Perturbation diversity certificates robust generalization

Zhuang Qian, Shufei Zhang, Kaizhu Huang*, Qiufeng Wang, Xinping Yi, Bin Gu, Huan Xiong

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review


Whilst adversarial training has been proven to be one most effective defending method against adversarial attacks for deep neural networks, it suffers from over-fitting on training adversarial data and thus may not guarantee the robust generalization. This may result from the fact that the conventional adversarial training methods generate adversarial perturbations usually in a supervised way so that the resulting adversarial examples are highly biased towards the decision boundary, leading to an inhomogeneous data distribution. To mitigate this limitation, we propose to generate adversarial examples from a perturbation diversity perspective. Specifically, the generated perturbed samples are not only adversarial but also diverse so as to certify robust generalization and significant robustness improvement through a homogeneous data distribution. We provide theoretical and empirical analysis, establishing a foundation to support the proposed method. As a major contribution, we prove that promoting perturbations diversity can lead to a better robust generalization bound. To verify our methods’ effectiveness, we conduct extensive experiments over different datasets (e.g., CIFAR-10, CIFAR-100, SVHN) with different adversarial attacks (e.g., PGD, CW). Experimental results show that our method outperforms other state-of-the-art (e.g., PGD and Feature Scattering) in robust generalization performance.

Original languageEnglish
Article number106117
JournalNeural Networks
Publication statusPublished - Apr 2024


  • Adversarial examples
  • Adversarial robustness
  • Robust generalization


Dive into the research topics of 'Perturbation diversity certificates robust generalization'. Together they form a unique fingerprint.

Cite this