Adversarial Training

If a model fails on inputs an attacker constructs, train it on those inputs. Each step generates the worst perturbation it can find and learns from that instead of the clean example. It is the only defence that has held up across a decade of papers, and it costs several times an ordinary training run.

The cost is structural: generating each adversarial example needs its own inner optimisation, so a k-step attack multiplies training cost by roughly k. Weaker attacks train faster and produce models that only look robust — gradient masking makes the attack fail rather than the model succeed, which is why any defence should be evaluated against attacks stronger than the ones it trained on.

Minimise E[max over ‖δ‖ ≤ ε of L(f(x+δ), y)] — a saddle-point problem where the inner maximisation is approximated by projected gradient ascent. The approximation quality is the defence's quality: an inner maximiser that finds a poor δ gives an outer objective that was never adversarial in the first place.