Structured Confidence Perturbation via Fisher Geometry for Adversarial Training

Summary

Adversarial training often produces "pseudo-attacks" that raise the loss without truly altering a model's confidence structure. The authors propose a hybrid objective combining cross-entropy and KL divergence, plus perturbations that maximize distribution distance on the confidence manifold, with the optimal direction aligned to principal eigenvectors of the Fisher information matrix. Experiments across multiple datasets and architectures report better adversarial robustness and transferability, especially against structural perturbations in high-confidence regions.

Related items

• LowYour Robot's Safety Functions Already Work. What If the Input Lies?Similar attack · VicOne Blog
• LowMeasuring Robustness and Efficiency in a Connectome-Constrained Fly Visual System Model: Linking an Adversarial and a Perceptual IllusionSimilar attack · Arxiv (cs.RO + cs.CV security)
• InfoA Layer-wise Study of How Style Rewriting Breaks the Calibration of Zero-Shot LLM Fake-News DetectorsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoEvaluating the robustness of explainable AI methods to adversarial attacks in intrusion and malware detectionSimilar attack · OpenAlex (peer-reviewed AI security)
• InfoRL-ATTACK: A Generalized Black-Box Adversarial Attack on Language Models via Reinforcement LearningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)