Rethinking Fake Adversarial Examples for Single-Step Adversarial Training

Abstract

Adversarial training (AT) is a widely adopted defense against adversarial attacks, but its multi-step optimization process for generating adversarial examples leads to substantial computational overhead. To mitigate this, various single-step adversarial training methods have been proposed. However, these models often suffer from catastrophic overfitting under larger perturbations and exhibit degraded robustness. The core issue is that certain single-step adversarial examples, although successfully learned and correctly classified, fail to expose the true vulnerabilities of models. We refer to these misleading examples as “fakers”. Specifically, we find that fakers exhibit three distinct characteristics compared to standard adversarial examples: 1) they unexpectedly degrade the model robustness rather than improve it; 2) they make it harder for the model to learn their robust features; and 3) they show significantly greater divergence from their clean counterparts. These observations motivate us to proactively reduce the impact of fakers during training. To this end, we propose the Faker-Alleviating Single-step adversarial Training method (FAST), a general and effective framework designed to enhance both accuracy and robustness. Concretely, FAST consists of two main components. First, it dynamically adjusts the label-smoothing level for adversarial examples according to their learning difficulty, making fakers easier for the model to learn. Second, it introduces an auxiliary sample with a weak adversarial effect, derived from the single-step adversarial example, which is used to dynamically ease the alignment with clean data and stabilize the optimization process. We demonstrate the effectiveness of FAST through extensive experiments, showing that our method achieves superior clean accuracy and robustness against various types of adversarial attacks. The code is available at https://github.com/mesunhlf/FAST.