Latent Adversarial Training

Adversarial training protects the input layer. We show the damage simply moves inward, and that attacking, then hardening, the latent layers recovers several points of robust accuracy.

Paper (IJCAI 2019)Code

Motivation

Adversarial training is the one defence that has reliably survived contact with stronger attacks. But it is defined entirely at the input: perturb the pixels, minimise the worst-case loss. Nothing in that objective says the network's internal representations have to be stable.

We probed the latent layers of adversarially trained models directly and found exactly that gap. The features are considerably less robust than the input-level guarantee suggests: small perturbations applied to an intermediate activation flip the prediction even when no input-space attack of comparable strength can.

Method

Latent Attack (LA)

An ℓ_∞ attack that constructs perturbations at an intermediate feature layer rather than at the input. Because it works where the model is weakest, it outperforms standard PGD on adversarially trained models across the datasets we tested.

Latent Adversarial Training (LAT)

A fine-tuning step, not a retrain. Starting from an already adversarially trained model, LAT alternates input-space and latent-space perturbations, so the objective now covers both the pixels and the features they produce. It is cheap: a short fine-tune on top of an existing robust checkpoint.

We validated on MNIST, CIFAR-10, CIFAR-100, SVHN and Restricted ImageNet.

What we found

Robustness is not uniform through depth. Intermediate layers of adversarially trained models remain attackable well after the input layer has been hardened.
LAT adds 4–6% robust accuracy. On CIFAR-10 and CIFAR-100, fine-tuning with latent perturbations improves adversarial accuracy over the adversarially trained baseline it starts from.
LA beats PGD on robust models. Attacking the latent space finds failures that input-space PGD of the same budget misses, which means published robustness numbers measured with PGD alone are optimistic.

Takeaways

If you only defend the input, you only measure the input. Evaluating and training at intermediate layers gives both a stricter robustness estimate and a cheap way to improve it: no architecture changes, no training from scratch.