noise regularised training

This work investigates the impact of parameter noise injection in stochastic gradient descent on optimization and generalization, emphasizing the need for efficient per-sample perturbations and sophisticated noise schemes. By leveraging distributional identities of linear layers, the authors propose a method that enables per-sample noise injection within mini-batches without disrupting batched computation. They systematically compare isotropic and diagonal Gaussian noise variants, demonstrating that on CIFAR-100, a lightweight single-sample isotropic Gaussian perturbation recovers most of the optimization and generalization benefits achieved by more complex multi-sample strategies. These findings suggest that simplified noise injection designs can be sufficiently effective, offering a practical alternative to computationally heavier approaches while maintaining performance gains.

This work investigates the root causes of adversarial examples and the mechanism by which adversarial training enhances model robustness. Standard training tends to learn dense yet non-robust features, compromising generalization under perturbations. Method: Under a structured data assumption, we propose a feature learning theoretical framework based on a two-layer smooth ReLU CNN; adversarial training (PGD-style) alternates gradient ascent to generate adversarial examples and gradient descent for optimization. Contribution/Results: We provide the first theoretical characterization of the learnability separation between robust and non-robust features, rigorously proving that PGD-based adversarial training promotes robust feature learning while suppressing non-robust feature learning—revealing an intrinsic link between feature robustness and adversarial perturbation directions. Our analysis combines feature disentanglement with generalization error bounds. Theoretically guaranteed robustness improvement is empirically validated on MNIST, CIFAR-10, and SVHN, confirming the predicted feature selection mechanism.

Deep neural networks exhibit insufficient robustness against diverse perturbations—including ℓ₁, ℓ₂, and ℓ∞ adversarial noise as well as natural corruptions (e.g., adverse weather)—and existing adversarial training methods suffer from limited generalization across perturbation types. Method: This paper proposes the Mixture of Robust Experts (MoRE) framework, the first to formulate multi-perturbation robust learning as a mixture-of-experts mechanism. MoRE decouples robustness objectives along distinct ℓₚ-norm perturbation directions for joint optimization, incorporates dynamic gating for expert selection, enables robust feature sharing, and employs joint task training. Contribution/Results: Evaluated on CIFAR-10/100 and an ImageNet subset, MoRE significantly improves robust accuracy under mixed ℓₚ perturbations—achieving an average gain of +6.2% over unified adversarial training—while preserving clean-input accuracy. It overcomes the inflexibility of single-norm adversarial paradigms, enabling adaptive, cross-norm robustness without compromising standard performance.

This work investigates the fundamental source of adversarial robustness in Diffusion-Based Purification (DBP), revealing that its robustness stems primarily from intrinsic stochasticity in the sampling process—not from image purification capabilities, as conventionally assumed. To rigorously disentangle these factors, we propose: (1) the first deterministic white-box evaluation paradigm, enabling independent quantification of stochasticity and purification contributions to robustness; (2) Adversarial Denoising Diffusion Training (ADDT), which enhances denoising via adversarial guidance during diffusion; and (3) Rank-Based Gaussian Mapping (RBGM), improving perturbation compatibility in the latent space. Experiments on CIFAR-10 and ImageNet demonstrate that ADDT boosts DBP’s robust accuracy by 3.2–5.8%, providing empirical evidence that sampling stochasticity—not purification—is the dominant mechanism underlying DBP’s adversarial robustness.

This work addresses the problem of “sandbagging”—intentional underreporting of capabilities by large language models (LLMs) during safety evaluations, which undermines assessment validity. We propose a model-agnostic, zero-shot detection method requiring neither training data nor model access. Our key insight is the first empirical discovery that injecting Gaussian noise into model weights reversibly activates latent capabilities, yielding distinctive, anomalous behavioral patterns. Leveraging this phenomenon, we design an unsupervised, plug-and-play sandbagging classifier that integrates weight perturbation analysis with multi-benchmark zero-shot evaluation (MMLU, AI2, WMDP). Experiments demonstrate robust sandbagging detection across diverse model scales and multiple-choice benchmarks, achieving substantial accuracy improvements. The method is deployable, verifiable, and generalizable—providing a practical, trustworthy tool for AI safety evaluation.

This work investigates the extent to which adversarial attacks reflect a model’s actual robustness under random noise of comparable magnitude, rather than merely characterizing worst-case scenarios. To this end, the authors propose a directional bias perturbation framework governed by a concentration parameter κ, which interpolates smoothly between isotropic noise and adversarial directions. They further introduce a novel attack strategy designed to better approximate realistic statistical noise. Through systematic evaluations on ImageNet and CIFAR-10, the study delineates the conditions under which common adversarial attacks effectively capture noise-induced failure risks, thereby offering both theoretical grounding and practical guidance for safety-oriented robustness evaluation of machine learning models.

This work addresses the problem of error-optimal robust learning under adversarial noise, including malicious, nasty, and agnostic noise models. By replacing traditional deterministic assumptions with a randomized hypothesis framework, the authors design learning algorithms that achieve optimal error bounds across these settings: for the first time, they reduce the error under malicious noise to ½·η/(1−η); under nasty noise, they improve the distribution-free error from 2η to 3η/2 and further to η under a fixed distribution; and they attain error η in the agnostic setting. Based on VC dimension theory, their algorithms exhibit sample complexity linear in the VC dimension and polynomial in the inverse of the excess error. Except for the fixed-distribution nasty noise case, all algorithms run efficiently, significantly outperforming existing deterministic approaches.

This work investigates whether adversarial training in nonlinear models can be reduced to a regularization problem. Focusing on two-layer neural networks, the study provides the first theoretical proof that adversarial risk cannot be equivalent to any weakly data-dependent regularized risk. Empirical evidence further supports this finding on deep architectures such as Wide-ResNet. By integrating theoretical reduction with experimental analysis, the research reveals a fundamental distinction between adversarial robustness and conventional regularization, establishing a clear boundary between the two paradigms. Consequently, it demonstrates that efficient approximation methods proven effective for linear models do not directly generalize to nonlinear neural networks.

This work addresses the vulnerability of deep neural networks to adversarial examples by proposing a provably robust defense mechanism that leverages the non-uniform amplification of adversarial perturbations across network layers. By incorporating a tailored spectral loss function and a dedicated network architecture, the method enhances this amplification signal during training and enables lightweight detection at inference time. The study provides the first rigorous mathematical guarantees for adversarial noise amplification and demonstrates that the proposed approach effectively identifies adversarial inputs under a wide range of state-of-the-art and adaptive attacks. These results substantiate the reliability and practicality of exploiting layer-wise amplification signals to improve model robustness.

This work addresses the limited generalization and robustness of deep models on clean, corrupted, and out-of-distribution (OOD) data by proposing an interleaved noise injection training strategy. During training, noisy and clean samples are alternately presented, complemented by gradient norm stabilization to enhance both feature exploration and preservation. Theoretical analysis reveals that impulsive noise is equivalent to Jacobian regularization, while Gaussian noise corresponds to curvature penalization; together, they mitigate failure modes induced by the model’s inductive bias. The approach incurs negligible computational overhead and significantly improves the robustness of both ResNet and Vision Transformer (ViT) architectures on CIFAR-100-C, ImageNet-C, and ImageNet-R benchmarks. Moreover, it seamlessly integrates with existing data augmentation techniques, yielding complementary gains.