Train against a declared perturbation problem

The robust objective asks the learner to minimize the expected largest loss over the permitted perturbations of each example. The inner search usually produces an approximate adversarial candidate rather than the exact maximum. The outer update then uses the chosen objective and model state. Record attack iterations, step sizes, restarts, initialization, precision, and model mode during generation. A change in batch-normalization or stochastic-layer behavior can change the inner target without changing the model architecture.

The candidate generator should not use test labels for model selection or mix final evaluation examples into training. Preserve train, validation, and final test roles across source data and any synthetic or additional data. A clean-adversarial mixture changes the effective training distribution; simply adding more attacked copies of frequent classes can alter class balance. State whether the coefficient applies per example, per batch, or through sampling frequency, because unequal batch sizes and denominators can make those implementations differ.

A mixture of label losses is not the same as penalizing changes in the model’s predictive distribution. A TRADES-style objective combines clean classification loss with a worst-case divergence between clean and perturbed predictions. This encourages local distributional consistency while maintaining a separate term tied to labels. The weight convention varies across descriptions; declare whether a parameter multiplies or divides the penalty before comparing values across implementations.

Neither formulation removes the need to check semantic label validity within the training threat. If an allowed transformation genuinely changes the task label, forcing the old label everywhere can teach the wrong invariance. Also distinguish adversarial training from ordinary random data augmentation. Random transforms sample an augmentation distribution, while an adversarial inner loop searches for difficult candidates under its stated objective. Their compute costs and covered cases can differ even when they apply the same transformation family.

Measure clean accuracy, attack-survival accuracy, and relevant subgroup behavior on held-out examples. Use attack variants that differ from the training generator, including stronger iteration and restart budgets when feasible. Training-time candidate generation may be intentionally cheaper than final evaluation, so compare both. If robustness drops sharply under a different loss or derivative treatment, inspect whether the learned model exploited the training attack’s weaknesses instead of establishing broad resistance within the stated set.

Publish the complete training recipe and selected checkpoint policy. Early stopping on clean validation accuracy, robust validation accuracy, or a weighted decision metric can select different artifacts. Record auxiliary data provenance, normalization, randomness, and the final evaluator’s exact threat. Do not generalize a measured benefit under one norm or epsilon to spatial transformations, corruptions, or semantic edits that the experiment never tested. A stronger training recipe changes empirical evidence, while certification remains a separate kind of result.