Structured Confidence Perturbation via Fisher Geometry for Adversarial Training
The authors target “pseudo-attacks” that raise a model’s loss without meaningfully changing its confidence structure.
They propose a hybrid objective combining cross-entropy and KL divergence to disrupt both prediction accuracy and distribution consistency. A second approach generates perturbations that maximize distance on the confidence manifold, with theoretical analysis linking the optimal direction to principal eigenvectors of the Fisher information matrix. An efficient algorithm avoids high-dimensional matrix computations. Across multiple datasets and architectures, the authors report improved adversarial robustness and robust transferability, particularly for structural perturbations in high-confidence regions.
HF Daily Papers' note
They propose a hybrid objective combining cross-entropy and KL divergence to disrupt both prediction accuracy and distribution consistency. A second approach generates perturbations that maximize distance on the confidence manifold, with theoretical analysis linking the optimal direction to principal eigenvectors of the Fisher information matrix. An efficient algorithm avoids high-dimensional matrix computations. Across multiple datasets and architectures, the authors report improved adversarial robustness and robust transferability, particularly for structural perturbations in high-confidence regions.
HF Daily Papers' note
score 4