ExGrad：对抗训练中显式减去干净梯度以提升鲁棒性
ExGrad: Beyond Suppression - Explicit Clean-Gradient Subtraction in Adversarial Training
arXiv 上新出的对抗训练方法 ExGrad，靠减掉一部分干净梯度，在 CIFAR-100 和 ImageNet-100 上把 AutoAttack 鲁棒准确率实实在在抬了一截，做鲁棒性的可以看。
ExGrad（extrapolative gradient recomposition）方法同时构造干净输入、对抗输入和对抗权重扰动（AWP）三种梯度，通过虚拟步骤测量它们对对抗边际的响应，并用一个有界仿射域上的三变量优化问题选取系数。在 CIFAR-10 上，当仿射半径增大时，负的干净梯度系数迅速占主导且幅值增加。在 CIFAR-100 的 R=0.8 设定下，ExGrad 将干净准确率和 AutoAttack 准确率分别提升 3.84 和 1.75 个百分点。在 ImageNet-100 相同半径下，其四项鲁棒指标均超过 AWP 和 PGD-AT。对照实验表明单纯置零干净系数并不足够，温和的减法才能带来 PGD-20 提升。
ExGrad: Beyond Suppression - Explicit Clean-Gradient Subtraction in Adversarial Training
Adversarial training derives updates from surrogate losses, but source-loss descent does not directly characterize an update's effect on adversarial margins. We introduce ExGrad (extrapolative gradient recomposition), which constructs clean-input, adversarial-input, and adversarial-weight-perturbed (AWP) gradients. Virtual steps measure their margin responses, and a globally solvable three-variable problem selects coefficients over a bounded affine domain without nonnegativity constraints. Across affine radii on CIFAR-10, negative clean coefficients rapidly predominate and increase in magnitude with the radius. Cross-zero interventions show that setting the clean coefficient to zero is insufficient: mild subtraction improves PGD-20, while stronger subtraction trades clean accuracy for further PGD-20 gains. In CIFAR-10 WRN-28-4 controls, none of the three candidate-removal variants matches full ExGrad. Projection diagnostics show that negative clean coefficients usually coexist with positive net clean-axis projections, although both decrease as the radius grows. Norm-matched controls indicate that update magnitude alone does not explain the moderate-radius gains. Experiments on CIFAR-10, CIFAR-100, and ImageNet-100 show radius-dependent improvements over AWP. On CIFAR-100, ExGrad at $R=0.8$ improves all five reported metrics, including clean and AutoAttack accuracy by 3.84 and 1.75 percentage points. On ImageNet-100, the same radius improves all four robust metrics over both AWP and PGD-AT. These results identify clean-gradient subtraction as a response-revealed update preference whose strength and clean-robust operating point are controlled by the affine radius.
