{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,16]],"date-time":"2026-10-16T19:36:06Z","timestamp":1792179366077,"version":"4.4.0"},"reference-count":35,"publisher":"Springer Science and Business Media LLC","issue":"6","license":[{"start":{"date-parts":[[2024,1,10]],"date-time":"2024-01-10T00:00:00Z","timestamp":1704844800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2024,1,10]],"date-time":"2024-01-10T00:00:00Z","timestamp":1704844800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Mach Learn"],"published-print":{"date-parts":[[2024,6]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Adversarial training (AT) has been widely recognized as the most effective defense approach against adversarial attacks on deep neural networks and it is formulated as a min-max optimization. Most AT algorithms are geared towards research-oriented datasets such as MNIST, CIFAR10, etc., where the labels are generally correct. However, noisy labels, e.g., mislabelling, are inevitable in real-world datasets. In this paper, we investigate AT with inherent label noise, where the training dataset itself contains mislabeled samples. We first empirically show that the performance of AT typically degrades as the label noise rate increases. Then, we propose a <jats:italic>Noisy-Robust Adversarial Training<\/jats:italic> (NRAT) algorithm, which leverages the recent advancements in learning with noisy labels to enhance the performance of AT in the presence of label noise. For experimental comparison, we consider two essential metrics in AT: (i) trade-off between natural and robust accuracy; (ii) robust overfitting. Our experiments show that NRAT\u2019s performance is on par with, or better than, the state-of-the-art AT methods on both evaluation metrics. Our code is\u00a0publicly available at: <jats:ext-link xmlns:xlink=\"http:\/\/www.w3.org\/1999\/xlink\" ext-link-type=\"uri\" xlink:href=\"https:\/\/github.com\/TrustAI\/NRAT\">https:\/\/github.com\/TrustAI\/NRAT<\/jats:ext-link>.<\/jats:p>","DOI":"10.1007\/s10994-023-06437-3","type":"journal-article","created":{"date-parts":[[2024,1,10]],"date-time":"2024-01-10T17:02:27Z","timestamp":1704906147000},"page":"3589-3610","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":7,"title":["Nrat: towards adversarial training with inherent label noise"],"prefix":"10.1007","volume":"113","author":[{"given":"Zhen","family":"Chen","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Fu","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ronghui","family":"Mu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Peipei","family":"Xu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiaowei","family":"Huang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8311-8738","authenticated-orcid":false,"given":"Wenjie","family":"Ruan","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2024,1,10]]},"reference":[{"key":"6437_CR1","unstructured":"Amid, E., Warmuth, M.K., Anil, R. & Koren, T. (2019). Robust bi-tempered logistic loss based on bregman divergences. Advances in Neural Information Processing Systems 32"},{"key":"6437_CR2","unstructured":"Athalye, A., Carlini, N. & Wagner, D.A. (2018). Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In Proceedings of the 35th International Conference on Machine Learning, ICML 2018, Stockholmsm\u00e4ssan, Stockholm, Sweden, July 10\u201315, 2018, pp. 274\u2013283. PMLR"},{"key":"6437_CR3","doi-asserted-by":"publisher","unstructured":"Carlini, N. & Wagner, D. (2017). Towards evaluating the robustness of neural networks. In 2017 IEEE symposium on security and privacy (SP) (pp. 39\u201357). https:\/\/doi.org\/10.1109\/SP.2017.49.","DOI":"10.1109\/SP.2017.49"},{"key":"6437_CR4","unstructured":"Croce, F. & Hein, M. (2020) Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning (pp. 2206\u20132216). PMLR."},{"key":"6437_CR5","unstructured":"Croce, F., Andriushchenko, M., Sehwag, V., Debenedetti, E., Flammarion, N., Chiang, M., Mittal, P. & Hein, M. (2020). Robustbench: a standardized adversarial robustness benchmark. arXiv preprint arXiv:2010.09670"},{"key":"6437_CR6","unstructured":"Devlin, J., Chang, M.-W., Lee, K. & Toutanova, K. (2018). Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805"},{"key":"6437_CR7","unstructured":"Dong, Y., Xu, K., Yang, X., Pang, T., Deng, Z., Su, H. & Zhu, J. (2021) Exploring memorization in adversarial training. arXiv preprint arXiv:2106.01606."},{"key":"6437_CR8","doi-asserted-by":"crossref","unstructured":"Feng, L., Shu, S., Lin, Z., Lv, F., Li, L. & An, B. (2021). Can cross entropy loss be robust to label noise?. In Proceedings of the twenty-ninth international conference on international joint conferences on artificial intelligence (pp. 2206\u20132212).","DOI":"10.24963\/ijcai.2020\/305"},{"key":"6437_CR9","doi-asserted-by":"crossref","unstructured":"Ghosh, A., Kumar, H. & Sastry, P.S.: (2017). Robust loss functions under label noise for deep neural networks. In Proceedings of the AAAI conference on artificial intelligence (vol. 31).","DOI":"10.1609\/aaai.v31i1.10894"},{"key":"6437_CR10","unstructured":"Goodfellow, I.J., Shlens, J. & Szegedy, C. (2014). Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572"},{"key":"6437_CR11","unstructured":"Han, B., Yao, Q., Yu, X., Niu, G., Xu, M., Hu, W., Tsang, I. & Sugiyama, M. (2018). Co-teaching: Robust training of deep neural networks with extremely noisy labels. Advances in Neural Information Processing Systems 31"},{"key":"6437_CR12","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S. & Sun, J. (2016). Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition (pp. 770\u2013778).","DOI":"10.1109\/CVPR.2016.90"},{"key":"6437_CR13","doi-asserted-by":"crossref","unstructured":"Jin, G., Yi, X., Huang, W., Schewe, S. & Huang, X. (2022). Enhancing adversarial training with second-order statistics of weights. In Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (pp. 15273\u201315283).","DOI":"10.1109\/CVPR52688.2022.01484"},{"key":"6437_CR14","doi-asserted-by":"crossref","unstructured":"Kim, Y., Yim, J., Yun, J. & Kim, J. (2019). Nlnl: Negative learning for noisy labels. In Proceedings of the IEEE\/CVF international conference on computer vision (pp. 101\u2013110).","DOI":"10.1109\/ICCV.2019.00019"},{"key":"6437_CR15","doi-asserted-by":"crossref","unstructured":"Li, Y., Yang, J., Song, Y., Cao, L., Luo, J. & Li, L.-J. (2017). Learning from noisy labels with distillation. In Proceedings of the IEEE International Conference on Computer Vision (ICCV).","DOI":"10.1109\/ICCV.2017.211"},{"key":"6437_CR16","unstructured":"Ma, X., Huang, H., Wang, Y., Romano, S., Erfani, S. & Bailey, J. (2020). Normalized loss functions for deep learning with noisy labels. In International conference on machine learning (pp. 6543\u20136553). PMLR."},{"key":"6437_CR17","unstructured":"Madry, A., Makelov, A., Schmidt, L., Tsipras, D. & Vladu, A. (2017). Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083"},{"issue":"7540","key":"6437_CR18","doi-asserted-by":"publisher","first-page":"529","DOI":"10.1038\/nature14236","volume":"518","author":"V Mnih","year":"2015","unstructured":"Mnih, V., Kavukcuoglu, K., Silver, D., Rusu, A. A., Veness, J., Bellemare, M. G., Graves, A., Riedmiller, M., Fidjeland, A. K., Ostrovski, G., et al. (2015). Human-level control through deep reinforcement learning. Nature, 518(7540), 529\u2013533.","journal-title":"Nature"},{"key":"6437_CR19","unstructured":"Natarajan, N., Dhillon, I.S., Ravikumar, P.K., & Tewari, A. (2013). Learning with noisy labels. Advances in Neural Information Processing Systems 26 (2013)"},{"key":"6437_CR20","doi-asserted-by":"crossref","unstructured":"Papernot, N., McDaniel, P., Wu, X., Jha, S. & Swami, A. (2016). Distillation as a defense to adversarial perturbations against deep neural networks. In 2016 IEEE Symposium on Security and Privacy (SP) (pp. 582\u2013597). IEEE","DOI":"10.1109\/SP.2016.41"},{"key":"6437_CR21","unstructured":"Rice, L., Wong, E. & Kolter, Z. (2020). Overfitting in adversarially robust deep learning. In International conference on machine learning (pp. 8093\u20138104). PMLR"},{"key":"6437_CR22","unstructured":"Song, H., Kim, M., Park, D. & Lee, J.-G. (2019). How does early stopping help generalization against label noise?. arXiv preprint arXiv:1911.08059."},{"key":"6437_CR23","unstructured":"Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I. & Fergus, R. (2013). Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199"},{"key":"6437_CR24","doi-asserted-by":"publisher","DOI":"10.1016\/j.jhydrol.2023.129168","volume":"618","author":"T Turkeltaub","year":"2023","unstructured":"Turkeltaub, T., Mannheim, R., Furman, A., & Weisbrod, N. (2023). Elucidating the relationship between gaseous o2 and redox potential in a soil aquifer treatment system using data driven approaches and an oxygen diffusion model. Journal of Hydrology, 618, 129168.","journal-title":"Journal of Hydrology"},{"key":"6437_CR25","unstructured":"Wang, Y., Zou, D., Yi, J., Bailey, J., Ma, X. & Gu, Q. (2019). Improving adversarial robustness requires revisiting misclassified examples. In International conference on learning representations."},{"key":"6437_CR26","doi-asserted-by":"crossref","unstructured":"Wang, Y., Ma, X., Chen, Z., Luo, Y., Yi, J. & Bailey, J. (2019). Symmetric cross entropy for robust learning with noisy labels. In Proceedings of the IEEE\/CVF international conference on computer vision (pp. 322\u2013330).","DOI":"10.1109\/ICCV.2019.00041"},{"key":"6437_CR27","unstructured":"Wang, Z., Pang, T., Du, C., Lin, M., Liu, W. & Yan, S. (2023). Better diffusion models further improve adversarial training. arXiv preprint arXiv:2302.04638."},{"key":"6437_CR28","first-page":"2958","volume":"33","author":"D Wu","year":"2020","unstructured":"Wu, D., Xia, S.-T., & Wang, Y. (2020). Adversarial weight perturbation helps robust generalization. Advances in Neural Information Processing Systems, 33, 2958\u20132969.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"6437_CR29","unstructured":"Xiao, T., Xia, T., Yang, Y., Huang, C. & Wang, X. (2015). Learning from massive noisy labeled data for image classification. In Proceedings of the IEEE conference on computer vision and pattern recognition (pp. 2691\u20132699)."},{"key":"6437_CR30","doi-asserted-by":"crossref","unstructured":"Xu, W., Evans, D. & Qi, Y. (2017). Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv preprint arXiv:1704.01155","DOI":"10.14722\/ndss.2018.23198"},{"key":"6437_CR31","unstructured":"Zhang, H., Yu, Y., Jiao, J., Xing, E., El\u00a0Ghaoui, L. & Jordan, M. (2019). Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning (pp. 7472\u20137482). PMLR."},{"key":"6437_CR32","unstructured":"Zhang, J., Xu, X., Han, B., Liu, T., Niu, G., Cui, L. & Sugiyama, M. (2021). Noilin: Do noisy labels always hurt adversarial training? arXiv preprint arXiv:2105.14676."},{"key":"6437_CR33","unstructured":"Zhang, Z. & Sabuncu, M. (2018). Generalized cross entropy loss for training deep neural networks with noisy labels. Advances in Neural Information Processing Systems 31."},{"key":"6437_CR34","doi-asserted-by":"crossref","unstructured":"Zheng, G., Awadallah, A.H., Dumais, S. (2021). Meta label correction for noisy label learning. In Proceedings of the AAAI conference on artificial intelligence, (vol. 35, pp. 11053\u201311061).","DOI":"10.1609\/aaai.v35i12.17319"},{"key":"6437_CR35","unstructured":"Zhu, J., Zhang, J., Han, B., Liu, T., Niu, G., Yang, H., Kankanhalli, M., & Sugiyama, M. (2021). Understanding the interaction of adversarial training with noisy labels. arXiv preprint arXiv:2102.03482."}],"container-title":["Machine Learning"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10994-023-06437-3.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10994-023-06437-3\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10994-023-06437-3.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,5,10]],"date-time":"2024-05-10T15:11:33Z","timestamp":1715353893000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10994-023-06437-3"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,1,10]]},"references-count":35,"journal-issue":{"issue":"6","published-print":{"date-parts":[[2024,6]]}},"alternative-id":["6437"],"URL":"https:\/\/doi.org\/10.1007\/s10994-023-06437-3","relation":{},"ISSN":["0885-6125","1573-0565"],"issn-type":[{"value":"0885-6125","type":"print"},{"value":"1573-0565","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,1,10]]},"assertion":[{"value":"2 June 2023","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"21 August 2023","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"7 October 2023","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"10 January 2024","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}},{"value":"This work does not involve any human or animal subjects so has no ethical concerns.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethics approval"}},{"value":"Not applicable","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent to participate"}},{"value":"Not applicable","order":5,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent for publication"}}]}}