{"id":29219694,"url":"https://github.com/dvlab-research/lbgat","last_synced_at":"2025-10-13T08:41:06.031Z","repository":{"id":44903259,"uuid":"314476228","full_name":"dvlab-research/LBGAT","owner":"dvlab-research","description":"Learnable Boundary Guided Adversarial Training (ICCV2021)","archived":false,"fork":false,"pushed_at":"2024-12-09T02:36:01.000Z","size":936,"stargazers_count":38,"open_issues_count":4,"forks_count":2,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-07-03T02:06:40.600Z","etag":null,"topics":["adversarial-attacks","adversarial-defense","adversarial-training","iccv2021","image-recognition","robustness"],"latest_commit_sha":null,"homepage":"https://arxiv.org/abs/2011.11164","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/dvlab-research.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-11-20T07:17:36.000Z","updated_at":"2025-04-07T13:39:33.000Z","dependencies_parsed_at":"2024-12-09T03:25:20.187Z","dependency_job_id":"918b02a4-e313-4efa-a417-6fd9240badcc","html_url":"https://github.com/dvlab-research/LBGAT","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/dvlab-research/LBGAT","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dvlab-research%2FLBGAT","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dvlab-research%2FLBGAT/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dvlab-research%2FLBGAT/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dvlab-research%2FLBGAT/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/dvlab-research","download_url":"https://codeload.github.com/dvlab-research/LBGAT/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dvlab-research%2FLBGAT/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279014326,"owners_count":26085492,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-13T02:00:06.723Z","response_time":61,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["adversarial-attacks","adversarial-defense","adversarial-training","iccv2021","image-recognition","robustness"],"created_at":"2025-07-03T02:06:40.170Z","updated_at":"2025-10-13T08:41:06.011Z","avatar_url":"https://github.com/dvlab-research.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# News\n* Our paper [\"Decoupled Kullback-Leibler Divergence Loss\"](https://arxiv.org/pdf/2305.13948) is accepted by **NeurIPS 2024**.\n* Our new arXiv paper [\"Decoupled Kullback-Leibler (DKL) Divergence Loss\"](https://arxiv.org/pdf/2305.13948v1.pdf) achieves new state-of-the-art on **adversarial robustness**. [Code](https://github.com/jiequancui/DKL) is released.\n \n# Learnable Boundary Guided Adversarial Training \nThis repository contains the implementation code for the ICCV2021 paper:  \n**Learnable Boundary Guided Adversarial Training** (https://arxiv.org/pdf/2011.11164.pdf)\n\n\n# Updates: Training with Epsilon 8/255 on CIFAR-100\n| # | Method | Model | Natural Acc | Robust Acc (AutoAttack) | download |\n| :---: | :---: | :---: | :---: | :---: | :---: |\n| 1 | AWP                                                  | WRN-34-10 | **60.38** | **28.86** | - |\n| 2 | LBGAT-AWP                                            | WRN-34-10 | **62.31** | **30.44** | - | \n| 3 | LBGAT-AWP*                                           | WRN-34-10 | **62.99** | **31.20** | [model](https://drive.google.com/file/d/1g8M77pgE7fCe9KzqRBUkexBN-6mcHkV-/view?usp=share_link) / [log](https://drive.google.com/file/d/1h5fbbx48pw3S97VxAxSJXpK5_ecD7JGR/view?usp=sharing)  |  \n\n\n# Overview\nIn this paper, we proposed the \"Learnable Boundary Guided Adversarial Training\" to preserve high natural accuracy while enjoy strong robustness for deep models. An interesting phenomenon in our exploration shows that natural classifier boundary can benefit model robustness to some degree, which is different from the previous work that the improved robustness is at cost of performance degradation on natural data. **Our method creates new state-of-the-art model robustness on CIFAR-100 without extra real or Synthetic data under [auto-attack benchmark](https://robustbench.github.io/)**. \n\n![image](https://github.com/FPNAS/LBGAT/blob/main/assets/lbgat.jpg)\n\n## Results and Pretrained models\n\n  `  \nModels are evaluated under the strongest AutoAttack(https://github.com/fra31/auto-attack) with epsilon 0.031.\n\nOur CIFAR-100 models:  \n[CIFAR-100-LBGAT0-wideresnet-34-10](https://mycuhk-my.sharepoint.com/:u:/g/personal/1155116769_link_cuhk_edu_hk/Edce7FP6qe1Lm2FwkhOpO6kBGp76LKDHNAC1w2WW2KUCUw?e=7v6odA) 70.25 vs 27.16                                             \n[CIFAR-100-LBGAT6-wideresnet-34-10](https://mycuhk-my.sharepoint.com/:u:/g/personal/1155116769_link_cuhk_edu_hk/EYFj964RVGtAu9qhhgjGfXwBcddlY60Igka4LHOwNmyv6Q?e=8doAf6) 60.64 vs 29.33    \n[CIFAR-100-LBGAT6-wideresnet-34-20](https://mycuhk-my.sharepoint.com/:u:/g/personal/1155116769_link_cuhk_edu_hk/ERdITbIJVGhIvqeKA8Y4CgQBgYBnqi4jCgQpQ0qY3ZgOMA?e=22eY6M) 62.55 vs 30.20    \n\n\nOur CIFAR-10 models:  \n[CIFAR-10-LBGAT0-wideresnet-34-10](https://mycuhk-my.sharepoint.com/:u:/g/personal/1155116769_link_cuhk_edu_hk/EWve6ZRn81xNuLG8PkRwQqgB1OLjalRYT3EKVmoGEFqWrg?e=7GCcFR) 88.22 vs 52.86  \n[CIFAR-10-LBGAT0-wideresnet-34-20](https://mycuhk-my.sharepoint.com/:u:/g/personal/1155116769_link_cuhk_edu_hk/EQ0S18gA4pdChXoCLdcy2G8B7T9RYSoHlNDCP930aqigQQ?e=cQREW2) 88.70 vs 53.57  \n\n  \n## CIFAR-100 L-inf \nNote: this is one partial results list for comparisons with methods without using additional data up to 2020/11/25. Full list can be found at https://github.com/fra31/auto-attack. TRADES (alpha=6) is trained with official open-source code at https://github.com/yaodongyu/TRADES.  \n\n| # | Method | Model | Natural Acc | Robust Acc (AutoAttack) |  \n| :---: | :---: | :---: | :---: | :---: |\n| 1 | **LBGAT (Ours)**                                         | WRN-34-20 | **62.55** | **30.20** |   \n| 2 | [(Gowal et al. 2020)](https://arxiv.org/abs/2010.03593)  | WRN-70-16 | 60.86 | 30.03 |\n| 3 | **LBGAT (Ours)**                                         | WRN-34-10 | 60.64 | **29.33** |\n| 4 | [(Wu et al. 2020)](https://arxiv.org/abs/2004.05884)     | WRN-34-10 | 60.38 | 28.86 |\n| 5 | **LBGAT (Ours)**                                         | WRN-34-10 | **70.25** | 27.16 |\n| 6 | [(Chen et al. 2020)](https://arxiv.org/abs/2010.01278)   | WRN-34-10 | 62.15 | 26.94 |\n| 7 | [(Zhang et al. 2019)](https://arxiv.org/abs/1901.08573) **TRADES (alpha=6)**                                     | WRN-34-10 | 56.50 | 26.87 |\n| 8 | [(Sitawarin et al. 2020)](https://arxiv.org/abs/2003.09347)                                                      | WRN-34-10 | 62.82 | 24.57 |\n| 9 | [(Rice et al. 2020)](https://arxiv.org/abs/2002.11569)                                                           | RN-18     | 53.83 | 18.95 |\n\n\n## CIFAR-10 L-inf\nNote: this is one partial results list for comparisons with **previous published methods** without using additional data up to 2020/11/25. Full list can be found at https://github.com/fra31/auto-attack. TRADES (alpha=6) is trained with official open-source code at https://github.com/yaodongyu/TRADES. “*” denotes methods aiming to speed up adversarial training. \n\n| # | Method | Model | Natural Acc | Robust Acc (AutoAttack) |  \n| :---: | :---: | :---: | :---: | :---: |\n| 1 | **LBGAT (Ours)**                                         | WRN-34-20 | **88.70** | **53.57** |   \n| 2 | [(Zhang et al.)]()                                       | WRN-34-10 | 84.52\t| 53.51 |\n| 3 | [(Rice et al. 2020)]()                                   | WRN-34-20 | 85.34\t|\t53.42 |\n| 4 | **LBGAT (Ours)**                                         | WRN-34-10 | **88.22** | 52.86 |\n| 5 | [(Qin et al., 2019)]()                        \t          | WRN-40-8\t | 86.28\t|\t52.84 |\n| 6 | [(Zhang et al. 2019)](https://arxiv.org/abs/1901.08573) **TRADES (alpha=6)**                                     | WRN-34-10 | 84.92 | 52.64 |\n| 7 | [(Chen et al., 2020b)]()                                 |\tWRN-34-10\t| 85.32\t| 51.12 |\n| 8 | [(Sitawarin et al., 2020)]()                 \t           | WRN-34-10\t| 86.84\t| 50.72 |\n| 9 | [(Engstrom et al., 2019)]()\t                             | RN-50\t    | 87.03 |\t49.25 |\n| 10 | [(Kumari et al., 2019)]()             \t                 | WRN-34-10\t| 87.80\t| 49.12 |\n| 11 | [(Mao et al., 2019)]()\t                                 |\tWRN-34-10\t| 86.21\t| 47.41 |\n| 12 | [(Zhang et al., 2019a)]()\t                              | WRN-34-10\t| 87.20\t| 44.83 |\n| 13 | [(Madry et al., 2018)]() **AT**              \t          | WRN-34-10\t| 87.14\t| 44.04 |\n| 14 | [(Shafahi et al., 2019)]()*                     \t       | WRN-34-10\t| 86.11\t| 41.47 |\n| 14 | [(Wang \u0026 Zhang, 2019)]()*\t                              |\tWRN-28-10\t| **92.80**\t| 29.35 |\n\n\n# Get Started\n\nBefor the training, please create the directory 'Logs' via the command 'mkdir Logs'.\n\n## Training\n```\nbash sh/train_lbgat0_cifar100.sh\n```\n\n## Evaluation\nbefore running the evaluation, please download the pretrained model.\n```\nbash sh/eval_autoattack.sh\n```\n\n# Acknowledgements\nThis code is partly based on the [TRADES](https://github.com/yaodongyu/TRADES) and [autoattack](https://github.com/fra31/auto-attack).\n\n# Contact\nIf you have any questions, feel free to contact us through email (jiequancui@link.cuhk.edu.hk) or Github issues. Enjoy!\n\n# BibTex\nIf you find this code or idea useful, please consider citing our work:\n```\n@inproceedings{cui2021learnable,\n  title={Learnable boundary guided adversarial training},\n  author={Cui, Jiequan and Liu, Shu and Wang, Liwei and Jia, Jiaya},\n  booktitle={Proceedings of the IEEE/CVF International Conference on Computer Vision},\n  pages={15721--15730},\n  year={2021}\n}\n\n@article{cui2023decoupled,\n  title={Decoupled Kullback-Leibler Divergence Loss},\n  author={Cui, Jiequan and Tian, Zhuotao and Zhong, Zhisheng and Qi, Xiaojuan and Yu, Bei and Zhang, Hanwang},\n  journal={arXiv preprint arXiv:2305.13948},\n  year={2023}\n}\n\n```  \n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdvlab-research%2Flbgat","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdvlab-research%2Flbgat","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdvlab-research%2Flbgat/lists"}