adversarial augmentation

**Adversarial Augmentation** is a **data augmentation approach that generates training samples by applying adversarial perturbations** — using gradient-based methods to find the perturbation that maximally increases the loss, then training on these worst-case examples. **Approaches to Adversarial Augmentation** - **FGSM Augmentation**: Add the sign of the gradient: $x' = x + epsilon cdot ext{sign}( abla_x mathcal{L})$. - **PGD Augmentation**: Multi-step projected gradient descent for stronger perturbations. - **Virtual Adversarial Training**: Find perturbation that maximally changes the output distribution (no labels needed). - **Adversarial Feature Augmentation**: Perturb in feature space rather than input space. **Why It Matters** - **Robustness**: Models trained with adversarial augmentation are more robust to adversarial attacks and natural corruptions. - **Regularization**: Acts as a strong regularizer, especially effective for small datasets. - **Trade-off**: Clean accuracy may decrease slightly in exchange for significant robustness gains. **Adversarial Augmentation** is **training against the worst case** — using gradient-based attacks as a data augmentation strategy for more robust models.