adversarial weight perturbation

**AWP** (Adversarial Weight Perturbation) is a **robust training technique that perturbs both the input AND the model weights during adversarial training** — the weight perturbation flattens the loss landscape, leading to smoother minima that generalize better to unseen adversarial examples. **How AWP Works** - **Standard AT**: Only perturbs inputs — finds worst-case input perturbation $delta$. - **AWP**: Additionally perturbs weights $ heta$ — finds worst-case weight perturbation $gamma$. - **Double Max**: $min_ heta max_gamma max_delta L(f_{ heta+gamma}(x+delta), y)$ — perturb both weights and inputs. - **Flat Minima**: Weight perturbation drives the model toward flat loss landscapes, improving adversarial generalization. **Why It Matters** - **Robust Overfitting**: Standard adversarial training suffers from robust overfitting — AWP mitigates this. - **State-of-Art**: AWP consistently improves adversarial accuracy on top of AT, TRADES, or MART. - **Plug-In**: AWP can be added to any adversarial training method as a simple augmentation. **AWP** is **shaking the model AND the input** — double perturbation drives the model to flat, robust loss landscapes that resist adversarial overfitting.