mart

**MART** (Misclassification-Aware Adversarial Training) is a **robust training method that differentially treats correctly classified and misclassified examples during adversarial training** — focusing more training effort on misclassified examples, which are the most vulnerable to adversarial perturbation. **MART Formulation** - **Key Insight**: Misclassified examples are more important for robustness than correctly classified ones. - **Loss**: Uses a boosted cross-entropy loss that up-weights misclassified adversarial examples. - **KL Term**: Adds a KL divergence term weighted by $(1 - p(y|x))$ — higher weight for less confident (more vulnerable) predictions. - **Adaptive**: Automatically focuses training on the "hardest" examples without manual importance weighting. **Why It Matters** - **Targeted Defense**: Instead of treating all training examples equally, MART focuses on the most vulnerable points. - **Improved Robustness**: MART improves adversarial robustness over standard AT and TRADES on several benchmarks. - **Complementary**: MART's insights can be combined with other robust training methods. **MART** is **smart adversarial training** — focusing defensive effort on the examples most likely to be adversarially exploited.