Adversarial Augmentation is a data augmentation approach that generates training samples by applying adversarial perturbations — using gradient-based methods to find the perturbation that maximally increases the loss, then training on these worst-case examples.

Approaches to Adversarial Augmentation

• FGSM Augmentation: Add the sign of the gradient: $x' = x + epsilon cdot ext{sign}(

abla_x mathcal{L})$.

• PGD Augmentation: Multi-step projected gradient descent for stronger perturbations.
• Virtual Adversarial Training: Find perturbation that maximally changes the output distribution (no labels needed).
• Adversarial Feature Augmentation: Perturb in feature space rather than input space.

Why It Matters

• Robustness: Models trained with adversarial augmentation are more robust to adversarial attacks and natural corruptions.
• Regularization: Acts as a strong regularizer, especially effective for small datasets.
• Trade-off: Clean accuracy may decrease slightly in exchange for significant robustness gains.

Adversarial Augmentation is training against the worst case — using gradient-based attacks as a data augmentation strategy for more robust models.