AWP (Adversarial Weight Perturbation) is a robust training technique that perturbs both the input AND the model weights during adversarial training — the weight perturbation flattens the loss landscape, leading to smoother minima that generalize better to unseen adversarial examples.

How AWP Works

• Standard AT: Only perturbs inputs — finds worst-case input perturbation $delta$.
• AWP: Additionally perturbs weights $ heta$ — finds worst-case weight perturbation $gamma$.
• Double Max: $min_ heta max_gamma max_delta L(f_{ heta+gamma}(x+delta), y)$ — perturb both weights and inputs.
• Flat Minima: Weight perturbation drives the model toward flat loss landscapes, improving adversarial generalization.

Why It Matters

• Robust Overfitting: Standard adversarial training suffers from robust overfitting — AWP mitigates this.
• State-of-Art: AWP consistently improves adversarial accuracy on top of AT, TRADES, or MART.
• Plug-In: AWP can be added to any adversarial training method as a simple augmentation.

AWP is shaking the model AND the input — double perturbation drives the model to flat, robust loss landscapes that resist adversarial overfitting.