Pseudo-Attacks: Fisher Geometry for Stronger Adversarial Training

This week I read Structured Confidence Perturbation via Fisher Geometry for Adversarial Training by Chenlong Wei, Hanling Wang, Chong Zhang, Qinkai Yu, Fangyu Wu and Xiaobo Jin, from Xi'an Jiaotong-Liverpool University, UC San Diego and the University of Exeter (Hugging Face page, code). It's a preprint posted November 10, 2026.

Most of what I write about is agents and LLMs. This one goes back to a classic: adversarial examples against image classifiers, and the standard defense, adversarial training. The paper's point is simple. If the attacks you train on are weak in a specific way, your model learns to resist weak attacks.

Summary

Adversarial training builds attacked copies of training images and teaches the model to classify them correctly. The usual recipe crafts each attack by pushing up the loss on the true label. The authors argue that this often produces pseudo-attacks: the loss goes up, but the model's top prediction doesn't change, and the overall shape of its confidence across classes stays intact.

They propose two fixes. SPP (Single Point Perturbation) adds a KL divergence term to the attack, so each attacked example also has to shift the whole output distribution. SCP (Structured Confidence Perturbation) goes further and pushes each input in the direction that changes the model's output distribution the most, which turns out to be the top eigenvector of the Fisher information matrix. Both improve robustness in most of the paper's tests, with clear exceptions.

What the Authors Did

Defining the problem. A pseudo-attack is a perturbation that raises the loss but leaves the predicted class the same. The paper argues these don't really test the model near its decision boundary, so training on them leaves weak spots in place.

Fix 1: a hybrid attack loss (SPP). Instead of maximizing cross-entropy alone, the attack maximizes cross-entropy plus the KL divergence between the model's clean and attacked outputs. The first term pushes toward a wrong answer, and the second distorts the whole confidence distribution. TRADES also uses KL: it builds its attacks by maximizing KL alone and adds KL as a training regularizer. SPP builds its attacks from cross-entropy plus KL, then trains with plain cross-entropy on clean plus attacked examples.

Fix 2: attacks on the confidence manifold (SCP). For small perturbations, the KL divergence between the clean and attacked outputs is approximately ½ δᵀF(x)δ, where F(x) is the Fisher information matrix with respect to the input. So the most damaging direction of a fixed size is the matrix's principal eigenvector. SCP takes one signed step of size ε in that direction.

Making it affordable. The Fisher matrix is d × d, where d is the number of input pixel values (3,072 for a CIFAR image). But it has rank at most K, the number of classes. The authors decompose a small K × K matrix instead and map its top eigenvector back. That cuts time complexity from O(Kd² + d³) to O(dK² + K³), and space from O(d²) to O(dK).

The setup.

• Datasets: CIFAR-10, CIFAR-100 and Tiny-ImageNet (200 classes)
• Models: ResNet-18, ResNet-34 and ResNet-50, plus DenseNet-121 and ViT-B/16 on CIFAR-10
• Training: 100 epochs, batch size 32, perturbation budget 8/255
• Evaluation: CW-10 and AutoAttack with an L2 budget of 0.5. The main metrics are clean accuracy, robust accuracy under AutoAttack, and attack success rate (ASR, lower is better)
• Baselines: PGD, TRADES and six FGSM-family variants, plus six recent methods on CIFAR-10

Findings With Numbers

CIFAR-10 is the strongest result. SCP had the best AutoAttack accuracy on all three ResNets: 70.47%, 71.50% and 72.50%. On ResNet-50, its attack success rate was 12.90%, against 19.34% for TRADES and 17.10% for PGD, while clean accuracy stayed at 83.24%.

It beats the recent baselines it lists. On CIFAR-10 ResNet-18, SCP reached 70.47% AutoAttack accuracy and SPP 70.15%, both above the strongest listed recent method, GAWP, at 68.89%. ASR was 14.35% for SPP and 14.78% for SCP, against 18.88% for RAMP.

The KL term does real work. On CIFAR-10 ResNet-18:

The authors also varied the KL weight from 0.1 to 2.0 and report stable results.

Transfer robustness is consistent. The authors built AutoAttack examples on ResNet-18 models trained with PGD, TRADES and PIFGSM, then tested them on DenseNet-121 and ViT-B/16 targets. Targets trained with SCP had the best robust accuracy in every pairing, for example 94.65% on DenseNet-121 and 93.10% on ViT-B/16 against PGD-sourced examples.

SCP flattens the sensitive direction. The median top Fisher eigenvalue on CIFAR-10 ResNet-18 was 0.0287 for SCP, against 0.1438 for PGD and 0.3011 for TRADES. A lower value means the output changes less sharply along the most sensitive input direction.

It escapes the high-confidence plateau. In a t-SNE plot of CIFAR-10 features, many CW adversarial examples stayed near confidence 1.0, which the authors read as pseudo-attacks. SCP examples dropped sharply in confidence. This evidence is visual, not a measured rate.

The wins aren't uniform. From the paper's own tables:

• Tiny-ImageNet: SPP beat SCP on clean accuracy at every depth. The authors blame noisier Fisher estimates with 200 classes and underfitting. PGD (ResNet-34) and PIFGSM (ResNet-50) had a lower ASR than both new methods
• CIFAR-100: on ResNet-18 and ResNet-34, PIFGSM's AutoAttack accuracy (32.66% and 33.68%) was a bit higher than SCP's (32.38% and 32.90%)
• ViT-B/16: every method dropped. MIFGSM reached 52.39% AutoAttack accuracy, ahead of SCP at 46.94% and SPP at 45.37%, though SCP still had the lowest ASR at 29.09%. ViT gradients were the noisiest measured, with relative variation of 0.345 against 0.247 for ResNet-18

Limitations

What the paper says itself:

• Fisher estimates get noisy. With many classes, or with noisy gradients as in ViT-B/16, the principal direction is less reliable and SCP weakens
• Underfitting hurts SCP. Its single-step perturbation assumes a well-trained confidence manifold
• ViTs need more work. The authors say no current method, theirs included, reaches strong robustness on ViTs trained from scratch on CIFAR-10 without architectural changes

From my own reading:

• The threat model is narrower than usual. Robust accuracy uses AutoAttack with an L2 budget of 0.5, not the common L-infinity 8/255 benchmark. AutoAttack accuracy is also higher than CW-10 accuracy in most rows, which surprised me since AutoAttack is normally the harder test. I'd want standard L-infinity AutoAttack numbers before comparing to leaderboards
• Comparisons may not share a protocol. Several recent baselines are on PreActResNet-18, and the paper doesn't say whether they were rerun under the same evaluation
• No error bars. I didn't find seeds or variance reported, so small gaps such as a few tenths of a point on CIFAR-100 may be noise
• Small images only, and a preprint. The largest dataset is Tiny-ImageNet at 64 × 64, and the work hasn't been peer reviewed yet

My Takeaways

The authors' own claim is that robustness should come from a stable confidence distribution, not just a higher loss on the true label. Here's what I'd take from it if I ran adversarial training:

1. Check whether your training attacks actually flip predictions. Log how often an attacked example still gets the original top-1 label. If it's often, you're training on pseudo-attacks
2. Add a distribution term to the attack. The KL term is a small change to the attack loss, and in the paper's ablation it added about 7.8 points of AutoAttack accuracy over cross-entropy alone (CIFAR-10, ResNet-18)
3. Test with more than one attack and threat model. Here the ranking changed between CW-10, AutoAttack, datasets and architectures. A single headline number would have hidden that
4. Don't assume CNN results carry over to transformers. The same methods dropped sharply on ViT-B/16
5. Measure transfer. Attackers often can't query your model directly, so check robustness against examples crafted on other models

For mapping, my team files this under OWASP ML01:2023 Input Manipulation Attack. In MITRE ATLAS (October 2026 data), the closest entries are AML.T0043 Craft Adversarial Data and mitigation AML.M0003 Predictive AI Model Hardening, which lists adversarial training. That mapping is ours; the paper doesn't use it.

The Bottom Line

An attack that raises the loss without changing the answer isn't much of an attack, and training on it gives you a model that's good at shrugging off weak attacks. This paper's fix is cheap to try, especially the KL term. Its biggest wins are on CIFAR-10 CNNs under an L2 test, so I'd check it under your own threat model before relying on it.

Sources

• Structured Confidence Perturbation via Fisher Geometry for Adversarial Training (arXiv, November 2026)
• Hugging Face paper page
• Authors' code repository
• OWASP ML01:2023 Input Manipulation Attack
• MITRE ATLAS data (AML.T0043, AML.M0003)

Read the full paper on arXiv. If you run adversarial training in production, I'd like to hear which attacks you train on. Reach me on X.