Boosting Adversarial Robustness with CLAT: Criticality Leveraged Adversarial Training

Thank you for your thoughtful questions and suggestions. We address each point below.

Finetuning from beginning / CLAT for training: CLAT can indeed be applied from the beginning, without any prior training, as well as after standard adversarial training. This directly addresses your suggestion of using the identified layers during the main adversarial training process.

As shown in Figure 1 (see the “CLAT for 100 epochs” curve), training only the identified critical layers from scratch eventually surpasses baseline adversarial training methods—demonstrating that CLAT is not limited to post hoc fine-tuning. While convergence is slower, final performance is higher than PGD-AT, reinforcing the utility of these layers during training itself. Lines 315–325 in the main text and Figure 5 in the appendix further support this observation with full training trajectories.

Using TRADES instead of PGD-AT mirrors these trends, with CLAT consistently improving performance when applied from scratch or as a fine-tuning step (see finetuning results in Table 1 and Table 2). In summary, CLAT is not merely an add-on to existing methods, but a flexible and general mechanism for improving adversarial robustness, whether applied during or after training.

Different objective: Continuing to optimize the standard adversarial loss after the model has already been trained often leads to degradation in generalization on clean data—a well-documented issue in adversarial training. To address this, we introduce a joint objective in Stage 2 that combines cross-entropy loss with a criticality term (Equation 6). This encourages the model to reduce reliance on non-robust features within the most sensitive layers, while still preserving performance on clean inputs. This insight and formulation are discussed in lines 158–174 of the paper.

The balance between the two terms is controlled by the hyperparameter λ, which we find to be stable across datasets and architectures. In practice, λ enables a smooth trade-off between robustness-enhancing updates and accuracy-preserving behavior during fine-tuning.

More experiments to show identified layers are important: We believe our current experiments already provide strong support for the importance of the identified layers and reviewers eBwd and 9V5S both agree on the comprehensiveness of our evaluation. We conduct multiple ablations to highlight this, including: (1) comparing performance when fine-tuning critical versus random layers, (2) analyzing the effect of selecting layers with the lowest versus highest CIDX values, and (3) evaluating the consistency of selected critical layers across batch sizes and datasets for a fixed architecture—amongst several other results in the main paper and appendix.

Additionally, we provide evidence (see response on “consistency” to Reviewer 9V5S) that the identified critical layers remain consistent across different adversarial attacks used to compute them. We are happy to incorporate this into the appendix for completeness. Together, these experiments consistently demonstrate that the identified layers are not only meaningful, but central to CLAT’s improvements in both clean and adversarial accuracy.

Critical layer definition: Layer criticality refers to the extent to which individual layers contribute to adversarial vulnerability. We define this empirically by measuring how much each layer’s output changes when the input is perturbed adversarially—assigning higher scores to layers that exhibit larger activation shifts (Equation 5).

While the term “criticality” is new in this context, the idea relates to prior work on layerwise sensitivity, pruning, and fine-tuning for robustness [1]. However, such methods typically focus on redundancy reduction or apply global training updates. In contrast, CLAT introduces a novel, lightweight, and scalable mechanism to identify and leverage structurally important layers for improving adversarial robustness.

We present theoretical motivation and justification for this formulation in the Methods section and Appendix F, and Reviewer 8QH8 specifically noted the thoroughness of this explanation. We agree that a deeper theoretical understanding of certain phenomena—such as why specific layers consistently emerge as more critical—would be valuable, and we view this as an exciting direction for future work.

Nonetheless, our empirical results—including comparisons with random and non-critical layers, consistency across datasets, attacks, and batch sizes, and consistent performance gains—provide strong support for the validity and utility of our criticality measure.

Thank you for your thoughtful feedback and for recognizing the experimental rigor of our work. Below, we respond to each of your concerns and questions.

Novelty: Please see the “Novelty” section in our response to Reviewer 8QH8. For a concrete comparison, consider RiFT [1], a fine-tuning method that also updates a subset of layers. While effective, RiFT identifies redundant layers using weight perturbations, whereas CLAT uses input perturbations to identify layers most responsible for adversarial vulnerability. CLAT consistently outperforms RiFT and other baselines across datasets and architectures (see Tables 1 and 2).
If there are other methods the reviewer believes are directly comparable, we would be happy to clarify distinctions.

Further analysis: Thank you for highlighting this point. We analyze layer selection across models, datasets, and training settings—examining the number of layers selected and when fine-tuning should begin. We also include multiple ablation studies verifying the impact of selected layers. Our response to Reviewer 9V5S under “Cidx consistency” shows that critical indices remain stable regardless of perturbation type.

We agree that deeper insight into why certain layers emerge as more important—perhaps due to architectural roles or training dynamics—would be valuable. As our focus is on practical improvements to robustness, we limit scope accordingly.

Additional baselines: Our submission prioritized SOTA methods, strong threat models (e.g., PGD, AutoAttack), and widely adopted training protocols. Below, we compare against omitted fine-tuning methods using their best-performing models and original settings. As shown, CLAT outperforms these methods—even under stronger attacks.

Note: FGSM is substantially weaker than PGD due to its single-step nature.

Comparison with Additional Baselines

Clarifications:

• [3] Uses FGSM and perturbs all layers, with high overhead and limited robustness.
• [4] Superseded by stronger methods like Fast is Better than Free [10], which we include.
• [5] Underperforms under PGD.
• [6] Perturbs three fixed layers; does not adapt to model structure or input sensitivity.
• [7] Targets large-scale training; less relevant to models like ResNet-18, WRN-34-10.
• [8] Modifies BatchNorm; orthogonal to CLAT’s selective fine-tuning objective.
• [9] No longer SOTA, but CLAT improves its performance when combined.

Writing: Noted on writing style and complex phrasing. We will incorporate these refinements in the camera-ready version.

References
[3] Regularizing Deep Networks Using Efficient Layerwise Adversarial Training: Sankaranarayanan, S., Jain, A., Chellappa, R., & Lim, S. N. (2018). Proceedings of the AAAI Conference on Artificial Intelligence, 32(1).

[4] Free Adversarial Training with Heuristic Layerwise Perturbation: Zheng, H., Zhang, M., & Huang, H. (2020). arXiv preprint arXiv:2010.03131.

[5] Yang, Z., Liu, Y., Bao, C., & Shi, Z. (2020). Layer-wise Adversarial Defense: An ODE Perspective. International Conference on Learning Representations (ICLR).

[6] Reliably Fast Adversarial Training via Latent Adversarial Perturbation: Park, G. Y., & Lee, S. W. (2021). Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 7758-7767

[7] Intriguing Properties of Adversarial Training at Scale: Xie, C., & Yuille, A. (2019). arXiv preprint arXiv:1906.03787. https://arxiv.org/abs/1906.03787

[8] Adversarial Attacks and Batch Normalization: Muhammad, A., Shamshad, F., & Bae, S.-H. (2023). IEEE Access, 11, 96449-96459. https://doi.org/10.1109/ACCESS.2023.3250661

[9] Smooth Adversarial Training: Xie, C., Tan, M., Gong, B., Yuille, A., & Le, Q. V. (2021). arXiv preprint arXiv:2006.14536. https://arxiv.org/abs/2006.14536

[10] Wong, E., Rice, L., & Kolter, J. Z. (2020). Fast is better than free: Revisiting adversarial training. arXiv. https://arxiv.org/abs/2001.03994.

Thank you so much for your time! Below, we’ve provided detailed responses to each of your concerns and criticisms. We hope this helps clarify everything.

Experimental support and breadth of evaluation:
Respectfully, we disagree with the concern regarding insufficient experimental support. As also noted by Reviewers 9V5S and eBwd, our submission presents a comprehensive and thoughtfully designed evaluation. We test CLAT across four diverse datasets (CIFAR-10, CIFAR-100, Imagenette, and ImageNet), multiple CNN architectures, and in conjunction with several adversarial training methods, including state-of-the-art approaches from RobustBench. These include both models trained from scratch and partially pretrained models.

To our knowledge, CLAT is the first fine-tuning method that can also be applied from scratch, demonstrating flexibility across training regimes. Despite this broad applicability and strong performance, CLAT introduces negligible overhead, requiring no backward passes or gradient computations for layer selection. We further support our claims with targeted ablation studies that isolate the contribution of each component.

While we cannot exhaustively include every prior method, we carefully prioritized baselines that reflect challenging, high-performing adversarial training settings. Several well-regarded SOTA methods accepted at top-tier venues conduct fewer evaluations in terms of dataset and model diversity. If there are specific baselines or comparisons the reviewer would like us to include, we are happy to provide additional results or clarify their exclusion.

Finetuning method:
Yes, CLAT is a fine-tuning method by design—and this is a core strength. It introduces a layer-selective strategy that mitigates overfitting and consistently improves both clean and adversarial performance. The proposed criticality index identifies layers still learning non-robust features that benefit from continued optimization.

As a fine-tuning method, CLAT is modular, integrates easily into existing adversarial training pipelines, and adds minimal overhead. Its ability to be applied from scratch further highlights the relevance of the selected layers and the generality of the approach.

More broadly, fine-tuning and adversarial training are not mutually exclusive. Fine-tuning has emerged as a valuable direction for improving robustness and has been recognized at top-tier venues [1].

Novelty and ALP:
CLAT is, to our knowledge, the only method that achieves state-of-the-art robustness across diverse training setups, by fine-tuning fewer than 5% of parameters with minimal overhead and no backward pass required for layer selection.

CLAT also introduces a distinct training objective compared to prior work such as Adversarial Logit Pairing (ALP) [2]. While ALP adds a global logit-level regularizer to align clean and adversarial outputs, CLAT uses a forward-pass-only feature sensitivity metric to select a small subset of layers and applies a layerwise regularizer to penalize their vulnerability. This objective targets internal robustness rather than output-level alignment and constrains optimization structurally and locally, in contrast to ALP’s full-model training.

This combination of non-gradient-based sensitivity analysis, feature-level regularization, and sparse fine-tuning defines a lightweight and general framework that is fundamentally distinct from prior approaches.

Marginal improvements:
Please see our response to Reviewer 9V5S regarding this concern.

Transformer-based models:
Vision Transformers represent a fundamentally different architectural paradigm with structural properties that diverge significantly from CNNs. While this is an important direction, it is outside the scope of this work, which focuses on the structural role of layer selection in CNN-based adversarial robustness. Preliminary results of CLAT on TinyVIT showcase an increase in both clean and adversarial accuracy by approximately 3%.

---

References
[1] Zhu, K., Wang, J., Hu, X., Xie, X., & Yang, G. (2023). Improving generalization of adversarial training via robust critical fine-tuning. arXiv preprint arXiv:2308.02533.
[2] Kannan, H., Kurakin, A., & Goodfellow, I. (2018). Adversarial logit pairing. arXiv preprint arXiv:1803.06373.

We’re grateful for your insightful comments and for appreciating the care we put into our experiments. Below, we offer detailed responses to each of your points.

Marginal improvement: We respectfully disagree. Gains of ~2% in adversarial robustness—particularly through fine-tuning—are considered meaningful in recent work (e.g., RiFT [1] reports average improvements of ~1.4%).

In addition, CLAT introduces a distinct and lightweight mechanism for identifying structurally important layers, based on their sensitivity to input perturbations. CLAT’s ability to improve robustness from scratch—across training settings and learning rates—while updating under 5% of parameters suggests these layers are inherently robust-relevant, not artifacts.

Critical Layers: We also validate our layer selection by comparing against low-criticality layers (Appendix E.3). Additionally, thanks for the suggestion—we now include a visualization of the criticality index for RN50 at the start of fine-tuning (post 70 epochs of AT), showing clear separation between high- and low-criticality layers (e.g., 34, 41, 48). Similar patterns hold across architectures and throughout fine-tuning. Link for image: https://imgur.com/a/iNKlttr

Cidx consistency: The identified critical layers remain stable across perturbation types. For instance, indices computed using AutoAttack closely match those from untargeted PGD for DN121, RN50, and RN18 on CIFAR-10.

Additional Results: We agree and are happy to move the ImageNet and random ablations into the main paper, space permitting. They were placed in the appendix due to the broader use of CIFAR datasets for baseline comparison.

[1] Zhu, K., Wang, J., Hu, X., Xie, X., & Yang, G. (2023). Improving generalization of adversarial training via robust critical fine-tuning. arXiv preprint arXiv:2308.02533.