# adversarial training

6 related articles

Subscribe to updates

arXiv Nov 5, 2026
Worst cases stop being guesswork: Simple-PAT searches a procedural generator's parameters and cuts worst-case error on four vision tasks
Vision models still fail on seemingly simple scenes, and a fixed dataset cannot reliably estimate worst-case error. Procedural adversarial learning treats an interpretable procedural generator as a controllable data source and uses zeroth-order optimization to search its low-dimensional control parameters for hard instances. On four tasks spanning surface normals, image segmentation and human pose estimation, Simple-PAT lowers worst-case error below uniform training and two robust reweighting baselines against a cross-model black-box adversary with 50M aggregate queries.
Vision models still fail on seemingly simple scenes, and a fixed dataset cannot reliably estimate worst-case error. Procedural adversarial learning treats an interpretable procedural generator as a controllable data source and uses zeroth-order optimization to search its low-dimensional control parameters for hard instances. On four tasks spanning surface normals, image segmentation and human pose estimation, Simple-PAT lowers worst-case error below uniform training and two robust reweighting baselines against a cross-model black-box adversary with 50M aggregate queries.
Princeton University
Jack Nugent（First author）
Procedural Adversarial Learning Simple-PAT PAL-Dojo Zeroth-Order Optimization adversarial training
Gemini Oct 14, 2026
Gemini 4 Argon opens to more cyber defenders: simulated attack scenarios solved rise from five to all twelve
Gemini 4 Argon is rolling out to a broader set of cyber defenders after a limited Fairwind window, and it solved all twelve end-to-end simulated cyberattack scenarios, up from five in the previous generation.
Google
Gemini 4 Argon Misalignment monitoring Prompt Injection Activation Probes adversarial training
arXiv Oct 26, 2026
Straighter video representations are not always better: adversarial training straightens CNNs and transformers, but segmentation and frame prediction do not want it
Human vision is thought to use a straightened encoding of the natural visual world as it evolves in time, meaning frame-to-frame changes follow a more linear path in representation space. A study compared network architecture, different types of robustness, biologically inspired filtering and representational straightness, finding that adversarial training yields straighter representations in both CNNs and transformer-based architectures, but the effect is task-dependent and does not extend to segmentation or frame prediction, nor to other kinds of robustness. Straighter representations also give class predictions temporal stability, including on out-of-distribution data.
Human vision is thought to use a straightened encoding of the natural visual world as it evolves in time, meaning frame-to-frame changes follow a more linear path in representation space. A study compared network architecture, different types of robustness, biologically inspired filtering and representational straightness, finding that adversarial training yields straighter representations in both CNNs and transformer-based architectures, but the effect is task-dependent and does not extend to segmentation or frame prediction, nor to other kinds of robustness. Straighter representations also give class predictions temporal stability, including on out-of-distribution data.
Massachusetts Institute of Technology
Anne Harrington（First author）
representational straightness adversarial training
International Journal of Computer Assisted Radiology and Surgery Oct 17, 2026
Alzheimer's classifiers stop using age as a shortcut: residualizing age in feature space nearly zeroes the age-prediction link in cognitively normal and mild cognitive impairment groups
On structural MRI from three independent cohorts, Alzheimer's disease classifiers use age as a shortcut: older patients receive higher predicted risk. Residualizing age linearly in feature space (PMDN) brings the age-prediction correlation near zero in cognitively normal and mild cognitive impairment groups, with balanced accuracy 0.71 and Brier score about 0.22, and far less fold-to-fold spread than the adversarial CF-Net. Post hoc calibration further lowers probability error, with nonparametric isotonic regression and Bayesian binning performing best.
On structural MRI from three independent cohorts, Alzheimer's disease classifiers use age as a shortcut: older patients receive higher predicted risk. Residualizing age linearly in feature space (PMDN) brings the age-prediction correlation near zero in cognitively normal and mild cognitive impairment groups, with balanced accuracy 0.71 and Brier score about 0.22, and far less fold-to-fold spread than the adversarial CF-Net. Post hoc calibration further lowers probability error, with nonparametric isotonic regression and Bayesian binning performing best.
Charité - Universitätsmedizin Berlin Otto-von-Guericke-Universität Magdeburg University of Aveiro University of Cologne University of Edinburgh University Hospital Bonn University of Göttingen Universitätsmedizin Göttingen
Majid Ramedani（First author）Martin Dyrba（Corresponding author）
PMDN CF-Net Probability Calibration adversarial training Convolutional Neural Networks
arXiv Oct 7, 2026
AdvSim2Real co-evolves tasks, injections, and a web executor inside a frozen web world model, raising a 4B agent's completion under an unseen frontier adversary by 33.6% relative
AdvSim2Real co-evolves a task curriculum, an injection adversary, and a web executor inside a frozen web world model, where the curriculum is rewarded for tasks the executor solves about half the time and the adversary only for flipping a judged success into a failure; the trained 4B executor raises clean completion on 150 web tasks from 74.89% to 81.33%, completion under three learned adversaries from 48.07% to 57.48%, and completion under the untrained Kimi-K3 from 23.00% to 30.72%.
AdvSim2Real co-evolves a task curriculum, an injection adversary, and a web executor inside a frozen web world model, where the curriculum is rewarded for tasks the executor solves about half the time and the adversary only for flipping a judged success into a failure; the trained 4B executor raises clean completion on 150 web tasks from 74.89% to 81.33%, completion under three learned adversaries from 48.07% to 57.48%, and completion under the untrained Kimi-K3 from 23.00% to 30.72%.
Massachusetts Institute of Technology
Sarim Hashmi（First author）
adversarial training World Model Prompt Injection LLM Agents Sim-to-Real Transfer
arXiv Sep 30, 2026
Adversarial post-training restores missing high-frequency detail in pixel diffusion, cutting DeCo FID from 33.27 to 28.59
By keeping the original diffusion or flow-matching objective and adding an adversarial loss to the predicted output at non-high-noise timesteps, this study jointly improves distribution fidelity, coverage, prompt alignment, and perceptual quality on the DeCo and PixelGen pixel backbones, attributing the gain to restored missing natural-image high-frequency power, while the same procedure yields no comparable gain in the tested latent diffusion configurations.
By keeping the original diffusion or flow-matching objective and adding an adversarial loss to the predicted output at non-high-noise timesteps, this study jointly improves distribution fidelity, coverage, prompt alignment, and perceptual quality on the DeCo and PixelGen pixel backbones, attributing the gain to restored missing natural-image high-frequency power, while the same procedure yields no comparable gain in the tested latent diffusion configurations.
Xin Lin（First author）
adversarial training Pixel Diffusion Text-to-Image Synthesis

You’re all caught up

Worst cases stop being guesswork: Simple-PAT searches a procedural generator's parameters and cuts worst-case error on four vision tasks

Gemini 4 Argon opens to more cyber defenders: simulated attack scenarios solved rise from five to all twelve

Straighter video representations are not always better: adversarial training straightens CNNs and transformers, but segmentation and frame prediction do not want it

Alzheimer's classifiers stop using age as a shortcut: residualizing age in feature space nearly zeroes the age-prediction link in cognitively normal and mild cognitive impairment groups

AdvSim2Real co-evolves tasks, injections, and a web executor inside a frozen web world model, raising a 4B agent's completion under an unseen frontier adversary by 33.6% relative

Adversarial post-training restores missing high-frequency detail in pixel diffusion, cutting DeCo FID from 33.27 to 28.59