Mart

MART (Misclassification-Aware Adversarial Training) is a robust training method that differentially treats correctly classified and misclassified examples during adversarial training — focusing more training effort on misclassified examples, which are the most vulnerable to adversarial perturbation.

MART Formulation

• Key Insight: Misclassified examples are more important for robustness than correctly classified ones.
• Loss: Uses a boosted cross-entropy loss that up-weights misclassified adversarial examples.
• KL Term: Adds a KL divergence term weighted by $(1 - p(y|x))$ — higher weight for less confident (more vulnerable) predictions.
• Adaptive: Automatically focuses training on the "hardest" examples without manual importance weighting.

Why It Matters

• Targeted Defense: Instead of treating all training examples equally, MART focuses on the most vulnerable points.
• Improved Robustness: MART improves adversarial robustness over standard AT and TRADES on several benchmarks.
• Complementary: MART's insights can be combined with other robust training methods.

MART is smart adversarial training — focusing defensive effort on the examples most likely to be adversarially exploited.