Adversarial Training

Parameter-efficient adversarial fine-tuning methods based on LoRA still lag clearly behind full-parameter adversarial training in robustness.

Adversarial training (AT) improves model robustness by generating adversarial examples during training and including them in training, but it incurs enormous memory overhead and involves a trade-off between clean accuracy and robust accuracy.

Adversarial training has the limitations of poor cross-attack-type generalization and high training cost.

Nonlinear concept erasure methods (such as schemes based on adversarial training or mutual information estimation) erase more thoroughly in experiments, but they lack formal guarantees and often sacrifice downstream task accuracy.

Common strategies for narrowing the domain gap between simulated and real data include domain adaptation, adversarial training, and fine-tuning with a small amount of real data, but these methods require real labeled data, which is precisely a scarce resource in the AD scenario.

Adversarial training can only defend against attack types within the training distribution and may still fail against unknown trigger words.

Adversarial examples exploit the fragility of the model's decision boundary in high-dimensional space; the network's robustness mechanisms (such as normalization and Dropout) are effective against random noise but almost ineffective against adversarial perturbations, because the perturbation direction is exactly the gradient ascent direction.

GCD does not require retraining the model, and its deployment cost is far lower than that of adversarial training-type solutions.

At the representation level, adversarially trained robust models are more easily decomposed by SAEs and invoke fewer SAE features in task attribution.

In the high-faithfulness range (90%, 95%), the robust model requires significantly fewer circuit edges.