Time-Efficient Evaluation and Enhancement of Adversarial Robustness in Deep Neural Networks

Abstract

With deep neural networks (DNNs) increasingly embedded in modern society, ensuring their safety has become critical and urgent. Substantial efforts have focused on the red–blue adversarial framework, where the red team identifies vulnerabilities in DNNs, and the blue team mitigates them. However, existing approaches from both teams remain computationally intensive, constraining their applicability to large models. To this end, this thesis endeavours to develop time-efficient methods for evaluating and enhancing adversarial robustness in DNNs. In red team, we examine the limited transferability of jailbreaking attacks, which undermines efficient multi-model vulnerability assessment via single-shot attack generation. For textual attacks, we show that jailbreaking prompts often overfit the model's sampling processes, and we counter this by dispersing the model’s perception to mitigate distributional dependency and enhance transferability. For visual attacks, we reveal that jailbreaking images tend to rely on model-specific features, confining them to sharpness regions and reducing transferability, whereas our method eliminates non-generalizable reliance to achieve flattened feasible regions. For blue team, we study the phenomenon of catastrophic overfitting (CO), which hinders efficient single-step adversarial training. First, we identify abnormal adversarial examples that conflict with the optimisation objective and are closely tied to CO, and we show that suppressing their generation can prevent CO. Second, we uncover that CO stems from the formation of pseudo-robust shortcuts that bypass genuine robustness learning, and we introduce adaptive weight perturbations to disrupt these shortcuts. Third, while natural overfitting, robust overfitting, and CO are typically regarded as distinct phenomena, we discover a shared behaviour whereby DNNs over-memorise specific training patterns that impair generalisation, and we propose a general framework to mitigate this tendency.