Stabilizing Multi-Attack Adversarial Training via Bandit Optimization

Abstract

Deep Neural Networks (DNNs) remain vulnerable to diverse adversarial perturbations, motivating multi-attack adversarial training (AT) for improved robustness. However, existing methods either incur prohibitive overhead by computing all attacks at each iteration, or rely on stochastic sampling over adversarial examples, which may cause excessive parameter drift. To address these issues, we propose Calibrated Adversarial Sampling (CAS), an efficient and stable framework that reformulates multi-attack AT as a multi-armed bandit optimization problem. By sampling a single attack per iteration that dynamically balances exploration and exploitation, CAS significantly reduces training cost while mitigating optimization conflicts across attacks and controlling excessive parameter drifts. Extensive experiments demonstrate that CAS achieves superior overall robustness at low computational cost, offering a scalable and principled approach to robust generalization against multi-attack settings. Our code is available at https://github.com/1240148048/CAS.

ACM MM 2026