Sparse fine-tuning improves adversarial robustness with fewer updates
Sparse Fine-Tuning for Parameter-Efficient Adversarial Training
Machine LearningArtificial Intelligence
Summary
Deep learning models can be tricked by small changes called adversarial attacks. Training models to resist these attacks usually needs changing all model parts, which takes a lot of memory and time. The authors found that only a small part of the model really needs adjusting to improve defense. Their method updates just around 5% of these important parts, making training more efficient while keeping strong protection against attacks.
What this means in practice
- •For machine learning engineers: Reduce memory and computation costs when training robust deep learning models by updating only key parameters identified for robustness.
- •For ai security teams: Improve model defenses against adversarial attacks by applying targeted fine-tuning that preserves accuracy and robustness efficiently.
Authors
Zhaoxin Wang, Zihang Ding, Handing Wang
Abstract
Deep neural networks achieve strong performance across many tasks but remain vulnerable to adversarial perturbations. Adversarial training (AT) is one of the most effective defenses, yet it suffers from high memory cost on large models and the persistent clean-robust accuracy trade-off. Recent work introduces parameter-efficient fine-tuning, such as LoRA, into AT, but this constraint induces a notable robustness gap relative to full-parameter AT. In this work, we revisit parameter-efficient adversarial fine-tuning from a parameter space perspective. Through gradient analysis, we find that adversarial optimization is highly concentrated on a small subset of parameters, which we call Robustness-Critical Parameters (RCPs), suggesting that robustness is encoded in a sparse subspace. Building on this observation, we propose Sparse Adversarial Fine-Tuning (SAFT), which identifies RCPs via adversarial gradient saliency and performs AT by updating only these parameters while freezing the rest. Across architectures and datasets, SAFT outperforms LoRA-based methods in both clean and robust accuracy with fewer trainable parameters, and approaches or surpasses full parameter AT in robustness while updating only about 5\% of parameters.