Paper deep dive
Confusion-Geometry Rebalancing for Long-Tailed Adversarial Training
Mengnan Zhao, Geyong Min, Lihe Zhang, Tianhang Zheng, Jie Cui
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Adversarial training under long tailed distributions suffers from a dual imbalance: the class imbalance skews the training objective toward head classes, and the adversarial inner maximization may further amplify this bias. Existing methods mitigate this issue by correcting class priors or adapting class wise robust supervision, yet they treat each class in isolation and fail to identify which boundaries drive long tailed collapse. We propose a Confusion Geometry Rebalancing method (CGRm) for long tail adversarial training, a plug in framework that leverages directed robust errors as training signals. CGRm leverages periodic robust evaluations to derive source class loss weights, class wise robust coefficients, and a directed confusion geometry graph. The method then couples feedback weighted robust optimization with graph guided margin correction, thereby boosting the robustness of vulnerable classes and sharpening the critical boundaries that drive long tailed performance degradation. Experiments on long tailed benchmarks show that CGRm achieves consistent robust performance gains over existing methods, with ablations validating the contribution of each component. We provide the code in the supplement.
Tags
Links
- Source: https://arxiv.org/abs/2608.09688v1
- Canonical: https://arxiv.org/abs/2608.09688v1
Trouble viewing inline? Open PDF directly →
Full Text
47,305 characters extracted from source content.
Expand or collapse full text
Confusion-Geometry Rebalancing for Long-Tailed Adversarial Training Mengnan Zhao1, Geyong Min3, Lihe Zhang2, Tianhang Zheng4, Jie Cui1 Abstract Adversarial training under long-tailed distributions suffers from a dual imbalance: the class imbalance skews the training objective toward head classes, and the adversarial inner maximization may further amplify this bias. Existing methods mitigate this issue by correcting class priors or adapting class-wise robust supervision, yet they treat each class in isolation and fail to identify which boundaries drive long-tailed collapse. We propose a Confusion-Geometry Rebalancing method (CGRm) for long-tail adversarial training, a plug-in framework that leverages directed robust errors as training signals. CGRm leverages periodic robust evaluations to derive source‑class loss weights, class‑wise robust coefficients, and a directed confusion‑geometry graph. The method then couples feedback‑weighted robust optimization with graph‑guided margin correction, thereby boosting the robustness of vulnerable classes and sharpening the critical boundaries that drive long‑tailed performance degradation. Experiments on long-tailed benchmarks show that CGRm achieves consistent robust performance gains over existing methods, with ablations validating the contribution of each component. We provide the code in the supplement. Figure 1: Robust confusion matrix on CIFAR10-LT. Adversarial examples from tail classes are frequently misclassified to head classes, often in a directed manner, highlighting the importance of targeted margin correction. 1 Introduction The vulnerability of deep neural networks to imperceptible adversarial perturbations has raised critical concerns about their deployment in safety-critical systems. Adversarial training (AT) is widely regarded as one of the most effective defenses against this threat. It is typically formulated as a min-max optimization problem (Zhao et al. 2024b, 2023, a, 2026). Despite its empirical success, AT has been predominantly studied under an implicit assumption of balanced class priors. However, this assumption rarely holds in real-world scenarios, where sampled datasets are intrinsically long-tailed: a few head classes account for the majority of samples, while numerous tail classes are represented by very few instances (Du et al. 2024). When AT is applied directly to such skewed data, it introduces a two-fold imbalance: head classes not only dominate the training objective, but also disproportionately influence the adversarial decision boundaries during the inner maximization (Jiang et al. 2026; Qin et al. 2026; Li et al. 2025). Consequently, the learned model may achieve satisfactory average robust accuracy, yet its performance on tail classes remains notably inferior. Recent studies improve the long-tailed AT from complementary perspectives. One line of work focuses on prior correction, adjusting logits, losses, or sample weights to counteract label imbalance (Ren et al. 2020; Wu et al. 2021; Yue et al. 2024). Another thread develops class-aware robust calibration, adapting perturbation budgets, regularization strengths, or class-specific weights based on each class’s robust behavior (Wei et al. 2023; Lee et al. 2024). Most recently, RobustLT shows that the adversarial inner maximization itself should also be class-dependent, reallocating perturbation radii and attack schedules across the imbalance spectrum (Zhang et al. 2026). Despite these advances, existing methods share a common limitation: each class’s robust error is treated in isolation, without considering where those errors are directed, as shown in Figure 1. This directional information matters in long-tailed AT. Under adversarial attack, an example from a source class is driven across the decision boundary toward different target classes. In long-tailed recognition, these errors are often structured rather than random: tail-class examples tend to collapse into frequent classes, especially when their feature representations lie close in the adversarial space. Consequently, treating all errors from an under-robust class equally may waste robust supervision on irrelevant negatives, while scalar class feedback alone cannot identify which target classes actually absorb these errors. We argue that robust long-tailed training should consider not only whether a class is vulnerable, but also where its adversarial examples are directed and whether the resulting confusion is geometrically plausible. Motivated by this observation, we propose a Confusion-Geometry Rebalancing method (CGRm) for long-tail AT, a plug-in framework that explicitly accounts for directed robust errors. The method periodically evaluates the model under attack and collects three forms of feedback—class-wise robust accuracy, confusion counts, and adversarial feature centers—which jointly characterize each class’s vulnerability and its error direction. This feedback serves two complementary purposes. On one hand, it produces class-adaptive weights and robust coefficients that amplify the contribution and regularization of under-robust classes. On the other hand, it builds a directed confusion-geometry graph whose edges capture tail-to-head misclassifications that are both frequent and geometrically plausible; a margin loss is then applied exclusively to these selected pairs. In this way, CGRm rebalances not only how much each class is supervised, but also which boundaries are explicitly hardened. Our contributions are summarized as follows: • We formulate long-tailed AT as a directed robust error-correction problem and propose CGRm, modeling not only per-class vulnerability but also the target direction and geometric plausibility of robust confusions. • We introduce a dynamic feedback mechanism that decouples per-class gradient contribution from clean-robust regularization by separately updating loss weights and robust coefficients based on evolving robust-error statistics. • We design a confusion-geometry boundary correction module that builds a directed graph from confusion frequency, target-class headness, and adversarial feature affinity, and then applies a margin loss exclusively to systematic source-target confusions. • Extensive experiments on long-tailed benchmarks show that CGRm consistently outperforms existing methods. 2 Related Work Adversarial training (AT). AT is typically formulated as a min-max optimization problem (Goodfellow et al. 2015; Robey et al. 2024; Yue et al. 2023; Jia et al. 2024). Let fθf_θ be a classifier, ℓ be the loss, and ϵ(x)=x′:‖x′−x‖∞≤ϵS_ε(x)=\x :\|x -x\|_∞≤ε\ be the perturbation set around an input x. Standard AT minimizes the worst-case risk, minθ(x,y)∼train[maxx′∈ϵ(x)ℓ(fθ(x′),y)], _θ\;E_(x,y) _train [ _x _ε(x) (f_θ(x ),y) ], (1) where the inner maximization is usually approximated by PGD (Madry et al. 2018). TRADES (Zhang et al. 2019) decouples the learning objective into a standard classification term and a robust regularization term: [ℓ(fθ(x),y)+βmaxx′∈ϵ(x)DKL(pθ(⋅|x)∥pθ(⋅|x′))],E [ (f_θ(x),y)+β _x _ε(x)D_KL(p_θ(·|x)\|p_θ(·|x )) ], (2) where pθ(⋅|x)p_θ(·|x) denotes the predictive distribution and β governs the trade-off between clean accuracy and adversarial robustness. AWP (Wu et al. 2020) improves robust generalization by perturbing both inputs and model weights during training, expressed as minθmax‖v‖≤γ‖θ‖(x,y)∼D[maxx′∈ϵ(x)ℓ(fθ+v(x′),y)], _θ _\|v\|≤γ\|θ\|E_(x,y) D [ _x _ε(x) (f_θ+v(x ),y) ], (3) where v denotes the weight perturbation and γ controls the perturbation magnitude. Long-tailed adversarial training. Unlike standard AT, long-tailed AT inherits two coupled biases: 1) the empirical risk is dominated by head classes, and 2) the adversarial examples generated around the learned decision boundary tend to further amplify head-class preferences. One family of methods addresses long-tailed learning as a prior-correction problem, adjusting losses, logits, or sample weights to reduce the dominance of class frequency in robust training (Cao et al. 2019; Ren et al. 2020). Given an adversarial example x′∈ϵ(x)x _ε(x) and logits z=fθ(x′)z=f_θ(x ), RoBal (Wu et al. 2021) integrates AT with dynamic logit adjustment, ℒRoBal=−logexp(zy+Δy)∑jexp(zj+Δj),L_RoBal=- (z_y+ _y) _j (z_j+ _j), (4) where Δj _j is estimated from per-class robust confusion patterns during training. Instead of relying on dynamic confusion statistics, BSL (Yue et al. 2024) uses static class frequencies as the correction prior, formulated as ℒBSL=−lognyτbexp(zy)∑iniτbexp(zi),L_BSL=- n_y _b (z_y) _in_i _b (z_i), (5) where τb _b tunes the strength of class-prior correction. TAET (Wang et al. 2025) argues that static frequency correction may still overfit underrepresented or hard classes. It therefore introduces a two-stage adversarial equalization strategy. Stage I trains the model with standard cross-entropy to stabilize clean representations. Stage I optimizes adversarial examples with a hierarchical equalization loss. Similarly, REAT (Li et al. 2023) down-weights the loss contribution of adversarial examples that are frequently predicted as head classes, encouraging the adversary to focus more on underrepresented categories. Beyond prior-correction, another line of work adapts robustness mechanisms on a per-class basis, such as perturbation radii and regularization coefficients. CFA (Wei et al. 2023) scales perturbation radii and regularization coefficients according to each class’s current robust accuracy rcr_c: ϵc=(λ1+rc)ϵ,βc=(λ2+rc)β1+(λ2+rc)β, _c=( _1+r_c)ε, _c= ( _2+r_c)β1+( _2+r_c)β, (6) where ϵε and β are base values, and λ1,λ2 _1, _2 are hyperparameters. This per-class scaling relies on a scalar accuracy summary per class but does not capture cross-class confusion. UDR (Bui et al. 2022) instead abstracts the issue to the distribution level, formulating AT as Wasserstein distributional robustness. RobustLT (Zhang et al. 2026) tackles long-tailed AT through a perturbation rebalancing mechanism coupled with an adversarial iteration weighting schedule. For each class c, it defines the imbalance ratio Kc=nmax/ncK_c=n_ /n_c and formulates the maximum perturbation budget as: ϵ¯c=(1−α+αlogKc∑jnjNlogKj)ϵ, ε_c= (1-α+ α K_c _j n_jN K_j )ε, (7) where ncn_c denotes the sample count of class c, nmax=maxcncn_ = _cn_c, and the hyperparameter α governs the extent to which perturbation budgets are redistributed from head to tail classes. The method further introduces a progressive warm-up schedule to enable more effective application of these budgets. At epoch t, the actual perturbation radius and the corresponding PGD step size are given by ϵc(t)=min(t−1ρT,1)ϵ¯c,ηc(t)=ϵc(t)ϵη, _c^(t)= ( t-1ρ T,1 ) ε_c, _c^(t)= _c^(t)εη, (8) with T denoting the total number of epochs, η the base step size, and ρ the warm-up ratio. Difference from existing methods. Existing methods treat all misclassifications from a vulnerable class equally, ignoring both which competing class the error goes to and whether that confusion is geometrically plausible in feature space. CGRm addresses these two missing dimensions. It jointly tracks robust errors and their source-target geometry: class frequency only initializes adversarial exploration, while subsequent corrections are driven by observed robust errors, their target classes, and the feature-space proximity of the confused classes. 3 Method This work propose CRGm, which periodically evaluates the model under attack and translates the robust errors into optimization objectives: class-adaptive weights and coefficients that rebalance per-class loss contribution and regularization toward clean-robust consistency, and a directed graph that applies margin loss to systematic source-target confusions. Optimization with Error Feedback To mitigate the adverse effects of uniformly assigned perturbation budgets in imbalanced data scenarios, we reuse Eqs. (7) and (8) to calculate the attack budgets ϵc(t) _c^(t) and step size ηc(t) _c^(t). For a sample (x,y)(x,y), we then generate xadvx^adv using such class-conditioned budget ϵy(t) _y^(t) and step size ηy(t) _y^(t). Given these adversarial examples, CGRm optimizes three coupled signals: a prior-calibrated natural classification term for long-tailed recognition, a feedback-weighted robust consistency term for vulnerable source classes, and a confusion-geometry margin term for the target classes that absorb adversarial errors. The objective is expressed as ℒCGR=[ℓbal(fθ(x),y)]+ℒrob+λmℒcgm.L_CGR=E [ _bal(f_θ(x),y) ]+L_rob+ _mL_cgm. (9) The first term denotes a balanced prior-calibrated classification term. Let πc=nc/N _c=n_c/N and bc=log(πc)b_c= ( _c). For logits z=fθ(x)z=f_θ(x), we use ℓbal(z,y)=−logexp(zy+by)∑j=1Cexp(zj+bj). _bal(z,y)=- (z_y+b_y) _j=1^C (z_j+b_j). (10) ℒrobL_rob reallocates the consistency between clean and adversarial predictions across classes. We introduce two independent factors: the source-class weight wy(t)w_y^(t) modulates the overall gradient contribution from samples of class y, while the class-wise robust coefficient βy(t) _y^(t) controls the strength of the consistency constraint imposed on that class. This allows the model to emphasize an under-robust class and independently enforce a stronger clean-adversarial prediction agreement on it. For example, when adopting TRADES as the base learner, ℒrobL_rob is expressed as ℒrob=[wy(t)βy(t)DKL(fθ(x)∥fθ(xadv))].L_rob=E [w_y^(t) _y^(t)D_KL (f_θ(x)\;\|\;f_θ(x^adv) ) ]. (11) where DKLD_KL penalizes the discrepancy between clean and adversarial predictions. The confusion-geometry margin complements this source-class correction with target-class information. A low robust accuracy indicates that class y is vulnerable, but it does not identify which wrong class should be separated from y. The graph G(t)G^(t) selects target classes that adversarial examples from y are frequently confused with and that are geometrically plausible competitors. CGRm then applies a margin penalty only to these selected targets: ℒcgm=(x,y)[wy(t)∑j≠yGyj(t)[m−zyadv+zjadv]+],L_cgm=E_(x,y) [w_y^(t) _j≠ yG_yj^(t) [m-z_y^adv+z_j^adv ]_+ ], (12) where m denotes the margin threshold, zadv=fθ(xadv)z^adv=f_θ(x^adv). At the beginning of training, wy=1w_y=1, βy=β _y=β, and Gy,j=0G_y,j=0. As training progresses, these variables are updated from robust-error statistics, which we define next. Robust-Error Statistics The frequency prior is only a proxy for robust difficulty. Some rare classes may be clearly separable, whereas some medium-frequency classes may remain vulnerable due to feature overlap or semantic ambiguity. CGRm thus updates its training emphasis using the model’s own robust behavior. At an evaluation epoch t, we attack a monitoring split (subset of the training dataset) and compute the class-wise robust accuracy ac(t)a_c^(t) and robust confusion matrix M(t)M^(t), where Mij(t)M_ij^(t) counts examples from class i predicted as class j under attack. We convert these measurements into a feedback score using two complementary signals. The first measures how far a class falls below the mean robust accuracy, gc(t)=max(a¯(t)−ac(t),0),a¯(t)=1C∑j=1Caj(t).g_c^(t)= ( a^(t)-a_c^(t),0 ), a^(t)= 1C _j=1^Ca_j^(t). (13) The second measures how often adversarial examples from class c leave the correct class: ec(t)=1−Mcc(t)∑j=1CMcj(t)+ξ,e_c^(t)=1- M_c^(t) _j=1^CM_cj^(t)+ξ, (14) where ξ is a negligible positive constant for numerical stability, Mij(t)M_ij^(t) counts examples from source class i that are predicted as target class j under attack. We combine the two signals as sc(t)s_c^(t), sc(t)=gc(t)+ec(t)1C∑j=1C(gj(t)+ej(t))+ξ.s_c^(t)= g_c^(t)+e_c^(t) 1C _j=1^C(g_j^(t)+e_j^(t))+ξ. (15) Because robust evaluation can be noisy, especially for tail classes, we use an exponential moving average s~c(t)=μs~c(t−1)+(1−μ)sc(t). s_c^(t)=μ s_c^(t-1)+(1-μ)s_c^(t). (16) Based on s~c(t) s_c^(t), we calculate the per-class loss weight in Eq. (11), which answers the question of how much examples from class c should contribute to the optimization objective: wc(t)=clip(1+s~c(t)1C∑j=1C(1+s~j(t)),0,wmax).w_c^(t)=clip ( 1+ s_c^(t) 1C _j=1^C(1+ s_j^(t)),0,w_ ). (17) Clipping prevents noisy tail estimates from producing excessive gradients, while normalization keeps the average weight stable across epochs. Additionally, s~c(t) s_c^(t) is used to determine the regularization strength for each class. A single global coefficient β applies the same clean-robust trade-off across all classes, which becomes suboptimal when robust difficulty varies unevenly: increasing β universally may hurt clean accuracy on easier classes, while decreasing it leaves harder classes under-regularized. To address this, we adapt β per class based on the proposed robust-error score: βc(t)=β⋅clip(1+s~c(t)/s¯(t),1,rmax)1C∑j=1Cclip(1+s~j(t)/s¯(t),1,rmax), _c^(t)=β· clip (1+ s_c^(t)/ s^(t),1,r_ ) 1C _j=1^Cclip (1+ s_j^(t)/ s^(t),1,r_ ), (18) where s¯(t)=1C∑js~j(t) s^(t)= 1C _j s_j^(t). Unlike wc(t)w_c^(t), which modulates a class’s contribution to the overall objective, βc(t) _c^(t) adjusts the clean-robust trade-off within the robust term. Algorithm 1 CGRm Training 1: Input: long-tailed training set D, class counts ncc=1C\n_c\_c=1^C, model fθf_θ, base attack parameters (ϵ,η)(ε,η), base robust coefficient β, total epochs T. 2: Output: robust model fθf_θ. 3: Initialize feedback scores s~c(0)=1 s_c^(0)=1, class weights wc(0)=1w_c^(0)=1, robust coefficients βc(0)=β _c^(0)=β, and graph G(0)=0G^(0)=0; 4: for epoch t=1,…,Tt=1,…,T do 5: Obtain class-wise perturbation budgets ϵc(t) _c^(t) and step sizes ηc(t) _c^(t) from Eq. (8); 6: for mini-batch (x,y)(x,y) sampled from D do 7: Generate xadvx^adv using ϵy(t) _y^(t) and ηy(t) _y^(t); 8: Compute prior-calibrated loss ℓbal _bal by Eq. (10); 9: Compute the feedback-weighted robust loss ℒrobL_rob with wy(t−1)w_y^(t-1) and βy(t−1) _y^(t-1) by Eq. (11); 10: Compute the confusion-geometry margin ℒcgmL_cgm with G(t−1)G^(t-1) by Eq. (12); 11: Update θ by minimizing ℒCGRL_CGR in Eq. (9); 12: end for 13: if t is an evaluation epoch then 14: Attack a monitoring split to compute robust gaps gc(t)g_c^(t), confusion errors ec(t)e_c^(t), and smoothed feedback scores s~c(t) s_c^(t) by Eqs. (13)–(16); 15: Update wc(t)w_c^(t) and βc(t) _c^(t) based on ec(t)e_c^(t) and s~c(t) s_c^(t); 16: Compute robust confusion P(t)P^(t), headness h, and feature affinity A(t)A^(t) by Eqs. (20)–(22); 17: Update the smoothed confusion-geometry graph G(t)G^(t) by Eq. (23); 18: end if 19: end for Table 1: Natural and robust accuracies of various base AT algorithms using ResNet. Bold digits denotes the best result. Methods CIFAR10-LT CIFAR100-LT TinyImageNet-LT Nat.(all) Nat.(tail) Rob.(all) Rob.(tail) Nat.(all) Nat.(tail) Rob.(all) Rob.(tail) Nat.(all) Nat.(tail) Rob.(all) Rob.(tail) !15 REAT 69.59% 63.79% 31.41% 21.91% 45.49% 43.35% 17.54% 16.59% 37.91% 35.42% 12.80% 11.33% TAET 65.45% 59.80% 33.32% 26.12% 43.65% 40.05% 17.36% 15.94% 34.99% 31.77% 12.04% 10.29% !15RoBal 72.43% 68.14% 33.47% 26.71% 44.88% 43.79% 18.61% 18.10% 37.12% 35.95% 12.28% 11.56% BSL 70.04% 64.35% 31.98% 22.75% 45.90% 43.53% 18.10% 17.10% 38.90% 36.36% 13.08% 11.41% !15PGD-AT 56.33% 46.27% 26.28% 13.19% 43.03% 38.91% 15.40% 13.34% 34.80% 30.56% 9.16% 7.25% + UDR 57.60% 47.71% 29.71% 16.94% 42.58% 38.26% 15.72% 13.86% 34.90% 29.86% 12.17% 9.64% !15+ CFA 57.08% 47.23% 29.76% 16.31% 43.31% 38.60% 17.58% 15.54% 37.08% 32.00% 11.96% 9.55% + DAFA 64.14% 56.91% 30.51% 21.26% 44.17% 40.39% 16.78% 15.55% 36.39% 32.19% 12.22% 10.35% !15+ RobustLT 56.71% 46.81% 30.88% 18.60% 46.09% 42.14% 17.73% 16.01% 36.67% 31.89% 12.26% 10.08% + Ours 71.80% 68.15% 35.31% 27.93% 48.25% 46.66% 18.83% 18.19% 39.81% 38.01% 13.03% 11.83% !15TRADES 54.48% 43.91% 30.13% 16.66% 43.57% 38.51% 20.07% 17.25% 35.41% 30.18% 13.85% 10.78% + UDR 55.09% 44.64% 29.79% 16.59% 41.01% 36.08% 19.21% 16.93% 33.72% 28.73% 12.61% 9.85% !15+ CFA 53.32% 42.43% 30.45% 16.41% 43.07% 37.52% 21.16% 18.18% 37.60% 32.48% 14.82% 11.61% + DAFA 61.25% 54.24% 31.54% 21.93% 44.77% 40.83% 19.43% 18.04% 36.07% 32.21% 13.21% 11.19% !15+ RobustLT 56.44% 44.01% 31.38% 18.57% 45.50% 40.80% 20.68% 18.25% 36.46% 31.66% 13.78% 10.82% + Ours 68.29% 62.39% 34.92% 27.06% 48.81% 46.80% 21.54% 20.73% 38.84% 36.82% 14.12% 13.05% !15AWP 48.04% 35.68% 31.50% 17.77% 43.45% 37.76% 22.72% 19.45% 34.27% 28.32% 16.73% 12.95% + UDR 43.59% 30.28% 28.00% 14.22% 43.58% 38.45% 21.08% 18.25% 31.54% 25.79% 14.10% 10.78% !15+ CFA 53.28% 42.38% 32.51% 18.81% 46.72% 41.71% 21.81% 18.93% 38.56% 32.94% 16.02% 12.53% + DAFA 52.67% 42.66% 32.45% 22.45% 44.50% 39.30% 23.03% 20.42% 35.03% 29.78% 16.99% 13.94% !15+ RobustLT 57.74% 44.35% 36.69% 27.06% 45.67% 39.65% 22.96% 19.86% 34.38% 28.10% 16.50% 12.62% + Ours 68.19% 64.71% 40.70% 36.44% 50.30% 48.67% 24.22% 23.85% 39.99% 37.65% 18.43% 17.09% Confusion-Geometry Boundary Correction Class-wise feedback identifies vulnerable source classes, yet it treats each class independently, overlooking the inherently relational nature of robust failure. An adversarial example from class i becomes harmful precisely because it crosses the decision boundary toward a specific target class j. In long-tailed recognition, the most detrimental errors are often not random misclassifications, but rather tail classes being absorbed by neighboring head classes. To address this, CGRm constructs a directed confusion-geometry graph that selects source-target pairs requiring explicit margin correction. The graph integrates three complementary signals: empirical confusion probabilities, class-frequency bias, and feature-geometry affinity. The graph at epoch t is formulated as the element-wise product of these three terms: G^ij(t)=Pij(t)hjAij(t),i≠j,G^ii(t)=0. G_ij^(t)=P_ij^(t)\,h_j\,A_ij^(t), i≠ j, G_i^(t)=0. (19) Here, the row-normalized robust confusion probability Pij(t)P_ij^(t) reflects the empirical tendency of adversarial examples from i to cross the decision boundary toward j. Pij(t)=Mij(t)∑k=1CMik(t)+ξ.P_ij^(t)= M_ij^(t) _k=1^CM_ik^(t)+ξ. (20) The headness score hjh_j aims to penalize confusions that are more damaging under long-tailed imbalance: hj=njnmax,h_j= n_jn_ , (21) where ncn_c is the sample count of class c and nmax=maxcncn_ = _cn_c. The geometry affinity Aij(t)A_ij^(t) measures the geometric proximity between the two classes in the adversarial feature space. Let mc(t)m_c^(t) denote the feature center of class c computed from adversarial examples, and define Aij(t)=1‖m^i(t)−m^j(t)‖2+ξ,A_ij^(t)= 1\| m_i^(t)- m_j^(t)\|_2+ξ, (22) where m m is ℓ2 _2-normalized. To reduce noise and maintain sparsity, we retain only the top-k outgoing edges for each source class and normalize the nonzero entries to unit mean. The graph is then updated smoothly across epochs via exponential moving average: G(t)=μG(t−1)+(1−μ)G^(t).G^(t)=μ G^(t-1)+(1-μ) G^(t). (23) The target classes selected by Eq. (19) are those that (i) are frequently confused with adversarial examples from the source class, as measured by Eqs. (20) and (21), and (i) serve as geometrically plausible competitors, as quantified by Eq. (22). Thus, this graph serves as a targeted description of long-tailed robust collapse. The training procedure is summarized in Algorithm 1. 4 Experiments Table 2: Natural and robust accuracies of various AT algorithms using PreActResNet. Methods CIFAR10-LT CIFAR100-LT TinyImageNet-LT Nat.(all) Nat.(tail) Rob.(all) Rob.(tail) Nat.(all) Nat.(tail) Rob.(all) Rob.(tail) Nat.(all) Nat.(tail) Rob.(all) Rob.(tail) !15REAT 70.89% 65.21% 32.26% 23.04% 45.46% 42.99% 17.88% 16.89% 38.40% 35.76% 12.94% 11.55% TAET 66.54% 61.24% 33.73% 26.88% 43.32% 39.42% 18.04% 16.35% 35.12% 31.70% 12.19% 10.44% !15RoBal 72.27% 68.10% 34.45% 27.38% 45.04% 44.38% 18.29% 17.61% 36.39% 35.25% 13.31% 12.26% BSL 70.49% 64.88% 32.15% 22.85% 45.13% 42.89% 17.60% 16.75% 38.31% 35.96% 13.31% 12.00% !15PGD-AT 57.38% 47.64% 26.93% 13.85% 42.67% 38.46% 15.36% 13.53% 34.39% 30.03% 9.34% 7.46% + UDR 59.62% 50.34% 29.69% 16.99% 42.24% 37.85% 15.76% 13.95% 34.87% 30.20% 10.59% 8.56% !15+ CFA 57.30% 47.54% 30.28% 16.90% 43.25% 38.75% 17.13% 15.06% 36.93% 32.06% 12.19% 9.71% + DAFA 66.05% 59.31% 31.36% 22.30% 43.69% 40.08% 16.91% 15.72% 37.13% 32.94% 12.49% 10.81% !15+ RobustLT 57.36% 47.59% 31.70% 19.46% 46.24% 42.23% 17.88% 16.20% 37.47% 32.86% 12.48% 10.29% + Ours 73.03% 68.59% 35.08% 28.11% 47.75% 46.35% 18.39% 17.76% 39.68% 37.75% 12.68% 11.71% !15TRADES 56.19% 46.09% 30.68% 17.32% 43.49% 38.52% 19.85% 17.29% 35.74% 30.56% 14.00% 10.96% + UDR 56.44% 46.38% 30.38% 17.15% 40.78% 35.95% 18.82% 16.48% 33.82% 28.50% 12.09% 9.21% !15+ CFA 54.39% 43.70% 30.51% 16.59% 43.53% 38.01% 20.66% 17.65% 37.32% 31.79% 14.60% 11.09% + DAFA 65.06% 58.35% 32.13% 22.51% 44.62% 41.09% 19.69% 18.31% 36.61% 32.59% 13.46% 11.43% !15+ RobustLT 57.33% 47.55% 33.12% 22.57% 45.21% 40.33% 21.22% 18.88% 36.25% 31.08% 14.08% 11.22% + Ours 69.15% 62.59% 35.28% 26.03% 49.09% 46.67% 21.23% 20.21% 39.78% 38.08% 13.96% 13.28% !15AWP 50.78% 39.05% 32.18% 18.50% 43.53% 37.86% 23.04% 19.74% 33.99% 28.20% 16.96% 13.31% + UDR 46.16% 33.46% 29.64% 15.81% 45.60% 40.65% 21.17% 18.60% 34.39% 28.78% 15.44% 12.10% !15+ CFA 54.86% 44.26% 32.84% 19.21% 47.06% 41.93% 22.19% 19.25% 38.63% 32.85% 16.35% 12.90% + DAFA 56.78% 47.60% 33.48% 23.60% 44.62% 39.59% 22.89% 20.38% 35.15% 29.81% 16.74% 13.75% !15+ RobustLT 45.82% 32.91% 31.52% 18.05% 45.87% 39.95% 23.20% 20.29% 34.65% 28.16% 16.70% 12.97% + Ours 69.59% 66.25% 41.42% 37.25% 51.11% 49.64% 24.28% 23.97% 39.85% 37.56% 18.85% 17.68% Table 3: Natural and robust accuracies of various base AT algorithms using WideResNet. Methods CIFAR10-LT CIFAR100-LT TinyImageNet-LT Nat.(all) Nat.(tail) Rob.(all) Rob.(tail) Nat.(all) Nat.(tail) Rob.(all) Rob.(tail) Nat.(all) Nat.(tail) Rob.(all) Rob.(tail) !15REAT 67.37% 60.31% 30.19% 18.73% 48.08% 44.93% 19.48% 18.31% 42.30% 39.96% 15.19% 13.51% TAET 66.89% 60.40% 34.51% 25.25% 45.58% 40.79% 19.07% 17.12% 38.26% 33.85% 13.16% 10.87% !15RoBal 72.50% 67.71% 34.62% 25.77% 48.84% 47.38% 21.85% 21.20% 41.26% 40.05% 16.05% 15.06% BSL 67.65% 60.61% 30.64% 19.09% 47.92% 45.05% 20.11% 18.84% 41.65% 36.90% 14.71% 12.17% !15PGD-AT 58.85% 49.33% 26.86% 13.12% 46.20% 41.65% 17.22% 15.01% 37.74% 33.50% 10.53% 8.43% + UDR 59.44% 50.06% 28.11% 14.96% 45.47% 40.90% 17.29% 15.20% 39.23% 34.45% 12.83% 10.34% !15+ CFA 57.52% 47.59% 30.07% 16.41% 45.44% 40.55% 19.19% 16.90% 38.69% 34.07% 10.94% 9.12% + DAFA 65.06% 57.39% 29.60% 18.71% 46.87% 43.23% 18.06% 16.89% 39.78% 35.89% 13.80% 11.81% !15+ RobustLT 60.74% 51.60% 31.54% 19.11% 49.07% 44.55% 18.55% 16.74% 41.65% 36.90% 14.71% 12.17% + Ours 73.83% 68.59% 35.64% 26.41% 50.95% 48.85% 19.54% 18.78% 44.14% 42.45% 14.77% 13.74% !15TRADES 59.04% 49.53% 32.42% 19.09% 47.60% 42.19% 22.10% 19.60% 38.83% 33.60% 16.07% 12.72% + UDR 58.73% 49.09% 31.36% 18.07% 44.95% 39.85% 20.32% 17.91% 40.85% 35.90% 13.67% 11.19% !15+ CFA 55.00% 44.41% 31.85% 17.99% 47.15% 41.98% 22.58% 19.62% 39.57% 34.14% 16.80% 13.11% + DAFA 65.58% 58.48% 33.54% 22.94% 48.52% 44.84% 21.98% 20.45% 39.15% 34.91% 15.91% 13.45% !15+ RobustLT 60.53% 51.36% 33.60% 21.00% 49.98% 45.32% 23.22% 21.12% 39.76% 34.76% 16.78% 13.71% + Ours 68.37% 61.54% 35.81% 25.16% 52.71% 49.20% 23.60% 22.04% 42.84% 41.24% 17.07% 16.15% !15 AWP 53.39% 42.35% 31.21% 16.96% 50.03% 44.60% 24.81% 21.29% 39.10% 32.86% 14.87% 11.26% + UDR 57.87% 47.89% 32.68% 19.50% 50.71% 45.74% 22.94% 20.26% 41.25% 35.71% 12.68% 10.74% !15 + CFA 57.81% 47.77% 34.47% 20.70% 50.50% 45.25% 24.31% 21.30% 39.96% 33.48% 15.80% 11.65% + DAFA 63.27% 55.31% 35.93% 25.94% 49.78% 45.05% 25.09% 22.78% 35.13% 29.71% 16.95% 13.96% !15 + RobustLT 68.91% 56.60% 38.70% 27.07% 50.83% 45.16% 25.34% 22.64% 38.01% 31.29% 19.29% 15.31% + Ours 74.07% 69.98% 43.72% 37.79% 55.95% 54.60% 26.06% 25.85% 43.99% 41.79% 21.40% 20.13% Table 4: Robust accuracies against different attacks using WRN-28-10. Better results are bolded. Methods CIFAR10-LT CIFAR100-LT TinyImageNet-LT C&W.(all) C&W.(tail) A.(all) A.(tail) C&W.(all) C&W.(tail) A.(all) A.(tail) C&W.(all) C&W.(tail) A.(all) A.(tail) !15RoBal 35.52% 27.82% 32.29% 24.53% 19.42% 19.08% 17.99% 17.66% 12.98% 12.12% 12.06% 11.29% BSL 32.62% 25.76% 29.64% 22.59% 19.23% 18.25% 17.34% 16.56% 15.05% 13.50% 13.30% 11.96% !15PGD-AT 31.18% 17.95% 28.90% 15.48% 19.52% 17.40% 17.42% 15.53% 14.38% 11.61% 12.74% 10.18% + UDR 28.93% 15.89% 26.95% 13.80% 17.47% 15.60% 15.83% 14.12% 13.31% 10.60% 11.93% 9.49% !15 + DAFA 31.14% 20.97% 28.73% 18.64% 18.54% 17.69% 16.76% 16.08% 14.13% 12.06% 12.92% 11.09% + RobustLT 32.70% 20.51% 29.97% 17.75% 18.88% 17.25% 16.91% 15.54% 15.03% 12.10% 13.21% 10.96% !15 + Ours 35.91% 28.04% 33.01% 25.09% 19.39% 19.04% 17.25% 17.03% 15.06% 13.99% 13.45% 12.29% TRADES 31.81% 18.39% 30.78% 17.29% 20.84% 18.35% 19.40% 17.14% 13.81% 10.91% 12.91% 10.18% !15 + UDR 30.92% 17.54% 29.54% 16.15% 18.98% 16.83% 17.45% 15.50% 12.23% 9.95% 11.09% 9.08% + DAFA 33.01% 22.45% 31.22% 20.66% 20.41% 19.20% 19.03% 18.01% 13.25% 11.15% 12.33% 10.34% !15 + RobustLT 32.69% 19.98% 31.22% 18.44% 21.64% 19.61% 20.21% 18.31% 14.19% 11.45% 13.06% 10.53% + Ours 34.69% 24.99% 32.24% 22.65% 21.79% 20.26% 19.94% 18.71% 14.28% 12.76% 12.92% 11.54% !15 AWP 30.15% 15.81% 29.15% 14.78% 22.06% 19.05% 20.67% 18.01% 12.48% 9.41% 11.23% 8.34% + UDR 32.35% 19.05% 29.92% 16.41% 21.84% 19.34% 20.03% 17.84% 10.46% 8.38% 9.80% 7.63% !15 + DAFA 35.37% 25.14% 32.99% 22.76% 23.54% 21.26% 21.37% 19.45% 16.54% 13.05% 11.67% 8.86% + RobustLT 37.11% 28.38% 35.01% 24.70% 23.80% 21.22% 21.50% 19.23% 17.14% 13.41% 15.46% 12.15% !15+ Ours 40.35% 33.32% 37.37% 30.55% 24.44% 24.10% 22.02% 21.83% 18.33% 16.95% 16.24% 14.90% Table 5: Ablation study of CGRm on CIFAR10-LT. ‘PCC’ denotes the balanced prior-calibrated classification term in Eq. (10), where the feedback reweighting wy(t)w_y^(t) and class-wise factor βy(t) _y^(t) are given in Eq. (11), and λm _m in Eq. (9) indicates whether the confusion-geometry margin term is used. PCC wy(t)w_y^(t) βy(t) _y^(t) λm _m CIFAR10-LT Nat.(all) Nat.(tail) Rob.(all) Rob.(tail) !15× ✓ ✓ ✓ 56.10% 45.56% 32.38% 20.49% ✓ × × × 64.60% 58.79% 32.96% 22.31% !15✓ × ✓ ✓ 68.27% 62.01% 34.78% 25.04% ✓ ✓ × ✓ 67.78% 61.51% 34.47% 24.96% !15✓ ✓ ✓ × 67.92% 61.67% 35.41% 24.61% ✓ ✓ ✓ ✓ 68.29% 62.39% 34.92% 27.06% Experimental details Datasets. Following RobustLT, we apply the exponential long-tailed sampling strategy (Cao et al. 2019) to derive CIFAR10‑LT, CIFAR100‑LT, and TinyImageNet‑LT (200 classes) from CIFAR10, CIFAR100 (Krizhevsky and Hinton 2009), and TinyImageNet (Le and Yang 2015), respectively. For C classes with imbalance ratio K, the number of training samples for class i is ni=nmaxK−iC−1,n_i=n_ K^- iC-1, (24) where classes are sorted from head to tail. We set the imbalance ratio to 5050 for CIFAR10-LT and 1010 for CIFAR100-LT and TinyImageNet-LT. The test sets retain the original balanced class distributions. Compared Methods. We compare against advanced AT techniques, including conventional debiased AT methods (RoBal (Wu et al. 2021), REAT (Li et al. 2023), BSL (Yue et al. 2024), TAET (Wang et al. 2025)) and plug‑in methods (UDR (Bui et al. 2022), CFA (Wei et al. 2023), DAFA (Lee et al. 2024), RobustLT (Zhang et al. 2026)) that are applied on base AT algorithms such as PGD‑AT (Madry et al. 2018), TRADES (Zhang et al. 2019), and AWP (Wu et al. 2020). For fair comparison, each plug-in method shares the same learner, backbone, and attack setting as its corresponding baseline. Evaluation Metrics. We report natural and robust accuracy on all test classes (Nat.(all) and Rob.(all)), as well as on the 80% of classes with fewest training samples (Nat.(tail) and Rob.(tail)). Robust accuracy is measured under a 20-step ℓ∞ _∞ PGD attack with radius 8/2558/255 and step size 2/2552/255. As an additional sanity check, we also evaluate the final models with AutoAttack to rule out gradient masking. Implementation Details. The main experiments use ResNet18, PreActResNet (He et al. 2016), WideResNet (Zagoruyko and Komodakis 2016) as backbones, optimized with SGD (momentum 0.9, weight decay 5×10−45× 10^-4) and an initial learning rate of 0.1. All models are trained for 110 epochs. The perturbation radius is set to ϵ=8/255ε=8/255. Adversarial examples are generated by 10-step PGD during training and evaluated by 20-step PGD at test time. The base AT configuration is kept unchanged. For CGRm-specific settings, the robust-error feedback and the confusion-geometry graph are updated every 1010 epochs. For each source class, the graph retains the top-33 most relevant target classes. The resulting graph is used only in the margin regularization term with weight λm=10/C _m=10/C, where C denotes the number of classes. All other CGRm-specific hyperparameters are fixed across datasets and listed in the appendix. Comparative Results Tables 1-3 present a comprehensive comparison across datasets, backbones, and base learners. Compared with existing plug‑in methods (e.g., UDR, CFA, DAFA, and RobustLT), CGRm consistently enhances both clean and adversarial performance, with the most stable gains observed on tail classes. For example, under ResNet‑based PGD‑AT on CIFAR10‑LT, CGRm increases Nat.(tail)/Rob.(tail) from 46.81%/18.60% (RobustLT) to 66.15%/27.93%. On CIFAR100‑LT with TRADES, it improves the best competitor’s Rob.(all)/Rob.(tail) from 20.68%/18.25% to 21.54%/20.73%, while also raising Nat.(all) from 45.50% to 48.81%. These gains indicate that the proposed method allocates robust learning pressure more effectively toward vulnerable classes and ambiguous boundaries. The improvement persists when switching from ResNet to Pre‑ResNet and WideResNet. On Pre‑ResNet, CGRm attains strong tail robustness. In the sole case where RobustLT marginally surpasses CGRm in overall robustness—TinyImageNet‑LT with TRADES (14.08% vs. 13.96% Rob.(all))—CGRm still improves Rob.(tail) from 11.22% to 13.28%. On WideResNet, the benefits scale with model capacity: CGRm boosts PGD‑AT on CIFAR10‑LT from 31.54%/19.11% to 35.64%/26.41% in Rob.(all)/Rob.(tail), and AWP combined with CGRm reaches 43.72%/37.79% on CIFAR10‑LT and 26.06%/25.85% on CIFAR100‑LT. Collectively, these comparisons demonstrate that CGRm effectively addresses the core robustness failure induced by class imbalance. Table 4 compares different methods under more stronger and diverse attacks, C&W (Carlini and Wagner 2017) and AutoAttack (Croce and Hein 2020). Similarly, CGRm improves tail robustness across base learners and datasets, while preserving competitive all-class robustness. Under PGD-AT, CGRm increases CIFAR10-LT C&W.(tail)/A.(tail) from 20.51%/17.75% with RobustLT to 28.04%/25.09%, and improves TinyImageNet-LT from 12.10%/10.96% to 13.99%/12.29%. Similar gains are observed with TRADES, where CGRm obtains stronger tail robustness than RobustLT on CIFAR10-LT (24.99%/22.65% vs. 19.98%/18.44%) and CIFAR100-LT (20.26%/18.71% vs. 19.61%/18.31%). With AWP, CGRm achieves the most consistent improvement, giving the best result on all reported metrics, including 40.35%/33.32% C&W accuracy and 37.37%/30.55% AutoAttack accuracy on CIFAR10-LT in all/tail classes. We note that a few all-class entries remain close or slightly favor competing methods, such as CIFAR100-LT A.(all) under TRADES. However, the corresponding tail metrics are consistently improved by CGRm. Ablation Study Table 5 ablates the four components of CGRm: the prior-calibrated classification term (PCC) in Eq. (10), feedback weight wyw_y and class-wise coefficient βy _y in Eq. (11), and confusion-geometry margin in Eq. (9). 1) Removing PCC drops natural accuracy from 68.29% to 56.10% (all) and from 62.39% to 45.56% (tail), and tail robust accuracy from 27.06% to 20.49%. 2) The two feedback components are complementary. Removing wyw_y lowers Rob.(tail) to 25.04%, indicating vulnerable source classes need stronger optimization contribution. Removing βy _y gives a similar drop to 24.96%, showing that loss reweighting alone is insufficient; consistency regularization must also be strengthened for under-robust classes. 3) Without the margin term, Rob.(all) slightly increases to 35.41%, but Rob.(tail) falls to 24.61%. Class-wise feedback alone improves average robustness, yet tail robustness requires correcting specific source-target confusions. The graph-guided margin thus trades a small average gain for substantial tail improvement. 4) Retaining PCC while disabling all three robust modules yields 64.60% Nat.(all), 58.79% Nat.(tail), 32.96% Rob.(all), and 22.31% Rob.(tail). Compared to this baseline, the full model improves all metrics, especially Rob.(tail) by 4.75 points. 5 Conclusion This paper presents CGRm, a confusion-geometry rebalanced framework for AT under long-tailed distributions. Our key insight is that robust imbalance cannot be adequately captured by class‑wise accuracy alone: adversarial errors tend to originate from vulnerable source classes and flow toward specific target classes, with the errors often arising from geometrically plausible tail‑to‑head confusions. To address this, CGRm converts the periodic robust evaluation into three components: source‑class loss weights, class‑wise robust coefficients, and a directed confusion‑geometry graph. By integrating feedback‑weighted robust optimization with graph‑guided margin correction, CGRm effectively strengthens under‑robust classes and hardens the decision boundaries most responsible for long‑tailed robust collapse. Extensive experiments and ablation studies demonstrate that our design improves robust performance over existing long‑tailed AT methods, confirming the effectiveness of both robust‑error feedback and confusion‑geometry boundary correction. References A. T. Bui, T. Le, Q. H. Tran, H. Zhao, and D. Phung (2022) A unified wasserstein distributional robustness framework for adversarial training. In International Conference on Learning Representations, Cited by: §2, §4. K. Cao, C. Wei, A. Gaidon, N. Arechiga, and T. Ma (2019) Learning imbalanced datasets with label-distribution-aware margin loss. In Advances in Neural Information Processing Systems, Cited by: §2, §4. N. Carlini and D. Wagner (2017) Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy (SP), p. 39–57. Cited by: §4. F. Croce and M. Hein (2020) Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In Proceedings of International Conference on Machine Learning (ICML), p. 1126–1135. Cited by: §4. C. Du, Y. Wang, S. Song, and G. Huang (2024) Probabilistic contrastive learning for long-tailed visual recognition. IEEE Transactions on Pattern Analysis and Machine Intelligence 46 (9), p. 5890–5904. Cited by: §1. I. J. Goodfellow, J. Shlens, and C. Szegedy (2015) Explaining and harnessing adversarial examples. In International Conference on Learning Representations, Cited by: §2. K. He, X. Zhang, S. Ren, and J. Sun (2016) Identity mappings in deep residual networks. In European conference on computer vision, p. 630–645. Cited by: §4. X. Jia, Y. Zhang, X. Wei, B. Wu, K. Ma, J. Wang, and X. Cao (2024) Improving fast adversarial training with prior-guided knowledge. IEEE Transactions on Pattern Analysis and Machine Intelligence 46 (9), p. 6367–6383. Cited by: §2. C. Jiang, M. Dong, Z. Wang, J. Gui, J. Jia, Y. Y. Tang, and J. T. Kwok (2026) Rethinking frequency modeling: tail-aware dynamic adversarial training for long-tailed robustness. IEEE Transactions on Information Forensics and Security. Cited by: §1. A. Krizhevsky and G. Hinton (2009) Learning multiple layers of features from tiny images. Technical report University of Toronto. Cited by: §4. Y. Le and X. Yang (2015) Tiny imagenet visual recognition challenge. CS 231N 7 (7), p. 3. Cited by: §4. H. Lee, S. Lee, H. Jang, J. Park, H. Bae, and S. Yoon (2024) DAFA: distance-aware fair adversarial training. In International Conference on Learning Representations, Cited by: §1, §4. G. Li, G. Xu, and T. Zhang (2023) Alleviating the effect of data imbalance on adversarial training. External Links: 2307.10205 Cited by: §2, §4. Z. Li, H. Zhang, J. Wang, M. Chen, H. Hu, W. Yi, X. Xu, M. Yang, and C. Ma (2025) From head to tail: efficient black-box model inversion attack via long-tailed learning. In Proceedings of the Computer Vision and Pattern Recognition Conference, p. 29288–29298. Cited by: §1. A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu (2018) Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, Cited by: §2, §4. Y. Qin, Y. Zhou, J. Wang, X. Xie, and H. Qi (2026) FedCART: tackling long-tailed distributions in federated adversarial training via classifier refinement. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 24557–24566. Cited by: §1. J. Ren, C. Yu, X. Ma, H. Zhao, S. Yi, et al. (2020) Balanced meta-softmax for long-tailed visual recognition. In Advances in Neural Information Processing Systems, p. 4175–4186. Cited by: §1, §2. A. Robey, F. Latorre, G. Pappas, H. Hassani, and V. Cevher (2024) Adversarial training should be cast as a non-zero-sum game. In International Conference on Learning Representations, Vol. 2024, p. 57834–57854. Cited by: §2. Y. Wang, J. Guo, A. Liu, K. Wang, Z. Wu, Z. Liu, W. Yin, and J. Liu (2025) TAET: two-stage adversarial equalization training on long-tailed distributions. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 15476–15485. Cited by: §2, §4. Z. Wei, Y. Wang, Y. Guo, and Y. Wang (2023) CFA: class-wise calibrated fair adversarial training. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 8193–8201. Cited by: §1, §2, §4. D. Wu, S. Xia, and Y. Wang (2020) Adversarial weight perturbation helps robust generalization. In Advances in Neural Information Processing Systems, p. 2958–2969. Cited by: §2, §4. T. Wu, Z. Liu, Q. Huang, Y. Wang, and D. Lin (2021) Adversarial robustness under long-tailed distribution. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 8659–8668. Cited by: §1, §2, §4. X. Yue, N. Mou, Q. Wang, and L. Zhao (2024) Revisiting adversarial training under long-tailed distributions. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, p. 24492–24501. Cited by: §1, §2, §4. X. Yue, M. Ningping, Q. Wang, and L. Zhao (2023) Revisiting adversarial robustness distillation from the perspective of robust fairness. Advances in Neural Information Processing Systems 36, p. 30390–30401. Cited by: §2. S. Zagoruyko and N. Komodakis (2016) Wide residual networks. arXiv preprint arXiv:1605.07146. Cited by: §4. H. Zhang, Y. Yu, J. Jiao, E. P. Xing, L. El Ghaoui, and M. I. Jordan (2019) Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning, p. 7472–7482. Cited by: §2, §4. L. Zhang, Y. Guo, Y. Li, J. Shi, and X. Liu (2026) Taming the long tail: rebalancing adversarial training via adaptive perturbation. External Links: 2506.13395 Cited by: §1, §2, §4. M. Zhao, L. Zhang, Y. Kong, and B. Yin (2023) Fast adversarial training with smooth convergence. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 4720–4729. Cited by: §1. M. Zhao, L. Zhang, Y. Kong, and B. Yin (2024a) Catastrophic overfitting: a potential blessing in disguise. In European Conference on Computer Vision, p. 293–310. Cited by: §1. M. Zhao, L. Zhang, B. Wang, T. Zheng, H. Zhong, and G. Min (2026) Mitigating error amplification in fast adversarial training. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, Cited by: §1. M. Zhao, L. Zhang, J. Ye, H. Lu, B. Yin, and X. Wang (2024b) Adversarial training: a survey. External Links: 2410.15042, Document Cited by: §1.