Adversarial training (AT) is widely regarded as a leading defense strategy for improving the robustness of deep learning models against adversarial attacks. However, existing AT methods often rely on a single attack strategy during training, which limits the exploration of the perturbation space and leads to poor generalization robustness against stronger, unseen, or adaptive adversarial attacks. Moreover, most AT approaches overlook class-wise robustness–the observed variation in robustness across different image classes–by focusing solely on average performance over the entire dataset. In this paper, we present Advanced Distributional Training with Class-wise Robustness (ADT++), a novel adversarial training framework that significantly improves generalization robustness against unseen and sophisticated adversarial attacks. Following the standard adversarial training framework, ADT++ is formulated as a minmax optimization problem, where the inner maximization aims to learn the worst-case adversarial distribution around adversarial examples to further explore the perturbation space. The outer minimization seeks to find model parameters that minimize the expected loss of the maximum inner loss. To further improve the generalization robustness, ADT++ leverages the class-wise robustness phenomenon by targeting the most vulnerable image classes with high-loss adversarial attacks to generate more impactful adversarial examples. Extensive evaluations on benchmark datasets and against various AT defense methods and adversarial attacks confirm the effectiveness of ADT++ in improving model robustness against stronger and adaptive attacks. The source code of ADT++ can be found.11https://github.com/LAiSR-SK/ADT2Plus

The well-trained image classification neural networks are vulnerable to adversarial examples. An adversarial example is a malicious input carefully crafted by adding small perturbations to the original input, leading to misclassification. Despite advancements in generating adversarial examples, to the best of our knowledge, none of the well-known adversarial attacks can generate effective adversarial examples that work efficiently on large-scale datasets and very deep neural network architectures. In contrast to ordinary adversarial examples, effective adversarial examples have all the following four characteristics: (1) the ability to maximize the loss of DNNs, (2) the ability to cause a high misclassification rate for both undefended and defended DNN models using various defense methods, (3) minimal perturbations with low computational overhead on large-scale datasets, (4) the ability to be transferable across different DNN architectures.To fill this void, we propose Fool-X, an algorithm to generate effective adversarial examples with the least perturbations that can fool state-of-the-art image classification neural networks. To evaluate the performance of Fool-X, we have conducted extensive experiments using 12 baseline adversarial training defense methods and six state-of-the-art adversarial attacks. The results reported on ImageNet-ILSVRC, CIFAR-100, and CIFAR-10 demonstrate that the proposed Fool-X algorithm can generate effective adversarial examples on large-scale datasets that can successfully fool the well-trained, defended image classification neural networks and significantly outperform the state-of-the-art adversarial attacks. The code is available: https://github.com/LAiSR-SK/fool-X-Attack