Adversarial Robustness under Long-Tailed Distribution

TLDR

Adversarial robustness has been widely studied, yet most work assumes balanced datasets while real‑world data is often long‑tailed. This study investigates adversarial vulnerability and defense under long‑tailed distributions and introduces RoBal, the first framework addressing this gap. We systematically evaluate existing long‑tailed recognition methods with adversarial training and propose RoBal, combining a scale‑invariant classifier with margin‑engineering re‑balancing and boundary adjustment. We find that imbalanced data harms both accuracy and robustness, reveal that natural accuracy can be improved while robust accuracy gains are misleading, and show that RoBal outperforms state‑of‑the‑art defenses; code is released at the provided GitHub link.

Abstract

Adversarial robustness has attracted extensive studies recently by revealing the vulnerability and intrinsic characteristics of deep networks. However, existing works on adversarial robustness mainly focus on balanced datasets, while real-world data usually exhibits a long-tailed distribution. To push adversarial robustness towards more realistic scenarios, in this work we investigate the adversarial vulnerability as well as defense under long-tailed distributions. In particular, we first reveal the negative impacts induced by imbalanced data on both recognition performance and adversarial robustness, uncovering the intrinsic challenges of this problem. We then perform a systematic study on existing long-tailed recognition methods in conjunction with the adversarial training framework. Several valuable observations are obtained: 1) natural accuracy is relatively easy to improve, 2) fake gain of robust accuracy exists under unreliable evaluation, and 3) boundary error limits the promotion of robustness. Inspired by these observations, we propose a clean yet effective framework, RoBal, which consists of two dedicated modules, a scale-invariant classifier and data re-balancing via both margin engineering at training stage and boundary adjustment during inference. Extensive experiments demonstrate the superiority of our approach over other state-of-the-art defense methods. To our best knowledge, we are the first to tackle adversarial robustness under long-tailed distributions, which we believe would be a significant step towards real-world robustness. Our code is available at: https://github.com/wutong16/Adversarial_Long-Tail.