DMAT: Dual Manifold Adversarial Training

• DMAT is an adversarial defense framework that combines image-space (L∞) and latent-space perturbation training to address conventional robustness–accuracy trade-offs.
• It leverages a generative model to construct an exact image manifold, enabling realistic on-manifold variations alongside traditional off-manifold attacks.
• Empirical results demonstrate that DMAT improves clean accuracy and robustness to unseen transformations, such as fog and elastic deformations, while maintaining competitive L∞ defense.

DMAT, short for Dual Manifold Adversarial Training, is an adversarial defense framework that jointly trains a classifier against two complementary perturbation families: conventional image-space $L_\infty$-bounded perturbations and latent-space perturbations constrained to lie on a learned image manifold. In "Dual Manifold Adversarial Robustness: Defense against $L_p$ and non-$L_p$ Adversarial Attacks" (Lin et al., 2020), DMAT is introduced to address two limitations of standard adversarial training: the robustness–accuracy trade-off and weak generalization to attacks outside the training threat model, including on-manifold perturbations, global color shifts, and image filtering.

1. Definition and motivating problem

Standard adversarial training considers a classifier $f_\theta : X \to Y$ over images $x \in X = \mathbb{R}^{H \times W \times C}$ and labels $y$, and optimizes the min–max objective

$$\min_\theta \sum_i \max_{\delta \in \Delta} L(f_\theta(x_i + \delta), y_i), \quad \Delta = \{\delta : \|\delta\|_p < \epsilon\}.$$

In the setting emphasized by the paper, $p=\infty$ and the inner maximization is commonly solved with PGD (Lin et al., 2020).

The paper identifies two well-known weaknesses of this paradigm. First, strong $L_p$ adversarial training significantly reduces standard accuracy. Second, robustness to $L_\infty$ perturbations generalizes poorly to other norms, non-$L_p$0 transformations, and attacks constrained to lie on the data manifold. DMAT is proposed to combine the strengths of conventional off-manifold adversarial training in image space and on-manifold adversarial training in latent space, thereby improving robustness beyond a single threat model (Lin et al., 2020).

The construction relies on a generative model $L_p$1 with latent variable $L_p$2, so that $L_p$3 and the support of $L_p$4 approximates a low-dimensional manifold $L_p$5. The paper’s central intuition is that latent codes often correspond to semantic, higher-level features such as object shape, pose, and color. Perturbing latent space can therefore generate realistic, label-preserving variations, while pixel-space perturbations remain necessary to defend against conventional $L_p$6 attacks.

2. Exact manifold construction: OM-ImageNet

A recurring difficulty in manifold-based robustness work is that the true natural-image manifold is unknown. The paper circumvents this by constructing OM-ImageNet, a dataset for which the manifold is exact by construction (Lin et al., 2020).

The starting point is Mixed-10, a 10-superclass subset of ImageNet. A StyleGAN is trained on this subset, with mapping network $L_p$7 and synthesis network $L_p$8. The image manifold approximation is

$L_p$9

Each real image $L_p$0 is projected into StyleGAN latent space by solving

$L_p$1

This inversion produces latent codes and reconstructions for both train and test images. The paper defines

$L_p$2

with $L_p$3, $L_p$4, over 10 classes.

OM-ImageNet uses only the reconstructed images $L_p$5. Consequently, every sample used in the robustness experiments is exactly of the form $L_p$6, so the support of the data distribution is

$L_p$7

This exactness matters because it cleanly separates on-manifold perturbations from off-manifold perturbations. It also permits a direct test of whether robustness learned on the manifold transfers to the original natural images $L_p$8, which are treated as out-of-manifold inputs.

3. Complementary threat models: latent-space versus pixel-space training

On-manifold adversarial examples are generated by perturbing the latent code: $L_p$9 The paper uses $f_\theta : X \to Y$0 and implements the attack with OM-FGSM or OM-PGD-$f_\theta : X \to Y$1. The corresponding training objective is

$f_\theta : X \to Y$2

For comparison, standard adversarial training on OM-ImageNet uses

$f_\theta : X \to Y$3

with $f_\theta : X \to Y$4 and PGD-5 during training (Lin et al., 2020).

The empirical contrast between these regimes is the immediate motivation for DMAT. On OM-ImageNet with ResNet-50, latent-only adversarial training improves clean accuracy and on-manifold robustness, but fails against standard pixel-space attacks; pixel-only adversarial training does the reverse.

Method	Clean	PGD-50	OM-PGD-50
Normal	74.72	0.00	0.26
AT [PGD-5]	73.31	38.88	7.23
OM-AT [OM-FGSM]	80.77	0.03	20.19
OM-AT [OM-PGD-5]	78.10	0.25	27.53
DMAT [PGD-5, OM-PGD-5]	77.96	37.86	20.53

These results establish a specific complementarity. Standard adversarial training is strong against $f_\theta : X \to Y$5 image-space attacks but weak against on-manifold attacks. On-manifold adversarial training is strong against latent-space attacks and yields higher clean accuracy, but is essentially broken by PGD-50 in image space. A common misconception is that manifold-consistent perturbations subsume conventional adversarial perturbations; the OM-ImageNet experiments show the opposite. Since no out-of-manifold perturbations are realized in latent-only training, the resulting classifier remains vulnerable to ordinary pixel-space attacks (Lin et al., 2020).

4. Dual Manifold Adversarial Training: objective and procedure

DMAT combines both perturbation families in a single min–max objective: $f_\theta : X \to Y$6 where

$f_\theta : X \to Y$7

with $f_\theta : X \to Y$8 and $f_\theta : X \to Y$9 in the reported experiments (Lin et al., 2020).

The first term enforces robustness to off-manifold pixel perturbations; the second enforces robustness to on-manifold latent perturbations. The paper uses PGD-5 in image space and OM-PGD-5 in latent space during training, then sums the two losses equally. No extra weighting parameter is introduced between the two branches.

The algorithmic procedure is organized per minibatch. For each sample $x \in X = \mathbb{R}^{H \times W \times C}$0, the method first generates an image-space adversarial example by projected gradient ascent on $x \in X = \mathbb{R}^{H \times W \times C}$1, then generates a latent-space adversarial example by projected gradient ascent on $x \in X = \mathbb{R}^{H \times W \times C}$2, and finally updates $x \in X = \mathbb{R}^{H \times W \times C}$3 using the sum of the two losses. The same optimizer hyperparameters as in the single-space experiments are used: SGD, momentum $x \in X = \mathbb{R}^{H \times W \times C}$4, weight decay $x \in X = \mathbb{R}^{H \times W \times C}$5, cyclic learning rate, and 20 epochs.

The paper also introduces DMAT + TRADES, which augments image-space TRADES with an additional latent-space consistency term: $x \in X = \mathbb{R}^{H \times W \times C}$6 The two inner maximizations are solved with PGD-5 and OM-PGD-5, respectively. This extension indicates that the dual-manifold idea is not tied to a single robust optimization objective and can be combined with TRADES in a direct way.

5. Empirical robustness to $x \in X = \mathbb{R}^{H \times W \times C}$7, non-$x \in X = \mathbb{R}^{H \times W \times C}$8, and unseen attacks

The central empirical claim of DMAT is not that it dominates standard adversarial training on its primary $x \in X = \mathbb{R}^{H \times W \times C}$9 threat model, but that it preserves nearly the same $y$0 robustness while improving clean accuracy and markedly improving robustness to attacks it was not explicitly trained against (Lin et al., 2020).

On OM-ImageNet, DMAT attains clean accuracy $y$1, compared with $y$2 for standard AT [PGD-5], while keeping PGD-50 robustness essentially comparable at $y$3 versus $y$4. At the same time, OM-PGD-50 robustness rises from $y$5 under standard AT to $y$6 under DMAT.

The paper then evaluates novel attacks drawn from Kang et al. (2019): Fog, Snow, Elastic, Gabor, JPEG, $y$7, and $y$8. On every reported unseen attack, DMAT exceeds AT [PGD-5]:

Method	Fog	Snow	Elastic	Gabor	JPEG	$y$9	$$\min_\theta \sum_i \max_{\delta \in \Delta} L(f_\theta(x_i + \delta), y_i), \quad \Delta = \{\delta : \|\delta\|_p < \epsilon\}.$$0
AT [PGD-5]	19.76	46.39	50.32	50.43	10.23	41.98	21.21
DMAT [PGD-5, OM-PGD-5]	31.78	51.19	56.09	51.61	14.31	51.36	29.68

The gains are especially large for Fog, $$\min_\theta \sum_i \max_{\delta \in \Delta} L(f_\theta(x_i + \delta), y_i), \quad \Delta = \{\delta : \|\delta\|_p < \epsilon\}.$$1, and $$\min_\theta \sum_i \max_{\delta \in \Delta} L(f_\theta(x_i + \delta), y_i), \quad \Delta = \{\delta : \|\delta\|_p < \epsilon\}.$$2. The paper describes these as substantial gains, often $$\min_\theta \sum_i \max_{\delta \in \Delta} L(f_\theta(x_i + \delta), y_i), \quad \Delta = \{\delta : \|\delta\|_p < \epsilon\}.$$3–$$\min_\theta \sum_i \max_{\delta \in \Delta} L(f_\theta(x_i + \delta), y_i), \quad \Delta = \{\delta : \|\delta\|_p < \epsilon\}.$$4 absolute. This suggests that robustness learned jointly on and off the manifold transfers to structured transformations not captured by the original image-space training threat model.

The TRADES extension exhibits the same pattern. Relative to TRADES, DMAT+TRADES improves clean accuracy from $$\min_\theta \sum_i \max_{\delta \in \Delta} L(f_\theta(x_i + \delta), y_i), \quad \Delta = \{\delta : \|\delta\|_p < \epsilon\}.$$5 to $$\min_\theta \sum_i \max_{\delta \in \Delta} L(f_\theta(x_i + \delta), y_i), \quad \Delta = \{\delta : \|\delta\|_p < \epsilon\}.$$6, improves OM-PGD-50 robustness from $$\min_\theta \sum_i \max_{\delta \in \Delta} L(f_\theta(x_i + \delta), y_i), \quad \Delta = \{\delta : \|\delta\|_p < \epsilon\}.$$7 to $$\min_\theta \sum_i \max_{\delta \in \Delta} L(f_\theta(x_i + \delta), y_i), \quad \Delta = \{\delta : \|\delta\|_p < \epsilon\}.$$8, and improves robustness on Fog, Elastic, JPEG, and $$\min_\theta \sum_i \max_{\delta \in \Delta} L(f_\theta(x_i + \delta), y_i), \quad \Delta = \{\delta : \|\delta\|_p < \epsilon\}.$$9, while reducing PGD-50 robustness from $p=\infty$0 to $p=\infty$1. The result is not a monotone improvement in every metric; rather, it is a rebalancing of the robustness profile toward manifold-consistent and unseen perturbations.

6. Generalization beyond the exact manifold, relation to prior work, and limitations

Although OM-ImageNet is an idealized construction, the paper explicitly evaluates the same models on the original natural images $p=\infty$2, treated as out-of-manifold inputs. The qualitative pattern persists (Lin et al., 2020).

On out-of-manifold natural images, AT [PGD-5] yields clean accuracy $p=\infty$3 and PGD-50 robustness $p=\infty$4, while DMAT yields clean accuracy $p=\infty$5 and PGD-50 robustness $p=\infty$6. DMAT again improves robustness to Fog, Snow, Elastic, JPEG, $p=\infty$7, and $p=\infty$8: for example, Fog rises from $p=\infty$9 to $L_p$0, Elastic from $L_p$1 to $L_p$2, and $L_p$3 from $L_p$4 to $L_p$5. A common objection to manifold-based defenses is that exact-manifold experiments are too artificial to say anything about natural images; the out-of-manifold results do not remove that concern, but they show that the observed gains are not confined to reconstructed samples alone.

Within the paper’s framing, DMAT extends two strands of prior work. Relative to standard adversarial training, it retains the image-space branch and therefore keeps comparable $L_p$6 robustness. Relative to manifold-based defenses such as those of Jalal et al. and Stutz et al., it scales the analysis to a StyleGAN-based exact manifold for a subset of ImageNet and demonstrates that on-manifold training alone does not protect against off-manifold $L_p$7 attacks (Lin et al., 2020). The paper therefore positions DMAT as a hybrid manifold-aware extension to AT and TRADES rather than as a replacement for them.

The method also has explicit limitations. It depends on a strong generative model and an inversion pipeline based on

$L_p$8

Its main experimental setting is a 10-class subset of ImageNet rather than full ImageNet. Training requires generating two adversarial examples per sample, one in image space and one in latent space, and latent attacks require differentiation through the generator. The reported PGD-50 robustness is slightly lower than that of standard AT in both on-manifold and out-of-manifold evaluation. The paper therefore presents DMAT not as a complete solution to adversarial robustness, but as evidence that manifold information can improve robustness to $L_p$9, non-$L_\infty$0, and out-of-manifold perturbations when it is combined with conventional adversarial training rather than substituted for it.