Dynamic Adversarial Optimization

• Dynamic adversarial optimization is a framework where attackers, defenders, or labels continuously adapt based on time, state, or interaction history.
• Methods such as bilevel, online, and closed-loop optimization enhance robustness by dynamically refining historical trajectories and adapting parameters during training and inference.
• Empirical studies show that dynamic techniques improve both robustness and nominal performance in applications like image classification, autonomous driving, and dynamic control.

Searching arXiv for the cited papers to ground the article in fresh records. Dynamic adversarial optimization can be understood as a family of optimization procedures in which the attacker, defender, target labels, optimization trajectory, environment distribution, or strategy policy is updated as a function of time, state, or interaction history rather than held fixed. Across the cited literature, the term spans adversarial training that refines historical optimization trajectories, test-time defenses that adapt model parameters during inference, closed-loop min-max formulations in reinforcement learning and autonomous driving, adversarial online optimization with dynamic regret, and adversarial methods for identifying dynamical regulation in biological systems (Huang et al., 2023, Wang et al., 2021, Kim et al., 13 Apr 2026, Chen et al., 2017, Teichner et al., 2023). This suggests that the unifying feature is not a single architecture or threat model, but the presence of an explicitly time-varying or state-contingent adversarial optimization loop.

1. Conceptual scope and recurring formulations

Several recurrent formulations appear across the literature. One is bilevel or min-max optimization, in which an inner adversary constructs perturbations or hard environments and an outer optimizer updates a model, policy, or weighting rule. Another is online optimization, in which losses, constraints, or opponents evolve over time and performance is measured against a dynamic comparator. A third is closed-loop adaptation, in which the defender and the adversary co-adapt during deployment rather than only during training (Liu et al., 2024, Shahrampour et al., 2017, Nie et al., 16 Mar 2026).

Mode	Dynamic object	Representative papers
Training-time adaptation	Trajectories, labels, iteration count, model-data pairs	(Huang et al., 2023, Liu et al., 2024, Wang et al., 2021, Zhang et al., 17 Mar 2025)
Test-time or inference-time adaptation	BN parameters, input smoothing, ensemble weights, displayed patches	(Wang et al., 2021, Waghela et al., 2024, Chahe et al., 2023)
Closed-loop or online adversarial optimization	Dynamics models, scenario generators, losses, constraints, bandit arms	(Kim et al., 13 Apr 2026, Nie et al., 16 Mar 2026, Chen et al., 2017, Li et al., 15 May 2026)

Formally, the family includes objectives such as adversarial training with dynamic labels,

$$\min_{\theta_g,\theta_t}\frac{1}{|D|}\sum_{(x,y)\in D}\left\{\mathcal{L}_g(\theta_g,f_g(x),y)+\beta \mathcal{L}_t(\theta_t,f_t(x+\delta),l^{nat})\right\},$$

test-time defensive entropy minimization,

$$\min_{\Delta,\Sigma}\, H\left(f(g(x+\delta;\Sigma);\theta+\Delta)\right),$$

and closed-loop robust control,

$$\max_{\theta}\min_{\psi\in\Psi} J(\pi_\theta,\mathcal{P}_\psi),$$

all of which instantiate adversarial optimization with explicitly dynamic state or parameter updates (Liu et al., 2024, Wang et al., 2021, Nie et al., 16 Mar 2026).

A common misconception is that the topic is equivalent to standard adversarial example generation. The cited work does not support that restriction. Dynamic adversarial optimization also includes adversarial bandits for social interaction, distributed mirror descent for target tracking in the presence of adversarial noise, and optimization of graph spectra against adversarial resonance attacks (Li et al., 15 May 2026, Shahrampour et al., 2017, Sahin et al., 2024).

2. Training-time dynamic adversarial optimization

A central line of work modifies adversarial training itself by making the optimization target evolve during training. “Enhancing Adversarial Training via Reweighting Optimization Trajectory” introduces Weighted Optimization Trajectories (WOT), which approaches robust overfitting from the perspective of “refining historical optimization trajectories.” During adversarial training, model increments are cached and then reweighted by learnable coefficients,

$$\widetilde{w}'=w+\widetilde{\Delta w},\qquad \widetilde{\Delta w}=\alpha^1\Delta w^1+\cdots+\alpha^k\Delta w^k,$$

with the weights learned on a “small, unseen hold-out set.” The method is explicitly designed to improve robustness on unseen data rather than to optimize training robustness. The paper reports that WOT “boosts the robust accuracy of AT-PGD under AA-$L_{\infty}$ attack by 1.53\% $\sim$ 6.11\% and meanwhile increases the clean accuracy by 0.55\%$\sim$5.47\% across SVHN, CIFAR-10, CIFAR-100, and Tiny-ImageNet datasets,” and that block-wise refinement “consistently leads to better performance” (Huang et al., 2023).

“Dynamic Label Adversarial Training for Deep Learning Robustness Against Adversarial Attacks” modifies both the outer and inner problems. DYNAT trains a guiding model on clean data and a target model on adversarial examples labeled by the guide. The dynamic label is

$l^{nat}=\mathrm{onehot}(\arg\max f_g(x)).$

The target model therefore “gradually and dynamically gain[s] robustness from the guide model’s decisions,” while adversarial examples are generated with respect to the current dynamic label rather than a static ground-truth label. The paper states that previous methods “primarily use static ground truth for adversarial training, but this often causes robust overfitting,” and reports that DYNAT and its variants “consistently achieve the highest or close-to-highest clean accuracy” while improving robustness under PGD, CW, and AutoAttack on CIFAR-10 and CIFAR-100 (Liu et al., 2024).

A different dynamic mechanism is schedule adaptation. “Dynamic Efficient Adversarial Training Guided by Gradient Magnitude” proposes DEAT, which “gradually increases the adversarial iteration during training.” Its M+ acceleration strategy uses the magnitude of the input gradient as a criterion for when to increase adversarial steps. The paper reports that M+-accelerated methods are “17–40% faster than their vanilla counterparts with equal/better robustness” on CIFAR-10 and that ImageNet training time is reduced by “16–34%” compared to FREE while keeping comparable robustness (Wang et al., 2021).

Transfer-learning-based adversarial fine-tuning offers another variant. “Adversarial Fine-tune with Dynamically Regulated Adversary” introduces a clean pretraining phase followed by fine-tuning with a “1:1 mix of clean and DRA-generated adversarial samples.” Its Dynamically Regulated Adversarial Attack (DRA) perturbs only the most significant pixels under an $L_1$ constraint and linearly decays the attack budget during fine-tuning. The paper reports, for CIFAR-10 with ResNet-50, “93.8% clean” and “10.9% robust” for DRA with max $\epsilon=2$, compared with “93.7% clean, 5.6% (PGD$$\min_{\Delta,\Sigma}\, H\left(f(g(x+\delta;\Sigma);\theta+\Delta)\right),$$0) robustness” for vanilla training and “91.4% clean, 8.6% robust” for TRADES (Hou et al., 2022).

The same training-time principle extends from instance-wise perturbations to universal ones. “Improving Generalization of Universal Adversarial Perturbation via Dynamic Maximin Optimization” argues that static model snapshots “do not fully leverage the potential of DNNs to generate more effective UAPs.” DM-UAP introduces an “iterative max-min-min optimization framework” and a curriculum schedule over parameter and data neighborhoods. Using only 500 samples for UAP generation, it “outperforms the state-of-the-art approach with an average increase in fooling ratio of 12.108%” on ImageNet (Zhang et al., 17 Mar 2025).

3. Test-time adaptation and attack-time dynamics

Dynamic adversarial optimization is not limited to training. “Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attacks” proposes dent, a test-time defense in which models “fight back, and optimize their defenses against attacks at test time.” Dent “adapts the model and input during testing, by defensive entropy minimization,” updating BN affine parameters and optionally Gaussian smoothing parameters to minimize predictive entropy. The paper reports that dent “boosts state-of-the-art defenses by 20+ points absolute against AutoAttack on CIFAR-10 at $$\min_{\Delta,\Sigma}\, H\left(f(g(x+\delta;\Sigma);\theta+\Delta)\right),$$1,” and that on CIFAR-10 Carmon19 improves from “59.5% accuracy” statically to “74.7%” with dent and “82.3%” with dent+ (Wang et al., 2021).

Dynamic adaptation also appears in ensemble methods for NLP. “Adversarial Robustness through Dynamic Ensemble Learning” introduces ARDEL, which “dynamically adjusts the ensemble configuration based on input characteristics and detected adversarial patterns.” The method combines a “meta-model for dynamic weighting,” an “adversarial pattern detection module,” and adversarial training with regularization techniques. In the reported experiments, under TextFooler attack on AG News, “ARDEL-BERT achieved 82.7% vs. FreeLB++ (54.7%) and InfoBERT (35.5%),” and on IMDB “ARDEL reaches 84.8%, while FreeLB++ is at 44.2% and InfoBERT at 29.2%” (Waghela et al., 2024).

Dynamic optimization can also target the attack process itself. “Dynamic Adversarial Attacks on Autonomous Driving Systems” uses a screen mounted on a moving vehicle to display patches that adapt to geometry and environmental conditions. The optimization objective maximizes target-class confidence, objectness, and IoU at the target location, while a Screen Image Transformation Network (SIT-Net) narrows “the gap between simulated and real-world scenarios.” The paper reports dynamic patch success rates of “39.9%” for Go-straight, “27.4%” for Turn, and “18.0%” for Pedestrian, compared with “30.0%,” “22.1%,” and “15.2%” for static patches and near-zero rates for printed patches (Chahe et al., 2023).

At a lower level of attack optimization, “GradMDM: Adversarial Attack on Dynamic Networks” targets dynamic neural networks by maximizing activated computation units rather than classification error. Its Power Loss adjusts gradient magnitudes, and Complexity Gradient Masking (CGM) adjusts directions to reduce gradient conflicts. On ImageNet, the paper reports ARP of “99.3” for SkipNet, “99.0” for SACT, and “99.3” for ManiDP, all with lower MSE and higher PSNR than ILFO (Pan et al., 2023). “Optimizing the Adversarial Perturbation with a Momentum-based Adaptive Matrix” advances this line with AdaMI, a momentum-based adaptive matrix attack that “is proved to attain optimal convergence for convex problems” and is reported to boost adversarial transferability “while maintaining better stability and imperceptibility” (Tao et al., 16 Dec 2025).

4. Closed-loop games, online optimization, and dynamic systems

A more general formulation treats adversarial optimization as a dynamic game. “Robust Adversarial Policy Optimization Under Dynamics Uncertainty” presents RAPO, which combines “trajectory-level robustness” and “model-level robustness.” At the trajectory level, a dual temperature parameter is approximated with an adversarial network, and at the model level the method uses “Boltzmann reweighting over dynamics ensembles.” The paper states that the two components “act independently and complement each other,” and reports that RAPO “outperforms robust RL baselines, improving resilience to uncertainty and generalization to out-of-distribution dynamics while maintaining dual tractability” (Kim et al., 13 Apr 2026).

“ADV-0: Closed-Loop Min-Max Adversarial Training for Long-Tail Robustness in Autonomous Driving” casts interaction between defender and attacker as a “zero-sum Markov game.” The adversary distribution has an energy-based form proportional to a traffic prior times $$\min_{\Delta,\Sigma}\, H\left(f(g(x+\delta;\Sigma);\theta+\Delta)\right),$$2, and dynamic adversary evolution is implemented through “iterative preference learning.” The paper states that ADV-0 “converges to a Nash Equilibrium and maximizes a certified lower bound on real-world performance,” while experiments indicate that it “effectively exposes diverse safety-critical failures and greatly enhances the generalizability of both learned policies and motion planners against unseen long-tail risks” (Nie et al., 16 Mar 2026).

In online optimization, the adversarial object may be the loss sequence, the constraint sequence, or the system disturbance. “An Online Convex Optimization Approach to Dynamic Network Resource Allocation” studies adversarial loss functions and adversarial constraints with delayed revelation. It defines dynamic regret against the best per-slot decision and dynamic fit as accumulated constraint violation, and proves that the modified online saddle-point scheme yields “sub-linear dynamic regret and fit” when cumulative variation is sub-linear (Chen et al., 2017). “An Online Optimization Approach for Multi-Agent Tracking of Dynamic Parameters in the Presence of Adversarial Noise” uses decentralized Mirror Descent and proves that the dynamic regret bound “scales inversely in the network spectral gap” and represents “the adversarial noise causing deviation with respect to the linear dynamics” (Shahrampour et al., 2017).

Not all adversarial dynamics concern machine-learned policies. “Identifying Dynamic Regulation with Adversarial Surrogates” introduces IDRAS, a min-max framework for discovering quantities regulated with respect to an unknown dynamic reference in biological and physical systems. The algorithm alternates between a combination player minimizing a coefficient of regulation and a shuffle player constructing hard surrogates. The paper reports, for example, that in a kinetic biological model “IRAS failed ($$\min_{\Delta,\Sigma}\, H\left(f(g(x+\delta;\Sigma);\theta+\Delta)\right),$$3),” whereas “IDRAS detected correct combination ($$\min_{\Delta,\Sigma}\, H\left(f(g(x+\delta;\Sigma);\theta+\Delta)\right),$$4), tracking the dynamic reference ($$\min_{\Delta,\Sigma}\, H\left(f(g(x+\delta;\Sigma);\theta+\Delta)\right),$$5)” (Teichner et al., 2023).

5. Empirical patterns across application domains

Across domains, dynamic adversarial optimization is repeatedly used to mitigate a static baseline’s failure to track a moving target. In adversarially robust image classification, WOT is reported to “consistently overcome[] the robust overfitting issue,” DYNAT is designed to address the fact that static labels “often cause robust overfitting,” and DEAT uses gradient magnitude to determine when additional adversarial strength is warranted (Huang et al., 2023, Liu et al., 2024, Wang et al., 2021).

In medical imaging, “Adversarial robustness of a U-Net-based model observer for CT protocol optimization” studies a multi-task U-Net for detection and localization of low-contrast objects. The baseline is vulnerable: “Fast gradient perturbations produced high misclassification rates, reaching up to 75% at intermediate perturbation levels,” while optimization-based attack achieved success rates “close to 50% for both tasks.” After dynamic adversarial training, the success rate of optimization-based attacks is reduced “to 7% for classification and 13% when including localization-specific training,” with “no statistically significant degradation” in localization ROC area under the curve or overall AI–human agreement (Balli et al., 29 Jun 2026).

In adversarial nets beyond robustness, “Mind the (optimality) Gap: A Gap-Aware Learning Rate Scheduler for Adversarial Nets” treats the discrepancy between current adversarial loss and a known ideal value as an optimality gap, and dynamically adjusts the adversary’s learning rate to maintain balance. On CelebA, the scheduler “requires only one-tenth of the tuning budget needed without a scheduler,” and it yields “up to $$\min_{\Delta,\Sigma}\, H\left(f(g(x+\delta;\Sigma);\theta+\Delta)\right),$$6 in Frechet Inception Distance for image generation and $$\min_{\Delta,\Sigma}\, H\left(f(g(x+\delta;\Sigma);\theta+\Delta)\right),$$7 in test accuracy for domain adaptation” (Hazimeh et al., 2023).

Dynamic adversarial optimization also appears in non-vision applications. “Competitive Coevolution as an Adversarial Approach to Dynamic Optimization” reformulates dynamic optimization as a static set-oriented minimax problem and uses competitive coevolution to build an offline archive of solutions for rapid online adaptation (Lu et al., 2019). “ALSO: Adversarial Online Strategy Optimization for Social Agents” formulates multi-turn interaction as an adversarial bandit problem and augments it with a “lightweight neural surrogate to predict rewards from interaction histories.” On Sotopia-Hard, ALSO reports “7.11” Goal, “2.43” Relationship, “5.47” Knowledge, and “3.53” Overall, compared with “6.52,” “1.32,” “4.37,” and “3.02” for Vanilla (Li et al., 15 May 2026).

These results suggest a recurring empirical pattern: whenever the adversary, defender, or evaluation environment changes substantially during optimization or deployment, static surrogates tend to leave blind spots, whereas dynamic adaptation is used to expose shifting failure modes, preserve nominal performance, or reduce manual tuning.

6. Misconceptions, limitations, and research directions

One misconception is that “dynamic” always means stronger attacks. The literature shows several other meanings: reweighting historical increments in WOT, dynamically evolving labels in DYNAT, automatic iteration schedules in DEAT, test-time parameter updates in dent, dynamic ensemble reconfiguration in ARDEL, and online strategy selection in ALSO (Huang et al., 2023, Wang et al., 2021, Waghela et al., 2024, Li et al., 15 May 2026).

A second misconception is that dynamic methods necessarily sacrifice clean or nominal performance. Several papers explicitly frame the problem as a robustness–performance balance. The transfer-learning strategy in DRA is motivated by the question of improving robustness “without sacrificing standard performance,” WOT reports simultaneous gains in robust and clean accuracy, and RAPO is designed to “directly expose[] the robustness-performance trade-off” while preserving in-distribution performance (Hou et al., 2022, Huang et al., 2023, Kim et al., 13 Apr 2026).

The literature also points to limitations. Dynamic methods often introduce additional inner-loop optimization, auxiliary models, or memory costs. WOT reports that memory and computation increase is “marginal,” but only because trajectory gaps are large and block counts are small; RAPO is “less compute-efficient per step than PPO”; and DM-UAP reports “1.6x SGA” time or memory cost (Huang et al., 2023, Kim et al., 13 Apr 2026, Zhang et al., 17 Mar 2025). This suggests that the central engineering problem is not merely robustness, but tractable adaptation.

A final controversy concerns evaluation. Dynamic defenses and dynamic adversaries alter the object being evaluated during inference or training. Dent is explicitly designed for “white-box, black-box, and adaptive attacks,” while ADV-0 criticizes prior work for decoupling scenario generation from policy optimization and thereby inducing “objective misalignment” (Wang et al., 2021, Nie et al., 16 Mar 2026). A plausible implication is that, for dynamic adversarial optimization, robustness evaluation is inseparable from the protocol that governs co-adaptation, information flow, and update timing.

Taken together, the cited work does not define a single canonical framework, but it does define a coherent research direction: adversarial optimization becomes dynamic whenever the optimizer treats time, interaction, or non-stationarity as part of the adversarial problem itself, rather than as an external nuisance.