ML Security PapersStudying Various Activation Functions and Non-IID Data for Machine Learning Model Robustness
Long Dang , Thushari Hapuarachchi , Kaiqi Xiong , Jing Lin
Published on arXiv
2512.04264
Input Manipulation Attack
OWASP ML Top 10 — ML01
Key Finding
With 40% data sharing in federated non-IID settings, the proposed approach achieves 70.09% natural and 54.79% robust accuracy, surpassing the CalFAT baseline.
Advanced Adversarial Training with Data Sharing
Novel technique introduced
Adversarial training is an effective method to improve the machine learning (ML) model robustness. Most existing studies typically consider the Rectified linear unit (ReLU) activation function and centralized training environments. In this paper, we study the ML model robustness using ten different activation functions through adversarial training in centralized environments and explore the ML model robustness in federal learning environments. In the centralized environment, we first propose an advanced adversarial training approach to improving the ML model robustness by incorporating model architecture change, soft labeling, simplified data augmentation, and varying learning rates. Then, we conduct extensive experiments on ten well-known activation functions in addition to ReLU to better understand how they impact the ML model robustness. Furthermore, we extend the proposed adversarial training approach to the federal learning environment, where both independent and identically distributed (IID) and non-IID data settings are considered. Our proposed centralized adversarial training approach achieves a natural and robust accuracy of 77.08% and 67.96%, respectively on CIFAR-10 against the fast gradient sign attacks. Experiments on ten activation functions reveal ReLU usually performs best. In the federated learning environment, however, the robust accuracy decreases significantly, especially on non-IID data. To address the significant performance drop in the non-IID data case, we introduce data sharing and achieve the natural and robust accuracy of 70.09% and 54.79%, respectively, surpassing the CalFAT algorithm, when 40% data sharing is used. That is, a proper percentage of data sharing can significantly improve the ML model robustness, which is useful to some real-world applications.
Key Contributions
- Advanced adversarial training approach combining architecture changes, soft labeling, data augmentation, and varying learning rates achieving 77.08%/67.96% natural/robust accuracy on CIFAR-10 against FGSM
- Systematic evaluation of ten activation functions under adversarial training, showing ReLU generally outperforms alternatives for robustness
- Data-sharing technique for federated learning with non-IID data that achieves 70.09%/54.79% natural/robust accuracy with 40% sharing, surpassing CalFAT
🛡️ Threat Analysis
Core contribution is an adversarial training defense against input manipulation attacks (FGSM, PGD, C&W, DeepFool) — both in centralized and federated environments. The entire paper is oriented around improving model robustness against adversarial examples at inference time.