Deep neural networks achieve strong performance across many tasks but remain vulnerable to adversarial perturbations. Adversarial training (AT) is one of the most effective defenses, yet it suffers from high memory cost on large models and the persistent clean-robust accuracy trade-off. Recent work introduces parameter-efficient fine-tuning, such as LoRA, into AT, but this constraint induces a notable robustness gap relative to full-parameter AT. In this work, we revisit parameter-efficient adversarial fine-tuning from a parameter space perspective. Through gradient analysis, we find that adversarial optimization is highly concentrated on a small subset of parameters, which we call Robustness-Critical Parameters (RCPs), suggesting that robustness is encoded in a sparse subspace. Building on this observation, we propose Sparse Adversarial Fine-Tuning (SAFT), which identifies RCPs via adversarial gradient saliency and performs AT by updating only these parameters while freezing the rest. Across architectures and datasets, SAFT outperforms LoRA-based methods in both clean and robust accuracy with fewer trainable parameters, and approaches or surpasses full parameter AT in robustness while updating only about 5% of parameters.
Figures & tables
Figure 1: Top 5% of ViT-B parameters capture 67.7% of adversarial gradient.
Setting
Clean
PGD-20
Baseline
85.04
43.60
5% Random
81.83
39.48
RCPs 5%
29.82
3.70
Random 10%
66.46
32.18
RCPs 10%
24.35
4.75
Table 1: Masking RCPs is more destructive than masking random parameters.
Model
Method
Trainable Params
Clean
PGD-20
CW-20
PGD-100
AutoAttack
ViT-B (85.2M)
Pretrained
–
96.26
0.00
0.00
0.00
0.00
Full Parameter
85.2M (100%)
85.04
43.60
44.57
42.96
41.16
LoRA
4.7M (5.5%)
79.51
41.58
41.27
41.31
38.63
LNLoRA
4.8M (5.6%)
79.59
41.79
41.50
41.40
39.07
SAFT
3.1M (3.6%)
82.55
44.41
44.87
44.04
41.61
ViT-S (21.4M)
Pretrained
–
94.49
0.00
0.00
0.00
0.00
Table 2: Comparison across architectures on CIFAR-10. Trainable parameters refer to updated parameters during AT. Below each backbone: its total parameter count, to which LoRA-based methods add adapters.
Dataset
Method
Clean
PGD-20
CW-20
PGD-100
AutoAttack
CIFAR-100
Pretrained
86.10
0.00
0.00
0.00
0.00
Full Parameter
64.14
24.42
25.14
24.09
22.58
LoRA
60.78
22.25
22.21
21.81
19.76
LNLoRA
61.05
21.96
22.01
21.52
19.80
SAFT
62.60
24.84
24.80
24.45
21.80
TinyImageNet
Pretrained
80.94
0.00
0.00
0.00
0.00
Table 3: Comparison across datasets on ViT-B (CIFAR-10 results are in Table 2 ). SAFT consistently outperforms LoRA-based PEFT-AT in robust accuracy across CIFAR-10, CIFAR-100, and TinyImageNet. The robustness gap of LoRA-based methods grows with dataset complexity, while SAFT remains close to full-parameter AT.
Table 5
Method
AT Objective
Clean
PGD-20
CW-20
PGD-100
AutoAttack
Full Parameter
TRADES
86.24
42.88
43.61
42.55
41.38
LoRA
TRADES
86.26
40.22
39.96
39.79
38.00
LNLoRA
TRADES
86.04
39.47
39.16
39.02
37.38
SAFT
TRADES
87.00
43.07
43.06
42.74
41.04
Full Parameter
MART
75.91
48.73
46.12
48.57
44.73
LoRA
MART
66.66
42.31
39.37
42.30
38.00
Table 6: SAFT under different AT objectives on ViT-B and CIFAR-10. SAFT consistently outperforms LoRA-based PEFT-AT under all three AT objectives.
Method
Trainable
Clean
PGD-20
AA
LoRA
4.7M
79.51
41.58
38.63
LNLoRA
4.8M
79.59
41.79
39.07
DoRA
4.8M
80.16
43.18
40.29
SAFT
3.1M
82.55
44.41
41.61
Table 7: Comparison with LoRA variants on ViT-B and CIFAR-10.
RCPs %
Clean
PGD-20
CW-20
PGD-100
AA
1%
81.51
43.71
43.58
43.35
40.82
3%
81.56
43.88
44.01
43.60
41.20
5%
82.55
44.41
44.87
44.04
41.61
7%
82.66
44.71
44.87
44.29
41.68
100% (Full AT)
85.04
43.60
44.57
42.96
41.16
Table 8: Effect of the RCPs percentage on ViT-B and CIFAR-10. Even with only 1% of parameters selected as RCPs, SAFT recovers most of the robustness of full-parameter AT.
Table 9
Benchmark
Pretrained
Full AT
LoRA
SAFT
CIFAR-10.1
–
72.80 / 25.05
66.50 / 27.10
70.00 / 28.20
CINIC-10 IN
–
60.62 / 22.54
56.77 / 23.32
59.05 / 24.30
CIFAR-10-C
77.01 / 0.00
69.58 / 25.21
65.50 / 26.79
68.29 / 27.86
CIFAR-100-C
55.03 / 0.01
43.81 / 11.37
41.80 / 11.43
43.77 / 12.49
Tiny-ImageNet-C
35.20 / 0.00
19.50 / 2.57
16.99 / 0.88
17.73 / 2.79
Table 11: No-attack / PGD-20 accuracy (%) on shifted data. Corruptions use severity 5. CINIC-10 IN uses a class-balanced 10,000-image subsample.
Appendix figures & tables5 assets
Supplementary material from the paper’s appendix.
Appendix
Backbone
Params
Full AT (GiB)
SAFT (GiB)
Saved (GiB)
ViT-B
85.2M
1.27
0.66
0.61
ViT-L
304M
4.53
2.35
2.18
ViT-H
632M
9.42
4.88
4.54
ViT-g/14
1.1B
16.39
8.49
7.90
ViT-G/14
1.8B
26.82
13.90
12.92
SwinV2-G
3.0B
44.70
23.16
21.54
Appendix
Table 12: Analytic parameter-side memory (weights, gradients and Adam states, fp32) of Full AT and SAFT, extrapolated with the trainable fraction of ViT-B.
Backbone
Dataset
Top-5% share (%)
ViT-B
CIFAR-10
67.7
ViT-B
CIFAR-100
61.88
ViT-B
TinyImageNet
63.59
ResNet-50
CIFAR-10
43.15
Appendix
Table 13: Share of cumulative adversarial gradient saliency captured by the top 5% of parameters.
Zeroed subset (5%)
Clean
PGD-20
Rel. drop, clean
Rel. drop, PGD-20
Random
76.41
39.86
7.4%
10.2%
Weight magnitude
62.69
18.75
24.1%
57.8%
RCPs
30.60
6.23
62.9%
86.0%
Appendix
Table 14: Zeroing 5% of the parameters of the trained SAFT model. Relative drops are computed with respect to the unmasked SAFT model (82.55% clean, 44.41% PGD-20).
CIFAR-10-C
CIFAR-100-C
Tiny-ImageNet-C
Model
mCA
Δ%
mCA
Δ%
mCA
Δ%
Pretrained
86.81
9.81
68.51
20.44
51.81
35.99
Full AT
76.16
10.45
52.85
17.61
28.01
52.38
LoRA
70.73
11.04
50.19
17.43
25.12
54.76
SAFT
73.98
10.38
51.99
16.95
25.73
52.70
Appendix
Table 15: Mean corruption accuracy (mCA, %) and relative degradation ( Δ% , lower is better) on ViT-B.
CIFAR-10.1
CINIC-10 IN
Model
Clean
Acc.
Δ%
Acc.
Δ%
Full AT
85.04
72.80
14.39
60.11
29.31
LoRA
79.51
66.50
16.36
56.50
28.94
SAFT
82.55
70.00
15.20
58.79
28.78
Appendix
Table 16: Accuracy (%) and relative degradation ( Δ% ) under natural shift on ViT-B. CINIC-10 IN: ImageNet-sourced portion of the CINIC-10 test split.