Adversarial Training

Adversarial training improves model robustness by incorporating adversarially perturbed examples directly into the optimization objective through a min-max formulation ^[134]. The Parametric Update coordinate reflects the defining operational property: adversarial perturbations are generated dynamically within the optimization loop, meaning the gradient signal itself is adversarially shaped at each training step—this is the mechanistic distinction from Data Augmentation, which modifies training inputs as a static pre-processing step independent of the gradient loop. This distinction is taxonomically consequential: adversarial training is a gradient-coupled technique whose computational cost scales with the inner maximization procedure at each step, while Data Augmentation's cost is absorbed in the data-loading stage. Both share Robustness, but only adversarial training carries Parametric Update with an adversarially shaped gradient signal, rather than the Pipeline-Mediated mechanism of augmentation. The DL, FM, LLM ceiling reflects an active research frontier: cross-modal adversarial robustness for vision-language MLLM architectures lacks standardized post-training protocols and established benchmark coverage, making the MLLM tier currently out of scope. Adversarial training universally trades off standard operational performance against robustness ^[195]; this Pareto trade-off must be explicitly characterized in the validation record, with the robustness-accuracy frontier documented as a system performance boundary—any deployment threshold revision following adversarial training constitutes a system behavior change requiring separate regression validation.