An arXiv preprint reports higher combined adversarial accuracy for Robust CurveMoE, a sparse mixture-of-experts method, than the strongest named baseline on CIFAR-100 and ImageNet-100. The reported gain in Union accuracy—the share of samples classified correctly under all three tested threat models—was 2.37 percentage points on CIFAR-100 and 2.13 points on ImageNet-100. That is a result from the paper’s benchmark experiments, not a claim that the system has been tested against every possible attack.
The paper asks whether complementary robustness under ℓ1, ℓ2 and ℓ∞ perturbations can remain available as separate capabilities and be used adaptively for each input, instead of being forced into one parameter configuration.
A curve of candidate experts
Robust CurveMoE builds a curve-derived candidate pool, constrains candidate selection by worst-case cross-norm robustness, and uses a top-1 router so each input is handled by a selected expert. Only influential layers are turned into expert layers; the remaining layers are shared. The training procedure then updates part of the curve using a contribution-guided rule before robust fine-tuning.
The reported evaluation used CIFAR-100 with WideResNet-28-10 and ImageNet-100 with ViT-Tiny/16. The schedules were 150 endpoint, 50 curve and 50 MoE epochs for CIFAR-100, and 30 endpoint, 20 curve and 20 MoE epochs for ImageNet-100. Robust accuracy was measured with AutoAttack at ℓ1, ℓ2 and ℓ∞ budgets of 12, 0.5 and 8/255 on CIFAR-100, and 75, 2.0 and 4/255 on ImageNet-100; clean accuracy used clean test samples.
The comparison named MSD and ERMC as baselines. The paper’s default configuration used a 30% partial curve-update ratio, three MoE layers, a candidate tolerance of 2 percentage points and a fine-tuning weight of 0.6.
The reported benchmark results
On CIFAR-100, Robust CurveMoE reported 58.34 ± 0.64% clean accuracy, 28.40 ± 0.70% under ℓ1, 36.48 ± 0.75% under ℓ2 and 19.71 ± 0.27% under ℓ∞. Its Union accuracy was 18.23 ± 0.67%, compared with 15.86% for ERMC and 15.21% for MSD. The reported scores were highest across the evaluated CIFAR-100 metrics.
On ImageNet-100, the model reported 73.58 ± 0.50% clean accuracy, 67.62 ± 0.69% under ℓ1, 54.34 ± 0.89% under ℓ2 and 41.96 ± 0.95% under ℓ∞. Union accuracy was 39.65 ± 0.54%, compared with 37.52% for ERMC and 35.84% for MSD. These were also the highest reported scores across the evaluated ImageNet-100 metrics.
The tables give ± values for the reported scores, but the paper does not identify the dispersion statistic or the number of runs behind them. That leaves the variability and statistical significance of the reported differences unclear.
Efficiency and stress tests
The efficiency case is based partly on an ablation of how the robustness curve is updated. At a 30% contribution-guided update ratio, the paper reported a 36.05 ± 0.82% reduction in curve-training time, alongside clean accuracy of 56.82 ± 3.73%, ℓ1 accuracy of 18.33 ± 7.56%, ℓ2 accuracy of 34.67 ± 2.36% and ℓ∞ accuracy of 16.41 ± 3.96%.
An accompanying theorem offers a conditional explanation for partial updating. If the objective is smooth near both the full and restricted solutions and the full solution is stationary, it bounds the gap between partial and full objectives using the squared optimization movement omitted by the selected parameter subspace. The theorem concerns the training objective under those assumptions; it does not by itself guarantee test accuracy or generalization.
A targeted-expert stress test found lower targeted-expert accuracy when candidate tolerance was loosened from τcand = 2 to τcand = 10: 14.58% to 9.74% on CIFAR-100, and 38.18% to 15.67% on ImageNet-100. The narrative comparison does not report uncertainty for those changes.
Layer count also mattered in the reported ablation. Moving from K = 3 to K = 5 accompanied a Union-accuracy increase from 18.23% to 19.45% on CIFAR-100 and from 39.65% to 42.93% on ImageNet-100. At K = 7, the changes were marginal and Union accuracy was slightly lower on both datasets.
Warm-up and load balancing did not show a consistent benefit across the two datasets, so the authors left both out of the final procedure.
What the preprint leaves open
The authors interpret robust mode connectivity as a structured source of specialized experts and selective sparse MoE integration as an effective approach to multi-norm robustness.
Important limits remain. The supplied evaluation covers only CIFAR-100 and ImageNet-100 with WideResNet-28-10 and ViT-Tiny/16, and it uses the fixed threat budgets described above. The targeted-expert check is one stated ℓ∞ attack aimed at the ℓ1-specialized expert; broader adaptive attacks, additional datasets and architectures, matched compute, and complete storage and inference-cost accounting remain open questions. The document is arXiv:2608.26043v1, dated 26 Aug 2026, so these are preprint benchmark results rather than deployment-level safety outcomes.
Paper data and sources
Original title: Robust CurveMoE: Multi-Norm Adversarial Defense for Mixture-of-Experts Models via Mode Connectivity
Authors: Xu Zhang, Ren Wang
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-26
DOI: Not available
Original paper · Full text