Adversarial Training Improves Generalization Under Distribution Shifts in Bird Sound Classification

Abstract

Adversarial training is a promising strategy for enhancing robustness against adversarial attacks, but its impact on generalization under substantial distribution shifts in audio classification remains largely unexplored. We address this gap by investigating how adversarial training strategies improve generalization performance and adversarial robustness in audio classification. We study two architectures for multi-label bird sound classification: ConvNeXt, a strong Convolutional Neural Network (CNN) baseline, and AudioProtoPNet, a prototype-based model that has demonstrated state-of-the-art performance while providing inherent interpretability through learned prototypes. Experiments use BirdSet, a challenging benchmark for bird sound classification in bioacoustics. Bioacoustic recordings exhibit substantial covariate shift due to heterogeneous recording devices and acoustic environments. We compare adversarial training based on output-space attacks, which maximize classification loss, and embedding-space attacks, which maximize embedding dissimilarity. Both attack types are also used for robustness evaluation. Additionally, for AudioProtoPNet, the study assesses the stability of its learned prototypes under targeted embedding-space attacks. Results show that adversarial training, particularly using output-space attacks, improves clean test-data performance by up to 10.5% relative in mean cmAP and simultaneously strengthens the adversarial robustness of the models. These findings, although derived from the bird sound domain, suggest that adversarial training holds potential to enhance robustness against both strong distribution shifts and adversarial attacks in challenging audio classification settings.