"By decomposing the minibatch gradient, we discover that the full gradient component in adversarial perturbation contributes minimally to generalization."
"Friendly perturbation in F-SAM is more 'friendly' to other data points compared with vanilla SAM."