Title: TOWARDS A UNIFIED MIN-MAX FRAMEWORK FOR ADVERSARIAL EXPLORATION AND ROBUSTNESS

Abstract: The worst-case training principle that minimizes the maximal adversarial loss, also known as adversarial training (AT), has shown to be a state-of-the-art approach for enhancing adversarial robustness against norm-ball bounded input perturbations. Nonetheless, min-max optimization beyond the purpose of AT has not been rigorously explored in the research of adversarial attack and defense. In particular, given a set of risk sources (domains), minimizing the maximal loss induced from the domain set can be reformulated as a general min-max problem that is fundamentally different from AT since the maximization is taken over the probability simplex of the domain set. Examples of this general formulation include attacking model ensembles, devising universal perturbation under multiple inputs or data transformations, and generalized AT over different types of attack models. We show that these problems can be solved under a unified and theoretically principled min-max optimization framework. We also show that the self-adjusted domain weights learnt from our method provide a holistic tool to explain the difficulty level of attack and defense over multiple domains. Extensive experiments show that our approach leads to substantial performance improvement over the conventional heuristic strategies 1 .
Under review as a conference paper at ICLR 2020 uniform averaging), resulting in significant performance drops when comparing to our proposed min-max optimization framework. Specifically, based on the general min-max framework, we show that these problems can be solved under the same optimization procedure and prove the rate of its algorithmic convergence. As a byproduct and an exclusive feature, by tracking the weighting factor associated with the probability simplex during training, our method can provide tools for self-adjusted risk assessment and obtain novel insights on the set of domains for the associated tasks.
Contributions (1) We indicate the utility of min-max optimization beyond AT by proposing a general and theoretically grounded framework on adversarial attack and defense. (2) We demonstrate the effectiveness of our min-max framework by evaluating the proposed APGD attack on MNIST and CIFAR-10. In theory, we show that APGD has an O(1/T ) convergence rate, where T is the number of iterations. In practice, we show that APGD obtains 17.48%, 35.21% and 9.39% improvement on average compared with PGD attack on CIFAR-10. (3) We propose a generalized AT scheme under mixed types of adversarial attacks and demonstrate that the diversified attack ensemble helps adversarial robustness. Compared with vanilla AT, our new training scheme leads to better worst-case robustness even if the defender lacks prior knowledge of the strengths of attacks. (4) We show how the weighting factors of the probability simplex help to obtain novel insights for associated tasks and interpreting the importance of candidates in domains.

1. INTRODUCTION:

Training a machine learning model that is capable of assuring its worst-case performance against all possible adversaries given a specified threat model is a fundamental yet challenging problem, especially for deep neural networks (DNNs) (Szegedy et al., 2013; Goodfellow et al., 2015; Carlini & Wagner, 2017) . A common practice to train an adversarially robust model is based on a specific form of min-max training, known as adversarial training (AT) (Goodfellow et al., 2015; Madry et al., 2017) , where the minimization step learns model weights under the adversarial loss constructed at the maximization step in an alternative training fashion. On datasets such as MNIST and CIFAR-10, AT has achieved the state-of-the-art defense performance against p -norm-ball input perturbations (Athalye et al., 2018b) .

Motivated by the success of AT, one follow-up question that naturally arises is: Beyond AT, can other types of min-max formulation and optimization techniques advance the research in adversarial robustness? In this paper, we give an affirmative answer corroborated by the substantial performance gain and the ability of self-learned risk interpretation using our proposed min-max framework on several tasks for adversarial attack and defense.

We demonstrate the utility of a general formulation for min-max optimization minimizing the maximal loss induced from a set of risk sources (domains). Our considered min-max formulation is fundamentally different from AT, as our maximization step is taken over the probability simplex of the set of domains. Moreover, we show that many problem setups in adversarial attacks and defenses can in fact be reformulated under this general min-max framework, including attacking model ensembles (Tramèr et al., 2018; Liu et al., 2018) , devising universal perturbation to input samples (Moosavi-Dezfooli et al., 2017) or data transformations (Athalye & Sutskever, 2018; Brown et al., 2017) , and generalized AT over multiple types of threat models (Tramèr & Boneh, 2019; Araujo et al., 2019) . However, current methods for solving these tasks often rely on simple heuristics (e.g.,

2. MIN-MAX POWER IN ADVERSARIAL EXPLORATION AND ROBUSTNESS:

We begin by introducing the principle of robust learning over multiple domains and its connection to a specialized form of min-max optimization. We then show that the resulting min-max formulation fits into various attack settings for adversarial exploration: a) ensemble adversarial attack, b) universal adversarial perturbation and c) robust perturbation over data transformations. Finally, we propose a generalized adversarial training (AT) framework under mixed types of adversarial attacks to improve model robustness.

2.1. GENERAL IDEA: ROBUST LEARNING OVER MULTIPLE DOMAINS:

Consider K loss functions {F i (v)} (each of which is defined on a learning domain), the problem of robust learning over K domains can be formulated as (Qian et al., 2018; Rafique et al., 2018; Lu et al., 2018) minimize

EQUATION

where v and w are optimization variables, V is a constraint set, and P denotes the probability simplex P = {w | 1 T w = 1, w i ∈ [0, 1], ∀i}. Since the inner maximization problem in (1) is a linear function of w over the probabilistic simplex, problem (1) is thus equivalent to minimize

EQUATION

where [K] denotes the integer set {1, 2, . . . , K}.

Benefit and computation challenge of (1) Compared to multi-task learning in a finite-sum formulation which minimizes K losses on average, problem (1) provides consistently robust worst-case performance across all domains. This can be explained from the epigraph form of (2), minimize v∈V,t t, subject to

EQUATION

where t is an epigraph variable (Boyd & Vandenberghe, 2004 ) that provides the t-level robustness at each domain.

Although the min-max problem (1) offers a great robustness interpretation as in (3), solving it becomes more challenging than solving the finite-sum problem. It is clear from (2) that the inner maximization problem of (1) always returns the one-hot value of w, namely, w = e i , where e i is the ith standard basis vector, and i = arg max i {F i (v)}. The one-hot coding reduces the generalizability to other domains and induces instability of the learning procedure in practice. Such an issue is often mitigated by introducing a strongly concave regularizer in the inner maximization step (Lu et al., 2018; Qian et al., 2018) .

Regularized problem formulation Spurred by (Qian et al., 2018) , we penalize the distance between the worst-case loss and the average loss over K domains. This yields minimize

EQUATION

where γ > 0 is a regularization parameter. As γ → 0, problem (4) is equivalent to (1). By contrast, it becomes the finite-sum problem when γ → ∞ since w → 1/K. In this sense, the trainable w provides an essential indicator on the importance level of each domain. The larger the weight is, the more important the domain is. We call w domain weights in this paper. We next show how the principle of robust learning over multiple domains can fit into various settings of adversarial attack and defense problems.

2.2. ROBUST ADVERSARIAL ATTACKS:

The general goal of adversarial attack is to craft an adversarial example x = x 0 + δ ∈ R d to mislead the prediction of machine learning (ML) or deep learning (DL) systems, where x 0 denotes the natural example with the true label t 0 , and δ is known as adversarial perturbation, commonly subject to p -norm (p ∈ {0, 1, 2, ∞}) constraint X := {δ | δ p ≤ , x 0 + δ ∈ [0, 1] d } for a given small number . Here the p norm enforces the similarity between x and x 0 , and the input space of ML/DL systems is normalized to [0, 1] d .

Ensemble attack over multiple models Consider K ML/DL models {M i } K i=1 , the goal is to find robust adversarial examples that can fool all K models simultaneously. In this case, the notion of 'domain' in (4) is specified as 'model', and the objective function F i in (4) signifies the attack loss f (δ; x 0 , y 0 , M i ) given the natural input (x 0 , y 0 ) and the model M i . Thus, problem (4) becomes minimize

EQUATION

where w encodes the difficulty level of attacking each model.

Universal perturbation over multiple examples Consider:

K natural examples {(x i , y i )} K

i=1 and a single model M, our goal is to find the universal perturbation δ so that all the corrupted K examples can fool M. In this case, the notion of 'domain' in (4) is specified as 'example', and problem (4) becomes minimize

EQUATION

where different from (5), w encodes the difficulty level of attacking each example.

Adversarial attack over data transformations Consider K categories of data transformation {p i }, e.g., rotation, lightening, and translation (Athalye et al., 2018a) , our goal is to find the adversarial attack that is robust to data transformations. In this case, the notion of 'domain' in ( 4) is specified as 'data transformer', and problem (4) becomes minimize

EQUATION

where E t∼pi [f (t(x 0 +δ); y 0 , M)] denotes the attack loss under the distribution of data transformation p i , and w encodes the difficulty level of attacking each type of transformed example x 0 .

2.3. ADVERSARIAL TRAINING (AT) UNDER MIXED TYPES OF ADVERSARIAL ATTACKS:

Conventional AT is restricted to a single type of norm-ball constrained adversarial attack (Madry et al., 2017) . For example, AT under ∞ attack yields minimize

EQUATION

where θ ∈ R n denotes model parameters, δ denotes -tolerant ∞ attack, and f tr (θ, δ; x, y) is the training loss under perturbed examples {(x + δ, y)}. However, there possibly exist blind attacking spots across multiple types of adversarial attacks so that AT under one attack would not be strong enough against another attack (Araujo et al., 2019) . Thus, an interesting question is how to generalize AT under multiple types of adversarial attacks. One possible way is to use the finite-sum formulation

EQUATION

where δ i ∈ X i is the ith type of adversarial perturbation defined on X i , e.g., different p attacks.

Moreover, one can map 'attack type' to 'domain' considered in (1). We then perform AT against the strongest adversarial attack across K attack types in order to avoid blind attacking spots. That is, upon defining F i (θ) := maximize δi∈Xi f tr (θ, δ i ; x, y), we solve the problem of the form (2), minimize

EQUATION

In fact, problem (10) is in the min-max-max form, however, Lemma 1 shows that problem (10) can be further simplified to the min-max form. Lemma 1. Problem (10) is equivalent to

EQUATION

where w ∈ R K represent domain weights, and P has been defined in (1).

Proof: see Appendix A.

Similar to (4), a strongly concave regularizer -γ/2 w -1/K 2 2 can be added into the inner maximization problem of (11), which can boost the stability of the learning procedure and strike a balance between the max and the average attack performance. However, solving problem (11) and its regularized version is more complicated than (8) since the inner maximization involves both domain weights w and adversarial perturbations {δ i }.

We finally remark that there was an independent work (Tramèr & Boneh, 2019) which also proposed the formulation (10) for AT under multiple perturbations. However, what we propose here is the regularized formulation of (11). As will be evident later, the domain weights w in our formulation have strong interpretability, which learns the importance level of different attacks. Most significantly, our work has different motivation from (Tramèr & Boneh, 2019) , and our idea applies to not only AT but also attack generation in Sec. 2.2.

3. PROPOSED ALGORITHM AND THEORY:

In this section, we delve into technical details on how to efficiently solve problems of robust adversarial attacks given by the generic form (4) and problem (11) for generalized AT under mixed types of adversarial attacks.

3.1. ALTERNATING ONE-STEP PGD FOR ROBUST ADVERSARIAL ATTACK GENERATION:

Algorithm 1 APGD to solve problem (4) 1: Input: given w (0) and δ (0) . 2: for t = 1, 2, . . . , T do 3: outer min.: fixing w = w (t-1) , call PGD (13) to update δ (t) 4: inner max.: fixing δ = δ (t) , update w (t) via ( 14) 5: end for

We propose the alternating one-step projected gradient descent (APGD) method (Algorithm 1) to solve problem (4). For clarity, we repeat problem (4) under the adversarial perturbation δ and its constraint set X defined in Sec. 2.2, minimize δ∈X maximize w∈P K i=1 wiFi(δ).

(

EQUATION

We show that at each iteration, APGD takes only one-step PGD for outer minimization and one-step projected gradient ascent for inner maximization (namely, PGD for its negative objective function). We also show that each alternating step has a closed-form expression, and the main computational complexity stems from computing the gradient of the attack loss w.r.t. the input. Therefore, APGD is computationally efficient like PGD, which is commonly used for design of conventional single p -norm based adversarial attacks (Madry et al., 2017) .

Outer minimization Considering w = w (t-1) and F (δ 4), we perform one-step PGD to update δ at iteration t,

) := K i=1 w (t-1) i F i (δ) in (

EQUATION

where proj(•) denotes the Euclidean projection operator, i.e., proj X (a) = arg min x∈X xa2 2 at the point a, α > 0 is a given learning rate, and ∇ δ denotes the first order gradient w.r.t. δ.

In (13), the projection operation becomes the key to obtain the closed-form of the updating rule (13). Recall from Sec. 2.2 that X = {δ| δ p ≤ , č ≤ δ ≤ ĉ}, where p ∈ {0, 1, 2, ∞}, and č = -x 0 and ĉ = 1 -x 0 (implying č ≤ 0 ≤ ĉ). If p = ∞, then the projection function becomes the clip function. However, when p ∈ {0, 1, 2}, the closed-form of projection operation becomes non-trivial. In Proposition 1, we derive the solution of proj X (a) under different p norms.

Proposition 1. Given a point a ∈ R d and a constraint set X = {δ| δ p ≤ , č ≤ δ ≤ ĉ}, the Euclidean projection δ * = proj X (a) has a closed-form solution when p ∈ {0, 1, 2}.

Proof: See Appendix B.

Inner maximization By fixing δ = δ (t) and letting ψ(w

) := K i=1 w i F i (δ (t) ) -γ 2 w -1/K 2 2

in problem (4), we then perform one-step PGD (w.r.t. -ψ) to update w,

EQUATION

where β > 0 is a given learning rate, ∇ w ψ(w) = φ (t) -γ(w -1/K), and φ (t) := [F 1 (δ (t) ), . . . , F K (δ (t) )] T . In ( 14), the second equality holds due to the closed-form of projection operation onto the probabilistic simplex P (Parikh et al., 2014) , where (•) + denotes the elementwise nonnegative operator, i.e., (x) + = max{0, x}, and µ is the root of the equation

1 T (b -µ1) + = 1. Since 1 T (b -min i {b i }1 + 1/K) + ≥ 1 T 1/K = 1, and 1 T (b -max i {b i }1 + 1/K) + ≤ 1 T 1/K = 1,

the root µ exists within the interval [min i {b i } -1/K, max i {b i } -1/K] and can be found via the bisection method (Boyd & Vandenberghe, 2004) .

Convergence analysis We remark that APGD follows the gradient primal-dual optimization framework (Lu et al., 2019a) , and thus enjoys the same optimization guarantees. In Theorem 1, we demonstrate the convergence rate of Algorithm 1 for solving problem (4). Theorem 1. (inherited from primal-dual min-max optimization) Suppose that in problem (4) F i (δ) has L-Lipschitz continuous gradients, and X is a convex compact set. Given learning rates α ≤ 1 L and β < 1 γ , then the sequence {δ (t) , w (t) } T t=1 generated by Algorithm 1 converges to a first-order stationary point 2 of problem (4) under the convergence rate O( 1 T ).

Proof: Note that the objective function of problem ( 4) is strongly concave w.r.t. w with parameter γ, and has γ-Lipschitz continuous gradients. Moreover, we have w 2 ≤ 1 due to w ∈ P. Using these facts and (Lu et al., 2019a, Theorem 1) or (Lu et al., 2019b , Theorem 1) completes the proof.

3.2. ALTERNATING MULTI-STEP PGD FOR GENERALIZED AT:

We next propose the alternating multi-step projected gradient descent (AMPGD) method to solve the regularized version of problem (11), which is repeated as follows

EQUATION

)

Algorithm 2 AMPGD to solve problem (15)

1: Input: given θ (0) , w (0) , δ (0) and K > 0.

2: for t = 1, 2, . . . , T do 3:

given w (t-1) and δ (t-1) , perform SGD to update θ (t) (Madry et al., 2017) 4:

given θ (t) , perform R-step PGD to update w (t) and δ (t) 5: end for Problem ( 15) is in a more general non-convex non-concave min-max setting, where the inner maximization involves both domain weights w and adversarial perturbations {δ i }. It was shown in (Nouiehed et al., 2019) that the multi-step PGD is required for inner maximization in order to approximate the near-optimal solution. This is also in the similar spirit of AT (Madry et al., 2017) , which executed multi-step PGD attack during inner maximization. We summarize AMPGD in Algorithm 2. At step 4 of Algorithm 2, each PGD step to update w and δ can be decomposed as

w (t) r = proj P w (t) r-1 + β∇ w ψ(θ (t) , w (t) r-1 , {δ (t) i,r-1 }) , ∀r ∈ [R], δ (t) i,r = proj Xi δ (t) i,r-1 + β∇ δ ψ(θ (t) , w (t) r-1 , {δ (t) i,r-1 }) , ∀r ∈ [R], ∀i ∈ [K]

where let w (t) 1 := w (t-1) and δ

(t) i,1 := δ (t-1) i

. Here the subscript t represents the iteration index of AMPGD, and the subscript r denotes the iteration index of R-step PGD. Clearly, the above projection operations can be derived for closed-form expressions through (14) and Lemma 1. To the best of our knowledge, it is still an open question to build theoretical convergence guarantees for solving the general non-convex non-concave min-max problem like (15), except the work (Nouiehed et al., 2019) which proposed O(1/T ) convergence rate if the objective function satisfies Polyak-Łojasiewicz conditions (Karimi et al., 2016) .

Improved robustness via diversified p attacks. It was recently shown in (Kariyappa & Qureshi, 2019; Pang et al., 2019) that the diversity of individual neural networks improves adversarial robustness of an ensemble model. Spurred by that, one may wonder if the promotion of diversity among p attacks is beneficial to adversarial robustness? We measure the diversity between adversarial attacks through the similarity between perturbation directions, namely, input gradients {∇ δi f tr (θ, δ i ; x, y)} i in (15). We find that there exists a strong correlation between input gradients for different p attacks. Thus, we propose to enhance their diversity through the orthogonality-promoting regularizer used for encouraging diversified prediction of ensemble models in (Pang et al., 2019) ,

EQUATION

where 

G ∈ R d×K is a d × K matrix,

The rationale behind (17) is that the adversary aims to enhance the effectiveness of attacks from diversified perturbation directions (inner maximization), while the defender robustifies the model θ, which makes diversified attacks less effective (outer minimization).

4. EXPERIMENTS:

In this section, we first evaluate the proposed min-max optimization strategy on three attack tasks. We show that our approach leads to substantial improvement compared with state-of-the-art attack methods such as ensemble PGD (Liu et al., 2018) and expectation over transformation (EOT) (Athalye et al., 2018b; Brown et al., 2017; Athalye et al., 2018a) . We next demonstrate the effectiveness of the generalized AT for multiple types of adversarial perturbations. We show that the use of trainable domain weights in problem ( 15) can automatically adjust the risk level of different attacks during the training process even if the defender lacks prior knowledge on the strength of these attacks. We also show that the promotion of diversity of p attacks help improve adversarial robustness further.

We thoroughly evaluate our APGD/AMPGD algorithm on MNIST and CIFAR-10. A set of diverse image classifiers (denoted from Model A to Model H) are trained, including multi-layer perceptrons (MLP), All-CNNs (Springenberg et al., 2015) , LeNet (Lecun et al., 1998) , LeNetV2, VGG16 (Simonyan & Zisserman, 2015) , ResNet50 (He et al., 2016) , Wide-ResNet (Madry et al., 2017; Zagoruyko & Komodakis, 2016) and GoogLeNet (Szegedy et al., 2015) . More details about model architectures and training process are provided in Appendix C.1.

Most current works play a min-max game from a defender's perspective, i.e., adversarial training. However, we show the great strength of min-max optimization also lies at the side of attack generation.

Note that problem formulations ( 5)-( 7) are applicable to both untargeted and targeted attack. Here we focus on the former setting and use C&W loss function (Carlini & Wagner, 2017; Madry et al., 2017) . The details of crafting adversarial examples are available in Appendix C.2.

Ensemble attack over multiple models We craft adversarial examples against an ensemble of known classifiers. The work (Liu et al., 2018, 5th place at CAAD-18) proposed an ensemble PGD attack, which assumed equal importance among different models, namely, w i = 1/K in problem (1). Throughout this task, we measure the attack performance via ASR all -the attack success rate (ASR) of fooling model ensembles simultaneously. Compared to the ensemble PGD attack (Liu et al., 2018) , our approach results in 40.79% and 17.48% ASR all improvement averaged over different p -norm constraints on MNIST and CIFAR-10, respectively. In what follows, we provide more detailed experiment results and analysis.

In Table 1 , we show that our min-max APGD significantly outperforms ensemble PGD in ASR all .

Taking ∞ -attack on MNIST as an example, our min-max attack leads to a 90.16% ASR all , which largely outperforms 48.17% (ensemble PGD). The reason is that Model C, D are more difficult to attack, which can be observed from their higher test accuracy on adversarial examples. As a result, although the adversarial examples crafted by assigning equal weights over multiple models are able to attack {A, B} well, they achieve a much lower ASR (i.e., 1 -Acc) in {C, D}. By contrast, APGD automatically handles the worst case {C, D} by slightly sacrificing the performance on {A, B}: 31.47% averaged ASR improvement on {C, D} versus 0.86% degradation on {A, B}. More results on CIFAR-10 and more complicated DNNs (e.g., GoogLeNet) are provided in Appendix D. 0.3 once Model D encounters the sufficient attack power and the corresponding attack performance is no longer improved. It is worth noticing that APGD is highly efficient because w i converges after a small number of iterations. To perform a boarder evaluation, we repeat the above experiments ( ∞ norm) under different in Figure 2 . The ASR of min-max strategy is consistently better or on part with the average strategy. Moreover, APGD achieves more significant improvement when moderate is chosen: MNIST ( ∈ [0.15, 0.25]) and CIFAR-10 ( ∈ [0.03, 0.05]).

Lastly, we highlight that tracking domain weights w provides us novel insights for model robustness and understanding attack procedure. From our theory, a model with higher robustness always corresponds to a larger w because its loss is hard to attack and becomes the "worst" term. This hypothesis can be verified empirically. According to Figure 1c 

> Acc D > Acc A > Acc B in Table 1 ( ∞ -norm).

Universal perturbation over multiple examples:

We evaluate APGD in universal perturbation on MNIST and CIFAR-10, where 10,000 test images are randomly divided into equal-size groups (containing K images per group) for universal perturbation. We measure two types of ASR (%), ASR avg and ASR gp . Here the former represents the ASR averaged over all images in all groups, and the latter signifies the ASR averaged over all groups but a successful attack is counted under a more restricted condition: images within each group must be successfully attacked simultaneously by universal perturbation. When K = 5, our approach achieves 42.63% and 35.21% improvement over the averaging strategy under MNIST and CIFAR-10, respectively.

In Table 2 , we compare the proposed min-max strategy (APGD) with the averaging strategy on the attack performance of generated universal perturbations. As we can see, our method always achieves higher ASR gp for different values of K. The universal perturbation generated from APGD can successfully attack 'hard' images (on which the average-based PGD attack fails) by self-adjusting domain weights, and thus leads to a higher ASR gp . Besides, the min-max universal perturbation also offers interpretability of "image robustness" by associating domain weights with image visualization; see Figure A9 and A10 (Appendix F) for an example in which the large domain weight corresponds to the MNIST letter with clear appearance (e.g., bold letter).

Robust adversarial attack over data transformations EOT (Athalye et al., 2018a) achieves stateof-the-art performance in producing adversarial examples robust to data transformations. From (7), we could derive EOT as a special case when the weights satisfy w i = 1/K (average case). For each input sample (ori), we transform the image under a series of functions, e.g., flipping horizontally (flh) or vertically (flv), adjusting brightness (bri), performing gamma correction (gam) and cropping (crop), and group each image with its transformed variants. Similar to universal perturbation, ASR avg and ASR gp are reported to measure the ASR over all transformed images and groups of transformed images (each group is successfully attacked signifies successfully attacking an example under all transformers). In Table 3 , compared to EOT, our approach leads to 9.39% averaged lift in ASR gp over given models on CIFAR-10 by optimizing the weights for various transformations. Due to limited space, we leave the details of transformers in Append C.3 and the results under randomness (e.g., flipping images randomly w.p. 0.8; randomly clipping the images at specific range) in Appendix D.

4.2. ADVERSARIAL TRAINING FOR MULTIPLE ADVERSARIAL PERTURBATIONS:

Compared to vanilla AT, we show the generalized AT scheme produces models robust to multiple types of perturbation, thus leads to stronger "overall robustness". We measure the training performance using two types of Acc (%): Acc max adv and Acc avg adv , where Acc max adv denotes the test accuracy over examples with the strongest perturbation ( ∞ or 2 ), and Acc avg adv denotes the averaged test accuracy over examples with all types of perturbations ( ∞ and 2 ). Moreover, we measure the overall worst-case robustness S in terms of the area under the curve 'Acc max adv vs. ' (see Figure 3b ). In Table 4 , we present the test accuracy of MLP in different training schemes: a) natural training, b) single-norm: vanilla AT ( ∞ or 2 ), c) multi-norm: generalized AT (avg and min max), and d) generalized AT with diversity-promoting attack regularization (DPAR, λ = 0.1 in problem ( 16)). If the adversary only performs single-type attack, training and testing on the same attack type leads to the best performance (diagonal of ∞ -2 block). However, when facing ∞ and 2 attacks simultaneously, multi-norm generalized AT achieves better Acc max adv and Acc avg adv than single-norm AT. In particular, the min-max strategy slightly outperforms the averaging strategy under multiple perturbation norms. DPAR further boosts the adversarial test accuracy, which implies that the promotion of diversified p attacks is a beneficial supplement to adversarial training.

In Figure 3 , we offer deeper insights on the performance of generalized AT. During the training procedure we fix ∞ ( for ∞ attack during training) as 0.2, and change 2 from 0.2 to 5.6 ( ∞ × √ d) so that the ∞ and 2 balls are not completely overlapped (Araujo et al., 2019) . In Figure 3a , as 2 increases, 2 -attack becomes stronger so the corresponding w also increases, which is consistent with min-max spirit -defending the strongest attack. We remark that min max or avg training does not always lead to the best performance on Acc max adv and Acc avg adv , especially when the strengths of two attacks diverge greatly (see Table A8 ). This can be explained by the large overlapping between ∞ and 2 balls (see Figure A3 ). However, Figure 3b and 3c show that AMPGD is able to achieve a rather robust model no matter how changes (red lines), which empirically verifies the effectiveness of our proposed training scheme. In terms of the area-under-the-curve measure S , AMPGD achieves the highest worst-case robustness: 6.27% and 17.64% improvement compared to the vanilla AT with ∞ and 2 attacks. Furthermore, we show in Figure A4a that our min-max scheme leads to faster convergence than the averaging scheme due to the benefit of self-adjusted domain weights.

5. CONCLUSION:

In this paper, we propose a general min-max framework applicable to both adversarial attack and defense settings. We show that many problem setups can be re-formulated under this general framework. Extensive experiments show that proposed algorithms lead to significant improvement on multiple attack and defense tasks compared with previous state-of-the-art approaches. In particular, we obtain 17.48%, 35.21% and 9.39% improvement on attacking model ensembles, devising universal perturbation to input samples, and data transformations under CIFAR-10, respectively. Our minmax scheme also generalizes adversarial training (AT) for multiple types of adversarial attacks, attaining faster convergence and better robustness compared to the vanilla AT and the average strategy. Moreover, our approach provides a holistic tool for self-risk assessment by learning domain weights. 

w i f tr (θ, δ i ; x, y),

where w ∈ R K represent domain weights, and P has been defined in (1).

Proof of Lemma 1::

Similar to (1), problem ( 10) is equivalent to

EQUATION

Recall that F i (θ) := maximize δi∈Xi f tr (θ, δ i ; x, y), problem can then be written as

EQUATION

According to proof by contradiction, it is clear that problem ( 19) is equivalent to

EQUATION

B PROOF OF PROPOSITION 1:

Proposition 1. Given a point a ∈ R d and a constraint set X = {δ| δ p ≤ , č ≤ δ ≤ ĉ}, the Euclidean projection δ * = proj X (a) has the closed-form solution when p ∈ {0, 1, 2}.

1) If p = 1, then δ * is given by

EQUATION

where x i denotes the ith element of a vector x; P [či,ĉi] (•) denotes the clip function over the interval

EQUATION

)

where λ 2 ∈ (0, a 2 / -1] is the root of d i=1 (P [či,ĉi] (a i /(λ 2 + 1))) 2 = 2 . 3) If p = 0 and ∈ N + , then δ * is given by

EQUATION

)

where [η] denotes the -th largest element of η, and δ i = P [či,ĉi] (a i ).

Proof of Proposition 1::

1 norm When we find the Euclidean projection of a onto the set X , we solve minimize

EQUATION

where

EQUATION

The minimizer δ * minimizes the Lagrangian, it is obtained by elementwise soft-thresholding

δ * i = P [či,ĉi] (sign(a i ) max {|a i | -λ 1 , 0}).

where x i is the ith element of a vector x,

P [či,ĉi] (•) is the clip function over the interval [č i , ĉi ].

The primal, dual feasibility and complementary slackness are

EQUATION

) If d i=1 |P [či,ĉi] (a i )| ≤ , δ * i = P [či,ĉi] (a i ). Otherwise δ * i = P [či,ĉi] (sign(a i ) max {|a i | -λ 1 , 0})

, where λ 1 is given by the root of the equation

d i=1 |P [či,ĉi] (sign(a i ) max {|a i | -λ 1 , 0})| = .

Bisection method can be used to solve the above equation for λ 1 , starting with the initial interval (0, max

i |a i | -/d]. Since d i=1 |P [či,ĉi] (sign(a i ) max {|a i | -0, 0})| = d i=1 |P [či,ĉi] (a i )| > in this case,

and

d i=1 |P [či,ĉi] (sign(a i ) max {|a i | -max i |a i | + /d, 0})| ≤ d i=1 |P [či,ĉi] (sign(a i )( /d))| ≤ d i=1 ( /d) = .

2 norm When we find the Euclidean projection of a onto the set X , we solve

EQUATION

where

EQUATION

)

The minimizer δ * minimizes the Lagrangian, it is

δ * i = P [či,ĉi] ( 1 λ 2 + 1 a i ).

The primal, dual feasibility and complementary slackness are

EQUATION

) If d i=1 (P [či,ĉi] (a i )) 2 ≤ 2 , δ * i = P [či,ĉi] (a i ). Otherwise δ * i = P [či,ĉi] 1 λ2+1 a i

, where λ 2 is given by the root of the equation d i=1 (P [či,ĉi] ( 1 λ2+1 a i )) 2 = 2 . Bisection method can be used to solve the above equation for λ 2 , starting with the initial interval (0,

d i=1 (a i ) 2 / -1]. Since d i=1 (P [či,ĉi] ( 1 0+1 a i )) 2 = d i=1 (P [či,ĉi] (a i )) 2

> 2 in this case, and

d i=1 (P [či,ĉi] ( 1 λ2+1 a i )) 2 = d i=1 (P [či,ĉi] ( a i / d i=1 (a i ) 2 )) 2 ≤ 2 d i=1 (a i ) 2 /( d i=1 (a i ) 2 ) 2 = 2 .

0 norm For 0 norm in X , it is independent to the box constraint. So we can clip a to the box constraint first, which is δ i = P [či,ĉi] (a i ), and then project it onto 0 norm. We find the additional Euclidean distance of every element in a and zero after they are clipped to the box constraint, which is

EQUATION

)

It can be equivalently written as

EQUATION

)

To derive the Euclidean projection onto 0 norm, we find the -th largest element in η and call it [η] . We keep the elements whose corresponding η i is above or equals to -th, and set rest to zeros. The closed-form solution is given by

EQUATION

)

Difference to (Hein & Andriushchenko, 2017, Proposition 4.1) . We remark that Hein & Andriushchenko (2017) discussed a relevant problem of generating p -norm based adversarial examples under box and linearized classification constraints. It was shown in (Hein & Andriushchenko, 2017, Proposition 4 .1) that the problem is convex and the solution can be derived using KKT conditions. However, Proposition 1 in our paper is different from (Hein & Andriushchenko, 2017, Proposition 4.1) . First, we place p norm as a hard constraint rather than minimizing it in the objective function. This difference will make our Lagrangian function more involved with a newly introduced nonnegative Lagrangian multiplier. Second, the problem of our interest is projection onto the intersection of box and p constraints. Such a projection step can then be combined with an attack loss (no need of linearization) for generating adversarial examples. Third, we cover the case of 0 norm. 2017) and GoogLeNet Szegedy et al. (2015) . For the last four models, we use the exact same architecture as original papers and evaluate them only on CIFAR-10 dataset. The details for model architectures are provided in Table A1 . For compatibility with our framework, we implement and train these models based on the strategies adopted in pytorch-cifar4 and achieve comparable performance on clean images; see Table A2 . To foster reproducibility, all the trained models are publicly accessible in the anonymous link. Specifically, we trained MNIST horizontally (flh) and vertically (flv); c) adjusting image brightness (bri); d) performing gamma correction (gam), e) cropping and re-sizing images (crop); f) rotating images (rot).

C EXPERIMENT SETUP:

Moreover, both deterministic and stochastic transformations are considered in our experiments. In particular, Table 3 and Table A6 are deterministic settings -rot: rotating images 30 degree clockwise; crop: cropping images in the center (0.8 × 0.8) and resizing them to 32 × 32; bri: adjusting the brightness of images with a scale of 0.1; gam: performing gamma correction with a value of 1.3. Differently, in Table A5 , we introduce randomness for drawing samples from the distribution -rot: rotating images randomly from -10 to 10 degree; crop: cropping images in the center randomly (from 0.6 to 1.0); other transformations are done with a probability of 0.8. In experiments, we adopt tf.image API7 for processing the images.

D SUPPLEMENTARY RESULTS -ROBUST ADVERSARIAL ATTACKS D.1 ENSEMBLE ATTACK OVER MULTIPLE MODELS:

Table A3 shows the performance of average (ensemble PGD Liu et al. (2018) ) and min-max (APGD) strategies for attacking model ensembles. Our min-max approach results in 15.69% averaged improvement on ASR all over models {A, E, F, H} on CIFAR-10. 

: α = 1, β = 1 150 , γ = 1, 1 : α = 1 4 , β = 1 100 , γ = 5, 2 : α = 1 8 , β = 1 100 , γ = 3; ∞ : α = 1 5 , β = 1 50 , γ = 6.

D.2 COMPARISON WITH HEURISTIC WEIGHTING SCHEMES:

To further demonstrate the effectiveness of self-adjusted weighting factors in proposed min-max framework, we compare with heuristic weighting schemes in Table A4 . Table A4 shows that our min-max approach outperforms all static heuristic weighting schemes by a large margin. Specifically, our min-max APGD also achieves significant improvement compared to w static setting, where the converged optimal weights are statically (i.e., invariant w.r.t different images and attack procedure) adopted. It again verifies the benefits of proposed min-max approach by automatically learning the weights for different examples during the process of ensemble attack generation (see Figure 1c ). To further explore the utility of quadratic regularizer on the probability simplex in proposed min-max framework, we conducted sensitivity analysis on γ and show how the proposed regularization affects the eventual performance (Figure A1 ) taking ensemble attack as an example. The experimental setting is the same as Table 1 except for altering the value of γ from 0 to 10. Figure A1 shows that too small or too large γ leads to relative weak performance due to the unstable convergence and penalizing too much for average case. When γ is around 4, APGD will achieve the best performance so we adopted this value in the experiments (Table 1 ). Moreover, when γ → ∞, the regularizer term dominates the optimization objective and it becomes the average case.

E SUPPLEMENTARY RESULTS -ADVERSARIAL TRAINING AGAINST MULTIPLE TYPES OF ADVERSARIAL ATTACKS:

E.1 ROBUSTNESS EVALUATION Figure A2 presents "overall robustness" comparison of our min-max generalized AT scheme and vanilla AT with single type of attacks ( ∞ and 2 ) on MNIST (LeNet). Similarly, our min-max training scheme leads to a higher "overall robustness" measured by S . In practice, due to the lacking knowledge of the strengths/types of the attacks used by adversaries, it is meaningful to enhance "overall robustness" of models under the worst perturbation (Acc max adv ). Specifically, our min-max generalized AT leads to 6.27% and 17.63% improvement on S compared to single-type AT with ∞ and 2 attacks. Furthermore, weighting factor w of the probability simplex helps understand the behavior of AT under mixed types of attacks. Our AMPGD algorithm will adjust w automatically according to the min-max principle -defending the strongest attack. In Figure A2a , as 2 increases, 2 -attack becomes stronger so its corresponding w increases as well. When 2 ≥ 2.5, 2 -attack dominates the adversarial training process. That is to say, our AMPGD algorithm will put more weights on stronger attacks even if the strengths of attacks are unknown, which is a meritorious feature in practice. 2018) also propose a variant of adversarial training to defend universal perturbations over multiple images. To produce universal perturbations, they propose uSGD to conduct gradient descent on the averaged loss of one-batch images. In consequence, their approach can be regarded as a variant of our generalized AT in average case. The difference is that they do AT across multiple adversarial images under universal perturbation rather than mixed p -norm perturbations.

We added UAT [1] as one of our defense baselines in Table A7 . The universal perturbation is generated by uSGD ( ∞ norm, = 0.3) with a batch size of 128 following Shafahi et al. (2018) . We find that a) our proposed approach outperforms UAT under per-image p attacks. Taking A7a as an example, our avg and min max generalized AT (with DPAR) result in average 17.85% and 17.97% improvement in adversarial test accuracy (ATA), b) our approach has just 3.72% degradation in ATA when encountering universal attacks, and c) both methods yield very similar normal test accuracy. It is not surprising that our average and min-max training schemes can achieve better overall robustness while maintaining competitive performance on defending universal perturbation. This is because the defensed model is trained under more general ( p norm) and diversity promoted perturbations. As a result, proposed generalized AT is expected to obtain better overall robustness and higher transferability as shown in Table 4 and A7 . As reported in Sec. 4.2, our min-max generalized AT does not always result in the best performance on the success rate of defending the worst/strongest perturbation (Acc max adv ) for given ( ∞ , 2 ) pair, especially when the strengths of two attacks diverge greatly (e.g., for ∞ and 2 attacks are 0.2 and 0.5). In what follows, we provide explanation and analysis about this finding inspired by recent work Araujo et al. (2019) . ( 2) attack as 2 for generalized AT increases. Note that the same as the AT procedure is used while attacking trained robust models.

Figure A3 shows the real overlap of ∞ and 2 norm balls in adversarial attacks for MLP model on MNIST. Ideally, if 2 satisfies ∞ < 2 < ∞ × √ d, ∞ and 2 balls will not cover each other completely Araujo et al. (2019) . In other words, AT with ∞ and 2 attacks cannot interchange with each other. However, the real range of 2 for keeping 2 and ∞ balls intersected is not ( ∞ , ∞ × √ d), because crafted adversarial examples are not uniformly distributed in p -norm balls. In Figure A3b , 99.98% adversarial examples devising using 2 attack are also inside ∞ ball, even if 0.2 < 2 = 0.5 < 5.6. In consequence, AT with ∞ attack is enough to handle 2 -attack in overwhelming majority cases, which results in better performance than min-max optimization (Table A8a ).

Figure A3c presents the average p distance of adversarial examples with 2 increasing. The average 2 -norm (green line) of adversarial examples generated by ∞ attack remains around 2.0 with a slight rising trend. This is consistent to our setting -fixing 2 as 0.2. It also indicates model robustness may effect the behavior of attacks -as 2 increases, robustly trained MLP model becomes more robust against 2 examples, so the ∞ attacker implicitly increases 2 norm to attack the model more effectively. On the other hand, the average ∞ -norm increases substantially as 2 increases from 0.5 to 2.5. When 2 arriving at 0.85, the average ∞ norm gets close to 0.2, so around half adversarial examples generated by 2 -attack are also inside ∞ balls, which is consistent with Table A3b .

E.4 LEARNING CURVE UNDER DIFFERENT TRAINING SCHEMES:

Figure A4 shows the learning curves of model A under different AT schemes, where two setting are plotted: (a) ( ∞ , 2 ) = (0.2, 0.5); (b) ( ∞ , 2 ) = (0.2, 2.0). Apart from better worst-case robustness shown in Table A8 , our min-max generalized AT leads to a faster convergence compared to average-based AT, especially when the strengths of two attacks diverge greatly. For instance, when 2 = 0.5 (Figure A4a ), the robust model trained with AMPGD reaches 70% test accuracy on the worst perturbation (1-R max adv ) within 210 epochs versus 280 epochs in average setting. When 2 = 2.0 (Figure A4b ), the learning curves for min-max and average strategy are very close because the strengths of two attacks are similar, which is verified by approximately equal weights in Figure 3a . Tracking domain weight w of the probability simplex from our algorithms is an exclusive feature of solving problem 1. In Sec. 4, we show the strength of w in understanding the procedure of optimization and interpreting the adversarial robustness. Here we would like to show the usage of w in measuring "image robustness" on devising universal perturbation to multiple input samples. Table A9 and A10 show the image groups on MNIST with weight w in APGD and two metrics (distortion of 2-C&W, minimum for ∞ -PGD) of measuring the difficulty of attacking single images. The binary search is utilized to searching for the minimum perturbation.

Although adversaries need to consider a trade-off between multiple images while devising universal perturbation, we find that weighting factor w in APGD is highly correlated under different p norms. Furthermore, w is also highly related to minimum distortion required for attacking a single image successfully. It means the inherent "image robustness" exists and effects the behavior of generating universal perturbation. Larger weight w usually indicates an image with higher robustness (e.g., fifth 'zero' in the first row of Table A9 ), which usually corresponds to the MNIST letter with clear appearance (e.g., bold letter). 

:

For reproducibility, the code and trained models will be released accompanying this paper.

The stationarity is measured by the 2 norm of gradient of the objective in (4) w.r.t. (δ, w).

An enhanced version of original LeNet with more layers and units (see TableA1Model D).

https://github.com/kuangliu/pytorch-cifar

https://github.com/tensorflow/cleverhans

https://github.com/carlini/nn_robust_attacks

https://www.tensorflow.org/api_docs/python/tf/image

Figures and Tables:

Figure1depicts the ASR of four models under average/min-max attacks as well as the distribution of domain weights during attack generation. For ensemble PGD (Figure1a), Model C and D are attacked insufficiently, leading to relatively low ASR and thus weak ensemble performance. By contrast, APGD (Figure1b) will encode the difficulty level to attack different models based on the current attack loss. It dynamically adjusts the weight w i as shown in Figure1c. For instance, the weight for Model D is first raised to 0.45 because D is difficult to attack initially. Then it decreases to

, we have w c > w d > w a > w bindicating a decrease in model robustness for C, D, A and B, which is exactly verified by Acc C

Figure 3: (a): Violin plot of weight w in APGD versus perturbation magnitude of 2-attack in AT; (b) & (c): Robustness of MLP under different AT schemes. Supplementary result for LeNet is provided in Figure A2 (Appendix E).

MODEL ARCHITECTURES AND TRAINING DETAILS For a comprehensive evaluation of proposed algorithms, we adopt a set of diverse DNN models (Model A to H), including multi-layer perceptrons (MLP), All-CNNs Springenberg et al. (2015), LeNet Lecun et al. (1998), LeNetV2 3 , VGG16 Simonyan & Zisserman (2015), ResNet50 He et al. (2016), Wide-ResNet Madry et al. (

Specifically, with the prior knowledge of robustness of given models (C > D > A > B), we devised several heuristic baselines including: (a) w c+d : ensemble PGD on models C and D only; (b) w a+c+d : ensemble PGD on models A, C and D only; (c) w clip : clipped version of C&W loss (threshold β = 40) to balance model weights in optimization as suggested in Shafahi et al. (2018); (d) w prior : larger weights on the more robust models, w prior = [w A , w B , w C , w D ] = [0.2, 0.1, 0.4, 0.3]; (e) w static : the converged mean weights of min-max (APGD) ensemble attack. For 2 ( = 3.0) and ∞ ( = 0.2) attacks, w static = [w A , w B , w C , w D ] are [0.209, 0.046, 0.495, 0.250] and [0.080, 0.076, 0.541, 0.303], respectively.

Figure A2: (a): Violin plot of weight w in APGD as a function of perturbation magnitude of 2 attack in adversarial training; (b) & (c): Robustness of LeNet (Model C) under different adversarial training schemes.

Figure A3: (a) & (b): Comparison of the percentage of adversarial examples inside ∞ ball (left, blue area) and inside 2 ball (right, red area). In particular, the red (blue) area in (a) (or (b)) represents the percentage of adversarial examples crafted by ∞( 2) attack that also belong to 2 ( ∞) ball. We generate adversarial examples on 10,000 test images for each attack. (c): Average p norm of adversarial examples as a function of perturbation magnitude 2 . The top (bottom) side represents the 2-norm ( ∞) of the adversarial examples generated by ∞( 2) attack as 2 for generalized AT increases. Note that the same as the AT procedure is used while attacking trained robust models.

Figure A4: Learning curves of MLP model under different adversarial training schemes on MNIST. Note that experiment is repeated ten times with different random seeds.

Interpretability of domain weight w for universal perturbation to multiple inputs on MNIST (Digit 0 to 4). Domain weight w for different images under p-norm (p = 0, 1, 2, ∞) and two metrics measuring the difficulty of attacking single image are recorded, where dist. ( 2) denotes the the minimum distortion of successfully attacking images using C&W ( 2) attack; min ( ∞) denotes the minimum perturbation magnitude for ∞-PGD attack. C&W 2 ) 1.839 1.954 1.347 1.698 3.041 1.545 1.982 2.178 2.349 1.050 min ( ∞ ) 0.113 0.167 0.073 0.121 0.199 0.167 0.157 0.113 0.114 0C&W 2 ) 1.335 2.552 2.282 1.229 1.884 1.928 1.439 2.312 1.521 2.356 min ( ∞ ) 0.050 0.165 0.110 0.083 0.162 0.082 0.106 0.176 0.072 0C&W 2 ) 1.558 1.229 1.939 0.297 1.303 0.940 1.836 1.384 1.079 2.027 min ( ∞ ) 0.084 0.088 0.122 0.060 0.094 0.115 0.103 0.047 0.125 0.100 Table A10: Interpretability of domain weight w for universal perturbation to multiple inputs on MNIST (Digit 5 to 9). Domain weight w for different images under p-norm (p = 0, 1, 2, ∞) and two metrics measuring the difficulty of attacking single image are recorded, where dist. ( 2) denotes the the minimum distortion of successfully attacking images using C&W ( 2) attack; min ( ∞) denotes the minimum perturbation magnitude for ∞-PGD attack. 2 ) 1.024 1.532 1.511 1.351 1.584 1.319 1.908 1.020 1.402 1.372 min ( ∞ ) 0.090 0.106 0.085 0.069 0.144 0.106 0.099 0.0748 0.131 02 ) 1.508 1.731 1.291 1.874 1.536 1.719 2.038 1.417 2.169 0.848 min ( ∞ ) 0.110 0.125 0.089 0.126 0.095 0.087 0.097 0.084 0.135 02 ) 1.961 1.113 1.132 1.802 0.939 1.132 1.508 1.335 1.033 1.110 min ( ∞ ) 0.144 0.108 0.083 0.103 0.079 0.041 0.090 0.103 0.083 0.044

Comparison of average and min-max (APGD) ensemble attack over four models on MNIST and CIFAR-10. Acc (%) represents the test accuracy of classifiers on adversarial examples. Here we set the iterations of APGD as 50 for attack generation. The learning rates α, β and regularization factor γ are provided in Appendix C.2.

Table content: <table><tr><td/><td/><td colspan="2">(a) MNIST</td><td/><td/><td/><td/><td/><td colspan="3">(b) CIFAR-10</td></tr><tr><td>Box constraint</td><td>Opt.</td><td colspan="5">AccA AccB AccC AccD ASRall Lift (↑)</td><td colspan="6">Box constraint AccA AccB AccC AccD ASRall Lift (↑)</td></tr><tr><td>0 ( = 30)</td><td colspan="2">avg. min max 3.65 7.03</td><td>1.51 11.27 2.36 4.99</td><td>2.48 3.11</td><td>84.03 91.97</td><td>-9.45%</td><td>0 ( = 50)</td><td colspan="2">27.86 3.15 18.74 8.66</td><td>5.16 9.64</td><td>6.17 9.70</td><td>65.16 71.44</td><td>-9.64%</td></tr><tr><td>1 ( = 20)</td><td colspan="3">avg. min max 6.12 20.79 0.15 21.48 2.53 8.43</td><td>6.70 5.11</td><td>69.31 89.16</td><td>-28.64%</td><td>1 ( = 30)</td><td colspan="2">32.92 2.07 12.46 3.74</td><td>5.55 5.62</td><td>6.36 5.86</td><td>59.74 78.65</td><td>-31.65%</td></tr><tr><td>2 ( = 3.0)</td><td colspan="2">avg. min max 1.51 6.88</td><td colspan="2">0.03 26.28 14.50 0.89 3.50 2.06</td><td>69.12 95.31</td><td>-37.89%</td><td>2 ( = 2.0)</td><td>24.3 7.17</td><td>1.51 3.03</td><td>4.59 4.65</td><td>4.20 5.14</td><td>69.55 83.95</td><td>-20.70%</td></tr><tr><td>∞ ( = 0.2)</td><td colspan="2">avg. min max 2.47 1.05</td><td colspan="2">0.07 41.10 35.03 0.37 7.39 5.81</td><td>48.17 90.16</td><td>-87.17%</td><td>∞ ( = 0.05)</td><td colspan="2">19.69 1.55 7.21 2.68</td><td>5.61 4.74</td><td>4.26 4.59</td><td>73.29 84.36</td><td>-15.10%</td></tr></table>

Comparison of average and minmax optimization on universal perturbation over multiple input examples. The adversarial examples are generated by 20-step ∞-APGD with α = 1 6 , β = 1 50 and γ = 4. ASR avg ASR gp Lift (↑) ASR avg ASR gp Lift (↑) ASR avg ASR gp Lift (↑) ASR avg ASR gp Lift (↑)

Table content: <table><tr><td/><td>Setting</td><td>K = 2</td><td>K = 4</td><td>K = 5</td><td>K = 10</td></tr><tr><td colspan="6">Dataset Opt. MNIST Model MLP avg. min max 98.15 96.96 2.62% 83.76 72.32 27.68% 72.28 53.70 41.13% 30.10 6.70 91.43% 97.19 94.48 -85.13 56.64 -79.11 38.05 -60.53 3.50 -avg. 97.76 95.52 -85.19 51.92 -80.02 31.25 -65.79 2.10 -All-CNNs min max 99.69 99.38 4.04% 90.11 75.64 45.69% 80.21 53.50 71.20% 43.54 4.30 104.8%</td></tr><tr><td/><td>LeNet</td><td colspan="4">avg. min max 96.60 94.58 5.14% 55.50 36.72 27.86% 42.79 25.80 34.73% 22.48 7.20 67.44% 94.78 89.96 -62.12 28.72 -51.84 19.15 -30.29 4.30 -</td></tr><tr><td/><td>LeNetV2</td><td colspan="4">avg. min max 97.33 95.68 6.26% 55.38 35.52 33.53% 40.22 21.05 23.46% 19.73 7.10 47.92% 94.72 90.04 -61.59 26.60 -50.42 17.05 -26.49 4.80 -</td></tr><tr><td/><td>All-CNNs</td><td colspan="4">avg. min max 92.22 85.98 3.49% 87.63 65.80 20.25% 85.02 55.74 38.66% 65.64 11.80 162.2% 91.09 83.08 -85.66 54.72 -82.76 40.20 -71.22 4.50 -</td></tr><tr><td>CIFAR-10</td><td>LeNetV2</td><td colspan="4">avg. min max 93.34 87.08 0.21% 91.91 71.64 8.35% 91.21 63.55 15.55% 82.85 25.10 182.0% 93.26 86.90 -90.04 66.12 -88.28 55.00 -72.02 8.90 -</td></tr><tr><td/><td>VGG16</td><td colspan="4">avg. min max 92.40 85.92 4.07% 90.04 70.40 10.14% 88.97 63.30 14.67% 79.07 30.80 37.50% 90.76 82.56 -89.36 63.92 -88.74 55.20 -85.86 22.40 -</td></tr><tr><td/><td>GoogLeNet</td><td colspan="4">avg. min max 87.08 77.82 7.37% 77.05 46.20 41.37% 71.20 33.70 71.94% 45.46 2.40 600.0% 85.02 72.48 -75.20 32.68 -71.82 19.60 -59.01 0.40 -</td></tr></table>

Comparison of average and min-max optimization on robust attack over multiple data transformations on CIFAR-10. Acc (%) represents the test accuracy of classifiers on adversarial examples (20-step ∞-APGD ( = 0.03) with α = 1 2 , β = 1 100 and γ = 10) under different transformations. Acc f lh Acc f lv Acc bri Acc gam Acc crop ASR avg ASR gp Lift (↑)

Table content: <table><tr><td colspan="3">Model Acc ori A Opt. avg. 10.80 min max 12.14</td><td>21.93 18.05</td><td>14.75 13.61</td><td>11.52 13.52</td><td>10.66 11.99</td><td>20.03 16.78</td><td>85.05 85.65</td><td>55.88 60.03</td><td>-7.43%</td></tr><tr><td>B</td><td>avg. min max</td><td>5.49 6.22</td><td>11.56 8.61</td><td>9.51 9.74</td><td>5.43 6.35</td><td>5.75 6.42</td><td>15.89 11.99</td><td>91.06 91.78</td><td>72.21 77.43</td><td>-7.23%</td></tr><tr><td>C</td><td>avg. min max</td><td>7.66 8.51</td><td>21.88 14.75</td><td>15.50 13.88</td><td>8.15 9.16</td><td>7.87 8.58</td><td>15.36 13.35</td><td>87.26 88.63</td><td>56.51 63.58</td><td>-12.51%</td></tr><tr><td>D</td><td>avg. min max</td><td>8.00 9.19</td><td>20.47 13.18</td><td>13.46 12.72</td><td>7.73 8.79</td><td>8.52 9.18</td><td>15.90 13.11</td><td>87.65 88.97</td><td>61.13 67.49</td><td>-10.40%</td></tr></table>

Adversarial training of MNIST models on single attacks ( ∞ and 2) and multiple attacks (avg. and min max). The perturbation magnitude for ∞ and 2 attacks are 0.2 and 2.0, respectively. Top 2 test accuracy on each metric are highlighted. Complete table for varied is given in TableA8(Appendix E).

Table content: <table><tr><td/><td/><td colspan="2">(a) MLP</td><td/><td/><td/><td/><td colspan="2">(b) LeNet</td><td/><td/></tr><tr><td>Opt.</td><td colspan="4">Acc. Acc-∞ Acc-2 Acc max adv</td><td>Acc avg adv</td><td>Opt.</td><td colspan="4">Acc. Acc-∞ Acc-2 Acc max adv</td><td>Acc avg adv</td></tr><tr><td colspan="2">natural 98.30</td><td>2.70</td><td>13.86</td><td>0.85</td><td>8.28</td><td colspan="2">natural 99.25</td><td>17.93</td><td>39.32</td><td>17.57</td><td>28.63</td></tr><tr><td>∞</td><td>98.08</td><td>77.70</td><td>69.17</td><td>66.34</td><td>73.43</td><td>∞</td><td>99.18</td><td>93.80</td><td>78.97</td><td>78.80</td><td>86.39</td></tr><tr><td>2</td><td>98.72</td><td>70.03</td><td>81.74</td><td>69.14</td><td>75.88</td><td>2</td><td>99.22</td><td>85.84</td><td>87.31</td><td>84.06</td><td>86.58</td></tr><tr><td>avg.</td><td>98.62</td><td>75.09</td><td>79.00</td><td>72.23</td><td>77.05</td><td>avg.</td><td>99.22</td><td>88.96</td><td>85.59</td><td>84.29</td><td>87.28</td></tr><tr><td colspan="2">+ DPAR 98.50</td><td>76.75</td><td>79.67</td><td>74.14</td><td>78.21</td><td colspan="2">+ DPAR 99.25</td><td>89.96</td><td>86.49</td><td>85.44</td><td>88.23</td></tr><tr><td colspan="2">min max 98.59</td><td>75.96</td><td>79.15</td><td>73.43</td><td>77.55</td><td colspan="2">min max 99.32</td><td>89.21</td><td>85.98</td><td>84.82</td><td>87.60</td></tr><tr><td colspan="2">+ DPAR 98.58</td><td>76.92</td><td>79.74</td><td>74.29</td><td>78.35</td><td colspan="2">+ DPAR 99.22</td><td>90.19</td><td>86.47</td><td>85.47</td><td>88.33</td></tr></table>

Model Architectures and Training Details . . . . . . . . . . . . . . . . . . . . . . 19 C.2 Crafting adversarial examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 C.3 Details of conducted data transformations . . . . . . . . . . . . . . . . . . . . . . 20 D Supplementary Results -Robust adversarial attacks 21 D.1 Ensemble attack over multiple models . . . . . . . . . . . . . . . . . . . . . . . . . 21 D.2 Comparison with heuristic weighting schemes . . . . . . . . . . . . . . . . . . . . . 21 D.3 Robust adversarial attack over data transformations . . . . . . . . . . . . . . . . . 22 D.4 Sensitivity analysis of regularizer on probability simplex . . . . . . . . . . . . . . 22

Table content: <table><tr><td>CONTENTS</td><td/><td/><td/></tr><tr><td colspan="2">A Proof of Lemma 1 Lemma 1. Problem (10) is equivalent to</td><td/><td>17</td></tr><tr><td/><td/><td>K</td><td/></tr><tr><td>B Proof of Proposition 1 minimize θ</td><td>E (x,y)∈D maximize w∈P,{δi∈Xi}</td><td>i=1</td><td>17</td></tr><tr><td>C Experiment Setup</td><td/><td/><td>19</td></tr><tr><td colspan="4">C.1 . 23</td></tr><tr><td colspan="4">A3 Overlapping of adversarial examples under different p balls (Sec. 4.2) . . . . . . . 24</td></tr><tr><td colspan="3">A4 Learning curves of MLP under different AT schemes (faster convergence, Sec. 4.2)</td><td>25</td></tr><tr><td>LIST OF TABLES</td><td/><td/><td/></tr><tr><td colspan="4">A1 Neural network architectures used in the paper (Sec. 4) . . . . . . . . . . . . . . . 20</td></tr><tr><td colspan="4">A2 Clean test accuracy of the DNN models (Sec. 4) . . . . . . . . . . . . . . . . . . . 20</td></tr><tr><td colspan="4">A3 Ensemble attack over multiple models {A, E, F, H} (Sec. 4.1) . . . . . . . . . . . . . 21</td></tr></table>

Comparison of average and min-max (APGD) ensemble attack over four models on CIFAR-10. Acc (%) represents the test accuracy of classifiers on adversarial examples. The learning rates α, β and regularization factor γ are set as -0

Table content: <table/>

The attack iteration for APGD is set as 50.

Table content: <table><tr><td>Box constraint</td><td>Opt. Acc avg. 27.38 6.33</td><td>7.18</td><td>6.99</td><td>66.56</td><td>-</td></tr><tr><td/><td>min max 19.38 8.72</td><td>9.48</td><td>8.94</td><td>73.83</td><td>10.92%</td></tr><tr><td>1 ( = 30)</td><td>avg. min max 12.56 3.21 30.90 2.06</td><td>1.85 2.70</td><td>1.84 2.72</td><td>66.23 83.13</td><td>-25.52%</td></tr><tr><td>2 ( = 1.5)</td><td>avg. min max 10.26 3.15 20.87 1.75</td><td>1.21 2.24</td><td>1.54 2.37</td><td>76.41 84.99</td><td>-11.23%</td></tr><tr><td>∞ ( = 0.03)</td><td>avg. min max 13.47 3.79 25.75 2.59</td><td>1.66 3.15</td><td>2.27 3.48</td><td>70.54 81.17</td><td>-15.07%</td></tr></table>

Comparison of average, min-max (APGD) ensemble attack and some heuristic weighting schemes over four models on MNIST. Acc (%) represents the test accuracy of classifiers on adversarial examples. w c+d and w a+c+d : average ensemble attack over models {C, D} and {A, C, D}; w clip : clipped version of C&W loss(Shafahi et al., 2018). wprior: larger weights on the models that are more difficult to attack -[wA, wB, wC , wD] = [0.2, 0.1, 0.4, 0.3]; wstatic: converged mean weights (over all data) in min max ensemble attack. The experimental setting is the same as Table1. Acc B Acc C Acc D ASR avg ASR all Lift (↑)

Table content: <table><tr><td colspan="6">Box constraint Acc A 2 ( = 3.0) Opt. avg. 6.88 w c+d 69.03 14.58 5.11 0.03 26.28 14.50 0.34 w a+c+d 1.34 24.53 11.69 2.79 w clip 2.70 0.02 12.69 4.13</td><td>88.08 77.74 89.91 95.12</td><td>69.12 28.65 67.45 85.33</td><td>--58.56% -2.42% 23.45%</td></tr><tr><td/><td>w prior</td><td/><td>0.05</td><td>6.78</td><td>2.65</td><td>96.06</td><td>88.25</td><td>27.68%</td></tr><tr><td/><td>w static</td><td>4.52</td><td>0.27</td><td>3.35</td><td>4.15</td><td>96.93</td><td>90.53</td><td>30.98%</td></tr><tr><td/><td colspan="2">min max 1.51</td><td>0.89</td><td>3.50</td><td>2.06</td><td>98.01</td><td>95.31</td><td>37.89%</td></tr><tr><td/><td>avg.</td><td>1.05</td><td colspan="3">0.07 41.10 35.03</td><td>80.69</td><td>48.17</td><td>-</td></tr><tr><td/><td>w c+d</td><td colspan="3">60.37 19.55 15.10</td><td>1.87</td><td>75.78</td><td>29.32</td><td>-39.13%</td></tr><tr><td/><td>w a+c+d</td><td colspan="4">0.46 21.57 25.36 13.84</td><td>84.69</td><td>53.39</td><td>10.84%</td></tr><tr><td>∞ ( = 0.2)</td><td>w clip</td><td>0.66</td><td colspan="3">0.03 23.43 13.23</td><td>90.66</td><td>71.54</td><td>48.52%</td></tr><tr><td/><td>w prior</td><td>1.57</td><td colspan="3">0.24 17.67 13.74</td><td>91.70</td><td>74.34</td><td>54.33%</td></tr><tr><td/><td>w static</td><td colspan="2">10.58 0.39</td><td>9.28</td><td>10.05</td><td>92.43</td><td>77.84</td><td>61.59%</td></tr><tr><td/><td colspan="2">min max 2.47</td><td>0.37</td><td>7.39</td><td>5.81</td><td>95.99</td><td>90.16</td><td>87.17%</td></tr><tr><td colspan="8">D.3 ROBUST ADVERSARIAL ATTACK OVER DATA TRANSFORMATIONS</td></tr></table>



Table content: <table/>

Comparison of average and min-max optimization on robust attack over multiple data transformations on CIFAR-10. Note that all data transformations are conducted stochastically with a probability of 0.8, except for crop which randomly crops a central area from original image and re-size it into 32 × 32. The adversarial examples are generated by 20-step ∞-APGD ( = 0.03) with α = 1 2 , β = 1 100 and γ = 10. Acc f lh Acc f lv Acc bri Acc crop ASR avg ASR gp Lift (↑)

Table content: <table><tr><td colspan="3">Model Acc ori A Opt. avg. 11.55 min max 13.06</td><td>21.60 18.90</td><td>13.64 13.43</td><td>12.30 13.90</td><td>22.37 20.27</td><td>83.71 84.09</td><td>55.97 59.17</td><td>-5.72%</td></tr><tr><td>B</td><td>avg. min max</td><td>6.74 8.19</td><td>11.55 11.13</td><td>10.33 10.31</td><td>6.59 8.31</td><td>18.21 16.29</td><td>89.32 89.15</td><td>69.52 71.18</td><td>-2.39%</td></tr><tr><td>C</td><td>avg. min max</td><td>8.23 9.68</td><td>17.47 13.45</td><td>13.93 13.41</td><td>8.54 9.95</td><td>18.83 18.23</td><td>86.60 87.06</td><td>58.85 61.63</td><td>-4.72%</td></tr><tr><td>D</td><td colspan="2">avg. min max 10.43 8.67</td><td>19.75 16.41</td><td>11.60 12.14</td><td>8.46 10.15</td><td>19.35 17.64</td><td>86.43 86.65</td><td>60.96 63.64</td><td>-4.40%</td></tr></table>

Comparison of average and min-max optimization on robust attack over multiple data transformations on CIFAR-10. Here a new rotation (rot) transformation is introduced, where images are rotated 30 degrees clockwise. Note that all data transformations are conducted with a probability of 1.0. The adversarial examples are generated by 20-step ∞-APGD ( = 0.03) with α = 1 2 , β = 1 100 and γ = 10. Acc f lh Acc f lv Acc bri Acc gam Acc crop Acc rot ASR avg ASR gp Lift (↑)

Table content: <table><tr><td/><td/><td/><td/><td/><td/><td/><td/><td>0.880</td><td/><td/><td/></tr><tr><td/><td/><td/><td/><td/><td/><td/><td>Attack success rate</td><td>0.865 0.870 0.875</td><td/><td/><td/></tr><tr><td/><td/><td/><td/><td/><td/><td/><td/><td>0.860</td><td>0</td><td>2</td><td>4</td><td>6</td><td>8</td><td>10</td></tr><tr><td/><td/><td/><td/><td/><td/><td/><td colspan="6">A1: Sensitivity analysis of the regular-2 w -1/K 2 izer γ 2 on the probability simplex.</td></tr><tr><td colspan="3">Model Acc ori A Opt. avg. 11.06 min max 13.51</td><td>22.37 18.84</td><td>14.81 14.03</td><td>12.32 15.20</td><td>10.92 13.00</td><td colspan="2">20.40 18.03</td><td/><td>15.89 14.79</td><td>84.60 84.66</td><td>49.24 52.31</td><td>-6.23%</td></tr><tr><td>B</td><td>avg. min max</td><td>5.55 6.75</td><td>11.96 9.13</td><td>9.97 10.56</td><td>5.63 6.72</td><td>5.94 7.11</td><td colspan="2">16.42 12.23</td><td/><td>11.47 10.80</td><td>90.44 90.96</td><td>65.18 70.38</td><td>-7.98%</td></tr><tr><td>C</td><td>avg. min max</td><td>7.65 9.05</td><td>22.30 15.10</td><td>15.82 14.57</td><td>8.17 9.57</td><td>8.07 9.31</td><td colspan="2">15.44 14.11</td><td/><td>15.09 14.23</td><td>86.78 87.72</td><td>49.67 55.37</td><td>-11.48%</td></tr><tr><td>D</td><td colspan="2">avg. min max 10.17 8.22</td><td>20.88 14.65</td><td>13.49 13.62</td><td>7.91 10.03</td><td>8.71 10.35</td><td colspan="2">16.33 14.36</td><td/><td>14.98 13.82</td><td>87.07 87.57</td><td>53.52 57.36</td><td>-7.17%</td></tr><tr><td colspan="12">D.4 SENSITIVITY ANALYSIS OF REGULARIZER ON PROBABILITY SIMPLEX</td></tr></table>



Table content: <table><tr><td>shows complete results on the test accuracy of models in different training schemes. In</td></tr><tr><td>general, the min-max generalized AT obtains better performance than averaging strategy. AMPGD always leads to Top-2 Acc max adv and Acc avg adv .</td></tr><tr><td>E.2 COMPARISON WITH UNIVERSAL ADVERSARIAL TRAINING (UAT)</td></tr><tr><td>Shafahi et al. (</td></tr></table>

Adversarial training of MNIST models on single attacks ( ∞ and 2), multiple attacks (avg. and min max) and universal perturbation (uni). The perturbation magnitude for ∞ and 2 attacks are 0.2 and 2.0, respectively. uSGD indicates universal adversarial training followingShafahi et al. (2018) ( ∞ norm, = 0.3). Top 2 test accuracy on each metric are highlighted.

Table content: <table><tr><td/><td/><td colspan="2">(a) MLP</td><td/><td/><td/><td/><td colspan="2">(b) LeNet</td><td/><td/></tr><tr><td>Opt.</td><td colspan="5">Acc. Acc-∞ Acc-2 Acc-uni Acc avg adv</td><td>Opt.</td><td colspan="5">Acc. Acc-∞ Acc-2 Acc-uni Acc avg adv</td></tr><tr><td>natural</td><td>98.30</td><td>2.70</td><td>13.86</td><td>21.61</td><td>12.72</td><td>natural</td><td>99.25</td><td>17.93</td><td>39.32</td><td>58.93</td><td>38.73</td></tr><tr><td>∞</td><td>98.08</td><td>77.70</td><td>69.17</td><td>90.90</td><td>79.26</td><td>∞</td><td>99.18</td><td>93.80</td><td>78.97</td><td>98.70</td><td>90.49</td></tr><tr><td>2</td><td>98.72</td><td>70.03</td><td>81.74</td><td>82.49</td><td>78.09</td><td>2</td><td>99.22</td><td>85.84</td><td>87.31</td><td>96.63</td><td>89.93</td></tr><tr><td colspan="2">uSGD ( ∞) 98.73</td><td>56.21</td><td>64.51</td><td>91.27</td><td>70.66</td><td colspan="2">uSGD ( ∞) 99.44</td><td>72.81</td><td>66.39</td><td>98.37</td><td>79.19</td></tr><tr><td>avg.</td><td>98.62</td><td>75.09</td><td>79.00</td><td>86.69</td><td>80.26</td><td>avg.</td><td>99.22</td><td>88.96</td><td>85.59</td><td>97.41</td><td>90.65</td></tr><tr><td>+ DPAR</td><td>98.50</td><td>76.75</td><td>79.67</td><td>87.88</td><td>81.44</td><td>+ DPAR</td><td>99.25</td><td>89.96</td><td>86.49</td><td>97.36</td><td>91.27</td></tr><tr><td>min max</td><td>98.59</td><td>75.96</td><td>79.15</td><td>86.13</td><td>80.41</td><td>min max</td><td>99.32</td><td>89.21</td><td>85.98</td><td>98.22</td><td>91.14</td></tr><tr><td>+ DPAR</td><td>98.58</td><td>76.92</td><td>79.74</td><td>87.55</td><td>81.40</td><td>+ DPAR</td><td>99.22</td><td>90.19</td><td>86.47</td><td>97.77</td><td>91.48</td></tr><tr><td colspan="5">E.3 OVERLAP OF p -NORM BALLS</td><td/><td/><td/><td/><td/><td/><td/></tr></table>

Adversarial training of MNIST models with single attacks ( ∞ and 2) and multiple attacks (avg. and min max). During the training process, the perturbation magnitude ∞ is fixed as 0.2, and 2 are changed from 0.5 to 3.0 with a step size of 0.5. For min-max scheme, the adversarial examples are crafted using 20-step ∞-APGD with α = 1 6 , β = 1 50 and γ = 4. The ratio of adversarial and benign examples in adversarial training is set as 1.0. For diversity-promoting attack regularizer (DPAR) in generalized AT, the hyperparameter λ = 0.1.

Table content: <table><tr><td/><td/><td colspan="3">(a) ( ∞ , 2 ) = (0.2, 0.5)</td><td/><td/><td/><td colspan="3">(b) ( ∞ , 2 ) = (0.2, 1.0)</td><td/></tr><tr><td>Model</td><td>Opt.</td><td colspan="4">Acc. Acc-∞ Acc-2 Acc max adv</td><td>Acc avg adv</td><td colspan="4">Acc. Acc-∞ Acc-2 Acc max adv</td><td>Acc avg adv</td></tr><tr><td/><td>natural</td><td>98.28</td><td>2.78</td><td>93.75</td><td>1.80</td><td>48.27</td><td>98.30</td><td>3.65</td><td>72.39</td><td>1.17</td><td>39.01</td></tr><tr><td/><td>∞</td><td>98.22</td><td>77.82</td><td>97.11</td><td>77.23</td><td>87.46</td><td>98.29</td><td>78.15</td><td>93.28</td><td>77.95</td><td>85.71</td></tr><tr><td>MLP</td><td>2</td><td>98.71</td><td>12.04</td><td>97.10</td><td>11.73</td><td>54.57</td><td>98.98</td><td>36.02</td><td>94.39</td><td>34.68</td><td>65.20</td></tr><tr><td/><td>avg.</td><td>98.83</td><td>74.07</td><td>97.70</td><td>73.67</td><td>85.88</td><td>98.72</td><td>73.97</td><td>94.63</td><td>73.70</td><td>84.30</td></tr><tr><td/><td>+ DPAR</td><td>98.56</td><td>77.32</td><td>97.74</td><td>76.98</td><td>87.53</td><td>98.60</td><td>76.57</td><td>94.41</td><td>76.39</td><td>85.49</td></tr><tr><td/><td colspan="2">min max 98.73</td><td>75.88</td><td>97.43</td><td>75.56</td><td>86.66</td><td>98.72</td><td>75.18</td><td>94.29</td><td>74.92</td><td>84.74</td></tr><tr><td/><td>+ DPAR</td><td>98.75</td><td>77.04</td><td>97.81</td><td>76.72</td><td>87.43</td><td>98.68</td><td>76.59</td><td>95.11</td><td>76.49</td><td>85.85</td></tr><tr><td/><td>natural</td><td>99.17</td><td>18.16</td><td>97.56</td><td>15.23</td><td>57.86</td><td>9.16</td><td>18.24</td><td>89.97</td><td>15.36</td><td>54.10</td></tr><tr><td/><td>∞</td><td>99.27</td><td>93.60</td><td>98.74</td><td>93.26</td><td>96.17</td><td>99.28</td><td>93.51</td><td>96.49</td><td>93.13</td><td>95.00</td></tr><tr><td>LeNet</td><td>2</td><td>99.43</td><td>34.30</td><td>98.49</td><td>26.89</td><td>66.39</td><td>99.50</td><td>63.48</td><td>96.62</td><td>57.94</td><td>80.05</td></tr><tr><td/><td>avg.</td><td>99.29</td><td>90.69</td><td>98.89</td><td>90.34</td><td>94.79</td><td>99.40</td><td>89.39</td><td>96.94</td><td>89.02</td><td>93.16</td></tr><tr><td/><td>+ DPAR</td><td>99.28</td><td>91.81</td><td>98.87</td><td>91.52</td><td>95.34</td><td>99.38</td><td>99.09</td><td>97.13</td><td>89.99</td><td>93.61</td></tr><tr><td/><td colspan="2">min max 99.35</td><td>90.81</td><td>98.74</td><td>90.21</td><td>94.78</td><td>99.31</td><td>90.82</td><td>97.20</td><td>90.56</td><td>94.01</td></tr><tr><td/><td>+ DPAR</td><td>99.34</td><td>91.82</td><td>98.77</td><td>91.60</td><td>95.30</td><td>99.35</td><td>90.88</td><td>97.07</td><td>90.80</td><td>93.98</td></tr><tr><td/><td/><td colspan="3">(c) ( ∞ , 2 ) = (0.2, 1.5)</td><td/><td/><td/><td colspan="3">(d) ( ∞ , 2 ) = (0.2, 2.0)</td><td/></tr><tr><td>Model</td><td>Opt.</td><td colspan="4">Acc. Acc-∞ Acc-2 Acc max adv</td><td>Acc avg adv</td><td colspan="4">Acc. Acc-∞ Acc-2 Acc max adv</td><td>Acc avg adv</td></tr><tr><td/><td>natural</td><td>98.39</td><td>2.77</td><td>35.70</td><td>2.32</td><td>19.23</td><td>98.30</td><td>2.70</td><td>13.86</td><td>0.85</td><td>8.28</td></tr><tr><td/><td>∞</td><td>98.34</td><td>78.96</td><td>85.94</td><td>77.42</td><td>82.45</td><td>98.08</td><td>77.70</td><td>69.17</td><td>66.34</td><td>73.43</td></tr><tr><td>MLP</td><td>2</td><td>99.00</td><td>60.37</td><td>89.96</td><td>59.82</td><td>75.16</td><td>98.72</td><td>70.03</td><td>81.74</td><td>69.14</td><td>75.88</td></tr><tr><td/><td>avg.</td><td>98.61</td><td>75.01</td><td>88.85</td><td>74.76</td><td>81.93</td><td>98.62</td><td>75.09</td><td>79.00</td><td>72.23</td><td>77.05</td></tr><tr><td/><td>+ DPAR</td><td>98.68</td><td>76.55</td><td>88.52</td><td>76.18</td><td>82.53</td><td>98.50</td><td>76.75</td><td>79.67</td><td>74.14</td><td>78.21</td></tr><tr><td/><td colspan="2">min max 98.76</td><td>75.66</td><td>88.78</td><td>75.33</td><td>82.22</td><td>98.59</td><td>75.96</td><td>79.15</td><td>73.43</td><td>77.55</td></tr><tr><td/><td>+ DPAR</td><td>98.77</td><td>77.54</td><td>89.57</td><td>77.24</td><td>83.55</td><td>98.58</td><td>76.92</td><td>79.74</td><td>74.29</td><td>78.35</td></tr><tr><td/><td>natural</td><td>99.22</td><td>14.31</td><td>67.69</td><td>12.34</td><td>41.00</td><td>99.25</td><td>17.93</td><td>39.32</td><td>17.57</td><td>28.63</td></tr><tr><td/><td>∞</td><td>99.22</td><td>93.76</td><td>91.11</td><td>90.26</td><td>92.43</td><td>99.18</td><td>93.80</td><td>78.97</td><td>78.80</td><td>86.39</td></tr><tr><td>LeNet</td><td>2</td><td>99.35</td><td>79.92</td><td>93.27</td><td>77.39</td><td>86.60</td><td>99.22</td><td>85.84</td><td>87.31</td><td>84.06</td><td>86.58</td></tr><tr><td/><td>avg.</td><td>99.31</td><td>89.26</td><td>93.29</td><td>88.77</td><td>91.28</td><td>99.22</td><td>88.96</td><td>85.59</td><td>84.29</td><td>87.28</td></tr><tr><td/><td>+ DPAR</td><td>99.27</td><td>90.75</td><td>93.48</td><td>89.96</td><td>92.11</td><td>99.25</td><td>89.96</td><td>86.49</td><td>85.44</td><td>88.23</td></tr><tr><td/><td colspan="2">min max 99.40</td><td>89.83</td><td>92.96</td><td>89.00</td><td>91.39</td><td>99.32</td><td>89.21</td><td>85.98</td><td>84.82</td><td>87.60</td></tr><tr><td/><td>+ DPAR</td><td>99.35</td><td>90.64</td><td>93.27</td><td>89.80</td><td>91.96</td><td>99.22</td><td>90.19</td><td>86.47</td><td>85.47</td><td>88.33</td></tr><tr><td/><td/><td colspan="3">(e) ( ∞ , 2 ) = (0.2, 2.5)</td><td/><td/><td/><td colspan="3">(f) ( ∞ , 2 ) = (0.2, 3.0)</td><td/></tr><tr><td>Model</td><td>Opt.</td><td colspan="4">Acc. Acc-∞ Acc-2 Acc max adv</td><td>Acc avg adv</td><td colspan="4">Acc. Acc-∞ Acc-2 Acc max adv</td><td>Acc avg adv</td></tr><tr><td/><td>natural</td><td>98.31</td><td>3.37</td><td>6.02</td><td>2.27</td><td>4.70</td><td>98.24</td><td>2.92</td><td>2.42</td><td>1.54</td><td>2.67</td></tr><tr><td/><td>∞</td><td>98.25</td><td>77.91</td><td>51.28</td><td>49.40</td><td>64.59</td><td>98.35</td><td>79.15</td><td>32.58</td><td>31.23</td><td>55.86</td></tr><tr><td>MLP</td><td>2</td><td>98.10</td><td>73.94</td><td>70.01</td><td>67.66</td><td>71.97</td><td>97.55</td><td>73.86</td><td>58.24</td><td>57.83</td><td>66.05</td></tr><tr><td/><td>avg.</td><td>98.47</td><td>75.35</td><td>64.39</td><td>63.37</td><td>69.86</td><td>98.17</td><td>75.07</td><td>49.75</td><td>49.49</td><td>62.41</td></tr><tr><td/><td>+ DPAR</td><td>98.18</td><td>76.33</td><td>66.49</td><td>65.54</td><td>71.41</td><td>97.85</td><td>74.61</td><td>51.16</td><td>51.04</td><td>62.89</td></tr><tr><td/><td colspan="2">min max 98.44</td><td>75.48</td><td>66.12</td><td>64.99</td><td>70.80</td><td>98.10</td><td>74.71</td><td>50.45</td><td>50.54</td><td>62.58</td></tr><tr><td/><td>+ DPAR</td><td>98.20</td><td>76.98</td><td>66.42</td><td>65.55</td><td>71.70</td><td>97.97</td><td>76.13</td><td>51.12</td><td>51.00</td><td>63.63</td></tr><tr><td/><td>natural</td><td>99.23</td><td>15.25</td><td>16.08</td><td>11.16</td><td>15.67</td><td>99.24</td><td>13.76</td><td>4.74</td><td>2.57</td><td>9.25</td></tr><tr><td/><td>∞</td><td>99.18</td><td>94.09</td><td>60.18</td><td>58.47</td><td>77.13</td><td>99.30</td><td>93.14</td><td>39.48</td><td>32.93</td><td>65.81</td></tr><tr><td>LeNet</td><td>2</td><td>98.94</td><td>87.57</td><td>78.45</td><td>78.42</td><td>83.01</td><td>98.55</td><td>87.87</td><td>68.69</td><td>68.34</td><td>78.28</td></tr><tr><td/><td>avg.</td><td>99.10</td><td>89.88</td><td>74.68</td><td>74.39</td><td>82.28</td><td>99.10</td><td>89.19</td><td>59.87</td><td>60.01</td><td>74.53</td></tr><tr><td/><td>+ DPAR</td><td>99.14</td><td>90.17</td><td>75.16</td><td>75.09</td><td>82.67</td><td>98.95</td><td>89.80</td><td>62.21</td><td>61.19</td><td>75.50</td></tr><tr><td/><td colspan="2">min max 99.21</td><td>88.88</td><td>74.97</td><td>74.42</td><td>81.93</td><td>99.01</td><td>88.93</td><td>61.15</td><td>60.76</td><td>75.04</td></tr><tr><td/><td>+ DPAR</td><td>99.09</td><td>89.34</td><td>75.55</td><td>75.45</td><td>82.45</td><td>98.98</td><td>89.53</td><td>63.22</td><td>63.18</td><td>76.37</td></tr></table>

Peer review (iclr2020):
Note: I applied a higher standard to this paper given that it significantly exceeds the recommended page limit. Furthermore, important details are left out in the appendices, which make it difficult to read the main body of the paper in a self-contained fashion. Given that the main body was already over the recommended page limit, I did not read the appendices. This paper generalizes the min max formulation of adversarial training, and proposes a formulation that encompasses adversarial training of an ensemble, robustness to universal adversarial examples, and robustness to non-adversarial transformations. This formulation is used to derive an adversarial training procedure that trains against the worst-case adversarial example among adversarial examples generated by a set of attacks. Experiments seek to demonstrate applicability of this framework to both attacks and defenses. As far as experiments are concerned, Section 4.1 presents results on MNIST, which is known to be a poor dataset to study adversarial examples on [https://arxiv.org/abs/1902.06705]. If models C and D are more difficult to attack, could better baselines be employed than attacking the ensemble A+B+C+D? For instance, would an adversary evading models C+D only perform better? It is difficult to draw insights that are generally applicable from a single ensemble. How was the ensemble chosen? Why would a defender add models which are known to be significantly less robust to the ensemble? When discussing universal perturbations, how are they generated? Given that the performance of the proposed approach significantly degrades average evasion across all images from all groups, what is the threat model for an adversary being interested in group-level success rather than average evasion across all images from all groups? How were the values of K chosen? This comment also applies to experiments over data transformations. For these experiments, what was the value of K? As far as the defensive perspective is concerned, it is not clear whether the improvements observed are statistically significant. Were multiple runs averaged to produce Table 4? Given that without DPAR, the improvement is negligible, this is important to interpret results. It appears that most of the robustness gains in both the average and max settings stem from DPAR. This should be clearly surfaced in the introduction and presentation of contributions if DPAR is required for the proposed generalized min max formulation to improve robustness. In particular, it is not clear whether DPAR is “a beneficial supplement to adversarial training” or a required supplement to adversarial training - per the formulation in this paper. There are issues with grammar throughout the document, which make it difficult to read. Some specific issues: 1 - Adversarial attack is a tautology (an attack is always adversarial) 7 - What does “robust” adversarial attack mean? 7 - What is CAAD-18? 7 - Define ASR_all: what does evade mean here? Is the attack targeted or untargeted? 7 - What is an “advanced” DNN?