SlowGuess/NeurIPS_2023_OCR huggingface dataset:
(c) The clean accuracy of models trained on pseudo-labeled distribution
Figure 1: (a) shows the results of gradual AST methods with varying starting domains on Rotating MNIST. The abscissa indicates different methods with varying starting domains  $\tau$ . The blue and red bars represent the clean accuracy and adversarial accuracy respectively of the trained model on the target domain. (b) shows the result of gradual AST methods with varying starting domains on Portraits. (c) compares the effect of adversarial training and standard training under pseudo-labeled distributions on Rotating MNIST. We use blue and red bars to represent the clean accuracy of the standardly trained model and the adversially trained model, respectively. The gray bar indicates the correct rate of the pseudo-labels.
When we set  $\zeta = 0.05$ , the gradual AST with the optimal starting domain  $\tau = 1$  achieves clean accuracy of  $86.04\%$ $(+4.01\%)$  and adversarial accuracy of  $77.25\%$ $(+37.02\%)$  on Portraits.
3.4 Training with Labeled Intermediate Domains
In the setting of GDA, the learner is provided with unlabeled intermediate domains, and the model predicts pseudo-labels on an unlabeled data set in each iteration. The pseudo-labels contain a small proportion of incorrect labels, leading to performance degradation of the trained model. In this section, we conduct experiments to investigate the optimal performance of the model trained with ground-truth labels. In other words, the learner is provided with labeled intermediate data. Although the learner has access to the ground-truth intermediate labels, we still retain the filtering process, since we need to maintain the same data size to ensure fair comparison. We present the results of the models with varying  $\tau$  in Table 19 and Table 20 (due to space limitations, we attach the tables in Appendix B). Since the results in Section 3.3 show that  $\zeta = 0.05$  is the optimal filtration ratio for gradual AST methods, we set  $\zeta = 0.05$  in this section. From Table 19, we can see that if the learner is provided with labeled intermediate domains, the vanilla gradual self-training method ( $\tau = 22$ ) achieves clean accuracy of  $98.44\%$  on Rotating MNIST. Recall the results in Table 9 showing that the proposed gradual AST method ( $\tau = 9$ ) achieves clean accuracy of  $97.15\%$ . The performance  $(97.15\%)$  of the proposed gradual AST is close to the optimal performance  $(98.44\%)$  of the gradual self-training where the learner is provided with labeled intermediate domains.
4 Theoretical Analysis
In this section, we theoretically analyze the experimental phenomena identified in Section 3 and explain the efficacy of gradual AST. In Section 4.1, we provide the adversarial error bound for gradual AST. In Section 4.2, we provide some theoretical insights about why AT outperforms standard training. In Section 4.3, we further present an example of a conditional Gaussian distribution to
show the error correction effect of AT on the incorrect labels. Our theory thus supports the excellent performance of gradual AST shown in Section 3.
4.1 Generalization Error Bounds for Gradual AST
We introduce the Margin Disparity Discrepancy (MDD) to measure the domain shifts, as below.
Definition 4.1 (MDD [53]). Let  $P$  and  $Q$  be two distributions over  $\mathcal{X}$ . Given a scoring function class  $\mathcal{F}$  and a specific scoring function  $f \in \mathcal{F}$ , the MDD between  $P$  and  $Q$  is defined as
$$
d _ {f, \mathcal {F}} ^ {(\rho)} (P, Q) \triangleq \sup  _ {f ^ {\prime} \in \mathcal {F}} \left(R _ {Q} ^ {(\rho)} \left(f ^ {\prime}, f\right) - R _ {P} ^ {(\rho)} \left(f ^ {\prime}, f\right)\right). \tag {2}
$$
When the domain shift is slight, the MDD between the domains is small. The MDD is well-defined and can be empirically estimated by the training data [53], where the estimation error can be bounded by Rademacher complexity. We next present the definition of Rademacher complexity, which is widely used in generalization theory to measure the complexity of a hypothesis class.
Definition 4.2 (Rademacher Complexity [44]). Let  $\mathcal{G}$  be a set of real-valued functions defined over  $\mathcal{X}$ . For a fixed collection  $S$  of  $n$  data points, the empirical Rademacher complexity of  $\mathcal{G}$  is defined as
$$
\widehat {\mathcal {R}} _ {S} (\mathcal {G}) \triangleq \frac {2}{n} \underset {\varsigma} {\mathbb {E}} \left[ \sup _ {g \in \mathcal {G}} \sum_ {x _ {i} \in S} \varsigma_ {i} g (x _ {i}) \right].
$$
The expectation is taken over  $\varsigma = (\varsigma_1, \dots, \varsigma_n)$ , where  $\varsigma_i, i \in \{1, \dots, n\}$ , are independent uniform random variables taking values in  $\{-1, +1\}$ .
We next introduce an adversarial margin hypothesis class  $\widetilde{\rho_{\mathcal{F}}\mathcal{F}}$
Definition 4.3 (Adversarial Margin Hypothesis Class). Given a scoring function class  $\mathcal{F}$ , the adversarial margin hypothesis class is defined as
$$
\widetilde {\rho_ {\mathcal {F}} \mathcal {F}} \triangleq \{x \mapsto \max  _ {\| \delta \| _ {q} \leq \epsilon} \rho_ {f ^ {\prime}} (x + \delta , h _ {f} (x)): f, f ^ {\prime} \in \mathcal {F} \}.
$$
Having defined the Rademacher complexity and the MDD, we now focus on a pair of arbitrary consecutive domains. The following result shows that AST returns a new model  $f'$  with bounded adversarial margin loss if the domain shifts gradually. The proof can be found in Appendix A.2.
Theorem 4.4 (Adversarial Error Bound for AST). Let  $\langle P, f_P \rangle$  and  $\langle Q, f_Q \rangle$  be two domains with gradual shifts. Suppose we have a scoring function  $f$  pre-trained on domain  $\langle P, f_P \rangle$ , and a data set  $S$  of  $n$  unlabeled data points drawn i.i.d. according to distribution  $Q$ .  $f'$  is the adapted scoring function by generated by the AST algorithm over  $S$ , i.e.,  $f' = AST(f, S)$ . Then, for any  $\alpha \geq 0$ , the following holds with probability of at least  $1 - \alpha$  over data points  $S$ :
$$
\widetilde {R} _ {Q} ^ {(\rho)} (f ^ {\prime}) \leq \widetilde {R} _ {P} ^ {(\rho)} (f) + \widetilde {\gamma} ^ {*} + \lambda^ {*} + d _ {f, \mathcal {F}} (P, Q) + \frac {2}{\rho} \widehat {\mathcal {R}} _ {S} (\widetilde {\rho_ {\mathcal {F}} \mathcal {F}}) + 6 \sqrt {\frac {\log \frac {4}{\alpha}}{2 n}},
$$
where  $\widetilde{\gamma}^{*} = \min_{f^{\prime}\in \mathcal{F}}\widetilde{R}_{Q}^{(\rho)}(f^{\prime},f)$  and  $\lambda^{*} = \min_{f\in \mathcal{F}}\Big\{R_P^{(\rho)}(f) + R_Q^{(\rho)}(f)\Big\}$ .
Remark 4.5. Theorem 4.4 indicates that if we have a model  $f$  with low adversarial margin loss on the domain  $\langle P, f_P \rangle$  and the distribution shifts slightly, AST generates a new model  $f'$  that is also adversarially robust on the domain  $\langle Q, f_Q \rangle$ . The  $\lambda^*$  term is widely used in domain adaptation theory [5, 34] to implicitly characterize the conditional distribution shift. In the setting of GDA, we assume that the domain shifts only slightly, i.e.,  $\lambda^*$  and  $d_{f,\mathcal{F}}(P,Q)$  are relatively low.
Based on the error bounds for AST, we can apply this argument inductively and sum these error differences along the domain sequence to obtain the following corollary. See proofs in Appendix A.3.
Corollary 4.6 (Error Bounds for Gradual AST). Given a sequence of domains  $\langle P_t, f_{P_t} \rangle$ ,  $t \in \{0, \dots, T\}$  with gradual shifts, each intermediate domain has an unlabeled data set  $S_t$  drawn i.i.d. from  $P_t$ . The model is successively trained by the AST method, i.e.,  $f_t = AST(f_{t-1}, S_t)$ ,  $t \in$
$\{1,\ldots ,T\}$  . Then, for any  $\alpha \geq 0$  , the following holds with probability of at least  $1 - \alpha$  over data points  $\{S_t\}_{t = 1}^T$  ..
$$
\widetilde {R} _ {P _ {T}} (h _ {f _ {T}}) \leq \widetilde {R} _ {P _ {0}} ^ {(\rho)} (f _ {0}) + \sum_ {t = 1} ^ {T} \kappa_ {t} + \frac {2 T}{\rho} \widehat {\mathcal {R}} _ {S} (\widetilde {\rho_ {\mathcal {F}} \mathcal {F}}) + 6 T \sqrt {\frac {\log \frac {4 T}{\alpha}}{2 n}},
$$
where  $\kappa_{t} = d_{f_{t - 1},\mathcal{F}}(P_{t - 1},P_{t}) + \min_{f\in \mathcal{F}}\widetilde{R}_{P_{t}}^{(\rho)}(f,f_{t - 1}) + \min_{f\in \mathcal{F}}\Bigl \{R_{P}^{(\rho)}(f) + R_{Q}^{(\rho)}(f)\Bigr \} .$
Remark 4.7. Our bound indicates that the adversarial risk on target domain can be controlled by the adversarial margin loss on the source domain and the discrepancy [53] between the intermediate domains. We also consider the standard risk and find that the standard risk of AST can be bounded similarly. We provide the bounds in Appendix A.4.
Comparison with Previous Work. Both of the works of [26] and [45] focus on binary classification and standard self-training, while our results non-trivially extend the error bounds into the setting of adversarial GDA and multiclass classification. Furthermore, [26] sets linear hypotheses as their training models, while we consider a more general hypothesis class that can be implemented by neural networks. [45] makes an assumption that the new model can always fit the pseudo-labels without error. As we can observe from the experiments, the training error tends to be small but never equal to 0. Compared to [45], we don't need the assumption, so our setting is more consistent with real experiments.
4.2 Adversarial Training Improves Clean Accuracy for Self-Training
AT is generally considered harmful to the clean accuracy of the model [52, 38]. However, the experimental results in Section 3 indicate that AT unexpectedly improves both the clean accuracy and adversarial accuracy of the model trained on the pseudo-labels. In this section, we provide some theoretical insights showing that when the training data contains a small portion of incorrect labels, the adversarially trained model may have a tighter generalization guarantee than the standardly trained model. Our theorem is based on the following optimization problem.
Definition 4.8. Given two fixed vectors  $p$  and  $p'$  with all positive coordinates and a fixed  $N$ -dimensional 0-1 vector  $e$ , i.e.,  $e \in \{0,1\}^N$ .  $\Pi$  is a fixed subset of  $\{1,\dots ,N\}$ . The variant of the Subset Sum Problem [3] can be defined as follows:
$$
\min _ {\widetilde {e} \in \{0, 1 \} ^ {N}} \left| p ^ {T} \widetilde {e} - p ^ {\prime T} e \right|, s. t. \widetilde {e} _ {i} = e _ {i}, \forall i \in \{1, \ldots , N \} \backslash \Pi .
$$
We use  $\Psi^{*}(p^{\prime},p,e,\Pi)$  to denote the optimal value of the problem. Given two fixed vectors  $p^\prime$  and  $e$ , the value of the term  $p^{\prime T}e$  is therefore constant. The optimization problem can be viewed as one of selecting a subset of  $p$  such that the sum of its elements is as close as possible to  $p^{\prime T}e$ . Intuitively, the set  $\Pi$  adjusts the difficulty of this optimization problem. For two sets  $\Pi_1\subseteq \Pi_2$ , we have  $\Psi^{*}(p^{\prime},p,e,\Pi_{1})\geq \Psi^{*}(p^{\prime},p,e,\Pi_{2})$  since we can optimize  $\widetilde{e}$  on more coordinates.
With a little abuse of notations, in this subsection, we consider a discrete real distribution  $P$  and a discrete noisy pseudo-labeled distribution  $P_{\eta}$  over  $\mathcal{X} \times \mathcal{Y}$ . We denote the corresponding probability mass functions as  $p$  and  $p_{\eta}$  respectively.  $p$  and  $p_{\eta}$  can be viewed as two vectors, i.e.,  $p_i = p(x_i, y_i), (x_i, y_i) \in \mathcal{X} \times \mathcal{Y}, i \in \{1, \ldots, |\mathcal{X} \times \mathcal{Y}|\}$ . The standard risk on the real data distribution is defined as  $R_P(h) = \sum_{(x,y) \in \mathcal{X} \times \mathcal{Y}} p(x,y) \mathbb{1}[h(x) \neq y]$  and the adversarial risk on the pseudo-labeled data distribution is defined as  $\widetilde{R}_{P_{\eta}}(h) = \sum_{(x,y) \in \mathcal{X} \times \mathcal{Y}} p_{\eta}(x,y) \max_{\| \delta \|_q \leq \epsilon} \mathbb{1}[h(x + \delta) \neq y]$ .
The next result uses the optimal value  $\Psi^{*}(p,p_{\eta},e,\Pi)$  to bound the difference between these two risks. The proof can be found in Appendix A.5.
Theorem 4.9. Given two distributions  $P$  and  $P_{\eta}$  over  $\mathcal{X} \times \mathcal{Y}$  with the corresponding probability mass vectors  $p$  and  $p_{\eta}$ , the following bound holds for any classifier  $h \in \mathcal{H}_{\mathcal{F}}$ :
$$
R _ {P} (h) \leq \widetilde {R} _ {P _ {\eta}} (h) + \Psi^ {*} (p, p _ {\eta}, e, \Pi_ {\epsilon}),
$$
where  $e$  is the risk vector  $e_i = \mathbb{1}[h(x_i) \neq y_i]$ , and  $\Pi_{\epsilon} = \{i : \exists \| \delta_i \|_q \leq \epsilon, h(x_i + \delta_i) \neq h(x_i)\}$ .
Figure 2: The visualization of the adversarially trained classifier for a conditional Gaussian distribution. AT consistently moves the threshold  $b_{adv}$  close to the optimal threshold  $b = 0$ , leading to better generalization on the real data distribution. Best viewed in color.
By setting  $\epsilon = 0$ , we can derive the error bound for standard training:  $R_{P}(h) \leq R_{P_{\eta}}(h) + \Psi^{*}(p, p_{\eta}, e, \Pi_0)$ . By the definition of the set  $\Pi_{\epsilon}$ , the larger the perturbation radius  $\epsilon$ , the larger the size of  $\Pi_{\epsilon}$ , i.e.,  $\Pi_0 \subseteq \Pi_{\epsilon}$ . We then have  $\Psi^{*}(p, p_{\eta}, e, \Pi_{\epsilon}) \leq \Psi^{*}(p, p_{\eta}, e, \Pi_0)$ . Theorem 4.9 implies that if the adversarial risk  $\widetilde{R}_{P_{\eta}}(h)$  on the pseudo-labeled distribution is well controlled by AT, then AT may yield a tighter generalization guarantee than standard training.
4.3 A Toy Example of a Conditional Gaussian Distribution
We further provide an example of a conditional Gaussian distribution to show the efficacy of AT under incorrect pseudo-labels.
Example 4.10 (Conditional Gaussian Distribution). We consider the input space  $\mathcal{X} = \mathbb{R}$  and the label space  $\mathcal{Y} = \{-1, + 1\}$ . For simplicity, we assume that the two classes have symmetrical mean parameters  $\{-\mu , + \mu \}$  and the same standard deviations  $\sigma$ . The  $(\mu ,\sigma)$ -conditional Gaussian distribution  $P$  can then be defined as a distribution over  $\mathcal{X}\times \mathcal{Y} = \mathbb{R}\times \{-1, + 1\}$ , where the conditional distribution of  $X$  given  $Y$  is  $X|Y = y\sim \mathcal{N}(y\mu ,\sigma^2)$  and the marginal distribution of  $Y$  is  $P_{Y}(\{-1\}) = P_{Y}(\{+1\}) = 1 / 2$ . We consider a threshold hypothesis class, i.e.,  $\mathcal{H}\triangleq \{x\mapsto \operatorname {sgn}(x - b):b\in \mathbb{R}\}$ , where  $\operatorname {sgn}$  is the sign function. We denote the hypothesis with threshold  $b$  as  $h_b$ . In the setting of self-training, we have a labeling function  $h_w$ , which is the model trained on the previous domain. The threshold  $w\neq 0$ , since there is a distribution shift. The function  $h_w$  assigns  $y = -1$  to the data points where  $x < w$  and assigns  $y = +1$  to the data points where  $x > w$ . We denote the pseudo-labeled data distribution over  $\mathcal{X}\times \mathcal{Y}$  as  $P_{\eta}$ . We use  $R_{P_{\eta}}(h)$  and  $\widetilde{R}_{P_{\eta}}(h)$  to respectively denote the standard 0-1 risk and adversarial 0-1 risk on the pseudo-labeled data distribution  $P_{\eta}$ . We assume  $|w|\ll \mu$  and  $\epsilon \ll \mu$ , since the domain shift is slight and the adversarial perturbation is subtle. We also assume  $\mu >\sigma$ , which means that most samples can be well separated. The learner is provided with infinite samples. Under these assumptions, we provide the following results to demonstrate the efficacy of AT. The proof can be found in Appendix A.6.
Theorem 4.11. For the real data distribution  $P$  defined in Example 4.10, the optimal classifier that minimizes the standard risk  $R_P(h)$  and adversarial risk  $\widetilde{R}_P(h)$  is  $h_0(\cdot) = \operatorname{sgn}(\cdot)$ . For the pseudo-labeled distribution  $P_{\eta}$  defined in Example 4.10, the standardly trained classifier  $h_{std}$  that minimizes the standard risk  $R_{P_{\eta}}(h)$  is  $h_{std} = h_w$ ; the adversarially trained classifier  $h_{adv}$  that minimizes the adversarial risk  $\widetilde{R}_{P_{\eta}}(h)$  has the following corresponding threshold  $b_{adv}$ ,
$$
b _ {a d v} = \left\{ \begin{array}{c l} w + \epsilon , & \text {i f} w <   - \epsilon \\ 0, & \text {i f} - \epsilon <   w <   \epsilon \\ w - \epsilon , & \text {i f} w > \epsilon \end{array} \right.
$$
Remark 4.12. Theorem 4.11 shows that the adversariably trained model  $h_{adv}$  consistently moves the threshold close to the optimal threshold  $b = 0$ , leading to a smaller generalization error. We visually represent the adversarially trained model in Figure 2.
Self-Training. A series of works have achieved significant progress using self-training in semi-supervised learning [29, 40] and domain adaptation [56]. The recent work [9] has proposed robust
self-training (RST) to leverage additional unlabeled data for robustness [2, 36]. While RST [9] focuses on utilizing additional unlabeled data drawn from the same distribution to improve adversarial robustness, our work investigates the different effects of vanilla self-training and adversarial self-training on clean accuracy.
Gradual Domain Adaptation. Unlike the UDA problem, GDA has intermediate domains between the source domain and target domain of UDA. Some works [22, 17, 48] propose various algorithms to handle these evolving domains in a computer vision context. The recent work [26] adopts the self-training method and proposes gradual self-training, which iteratively adapts the model along the domain sequence. Moreover, [26] provides the first learning theory for GDA and investigates when and why the gradual structure helps. [45] further improves the generalization error bound in [26] and reveals the influence of the number of intermediate domains on the error bound. [10] investigates a more difficult setting in which the learner is provided with a set of unordered intermediate data. The authors propose TDOL, a framework that generates synthetic domains by indexing the intermediate data. However, the aforementioned works pay insufficient attention to the adversarial robustness of the model in a GDA context. In the field of UDA, the work of [11] constructs synthetic intermediate domains by creating Grassmannian manifolds between the source and the target. Another line of work instead uses a generative network, such as a cycle generative adversarial network [23], to generate the intermediate data.
Adversarial Training. After [41] shows that DNNs are fragile to adversarial attacks, a large amount of works have proposed various attack methods [33, 27, 8] and defense methods [47, 19, 51, 31, 20, 24, 30]. Adversarial training [19] is one of the popular and effective methods that improves adversarial robustness by adding adversarial examples to the training dataset. From the theoretical perspective, some works focus on the sample complexity [50, 54, 12] and the generalization of adversarial training. [32] investigates the trade-off between robustness and fairness. [46, 55] study adversarial robustness under self-supervised learning.
In this work, we empirically demonstrate that gradual AST improves both the clean accuracy and the adversarial accuracy of the GDA model. We reveal that the reason for this performance improvement is that AT outperforms standard training when the training data contains incorrect pseudo-labels. We first provide generalization error bounds for gradual AST in a multiclass setting. We then construct the Subset Sum Problem to connect the adversarial error and the standard error, providing theoretical insights into the superiority of AST in GDA. The example of conditional Gaussian distribution is further provided to give additional insights into the efficacy of AT on pseudo-labeled training data.
This work is supported by the National Natural Science Foundation of China under Grant 61976161, the Fundamental Research Funds for the Central Universities under Grant 2042022rc0016.
[1] Samira Abnar, Rianne van den Berg, Golnaz Ghiasi, Mostafa Dehghani, Nal Kalchbrenner, and Hanie Sedghi. Gradual domain adaptation in the wild: When intermediate distributions are absent. arXiv preprint arXiv:2106.06080, 2021.
[2] Jean-Baptiste Alayrac, Jonathan Uesato, Po-Sen Huang, Alhussein Fawzi, Robert Stanforth, and Pushmeet Kohli. Are labels required for improving adversarial robustness? In NeurIPS, pages 12192-12202, 2019.
[3] Jonathan Allcock, Yassine Hamoudi, Antoine Joux, Felix Klingelhöfer, and Miklos Santha. Classical and quantum algorithms for variants of subset-sum via dynamic programming. In European Symposium on Algorithms, pages 6:1-6:18, 2022.
[4] Peter L. Bartlett and Shahar Mendelson. Rademacher and gaussian complexities: Risk bounds and structural results. Journal of Machine Learning Research, 3:463-482, 2002.
[5] Shai Ben-David, John Blitzer, Koby Crammer, Alex Kulesza, Fernando Pereira, and Jennifer Wortman Vaughan. A theory of learning from different domains. Machine Learning, 79:151-175, 2010.
[6] Andreea Bobu, Eric Tzeng, Judy Hoffman, and Trevor Darrell. Adapting to continuously shifting domains. In ICLR, 2018.
[7] Stephen Boyd, Stephen P Boyd, and Lieven Vandenberghe. Convex optimization. Cambridge university press, 2004.
[8] Nicholas Carlini and David A. Wagner. Towards evaluating the robustness of neural networks. In SP, pages 39-57, 2017.
[9] Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C. Duchi, and Percy Liang. Unlabeled data improves adversarial robustness. In NeurIPS, pages 11190-11201, 2019.
[10] Hong-You Chen and Wei-Lun Chao. Gradual domain adaptation without indexed intermediate domains. In NeurIPS, pages 8201–8214, 2021.
[11] Zhen Cui, Wen Li, Dong Xu, Shiguang Shan, Xilin Chen, and Xuelong Li. Flowing on riemannian manifold: Domain adaptation by shifting covariance. IEEE Transactions on Cybernetics, 44:2264-2273, 2014.
[12] Daniel Cullina, Arjun Nitin Bhagoji, and Prateek Mittal. Pac-learning in the presence of adversaries. In NeurIPS, pages 228-239, 2018.
[13] Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research, 9(11), 2008.
[14] Özgür Erkent and Christian Laugier. Semantic segmentation with unsupervised domain adaptation under varying weather conditions for autonomous vehicles. IEEE Robotics and Automation Letters, 5:3580-3587, 2020.
[15] Abolfazl Farahani, Sahar Voghoei, Khaled Rasheed, and Hamid R. Arabnia. A brief review of domain adaptation. arXiv preprint arXiv:2010.03978, 2020.
[16] Ali Farshchian, Juan Alvaro Gallego, Joseph Paul Cohen, Yoshua Bengio, Lee E. Miller, and Sara A. Solla. Adversarial domain adaptation for stable brain-machine interfaces. In ICLR, 2019.
[17] Michael Gadermayr, Dennis Eschweiler, Barbara Mara Klinkhammer, Peter Boor, and Dorit Merhof. Gradual domain adaptation for segmenting whole slide images showing pathological variability. In ICISP, pages 461-469, 2018.
[18] Shiry Ginosar, Kate Rakelly, Sarah Sachs, Brian Yin, Crystal Lee, Philipp Krahenbuhl, and Alexei A. Efros. A century of portraits: A visual historical record of american high school yearbooks. IEEE Transactions on Computational Imaging, 3:421-431, 2017.
[19] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015.
[20] Sven Gowal, Sylvestre-Alvise Rebuffi, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy A. Mann. Improving robustness using generated data. In NeurIPS, pages 4218-4233, 2021.
[21] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, pages 770-778, 2016.
[22] Judy Hoffman, Trevor Darrell, and Kate Saenko. Continuous manifold based adaptation for evolving visual domains. In CVPR, pages 867-874, 2014.
[23] Han-Kai Hsu, Chun-Han Yao, Yi-Hsuan Tsai, Wei-Chih Hung, Hung-Yu Tseng, Maneesh Singh, and Ming-Hsuan Yang. Progressive domain adaptation for object detection. In CVPR, pages 749-757, 2020.