SlowGuess/NeurIPS_2023_OCR huggingface dataset:
(b) test
Figure 14: Training and test robust accuracy of PGD-AT and ReBAT on CIFAR-10 under the perturbation norm  $\varepsilon_{\infty} = 8 / 255$  based on the PreActResNet-18 architecture. The gray dashed lines in (a) indicate LR decays, and the colored dashed lines in (b) indicate the epochs where each method attains its best robustness, respectively.
Table 5: Combining training time per epoch on CIFAR-10 under the perturbation norm  $\varepsilon_{\infty} = 8 / 255$  based on the PreActResNet-18 architecture.
Method	Training Time per Epoch (s)
PGD-AT	131.6
WA	132.1
KD+SWA	131.6+16.5+141.7
AWP	142.8
MLCATwp	353.3
ReBAT	136.2
WA+CutMix	168.6
ReBAT+CutMix	173.1
method does not need early stopping techniques (almost no robust overfitting), and have negligible computation overhead per epoch, the total training time is comparable with vanilla AT. We also remark that  $\mathrm{KD + SWA}$ , one of the most competitive methods that aims to address the RO issue, is not really computationally efficient as it requires to pretrain a robust classifier and a non-robust one as AT teacher and ST teacher respectively.
D More Experiments on ReBAT
In this section, we conduct extensional experiments on the proposed ReBAT method to further demonstrate its effectiveness, efficiency and flexibility.
D.1 Additional Results on BoAT Loss
In Section C.4, we discuss the detailed configurations for the experiments in Figure 6a, where we show that BoAT can largely mitigate robust overfitting. Here, we further summarize the performance of best and final checkpoints of the original  $\mathrm{AT + WA}$  method and our BoAT. As shown in Table 6, BoAT not only boosts the best robustness by a large margin (0.67% higher against AA) but also significantly suppresses RO (1.58% v.s. 6.06% against AA). To achieve the reported robustness, we first use  $\lambda_{1} = 10.0$  after the first LR decay and then apply  $\lambda_{2} = 60.0$  after the second LR decay to better maintain the flatness of adversarial loss landscape and control robust overfitting.
D.2 Additional Results on the Effect of LR decay
Below we show that when a relatively large decay factor  $d$  is applied, i.e., the model has overly strong fitting ability that results in robust overfitting, a large regularization coefficient  $\lambda$  should be chosen
Table 6: Comparing model robustness w/ and w/o BoAT loss on CIFAR-10 under the perturbation norm  $\varepsilon_{\infty} = 8 / 255$  based on the PreActResNet-18 architecture.
Method	Natural	PGD-20	AutoAttack
best	final	diff	best	final	diff	best	final	diff
AT+WA	83.50	84.94	-1.44	55.05	47.60	7.45	49.89	43.83	6.06
ReBAT(d=10)	81.54	82.42	-0.88	55.29	53.43	1.86	50.56	48.98	1.58
for better performance. Table 7 reveals this relationship between  $d$  and  $\lambda$ . When  $d = 1.3$ , even a  $\lambda$  as small as 1.0 will harm both the best and last robustness as well as natural accuracy, as  $d = 1.3$  is already too small a decay factor that makes the model suffering from underfitting and naturally requiring no more flatness regularization. On the other side, when  $d$  is relatively large, even a strong regularization of  $\lambda = 4.0$  is not adequate to fully suppress RO. Besides, comparing the situation of  $\lambda > 0$  and  $\lambda = 0$  for a fixed  $d(\geq 1.5)$ , we emphasize that the purported BoAT loss again exhibits its apparent effectiveness in simultaneously boosting the best robustness and mitigating RO.
Table 7: Changing decay factor  $d$  and regularization strength  $\lambda$  and evaluating model robustness on CIFAR-10 under the perturbation norm  $\varepsilon_{\infty} = 8 / 255$  based on the PreActResNet-18 architecture.
Method	Natural	PGD-20	AutoAttack
best	final	diff	best	final	diff	best	final	diff
ReBAT(d=1.3,λ=0.0)	81.17	81.27	-0.10	56.43	56.23	0.20	50.80	50.75	0.05
ReBAT(d=1.3,λ=1.0)	80.67	80.63	0.04	56.27	56.15	0.12	50.74	50.65	0.09
ReBAT(d=1.3,λ=4.0)	78.50	78.36	0.14	55.10	55.04	0.06	50.31	50.30	0.01
ReBAT(d=1.5,λ=0.0)	81.90	82.39	-0.49	56.21	55.95	0.26	50.81	50.58	0.23
ReBAT(d=1.5,λ=1.0)	81.86	81.91	-0.05	56.36	56.12	0.24	51.13	51.22	-0.09
ReBAT(d=1.5,λ=4.0)	79.68	79.88	-0.20	55.72	55.65	0.07	50.52	50.50	0.02
ReBAT(d=4.0,λ=0.0)	83.05	85.38	-2.33	55.98	50.87	5.11	50.38	46.95	3.43
ReBAT(d=4.0,λ=1.0)	82.46	84.84	-2.38	55.86	52.02	3.84	50.87	47.88	2.99
ReBAT(d=4.0,λ=4.0)	80.99	84.07	-3.08	56.06	53.58	2.48	51.00	49.02	1.98
D.3 Additional Results on Adopting Stronger Training Time Attacker
In Section 4.3, we design two versions of ReBAT, and we name the stronger one that also uses a stronger training attacker as  $\mathrm{ReBAT}++$ . Here we fix the hyperparameter used in ReBAT above (note that we use a larger LR decay factor  $d = 1.7$  in  $\mathrm{ReBAT}++$  for CIFAR-10, and now we still use  $d = 1.5$  as in ReBAT) and adjust the attacker strength to study its influence when combined with ReBAT. According to Figure 15, though a slightly stronger attack (e.g.,  $\varepsilon = 9/255$ ) may marginally improves the best and last robust accuracy, it heavily degrades natural accuracy, particularly when much stronger attack is used. We deem that this is because it breaks the balance from the other side that the overly strong attacker  $\mathcal{A}$  dominates the adversarial game and results in an underfitting state that harms both robust and natural accuracy.
D.4 Further Improving Natural Accuracy with Knowledge Distillation
Chen et al. [8] propose to adopt knowledge distillation (KD) [18] to mitigate RO and it is worth mentioning that their method achieves relatively good natural accuracy according to Table 1 and 2. Since our ReBAT method is orthogonal to KD, we propose to combine our techniques with KD to further improve natural accuracy. Specifically, we simplify their method by using only a non-robust standard classifier as a teacher (ST teacher) instead of using both a ST teacher and a AT teacher, because i) a large sum of computational cost for training the AT teacher will be saved, ii) our main goal is to improve natural accuracy so the ST teacher matters more and iii) ReBAT already use the WA model as a very good teacher. This gives the final loss function as
$$
\ell_ {\mathrm {R e B A T} + \mathrm {K D}} (x, y; \theta) = \left(1 - \lambda_ {\mathrm {S T}}\right) \cdot \ell_ {\mathrm {B o A T}} (x, y; \theta) + \lambda_ {\mathrm {S T}} \cdot \mathrm {K L} \left(f _ {\theta} (x) \| f _ {\mathrm {S T}} (x)\right), \tag {5}
$$
where  $f_{\mathrm{ST}}$  indicates the ST teacher and  $\lambda_{\mathrm{ST}}$  is a trade-off parameter.
Figure 15: Using different adversarial attack strength in ReBAT.
Table 8: Combining our methods with knowledge distillation and evaluating model robustness on CIFAR-10 under the perturbation norm  $\varepsilon_{\infty} = 8 / 255$  based on the PreActResNet-18 architecture.
Method	Natural	PGD-20	AutoAttack
best	final	diff	best	final	diff	best	final	diff
ReBAT (λST = 0.0)	81.86	81.91	-0.05	56.36	56.12	0.24	51.13	51.22	-0.09
ReBAT+KD (λST = 0.4)	83.59	83.64	-0.05	54.91	54.77	-0.14	50.70	50.99	-0.29
ReBAT+KD (λST = 0.5)	84.12	84.20	-0.08	55.28	55.39	-0.11	50.47	50.72	-0.25
ReBAT+KD (λST = 0.6)	84.34	84.72	-0.38	53.83	54.30	-0.47	50.15	50.37	-0.22
Table 8 compares the performance of ReBAT+KD when different  $\lambda_{\mathrm{ST}}$  is applied, and clearly a large  $\lambda_{\mathrm{ST}}$  results in improvement in natural accuracy and decreases robustness (may due to the theoretically principled trade-off between natural accuracy and robustness [59]). However, it is still noteworthy that when  $\lambda_{\mathrm{ST}} = 0.4$ , a notable increase in natural accuracy ( $\sim 1.7\%$ ) is achieved at the cost of only a small slide of  $\sim 0.2\%$  in final robustness against AA. Also when  $\lambda_{\mathrm{ST}} = 0.5$ , it achieves comparable natural accuracy with KD+SWA [8] but has much higher AA robustness. Moreover, we emphasize that RO is almost completely eliminated regardless of the trade-off, which is the main concern of this paper and demonstrates the superiority of our method against previous ones. An intriguing phenomenon is that nearly all the final results are better than the results on the best checkpoints selected by the validation set, which implies that in this training scheme AT enjoys the same property of "training longer, generalize better" as ST without any need of early stopping.
D.5 The Effect of Different Learning Rate Schedules
In the previous experiments we only investigate the piecewise LR decay schedule. However, a natural idea would be using mild LR decay schedules, e.g., Cosine and Linear decay schedule, instead of suddenly decaying it by a factor of  $d$  at some epoch in the piecewise decay schedule. As mentioned in Section 6, previous works have shown that changing LR decay schedule fails to effectively suppress RO whether with [45] or without WA [38] because the LR finally becomes small and endows the trainer with overly strong fitting ability. Therefore, here we continue to experiment with modified Cosine and Linear decay schedules that follow a similar LR scale of the piecewise LR decay schedule, and summarise the results in Table 9. To be specific, the LR still decays to 0.01 at epoch 150 and 0.001 at epoch 200, though the two decay stages (from epoch 100 to 150 and 150 to 200) are designed to be gradual following the Cosine/Linear schedule. We also gradually increase the strength of ReBAT regularization from zero as the LR gradually decreases, following the "larger decay factor goes with stronger ReBAT regularization" principle that we introduced in Appendix D.2.
It can be concluded from Table 9 that simply changing the LR decay schedule indeed improves the best robust accuracy from  $49.89\%$  to  $50.59\%$  and  $50.67\%$  against AA respectively, but it provides no help at all in mitigating RO as the final robust accuracy is still below  $45\%$  against AA. We also note that in this situation, the application of BoAT loss not only significantly mitigates RO but also further improves the best model robustness, which also proves its effectiveness.
Table 9: Comparing our method with WA on CIFAR-10 under the perturbation norm  $\varepsilon_{\infty} = 8 / 255$  based on PreActResNet-18 architecture, when Cosine/Linear LR decay schedule are applied.
Method	Cosine	Linear
Natural	PGD-20	AutoAttack	Natural	PGD-20	AutoAttack
best	final	best	final	best	final	best	final	best	final	best	final
WA(d=10)	82.32	84.99	55.97	47.84	50.59	44.08	82.21	85.01	56.21	48.10	50.67	44.63
ReBAT(d=10)	82.06	82.22	56.12	54.44	50.98	49.81	81.98	82.13	56.33	54.50	51.08	49.63
D.6 Results on Different Network Architectures
In previous experiments we compare methods based on PreActResNet-18 and WideResNet-34-10 architecture, and here we also adopt VGG-16 [41] and MobileNetV2 [39] architecture. The significant improvement against baseline PGD-AT in both best and final robust accuracy and in mitigating RO reported in Table 10 further demonstrates that our method works on a wide range of network architectures.
Table 10: Comparing our method with PGD-AT on CIFAR-10 under the perturbation norm  $\varepsilon_{\infty} = 8/255$  based on VGG-16 and MobileNetV2 architecture.
Method	VGG-16	MobileNetV2
Natural	PGD-20	AutoAttack	Natural	PGD-20	AutoAttack
best	final	best	final	best	final	best	final	best	final	best	final
PGD-AT	78.43	81.64	50.56	44.25	44.19	39.66	79.85	80.67	51.56	50.67	46.01	45.27
ReBAT	78.17	78.37	53.13	53.01	47.24	47.13	78.98	80.81	53.18	52.57	47.66	47.35