SlowGuess/NeurIPS_2023_OCR huggingface dataset:
DAD is based on adversarial training and uses gradients to find the most diverse and useful data augmentations. To show the importance of using teacher gradients to generate adversarial examples, we implement a sampling-based baseline where we discretize images without the added perturbation. The results in Tab. 11 are significantly worse than DAD, indicating the need to use gradients to discover diverse samples. This is also supported by our theoretical analysis that indicates more diverse adversarial examples are better for robustness. Higher in-distribution performance also suggests the samples are less diverse.
B.3 Transfer to adversarial robustness
Although we center our study on out-of-distribution robustness, it is natural to examine the effect of DAD on adversarial robustness due to the use of adversarial training. In Tab. 12 we attack our trained models with adversarial attacks of various difficulty. We observe a small improvement in adversarial robustness for simpler attacks, but neither DAT or DAD is robust to AutoAttack. This is because the perturbation is discretized and no longer represents the original adversarial example. We observe that DAT is stronger than DAD for ViT-B. Unlike out-of-distribution robustness, since adversarial robustness is based on perturbations generated with gradients from the base model, DAT models are trained on images closer to these perturbations than DAD models (which were trained on perturbations generated with CLIP gradients). However, for ResNet50, DAD is better even for adversarial robustness as distillation is able to help smaller capacity models learn discrete adversarial examples. We also observe higher ResNet50 performance in general in Tab. 1.
We adopt official hyperparameter settings for a fair comparison for our baselines. For knowledge distillation, we use a temperature of  $t = 4$  for all models and  $a = 0.5$ , following [63]. For DAD, we also weight the second KL-divergence term by  $a$ . All ViT models are trained with the AugReg [59] hyperparameter and data augmentation configurations.
Table 12: Comparison of adversarial attack methods. We use pretrained models and attack with FGSM [22], PGD [39], and AutoAttack [9]. Models trained on discretized adversarial examples are somewhat robust but fail on stronger attacks.
Method	FGSM	PGD	AutoAttack
ResNet50	23.5	1.0	0.0
ResNet50 DAT	33.0	5.9	0.0
ResNet50 DAD	43.5	12.6	0.0
ViT-B	49.4	24.7	0.0
ViT-B - DAT	64.9	26.2	0.0
ViT-B - DAD	47.2	25.0	0.0
Following [41], we use the pretrained VQGAN weights from the official GitHub  ${}^{2}$  . The VQGAN with  $\mathrm{f} = 8,\mathrm{\;d} = 4$  and  $\mathrm{K} = {16384}$  is used for main experiments.
We use one iteration for the adversarial attack, and an attack learning rate of 0.1.
For the  $\mathrm{DAT} + \mathrm{DAD}$  variant, we add an additional cross entropy loss term with the student adversarial example to the overall training objective, and weight by  $a$ .
We conduct all of our experiments on 8 32GB NVIDIA V100 GPUs.
D Wasserstein distance comparisons
To justify our theoretical framework and empirical results we investigate the relationship between Wasserstein distance and model performance. We use a pretrained ResNet50 and calculate Wasserstein distance from batch norm statistics on different distributions using 1000 mini-batches. These distributions are data augmentations generated with the respective methods. In 2a we find that DAD tends to have better performance the larger the distribution shift. This is likely due to the help of distillation letting the model learn robust representations. Additionally, in 2b, we find that relative to the Wasserstein distance between clean ImageNet images and a distribution shift and baseline models, our method has higher performance.
(a) The relationship between Wasserstein distance and performance. DAD is the only method that improves performance when the generated data augmentation is more diverse.
(b) The relative relationship between Wasserstein distance and performance to the baseline model. DAD has stronger performance compared to DAT over the standard model.
Proof of Lemma 3.1.
$^{2}$ https://github.com/CompVis/taming-transformers
Proof. Variational divergence  $tv$  measures the divergence between distributions, where  $\mathcal{B}$  is the set of measurable subsets in  $P$  and  $P'$
$$
t v (P, P ^ {\prime}) = 2 \sup _ {B \in \mathcal {B}} \left| \operatorname * {P r} _ {P} [ B ] - \operatorname * {P r} _ {P ^ {\prime}} [ B ] \right|
$$
$$
\begin{array}{l} r \left(P ^ {\prime}\right) = r \left(P ^ {\prime}\right) + r (P) - r (P) \\ \leq r (P) + \left| r \left(P ^ {\prime}\right) - r (P) \right| \\ \leq r (P) + \int | \delta (x) - \delta^ {\prime} (x) | d x \\ \leq r (P) + t v (P, P ^ {\prime}). \\ \end{array}
$$
Following [5] and from Assumption 2, we can bound total variation with Wasserstein's distance. We take  $K: \mathbb{R} \to \mathbb{R}$ , a kernel satisfying a suitable moment condition, so for any coupling of  $P$  and  $P'$ ,
$$
\| K * p - K * p ^ {\prime} \| _ {\epsilon} \leq \sup  _ {s \neq t} \frac {\| T _ {s} (K) - T _ {t} (K) \| _ {r}}{| s - t |} W _ {\epsilon} (P, P ^ {\prime}).
$$
by the Jensen's inequality. Assume that  $p,p^{\prime}\in H_1^\alpha (\mathbb{R})$ . Let  $\{\phi_m\}$  be the orthonormal system in  $L^2 ([-1,1])$  of Legendre polynomials defined by
$$
\phi_ {0} (x) = 2 ^ {- 1 / 2} I (| x | \leq 1), \quad \phi_ {m} (x) = \sqrt {\frac {2 m + 1}{2}} \frac {1}{2 ^ {m} m !} \frac {d ^ {m}}{d x ^ {m}} [ (x ^ {2} - 1) ^ {m} ] I (| x | \leq 1),
$$
for  $x\in \mathbb{R}$  and  $m\in \mathbb{N}$ . Define
$$
K (x) = \sum_ {m = 0} ^ {\alpha} \phi_ {m} (0) \phi_ {m} (x).
$$
Then, by Propositions 4.1.5 and 4.1.6 of [19],
$$
\| K h * p - p \| _ {1} \preceq \| p \| ^ {H _ {1} ^ {\alpha}} h ^ {\alpha} \quad \text {a n d} \quad \| K h * p ^ {\prime} - p ^ {\prime} \| _ {1} \preceq \| p ^ {\prime} \| ^ {H _ {1} ^ {\alpha}} h ^ {\alpha}.
$$
Since  $\max_{x\in [-1,1]}(|\phi_m(x)|\vee |\phi_m'(x)|)$  is bounded by a constant depending only on  $m$ , where  $\phi_m^\prime$  is the derivative of  $\phi_{m}$  and  $a\lor b$  is the maximum of  $a$  and  $b$ ,
$$
\begin{array}{l} \left\| T _ {s} \left(\phi_ {m}\right) - T _ {t} \left(\phi_ {m}\right) \right\| _ {1} = \int \left| \phi_ {m} (x - s) - \phi_ {m} (x - t) \right| d x \\ \leq \int_ {\{| x - s | \vee | x - t | \leq 1 \}} | \phi_ {m} (x - s) - \phi_ {m} (x - t) | d x + 2 | s - t | \max  _ {x \in [ - 1, 1 ]} | \phi_ {m} (x) | \\ \leq 4 | s - t | \max  _ {x \in [ - 1, 1 ]} | \phi_ {m} ^ {\prime} (x) | + 2 | s - t | \max  _ {x \in [ - 1, 1 ]} | \phi_ {m} (x) | \\ \preccurlyeq | s - t |. \\ \end{array}
$$
$$
\| T _ {s} (K h) - T _ {t} (K h) \| _ {1} \leq \frac {1}{h} \sum_ {m = 0} ^ {\alpha} \phi_ {m} (0) \int \left| \phi_ {m} \left(\frac {x - s}{h}\right) - \phi_ {m} \left(\frac {x - t}{h}\right) \right| d x \preccurlyeq \frac {| s - t |}{h},
$$
where  $\phi_m(0)$  and  $\alpha$  depends only on  $\alpha$ . By the triangle inequality, we have
$$
\begin{array}{l} \left\| p - p ^ {\prime} \right\| _ {1} \leq \left\| p - K h * p \right\| _ {1} + \left\| K h * p - K h * p ^ {\prime} \right\| _ {1} + \left\| K h * p ^ {\prime} - p ^ {\prime} \right\| _ {1} \\ \preccurlyeq \| p \| ^ {H _ {1} ^ {\alpha}} h ^ {\alpha} + \frac {W _ {1} (P , P ^ {\prime})}{h} + \| p ^ {\prime} \| ^ {H _ {1} ^ {\alpha}} h ^ {\alpha}. \\ \end{array}
$$
If we take
$$
h = \left(\frac {W _ {1} (P , P ^ {\prime})}{\| p \| ^ {H _ {1} ^ {\alpha}} + \| p ^ {\prime} \| ^ {H _ {1} ^ {\alpha}}}\right) ^ {1 / (\alpha + 1)},
$$
the proof is complete.
Proof of Lemma 3.3.
Proof. Let  $(Z, d_Z)$  be a metric space where  $Z = X \times Y$  and  $d_Z$  is defined as:
$$
d _ {Z} (z, z _ {0}) = d _ {Z} ((x, y), (x _ {0}, y _ {0})) = \left(d _ {X} (x, x _ {0}) + d _ {Y} (y, y _ {0})\right)
$$
where  $d_{X}$  and  $d_{Y}$  represent the metric in the feature space and label space, respectively. Then we can define the Wasserstein distance between  $P$  and  $P^{*}$ ,
$$
W _ {p} (P, P ^ {*}) := \inf  _ {M \in \Gamma (P, P ^ {*})} \mathbb {E} _ {(z, z _ {0}) \sim M} [ d _ {Z} (z, z _ {0}) ],
$$
where  $\Gamma(P, P^{*})$  denotes the collection of all measures on  $Z \times Z$  with marginals  $P$  and  $P^{*}$  on the first and second factors, respectively.
Following [65], we use the minimax approach, considering the worse-case  $P^*$  in the Wasserstein ball  $\mathcal{B}_{\varepsilon}^{w_p}$  of radius  $\varepsilon$  centered around  $P$  where
$$
\mathcal {B} _ {\varepsilon} ^ {w _ {p}} (P) = \left\{P ^ {*}: w _ {p} (P, P ^ {*}) \leq \varepsilon \right\}
$$
Next we define a transport map  $T: Z \to Z$  to push  $P$  to  $P^*$  as follows:
$$
z = (x, y) \mapsto (x ^ {*}, y)
$$
where  $x^{*} = \arg \max_{x_{0}\in P^{*}}l(\theta (x_{0}),y)$ . By the definition of  $d_Z$ ,  $d_Z((x,y),(x^*,y)) = d_X(x,x^*)$ .
Finally, let  $P^{*} = T_{\theta}\# P$ , the pushforward of  $P$  by  $T_{\theta}$ , then we have  $R(P,\epsilon) = R(P^{*})$ . By the definition, we have
$$
\begin{array}{l} R (P, \epsilon) = \mathbb {E} _ {(x, y) \sim P} [ \max  l (\theta (x _ {0}), y) ] \\ = \mathbb {E} _ {(x, y) \sim P} [ l (\theta (x ^ {*}), y) ] \\ = \mathbb {E} _ {(x, y) \sim P ^ {*}} [ l (\theta (x), y) ]. \\ \end{array}
$$
Therefore,  $r(P,\epsilon) = r(P^{*})$ . This lets us establish upper bound on the worst-case in the Wasserstein ball and bound the adversarial expected risk. Next we define the radius of the adversary constrained by  $B$  as  $\varepsilon_{B} \coloneqq \sup_{x \in B} d_{X}(x,0)$ . For any hypothesis  $h$  and the corresponding  $P^{*} = T_{\theta} \# P$ , we have  $w(P,P^{*}) \leq \varepsilon_{B}$ . By the definition of the Wasserstein distance, we have
$$
\begin{array}{l} w (P, P ^ {*}) \leq \mathbb {E} _ {P} [ d _ {Z} (Z, T _ {\theta} (Z)) ] \\ = \mathbb {E} _ {P} \left[ d _ {X} \left(x, x ^ {*}\right) \right] \\ \leq (\varepsilon_ {B}), \\ \end{array}
$$
where the last inequality uses the translation invariant property of  $d_X$ . Therefore, we have
$$
w (P, P ^ {*}) \leq \varepsilon_ {B}.
$$
Proof of Lemma 3.4
Proof. We use  $P$  to denote the (at least) one distribution in the intersection of  $\mathbf{P}_1$  and  $\mathbf{P}_2$ .
$$
\begin{array}{l} \mathbb {E} _ {\hat {P}} \left[ w (D (\phi (\mathbf {P} _ {1})), P ^ {\prime}) - w (D (\phi (P)), P ^ {\prime}) \right] \\ \leq \mathbb {E} _ {\hat {P}} \left[ w \left(\mathbf {P} _ {1}, P _ {1}\right) + w \left(\mathbf {P} _ {1}, P ^ {\prime}\right) \right] - \mathbb {E} _ {\hat {P}} \left[ w \left(P, P _ {2}\right) - w \left(P, P ^ {\prime}\right) \right] \\ = \mathbb {E} _ {\hat {P}} \left[ w \left(\mathbf {P} _ {1}, P _ {1}\right) - w (P, P _ {2}) \right] + \mathbb {E} _ {\hat {P}} w \left(\mathbf {P} _ {1}, P ^ {\prime}\right) + w (P, P ^ {\prime}) \\ = \mathbb {E} _ {\hat {P}} \left[ \sup  _ {P \in \mathbf {P}} r _ {\text {w o r s t}} (P, \epsilon) - r _ {\text {w o r s t}} (P, \epsilon) \right] + \mathbb {E} _ {\hat {P}} w (\mathbf {P}, P ^ {\prime}) + w (P, P ^ {\prime}) \\ \leq \sup  _ {P \in \mathbf {P} _ {1}} r _ {\text {w o r s t}} (P, \epsilon) - r _ {\text {w o r s t}} (P, \epsilon) + \mathbb {E} _ {\hat {P}} \sup  _ {P \in \mathbf {P}} w (P, P ^ {\prime}) + w (P, P ^ {\prime}) \\ = 2\mathbb{E}_{\hat{P}}\sup_{P\in \mathbf{P}_{1}}w(P,P^{\prime}) + c, \\ \end{array}
$$
where  $c$  is a positive constant.
Similarly, we can have
$$
\mathbb {E} _ {\hat {P}} \big [ w (D (\phi (\mathbf {P} _ {2})), P ^ {\prime}) - w (D (\phi (P)), P ^ {\prime}) \big ] \geq c - 2 \mathbb {E} _ {\hat {P}} \sup  _ {P \in \mathbf {P} _ {2}} w (P, P ^ {\prime}).
$$
F Visualizations
Figure 3: Additional visualizations of generated images. To highlight the difference, we use adversarial examples that are classified differently by the base model. Using CLIP in DAD results in a more diverse adversarial example than a vanilla ResNet50. Adversarial examples in pixel-space are imperceptible.