SlowGuess/NeurIPS_2023_OCR huggingface dataset:
SVHN Settings and Results. For experiments on SVHN, we use the cyclical learning rate schedule with 15 epochs that reaches its maximum learning rate (0.05) when  $40\%$  (6) epochs are passed. In the meantime, we uniformly increase the step size between 0 and 5 epochs, which follow the settings of [6]. We show the hyperparameters setting on SVHN in Table 12. In Table 13, we present the performance of AAER on the SVHN dataset, along with the results of the competing baseline taken from [6]. It is evident that our method can successfully prevent CO and improve robust accuracy across different noise magnitudes. This demonstrates the effectiveness of AAER in enhancing the robustness of models trained on the SVHN dataset.
Table 12. SVHN: The hyperparameters setting for different noise magnitudes. The top number is  $\lambda_{2}$  while the bottom number is  $\lambda_{3}$ . The  $\lambda_{1}$  is fixed as 1.0 in all settings.
SVHN	4/255	8/255	12/255
RS-AAER	0.5	0.6	0.45
1.25	0.85	0.55
N-AAER	0.75	1.0	1.0
0.25	1.0	0.75
Tiny-ImageNet Settings and Results. We also scale our method to a medium-sized dataset TinyImageNet to showcase its effectiveness. We utilized the cyclical learning rate schedule with 30 epochs, reaching the maximum learning rate of 0.2 at the midpoint of 15 epochs. For RS-AAER, we set  $\lambda_{2} = 0.75$  and  $\lambda_{3} = 0.15$ , while for N-AAER, we set  $\lambda_{2} = 0.25$  and  $\lambda_{3} = 0.05$ . The value of  $\lambda_{1}$  remained fixed at 1.0 in all settings. Table 14 presents the performance of AAER on the Tiny-ImageNet dataset. We can observe that our method effectively prevents CO and improves robust accuracy in this medium-scale dataset.
Table 13. SVHN: Accuracy of different methods and different noise magnitudes using PreActResNet-18 under  $L_{\infty}$  threat model. The baseline results are taken from [6]. The top number is the natural accuracy (\%), while the bottom number is the PGD-50-10 accuracy (\%). The results are averaged over 3 random seeds and reported with the standard deviation.
noise magnitude	4/255	8/255	12/255
FreeAT	93.66 ± 0.12	91.29 ± 4.07	92.36 ± 1.00
71.61 ± 0.75	0.01 ± 0.00	0.00 ± 0.00
ZeroGrad	94.81 ± 0.16	92.42 ± 1.29	88.09 ± 0.40
71.59 ± 0.22	35.93 ± 2.73	14.14 ± 0.32
MultiGrad	94.71 ± 0.17	94.86 ± 0.97	94.48 ± 0.19
71.98 ± 0.26	11.49 ± 16.19	0.00 ± 0.00
Grad Align	94.56 ± 0.21	90.1 ± 0.34	84.01 ± 0.46
72.12 ± 0.19	43.85 ± 0.14	23.62 ± 0.41
RS-FGSM	95.09 ± 0.09	94.46 ± 0.16	92.74 ± 0.5
71.28 ± 0.40	0.00 ± 0.00	0.00 ± 0.00
N-FGSM	94.54 ± 0.15	89.56 ± 0.49	81.48 ± 1.64
72.53 ± 0.19	45.63 ± 0.11	26.13 ± 0.81
RS-AAER	94.99 ± 0.70	90.11 ± 0.85	83.50 ± 4.13
71.97 ± 0.88	41.75 ± 0.55	22.84 ± 0.51
N-AAER	94.35 ± 0.26	89.26 ± 0.57	82.76 ± 0.84
73.10 ± 0.23	46.98 ± 0.25	26.87 ± 1.51
PGD-2	94.66 ± 0.10	94.63 ± 1.29	94.16 ± 0.54
73.29 ± 0.29	20.68 ± 18.56	0.02 ± 0.03
PGD-10	94.37 ± 0.13	89.67 ± 0.34	80.08 ± 0.93
74.76 ± 0.19	53.95 ± 0.55	37.65 ± 0.53
Table 14. Tiny-ImageNet: Accuracy of different methods with 8/255 noise magnitude using PreActResNet-18 under  $L_{\infty}$  threat model. The results are averaged over 3 random seeds and reported with the standard deviation.
method	RS-FGSM	N-FGSM	RS-AAER	N-AAER	PGD-2
natural accuracy (%)	52.28 ± 2.64	48.16 ± 0.61	49.86 ± 0.39	47.93 ± 0.27	46.43 ± 0.35
robust accuracy (%)	0.00 ± 0.00	20.73 ± 0.40	19.66 ± 0.14	20.92 ± 0.01	20.72 ± 0.32
Table 15. ImageNet-100: Accuracy of different methods with 8/255 noise magnitude using PreActResNet-18 under  $L_{\infty}$  threat model. The results are averaged over 3 random seeds and reported with the standard deviation.
method	RS-FGSM	N-FGSM	RS-AAER	N-AAER
natural accuracy (%)	27.10 ± 11.44	38.87 ± 0.17	32.28 ± 1.52	39.52 ± 0.42
robust accuracy (%)	0.00 ± 0.00	20.71 ± 0.74	14.22 ± 0.96	20.90 ± 0.34
ImageNet-100 Settings and Results. We have also extended our method to a large-sized dataset, ImageNet-100, to demonstrate its effectiveness. We utilized the cyclical learning rate schedule with 30 epochs, reaching the maximum learning rate of 0.2 at the midpoint of 15 epochs. For RS-AAER, we set  $\lambda_{2} = 3.0$  and  $\lambda_{3} = 2.5$ , while for N-AAER, we set  $\lambda_{2} = 1.25$  and  $\lambda_{3} = 0.25$ . The value of  $\lambda_{1}$  remained fixed at 1.0 in all settings. From Table 15, it is evident that our method effectively prevents CO and enhances robust accuracy in this large-scale dataset. It needs to be highlighted that the results in the above table may not be optimal, which can be further improved by increasing training epochs or adjusting hyperparameters and learning rate. However, they do establish the effectiveness of our method in trustworthy eliminating CO on a larger-scale dataset. The above outcomes underscore the scalability and effectiveness of AAER in fortifying the robustness of models trained.
F More Competing Baselines
We also compare the performance of our method with other SSAT methods, including GAT [33], NuAT [34], PGI-FGSM [17], SDI-FGSM [18] and Kim [21]. The results for GAT, NuAT and Kim are directly taken from [6], while the reported PGI-FGSM and SDI-FGSM results are based on the official code after searching the hyperparameters across different noise magnitudes.
Table 16. CIFAR10: Accuracy of different methods and different noise magnitudes using PreActResNet-18 under  $L_{\infty}$  threat model. GAT, NuAT and Kim results are taken from [6]. The top number is the natural accuracy (\%), while the bottom number is the PGD-50-10 accuracy (\%). The results are averaged over 3 random seeds and reported with the standard deviation.
noise magnitude	8/255	12/255	16/255
GAT	76.75 ± 0.38	80.44 ± 5.08	82.17 ± 2.47
50.98 ± 0.12	14.93 ± 9.26	1.25 ± 0.51
NuAT	73.22 ± 0.34	74.38 ± 7.32	80.1 ± 1.08
50.10 ± 0.33	17.54 ± 8.82	3.29 ± 0.87
PGI-FGSM	77.94 ± 0.26	83.82 ± 0.86	83.42 ± 0.24
52.86 ± 0.34	5.19 ± 0.59	4.16 ± 0.31
SDI-FGSM	79.28 ± 0.08	70.07 ± 0.84	81.09 ± 0.13
49.26 ± 0.10	36.56 ± 1.34	0.05 ± 0.01
Kim	89.02 ± 0.10	88.35 ± 0.31	90.45 ± 0.08
33.01 ± 0.09	13.11 ± 0.63	1.88 ± 0.05
RS-AAER	83.83 ± 0.27	74.40 ± 0.79	64.56 ± 1.45
46.14 ± 0.02	32.17 ± 0.16	23.87 ± 0.36
N-AAER	80.56 ± 0.35	71.15 ± 0.18	61.84 ± 0.43
48.31 ± 0.23	36.52 ± 0.10	28.20 ± 0.71
In Table 16, we can observe that GAT, NuAT, PGI-FGSM and SDI-FGSM demonstrate superior performance under 8/255 noise magnitude. However, it becomes apparent that these methods still suffer from CO with strong adversaries, resulting in nearly zero robustness under 16/255 noise magnitude, let alone the more challenging 32/255. In contrast, our proposed method exhibits consistent effects across different settings with negligible computational overhead, demonstrating its trustworthy effectiveness in preventing CO. We would like to emphasize that while achieving excellent performance under 8/255 noise magnitude is certainly gratifying, but can reliable defence against CO is more critical to a successful SSAT method.
G Long Training Schedule
We also compare the performance of our method using the standard robust overfitting training schedule. This training schedule consists of 200 epochs with an initial learning rate of 0.1. The learning rate is divided by 10 at the 100th and 150th epochs, respectively. During the long training
schedule, we employ a warm-up strategy in the first 20 epochs, which uniformly rises the strength of AAER from  $0\%$  to  $100\%$ .
Table 17. CIFAR10: Accuracy of long training schedule with 8/255 noise magnitude using PreActResNet-18 under  $L_{\infty}$  threat model. The results are averaged over 3 random seeds and reported with the standard deviation.
method	RS-FGSM	N-FGSM	RS-AAER	N-AAER
natural accuracy (%)	91.21 ± 0.26	83.25 ± 0.04	85.69 ± 0.20	83.23 ± 0.25
robust accuracy (%)	0.00 ± 0.00	36.98 ± 0.34	36.05 ± 0.17	37.38 ± 0.16
In Table 17, we observe that our method, AAER, consistently improves adversarial robustness under the long training schedule, underscoring its consistently reliable and effective performance in preventing CO.