SlowGuess/NeurIPS_2023_OCR huggingface dataset:
$$
\min  _ {\mathbf {w}} \quad P (\mathbf {w}) + \lambda R (\mathbf {w}, \delta , \mathcal {D})
$$
$$
\max  _ {\| \delta_ {i} \| \leq \epsilon} \quad \sum_ {i = 1} ^ {n} G (\mathbf {w}, \mathbf {x} _ {i} + \delta_ {i}, y _ {i}), \tag {9}
$$
where the attacks are pointwise attacks generated for individual examples separately, e.g., FGSM, PGD. We refer to the above method as AdAP_LN. Finally, we experiment with another method by adding a pointwise regularization into the objective for optimizing the model parameter  $\mathbf{w}$ , i.e.,
$$
\min  _ {\mathbf {w}} \quad P (\mathbf {w}) + \lambda \left(R (\mathbf {w}, \delta , \mathcal {D}) + \frac {1}{n} \sum_ {i = 1} ^ {n} L \left(h _ {\mathbf {w}} \left(\mathbf {x} _ {i}\right), h _ {\mathbf {w}} \left(\mathbf {x} _ {i} + \delta_ {i}\right)\right)\right) \tag {10}
$$
This method referred to as AdAP_LPN imposes a stronger adversarial regularization on the model.
Algorithm 1 Stochastic Algorithm for Solving AdAP_LN in (9)
1: Initialize  $\mathbf{w},\mathbf{u}_{\mathbf{x}}^{1},\mathbf{u}_{\mathbf{x}}^{2},\mathbf{u},\gamma_{1},\gamma_{2}$    
2: for  $t = 1,\dots ,T$  do   
3: Draw a batch of  $B_{+}$  positive samples denoted by  $\mathcal{B}_+$    
4: Draw a batch of  $B$  samples denoted by  $\mathcal{B}$    
5: for  $\mathbf{x}_i\in \mathcal{B}$  do   
6: Initialize  $\delta_i\sim \alpha \cdot \mathcal{N}(0,1)$    
7: for  $m = 1,\ldots ,M$  do   
8: Update  $\delta_{i} = \Pi_{\parallel \cdot \parallel \leq \epsilon}(\delta_{i} + \eta_{2}\cdot sign(\nabla_{\delta_{i}}G(\mathbf{w}_{t},\mathbf{x}_{i} + \delta_{i},y_{i})))$  , where  $\Pi_{\Omega}(\cdot)$  is the projection operator.   
9: end for   
10: end for   
11: For each  $\mathbf{x}_i\in \mathcal{B}_+$  , update  $\mathbf{u}_{\mathbf{x}_i}^1$  and  $\mathbf{u}_{\mathbf{x}_i}^2$  by Equation (2)   
12: Update u by Equation (11) and compute  $\widehat{\nabla}_{\mathbf{w}_t}R(\mathbf{w}_t,\delta ,\mathcal{D})$  by Equation (12)   
13: Compute stochastic gradient estimator  $\nabla_{\mathbf{w}_t} = \widehat{\nabla}_{\mathbf{w}_t}P(\mathbf{w}_t) + \lambda \widehat{\nabla}_{\mathbf{w}_t}R(\mathbf{w}_t,\delta ,\mathcal{D})$    
14: Update  $\mathbf{w}_{t + 1}$  by using SGD, momentum-methods or Adam.   
15: end for
4.2 Algorithms for Adversarial AP Maximization
Below, we will discuss efficient algorithms for adversarial AP maximization employing different objectives. Due to limit of space, we focus attention on solving (9). Equal efforts have been spent on solving other AdAP formulations with algorithms presented in the appendix.
Since there are two players one for minimizing over  $\mathbf{w}$  and one for maximizing over  $\delta$ , we adopt the alternating optimization framework that first optimizes  $\delta$  for generating attacks of sampled data and then optimizes for  $\mathbf{w}$  based on the sampled clean data and perturbed data. The optimization for  $\delta$  is following the existing methods in the literature. We use the PGD method for illustration purpose. The major technical challenge lies at computing a gradient estimator of the listwise regularization  $R(\mathbf{w},\delta,\mathcal{D})$  in terms of  $\mathbf{w}$ . We consider  $\delta$  to be fixed and rewrite  $R(\mathbf{w},\delta,\mathcal{D})$  as:
$$
\frac {\sum_ {i = 1} ^ {n} \exp (h (\mathbf {x} _ {i})) (h (\mathbf {x} _ {i}) - h (\mathbf {x} _ {i} + \delta_ {i}))}{\sum_ {j = 1} ^ {n} \exp (h (\mathbf {x} _ {j}))} - \log \sum_ {j = 1} ^ {n} \exp (h (\mathbf {x} _ {j})) + \log \sum_ {j = 1} ^ {n} \exp (h (\mathbf {x} _ {j} + \delta_ {j})).
$$
Note that calculating the gradient of  $R(\mathbf{w}, \delta, \mathcal{D})$  in terms of  $\mathbf{w}$  directly, which includes the prediction scores of all samples, is not feasible. To tackle this challenge, we cast  $R(\mathbf{w}, \delta, \mathcal{D})$  into a compositional function and borrow the technique of stochastic compositional optimization. To this end, we define:
$$
\begin{array}{l} g (\mathbf {w}) = \left[ g _ {1} (\mathbf {w}), g _ {2} (\mathbf {w}), g _ {3} (\mathbf {w}) \right] ^ {\top} \\ = \left[ \frac {1}{n} \sum_ {i = 1} ^ {n} \exp (h (\mathbf {x} _ {i})) (h (\mathbf {x} _ {i}) - h (\mathbf {x} _ {i} + \delta_ {i})), \frac {1}{n} \sum_ {i = 1} ^ {n} \exp (h (\mathbf {x} _ {i})), \frac {1}{n} \sum_ {i = 1} ^ {n} \exp (h (\mathbf {x} _ {i} + \delta_ {i})) \right] ^ {\top}. \\ \end{array}
$$
Let  $F(g) = \frac{g_1}{g_2} - \log g_2 + \log g_3$ . Then we write  $R(\mathbf{w}, \delta, \mathcal{D}) = F(g(\mathbf{w})) = \frac{g_1(\mathbf{w})}{g_2(\mathbf{w})} - \log g_2(\mathbf{w}) + \log g_3(\mathbf{w})$ . The gradient of  $R(\mathbf{w}; \delta, \mathcal{D})$  is given by:
$$
\nabla_ {\mathbf {w}} R (\mathbf {w}, \delta , \mathcal {D}) = \nabla_ {\mathbf {w}} g (\mathbf {w}) ^ {\top} \nabla F (g (\mathbf {w})) = \nabla_ {\mathbf {w}} g (\mathbf {w}) ^ {\top} \left(\frac {1}{g _ {2} (\mathbf {w})}, \frac {- g _ {1} (\mathbf {w}) - g _ {2} (\mathbf {w})}{(g _ {2} (\mathbf {w})) ^ {2}}, \frac {1}{g _ {3} (\mathbf {w})}\right) ^ {\top}.
$$
The major cost for computing  $\nabla_{\mathbf{w}}R(\mathbf{w},\delta ,\mathcal{D})$  lies at evaluating  $g(\mathbf{w})$  and its gradient  $\nabla_{\mathbf{w}}g(\mathbf{w})$  which involves passing through all examples in  $\mathcal{D}$ . In order to develop a stochastic algorithm, we will approximate these quantities by using a mini-batch of random samples. The gradient  $\nabla_{\mathbf{w}}g(\mathbf{w})$  can be simply approximated by the stochastic gradient, i.e.,
$$
\widehat {\nabla} _ {\mathbf {w}} g (\mathbf {w}) = \left( \begin{array}{c} \frac {1}{B} \sum_ {\mathbf {x} _ {i} \in \mathcal {B}} \exp (h (\mathbf {x} _ {i})) ((h (\mathbf {x} _ {i}) - h (\mathbf {x} _ {i} + \delta_ {i}) + 1) \nabla_ {\mathbf {w}} h (\mathbf {x} _ {i}) - \nabla_ {\mathbf {w}} h (\mathbf {x} _ {i} + \delta_ {i})) \\ \frac {1}{B} \sum_ {\mathbf {x} _ {i} \in \mathcal {B}} \exp (h (\mathbf {x} _ {i})) \nabla_ {\mathbf {w}} h (\mathbf {x} _ {i}) \\ \frac {1}{B} \sum_ {\mathbf {x} _ {i} \in \mathcal {B}} \exp (h (\mathbf {x} _ {i} + \delta_ {i})) \nabla_ {\mathbf {w}} h (\mathbf {x} _ {i} + \delta_ {i}) \end{array} \right),
$$
where  $\mathcal{B}$  denote a set of  $B$  random samples from  $\mathcal{D}$ . Due to the non-linear dependence of  $\nabla_{\mathbf{w}}R(\mathbf{w},\delta ,\mathcal{D})$  on  $g(\mathbf{w})$ , we cannot simply use their mini-batch estimator in the calculation as it will yield a large optimization error [51]. To reduce the optimization error [34, 33], we will maintain a vector  $\mathbf{u} = [u_1,u_2,u_3]$  for tracking  $[g_{1}(\mathbf{w}),g_{2}(\mathbf{w}),g_{3}(\mathbf{w})]$ . The vector  $\mathbf{u}$  is updated by Equation (11), where  $\gamma_{2}\in (0,1)$  is a parameter. An estimate of  $\nabla_{\mathbf{w}}R(\mathbf{w},\delta ,\mathcal{D})$  is given by
Equation (12):
$$
\begin{array}{l} \mathbf {u} = (1 - \gamma_ {2}) \mathbf {u} + \gamma_ {2} \left( \begin{array}{c} \frac {1}{B} \sum_ {\mathbf {x} _ {i} \in \mathcal {B}} \exp (h (\mathbf {x} _ {i})) (h (\mathbf {x} _ {i}) - h (\mathbf {x} _ {i} + \delta_ {i})) \\ \frac {1}{B} \sum_ {\mathbf {x} _ {i} \in \mathcal {B}} \exp (h (\mathbf {x} _ {i})) \\ \frac {1}{B} \sum_ {\mathbf {x} _ {i} \in \mathcal {B}} \exp (h (\mathbf {x} _ {i} + \delta_ {i})) \end{array} \right) (11) \\ \widehat {\nabla} _ {\mathbf {w}} R (\mathbf {w}, \delta , \mathcal {D}) = \widehat {\nabla} _ {\mathbf {w}} g (\mathbf {w}) ^ {\top} \left(\frac {1}{u _ {2}}, \frac {- u _ {1} - u _ {2}}{\left(u _ {2}\right) ^ {2}}, \frac {1}{u _ {3}}\right) ^ {\top}. (12) \\ \end{array}
$$
Finally, we are ready to present the detailed steps of the proposed algorithm for solving AdAP_LZ in (9) in Algorithm 1, which employs PGD for generating adversarial attacks and stochastic compositional optimization techniques for updating the model parameter  $\mathbf{w}$ .
In this section, we perform extensive experiments to evaluate the proposed approaches against white-box and black-box attacks on diverse imbalanced datasets. In order to provide a comprehensive understanding of our methods, we conduct experiments from three other perspectives: (1) trade-off between robustness and average precision; (2) a close look at the effect of the adversarial perturbations; (3) ablation study of different strategies for adversarial AP maximization.
Datasets. We conduct experiments on four distinct datasets sourced from various domains. These encompass CIFAR-10 and CIFAR-100 datasets [22], CelebA dataset [26] and the BDD100K dataset [57]. For CIFAR-10 and CIFAR100, we adopt one versus-all approach to construct imbalanced classification tasks. It should be noted that even for clean data, the task of distinguishing between 1 positive class and 99 negative classes in CIFAR100 is challenging. Hence, in our experiments, we employ the 20 superclass labels, of which we choose the first 10 superclasses for constructing 10 one-vs-all binary classification tasks to verify the adversarial robustness on the CIFAR100 dataset. We split the training dataset into train/validation sets at  $80\% /20\%$  ratio, and use the testing dataset for testing. CelebA dataset is a large-scale face attributes dataset that contains over 200,000 images of celebrities, each of which is annotated with 40 facial attributes. In our experiments, we choose two attributes with the highest imbalanced ratio, i.e., Gray_hair and Mustache, to show the superiority of our method. We adopt the recommended training/validation/testing split. BDD100K dataset is a large-scale diverse driving video dataset, which also has collected image-level annotation on six weather conditions and six scene types. In our experiments, we choose two kinds of weather conditions, i.e., Rainy and Cloudy, and two kinds of scene types, i.e., Tunnel and Residential, which are more imbalanced than others. Since the official testing dataset is not handy, we take the official validation set as the testing data, and split the training dataset into train/validation sets at  $80\% /20\%$  ratio. The statistics for each task in datasets are presented in Table 6 in the appendix.
Baselines. In all experiments, we compare our methods (AdAP_LN, AdAP_LPN) with the following baseline methods: (1) PGD [27], which solves a MiniMax objective directly to enhance the adversarial robustness in terms of accuracy; (2) TRADES [59], which considers the trade-off between robustness and accuracy by minimizing a form of regularized surrogate loss; (3) MART [53], which explores the effect of misclassified examples to the robustness of adversarial training. Furthermore, we include two normal training methods, namely CE minimization and AP maximization by [34], as references.
Experimental Details. We employ the ResNet18 [19] as the backbone network in our experiments. This choice is based on the fact that all the tasks involved in our study are binary classifications, and ResNet18 is considered to be expressive enough for the purpose. For all methods, with mini-batch size as 128, we tune learning rate in  $\{1\mathrm{e} - 3,1\mathrm{e} - 4,1\mathrm{e} - 5\}$  with standard Adam optimizer. We set the weight decay to  $2\mathrm{e} - 4$  for the CIFAR10 and CIFAR100 datasets and  $1\mathrm{e} - 5$  for the CelebA and BDD100k datasets. In the case of the CIFAR10 and CIFAR100 datasets, we run each method for a total of 60 epochs. For the CelebA and BDD100k datasets, we run each method for 32 epochs. The learning rate decay happens at  $50\%$  and  $75\%$  epochs by a factor of 10. For MART, AdAP_LN and AdAP_LPN, we tune the regularization parameter  $\lambda$  in  $\{0.1,0.4,0.8,1,4,8,10\}$ . For TRADES, we tune the regularization parameter in  $\{1,4,8,10,40,80,100\}$ , since they favor larger weights to obtain better robustness. In addition, for AdAP_LN and AdAP_LPN, we tune its moving average parameters  $\gamma_{1},\gamma_{2}$  in  $\{0.1,0.9\}$ . Similarly, we tune the moving average parameters  $\gamma_{1}$  for AP maximization in  $\{0.1,0.9\}$ . We set margin parameter in the surrogate loss of AP as 0.6 for all methods that use the AP surrogate loss. For all adversarial training methods, we apply 6 projected gradient ascent steps to generate adversarial samples in the training stage, and the step size is 0.01. We choose  $L_{\infty}$  norm to bound the perturbation within the limit of  $\epsilon = 8 / 255$ , as it is commonly used in the literature.
All the models in our experiments are trained from scratch, except direct AP maximization which is fine-tuned on a pretrained CE model as in [34]. For each experiment, we repeat three times with different random seeds, then report average and standard deviation.
5.1 Robustness against White-box Attacks
In this part, we evaluate the robustness of all models against PGD and APGD [12] white box attacks that have full access to model parameters. Specifically, we utilized 10-step PGD and APGD attack to generate adversarial perturbations constrained by the same perturbation limit  $\epsilon = 8 / 255$ . Given that APGD is a step size-free method, we set the step size for PGD to 0.007. For the adversarial training methods, hyperparameters and models are chosen based on the robust average precision (AP) metric on validation datasets, and their corresponding performances on test datasets are reported. For normal training methods, models are chosen based on the clean average precision. The results are presented in Table 2 and 3. Since we run all the classes of CIFAR10 and the first 10 classes of CIFAR100 to verify the effectiveness of our method, we report the mean average precision over the ten classes in the tables, and the performance on each class is shown in the appendix.
From Table 2 and 3, we can observe that our proposed methods outperform other baselines consistently by a large margin while maintaining notably higher clean AP scores. It is striking to see that our methods improve robust AP by  $2 \sim 7$  percent on all datasets, compared with adversarial training methods which are concerning accuracy. The results also show that normal training methods (CE min. and AP max.) are vulnerable to adversarial attacks, while they can achieve pretty high clean AP. This is consistent with the observation from other literature [46, 16]. When comparing results in Table 3 with that in Table 2, we can see that APGD exhibits stronger attacks than PGD, as demonstrated in [12]. However, the superiority of our proposed methods still remains evident.
5.2 Robustness against Black-box Attacks
In this part, we examine all the models against adversarial black-box attacks. To achieve this, we utilize the model trained with CE loss minimization on clean datasets as an attacker model. So we do not include the performance of models of CE loss minimization here. With the well-trained model from CE loss minimization, we craft adversarial test images by PGD attack with 20 iterations and step size is 0.003, under perturbation limit  $\epsilon = 8 / 255$ . The models evaluated here are the same model evaluated in 5.1. The results are summarized in Table 4. Results show that our method exhibits significantly superior robustness against black-box attacks on all tasks, with evident advantages against white-box attacks shown in 5.1. From Table 4, we can also observe that the normal training method, i.e., AP maximization, is also susceptible when confronting adversarial black-box attacks.
5.3 Trade-off between Robustness and AP
As argued in various research studies [59, 40, 56], there exists a trade-off between accuracy and adversarial robustness. That is saying when one model boosts its adversarial performance, it may result in a decrease in its clean performance. In this part, we aim to study the trade-off between robustness and average precision and provide clear visualizations of the phenomenon. To accomplish this, we tune the weight of the regularization for the regularization-based approaches, i.e. TRADES, MART, AdAP_LN and AdAP_LPN, then show how their robust AP and clean AP changes. We evaluate the models at the last epoch to ensure that all methods reach a convergence point. For TRADES, AdAP_LN and AdAP_LPN, we tune the weight introduced in Experimental Details part, as well as 0.01, to better illustrate the trade-off trend. We also include non-regularization-based approaches as a point in this graph.
Based on Figure 2, we can observe that for TRADES, AdAP_LN and AdAP_LPN, as the weight of regularization increases, the clean AP decreases while the robust AP increases at first, which is consistent with the observation in [59]. But for MART, the trend is not clear as it is not a trade-off based approach. However, as the weight of regularization continues increasing, both the clean AP and robust AP decrease. This is because when the model places excessive emphasis on the regularization term, it may overlook the actual objective. Notably, our proposed methods place more towards the upper-right than other baselines, which indicates that our method is able to achieve better both robust and clean AP simultaneously.
5.4 Visualizing the Behavior after Adversarial Perturbations
To gain a deeper understanding of our approach, we have a close look at how defense models' predictions change after introducing adversarial perturbations. To be more specific, we compare our AdAP_LN method with another robust baseline, TRADES, to examine how their predictions are
Table 2: Adversarial robustness against PGD white box attacks
Methods	CIFAR-10 (average)	CIFAR-100 (average)	CelebA(gray_hair)	CelebA(mustache)
Robust	Clean	Robust	Clean	Robust	Clean	Robust	Clean
CE Min.	0.0526(0.0007)	0.8944(0.0037)	0.0256(0.0001)	0.7094(0.0062)	0.0161(0.0000)	0.7851(0.0040)	0.0196(0.0000)	0.6658(0.0055)
AP Max.	0.0528(0.0012)	0.9007(0.0037)	0.0267(0.0015)	0.7222(0.0077)	0.0161(0.0000)	0.7851(0.0038)	0.0196(0.0000)	0.6517(0.0057)
PGD	0.2765(0.0087)	0.4929(0.0085)	0.1613(0.0043)	0.3149(0.0083)	0.2576(0.0020)	0.4946(0.0019)	0.2127(0.0006)	0.5040(0.0019)
TRADES	0.2884(0.0029)	0.5631(0.0045)	0.1767(0.0026)	0.3975(0.0065)	0.2586(0.0024)	0.4697(0.0040)	0.2069(0.0016)	0.5049(0.0001)
MART	0.2859(0.0126)	0.4971(0.0093)	0.1650(0.0060)	0.3167(0.0071)	0.2608(0.0026)	0.4874(0.0035)	0.2147(0.0021)	0.5053(0.0015)
AdAP_LN	0.2949(0.0147)	0.6345(0.0114)	0.1957(0.0069)	0.4628(0.0138)	0.2931(0.0020)	0.5186(0.0030)	0.2586(0.0044)	0.4693(0.0019)
AdAP_LPN	0.3301(0.0022)	0.6526(0.0029)	0.2188(0.0040)	0.4675(0.0075)	0.2805(0.0028)	0.4944(0.0047)	0.2269(0.0010)	0.5439(0.0040)
Methods	BDD100K(tunnel)	BDD100K(residential)	BDD100K(rainy)	BDD100K(Cloudy)
Robust	Clean	Robust	Clean	Robust	Clean	Robust	Clean
CE Min.	0.0014(0.0000)	0.6289(0.0215)	0.0655(0.0000)	0.5970(0.0051)	0.0379(0.0000)	0.7374(0.0063)	0.0379(0.0000)	0.6623(0.0021)
AP Max.	0.0014(0.0000)	0.6390(0.0188)	0.0656(0.0000)	0.6262(0.0101)	0.0381(0.0000)	0.7566(0.0056)	0.0388(0.0004)	0.6681(0.0029)
PGD	0.2263(0.0054)	0.4091(0.0146)	0.1378(0.0017)	0.1805(0.0022)	0.1730(0.0087)	0.3688(0.0178)	0.2164(0.0067)	0.4497(0.0105)
TRADES	0.1855(0.0094)	0.4459(0.0208)	0.1568(0.0011)	0.2379(0.0012)	0.2203(0.0016)	0.4807(0.0023)	0.2403(0.0013)	0.5250(0.0028)
MART	0.2223(0.0077)	0.4074(0.0164)	0.1400(0.0007)	0.1865(0.0020)	0.1703(0.0041)	0.3661(0.0086)	0.2157(0.0036)	0.4469(0.0055)
AdAP_LN	0.2918(0.0137)	0.5726(0.0141)	0.1617(0.0021)	0.3070(0.0029)	0.2545(0.0017)	0.5401(0.0053)	0.2826(0.0035)	0.5483(0.0039)
AdAP_LPN	0.2986(0.0121)	0.5558(0.0047)	0.1752(0.0013)	0.2552(0.0004)	0.2598(0.0032)	0.5194(0.0033)	0.2744(0.0036)	0.5456(0.0087)
Table 3: Adversarial robustness against APGD white-box attacks
Methods	CIFAR-10 (average)	CIFAR-100 (average)	CelebA(gray_hair)	CelebA(mustache)
Robust	Clean	Robust	Clean	Robust	Clean	Robust	Clean
CE Min.	0.0524(0.0004)	0.8944(0.0037)	0.0255(0.0000)	0.7094(0.0062)	0.0161(0.0000)	0.7851(0.0040)	0.0196(0.0000)	0.6658(0.0055)
AP Max.	0.0526(0.0012)	0.9007(0.0037)	0.0257(0.0003)	0.7222(0.0077)	0.0163(0.0001)	0.7851(0.0038)	0.0196(0.0000)	0.6517(0.0057)
PGD	0.2670(0.0054)	0.4929(0.0085)	0.1580(0.0035)	0.3149(0.0083)	0.2560(0.0020)	0.4946(0.0019)	0.2090(0.0004)	0.5040(0.0019)
TRADES	0.2839(0.0029)	0.5631(0.0045)	0.1739(0.0027)	0.3975(0.0065)	0.2572(0.0025)	0.4697(0.0040)	0.2020(0.0013)	0.5049(0.0001)
MART	0.2721(0.0052)	0.4971(0.0093)	0.1603(0.0050)	0.3167(0.0071)	0.2592(0.0025)	0.4874(0.0035)	0.2110(0.0021)	0.5053(0.0015)
AdAP_LN	0.2594(0.0056)	0.6345(0.0114)	0.1853(0.0030)	0.4628(0.0138)	0.2908(0.0009)	0.5186(0.0030)	0.2318(0.0017)	0.4693(0.0019)
AdAP_LPN	0.3252(0.0022)	0.6526(0.0029)	0.2160(0.0040)	0.4675(0.0075)	0.2785(0.0027)	0.4944(0.0047)	0.2222(0.0008)	0.5439(0.0040)
Methods	BDD100K(tunnel)	BDD100K(residential)	BDD100K(rainy)	BDD100K(Cloudy)
Robust	Clean	Robust	Clean	Robust	Clean	Robust	Clean
CE Min.	0.0014(0.0000)	0.6289(0.0215)	0.0655(0.0000)	0.5970(0.0051)	0.0379(0.0000)	0.7374(0.0063)	0.0379(0.0000)	0.6623(0.0021)
AP Max.	0.0014(0.0000)	0.6390(0.0188)	0.0656(0.0000)	0.6262(0.0101)	0.0382(0.0001)	0.7566(0.0056)	0.0387(0.0003)	0.6681(0.0029)
PGD	0.2235(0.0055)	0.4091(0.0146)	0.1364(0.0013)	0.1805(0.0022)	0.1722(0.0086)	0.3688(0.0178)	0.2128(0.0067)	0.4497(0.0105)
TRADES	0.1819(0.0115)	0.4459(0.0208)	0.1563(0.0011)	0.2379(0.0012)	0.2187(0.0014)	0.4807(0.0023)	0.2366(0.0013)	0.5250(0.0028)
MART	0.2209(0.0083)	0.4074(0.0164)	0.1383(0.0013)	0.1865(0.0020)	0.1694(0.0040)	0.3661(0.0086)	0.2120(0.0038)	0.4469(0.0055)
AdAP_LN	0.2882(0.0142)	0.5726(0.0141)	0.1616(0.0013)	0.3070(0.0029)	0.2526(0.0019)	0.5401(0.0053)	0.2789(0.0027)	0.5483(0.0039)
AdAP_LPN	0.2959(0.0114)	0.5558(0.0047)	0.1747(0.0014)	0.2552(0.0004)	0.2579(0.0031)	0.5194(0.0033)	0.2719(0.0035)	0.5456(0.0087)
Table 4: Adversarial robustness against black-box attacks
Methods	CIFAR-10 (average)	CIFAR-100 (average)	CelebA(gray_hair)	CelebA(mustache)
Robust	Clean	Robust	Clean	Robust	Clean	Robust	Clean
AP Max.	0.1137(0.0374)	0.9007(0.0037)	0.0608(0.0241)	0.7222(0.0077)	0.0162(0.0000)	0.7851(0.0038)	0.0196(0.0000)	0.6517(0.0057)
PGD	0.4594(0.0074)	0.4929(0.0085)	0.2869(0.0078)	0.3149(0.0083)	0.4638(0.0022)	0.4946(0.0019)	0.4180(0.0010)	0.5040(0.0019)
TRADES	0.5148(0.0039)	0.5631(0.0045)	0.3420(0.0045)	0.3975(0.0065)	0.4360(0.0033)	0.4697(0.0040)	0.3953(0.0009)	0.5049(0.0001)
MART	0.4624(0.0083)	0.4971(0.0093)	0.2892(0.0067)	0.3167(0.0071)	0.4578(0.0039)	0.4874(0.0035)	0.4188(0.0013)	0.5053(0.0015)
AdAP_LN	0.5562(0.0087)	0.6345(0.0114)	0.3880(0.0099)	0.4628(0.0138)	0.4753(0.0011)	0.5186(0.0030)	0.3635(0.0010)	0.4627(0.0015)
AdAP_LPN	0.6031(0.0028)	0.6526(0.0030)	0.4166(0.0072)	0.4675(0.0075)	0.4633(0.0047)	0.4944(0.0047)	0.4334(0.0036)	0.5439(0.0041)
Methods	BDD100K(tunnel)	BDD100K(residential)	BDD100K(rainy)	BDD100K(Cloudy)
Robust	Clean	Robust	Clean	Robust	Clean	Robust	Clean
AP Max.	0.1013(0.0736)	0.6390(0.0188)	0.1149(0.0367)	0.6262(0.0101)	0.0669(0.0228)	0.7566(0.0056)	0.1904(0.0694)	0.6681(0.0029)
PGD	0.3724(0.0123)	0.4091(0.0146)	0.1797(0.0022)	0.1805(0.0022)	0.3566(0.0172)	0.3688(0.0178)	0.4194(0.0089)	0.4497(0.0105)
TRADES	0.3764(0.0196)	0.4459(0.0208)	0.2330(0.0010)	0.2379(0.0012)	0.4645(0.0025)	0.4807(0.0023)	0.4752(0.0018)	0.5250(0.0028)
MART	0.3727(0.0161)	0.4074(0.0164)	0.1860(0.0020)	0.1865(0.0020)	0.3539(0.0085)	0.3661(0.0086)	0.4169(0.0047)	0.4469(0.0055)
AdAP_LN	0.5400(0.0168)	0.5726(0.0141)	0.2872(0.0027)	0.3070(0.0029)	0.5234(0.0052)	0.5401(0.0053)	0.4872(0.0011)	0.5483(0.0039)
AdAP_LPN	0.5252(0.0062)	0.5558(0.0047)	0.2486(0.0008)	0.2552(0.0004)	0.5060(0.0037)	0.5194(0.0033)	0.4975(0.0085)	0.5457(0.0087)
Table 5: Comparison of different adversarial AP maximization methods
Methods	CIFAR-10 (average)	CIFAR-100 (average)	BDD100K(tunnel)	BDD100K(rainy)
Robust	Clean	Robust	Clean	Robust	Clean	Robust	Clean
AdAP_MM	0.2759(0.0062)	0.4708(0.0126)	0.1878(0.0047)	0.3843(0.0105)	0.2743(0.0441)	0.5849(0.0284)	0.2199(0.0011)	0.4516(0.0053)
AdAP_PZ	0.3105(0.0018)	0.6112(0.0049)	0.2109(0.0032)	0.4465(0.0078)	0.2708(0.0180)	0.5771(0.0516)	0.2531(0.0029)	0.5031(0.0104)
AdAP_LZ	0.3012(0.0194)	0.6508(0.0129)	0.1919(0.0084)	0.4422(0.0200)	0.2619(0.0127)	0.6212(0.0107)	0.2103(0.0021)	0.4365(0.0163)
AdAP_LN	0.2949(0.0147)	0.6345(0.0114)	0.1957(0.0069)	0.4628(0.0138)	0.2918(0.0137)	0.5726(0.0141)	0.2545(0.0017)	0.5401(0.0053)
AdAP_LPN	0.3301(0.0022)	0.6526(0.0029)	0.2188(0.0040)	0.4675(0.0075)	0.2986(0.0121)	0.5558(0.0047)	0.2598(0.0032)	0.5194(0.0033)