SlowGuess/NeurIPS_2023_OCR huggingface dataset:
In Figure 3 we report the wall-clock time of training a WRN-28 (left) and a ResNeXt (right) with batchsize 128 on a single A100 with PyTorch. Since the normalization parameters at the earlier layers of the network require a gradient, potentially a full backpropagation pass has to be computed for the ascent-step of SAM-ON, even though only a tiny fraction of all parameters is perturbed. However, as discussed in [12] for a related setting, the gradients of the intermediate (no-norm) layers do not need to be stored or used for updating. This leads to computational gains of SAM-ON over SAM-all as reported in Figure 3.
In contrast, although future development of hardware for sparse operation may allow for acceleration, Mi et al. [42] report that their sparse perturbation approach does not at present lead to reduced wall-clock time. Their approach also suffers from additional computational cost associated with selecting the mask, and hence is outshined by SAM-ON both in computational cost and generalization performance (as discussed in Section 5.1).
We also show results for perturbing only the normalization layers of selected blocks (Block 1-3) of the network, and interestingly the main benefits of SAM-ON seem to arise from the later normalization layers, allowing for further computational savings. When perturbing only the normalization layers from the last block (B3), the biggest computational gains can be achieved (reducing the additional cost of SAM by more than  $50\%$ ), without much loss in test accuracy. When perturbing the normalization layers from Block 2 and 3 (B2+B3), the test accuracy even slightly improves over SAM-ON for both models, while the runtime is still significantly lower. We have not investigated this variant of SAM-ON thoroughly, i.e. in combination with other ASAM perturbation models and more network architectures, but think that this is an interesting research direction for future work.
5 Towards Understanding SAM-ON
To gain a better understanding of SAM-ON, we study different hypotheses for the method's success. First, we investigate the role of sparsity by comparing SAM-ON to different sparsified perturbation approaches (Section 5.1), concluding that sparsity alone is not enough to explain its success. Then, we highlight that SAM-ON might in fact find sharper minima, while generalizing better than SAM-all (Section 5.2). We also show that SAM-ON - similar to SAM-all - reduces the feature-rank compared to vanilla optimizers (Section 5.2). Further, we showcase that depending on the perturbation method, SAM-ON can induce a significant shift in the distribution of the normalization parameters (Section 5.3) and relate this to the no-norm results from Section 4. Unless stated otherwise, we use a WRN-28 with BatchNorm and the setting described in Section 4 for the ablation studies. Further ablation studies are presented in Appendix B.
Figure 4: Left: SAM-ON outperforms SSAM-F [42] (with different sparsity levels) and random mask SAM-rand (same sparsity level  $99.93\%$  as SAM-ON) sparse perturbation approaches on CIFAR-10 for ResNet-18. Right: SAM-ON improves over SAM for various batch-sizes (bs) and values of  $m$ , where smaller values of  $m$  tend to improve performance. WRN-28, CIFAR-100.
5.1 The effect of sparsified perturbations
Mi et al. [42] propose a sparsified SAM (SSAM) approach which only considers part of the parameters for the SAM perturbation step. They find that using  $50\%$  perturbation sparsity SSAM can outperform SAM-all, and still perform competitively with up to  $99\%$  sparsity in certain settings. This raises the question whether the enhanced performance of SAM-ON over SAM-all is simply due to perturbing fewer parameters. We therefore compare SAM-ON to other sparse perturbation approaches.
In order to determine the parameters which should be perturbed, one solution Mi et al. [42] propose is to compute a binary mask via an approximation of the Fisher matrix. We call this approach SSAM-F to avoid confusion with Fisher-SAM introduced in Section 3.2. Mi et al. [42] also propose a dynamic mask sparse perturbation approach (SSAM-D), but do not clearly favour either method. Since they consider SSAM-F "relatively more stable but a bit time-consuming, while [SSAM-D] is more efficient", we will for fair comparison focus on SSAM-F here and provide results for SSAM-D in Appendix B.2. According to Mi et al. [42] neither approach improves wall-clock time in practice, while we find that SAM-ON does (see Section 4.3).
We provide a comparison between SAM-ON, SSAM-F, and a random sparsity mask of the same sparsity level as SAM-ON for  $a$ ) ResNet-18 on CIFAR-10 (main setting considered in [42]) in Figure 4 (left) and  $b$ ) WRN-28 on CIFAR-100 in Table 5. We find that although SSAM-F can indeed perform on par or even outperform SAM-all at the medium to high sparsity levels recommended in [42] it is less successful than SAM-ON. Moreover, for the sparsity levels of SAM-ON, which are above  $99.9\%$  in both settings, a random mask performs poorly. These results suggest that sparsity is not the sole cause for SAM-ON's success.
Table 5: SAM-ON outperforms other sparse perturbation approaches: Although SSAM-F [42] with different sparsity levels can outperform SAM-all on CIFAR-100 with WRN-28, it is less effective than SAM-ON, especially when probed at very high sparsity levels.
Sparsity	SAM
0%	SAM-ON
99.95%	Random Mask
99.95%	SSAM-F
50%	99.95%
Test Accuracy (%)	83.11±0.3	84.19±0.2	80.97±0.2	83.94±0.1	83.14±0.1
5.2 Sharpness and feature-rank of SAM-ON
The improved generalization performance of SAM-trained models is often attributed to finding flatter minima [27, 34] – indeed this was the initial motivation behind SAM in [23]. Andriushchenko and Flammarion [2] however cast doubt on this explanation, and argue that the benefits of SAM might stem from a favorable implicit bias induced by the method. A recent study furthermore found that sharpness often does not correlate well with a model's generalization performance [4]. In this section we therefore compare the sharpness of SAM-all to SAM-ON models (following the setup in [4], more details provided in Appendix B.10).
In Table 6, we report logit-normalized worst-case adaptive  $\ell_{\infty}$ $m$  -sharpness, the sharpness definition which achieved the best correlation with generalization error for CIFAR data in the large-scale study in [4]. We investigate a WRN-28 on CIFAR-100 trained with SGD, SAM, and ASAM- $\ell_{\infty}$  both with their respective all and ON variants.
Worst-case sharpness is measured with 20 steps of AutoPGD [16], a hyperparameter-free method designed for accurate estimation of adversarial robustness. Instead of the input space, which is optimized in adversarial robustness, the method is adapted to the weight space for sharpness computation. In addition to the 20-step AutoPGD-sharpness, we also report 1-step sharpness, i.e. the change in loss obtained when performing only a single gradient step, like in the perturbation step of SAM. It is to note that except for the logit-normalization, the sharpness definition reported in Table 6 corresponds exactly to the perturbation model that ASAM elementwise  $\ell_{\infty}$  uses, and hence the 1-step sharpness reported should be fairly close the the objective that ASAM elementwise  $\ell_{\infty}$  actually minimizes during training. For both sharpness definitions, we pick  $\rho$  such that we get sharpness values similar to those that lead to good correlation with generalization in [4]. This is, for 1-step sharpness we have to pick  $\rho$  larger than for the 20-step sharpness to get to similar loss changes.
We observe that the SAM-ON models obtain the best generalization performance, while having significantly higher sharpness than their SAM-all counterparts, and sometimes even higher than that of the baseline SGD-trained model. This supports the claims of [2] that although SAM-all might in fact find flatter minima, we should be careful in attributing this as the sole reason for its improved generalization performance. In Appendix B.10 we report more sharpness metrics and find that SAM-ON is sharper than SAM-all for most metrics, although there exist exceptions.
A recent study by Andriushchenko et al. [3] further showed that SAM-all leads to features of lower rank compared to vanilla optimizers. Following their setup we measure the feature rank for a WRN-28 and report our findings in Table 6 (final row). We find that SAM-ON also leads to features of lower rank compared to SGD, but observe no significant change compared to SAM-all.
Table 6: SAM-ON models are sharper, yet generalize better. Shown is logit-normalized  $\ell_{\infty}$ $m$  -sharpness from [4], averaged over three models per method for a WRN-28 on CIFAR-100, and the feature rank like investigated in [3] (last row).
SGD	SAM	ASAM-el.-l∞
all	ON	all	ON
Test Accuracy (%)	80.71±0.2	83.11±0.3	84.19±0.2	83.25±0.2	84.14±0.2
sharpness	20 steps, ρ = 0.003	0.071±0.000	0.048±0.001	0.090±0.005	0.048±0.001	0.078±0.004
20 steps, ρ = 0.005	0.201±0.001	0.139±0.004	0.296±0.018	0.124±0.002	0.283±0.011
20 steps, ρ = 0.007	0.433±0.002	0.309±0.011	0.585±0.018	0.255±0.005	0.580±0.020
1 step, ρ = 0.007	0.117±0.002	0.098±0.001	0.170±0.007	0.095±0.002	0.142±0.011
81step, ρ = 0.01	0.204±0.005	0.183±0.002	0.315±0.010	0.170±0.003	0.271±0.019
1 step, ρ = 0.03	0.809±0.003	0.769±0.017	0.843±0.007	0.724±0.005	0.834±0.012
Feature Rank	4004±12	3798±17	3728±11	3613±47	3725±11
5.3 SAM-ON can change the affine parameter values
In Figure 5 we show the distribution of the scaling parameter  $\gamma$  and the shift parameter  $\beta$  (as defined in Eq. 1) for a WRN-28 trained with SAM-ON and SAM-all. While there are only minor changes in the distribution of  $\beta$ , there is a clear shift in the distribution of  $\gamma$  towards larger values for SAM-ON. In Figure 9 in Appendix B.6 we study more SAM-variants and rediscover a pattern from Section 4.1: The distribution shift for  $\gamma$  only seems to appear for those variants, where the optimal  $\rho$  of SAM-ON shifts towards larger values compared to SAM-all (i.e. not for ASAM elementwise- $\ell_2$ ). We thus hypothesize that the perturbation model of ASAM elementwise- $\ell_2$  implicitly focuses mostly on perturbing the normalization layers already, which is why excluding them (no-norm) leads to a drastic performance decrease, whereas SAM-ON minimally changes the  $\gamma$ -distribution. In contrast, the other SAM-variants (for which the optimal  $\rho$ -value changes) may not perturb the normalization layers enough in SAM-all for them to be effective, which is why no-norm has little effect, while SAM-ON leads to a distinctive shift of the  $\gamma$ -distribution.
Figure 5: SAM-ON changes the weight distribution of the normalization layer weights of a WRN-28 towards larger values. More SAM-variants are shown in Figure 9 in the appendix.
In recent years the method of sharpness-aware minimization (SAM) [23] has risen to prominence due to its demonstrated effectiveness and the community's long-standing interest in flat minima. In this work we show that only applying SAM to the normalization layers (SAM-ON) – typically less than  $0.1\%$  of the total parameters – can significantly enhance performance compared to regular SAM (SAM-all). We show results on CIFAR and ImageNet for ResNet and Vision Transformers with BatchNorm and Layernorm, respectively. Although the use of sparsified perturbations was recently shown to benefit generalization [42], we show that the success of SAM-ON cannot be attributed to sparsity alone: targeting the normalization layers clearly improves over other masked sparsity approaches.
We find that while SAM-ON outperforms SAM-all in almost all settings, the optimal SAM variant to use varies. We do not see a consistent benefit of using reparameterization-invariant perturbation models compared to variants with fewer invariances. In particular, we find that layerwise  $\ell_2$  in combination with SAM-ON reaches the highest accuracy for many settings.
While SAM-ON improves generalization, it loses some of SAM's sharpness-reducing qualities. Although perhaps surprising given SAM's original motivation, this finding relates naturally to the literature. [4] find that sharpness does not always correlate well with generalization performance. Further, [2] question if sharpness is the sole driving factor behind SAM's success in enhancing generalization. We lend support to this question, showing that SAM-like methods can generalize better, without significant sharpness reduction.
In summary, we demonstrate benefits of SAM beyond reducing sharpness and highlight the special role played by the normalization layers. More investigation into the interplay of SAM and other aspects of training are needed to fully understand where the methods gains come from.
Limitations. Similar to the main inspirations for this work [23, 24, 42] we focus on vision data. We provide a simple experiment in the language domain in Appendix B.5 indicating that the efficacy of SAM-ON might be preserved for language tasks, but more extensive benchmarking, as done by [7] is required. Further, more work is required to try to leverage the perturbation sparsity for reduced computational cost beyond the gains obtained in this work, and to fully explore the benefits of perturbing subsets of the normalization layers building on the findings in Section 4.3.
We acknowledge support from the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) under Germany's Excellence Strategy (EXC number 2064/1, Project number 390727645), as well as from the Carl Zeiss Foundation in the project "Certification and Foundations of Safe Machine Learning Systems in Healthcare". We also thank the European Laboratory for Learning and Intelligent Systems (ELLIS) for supporting Maximilian Müller. We are grateful for support from the Canada CIFAR AI Chairs Program and US National Science Foundation award tel:1910864. In addition, we acknowledge material support from NVIDIA and Intel in the form of computational resources and are grateful for technical support from the Mila IDT team in maintaining the Mila Compute Cluster.
[49] C. Summers and M. J. Dinneen. Four things everyone should know to improve batch normalization. *ICLR*, 2020.
[50] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus. Intriguing properties of neural networks. *ICLR*, 2014.
[51] A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, L. Kaiser, and I. Polosukhin. Attention is all you need. NeurIPS, 2017.
[52] Z. Wei, J. Zhu, and Y. Zhang. Sharpness-aware minimization alone can improve adversarial robustness. ICML AdvML-Frontiers Workshop, arXiv:2305.05392, 2023.
[53] R. Wightman. Pytorch image models. https://github.com/rwrightman/pytorch-image-models, 2019.
[54] C. Xie and A. Yuille. Intriguing properties of adversarial training at scale. *ICLR*, 2020.
[55] S. Xie, R. Girshick, P. Dollar, Z. Tu, and K. He. Aggregated residual transformations for deep neural networks. CVPR, 2017.
[56] J. Xu, X. Sun, Z. Zhang, G. Zhao, and J. Lin. Understanding and improving layer normalization. NeurIPS, 2019.
[57] Z. Yao, A. Gholami, K. Keutzer, and M. Mahoney. PyHessian: Neural networks through the lens of the Hessian. IEEE BigData, arXiv:1912.07145, 2020.
[58] M. Yazdanpanah, A. A. Rahman, M. Chaudhary, C. Desrosiers, M. Havaei, E. Belilovsky, and S. E. Kahou. Revisiting learnable affines for Batch Norm in few-shot transfer learning. CVPR, 2022.
[59] S. Zagoruyko and N. Komodakis. Wide residual networks. In BMVC, 2016.
[60] H. Zhang, Y. N. Dauphin, and T. Ma. Fixup initialization: Residual learning without normalization. ICLR, 2019.
[61] J. Zhuang, B. Gong, L. Yuan, Y. Cui, H. Adam, N. Dvornek, S. Tatikonda, J. Duncan, and T. Liu. Surrogate gap minimization improves sharpness-aware training. *ICLR*, 2022.
This appendix is structured as follows:
- In Appendix A we provide more training details. In particular, we report the hyperparameters used for the CIFAR experiments in A.1 and for the ImageNet experiments in A.2. In A.3 we provide more details and a formal definition of the SAM-variants used throughout this paper.
- In Appendix B we show additional experimental results for: CIFAR in B.1, ImageNet in B.3, and a machine translation task in B.5. In B.2 we provide additional ablation studies for sparse perturbation SSAM approaches and in B.4 we extend the discussion on adversarial robustness. To gain a better understanding of SAM-ON, we further investigate: the weight distribution shift induced by SAM-ON (B.6), the effect of SAM when fixing the normalization parameters during training (B.7), SAM's performance when only training the normalization layers (B.8), and ablations on weight decay and dropout (B.9). Finally, we provide an extended discussion on the sharpness evaluation and more ablations in B.10.
- In Appendix C we provide a convergence analysis for SAM-ON.
A.1 CIFAR training details
For our CIFAR experiments, we consider a range of SAM-variants which differ either in the norm  $(p\in \{2,\infty \})$  or in the definition of the normalization operator. We use SGD, the original SAM with no normalization and  $p = 2$ , Fisher-SAM and the following ASAM-variants: elementwise- $\ell_{\infty}$ , layerwise- $\ell_{2}$ , and elementwise- $\ell_{2}$ . For the ViT-experiments, we use AdamW instead of SGD. For each of the ASAM-variants, we normalize both bias and weight parameters and set  $\eta = 0$ . Additionally, we employ the original ASAM-algorithm, where the bias parameters are not normalized and  $\eta = 0.01$ . We train all models on a single GPU for 200 epochs, and m-sharpsness is not employed (unless indicated otherwise). For ResNets, we follow [37] and adopt a learning rate of 0.1, momentum of 0.9, weight decay of 0.0005 and use label smoothing with a factor of 0.1. We use both basic augmentations (random cropping and flipping) and strong augmentations (basic+AutoAugment). For ViTs we use AdamW with learning rate 0.0001, batchsize 64 and only strong augmentations, the other settings remain unchanged. The ResNet results were computed on 2080ti-GPUs and the ViT results on A100s. The values of  $\rho$  we considered for each method can be found in Table 7. The ResNet-networks we considered for the CIFAR-experiments in the main paper are ResNet56 (RN56) [25], ResNeXt-29-32x4d (RNxT) [55], and WideResNet-28-10 (WRN) [59]. We adopted the ViTs to CIFAR by setting the image-size to 32 and patch-size to 4.
Table 7: Search-space for  $\rho$ . The values used for the experiments in Tables 1,3 and 10 are marked in bold.
CIFAR-10 RN	CIFAR-100 RN	CIFAR-10/100 ViT
SAM	all	0.05, 0.1, 0.25	0.05, 0.1, 0.5, 1.	0.025, 0.05, 0.1, 0.25, 0.5
SAM	ON	0.1, 0.5, 1	0.1, 0.5, 1., 5.	1., 2.5, 5., 10., 25
el. l2	all	0.5, 1, 2, 3, 5	0.5, 1, 2.5, 5., 10.	0.5, 1., 2.5, 5, 10
el. l2	ON	0.5, 1, 2, 3, 5	0.5, 1., 2.5, 5., 10.	1., 2.5, 5.,10., 25
el. l2, orig.	all	0.1, 0.5, 1, 5, 10	0.5, 1, 2.5, 5	0.5, 1., 2.5, 5, 10
el. l2, orig.	ON	0.1, 0.5, 1, 5, 10	0.5, 1., 2.5, 5	1., 2.5, 5.,10., 25
el. l∞	all	0.001, 0.005, 0.01, 0.05	0.001, 0.005, 0.01, 0.05	0.0005, 0.001, 0.0025, 0.005, 0.01
el. l∞	ON	0.01, 0.025, 0.05, 0.1	0.01, 0.05, 0.1, 0.5	0.025, 0.05, 0.1, 0.25, 0.5
layer l2	all	0.005, 0.01, 0.025, 0.05, 0.1	0.001, 0.01, 0.05, 0.1	0.001, 0.0025, 0.005, 0.01, 0.025
layer l2	ON	0.05, 0.1, 0.25, 0.5, 1	0.1, 0.2, 0.5, 1.	0.05, 0.1, 0.25, 0.5, 1.
Fisher	all	0.05, 0.1, 0.5, 1.5	0.05, 0.1, 0.5, 1	0.05,5 0.1, 0.5, 1.5
Fisher	ON	0.1, 0.5,1 ,5 ,10	0.1, 0.5,1 ,5 ,10	0.1, 0.5,1 ,5 ,10
A.2 ImageNet training details
Table 8 shows the hyperparameters for all variants used for ImageNet training. For the ResNet-50 with SGD, SAM and elementwise- $\ell_2$  we used the hyperparameters from [23] and [37]. For the layerwise  $\ell_2$  and elementwise- $\ell_{\infty}$  we tried two  $\rho$ -values per configuration and report the results of the better one (named  $\rho$  (reported) in the table).  $\rho$  (discarded) refers to the  $\rho$  value we probed, but found to perform worse than the other one. For the ViT-S (additional fine-tuning experiments in Appendix B.3), we tried at least three values of  $\rho$  per SAM-configuration and reported the best one.
Table 8: Hyperparameters for training on ImageNet. Top: ResNet-50 from scratch, center: ViT-S from scratch, bottom: finetuning the ViT-S.
param	SGD all	SAM all	elem. ℓ2 all onlyNorm	ResNet-50	elem. ℓ∞ all onlyNorm	layer ℓ2 all onlyNorm
train epochs	90
warm-up epochs	3
cool-down epochs	10
batch-size	512
augmentation	inception-style
lr	0.2
lr decay	Cosine
weight decay	0.0001
ρ (reported)	0.05	1	1	0.001	0.005	0.005	0.05
ρ (discarded)	0.01	0.05	0.05	0.5
Input Resolution	224 × 224
m	64
GPU Type	8×2080-ti
param	AdamW all	AdamW+SAM all	onlyNorm	ViT-S scratch	Lion all	Lion+SAM all	onlyNorm
train epochs	300
warm-up epochs	10
cool-down epochs	0
batch-size	128
augmentation	inception-style
lr	0.001
lr decay	Cosine
weight decay	0.1
ρ (reported)	-	1	15	-	1	10
ρ (discarded)	-	0.05,0.1,0.5,2	10,20	-	0.5,2	5,20
Input Resolution m	224 × 224
GPU Type	128
1×A100
param	SGD all	SAM onlyNorm	elem. ℓ2 all	ViT-S FT onlyNorm	elem. ℓ∞ all	layer ℓ2 all	onlyNorm
train epochs	9
warm-up epochs	1
cool-down epochs	0
batch-size	896
augmentation	inception-style
lr	0.017
lr decay	Cosine
weight decay	0.0001
ρ (reported)	-	0.01	0.1	0.1	1	10-4	10-2
ρ (discarded)	0.1	0.01	0.01	0.1	10-3	10-3
ρ (discarded)	0.001	1.	1.	10	10-5	10-4
Input Resolution m	224 × 224
GPU Type	128
7×A100
A.3 SAM variants
Here, we provide a more comprehensive overview of the SAM-variants used throughout the experiments. To this end, we first recall the definition of the (A)SAM-perturbation (Eq. (5) in the main paper):
$$
\epsilon_ {2} = \rho \frac {T _ {w} ^ {2} \nabla L (\mathbf {w})}{| | T _ {w} \nabla L (\mathbf {w}) | | _ {2}} \text {f o r} p = 2, \quad \epsilon_ {\infty} = \rho T _ {w} \operatorname {s i g n} \left(\nabla L (\mathbf {w})\right) \text {f o r} p = \infty .
$$
with the normalization operator  $T_w^i$ , which is diagonal for all variants. We note that SAM-ON can be formally defined as using the conventional (A)SAM-algorithm but setting all entries  $T_w^i = 0$  if  $w_i$  is not a normalization parameter. This leads to a change of the perturbation  $\epsilon$  according to Eq. (5). Importantly, the magnitude of  $\epsilon$  is still  $\rho$ , since both the nominator and the denominator of Eq. (5) change. We provide an overview over all (A)SAM-variants and their respective perturbation models in Table 9.
Table 9: The definition of  $T_w^i$  for the considered SAM-variants.
variant	Tiw	p	η
SAM	all	1	2	0
ON	{1 if wi is a normalization parameter	2	0
0 else
el. l2	all	|wi|	2	0
ON	{|wi| if wi is a normalization parameter	2	0
0 else
el. l2, orig.	all	{|wi| + η if wi is a weight parameter	2	0.01
1 + η if wi is a bias parameter
ON	{|wi| + η if wi is a normalization weight	2	0.01
1 + η if wi is a normalization bias
0 else
el. l∞	all	|wi|	∞	0
ON	{|wi| if wi is a normalization parameter	∞	0
0 else
layer l2	all	||Wlayer[i)||2	2	0
ON	||Wlayer[i]|2 if wi is a normalization parameter	2	0
0 else
Fisher	all	(1 + η (∂wiLBatch(w))2) -0.5	2	1
ON	{ (1 + η (∂wiLBatch(w))2) -0.5 if wi is a normalization parameter	2	1
0 else
B Further Experimental Results
B.1 SAM-ON on CIFAR
We omitted the results for ResNet-like models on CIFAR-10 in the main paper. Those are thus reported in Table 10. Due to the already very high accuracies, the differences between SAM-ON and SAM-all are smaller, yet on average SAM-ON is still clearly the better method. We further plot all considered SAM-variants for different values of  $\rho$  in Figure 6 for a WRN-28 and in Figure 7 for a ViT-S on CIFAR-100. We show results for various VGG-models [47] and DenseNet-100 [30] for CIFAR-10/100 in Table 11 and observe that SAM-ON consistently improves over SAM-all.
B.2 Additional ablation studies for sparse SAM
In this section we provide additional ablation studies for sparsified perturbation approaches as discussed in Section 5.1. Mi et al. [42] proposed two sparsified SAM (SSAM) approaches: Fisher SSAM (SSAM-F) and Dynamic SSAM (SSAM-D). As an extension to Figure 4 for ResNet-18 on CIFAR-10 data in the main paper we provide an accompanying Figure 8 which includes error bars