SlowGuess/NeurIPS_2023_OCR huggingface dataset:
- For RotatedMNIST, we have six environments, each of which corresponds to a rotation angle of the original image. The rotation angle of the  $i$ -th environment is  $i \times 15^\circ$ ,  $i \in \{0, 1, 2, 3, 4, 5\}$ . For task  $i$ , we use the  $i$ -th environment as the test environment and the remaining environments as the training environments. Following Remark 3, we define  $d_{\mathrm{avg}}(i) \coloneqq \frac{1}{5} \sum_{j \neq i} \mathrm{angle}(i,j)$  as the average distance between the test environment and each training environment for task  $i$ . Then,  $d_{\mathrm{avg}}(0) = 45^\circ$ ,  $d_{\mathrm{avg}}(1) = 33^\circ$ ,  $d_{\mathrm{avg}}(2) = 27^\circ$ ,  $d_{\mathrm{avg}}(3) = 27^\circ$ ,  $d_{\mathrm{avg}}(4) = 33^\circ$  and  $d_{\mathrm{avg}}(5) = 45^\circ$ . We define the PGD-20 adversarial accuracy of the model trained by RDANN for task  $i$  as  $a(i)$ ; then,  $a(0) = 90.8$ ,  $a(1) = 94.7$ ,  $a(2) = 95.3$ ,  $a(3) = 95.6$ ,  $a(4) = 95.5$  and  $a(5) = 89.0$ . As  $i$  increases,  $d_{\mathrm{avg}}(i)$  first decreases and then increases, while  $a(i)$  first increases and then decreases. The result indicates that  $d_{\mathrm{avg}}(i)$  is anticorrelated with  $a(i)$ , which is consistent with the analysis in Remark 3. Note that this phenomenon occurs in all algorithms.
- For ColoredMNIST, we have three environments, each of which corresponds to a correlation between the additional channel and the label. For task  $i$ ,  $i \in \{0,1,2\}$ , we define the correlation as  $\operatorname{cor}(i)$  and  $\operatorname{cor}(1) = 0.9$ ,  $\operatorname{cor}(2) = 0.8$ ,  $\operatorname{cor}(3) = -0.9$ . Here, we define  $d_{\mathrm{avg}}(i) = \left| \frac{1}{2} \sum_{j \neq i} \operatorname{cor}(j) - \operatorname{cor}(i) \right|$ , then  $d_{\mathrm{avg}}(1) = 0.95$ ,  $d_{\mathrm{avg}}(2) = 0.8$ ,  $d_{\mathrm{avg}}(3) = 1.75$ . Similarly, we can define  $a(i)$  for a given algorithm. The detailed results in Appendix D.2 imply that  $d_{\mathrm{avg}}(i)$  is anticorrelated with  $a(i)$ . To further understand this phenomenon, we present another toy example for ColoredMNIST with a different data model in Appendix B.
In this paper, we focus specifically on out-of-distribution adversarial robustness. First, we show that existing OOD generalization algorithms are easily fooled by adversarial attacks. Motivated by this, we then study the theory of the adversarial robustness of models in two different but complementary OOD settings. Based on our theory, we propose two algorithms, AT and RDANN. Extensive experiments show that our proposed algorithms can significantly improve the OOD adversarial robustness of the model.
[61] Vladimir Vapnik. Statistical learning theory. Wiley, 1998.
[62] Hemanth Venkateswara, Jose Eusebio, Shayok Chakraborty, and Sethuraman Panchanathan. Deep hashing network for unsupervised domain adaptation. In CVPR, pages 5385-5394, 2017.
[63] Martin J. Wainwright. High-dimensional statistics: A non-asymptotic viewpoint, volume 48. Cambridge University Press, 2019.
[64] Qixun Wang, Yifei Wang, Hong Zhu, and Yisen Wang. Improving out-of-distribution generalization by adversarial training with structured priors. CoRR, abs/2210.06807, 2022.
[65] Zekai Wang and Weiwei Liu. Robustness verification for contrastive learning. In ICML, pages 22865-22883, 2022.
[66] Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan. Better diffusion models further improve adversarial training. In ICML, pages 36246-36263, 2023.
[67] Jiancong Xiao, Yanbo Fan, Ruoyu Sun, and Zhi-Quan Luo. Adversarial rademacher complexity of deep neural networks. CoRR, abs/2211.14966, 2022.
[68] Shiji Xin, Yifei Wang, Jingtong Su, and Yisen Wang. Domain-wise adversarial training for out-of-distribution generalization, 2022.
[69] Jingyuan Xu and Weiwei Liu. On robust multiclass learnability. In NeurIPS, 2022.
[70] Hanshu Yan, Jiawei Du, Vincent Y. F. Tan, and Jiashi Feng. On robustness of neural ordinary differential equations. In ICLR. OpenReview.net, 2020.
[71] Mingyang Yi, Lu Hou, Jiacheng Sun, Lifeng Shang, Xin Jiang, Qun Liu, and Zhiming Ma. Improved OOD generalization via adversarial training and pretraining. In ICML, pages 11987-11997, 2021.
[72] Dong Yin, Kannan Ramchandran, and Peter L. Bartlett. Rademacher complexity for adversari-ally robust generalization. In ICML, volume 97, pages 7085-7094, 2019.
[73] Runtian Zhai, Tianle Cai, Di He, Chen Dan, Kun He, John E. Hopcroft, and Liwei Wang. Adversarily robust generalization just requires more unlabeled data. CoRR, abs/1906.00555, 2019.
[74] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML, volume 97, pages 7472-7482, 2019.
[75] Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan S. Kankanhalli. Attacks which do not kill training make adversarial learning stronger. In ICML, volume 119, pages 11278-11287, 2020.
[76] Yuchen Zhang, Tianle Liu, Mingsheng Long, and Michael I. Jordan. Bridging theory and algorithm for domain adaptation. In ICML, volume 97, pages 7404-7413, 2019.
[77] Zhengyu Zhou and Weiwei Liu. Sample complexity for distributionally robust learning under chi-square divergence. Journal of Machine Learning Research, 24(230):1-27, 2023.
[78] Xin Zou and Weiwei Liu. Generalization bounds for adversarial contrastive learning. Journal of Machine Learning Research, 24:114:1-114:54, 2023.
In this section, we show the proofs of the results in the mainscript.
A.1 Proofs of the Toy Example
Lemma A.1. If  $X \sim \mathcal{N}(\pmb{\mu}, \Sigma)$  where  $X \sim \mathbb{R}^n$ , then for any  $A \in \mathbb{R}^{m \times n}$ , we have:
$$
A X \sim \mathcal {N} (A \boldsymbol {\mu}, A \Sigma A ^ {T})
$$
Proof of Lemma A.1. We prove the lemma by a powerful tool, the characteristic function of random variables. The characteristic function of a random vector  $\mathbf{X}$  is defined as:
$$
\phi_ {\boldsymbol {X}} (\boldsymbol {\omega}) = \mathbb {E} \left[ e ^ {i \boldsymbol {\omega} ^ {T} \boldsymbol {X}} \right]
$$
Let  $\mathbf{Y} = A\mathbf{X}$ , we have:
$$
\phi_ {\boldsymbol {Y}} (\boldsymbol {\omega}) = \mathbb {E} \left[ e ^ {i \boldsymbol {\omega} ^ {T} \boldsymbol {Y}} \right] = \mathbb {E} \left[ e ^ {i \boldsymbol {\omega} ^ {T} (A \boldsymbol {X})} \right] = \mathbb {E} \left[ e ^ {i (A ^ {T} \boldsymbol {\omega}) ^ {T} \boldsymbol {X}} \right] = \phi_ {\boldsymbol {X}} (A ^ {T} \boldsymbol {\omega}).
$$
Since  $X\sim \mathcal{N}(\pmb {\mu},\Sigma)$  , we have:
$$
\phi_ {\boldsymbol {X}} (\boldsymbol {\omega}) = \mathbb {E} \left[ e ^ {i \boldsymbol {\omega} ^ {T} \boldsymbol {X}} \right] = \mathbb {E} \left[ e ^ {i \boldsymbol {\omega} ^ {T} \boldsymbol {\mu} - \frac {1}{2} \boldsymbol {\omega} ^ {T} \boldsymbol {\Sigma} \boldsymbol {\omega}} \right],
$$
so we have:
$$
\phi_ {\boldsymbol {Y}} (\boldsymbol {\omega}) = \mathbb {E} \left[ e ^ {i (A ^ {T} \boldsymbol {\omega}) ^ {T} \boldsymbol {\mu} - \frac {1}{2} (A ^ {T} \boldsymbol {\omega}) ^ {T} \Sigma (A ^ {T} \boldsymbol {\omega})} \right] = \mathbb {E} \left[ e ^ {i \boldsymbol {\omega} ^ {T} (A \boldsymbol {\mu}) - \frac {1}{2} \boldsymbol {\omega} ^ {T} (A \Sigma A ^ {T}) \boldsymbol {\omega}} \right].
$$
Since the characteristic function and the distribution is one-to-one, we have:  $\pmb{Y}$  obeys the multivariable Gaussian distribution and  $\pmb{Y} \sim \mathcal{N}(A\pmb{\mu}, A\Sigma A^T)$ .
Lemma A.2. Let  $\mathcal{D}_Y(Y = 1) = \mathcal{D}_Y(Y = -1) = \frac{1}{2}, X \in \mathbb{R}^d$  and  $\mathcal{D}_{X|Y=y} = \mathcal{N}(y\pmb{\mu}, \Sigma)$  where  $\pmb{\mu} \in \mathbb{R}^d$  and  $\Sigma \in \mathbb{R}^{d \times d}$ , then for any linear classifier  $h_{\pmb{w}} \in \mathcal{H}$ :
$$
\mathcal {R} _ {\mathcal {D}} ^ {B _ {p} ^ {\epsilon}} (\ell_ {0 1}, h _ {\boldsymbol {w}}) = \Phi \left(\frac {\epsilon \| \boldsymbol {w} \| _ {p ^ {*}} - \boldsymbol {w} ^ {T} \boldsymbol {\mu}}{\sqrt {\boldsymbol {w} ^ {T} \Sigma \boldsymbol {w}}}\right),
$$
where  $\frac{1}{p} +\frac{1}{p^*} = 1$ . Further more, if  $p = 2$  and  $\Sigma = \sigma^2 I$ , then  $\boldsymbol{w}^{\star} = \underset {\boldsymbol{w}:h_{\boldsymbol{w}}\in \mathcal{H}}{\arg \min}\mathcal{R}_{\mathcal{D}}^{B^{\epsilon}}(\ell_{01},h_{\boldsymbol{w}})$ , the weight of the most robust  $h_\boldsymbol{w}\in \mathcal{H}$  under adversarial attack  $B_2^\epsilon (\cdot)$  is:
$$
\boldsymbol {w} ^ {\star} = \boldsymbol {\mu}.
$$
Proof of Lemma A.2. Let  $h_{\boldsymbol{w}}(\boldsymbol{x}) = \mathrm{sign}(\boldsymbol{w}^T\boldsymbol{x})$ , then we have:
$$
\begin{array}{l} \mathcal {R} _ {\mathcal {D}} ^ {B _ {p} ^ {\epsilon}} (\ell_ {0 1}, h _ {\boldsymbol {w}}) = \underset {(\boldsymbol {x}, y) \sim \mathcal {D}} {\mathbb {E}} \left\{\sup  _ {\boldsymbol {x} ^ {\prime} \in B _ {p} ^ {\epsilon} (\boldsymbol {x})} \mathbb {1} [ h _ {\boldsymbol {w}} (\boldsymbol {x}) \neq y ] \right\} \\ = \frac {1}{2} \mathbb {E} _ {\boldsymbol {x} \sim \mathcal {D} _ {X | Y = 1}} \left\{\sup  _ {\boldsymbol {x} ^ {\prime} \in B _ {p} ^ {\epsilon} (\boldsymbol {x})} \mathbb {1} \left[ \boldsymbol {w} ^ {T} \boldsymbol {x} ^ {\prime} <   0 \right] \right\} + \frac {1}{2} \mathbb {E} _ {\boldsymbol {x} \sim \mathcal {D} _ {X | Y = - 1}} \left\{\sup  _ {\boldsymbol {x} ^ {\prime} \in B _ {p} ^ {\epsilon} (\boldsymbol {x})} \mathbb {1} \left[ \boldsymbol {w} ^ {T} \boldsymbol {x} ^ {\prime} > 0 \right] \right\} \\ = \frac {1}{2} \mathbb {P} _ {\boldsymbol {x} \sim \mathcal {D} _ {X | Y = 1}} \left\{\inf  _ {\boldsymbol {x} ^ {\prime} \in B _ {p} ^ {\epsilon} (\boldsymbol {x})} \boldsymbol {w} ^ {T} \boldsymbol {x} ^ {\prime} <   0 \right\} + \frac {1}{2} \mathbb {P} _ {\boldsymbol {x} \sim \mathcal {D} _ {X | Y = - 1}} \left\{\sup  _ {\boldsymbol {x} ^ {\prime} \in B _ {p} ^ {\epsilon} (\boldsymbol {x})} \boldsymbol {w} ^ {T} \boldsymbol {x} ^ {\prime} > 0 \right\} \\ = \frac {1}{2} _ {\boldsymbol {x} \sim \mathcal {D} _ {X | Y = 1}} \mathbb {P} \left\{\boldsymbol {w} ^ {T} \boldsymbol {x} - \epsilon \| \boldsymbol {w} \| _ {p ^ {*}} <   0 \right\} + \frac {1}{2} _ {\boldsymbol {x} \sim \mathcal {D} _ {X | Y = - 1}} \mathbb {P} \left\{\boldsymbol {w} ^ {T} \boldsymbol {x} + \epsilon \| \boldsymbol {w} \| _ {p ^ {*}} > 0 \right\} \\ \stackrel {a} {=} \frac {1}{2} \mathbb {P} \left[ \mathcal {N} (\boldsymbol {w} ^ {T} \boldsymbol {\mu}, \boldsymbol {w} ^ {T} \Sigma \boldsymbol {w}) <   \epsilon \| \boldsymbol {w} \| _ {p ^ {*}} \right] + \frac {1}{2} \mathbb {P} \left[ \mathcal {N} (- \boldsymbol {w} ^ {T} \boldsymbol {\mu}, \boldsymbol {w} ^ {T} \Sigma \boldsymbol {w}) > - \epsilon \| \boldsymbol {w} \| _ {p ^ {*}} \right] \\ = \mathbb {P} \left[ \mathcal {N} (\boldsymbol {w} ^ {T} \boldsymbol {\mu}, \boldsymbol {w} ^ {T} \Sigma \boldsymbol {w}) <   \epsilon \| \boldsymbol {w} \| _ {p ^ {*}} \right] = \Phi \left(\frac {\epsilon \| \boldsymbol {w} \| _ {p ^ {*}} - \boldsymbol {w} ^ {T} \boldsymbol {\mu}}{\sqrt {\boldsymbol {w} ^ {T} \Sigma \boldsymbol {w}}}\right), \\ \end{array}
$$
where  $a$  is the result of Lemma A.1 when we regard  $\pmb{w}^T$  as  $A$  in Lemma A.1.
If  $p = 2$  and  $\Sigma = \sigma^2 I$ , then we have:
$$
\mathcal {R} _ {\mathcal {D}} ^ {B _ {2} ^ {\epsilon}} (\ell_ {0 1}, h _ {\boldsymbol {w}}) = \Phi \left(\frac {\epsilon \| \boldsymbol {w} \| _ {2} - \boldsymbol {w} ^ {T} \boldsymbol {\mu}}{\sigma \| \boldsymbol {w} \| _ {2}}\right) = \Phi \left(\frac {\epsilon}{\sigma} - \frac {\boldsymbol {w} ^ {T} \boldsymbol {\mu}}{\sigma \| \boldsymbol {w} \| _ {2}}\right).
$$
Since  $\Phi(\cdot)$  is increasing, we need to minimize  $\frac{\epsilon}{\sigma} - \frac{\boldsymbol{w}^T \boldsymbol{\mu}}{\sigma \| \boldsymbol{w} \|_2}$ , i.e., to maximize  $\frac{\boldsymbol{w}^T \boldsymbol{\mu}}{\sigma \| \boldsymbol{w} \|_2}$ , it's easy to see that the maximum is achieved if we choose  $\boldsymbol{w} = \boldsymbol{\mu}$ , so we have  $\boldsymbol{w}^\star = \boldsymbol{\mu}$ .
Lemma A.3. Let  $\mathcal{D}_1, \mathcal{D}_2$  to be defined as:  $\mathcal{D}_{1,Y}(Y = 1) = \mathcal{D}_{1,Y}(Y = -1) = \mathcal{D}_{2,Y}(Y = -1) = \mathcal{D}_{2,Y}(Y = -1)\frac{1}{2}, X \in \mathbb{R}^d$  and  $\mathcal{D}_{1,X|Y=y} = \mathcal{N}(y\pmb{\mu}_1, \sigma^2 I), \mathcal{D}_{2,X|Y=y} = \mathcal{N}(y\pmb{\mu}_2, \sigma^2 I)$  where  $\pmb{\mu}_1, \pmb{\mu}_2 \in \mathbb{R}^d$ ,  $\|\pmb{\mu}_1\|_2 = \|\pmb{\mu}_2\|_2$  and  $\sigma \in \mathbb{R}_+$ , let  $\mathcal{D} = \frac{1}{2}\mathcal{D}_1 + \frac{1}{2}\mathcal{D}_2$  and suppose  $\alpha$  is the angle between  $\pmb{\mu}_1$  and  $\pmb{\mu}_2$ , if  $0 < \alpha \leq 2$  arccos  $\frac{\epsilon}{\|\pmb{\mu}_1\|_2}$ , then  $\pmb{w}^\star = \pmb{\mu}_1 + \pmb{\mu}_2$  achieves the minimal robust risk.
Proof of Lemma A.3. To simplify the notation, we denote  $\mathcal{R}_{\mathcal{D}}^{B_2^5}(\ell_{01},h_{\boldsymbol{w}})$  by  $\mathcal{R}(\boldsymbol {w})$ . Then by Lemma A.2 we have:
$$
\mathcal {R} (\boldsymbol {w}) = \frac {1}{2} \mathcal {R} _ {\mathcal {D} _ {1}} ^ {B _ {2} ^ {\epsilon}} (\ell_ {0 1}, h _ {\boldsymbol {w}}) + \frac {1}{2} \mathcal {R} _ {\mathcal {D} _ {2}} ^ {B _ {2} ^ {\epsilon}} (\ell_ {0 1}, h _ {\boldsymbol {w}}) = \frac {1}{2} \Phi \left(\frac {\epsilon \| \boldsymbol {w} \| _ {2} - \boldsymbol {w} ^ {T} \boldsymbol {\mu} _ {1}}{\sigma \| \boldsymbol {w} \| _ {2}}\right) + \frac {1}{2} \Phi \left(\frac {\epsilon \| \boldsymbol {w} \| _ {2} - \boldsymbol {w} ^ {T} \boldsymbol {\mu} _ {2}}{\sigma \| \boldsymbol {w} \| _ {2}}\right),
$$
where  $\Phi(u) = \frac{1}{\sqrt{2\pi}} \int_{-\infty}^{u} e^{-\frac{y^2}{2}} dy$ . The proof is divided into two steps. In the first step, we prove that for any weight  $\pmb{w}$ , we have  $\mathcal{R}(\pmb{\mu}_P) \leq \mathcal{R}(\pmb{\mu})$ , where  $\pmb{\mu}_P$  is the project of  $\pmb{\mu}$  onto the space span  $\langle \pmb{\mu}_1, \pmb{\mu}_2 \rangle$ . Then we can reduce our analysis to the weights in the space span  $\langle \pmb{\mu}_1, \pmb{\mu}_2 \rangle$ .
Step 1. For any  $\pmb{w} \in \mathbb{R}^d$ , we take a direct sum decomposition as  $\pmb{w} = \pmb{w}_s + \pmb{w}_t$  where  $\pmb{w}_s \in \operatorname{span}\langle \pmb{\mu}_1, \pmb{\mu}_2 \rangle$  and  $\pmb{w}_t \in \operatorname{span}\langle \pmb{\mu}_1, \pmb{\mu}_2 \rangle^\perp$ , the orthogonal complement space of span  $\langle \pmb{\mu}_1, \pmb{\mu}_2 \rangle$ , then we have:
$$
\boldsymbol {w} ^ {T} \boldsymbol {\mu} _ {1} = \boldsymbol {w} _ {s} ^ {T} \boldsymbol {\mu} _ {1} + \boldsymbol {w} _ {t} ^ {T} \boldsymbol {\mu} _ {1} = \boldsymbol {w} _ {s} ^ {T} \boldsymbol {\mu} _ {1}
$$
Similarly, we have  $\pmb{w}^T\pmb{\mu}_2 = \pmb{w}_s^T\pmb{\mu}_2$ . Since  $\pmb{w}_s \perp \pmb{w}_t$ , then we have  $\| \pmb{w} \|_2^2 = \| \pmb{w}_s \|_2^2 + \| \pmb{w}_t \|_2^2$ , so for any  $\pmb{w} \in \mathbb{R}^d$ , we have:
$$
\begin{array}{l} \mathcal {R} (\boldsymbol {w}) = \frac {1}{2} \Phi \left(\frac {\epsilon}{\sigma} - \frac {\boldsymbol {w} ^ {T} \boldsymbol {\mu} _ {1}}{\sigma \| \boldsymbol {w} \| _ {2}}\right) + \frac {1}{2} \Phi \left(\frac {\epsilon}{\sigma} - \frac {\boldsymbol {w} ^ {T} \boldsymbol {\mu} _ {2}}{\sigma \| \boldsymbol {w} \| _ {2}}\right) \\ = \frac {1}{2} \Phi \left(\frac {\epsilon}{\sigma} - \frac {\boldsymbol {w} _ {s} ^ {T} \boldsymbol {\mu} _ {1}}{\sigma \sqrt {\| \boldsymbol {w} _ {s} \| _ {2} ^ {2} + \| \boldsymbol {w} _ {t} \| _ {2} ^ {2}}}\right) + \frac {1}{2} \Phi \left(\frac {\epsilon}{\sigma} - \frac {\boldsymbol {w} _ {s} ^ {T} \boldsymbol {\mu} _ {2}}{\sigma \sqrt {\| \boldsymbol {w} _ {s} \| _ {2} ^ {2} + \| \boldsymbol {w} _ {t} \| _ {2} ^ {2}}}\right) \\ \end{array}
$$
So it is obvious that  $\mathcal{R}(\boldsymbol{w}_s) \leq \mathcal{R}(\boldsymbol{w})$ .
Step 2. According to the above results, we consider  $\pmb{w} \in \operatorname{span}\langle \pmb{\mu}_1, \pmb{\mu}_2 \rangle$ . Suppose the angle between  $\pmb{\mu}_1, \pmb{\mu}_2$  is  $\alpha$ , note that  $\mathcal{R}(\pmb{w})$  does not depend on the length of  $\pmb{w}$ , so without loss of generality, we assume  $\| \pmb{w} \|_2 = 1$  here. Suppose the angle between  $\pmb{w}$  and  $\pmb{\mu}_1$  is  $\theta$ , then the angle between  $\pmb{w}$  and  $\pmb{\mu}_2$  is  $\alpha - \theta$ , then  $\pmb{w}$  is uniquely determined by  $\theta$ , we denote  $\mathcal{R}(\theta) = \mathcal{R}(\pmb{w})$ , then we have:
$$
\mathcal {R} (\theta) = \frac {1}{2} \Phi \left(\frac {\epsilon}{\sigma} - \frac {\| \boldsymbol {\mu} _ {1} \| _ {2} \cos \theta}{\sigma}\right) + \frac {1}{2} \Phi \left(\frac {\epsilon}{\sigma} - \frac {\| \boldsymbol {\mu} _ {1} \| _ {2} \cos (\alpha - \theta)}{\sigma}\right)
$$
By the rule of derivation for composition function, we have:
$$
\begin{array}{l} \mathcal {R} ^ {\prime} (\theta) = \frac {1}{2 \sqrt {2 \pi}} \exp \left\{- \frac {\left(\epsilon - \| \boldsymbol {\mu} _ {1} \| _ {2} \cos \theta\right) ^ {2}}{2 \sigma^ {2}} \right\} \frac {\| \boldsymbol {\mu} _ {1} \| _ {2}}{\sigma} \sin \theta \\ - \frac {1}{2 \sqrt {2 \pi}} \exp \left\{- \frac {\left(\epsilon - \| \boldsymbol {\mu} _ {1} \| _ {2} \cos (\alpha - \theta)\right) ^ {2}}{2 \sigma^ {2}} \right\} \frac {\| \boldsymbol {\mu} _ {1} \| _ {2}}{\sigma} \sin (\alpha - \theta) \\ = \frac {\left\| \boldsymbol {\mu} _ {1} \right\| _ {2}}{2 \sqrt {2 \pi} \sigma} \left[ \exp \left\{- \frac {\left(\epsilon - \left\| \boldsymbol {\mu} _ {1} \right\| _ {2} \cos \theta\right) ^ {2}}{2 \sigma^ {2}} \right\} \sin \theta \right. \\ \left. - \exp \left\{- \frac {\left(\epsilon - \| \boldsymbol {\mu} _ {1} \| _ {2} \cos (\alpha - \theta)\right) ^ {2}}{2 \sigma^ {2}} \right\} \sin (\alpha - \theta) \right]. \\ \end{array}
$$
It is easy to see that when  $\theta = \frac{\alpha}{2}$  or  $\theta = \frac{\alpha}{2} +\pi$ $\mathcal{R}'(\theta) = 0$  , since:
$$
\begin{array}{l} \mathcal {R} ^ {\prime} \left(\frac {\alpha}{2}\right) = \frac {\| \boldsymbol {\mu} _ {1} \| _ {2}}{2 \sqrt {2 \pi} \sigma} \left[ \exp \left\{- \frac {\left(\epsilon - \| \boldsymbol {\mu} _ {1} \| _ {2} \cos \frac {\alpha}{2}\right) ^ {2}}{2 \sigma^ {2}} \right\} \sin \frac {\alpha}{2} - \exp \left\{- \frac {\left(\epsilon - \| \boldsymbol {\mu} _ {1} \| _ {2} \cos \frac {\alpha}{2}\right) ^ {2}}{2 \sigma^ {2}} \right\} \sin \frac {\alpha}{2} \right] \\ = 0 \\ \end{array}
$$
Similarly we have  $\mathcal{R}'\left(\frac{\alpha}{2} + \pi\right) = 0$ . Next we prove  $\mathcal{R}(\theta)$  achieves the minimum at  $\theta = \frac{\alpha}{2}$ , taking the second order derivation of  $\theta$ , we have:
$$
\begin{array}{l} \frac {2 \sqrt {2 \pi} \sigma}{\| \boldsymbol {\mu} _ {1} \| _ {2}} \mathcal {R} ^ {\prime \prime} (\theta) = \exp \left\{- \frac {(\epsilon - \| \boldsymbol {\mu} _ {1} \| _ {2} \cos \theta) ^ {2}}{2 \sigma^ {2}} \right\} \cdot \left(- \frac {\| \boldsymbol {\mu} _ {1} \| _ {2} (\epsilon - \| \boldsymbol {\mu} _ {1} \| _ {2} \cos \theta) \sin^ {2} \theta}{\sigma^ {2}}\right) \\ + \exp \left\{- \frac {\left(\epsilon - \| \boldsymbol {\mu} _ {1} \| _ {2} \cos \theta\right) ^ {2}}{2 \sigma^ {2}} \right\} \cos \theta \\ - \exp \left\{- \frac {\left(\epsilon - \| \boldsymbol {\mu} _ {1} \| _ {2} \cos (\alpha - \theta)\right) ^ {2}}{2 \sigma^ {2}} \right\} \cdot \left(\frac {\| \boldsymbol {\mu} _ {1} \| _ {2} \left(\epsilon - \| \boldsymbol {\mu} _ {1} \| _ {2} \cos (\alpha - \theta)\right) \sin^ {2} (\alpha - \theta)}{\sigma^ {2}}\right) \\ + \exp \left\{- \frac {(\epsilon - \| \boldsymbol {\mu} _ {1} \| _ {2} \cos (\alpha - \theta)) ^ {2}}{2 \sigma^ {2}} \right\} \cos (\alpha - \theta) \\ = \exp \left\{- \frac {\left(\epsilon - \| \boldsymbol {\mu} _ {1} \| _ {2} \cos \theta\right) ^ {2}}{2 \sigma^ {2}} \right\} \left(\cos \theta - \frac {\| \boldsymbol {\mu} _ {1} \| _ {2} \left(\epsilon - \| \boldsymbol {\mu} _ {1} \| _ {2} \cos \theta\right) \sin^ {2} \theta}{\sigma^ {2}}\right) \\ + \exp \left\{- \frac {(\epsilon - \| \boldsymbol {\mu} _ {1} \| _ {2} \cos (\alpha - \theta)) ^ {2}}{2 \sigma^ {2}} \right\} \left(\cos (\alpha - \theta) - \frac {\| \boldsymbol {\mu} _ {1} \| _ {2} (\epsilon - \| \boldsymbol {\mu} _ {1} \| _ {2} \cos (\alpha - \theta)) \sin^ {2} (\alpha - \theta)}{\sigma^ {2}}\right) \\ \end{array}
$$
$$
\begin{array}{l} \frac {2 \sqrt {2 \pi} \sigma}{\| \boldsymbol {\mu} _ {1} \| _ {2}} \mathcal {R} ^ {\prime \prime} (\frac {\alpha}{2}) = \exp \left\{- \frac {(\epsilon - \| \boldsymbol {\mu} _ {1} \| _ {2} \cos \frac {\alpha}{2}) ^ {2}}{2 \sigma^ {2}} \right\} \left(\cos \frac {\alpha}{2} - \frac {\| \boldsymbol {\mu} _ {1} \| _ {2} (\epsilon - \| \boldsymbol {\mu} _ {1} \| _ {2} \cos \frac {\alpha}{2}) \sin^ {2} \frac {\alpha}{2}}{\sigma^ {2}}\right) \\ + \exp \left\{- \frac {\left(\epsilon - \| \boldsymbol {\mu} _ {1} \| _ {2} \cos \frac {\alpha}{2}\right) ^ {2}}{2 \sigma^ {2}} \right\} \left(\cos \frac {\alpha}{2} - \frac {\| \boldsymbol {\mu} _ {1} \| _ {2} \left(\epsilon - \| \boldsymbol {\mu} _ {1} \| _ {2} \cos \frac {\alpha}{2}\right) \sin^ {2} \frac {\alpha}{2}}{\sigma^ {2}}\right) \\ = \frac {2}{\sigma^ {2}} \exp \left\{- \frac {\left(\epsilon - \| \boldsymbol {\mu} _ {1} \| _ {2} \cos \frac {\alpha}{2}\right) ^ {2}}{2 \sigma^ {2}} \right\} \left(\sigma^ {2} \cos \frac {\alpha}{2} - \| \boldsymbol {\mu} _ {1} \| _ {2} (\epsilon - \| \boldsymbol {\mu} _ {1} \| _ {2} \cos \frac {\alpha}{2}) \sin^ {2} \frac {\alpha}{2}\right) \\ \end{array}
$$
Now, for simplicity, let  $k = \| \pmb{\mu}_1\|_2$ ,  $x = \cos \frac{\alpha}{2}$ , then  $\sin^2 \frac{\alpha}{2} = 1 - x^2$ , then we consider  $f(x) = \sigma^2 x - k(\epsilon - kx)(1 - x^2) = \sigma^2 \cos \frac{\alpha}{2} - \| \pmb{\mu}_1\|_2 (\epsilon - \| \pmb{\mu}_1\|_2 \cos \frac{\alpha}{2}) \sin^2 \frac{\alpha}{2}$ , where  $\alpha \in (0, \pi)$ , so  $x \in (0, 1)$ . We have:
$$
\begin{array}{l} f (x) = \sigma^ {2} x - k (\epsilon - k x) (1 - x ^ {2}) = \sigma^ {2} x - k \epsilon + k ^ {2} x + k \epsilon x ^ {2} - k ^ {2} x ^ {3} \\ = k ^ {2} \left(x - x ^ {3}\right) - k \epsilon \left(1 - x ^ {2}\right) + \sigma^ {2} x = k ^ {2} x \left(1 - x ^ {2}\right) - k \epsilon \left(1 - x ^ {2}\right) + \sigma^ {2} x \\ = k \left(1 - x ^ {2}\right) (k x - \epsilon) + \sigma^ {2} x. \\ \end{array}
$$
Since  $x \in (0,1)$ , then  $\sigma^2 x > 0$  and  $k(1 - x^2) > 0$ , by the assumption,  $0 < \alpha \leq 2$ $\arccos_{\|\pmb{\mu}_1\|_2} \frac{\epsilon}{2} = 2$ $\arccos_{\frac{\epsilon}{k}} \frac{\epsilon}{k}$ , so  $x = \cos \frac{\alpha}{2} \geq \frac{\epsilon}{k}$ , so  $kx - \epsilon \geq 0$ , so we have  $f(x) > 0$ , which means that  $\mathcal{R}''(\frac{\alpha}{2}) > 0$ , so we know that  $\theta = \frac{\alpha}{2}$  achieves the minimum of  $\mathcal{R}(\theta)$ , which means that the direction  $\pmb{w}^\star = \pmb{\mu}_1 + \pmb{\mu}_2$  achieves the minimum of  $\mathcal{R}(\pmb{w})$ . Similarly we can show that  $\mathcal{R}(\theta)$  achieves its maximum at  $\theta = \frac{\alpha}{2} + \pi$ , which means that the direction  $-( \pmb{\mu}_1 + \pmb{\mu}_2)$  achieves the maximum of  $\mathcal{R}(\pmb{w})$  in span  $\langle \pmb{\mu}_1, \pmb{\mu}_2 \rangle$ .