SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Remark 2. The first term of the bound is the average empirical adversarial robust error of the model on training environments, and the second term is the weighted average discrepancy on the empirical training distributions  $\widehat{\mathfrak{D}} = \{\widehat{\mathcal{D}}_1,\dots ,\widehat{\mathcal{D}}_t\}$ . The third term can be viewed as the distance between  $\mathcal{T}$  and the convex hull Conv( $\mathfrak{D}$ ), which is fixed once the task,  $\ell, \widehat{\mathfrak{D}}$  and  $\mathcal{T}$  are given. Thus, minimizing the first two terms of the bound is able to improve the OOD adversarial robustness.
Moreover,  $\Re_{tn}(\widetilde{\mathcal{G}})$  and  $\Re_n(\widetilde{\mathcal{G}})$  measure the capacity of the model, and can be regarded as an implicit regularizer on the model. There are many existing works that present the upper bounds of the empirical Rademacher complexity for neural networks [49, 6, 7, 23] and the adversarial Rademacher complexity [31, 73, 18, 5, 67]. Their results can be summarized as follows: for bounded  $\mathcal{X}$ , with proper weak assumptions on the loss function  $\ell$ ,  $\Re_n(\widetilde{\mathcal{G}})$  can be upper-bounded by  $\mathcal{O}\left(\frac{C}{\sqrt{n}}\right)$ , where  $C$  is a constant that is related to some norm of the parameters of  $h$  and increases with the norm. Thus, we consider constraints on the norm of the parameters of  $h$  in the algorithm designing part of Section 4.
Last but not least, different from the results in Theorem 3.1, the convergence rate is  $\mathcal{O}\left(\sqrt{\frac{\ln 1 / \delta}{tn}} +\sqrt{\frac{\ln t / \delta}{n}}\right)$ . When  $t = \mathcal{O}(1)$ ,  $\mathcal{O}\left(\sqrt{\frac{\ln t / \delta}{n}}\right)$  in Theorem 3.3 converges much faster
than  $\mathcal{O}\left(\sqrt{\frac{\ln 1 / \delta}{t}}\right)$  in Theorem 3.1, since  $n \gg t$ .
The  $d_{\ell(\mathcal{H})}^{\mathcal{B}}(\mathcal{T}, \mathcal{T}_P)$  term in Theorem 3.3 is determined by the distance between the source and target environments. A larger  $d_{\ell(\mathcal{H})}^{\mathcal{B}}(\mathcal{T}, \mathcal{T}_P)$  may lead to worse adversarial robustness of the model on the target domain. Next, we present a toy example to illustrate this case.
Example 1. We consider the input space  $\mathcal{X} = \mathbb{R}^d\subseteq \mathbb{R}^m$  and label space  $\mathcal{V} = \{+1, - 1\}$ . For simplicity, we consider only three distributions on  $\mathcal{X}\times \mathcal{V}$ , i.e.,  $\mathcal{D}^{(0)},\mathcal{D}^{(1)}$  and  $\mathcal{D}^{(2)}$ . The marginal distributions for  $Y$  satisfy  $\mathcal{D}_Y^{(0)}(\{-1\}) = \mathcal{D}_Y^{(0)}(\{+1\}) = \mathcal{D}_Y^{(1)}(\{-1\}) = \mathcal{D}_Y^{(1)}(\{+1\}) = \mathcal{D}_Y^{(2)}(\{-1\}) = \mathcal{D}_Y^{(2)}(\{+1\}) = \frac{1}{2}$ . For  $\mathcal{D}^{(i)}$ , let the conditional distribution of  $\pmb{X}^{(i)}$  given  $Y$  be  $\pmb {X}^{(i)}|Y = y\sim \mathcal{N}(y\pmb{\mu}^{(i)},\sigma^2 I)$  where  $\pmb{\mu}^{(i)}\in \mathbb{R}^d$  is a non-zero vector and  $\sigma^2 I\in \mathbb{R}^{d\times d}$  is the covariance matrix, i.e., the
Figure 1: An intuitive visualization of the distributions  $\mathcal{D}^{(0)},\mathcal{D}^{(1)},\mathcal{D}^{(2)}$  (red, green, blue respectively). We also represent the three mean vectors  $\pmb {\mu},Q\pmb {\mu},Q^2\pmb{\mu}$  using red, green, and blue arrows. The angle between  $\pmb {\mu},\underline{\pmb{Q}}\pmb{\mu}$  is  $\alpha$  which is the same as the angle between  $Q\pmb {\mu},Q^2\pmb{\mu}$  . More details about the relationship between  $\overline{Q}$  and  $\alpha$  can be found in the proof of Theorem A.4 in Appendix A.1.
elements of  $\pmb{X}^{(i)}$  are independent. Let  $Q$  be a rotation transformation on  $\mathbb{R}^d$ , which is a special orthogonal transformation. Suppose that  $\underline{Q} \neq \underline{I}$ , where  $\underline{I}$  is the identity transformation. Let  $Q \in \mathbb{R}^{d \times d}$  be the matrix of  $Q$  under some orthonormal basis. We then know that  $Q$  is a rotation matrix and  $Q^T Q = Q Q^T = I$ ,  $\operatorname{det}(Q) = 1$ ,  $Q \neq I$ . To model the distributional shift among the environments, we apply the transformation  $Q$  to  $\pmb{\mu}^{(0)}$  and use  $\pmb{\mu}^{(1)} = Q\pmb{\mu}^{(0)}, \pmb{\mu}^{(2)} = Q^2\pmb{\mu}^{(0)}$  as the mean vectors of  $\mathcal{D}^{(1)}, \mathcal{D}^{(2)}$  respectively. Here, we consider the  $\ell_2$ -norm adversarial attack with radius  $\epsilon$ , i.e.,  $\mathcal{B}(\boldsymbol{x}) = \{\boldsymbol{x}' : \| \boldsymbol{x} - \boldsymbol{x}' \|_2 \leq \epsilon\}$ . We use two environments as the training environments and the remainder as the test environment. Theorem 3.4 shows that a larger distance between the training and test environments leads to worse OOD adversarial robustness.
Theorem 3.4. Consider the setting in Example 1, and suppose that  $\pmb{\mu}$  lies in the 2-dimensional subspace  $\Re$  in Theorem A.4 (see Appendix A.1 for details about  $\Re$ , and see Figure 1 for an intuitive visualization). Let  $\ell_{01}(x,y) = \mathbb{1}[x\neq y]$ , where  $\mathbb{1}[\cdot ]$  is the indicator function and  $B_p^r (\pmb {x}) = \{\pmb{x}':\| \pmb {x} - \pmb{x}'\| _p\leq r\}$ . Consider training with hypothesis class  $\mathcal{H} = \{h_{\pmb{w}}:h_{\pmb{w}}(x) = sign(\pmb{w}^T x),\pmb{w}\in \mathbb{R}^d\}$ , and denote  $\mathcal{D}^{(ij)} = \frac{1}{2}\mathcal{D}^{(i)} + \frac{1}{2}\mathcal{D}^{(j)}, i,j\in \{0,1,2\}, i\neq j$ . Consider the  $\ell_2$ -norm adversarial attack with radius  $\epsilon$ ; for notation convenience, let  $\widetilde{\mathcal{R}}_{ij}(\pmb {w}) = \mathcal{R}_{\mathcal{D}^{(ij)}}^{B_\epsilon^2}(\ell_{01},h_{\pmb{w}})$  and  $\widetilde{\mathcal{R}}_i(\pmb {w}) = \mathcal{R}_{\mathcal{D}^{(i)}}^{B_\epsilon^2}(\ell_{01},h_{\pmb{w}})$ . Let  $\Phi (\cdot)$  be the distribution function of the standard normal distribution. Let  $\alpha$  denote the angle between  $\pmb{\mu}$  and  $Q\pmb{\mu}$ , which is the rotation angle of  $Q$  in the subspace  $\Re$ . Furthermore, suppose that  $0 < \alpha \leq \arccos \frac{\epsilon}{\|\pmb{\mu}_1\|_2}$ . We then have:
(1) If we train with  $\mathcal{D}^{(0)}$  and  $\mathcal{D}^{(1)}$ , let  $\pmb{w}_{(01)} = \pmb{\mu} + \underline{Q}\pmb{\mu}$ , which achieves the minimum of  $\widetilde{\mathcal{R}}_{01}(\pmb{w})$ . Then the adversarial accuracy of  $\pmb{w}_{(01)}$  on the test distribution  $\mathcal{D}^{(2)}$  is  $\widetilde{\mathcal{R}}_2(\pmb{w}_{(01)}) = \Phi \left(\frac{\epsilon}{\sigma} - \frac{(\pmb{\mu} + \underline{Q}\pmb{\mu})^T\underline{Q}^2\pmb{\mu}}{\sigma\|\pmb{\mu} + \underline{Q}\pmb{\mu}\|_2}\right)$ .
(2) If we train with  $\mathcal{D}^{(0)}$  and  $\mathcal{D}^{(2)}$ , let  $\boldsymbol{w}_{(02)} = \boldsymbol{\mu} + \underline{Q}^2\boldsymbol{\mu}$ , which achieves the minimum of  $\widetilde{\mathcal{R}}_{02}(\boldsymbol{w})$ . Then the adversarial accuracy of  $\boldsymbol{w}_{(02)}$  on the test distribution  $\mathcal{D}^{(1)}$  is  $\widetilde{\mathcal{R}}_1(\boldsymbol{w}_{(02)}) = \Phi \left(\frac{\epsilon}{\sigma} - \frac{(\boldsymbol{\mu} + \underline{Q}^2\boldsymbol{\mu})^T\underline{Q}\boldsymbol{\mu}}{\sigma\|\boldsymbol{\mu} + \underline{Q}^2\boldsymbol{\mu}\|_2}\right)$ .
(3) If we train with  $\mathcal{D}^{(1)}$  and  $\mathcal{D}^{(2)}$ , let  $\pmb{w}_{(12)} = \underline{\underline{Q}}\pmb{\mu} + \underline{\underline{Q}}^2\pmb{\mu}$ , which achieves the minimum of  $\widetilde{\mathcal{R}}_{12}(\pmb{w})$ . Then the adversarial accuracy of  $\pmb{w}_{(12)}$  on the test distribution  $\mathcal{D}^{(0)}$  is  $\widetilde{\mathcal{R}}_0(\pmb{w}_{(12)}) = \Phi\left(\frac{\epsilon}{\sigma} - \frac{(Q\pmb{\mu} + Q^2\pmb{\mu})^T\pmb{\mu}}{\sigma\|\underline{Q}\pmb{\mu} + Q^2\pmb{\mu}\|_2}\right)$ .
(4)  $\widetilde{\mathcal{R}}_1(\pmb{w}_{(02)}) < \widetilde{\mathcal{R}}_2(\pmb{w}_{(01)}) = \widetilde{\mathcal{R}}_0(\pmb{w}_{(12)}).$
Remark 3. Let  $\{i,j,k\} = \{0,1,2\}$ . For task  $i$ , we use  $\mathcal{D}^{(j)}, \mathcal{D}^{(k)}$  as the training environments and  $\mathcal{D}^{(i)}$  as the test environment.  $\widetilde{\mathcal{R}}_i(\boldsymbol{w}_{(jk)})$  is the target adversarial error of the learned classifier  $\boldsymbol{w}_{(jk)}$  in task  $i$ .
We now consider the distance between the training and test environments for each task. Intuitively, we regard the angle as the "distance" between two distributions. We define  $\text{angle}(i,j)$  as the angle between the mean vector of  $\mathcal{D}^{(i)}$  and  $\mathcal{D}^{(j)}$ ,  $i \neq j$ . For task  $i$ , we define the average "distance" between the test environment and each training environment as  $d_{avg}(i) \coloneqq \frac{\text{angle}(i,j) + \text{angle}(i,k)}{2}$ . We use  $d_{avg}(i)$  as a measure of the distance between the training environments and the test environment for task  $i$ .
From the settings in Example 1, it can be clearly seen that  $d_{avg}(0) = \frac{angle(0,1) + angle(0,2)}{2} = \frac{\alpha + 2\alpha}{2} = \frac{3\alpha}{2} = d_{avg}(2)$  and  $d_{avg}(1) = \frac{angle(1,0) + angle(1,2)}{2} = \frac{\alpha + \alpha}{2} = \alpha$ , which implies that  $d_{avg}(1) < d_{avg}(0) = d_{avg}(2)$ . Theorem 3.4 tells us that  $\widetilde{\mathcal{R}}_1(\boldsymbol{w}_{(02)}) < \widetilde{\mathcal{R}}_0(\boldsymbol{w}_{(12)}) = \widetilde{\mathcal{R}}_2(\boldsymbol{w}_{(01)})$ , and thus implies that a smaller distance between the training and test environments leads to better OOD adversarial robustness.
Moreover, the assumption of the angle between  $\pmb{\mu}$  and  $Q\pmb{\mu}$  in Theorem 3.4 is reasonable. Consider  $\epsilon = \frac{\|\pmb{\mu}\|_2}{2}$ ; in this case, the attack is strong and perceptible to human eyes. Then,  $\alpha \leq \arccos \frac{\epsilon}{\|\pmb{\mu}_1\|_2} = \arccos \frac{1}{2} = \frac{\pi}{3}$ . In this case, the maximal angle between the environments is  $\frac{2\pi}{3}$ , which leads to a strong distribution shift. When  $\epsilon < \frac{\|\pmb{\mu}\|_2}{2}$ , the allowed rotation angle can be further enlarged, and when  $\epsilon = 0$ , it becomes the standard case.
Furthermore, the data distribution here can be regarded as a simplified data model for RotatedMNIST. Moreover, our experimental results in Section 5 are consistent with our analysis here in both the standard and adversarial cases. Please refer to the observation part of Section 5.2 and the table in Appendix D.1 for further details.
In this section, based on our theory, we present two algorithms that can improve the adversarial robustness of the model on the target environment.
4.1 Adversarial Empirical Risk Minimization (AERM or AT)
Based on Theorem 3.1, which shows an upper bound of the average adversarial risk over the environments, we propose our first algorithm: adversarial empirical risk minimization (AERM, which corresponds to applying AT to multiple source domains). The bound in Theorem 3.1 consists of the average adversarial empirical risk  $\mathcal{L}_{\widehat{\mathcal{D}}}^{\mathcal{B}}(\ell,h) = \frac{1}{t}\sum_{i=1}^{t}\mathcal{R}_{\widehat{\mathcal{D}}_i}^{\mathcal{B}}(\ell,h)$  and two empirical Rademacher complexity terms  $\Re_t(\widetilde{\mathcal{G}}) + \Re_{tn}(\widetilde{\mathcal{G}})$ . As outlined in Remark 2, the empirical Rademacher complexity implies an implicit regularizer on the model capacity. We choose  $\|\cdot\|_F$  as a regularizer on the model parameters. The optimization objective of AT is as follows:
$$
L _ {\mathrm {A T}} (h) = \frac {1}{t} \sum_ {i = 1} ^ {t} \mathcal {R} _ {\widehat {\mathcal {D}} _ {i}} ^ {\mathcal {B}} (\ell , h) + \lambda \| W \| _ {F},
$$
where  $\lambda$  is a trade-off hyper-parameter, and  $W$  is the parameter matrix of the model. From Remark 1, we know that AT may not generalize well in the case where the training environments are limited. Next, we propose another algorithm for the limited environment case.
4.2 Robust DANN (RDANN)
Theorem 3.3 shows that  $\Re_n(\widetilde{\mathcal{G}})$ ,  $\frac{1}{t}\sum_{i=1}^{t}\mathcal{R}_{\widehat{\mathcal{D}}_i}^{\mathcal{B}}(\ell,h)$ , and  $\frac{1}{t}\sum_i\sum_j\lambda_j^\star d_{\ell(\mathcal{H})}^{\mathcal{B}}(\widehat{\mathcal{D}}_i,\widehat{\mathcal{D}}_j)$  play the key roles in designing the OOD adversarial training methods. However, the weights  $\lambda_1^\star,\dots,\lambda_t^\star$  are unknown, since we have no information about the target distribution  $\mathcal{T}$ . Since  $\lambda_j^\star \in [0,1],\forall j$ , it is evident that  $\frac{1}{t}\sum_i\sum_j\lambda_j^\star d_{\ell(\mathcal{H})}^{\mathcal{B}}(\widehat{\mathcal{D}}_i,\widehat{\mathcal{D}}_j) \leq \frac{1}{t}\sum_i\sum_jd_{\ell(\mathcal{H})}^{\mathcal{B}}(\widehat{\mathcal{D}}_i,\widehat{\mathcal{D}}_j)$ . We therefore turn to optimize the average discrepancy  $\frac{1}{t^2}\sum_i\sum_jd_{\ell(\mathcal{H})}^{\mathcal{B}}(\widehat{\mathcal{D}}_i,\widehat{\mathcal{D}}_j)$ . To improve the OOD adversarial robustness, we minimize the following:
$$
\frac {1}{t} \sum_ {i = 1} ^ {t} \mathcal {R} _ {\widehat {\mathcal {D}} _ {i}} ^ {\mathcal {B}} (\ell , h) + \lambda_ {1} \frac {1}{t ^ {2}} \sum_ {i = 1} ^ {t} \sum_ {j = 1} ^ {t} d _ {\ell (\mathcal {H})} ^ {\mathcal {B}} (\widehat {\mathcal {D}} _ {i}, \widehat {\mathcal {D}} _ {j}) + \lambda_ {2} \| W \| _ {F},
$$
where  $\lambda_1, \lambda_2$  are two hyper-parameters, and  $W$  is the parameter matrix of the model. However, the term  $\frac{1}{t^2} \sum_{i=1}^{t} \sum_{j=1}^{t} d_{\ell(\mathcal{H})}^B(\widehat{\mathcal{D}}_i, \widehat{\mathcal{D}}_j)$  is a constant. Motivated by [17], we minimize the discrepancy of the training environments in the feature space of a feature extractor  $f$ .
Specifically, we consider  $\mathcal{H} = \{c\circ f|f\in \mathcal{F},c\in \mathcal{C}\}$ ; this means that the predictor  $h$  consists of a classifier  $c$  and a feature extractor  $f$ , where  $\mathcal{F} = \{f:\mathcal{X}\to \mathcal{Z}\}$ ,  $\mathcal{C} = \{c:\mathcal{Z}\to \mathcal{Y}\}$  and  $\mathcal{Z}\subseteq \mathbb{R}^l$  is the feature space. Any feature extractor  $f\in \mathcal{F}$  determines a hypothesis class  $\mathcal{H}_f = \{c\circ f|c\in \mathcal{C}\}$ . Given a feature extractor  $f$ , we apply Theorem 3.3 to the hypothesis class  $\mathcal{H}_f$ . Then with high probability, for any  $c\in \mathcal{C}$ , the target error of  $h = c\circ f$  can be controlled mainly by  $\frac{1}{t}\sum_{i = 1}^{t}\mathcal{R}_{\widehat{\mathcal{D}}_i}^{\mathcal{B}}(\ell ,\infty f)$  and  $\frac{1}{t^2}\sum_{i = 1}^{t}\sum_{j = 1}^{t}d_{\ell (\mathcal{H}_f)}^{\mathcal{B}}(\widehat{\mathcal{D}}_i,\widehat{\mathcal{D}}_j)$ . We then aim to find  $c$  and  $f$  such that  $h = c\circ f$  has good OOD adversarial robustness. Thus, we aim to minimize the following:
$$
\overbrace {\underbrace {\frac {1}{t} \sum_ {i = 1} ^ {t} \mathcal {R} _ {\widehat {\mathcal {D}} _ {i}} ^ {\mathcal {B}} (\ell , c \circ f)} _ {L _ {\mathrm {c l s}} (\ell , c \circ f)} + \lambda_ {1} \underbrace {\frac {1}{t ^ {2}} \sum_ {i = 1} ^ {t} \sum_ {j = 1} ^ {t} d _ {\ell (\mathcal {H} _ {f})} ^ {\mathcal {B}} (\widehat {\mathcal {D}} _ {i} , \widehat {\mathcal {D}} _ {j})} _ {L _ {\mathrm {d i s c}} (\ell , f)} + \lambda_ {2} \| W \| _ {F}}.
$$
To minimize  $L(c \circ f)$ , we need to solve a minimax problem. For simplicity, we fix  $\mathcal{B}(\cdot), \ell$  and define the following:
$$
D (h, P, Q) = \left| \underset {(\boldsymbol {x}, y) \sim P} {\mathbb {E}} \left[ \sup  _ {\boldsymbol {x} ^ {\prime} \in \mathcal {B} (\boldsymbol {x})} \ell (h (\boldsymbol {x} ^ {\prime}), y) \right] - \underset {(\boldsymbol {x}, y) \sim Q} {\mathbb {E}} \left[ \sup  _ {\boldsymbol {x} ^ {\prime} \in \mathcal {B} (\boldsymbol {x})} \ell (h (\boldsymbol {x} ^ {\prime}), y) \right] \right|.
$$
Since  $D(h, P, P) = 0$  and  $D(h, P, Q) = D(h, Q, P)$  for any  $P, Q, h$ , our optimization problem can be formulated as follows:
$$
\min_{c\in \mathcal{C},f\in \mathcal{F}}\max_{c_{ij}\in \mathcal{C}:1\leq i <   j\leq t}L_{\mathrm{cls}}(\ell ,c\circ f) + \lambda_{1}\frac{2}{t(t - 1)}\sum_{1\leq i <   j\leq t}D(c_{ij}\circ f,\widehat{\mathcal{D}}_{i},\widehat{\mathcal{D}}_{j}) + \lambda_{2}\| W\|_{F}.
$$
Table 2: The results  $(\%)$  of the algorithms. Results are presented in the form of a/b: here, a is the OOD adversarial accuracy under PGD-20 attack [44]; and b is the OOD adversarial accuracy under AutoAttack [12]. We conduct the  $\ell_{\infty}$ -norm attack. Since [64] do not realize MAT and LDAT for RotatedMNIST, we use X to denote the unrealized results. Best results for PGD-20 attack are shown in bold. For more details about the algorithms, please refer to Appendix C.1. We use RM, CM, and OH as the abbreviation of RotatedMNIST, ColoredMNIST, and OfficeHome, respectively.
Algorithm	RM	CM	VLCS	PACS	OH	Avg
ERM	0.6/0.0	5.8/X	0.0/0.0	0.3/0.6	0.4/0.0	1.4/X
MLDG	0.2/0.0	4.8/X	0.0/0.0	0.1/0.3	0.6/0.1	1.2/X
CDANN	0.9/0.0	8.2/X	3.0/0.0	1.5/0.3	0.1/0.0	2.7/X
VREx	0.2/0.0	6.4/X	0.0/0.0	0.0/0.3	0.4/0.1	1.4/X
RSC	1.0/0.0	3.9/X	0.0/0.0	0.1/0.4	0.7/0.0	1.1/X
MAT	X/X	10.7/X	0.0/0.0	0.7/1.4	0.8/0.1	X/X
LDAT	X/X	7.9/X	0.0/0.0	0.1/0.3	0.4/0.1	X/X
AT (ours)	93.4/93.3	51.6/X	42.6/41.8	48.1/47.6	30.2/29.8	53.2/X
RDANN (ours)	93.5/93.3	51.1/X	44.9/43.9	48.1/48.0	28.6/27.4	53.3/X
To solve the minimax optimization problem, we adopt an idea similar to that of adversarial neural networks [24] and refer to  $c_{ij}$  as the discriminator. However, there are  $\frac{t(t - 1)}{2}$  discriminators in this case, and training with many discriminators may make the optimization process unstable [3]. We therefore opt to use the same discriminator for all  $(\widehat{\mathcal{D}}_i, \widehat{\mathcal{D}}_j)$  pairs. Note that:
$$
\max  _ {c ^ {\prime} \in \mathcal {C}} \sum_ {i <   j} D \left(c ^ {\prime} \circ f, \widehat {\mathcal {D}} _ {i}, \widehat {\mathcal {D}} _ {j}\right) \leq \max  _ {c _ {i j} \in \mathcal {C}} \sum_ {i <   j} D \left(c _ {i j} \circ f, \widehat {\mathcal {D}} _ {i}, \widehat {\mathcal {D}} _ {j}\right),
$$
such that optimizing over a shared discriminator  $c'$  is equivalent to optimizing a lower bound of the original objective. Our final optimization problem then becomes:
$$
\min_{c\in \mathcal{C},f\in \mathcal{F}}\max_{c^{\prime}\in \mathcal{C}}\underbrace{L_{\mathrm{cls}}(\ell,c\circ f)}_{L_{\mathrm{c}}(w,\theta)} + \lambda_{1}\underbrace{\frac{2}{t(t - 1)}\sum_{1\leq i <   j\leq t}D(c^{\prime}\circ f,\widehat{\mathcal{D}}_{i},\widehat{\mathcal{D}}_{j})}_{L_{\mathrm{d}}(w^{\prime},\theta)} + \lambda_{2}\underbrace{\|W\|_{F}}_{L_{\mathrm{reg}}(w,\theta)}.
$$
where  $w, w', \theta$  are parameters for  $c, c', f$  respectively. We call our method robust adversarial-domain neural network (RDANN), the pseudo-code of which is presented in Algorithm 1.
To verify the adversarial robustness of our algorithms, we conduct experiments on the DomainBed benchmark [26], a testbed for OOD generalization that implements consistent experimental protocols across various approaches to ensure fair comparisons. Our code is attached in the supplementary material.
Datasets. The datasets we use are RotatedMNIST [21], ColoredMNIST [4], VLCS [15], PACS [38], and OfficeHome [62]. There are several different environments in each dataset. For the DomainBed benchmark, we choose one environment as the test environment and use the others as training environments. We report the average accuracy over
different choices of the test environment. Further details about the selected datasets can be found in Appendix C.2.
Backbone network. Following [26], we use a small CNN architecture for RotatedMNIST, ColoredMNIST, and ResNet-50 [27] for VLCS, PACS, and OfficeHome.
Algorithm 1 RDANN
Input: the training data  $\widehat{\mathcal{D}}_1,\dots ,\widehat{\mathcal{D}}_t$  , the number of iterations  $T$  , the number of iterations for the inner maximization problem  $k$  , the learning rate  $\eta$  , the inner max learning rate  $\alpha$  , the tradeoff hyper-parameters  $\lambda_{1},\lambda_{2}$
Output: the parameters  $w^T, \theta^T$  for  $c, f$ .
1: initialize  $w^0, \theta^0, w'^k$  randomly
2: for  $i \gets 0$  to  $T - 1$  do
3: set  $w'^0 \gets w'^k$
4: for  $j\gets 0$  to  $k - 1$  do
5:  $w^{\prime (j + 1)}\gets w^{\prime j} + \alpha \nabla_{w^{\prime}}L_{\mathsf{d}}(w^{\prime j},\theta^{i})$
6: end for
7:  $L_1^i \gets L_{\mathrm{c}}(w^i, \theta^i) + \lambda_2 L_{\mathrm{reg}}(w^i, \theta^i)$
8:  $L_2^i \gets L_1^i + \lambda_1 L_{\mathrm{d}}(w'^k, \theta^i)$
9:  $\theta^{i + 1}\gets \theta^i -\eta \nabla_\theta L_2^i$
0:  $w^{i + 1}\gets w^i -\eta \nabla_w\bar{L}_1^i$
11: end for
Hyper-parameters for adversarial attack and adversarial training. We use  $\ell_{\infty}$ -norm attack for both adversarial attack and adversarial training. We use  $\epsilon = 0.1$  for ColoredMNIST and RotatedMNIST, and  $\epsilon = 4/255$  for VLCS, PACS, and OfficeHome; moreover, following [74, 75], we use PGD-10 to generate adversarial examples at the training stage and PGD-20 at the evaluation stage to avoid overfitting. The step size used to generate adversarial examples is set to be  $\epsilon / 4$ .
More details of the experimental settings can be found in Appendix C.4.
Table 2 presents the results of our experiments. As is clear from the table, our proposed algorithms significantly improve the OOD adversarial robustness of the model. For example, under the attack PGD-20, all other algorithms achieve no more than  $3\%$  average adversarial accuracy, while our proposed algorithms achieve more than  $53\%$  average adversarial accuracy. Moreover, in our datasets, the number of environments  $(t)$  is small. From Table 2, we can see that the overall performance of RDANN is superior to that of AT. RDANN achieves better or comparable adversarial accuracy on most datasets (except OfficeHome). The results are consistent with our claim in Remark 2: when  $t = \mathcal{O}(1)$ , the bound in Theorem 3.3 converges faster than that in Theorem 3.1. The detailed results for each test environment are attached in Appendix D.
Observations. According to the detailed results for RotatedMNIST and ColoredMNIST in Appendix D.1 and Appendix D.2, we can make the following observations (these phenomena occur in both the adversarial training setting and the standard training setting):