SlowGuess/NeurIPS_2023_OCR huggingface dataset:
1. When we train with  $S_{1}, S_{3}$ , then the overall  $p_{train} = \frac{0.1 + 0.9}{2} = \frac{1}{2}$ . So according to Theorem B.1 we know that  $w_{sp}(t) = 0$ , which means that the classifier just depends on the invariant feature, so the performance on  $S_{2}$  is good. Since  $w_{sp}(t) = 0$ ,  $L_{1} = L_{2}$ , so we have  $L_{train} = p_{train}L_{1} + (1 - p_{train})L_{2} = \mathbb{E}_{\boldsymbol{x}_{inv}}\hat{D}_{inv}\left[e^{-(\boldsymbol{w}_{im}\boldsymbol{x}_{inv})}\right] = L_{test}$ . So the mixed training distribution here is the same as the test distribution, which means that we can generalize well in this case, which is consistent with our experimental results.
2. When training with  $S_{2}, S_{3}$ , then the overall  $p_{train} = \frac{0.2 + 0.9}{2} = 0.55$ , which is quite close to 0.5, which means that the correlation between  $x_{sp}$  and  $y$  is not very strong. It means that the upper bound and the lower bound in Theorem B.1 is small, so  $w_{sp}$  is small, the classifier mainly depends on the invariant feature and slightly depends on the spurious feature, which is just a little negatively related to  $y$  when  $p_{test} = 0.1$  in the test environment. In this case,  $L_{train} = p_{train}L_{1} + (1 - p_{train})L_{2} = 0.55L_{1} + 0.45L_{2}$  and  $L_{test} = p_{test}L_{1} + (1 - p_{test})L_{2} = 0.1L_{1} + 0.9L_{2}$ , and  $L_{test} - L_{train} = -0.45L_{1} + 0.45L_{2} = 0.45(L_{2} - L_{1}) > 0$ , but in this case  $w_{sp}$  is small, so we have  $L_{2} - L_{1}$  is small according to (B.11), so the difference between training error and test error is not too large, so the generalization performance for this case is not bad, which is consistent with our experimental results.
3. Finally, it comes to the failure case in our experimental results, i.e., using  $S_{1}, S_{2}$  as the training environments and  $S_{3}$  as the test environment. In this case, the overall  $p_{train} =$
$\frac{0.1 + 0.2}{2} = 0.15$ , so the classifier depends more on the spurious features compared with the above two cases, what's more, since  $p_{test} = 0.9$ , the relationship between  $x_{sp}$  and  $y$  is almost reversed when we switch to the test stage, so we have  $L_{train} = p_{train}L_2 + (1 - p_{train})L_1 = 0.85L_1 + 0.15L_2$  and  $L_{test} = p_{test}L_2 + (1 - p_{test})L_1 = 0.1L_1 + 0.9L_2$  and  $L_{test} - L_{train} = -0.75L_1 + 0.75L_2 = 0.75(L_2 - L_1) > 0$ , and the  $w_{sp}$  here is much larger than that in case 2, which means that  $L_2 - L_1$  here is much larger than that in case 2, so the gap between training error and test error here map be much larger than that in case two, leading to the poor generalization performance in practice.
We can see that the analysing results here are consistent with our experimental results for ColoredMNIST in Appendix D.2.
We run each algorithm 20 times and 1 trial (since adversarial training is time-consuming, we just run 1 trial rather than 3 trials as done in DomainBed). We use part of the training data as the validation set to select the best model of the 20 runs according to the adversarial robustness of the training environments. Following DomainBed, we use random hyper-parameters in the 20 runs.
C.1 Attacked Algorithms
1. Empirical Risk Minimization (ERM, [61]) minimizes the errors across domains.
2. Meta-Learning for Domain Generalization (MLDG, [39]) leverages MAML [16] to metalearn how to generalize across domains.
3. Class-conditional DANN (C-DANN, [42]) is a variant of DANN [17] matching the conditional distributions  $\mathbb{P}[\phi(X^d)|Y^d = y]$  across domains, for all labels  $y$ .
4. Risk Extrapolation (VREx, [33]) approximates IRM with a variance penalty.
5. Representation Self-Challenging (RSC, [28]) learns robust neural networks by iteratively discarding (challenging) the most activated features.
6. Domain-wise Multiple-perturbation Adversarial Training (MAT, [64]) use an universal adversarial perturbation (UAP) with low rank along the dimension of examples (for  $n$  examples, use the convex combination of  $k$  ( $k < n$ ) perturbations as the universal perturbation) to conduct universal adversarial training (UAT) to improve the OOD generalization.
7. Adversarial Training with Low-rank Decomposed perturbations(LDAT, [64]) shares similar idea with MAT, but it uses an UAP with low rank along the input space (for  $N \times N$  images, it constrains the  $N \times N$  UAP matrix has rank  $l < N$ ) to conduct universal adversarial training (UAT) to improve the OOD generalization.
We use the following datasets provided by the DomainBed [26]:
1. ColoredMNIST [4] is a variant of the MNIST handwritten digit classification dataset [35]. Domain  $d \in \{0.1, 0.3, 0.9\}$  contains a disjoint set of digits colored either red or blue. The label is a noisy function of the digit and color, such that color bears correlation  $d$  with the label and the digit bears correlation 0.75 with the label. This dataset contains 70000 examples of dimension (2, 28, 28) and 2 classes.
2. RotatedMNIST [21] is a variant of MNIST where domain  $d \in \{0, 15, 30, 45, 60, 75\}$  contains digits rotated by  $d$  degrees. Our dataset contains 70000 examples of dimension (1, 28, 8) and 10 classes.
3. PACS [38] comprises four domains  $d \in \{ \text{art, cartoons, photos, sketches} \}$ . This dataset contains 9991 examples of dimension (3, 224, 224) and 7 classes.
4. VLCS [15] comprises four photographic domains  $d \in \{ \text{Caltech101}, \text{LabelMe}, \text{SUN09}, \text{VOC2007} \}$ . This dataset contains 10729 examples of dimension (3, 224, 224) and 5 classes.
5. OfficeHome [62] includes domains four  $d \in \{ \text{art, clipart, product, real} \}$ . This dataset contains 15588 examples of dimension (3, 224, 224) and 65 classes.
C.3 Settings for attacking standard OOD algorithms
We evaluate the adversarial robustness of some of the algorithms in Table 1. For adversarial attacks, we use  $\ell_{\infty}$  adversarial perturbation upper bound  $\epsilon = 0.1$  for RotatedMNIST and ColoredMNIST,  $\epsilon = 4 / 255$  for others (it is because  $\epsilon = 4 / 255$  is use usually used in  $224\times 224$  colored images); we use the classical FGSM and PGD-20 as the attack methods, for PGD-20, the step size  $\alpha = \epsilon /4$ , we realize the attacks according to the package 'torchattacks' [32].
We train the models in the same hyper-parameter random search setting (except that we just train the model for one trial) in DomainBed, and the we attack the models trained with the best hyperparameters chosen by the training-domain validation set model selection method in DomainBed with the same seed as used during training. For MAT and LDAT, we use the same hyper-parameter random search setting in [64] except that we train with 20 random hyper-parameter for 1 trial and they train with 8 random hyper-parameter for 3 trials.
C.4 Settings for OOD adversarial algorithms
In this subsection, we introduce the settings in our experiments in Section 5. We use the training-domain validation set model selection method in the experiment and train the model with 20 random hyper-parameter for 1 trial.
Basic setting for training hyper-parameter random search.
1. For AT, we use the same basic random search setting as ERM.
2. For RDANN, we use the same basic random search setting as DANN.
Setting for adversarial training. We use PGD-10 as the adversarial attack to generate adversarial examples for adversarial training, with  $\epsilon = 0.1$  for RotatedMNIST and ColoredMNIST and  $\epsilon = 4/255$  for the other  $224 \times 224$  datasets, and we use the attack step size  $\alpha = \epsilon / 4$  as usually done in the adversarial training community.
Setting for evaluating adversarial robustness. We consider two attack methods, FGSM and PGD20, to evaluate the OOD adversarial robustness of the trained models. We use the same  $\epsilon$  as that used for training but we do 20 iterations for PGD in the evaluation stage rather than just 10 iterations in the training stage to avoid overfitting, which is also a strategy used by the adversarial robustness community.
In this section, we show the detailed adversarial robustness of the current OOD generalization algorithms and our proposed algorithms, here we show the adversarial robustness in each test environment, for the ColoredMNIST dataset and RotatedMNIST dataset, we set  $\epsilon = 0.1$ , and for other  $224 \times 224$  datasets, we set  $\epsilon = \frac{4}{255}$ .
In Appendices D.1 to D.3, we use FGSM and PGD-20 as the attacks to evaluate the adversarial robustness and the results are shown in the form of triple tuple (clean accuracy / accuracy under FGSM attack / accuracy under PGD-20 attack). Each column represents the results for a test environment. The tables show that compared with existing methods, our methods (AT and RDANN) significantly improve the adversarial robustness of the model on the target domains.
In Appendix D.6, we use AutoAttack as the attacks to evaluate the adversarial robustness. Each column represents the results for a test environment. The results show that under AutoAttack, all the existing methods fail (no more than  $1\%$  adversarial accuracy), and our methods significantly improves the adversarial robustness.
D.1 RotatedMNIST
Algorithm	0	15	30	45	60	75	Avg
ERM	93.8 / 11.9 / 1.3	98.7 / 10.0 / 1.1	99.2 / 13.5 / 0.5	99.2 / 19.2 / 0.2	99.0 / 19.1 / 0.3	95.8 / 11.8 / 0.2	97.6 / 14.2 / 0.6
MLDG	94.8 / 14.1 / 0.4	98.7 / 15.0 / 0.2	99.1 / 11.8 / 0.0	99.1 / 17.2 / 0.0	98.8 / 15.3 / 0.8	96.7 / 16.9 / 0.0	97.9 / 15.1 / 0.2
CDANN	95.7 / 11.4 / 0.0	98.7 / 12.2 / 2.7	98.8 / 16.1 / 0.5	98.9 / 12.3 / 2.1	98.9 / 16.5 / 0.0	95.9 / 22.9 / 0.3	97.8 / 15.2 / 0.9
VReX	95.1 / 8.3 / 0.3	98.6 / 9.3 / 0.1	98.6 / 11.9 / 0.1	99.0 / 13.4 / 0.0	98.8 / 14.4 / 0.4	96.3 / 9.2 / 0.0	97.7 / 11.1 / 0.2
RSC	95.5 / 11.4 / 1.5	98.4 / 11.3 / 0.0	99.3 / 11.6 / 2.3	99.1 / 12.0 / 0.7	99.0 / 21.6 / 1.0	96.0 / 9.9 / 0.3	97.9 / 13.0 / 1.0
AT	97.0 / 91.8 / 90.8	99.2 / 96.1 / 94.8	99.2 / 96.6 / 95.6	99.0 / 96.3 / 95.4	99.0 / 96.2 / 95.1	97.2 / 90.9 / 88.9	98.4 / 94.7 / 93.4
RDANN	96.1 / 91.5 / 90.8	99.2 / 96.0 / 94.7	99.2 / 96.4 / 95.3	99.2 / 96.7 / 95.6	99.1 / 96.4 / 95.5	97.3 / 91.1 / 89.0	98.4 / 94.7 / 93.5
D.2 ColoredMNIST
Algorithm	+90%	+80%	-90%	Avg
ERM	71.7 / 20.0 / 2.2	72.8 / 29.8 / 5.5	9.8 / 9.8 / 9.8	51.5 / 19.9 / 5.8
MLDG	72.3 / 16.6 / 0.1	73.4 / 29.5 / 5.3	9.7 / 9.5 / 9.0	51.8 / 18.5 / 4.8
CDANN	71.4 / 31.3 / 11.7	72.5 / 29.5 / 4.6	10.0 / 8.9 / 8.1	51.3 / 23.2 / 8.2
VREx	72.9 / 24.3 / 3.7	73.9 / 29.8 / 5.9	10.3 / 10.1 / 9.8	52.3 / 21.4 / 6.4
RSC	72.7 / 36.7 / 1.2	72.9 / 36.3 / 3.7	10.2 / 9.1 / 6.7	51.9 / 27.3 / 3.9
MAT	72.7 / 40.6 / 21.2	73.9 / 27.9 / 1.6	9.9 / 9.6 / 9.3	52.2 / 26.0 / 10.7
LDAT	72.1 / 28.3 / 7.0	72.8 / 36.4 / 7.4	9.7 / 9.5 / 9.3	51.5 / 24.7 / 7.9
AT	73.7 / 72.4 / 72.3	73.7 / 72.6 / 72.5	10.2 / 10.2 / 10.2	52.5 / 51.7 / 51.6
RDANN	73.3 / 72.1 / 72.0	73.2 / 71.8 / 71.7	9.7 / 9.7 / 9.7	52.1 / 51.2 / 51.1
D.3 VLCS
Algorithm	C	L	S	V	Avg
ERM	98.2 / 47.4 / 0.0	62.7 / 21.7 / 0.0	72.1 / 4.4 / 0.0	71.9 / 6.0 / 0.0	76.2 / 19.9 / 0.0
MLDG	98.5 / 50.0 / 0.0	63.5 / 24.3 / 0.0	73.1 / 4.9 / 0.0	79.7 / 10.0 / 0.0	78.7 / 22.3 / 0.0
CDANN	98.1 / 58.4 / 0.0	64.8 / 11.9 / 0.0	74.6 / 10.4 / 0.0	77.1 / 25.8 / 12.1	78.7 / 26.6 / 3.0
VReX	98.4 / 56.2 / 0.0	64.9 / 16.2 / 0.0	69.7 / 2.7 / 0.0	78.4 / 13.6 / 0.0	77.9 / 22.2 / 0.0
RSC	97.9 / 35.7 / 0.0	64.9 / 12.5 / 0.0	75.5 / 3.0 / 0.0	77.8 / 4.3 / 0.0	79.0 / 13.9 / 0.0
MAT	98.9 / 52.7 / 0.0	64.8 / 18.3 / 0.0	68.7 / 2.3 / 0.0	80.7 / 9.5 / 0.0	78.3 / 20.7 / 0.0
LDAT	97.2 / 44.8 / 0.0	65.8 / 20.9 / 0.0	70.8 / 2.9 / 0.0	73.9 / 5.2 / 0.0	76.9 / 18.5 / 0.0
AT	74.2 / 64.8 / 63.5	53.0 / 40.8 / 39.5	47.2 / 36.2 / 34.9	49.6 / 35.1 / 32.4	56.0 / 44.2 / 42.6
RDANN	69.3 / 66.5 / 66.3	53.2 / 43.2 / 42.1	50.3 / 37.7 / 35.5	54.4 / 39.4 / 35.7	56.8 / 46.7 / 44.9
D.4 PACS
Algorithm	A	C	P	S	Avg
ERM	86.8/6.7/0.0	76.1/29.5/0.9	98.1/55.5/0.0	67.9/23.5/0.2	82.2/28.8/0.3
MLDG	86.8/10.3/0.0	75.2/30.0/0.2	97.6/62.5/0.0	76.1/29.6/0.1	83.9/33.1/0.1
CDANN	91.3/18.3/1.0	78.4/31.4/0.3	96.7/53.7/4.0	77.1/31.0/0.6	85.9/33.6/1.5
VREx	86.3/8.1/0.0	80.5/30.0/0.2	98.1/51.2/0.0	68.7/27.0/0.0	83.4/29.1/0.0
RSC	86.2/6.4/0.0	76.4/29.4/0.4	97.5/59.7/0.0	72.2/27.0/0.1	83.1/30.6/0.1
MAT	88.3/11.8/0.0	80.5/33.5/1.1	97.4/57.6/0.1	77.4/32.2/1.5	85.9/33.8/0.7
LDAT	87.2/8.3/0.0	76.1/26.6/0.1	97.8/54.0/0.0	74.0/33.1/0.2	83.8/30.5/0.1
AT	59.8/30.9/24.5	71.4/56.7/54.9	75.7/60.4/57.6	60.1/55.8/55.5	66.7/50.9/48.1
RDANN	63.8/31.8/25.0	63.3/50.5/48.2	76.8/62.3/58.2	68.5/61.8/61.1	68.1/51.6/48.1
D.5 OfficeHome
Algorithm	A	C	P	R	Avg
ERM	62.1/12.6/0.0	52.9/20.9/0.3	76.4/25.7/0.5	76.0/26.3/0.6	66.9/21.4/0.4
MLDG	61.1/13.7/0.6	52.9/22.1/0.7	76.5/25.7/0.3	77.4/24.0/0.9	67.0/21.4/0.6
CDANN	61.8/8.5/0.1	53.5/19.3/0.1	75.8/24.4/0.1	77.6/23.7/0.0	67.2/19.0/0.1
VREx	58.7/8.3/0.0	52.4/20.0/0.1	75.5/22.5/0.7	76.1/23.3/1.0	65.7/18.5/0.4
RSC	59.3/9.1/0.2	52.1/18.3/0.3	75.2/20.5/1.0	74.1/20.6/1.2	65.1/17.1/0.7
MAT	57.3/11.2/0.1	54.0/20.2/0.5	75.2/26.9/0.8	77.4/24.1/1.8	66.0/20.6/0.8
LDAT	61.2/12.9/0.0	52.7/20.6/0.4	74.5/27.9/0.6	78.0/29.5/0.8	66.6/22.7/0.4
AT	29.6/16.4/14.5	44.6/36.4/35.0	53.2/40.9/38.3	53.7/36.1/32.9	45.3/32.4/30.2
RDANN	30.0/17.1/15.3	41.9/33.6/32.1	48.8/38.2/36.3	47.1/33.5/30.8	41.9/30.6/28.6
D.6 Results for AutoAttack
D.6.1 RotatedMNIST
Algorithm	0	15	30	45	60	75	Avg
ERM	0.0	0.0	0.0	0.0	0.0	0.0	0.0
MLDG	0.0	0.0	0.0	0.0	0.0	0.0	0.0
CDANN	0.0	0.0	0.0	0.0	0.0	0.1	0.0
VREx	0.0	0.0	0.0	0.0	0.0	0.0	0.0
RSC	0.0	0.0	0.0	0.0	0.0	0.0	0.0
AT	90.6	94.7	95.5	95.3	95.0	88.6	93.3
RDANN	90.6	94.6	95.2	95.6	95.5	88.6	93.3
D.6.2 VLCS
Algorithm	C	L	S	V	Avg
ERM	0.0	0.0	0.0	0.0	0.0
MLDG	0.0	0.0	0.0	0.0	0.0
CDANN	0.0	0.0	0.0	0.0	0.0
VReX	0.0	0.0	0.0	0.0	0.0
RSC	0.0	0.0	0.0	0.0	0.0
MAT	0.0	0.0	0.0	0.0	0.0
LDAT	0.0	0.0	0.0	0.0	0.0
AT	63.2	38.7	33.9	31.4	41.8
RDANN	65.6	41.1	34.7	34.3	43.9
D.6.3 PACS
Algorithm	A	C	P	S	Avg
ERM	0.0	1.8	0.0	0.7	0.6
MLDG	0.0	0.5	0.0	0.7	0.3
CDANN	0.0	0.6	0.0	0.4	0.3
VREx	0.0	0.5	0.0	0.9	0.3
RSC	0.0	0.9	0.0	0.6	0.4
MAT	0.0	1.5	0.1	4.0	1.4
LDAT	0.0	0.5	0.0	0.9	0.3
AT	23.4	54.7	57.0	55.2	47.6
ADANN	24.5	48.2	58.0	61.1	48.0
D.7 OfficeHome
Algorithm	A	C	P	R	Avg
ERM	0.0	0.0	0.1	0.1	0.0
MLDG	0.0	0.1	0.2	0.1	0.1
CDANN	0.0	0.1	0.0	0.1	0.0
VREx	0.0	0.1	0.2	0.1	0.1
RSC	0.0	0.1	0.1	0.0	0.0
MAT	0.0	0.3	0.2	0.1	0.1
LDAT	0.0	0.0	0.1	0.1	0.1
AT	14.2	34.6	38.1	32.4	29.8
ADANN	14.0	31.5	34.4	29.7	27.4