SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Table 3: For the CIFAR-100 and ImageNet pretraining datasets, we report clean & robust accuracy, the proportion of images fulfilling the theoretical bound, and, of the images fulfilling the theoretical bound, the proportion of images that are robust for each of the CIFAR-10, Fashion-MNIST and Intel Image downstream tasks.
CIFAR-10	ImageNet
CIFAR-10	F-MNIST	Intel Image	CIFAR-10	F-MNIST	Intel Image
clean accuracy	70.9%	84%	78.5%	92.4%	87.2%	91.2%
robust accuracy	42.2%	56.2%	56.8%	15.8%	0%	85.3%
prop. fulfilled	13.4%	10.1%	26.3%	0.1%	0%	56.2%
rob. fulfilled	100%	100%	100%	100%	-	100%
6 Adversarial Sensitivity Score
In the prior sections, we empirically validated that our theoretical results and required assumptions are realistic and hold in applications. Note that, in both of our results, the robustness of the representation function determines the robustness that transfers to downstream tasks. Specifically, Lemma 1 is stated using the adversarial sensitivity (AS) score of the representation function on a dataset  $\mathbb{X}$ ,
$$
\frac {1}{n} \sum_ {i = 1} ^ {n} \max  _ {\| \delta \| <   \epsilon} \| g _ {\theta} (x _ {i} + \delta) - g _ {\theta} (x _ {i}) \| _ {2}, \tag {2}
$$
to bound the difference between clean and adversarial loss. Before specifying a downstream task, we can compute the representation function's adversarial sensitivity score on a set of unlabeled input images. In the following, we explore how to calibrate expectations on the robustness upon transfer of the representation function via linear probing to a particular downstream task based on the AS score.
6.1 Robustness Transfer via Linear Probing
Here, we explore how the AS score can be used to provide valuable insights on the transferability of robustness with linear probing. In Tab. 4, we find that if the AS score on the unlabeled pretraining and downstream datasets are similarly small, then it is reasonable to expect that robustness will transfer via linear probing. However, if the AS score on the downstream task is much higher, it is reasonable to expect that robustness will not transfer via linear probing.
In Tab. 4, we compare the AS score to the relative difference between clean and robust CE loss on each dataset, i.e., (CE - robust CE)/CE. Indeed, the similar AS scores of CIFAR-100, CIFAR-10, and Intel Image upon pretraining on CIFAR-100 correspond to a successful transfer of robustness, whereas the dissimilar adversarial sensitivity scores of ImageNet, Fashion-MNIST, and CIFAR-10 upon pretraining on ImageNet reflect the striking loss of robustness upon transfer. One explanation for a larger AS score is a shift in distribution between pretraining and downstream data. This connection is confirmed in an additional empirical analysis in Appx. B.5.
Table 4: For the CIFAR-100 and ImageNet pretraining datasets, we report the AS score (Eq. (2)), clean & robust cross-entropy loss, and the relative difference between said losses for the pretraining dataset, as well as the CIFAR-10, Fashion-MNIST and Intel Image downstream tasks.
Pretraining	Downstream	AS score	clean /robust CE	relative dif.
CIFAR-100	CIFAR-100	1.0	2.71 / 3.27	0.21
CIFAR-10	0.98	0.82 / 1.55	0.9
Fashion-MNIST	2.11	0.45 / 1.25	1.8
Intel Image	1.05	0.61 / 1.08	0.76
ImageNet	ImageNet	1.27	1.38 / 1.64	0.19
CIFAR-10	15.7	0.22 / 4.36	18.8
Fashion-MNIST	53.2	0.36 / 9.76	26.1
Intel Image	2.75	0.25 / 0.39	0.57
6.2 Beyond Linear Probing?
In the prior section, we observe a correlation between AS score and the difference between clean and robust CE, i.e., the AS score is predictive of robustness transfer via linear probing. However, linear probing is not the only transfer learning approach, what can we say about alternatives?
In finetuning, the representation function is changed, and thus also the AS score changes post-transfer. Thus, we can expect the AS score computed pre-transfer is less predictive of the downstream robustness for finetuning than for linear probing. To gain a better understanding, we study the difference between clean/robust accuracy for linear probing (LP), full finetuning (FT) as well as linear probing then finetuning (LP-FT) [35], where LP-FT was proposed to combine the benefits of the two approaches. The main results can be found in Tab. 5, and additional details about the experiment are provided in Appx. B.4.
Tab. 5 shows the performance of each transfer learning method applied to the model robustly pretrained on CIFAR-100 or ImageNet. On CIFAR-100, LP preserves the most robust accuracy, whereas LP-FT performs better on ImageNet. Note that the AS score for LP is highlighted, as this is the score we can obtain prior to transfer learning, which allows us to calibrate expectations on downstream performance.
We find no correlation between LP and FT performance, and do not observe a predictive relationship between AS score pre-transfer and robustness transfer via FT. Instead, we observe successful robustness transfer via FT and LP-FT for cases with high AS score pre-transfer. This provides us with a first indication that the adversarial sensitivity score may point to scenarios where FT preserves more robustness downstream than LP.
Significance: If the representation does not change at all in response to  $\epsilon$ -perturbations, it may seem immediately clear that any predictor operating on said representation is robust. However, if the representation function is variant to  $\epsilon$ -perturbations, how much robustness is lost as a result is dependent on the nature of the predictor function under consideration and the distribution shift in the data from pretraining to target task. In this work, we consider a linear predictor, and formally compute the exact effect this function can have on the test-time robustness.
Comparison of the theorems: The theoretical statement in Thm. 1 is closely related to the one in Thm. 2, as a more robust predictor to adversarial attacks leads to a smaller difference in the loss
Table 5: Clean accuracy (Acc) and robust accuracy (RAcc) for the three transfer learning approaches using the model robustly pretrained on CIFAR-100.
CIFAR-100
Method	CIFAR-10	Fashion-MNIST	Intel Image
Acc	RAcc	AS	Acc	RAcc	AS	Acc	RAcc	AS
FT	94.2%	3.9%	8.93	95.1%	40%	6.68	90.1%	7.5%	6.86
LP	70.9%	42.2%	0.98	84%	56.2%	2.11	78.5%	56.8%	1.05
LP-FT	93.9%	1.4%	6.44	95%	36%	4.27	89.2%	27.1%	3.02
ImageNet
Method	CIFAR-10	Fashion-MNIST	Intel Image
Acc	RAcc	AS	Acc	RAcc	AS	Acc	RAcc	AS
FT	98.6%	38.4%	12.6	95.7%	63.5%	9.0	93.9%	85.8%	3.8
LP	92.4%	15.8%	15.7	87.2%	0%	53.2	91.2%	85.3%	2.7
LP-FT	98.5%	44.5%	9.8	95.6%	73.9%	5.1	93.9%	85.9%	3.9
between clean and adversarial examples, and vice versa. Thm. 1 provides a bound on the robustness based on the difference of the loss function, while Thm. 2 only considers the specific form of the classifier and thus information about and restrictions on the used loss function is unnecessary. However, studying the loss function makes Thm. 1 valid in a much broader set of scenarios, and further provides reasoning on why using weight norm regularization during linear probing improves robustness transfer, see Sec. 5.1.
The bound in Thm. 2, on the other hand, provides insights on how robustness of a classifier can be guaranteed. In particular, one could use our results to derive robustness guarantees post-transfer from attacks on the representation function pre-transfer.
**Clarification:** Note that we consider a model  $f$  as a composition of a linear layer and a representation function, i.e.,  $f(x) = W g_{\theta}(x)$ , but do not specify how the parameters of  $f$  are learned. As our motivating example, the representation function  $g_{\theta}$  is optimized on a pretraining task and subsequently  $W$  is trained w.r.t. a downstream task. However, one could also approach the downstream task with the classical strategy of training the model end-to-end instead, i.e., optimizing  $\tilde{W}$  and  $\tilde{\theta}$  simultaneously in  $f_{\tilde{W},\tilde{\theta}} = \tilde{W} g_{\tilde{\theta}}$ , assuming the same architecture as before. The parameters  $\theta, W$  and  $\tilde{\theta}, \tilde{W}$  obtained from the two strategies may be very different. For example, the representation function  $g_{\theta}$  may not be as useful for linearly separating the dataset into  $c$  classes as  $g_{\tilde{\theta}}$ , which was optimized specifically for this task. This observation is described as a task mismatch between pretraining and the supervised downstream task.
Our contributed theoretical results demonstrate that we can study robustness by studying the learned functions themselves, regardless of how said functions were optimized in the first place. With that said, this does not mean that the aforementioned task mismatch does not affect the model's robustness. Thm. 1's bound will loosen if, e.g.,  $g_{\theta}$  does not enable linear separation of the dataset into  $c$  classes, and if the AS score of the representation function increases due to this task mismatch or distribution shift in the data. We provide a study on the impact of the distribution shift in the data on the AS score in Appx. B.5.
Finally, while the linear probing protocol is standard practice [10, 11], alternative methodology exists for leveraging a representation function for a specified downstream task. For one, we could consider a model  $f$  as a composition of a nonlinear function  $h$  and a representation function, i.e.  $f(x) = h \circ g_{\theta}(x)$ , a scenario our theoretical statements do not account for. Furthermore, alternative approaches can include updating the parameters of the representation function  $g_{\theta}$ , e.g., full finetuning. As suggested by the results in Sec. 6.2, while a high AS score may not be predictive of robustness transfer for finetuning, it may instead indicate when finetuning is required to transfer robustness. Overall, the theoretical dependencies between the robustness of the representations and transfer learning alternatives to linear probing present interesting opportunities for future analysis.
We prove two theorems which demonstrate that the robustness of a linear predictor on downstream tasks can be bound by the robustness of its underlying representation. We provide a result applicable to various loss functions and downstream tasks, as well as a more direct result for classification. Our
theoretical insights can be used for analysis when representations are transferred between domains, and sets the stage for carefully studying the robustness of adapting pretrained models.
We thank the ICLR 2022 Diversity, Equity & Inclusion Co-Chairs, Rosanne Liu and Krystal Maughan, for starting the CoSubmitting Summer (CSS) program, through which this collaboration began. We thank the ML Collective community for the ongoing support and feedback of this research. The authors thank the International Max Planck Research School for Intelligent Systems (IMPRS-IS) for supporting YS. This work was supported by the German Federal Ministry of Education and Research (BMBF): Tübingen AI Center, FKZ: 01IS18039A.
[51] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. International Conference on Learning Representations, 2014.
[52] Nilesh Tripuraneni, Michael Jordan, and Chi Jin. On the theory of transfer learning: The importance of task diversity. Advances in Neural Information Processing Systems, 33:7852-7862, 2020.
[53] Eric Wallace, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh. Universal adversarial triggers for attacking and analyzing nlp. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), 2019.
[54] Eric Wong and Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. In International Conference on Machine Learning, pages 5286-5295. PMLR, 2018.
[55] Eric Wong, Leslie Rice, and J. Zico Kolter. Fast is better than free: Revisiting adversarial training. In International Conference on Learning Representations, 2020.
[56] Sen Wu, Hongyang R. Zhang, and Christopher Ré. Understanding and improving information transfer in multi-task learning. In International Conference on Learning Representations, 2020.
[57] Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747, 2017.
[58] Yutaro Yamada and Mayu Otani. Does robustness on imagenet transfer to downstream tasks? In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9215-9224, 2022.
[59] Yao-Yuan Yang, Cyrus Rashtchian, Hongyang Zhang, Russ R Salakhutdinov, and Kamalika Chaudhuri. A closer look at accuracy vs. robustness. Advances in neural information processing systems, 33:8588-8601, 2020.
[60] Fisher Yu, Haofeng Chen, Xin Wang, Wenqi Xian, Yingying Chen, Fangchen Liu, Vashisht Madhavan, and Trevor Darrell. Bdd100k: A diverse driving dataset for heterogeneous multitask learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2636-2645, 2020.
[61] Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In British Machine Vision Conference 2016. British Machine Vision Association, 2016.
[62] Xiaohua Zhai, Joan Puigcerver, Alexander Kolesnikov, Pierre Ruyssen, Carlos Riquelme, Mario Lucic, Josip Djolonga, Andre Susano Pinto, Maxim Neumann, Alexey Dosovitskiy, et al. A large-scale study of representation learning with the visual task adaptation benchmark. arXiv preprint arXiv:1910.04867, 2019.
[63] Jiaming Zhang, Jitao Sang, Qi Yi, Yunfan Yang, Huiwen Dong, and Jian Yu. Imagenet pre-training also transfers non-robustness. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 3436–3444, 2023.
A Proofs and Auxiliary Results
We state two auxiliary results first and subsequently provide the full proofs for Thm. 1 and Thm. 2 in Appx. A.1 and Appx. A.2.
Lemma 2. For a matrix  $W \in \mathbb{R}^{c \times r}$  and a vector  $g \in \mathbb{R}^r$ , the following bounds hold,
1.  $\| Wg\| _2\leq \| W\| _2\| g\| _2$
2.  $\| Wg\| _1\leq \sum_{i = 1}^c\| W_i\| _2\| g\| _2,$
3.  $\| Wg\|_{\infty}\leq \max_{i}\| W_{i}\|_{2}\| g\|_{2}.$
Proof. 1.  $\| Wg\| _2 = \sqrt{\sum_{i = 1}^c(W_i g)^2}\leq \sqrt{\sum_{i = 1}^c(\|W_i\|_2\|g\|_2)^2} = \| W\| _2\| g\| _2$ , where the second step follows by Cauchy-Schwartz inequality.
2.  $\|Wg\|_1 = \sum_{i=1}^c |W_i g| \leq \sum_{i=1}^c \|W_i\|_2 \|g\|_2 = \sum_{i=1}^c \|W_i\|_2 \|g\|_2$ , where the second step follows again by Cauchy-Schwartz inequality.
3.  $\| Wg\|_{\infty} = \max_i|Wig|\leq \max_i\| W_i\| _2\| g\| _2$  , where the second step follows by CauchySchwartz inequality.
The following Lemma proves a Lipschitz condition for the cross-entropy-softmax loss.
Lemma 3. We define the cross-entropy loss with softmax function for a vector  $f \in \mathbb{R}^c$  and a class index  $y \in \{1, \dots, c\}$ , i.e.,
$$
\ell (f, y) := - \log \left(p _ {y} (f)\right) = - \log \left(\frac {\exp \{f _ {y} \}}{\sum_ {i = 1} ^ {c} \exp \{f _ {i} \}}\right).
$$
Then, the following Lipschitz condition holds for  $\ell (f,y)$
$$
\left| \ell (a, y) - \ell (b, y) \right| \leq 2 \| a - b \| _ {\infty},
$$
for any vectors  $a, b \in \mathbb{R}^c$  and an arbitrary class index  $y \in \{1, \dots, c\}$ .
$$
\begin{array}{l} | \ell (a, y) - \ell (b, y) | = | - \log \left(\frac {\exp \{a _ {y} \}}{\sum_ {j = 1} ^ {c} \exp \{a _ {j} \}}\right) + \log \left(\frac {\exp \{b _ {y} \}}{\sum_ {j = 1} ^ {c} \exp \{b _ {j} \}}\right) | \\ = | \log \left(\exp \{b _ {y} - a _ {y} \}\right) - \log \left(\frac {\sum_ {j = 1} ^ {c} \exp \{b _ {j} \}}{\sum_ {j = 1} ^ {c} \exp \{a _ {j} \}}\right) \\ = \left| \left(b _ {y} - a _ {y}\right) - \log \left(\sum_ {j = 1} ^ {c} \frac {\exp \left\{a _ {j} \right\}}{\sum_ {l = 1} ^ {c} \exp \left\{a _ {l} \right\}} \exp \left\{b _ {j} - a _ {j} \right\}\right) \right| \\ \leq \left| \left(b _ {y} - a _ {y}\right) - \sum_ {j = 1} ^ {c} p _ {j} (a) \left(b _ {j} - a _ {j}\right) \right|, \\ \end{array}
$$
where  $p_j(a) \coloneqq \frac{\exp\{a_j\}}{\sum_{l=1}^{c} \exp\{a_l\}}$  denotes the soft-max output of the vector  $a$ . The inequality in the last line follows by Jensen's inequality, since - log is convex and the soft-max probabilities  $p_j$  sum up to one.
$$
\left| \left(b _ {y} - a _ {y}\right) - \sum_ {j = 1} ^ {c} p _ {j} (a) \left(b _ {j} - a _ {j}\right) \right| \leq \left| b _ {y} - a _ {y} \right| + \sum_ {j = 1} ^ {c} p _ {j} (a) \left| b _ {j} - a _ {j} \right| \leq 2 \| b - a \| _ {\infty},
$$
since both summands in the middle can be bounded by the supremum norm.
Proof of Theorem 1. We use Hoeffding's inequality on the independent random variables  $D_{1}, \ldots, D_{n}$ , which are defined as
$$
D_{i}:= \max_{\| \delta \| <  \epsilon}\ell (f(x_{i} + \delta),y_{i}) - \ell (f(x_{i}),y_{i}),
$$
based on independently drawn data points with probability distribution  $\mathcal{P}(\mathcal{X})$ , where the observations are  $x_{i}\in \mathcal{X}$  with corresponding labels  $y_{i}$ . We can use the upper bound on  $\ell$  to obtain that  $0\leq D_{i}\leq C_{2}$  and conclude that
$$
\begin{array}{l} \mathbb {P} \left(\left| \sum_ {i = 1} ^ {n} D _ {i} - n \mathbb {E} [ D ] \right| \geq t\right) \leq 2 \cdot \exp \left(\frac {- 2 t ^ {2}}{n C _ {2} ^ {2}}\right) \\ \Rightarrow \quad \mathbb {P} \left(\left| \frac {1}{n} \sum_ {i = 1} ^ {n} D _ {i} - \mathbb {E} [ D ] \right| \leq C _ {2} \sqrt {\frac {\log (\rho / 2)}{- 2 n}}\right) \geq 1 - \rho . \\ \end{array}
$$
Thus, with probability of at least  $1 - \rho$  it holds that
$$
\begin{array}{l} \mathbb {E} [ D ] = \left| \mathcal {L} _ {\mathrm {a d v}} (f) - \mathcal {L} (f) \right| = \left| \mathbb {E} _ {(x, y)} \left[ \max  _ {| | \delta | | <   \epsilon} \ell (f (x + \delta), y) - \ell (f (x), y) \right] \right| \\ \leq \left| \frac {1}{n} \sum_ {i = 1} ^ {n} \max _ {\| \delta \| <   \epsilon} \ell (f (x _ {i} + \delta), y _ {i}) - \ell (f (x _ {i}), y _ {i}) \right| + C _ {2} \sqrt {\frac {\log (\rho / 2)}{- 2 n}}. \\ \end{array}
$$
We can further bound the first term on the right-hand side, since the loss function  $\ell(r,y)$  is  $C_1$ -Lipschitz in  $\|\cdot\|_{\alpha}$  for  $r \in f(\mathcal{X})$  and  $f(x) = Wg_{\theta}(x)$ .
$$
\begin{array}{l} \left| \frac {1}{n} \sum_ {i = 1} ^ {n} \max  _ {\| \delta \| <   \epsilon} \ell (W g _ {\theta} (x _ {i} + \delta), y _ {i}) - \ell (W g _ {\theta} (x _ {i}), y _ {i}) \right| \\ = \left| \frac {1}{n} \sum_ {i = 1} ^ {n} \left| \ell \left(W g _ {\theta} \left(x _ {i} + \delta_ {i}\right), y _ {i}\right) - \ell \left(W g _ {\theta} \left(x _ {i}\right), y _ {i}\right) \right| \right| \\ \leq C _ {1} \frac {1}{n} \sum_ {i = 1} ^ {n} \| W g _ {\theta} \left(x _ {i} + \delta_ {i}\right) - W g _ {\theta} \left(x _ {i}\right) \| _ {\alpha}, \\ \end{array}
$$
where  $\delta_1, \ldots, \delta_n \in \mathcal{X}$  with  $\| \delta_i \| < \epsilon$  are chosen appropriately. In a next step, we apply Lemma 2 and the definition of  $L_{\alpha}$  in the theorem statement,
$$
C _ {1} \frac {1}{n} \sum_ {i = 1} ^ {n} \| W g _ {\theta} (x _ {i} + \delta_ {i}) - W g _ {\theta} (x _ {i}) \| _ {\alpha} \leq L _ {\alpha} (W) C _ {1} \frac {1}{n} \sum_ {i = 1} ^ {n} \| g _ {\theta} (x _ {i} + \delta_ {i}) - g _ {\theta} (x _ {i}) \| _ {2}.
$$
The  $\delta_{i}$ 's might not be the same that maximize the distance between the representations but their effect can be upper bounded by the maximum. Combining the derived bounds and using that  $g_{\theta}(x_i + \delta_i) \leq \max_{\|\delta\| < \epsilon} g_{\theta}(x_i + \delta)$ , we obtain our result.
$$
\begin{array}{l} \mathcal {L} _ {\mathrm {a d v}} (f) - \mathcal {L} (f) = \left| \mathcal {L} _ {\mathrm {a d v}} (f) - \mathcal {L} (f) \right| \\ \leq L _ {\alpha} (W) C _ {1} \frac {1}{n} \sum_ {i = 1} ^ {n} \max _ {\| \delta \| <   \epsilon} \| g _ {\theta} (x _ {i} + \delta) - g _ {\theta} (x _ {i}) \| _ {2} + C _ {2} \sqrt {\frac {\log (\rho / 2)}{- 2 n}}. \\ \end{array}
$$
Proof of Theorem 2. We want to proof that the classifier  $c(x)$  is robust in  $x \in \mathcal{X}$ , i.e., it holds that  $c(x + \delta) = c(x)$  for all  $\delta \in \mathbb{R}^d$  with  $\| \delta \| < \epsilon$ . The classifier predicts class  $y$ , i.e.,  $c(x) = y$ , if the  $y$ -th value of the model  $f(x)$  is larger than all other entries, i.e.,  $f(x)_y > f(x)_j$  for all  $j \neq y$ . We
denote the  $y$ -th row of the linear layer's matrix  $W$  by  $W_{y}$ , thus  $f(x)_{y} = W_{y}g_{\theta}(x)$ .
For an input  $x$  with  $c(x) = y$ , we want to prove that  $c(x + \delta) = y$  for any  $\delta$  with  $\| \delta \| < \epsilon$ , i.e.,
$$
f (x + \delta) _ {y} > f (x + \delta) _ {j}, \text {i f} f (x) _ {y} > f (x) _ {j}.
$$
$$
f (x + \delta) _ {y} = f (x + \delta) _ {j} + (W _ {j} (g _ {\theta} (x) - g _ {\theta} (x + \delta))) + (W _ {y} g _ {\theta} (x) - W _ {j} g _ {\theta} (x)) + (W _ {y} (g _ {\theta} (x + \delta) - g _ {\theta} (x))).
$$
Thus, for  $f(x + \delta)_{y} > f(x + \delta)_{j}$  to be true, it is necessary that
$$
\begin{array}{l} \left(W _ {j} \left(g _ {\theta} (x) - g _ {\theta} (x + \delta)\right)\right) + \left(W _ {y} g _ {\theta} (x) - W _ {j} g _ {\theta} (x)\right) + \left(W _ {y} \left(g _ {\theta} (x + \delta) - g _ {\theta} (x)\right)\right) \geq 0 \\ \Longleftrightarrow W _ {y} g _ {\theta} (x) - W _ {j} g _ {\theta} (x) \geq \left(W _ {y} - W _ {j}\right) \left(g _ {\theta} (x) - g _ {\theta} (x + \delta)\right)). \tag {3} \\ \end{array}
$$
By Cauchy-Schwartz inequality follows that
$$
\left(W _ {y} - W _ {j}\right) \left(g _ {\theta} (x) - g _ {\theta} (x + \delta)\right) \leq \left| \left(W _ {y} - W _ {j}\right) \left(g _ {\theta} (x) - g _ {\theta} (x + \delta)\right) \right| \leq \| W _ {y} - W _ {j} \| _ {2} \cdot \| g _ {\theta} (x + \delta) - g _ {\theta} (x) \| _ {2}.
$$
Since further  $W_{y}g_{\theta}(x) - W_{j}g_{\theta}(x) = f(x)_{y} - f(x)_{j}$ , the condition of equation (3) holds for any  $j \neq y$  if
$$
f (x) _ {y} - f (x) _ {j} = \left| f (x) _ {y} - f (x) _ {j} \right| \geq \left\| W _ {y} - W _ {j} \right\| _ {2} \cdot \left\| g _ {\theta} (x + \delta) - g _ {\theta} (x) \right\| _ {2}.
$$
For  $c(x + \delta) = c(x)$  to be true, the above condition needs to be true for all  $j\neq y$  and this holds if
$$
\min  _ {j \neq y} \frac {| f (x) _ {y} - f (x) _ {j} |}{\| W _ {y} - W _ {j} \| _ {2}} \geq \max  _ {\| \delta \| <   \epsilon} \| g _ {\theta} (x + \delta) - g _ {\theta} (x) \| _ {2}.
$$
We provide additional information on the datasets used and the employed hyperparameters in Appx. B.1. A further application of Thm. 1 is presented in Appx. B.2, where robustness transfer is analysed for a regression task. In Appx. B.3, we extend the analysis from Sec. 6 by evaluating the robustness against stronger attacks. In Appx. B.4, an empirical study compares the robustness transfer depending on the chosen transfer learning method. Finally, in Appx. B.5, we investigate the effect of a shift in distribution between pretraining and downstream task data on the transferred robustness and the AS score.
B.1 Experimental Setup for Section 5
For our experiments, we consider two models robustly pretrained on CIFAR-100 [34] and ImageNet [17]. CIFAR-100 consists of 32x32 RGB images with 100 different classes. ImageNet-1K consists of 256x256 RGB images of 1,000 different classes.
We investigate the performance of robustness transfer on CIFAR-10 [34], Fashion-MNIST [57] and Intel Image Classification<sup>3</sup>. The CIFAR-10 dataset consists of 32x32 RGB images in 10 classes. Intel Image Classification consists of 150x150 RGB images of 6 natural scenes (buildings, forest, glacier, mountain, sea, and street). Fashion-MNIST is a dataset of Zalando's article images, where each example is a 28x28 grayscale image, associated with a label from 10 classes.