SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Evaluation Metrics. We evaluate the model using four typical attacks: FGSM [10], PGD [24], C&W [4], and AutoAttack (AA) [8]. For both datasets, the maximum perturbation is set to  $\epsilon = 8 / 255$ , and the perturbation steps for both PGD and C&W are set to 20 following [45]. And following [38], we use the worst-class robustness and NSD to measure the robust fairness of the student model. The average and worst-class robustness of teacher models under the four attacks can be found in Appendix C.1.
4.2 Robustness and Fairness
As shown in Table 2 and Table 3, after applying Fair-ARD, the models have a significant improvement in robust fairness. In addition, in most of the results, there is a slight improvement in the average accuracy and robustness as well. Our method achieves state-of-the-art worst-class robustness under all attacks, surpassing even the worst-class robustness of the teacher model. These results confirm that Fair-ARD outperforms all baseline methods in inheriting robust fairness from the teacher model. Considering that we fine-tune the hyperparameter using ResNet-18 on Fair-ARD, it demonstrates the most significant enhancement, with the worst-class robustness under AA experiencing a substantial
Figure 5: Effects of different  $\beta$  on Fair-ARD using ResNet-18 on CIFAR10. Left:  $\omega$  values under different  $\beta$ . Middle: the average robustness and accuracy of student models using different  $\beta$ . Right: the worst-class robustness and accuracy of student models using different  $\beta$ .
$12.3\%$  improvement. If the hyperparameter were fine-tuned on other fair methods, e.g., Fair-IAD, they could potentially exhibit further improvements.
For MTARD, we observe that while Fair-ARD can improve its robust fairness, it may decrease clean accuracy. This is due to the workflow of MTARD. The student model is simultaneously guided by a clean model and a teacher model, where the weights of these two models sum up to 1. And Fair-ARD aims to enhance robust fairness. Consequently, the robust teacher's weight is potentially increased during the training process, naturally leading to a decrease in the clean teacher's weight, thereby reducing the clean accuracy.
Then, we present the NSD of both the vanilla ARD and Fair-ARD across various models in Fig. 3 and Fig. 4. The results show that Fair-ARD effectively reduces the NSD of the student model, especially in most experimental results where the NSD of the student model even falls below that of the teacher model. This further demonstrates the superiority of our method in enhancing robust fairness.
To obtain a comprehensive understanding of Fair-ARD, we investigate the effect of  $\beta$ . Additional ablation studies on different re-weighting functions and teacher models are presented in Appendix C.8 and C.9, respectively. Specifically, we choose ResNet-18 as the student model and ARD as the baseline method; other settings are the same as in Section 4.1. We first visualize the value of  $\omega$  with different  $\beta$  in the left panel of Fig. 5. With the increase of  $\beta$ , the re-weighting magnitude and the weight gap among classes also increase, and student models will pay more attention to the knowledge of difficult classes.
In the middle and right panels of Fig. 5, we present the average and worst-class performance of the student model obtained with different  $\beta$ , respectively. Note that when  $\beta = 0$ , all classes are considered equally, i.e., Fair-ARD is the same as ARD in this case. We can observe that the average robustness of Fair-ARD is worse than ARD when  $\beta$  is too small. However, when  $\beta > 1$ , Fair-ARD exhibits higher robustness compared to ARD while almost not sacrificing accuracy. Additionally, the worst-class robustness and accuracy of Fair-ARD across various  $\beta$  values surpass those of ARD, highlighting the superiority of our method. In particular, when  $\beta = 2$ , the student model achieves the highest worst-class robustness. Therefore, we adopt this setting in our experiments. Moreover, the worst-class robustness of Fair-ARD initially increases and then decreases as  $\beta$  increases. The reason might be that an excessively large  $\beta$  leads to a significant weight disparity among classes, resulting in unstable training.
In this section, we discuss the differences between our Fair-ARD and related works about (fair) adversarial training with detailed experimental results. More discussions are provided in Appendix C.10.
Table 4: The average (Avg.) and worst-class (Worst) robustness for various algorithms using ResNet-18 on CIFAR-10. The best results are bolded, and the second best results are underlined.
Method	Clean	FGSM	PGD	C&W	AA
Avg.	Worst	Avg.	Worst	Avg.	Worst	Avg.	Worst	Avg.	Worst
ARD	83.22	61.00	58.77	28.10	51.65	21.60	51.25	19.70	49.05	16.90
GAIR-ARD	81.09	65.80	54.04	34.60	50.00	32.60	42.69	20.70	40.88	18.90
FRL-ARD	81.47	61.40	56.90	34.30	50.24	28.60	49.76	26.80	47.84	23.90
FAT-ARD	82.98	65.20	57.62	38.00	51.11	31.00	49.99	29.20	48.22	25.90
CFA-ARD	82.00	62.30	57.68	30.60	52.43	25.00	51.23	22.30	49.73	20.00
Fair-ARD (ours)	82.96	68.10	57.69	39.20	52.05	33.20	50.69	31.00	49.13	29.20
5.1 Comparison with GAIRAT
GAIRAT [41] is an instance-reweighted adversarial training algorithm, and our metric for measuring class difficulty is designed based on the LPS proposed by GAIRAT. We highlight several differences between our Fair-ARD and GAIRAT. Firstly, Fair-ARD focuses on both overall robustness and robust fairness, while GAIRAT only concerns overall robustness. Additionally, GAIRAT can be viewed as finding solutions for each individual example, whereas Fair-ARD seeks solutions for an entire class of examples. Finally, the re-weighting functions of the two are also different: GAIRAT' function is a tanh-type function, while ours is a power function. And the comparison of different re-weighting functions is provided in Appendix C.8.
For a fair comparison, we applied the GAIRAT method to ARD, resulting in a variant we refer to as GAIR-ARD. As shown in Table 4, although GAIR-ARD demonstrates higher worst-class robustness under the PGD attack than ARD, it still does not outperform our Fair-ARD. Furthermore, under the AutoAttack, the average robustness and robust fairness of GAIR-ARD are both significantly lower than our Fair-ARD. Upon investigating the reason, we observed the weights assigned to each example during the training process of GAIR-ARD and found that the disparities among different examples' weights were substantial, even differing by several orders of magnitude. This may lead to subtle gradient masking [3, 16], resulting in a substantial drop in robustness when facing AA. Instead, our Fair-ARD employs a re-weighting function that acts on the classes, and the hyperparameter  $\beta$  can control the re-weighting amplitude within a smaller range. Consequently, Fair-ARD does not suffer from gradient masking, as evidenced by the results under AA.
5.2 Comparison with Robust Fairness Algorithms
FRL [38], FAT [23], and CFA [35] are the state-of-the-art methods for improving the robust fairness of AT. FAT enhances robust fairness by controlling the variance of class-wise adversarial risk, which offers a distinct perspective compared to methods like FRL, CFA, and Fair-ARD. Hence, we mainly focus on comparing our Fair-ARD with both FRL and CFA, as they all employ the re-weighting approach. Firstly, they use different metrics to quantify the class difficulty. FRL and CFA use the class-wise robustness on the validation set, while we utilize the average distance between examples and the decision boundary, which offers a finer granularity, as shown in Fig. 2. Additionally, their re-weighting functions differ from ours. FRL's function is an iterative algorithm based on the difficulty metric, with more than four hyperparameters, and CFA applies a fractional function based on class difficulty, whereas we mainly use power functions for re-weighting. We make more discussions about several types of re-weighting functions in Appendix C.8. Finally, CFA utilizes the exponential moving average (EMA), while FRL and Fair-ARD do not employ it.
To show the advantages of our proposed method compared to FRL, FAT, and CFA, we also employed them in ARD, namely FRL-ARD, FAT-ARD, and CFA-ARD, respectively. The results in Table 4 demonstrate that while FRL and FAT can improve the worst-class robustness of ARD, they also lead to a slight decrease in the average robustness. On the other hand, Fair-ARD outperforms both FRL-ARD and FAT-ARD in terms of both average and worst-class robustness. Most notably, Fair-ARD improves the worst-class robustness under AA by  $5.3\%$  compared to FRL-ARD. This also provides rough evidence that the metric LPS is superior to FED. Regarding CFA, while CFA-ARD outperforms ARD in terms of robust fairness, it falls short when compared to Fair-ARD. This distinction highlights the superiority of Fair-ARD in enhancing robust fairness.
In this paper, we conducted an in-depth investigation into the issue of robust fairness in ARD. We revealed that the student model obtained through ARD fails to fully inherit the robust fairness from the teacher model. We discovered that this issue may arise due to the capacity gap between the teacher and student models, and previous ARD methods treated the knowledge of all classes equally. Based on these observations, we proposed Fair-ARD, which utilizes a refined class difficulty metric from a geometric perspective and a re-weighting strategy for distinct classes to enhance the robust fairness of the student model. Extensive experiments showed that Fair-ARD significantly improves the robust fairness of student models compared to existing methods while maintaining high overall robustness. Our work can help in establishing adversarially robust and fair lightweight deep learning models.
This work was partially supported by the NSFC under Grants U20B2049, U21B2018, and 62302344, and the Fundamental Research Funds for the Central Universities, 2042023kf0122.
[1] Jean-Baptiste Alayrac, Jonathan Uesato, Po-Sen Huang, Alhussein Fawzi, Robert Stanforth, and Pushmeet Kohli. Are labels required for improving adversarial robustness? In NeurIPS, 2019.
[2] Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: a query-efficient black-box adversarial attack via random search. In ECCV, 2020.
[3] Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In ICML, 2018.
[4] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In S&P, 2017.
[5] Jang Hyun Cho and Bharath Hariharan. On the efficacy of knowledge distillation. In ICCV, 2019.
[6] Corinna Cortes and Vladimir Vapnik. Support-vector networks. Machine learning, 1995.
[7] Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with a fast adaptive boundary attack. In ICML, 2020.
[8] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In ICML, 2020.
[9] Micah Goldblum, Liam Fowl, Soheil Feizi, and Tom Goldstein. Adversarily robust distillation. In AAAI, 2020.
[10] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015.
[11] Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03593, 2020.
[12] Moritz Hardt, Eric Price, and Nati Srebro. Equality of opportunity in supervised learning. In NeurIPS, 2016.
[13] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016.
[14] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In ECCV, 2016.
[37] Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. In NeurIPS, 2020.
[38] Han Xu, Xiaorui Liu, Yaxin Li, Anil Jain, and Jiliang Tang. To be robust or to be fair: Towards fairness in adversarial training. In ICML, 2021.
[39] Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In BMVC, 2016.
[40] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML, 2019.
[41] Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan Kankanhalli. Geometry-aware instance-reweighted adversarial training. In ICLR, 2021.
[42] Xiangyu Zhang, Xinyu Zhou, Mengxiao Lin, and Jian Sun. Shufflenet: An extremely efficient convolutional neural network for mobile devices. In CVPR, 2018.
[43] Shiji Zhao, Jie Yu, Zhenlong Sun, Bo Zhang, and Xingxing Wei. Enhanced accuracy and robustness via multi-teacher adversarial distillation. In ECCV, 2022.
[44] Jianing Zhu, Jiangchao Yao, Bo Han, Jingfeng Zhang, Tongliang Liu, Gang Niu, Jingren Zhou, Jianliang Xu, and Hongxia Yang. Reliable adversarial distillation with unreliable teachers. In ICLR, 2021.
[45] Bojia Zi, Shihao Zhao, Xingjun Ma, and Yu-Gang Jiang. Revisiting adversarial robustness distillation: Robust soft labels make student better. In ICCV, 2021.