SlowGuess/NeurIPS_2023_OCR huggingface dataset:
1. Do we need the merging algorithm?
2. If yes, does it work without properly trained embeddings?
We can answer both questions using Table 4. We evaluate robust embeddings both with normal adversarial training and bilevel optimization for different values of the parameter  $\tau$ . For comparison, we also apply the merging algorithm to randomly generated embedding, in order to perform the ablation study for the effect of merging. We see that even merging with small  $\tau$ , significantly improves the robustness, keeping the clean accuracy on a high level for robust embeddings, while for random embeddings it has no effect. Also, we see that, although normal adversarial training has some effect on robust accuracy after embedding transfer, the bilevel optimization algorithm provides the models with a much better robustness accuracy trade-off.
Table 4: Evaluation of the embedding merging algorithm. We report clean and robust accuracy of boosted decision stump classifier on BAF dataset (in percentage) with both random and robust embeddings. For the robust embeddings we evaluate both normal adversarial training, and the bilevel minimization algorithm.  $\tau = 0.0$  means that no merging is performed.
Method	0.0	0.02	0.05	T	0.1	0.15	0.2
Robust Emb. (Bilevel), Clean	74.9	74.5	74.1	71.9	71.6	68.1
Robust Emb. (Bilevel), Robust	48.3	48.3	51.9	61.4	70.9	67.7
Robust Emb. (Normal AT), Clean	74.3	73.5	72.4	71.8	70.8	70.8
Robust Emb. (Normal AT), Robust	48.3	51.5	51.0	55.1	53.3	53.4
Random Embeddings, Clean	74.5	71.9	71.7	71.7	71.7	68.8
Random Embeddings, Robust	49.1	44.8	44.7	44.7	44.7	47.3
C.3 Experiments on FT transformer
In order to show that our approach is not tied to one particular neural network architecture, we performed the same experiments with the more recent FT-Transformer model (Gorishniy et al., 2021). We applied robust embeddings generated for FT-Transformer to the models used in Section 5. The results are shown in Table 5. Overall, we see that FT-Transformer embeddings give better clean and robust performance, and therefore we conclude that our method is also suitable for this type of neural networks.
Table 5: Robust embeddings for FT-Transformer. We evaluate robust embeddings generated with FT-Transformer (RE-FT) (Gorishniy et al., 2021), in the same scenario as for the Table 1.
Model	No Emb.	RE	RE-FT
RF, Clean	72.3	65.8	67.5
RF, Robust	42.8	65.8	67.1
GBS, Clean	74.1	68.1	71.5
GBS, Robust	46.8	67.7	71.5
LGBM, Clean	74.1	68.1	71.4
LGBM, Robust	49.2	67.5	71.4
CB, Clean	74.4	67.2	70.8
CB, Robust	48.2	67.2	70.8
C.4 Effect of embedding transfer for neural networks
In this section, we cover the effect of robust embeddings on the original neural network trained over the clean data. To measure this effect we apply robust embeddings to a TabNet model trained on clean data. The results are reported in Table 6. It shows that the target neural network definitely benefits from this procedure, though the resulting models still have less robustness than models trained with CatPGD 1. We do not propose this technique as an optimal defence since Cat-PGD is available for neural networks, however, it can provide some robustness if adversarial training is not available for some reason (for example due to computational recourses limitation).
Table 6: Embedding Transfer. We evaluate TabNet models trained on clean data with robust embeddings applied to them, in the same setting as we do for the Table 1. We compare its performance with clean models (NN) and models trained with CatPGD (NN-CatPGD).
Model	NN	NN-RE	NN-CatPGD
IEEECIS, Clean	79.0	69.0	74.9
IEEECIS, Robust	40.1	61.9	72.6
BAF, Clean	75.5	69.9	70.9
BAF, Robust	48.3	67.9	70.4
Credit, Clean	83.1	82.1	72.8
Credit, Robust	70.6	71.5	72.6