Adversarially Robust Models may not Transfer Better: Sufficient Conditions for Domain Transferability from the View of Regularization

1 INTRODUCTION . Domain generalization ( or transferability ) is the task of training machine learning models with data from one or more source domains that can be adapted to a target domain , often via lowcost fine-tuning . Thus , domain generalization refers to approaches designed to address the natural data distribution shift problem ( Muandet et al. , 2013 ; Rosenfeld et al. , 2021 ) . A wide array of approaches have been proposed to address domain transferability , including fine-tuning the last layer of DNNs ( Huang et al. , 2018 ) , invariant feature optimization ( Muandet et al. , 2013 ) , efficient model selection for fine-tuning ( You et al. , 2019 ) , and optimal transport based domain adaptation ( Courty et al. , 2016 ) . Improving domain generalization has emerged as an important task in the machine learning community : for instance , it is among the key technologies to enable an autonomous driving vehicle trained in city scenarios to make correct decisions in the countryside as well . On the other hand , robust machine learning aims to tackle the problem of adversarial data distribution shift . Both empirical and certified robust learning approaches have been proposed , such as empirical adversarial training ( Madry et al. , 2018 ) and certified defenses based on deterministic and probabilistic approaches ( Cohen et al. , 2019 ) . As domain transferability and robust machine learning tackle different kinds of data distribution shifts , this work seeks to uncover their underlying connections and tradeoffs . For instance , recent studies suggest that adversarially robust models are more domain transferable ( Salman et al. , 2020 ) , which , in turn , provides new insights on improving domain generalization . However , a theoretical analysis of their relationship is still lacking , and it is unclear whether such positive correlations al- ways hold . In this paper , we take the first steps towards formally analyzing the relationship between model robustness and domain transferability to answer the following questions : What are sufficient conditions for domain transferability ? Is model robustness the cause of domain transferability ? Can robustness and domain transferability be negatively correlated ? To answer the above questions and uncover the underlying relationship between robustness and domain transferability , we propose a general theoretical framework that characterizes sufficient conditions for domain transferability from the view of function class regularization . Our analysis shows that if the function class of feature extractors is more regularized , the model based on a feature extractor trained from the function class , composed with a fine-tuned last layer , can be more transferable . Formally , we prove that there is a monotone relation between the regularization strength and a tight upper bound on the relative domain transfer loss . Under the proposed framework , we analyze several common factors for model training , including the Jacobian norm , the last layer norm , data augmentation , and adversarial training as shown in Fig . 1 . In particular , controlling the Jacobian norm and last layer norm can be viewed as functionclass regularization , thus can be analyzed in our framework . We also analyze how other common regularization operations can be mapped to function class regularization . For instance , we consider noise-dependent and independent data augmentation procedures based on feature average and loss average aggregation algorithms . We conduct extensive experiments on ImageNet ( CIFAR-10 as target domain ) and CIFAR-10 ( SVHN as target domain ) based on different models to verify our analysis . We show that regularization can control domain transferability , and robustness and domain transferability can be negatively correlated , which are counter-examples against Salman et al . ( 2020 ) . Taken together , this indicates that robustness is not a cause of transferability . Technical Contributions . We aim to uncover the underlying relationship between robustness and domain transferability and lay out the sufficient conditions for transferability from the view of regularization . We make both theoretical and empirical contributions . • We propose a theoretical framework to analyze the sufficient conditions for domain transferability from the view of function class regularization . We provably show that stronger regularization on the feature extractor implies a decreased tight upper bound on the relative transferability loss ; while model robustness could be arbitrary . • We prove the tightness of our transferability upper bound , and provide the generalization bound of the relative transferability loss from the view of regularization . • We analyze several factors such as different data augmentations ( e.g. , rotation and Gaussian ) under the framework , and show how they can be mapped to function class regularization and therefore affect transferability . • We conduct extensive experiments on different datasets and model architectures to verify our theoretical claims . We also show several counterexamples that indicate significant negative correlation between robustness and the relative domain transferability . 2 RELATED WORK . Domain Transferability has been analyzed in different settings . Muandet et al . present a generalization bound for classification task based on the properties of the assumed prior over training environments . Rosenfeld et al . model domain transferability/generalization as an online game and show that generalizing beyond the convex hull of training environments is NP-hard , and Zhang et al . provides a generalization bound for distributions with sufficiently small H-divergence . Given the complexity of domain transferability analysis , recent empirical studies show that adversarially robust models transfer better ( Salman et al. , 2020 ) . In this paper , we aim to relax the assumptions and focus on understanding the domain transferability from the view of regularization and theoretically show whether “ robustness ” is indeed a causation for transferability or not . Model Robustness is an important topic given recent diverse adversarial attacks ( Goodfellow et al. , 2014 ; Carlini & Wagner , 2017 ) . These attacks may be launched without access to model parameters ( Tu et al. , 2019 ) or even with the model predicted label alone ( Chen et al. , 2020 ) . Different approaches have been proposed to improve model robustness against adversarial attack . Adversarial training has been shown to be effective empirically ( Madry et al. , 2018 ; Zhang et al. , 2019a ; Miyato et al. , 2018 ) . Some studies have shown that robustness is property related to other model characteristics , such as transferability and invertibility ( Engstrom et al. , 2019 ) . 3 SUFFICIENT CONDITIONS FOR DOMAIN TRANSFERABILITY . In this section , we theoretically analyze the problem of domain transferability from the view of regularization and discuss some sufficient conditions for good transferability . All of the proofs are provided in Section A in the appendix . Notations . We denote the input space as X ; the feature space as Z and the output space as Y . Let the fine-tuning function class be g ∈ G. Given a feature extractor f : X → Z and a fine-tuning function g : Z → Y , the full model is g ◦ f : X → Y . We denote PX×Y as the set of distributions on X × Y . The loss function is denoted by ` : Y × Y → R+ , and the population loss based on data distribution D ∈ PX×Y and a model g ◦ f is defined as ` D ( g ◦ f ) : = E ( x , y ) ∼D [ ` ( g ◦ f ( x ) , y ) ] . Before diving into the details , we first provide the following example to illustrate why one might investigate domain transferability from the view of regularization . 3.1 EXAMPLE : ROBUSTNESS AND TRANSFERABILITY ARE INDEPENDENT . In this subsection , we construct a simple example where domain transferability depends on regularization , yet domain transferability and robustness are independent . Moreover , this example serves as motivation to consider domain transferability from the view of regularization . Given the source and target distributions DS , DT ∈ PX×Y , we denote their marginal distributions on the input space X as DXS and DXT , respectively . We consider the case that X ⊂ Rm being a low-dimensional manifold in Rm , and Y = Rd . Given an input x ∈ X , the ground truth target for the source domain is yS ( x ) generated by a function yS : Rm → Rd . Similarly , we define yT for the target domain . In this example , for simplicity , we neglect the fine-tuning process but directly consider learning a function f : Rm → Rd with a norm ‖ · ‖ on Rd . For the source domain we have the population loss : ` DS ( f ) = Ex∼DXS [ ‖f ( x ) − yS ( x ) ‖ ] . A distribution D ∈ PX on the input space X , defines a norm of a function f : Rm → Rd as ‖f‖D : = Ex∼D [ ‖f ( x ) ‖ ] , where we view two functions f1 , f2 as the same if ‖f1 − f2‖D = 0 . Therefore , we can define the source domain loss ` DS ( f ) = ‖f − yS‖DXS and the target domain loss ` DT ( f ) = ‖f − yT ‖DXT . For the sake of illustration , we consider the simple case where the input distributions DXS , DXT are the same , and hence we denote D = DXS = DXT . Note that yS and yT are different . Denoting a function space F = { f : Rm → Rd | ‖f‖D < ∞ } , we assume that yS , yT ∈ F and we can compare f , yS , yT in the same space . Therefore , given c > 0 as a regularization parameter , the domain transferability problem can be defined as : Learning a source model : fDSc ∈ arg min f∈F ` DS ( f ) , s.t . ‖f‖D ≤ c ; ( 1 ) Testing on a target domain : ` DT ( f DS c ) , where the minimizer fDSc : = yS min { 1 , c‖yS‖D } , the source domain loss is ` DS ( f ) = ‖f − yS‖D , and the target domain loss is ` DT ( f ) = ‖f − yT ‖D . We prove in Proposition 3.1 that fDSc is indeed a minimizer of ( 1 ) and provide an intuitive illustration in Figure 2 . We show that the robustness can be independent to domain transferability as follows . Consider the adversarial robustness of fDSc on an input x ∈ X ( e.g. , maxδ : ‖δ‖2≤ ` ( fDSc ( x + δ ) , yS ( x ) ) ) . Since the transferred loss ` DT ( f DS c ) only evaluates f DS c on X which is a low-dimensional manifold in Rm , an adversarial perturbation δ ∈ Rm could make x + δ ∈ Rm\X when the loss function is sufficiently big outside the manifold X . Therefore , the robustness could be arbitrarily bad without changing the value of ` DT ( f DS c ) , i.e. , the performance of the source model on the target domain . As we can see , the robustness is independent to domain transferability in this example . On the contrary , if we change the perspective to consider the the regularization parameter c , we have the following interesting finding . An illustration of the finding is shown in Figure 2 , and a more formal statement is provided in Proposition 3.1 . Proposition 3.1 . Given the problem defined above , fDSc is a minimizer of equation 1 . If c ≥ c′ ≥ 0 , then the relative domain transferability loss ` DT ( f DS c ) − ` DS ( fDSc ) ≥ ` DT ( f DS c′ ) − ` DS ( f DS c′ ) . We can see that robustness is not sufficient to characterize domain transferability . However , there is a monotone relation between the regularization strength and the relative transferability loss , where adversarial robustness could be arbitrary . Similar behavior is also observed in our experiments , as we will discuss in Section 4 . Naturally , these findings motivate the study of the connections between the regularization of the training process and domain transferability in general , as we consider next .

Summary: This paper discusses a very interesting question: what is the relationship between adversarial robustness and cross-domain transferability. The previous studies show that a more robust model can transfer better. This paper argues that the true reason for the cross-domain transferability is not the adversarial robustness, but the effect of regularization, which can also be achieved through other methods, such as data augmentation.