Adversarially Robust Models may not Transfer Better: Sufficient Conditions for Domain Transferability from the View of Regularization

1 INTRODUCTION . Domain generalization ( or transferability ) is the task of training machine learning models with data from one or more source domains that can be adapted to a target domain , often via lowcost fine-tuning . Thus , domain generalization refers to approaches designed to address the natural data distribution shift problem ( Muandet et al. , 2013 ; Rosenfeld et al. , 2021 ) . A wide array of approaches have been proposed to address domain transferability , including fine-tuning the last layer of DNNs ( Huang et al. , 2018 ) , invariant feature optimization ( Muandet et al. , 2013 ) , efficient model selection for fine-tuning ( You et al. , 2019 ) , and optimal transport based domain adaptation ( Courty et al. , 2016 ) . Improving domain generalization has emerged as an important task in the machine learning community : for instance , it is among the key technologies to enable an autonomous driving vehicle trained in city scenarios to make correct decisions in the countryside as well . On the other hand , robust machine learning aims to tackle the problem of adversarial data distribution shift . Both empirical and certified robust learning approaches have been proposed , such as empirical adversarial training ( Madry et al. , 2018 ) and certified defenses based on deterministic and probabilistic approaches ( Cohen et al. , 2019 ) . As domain transferability and robust machine learning tackle different kinds of data distribution shifts , this work seeks to uncover their underlying connections and tradeoffs . For instance , recent studies suggest that adversarially robust models are more domain transferable ( Salman et al. , 2020 ) , which , in turn , provides new insights on improving domain generalization . However , a theoretical analysis of their relationship is still lacking , and it is unclear whether such positive correlations al- ways hold . In this paper , we take the first steps towards formally analyzing the relationship between model robustness and domain transferability to answer the following questions : What are sufficient conditions for domain transferability ? Is model robustness the cause of domain transferability ? Can robustness and domain transferability be negatively correlated ? To answer the above questions and uncover the underlying relationship between robustness and domain transferability , we propose a general theoretical framework that characterizes sufficient conditions for domain transferability from the view of function class regularization . Our analysis shows that if the function class of feature extractors is more regularized , the model based on a feature extractor trained from the function class , composed with a fine-tuned last layer , can be more transferable . Formally , we prove that there is a monotone relation between the regularization strength and a tight upper bound on the relative domain transfer loss . Under the proposed framework , we analyze several common factors for model training , including the Jacobian norm , the last layer norm , data augmentation , and adversarial training as shown in Fig . 1 . In particular , controlling the Jacobian norm and last layer norm can be viewed as functionclass regularization , thus can be analyzed in our framework . We also analyze how other common regularization operations can be mapped to function class regularization . For instance , we consider noise-dependent and independent data augmentation procedures based on feature average and loss average aggregation algorithms . We conduct extensive experiments on ImageNet ( CIFAR-10 as target domain ) and CIFAR-10 ( SVHN as target domain ) based on different models to verify our analysis . We show that regularization can control domain transferability , and robustness and domain transferability can be negatively correlated , which are counter-examples against Salman et al . ( 2020 ) . Taken together , this indicates that robustness is not a cause of transferability . Technical Contributions . We aim to uncover the underlying relationship between robustness and domain transferability and lay out the sufficient conditions for transferability from the view of regularization . We make both theoretical and empirical contributions . • We propose a theoretical framework to analyze the sufficient conditions for domain transferability from the view of function class regularization . We provably show that stronger regularization on the feature extractor implies a decreased tight upper bound on the relative transferability loss ; while model robustness could be arbitrary . • We prove the tightness of our transferability upper bound , and provide the generalization bound of the relative transferability loss from the view of regularization . • We analyze several factors such as different data augmentations ( e.g. , rotation and Gaussian ) under the framework , and show how they can be mapped to function class regularization and therefore affect transferability . • We conduct extensive experiments on different datasets and model architectures to verify our theoretical claims . We also show several counterexamples that indicate significant negative correlation between robustness and the relative domain transferability . 2 RELATED WORK . Domain Transferability has been analyzed in different settings . Muandet et al . present a generalization bound for classification task based on the properties of the assumed prior over training environments . Rosenfeld et al . model domain transferability/generalization as an online game and show that generalizing beyond the convex hull of training environments is NP-hard , and Zhang et al . provides a generalization bound for distributions with sufficiently small H-divergence . Given the complexity of domain transferability analysis , recent empirical studies show that adversarially robust models transfer better ( Salman et al. , 2020 ) . In this paper , we aim to relax the assumptions and focus on understanding the domain transferability from the view of regularization and theoretically show whether “ robustness ” is indeed a causation for transferability or not . Model Robustness is an important topic given recent diverse adversarial attacks ( Goodfellow et al. , 2014 ; Carlini & Wagner , 2017 ) . These attacks may be launched without access to model parameters ( Tu et al. , 2019 ) or even with the model predicted label alone ( Chen et al. , 2020 ) . Different approaches have been proposed to improve model robustness against adversarial attack . Adversarial training has been shown to be effective empirically ( Madry et al. , 2018 ; Zhang et al. , 2019a ; Miyato et al. , 2018 ) . Some studies have shown that robustness is property related to other model characteristics , such as transferability and invertibility ( Engstrom et al. , 2019 ) . 3 SUFFICIENT CONDITIONS FOR DOMAIN TRANSFERABILITY . In this section , we theoretically analyze the problem of domain transferability from the view of regularization and discuss some sufficient conditions for good transferability . All of the proofs are provided in Section A in the appendix . Notations . We denote the input space as X ; the feature space as Z and the output space as Y . Let the fine-tuning function class be g ∈ G. Given a feature extractor f : X → Z and a fine-tuning function g : Z → Y , the full model is g ◦ f : X → Y . We denote PX×Y as the set of distributions on X × Y . The loss function is denoted by ` : Y × Y → R+ , and the population loss based on data distribution D ∈ PX×Y and a model g ◦ f is defined as ` D ( g ◦ f ) : = E ( x , y ) ∼D [ ` ( g ◦ f ( x ) , y ) ] . Before diving into the details , we first provide the following example to illustrate why one might investigate domain transferability from the view of regularization . 3.1 EXAMPLE : ROBUSTNESS AND TRANSFERABILITY ARE INDEPENDENT . In this subsection , we construct a simple example where domain transferability depends on regularization , yet domain transferability and robustness are independent . Moreover , this example serves as motivation to consider domain transferability from the view of regularization . Given the source and target distributions DS , DT ∈ PX×Y , we denote their marginal distributions on the input space X as DXS and DXT , respectively . We consider the case that X ⊂ Rm being a low-dimensional manifold in Rm , and Y = Rd . Given an input x ∈ X , the ground truth target for the source domain is yS ( x ) generated by a function yS : Rm → Rd . Similarly , we define yT for the target domain . In this example , for simplicity , we neglect the fine-tuning process but directly consider learning a function f : Rm → Rd with a norm ‖ · ‖ on Rd . For the source domain we have the population loss : ` DS ( f ) = Ex∼DXS [ ‖f ( x ) − yS ( x ) ‖ ] . A distribution D ∈ PX on the input space X , defines a norm of a function f : Rm → Rd as ‖f‖D : = Ex∼D [ ‖f ( x ) ‖ ] , where we view two functions f1 , f2 as the same if ‖f1 − f2‖D = 0 . Therefore , we can define the source domain loss ` DS ( f ) = ‖f − yS‖DXS and the target domain loss ` DT ( f ) = ‖f − yT ‖DXT . For the sake of illustration , we consider the simple case where the input distributions DXS , DXT are the same , and hence we denote D = DXS = DXT . Note that yS and yT are different . Denoting a function space F = { f : Rm → Rd | ‖f‖D < ∞ } , we assume that yS , yT ∈ F and we can compare f , yS , yT in the same space . Therefore , given c > 0 as a regularization parameter , the domain transferability problem can be defined as : Learning a source model : fDSc ∈ arg min f∈F ` DS ( f ) , s.t . ‖f‖D ≤ c ; ( 1 ) Testing on a target domain : ` DT ( f DS c ) , where the minimizer fDSc : = yS min { 1 , c‖yS‖D } , the source domain loss is ` DS ( f ) = ‖f − yS‖D , and the target domain loss is ` DT ( f ) = ‖f − yT ‖D . We prove in Proposition 3.1 that fDSc is indeed a minimizer of ( 1 ) and provide an intuitive illustration in Figure 2 . We show that the robustness can be independent to domain transferability as follows . Consider the adversarial robustness of fDSc on an input x ∈ X ( e.g. , maxδ : ‖δ‖2≤ ` ( fDSc ( x + δ ) , yS ( x ) ) ) . Since the transferred loss ` DT ( f DS c ) only evaluates f DS c on X which is a low-dimensional manifold in Rm , an adversarial perturbation δ ∈ Rm could make x + δ ∈ Rm\X when the loss function is sufficiently big outside the manifold X . Therefore , the robustness could be arbitrarily bad without changing the value of ` DT ( f DS c ) , i.e. , the performance of the source model on the target domain . As we can see , the robustness is independent to domain transferability in this example . On the contrary , if we change the perspective to consider the the regularization parameter c , we have the following interesting finding . An illustration of the finding is shown in Figure 2 , and a more formal statement is provided in Proposition 3.1 . Proposition 3.1 . Given the problem defined above , fDSc is a minimizer of equation 1 . If c ≥ c′ ≥ 0 , then the relative domain transferability loss ` DT ( f DS c ) − ` DS ( fDSc ) ≥ ` DT ( f DS c′ ) − ` DS ( f DS c′ ) . We can see that robustness is not sufficient to characterize domain transferability . However , there is a monotone relation between the regularization strength and the relative transferability loss , where adversarial robustness could be arbitrary . Similar behavior is also observed in our experiments , as we will discuss in Section 4 . Naturally , these findings motivate the study of the connections between the regularization of the training process and domain transferability in general , as we consider next .

Summary: This paper aims to convey the message that adversarially robust models may not have better transferability in terms of transfer learning in vision tasks. However, this message is unclear due to the mixture of data augmentation, regularization, robustness in the presentation. Some definitions are confusing and the conclusion seems to contradict with existing literature, e.g,  Salman et al arxiv: 2007.08489.  --post rebuttal--  Thanks to the authors for the draft revision and the additional appendix C. Now the paper is clearer to me: the general idea is to say that robustness is a type of regularization, and this regularization is the key to generalization. However, I think the former is not novel as already mentioned in Roth et al NeurIPS 2020. Besides, there are still many presentation issues even after the revision, e.g.: 1) Prop 3.1 mentioned the relative domain transferability, but the formal definition is introduced later in Def 1. 2) The added paragraph is confusing to me. How would you define the input space ${\cal X}$? Is it a compact set? Why would the perturbation go outside ${\cal X}$? Shouldn't $x + \delta$ still be in the domain of $f_c^{{\cal D}_{\cal S}}$ as otherwise it is not well-defined? 3) Def 2 should be compared with existing metrics.  4) In Section 3.4 the authors use the squared loss but in experiments they use cross entropy loss.  Despite the interesting topic, I would keep my current score until a more well-written version is presented.