Improving Hierarchical Adversarial Robustness of Deep Neural Networks
Authors: Avery Ma
Aladin Virmaux
Kevin Scaman
Juwei Lu
Venue:  (2021)
Keywords: Adversarial Robustness

Abstract: Do all adversarial examples have the same consequences? An autonomous driving system misclassifying a pedestrian as a car may induce a far more dangerous --and even potentially lethal-- behavior than, for instance, a car as a bus. In order to better tackle this important problematic, we introduce the concept of hierarchical adversarial robustness. Given a dataset whose classes can be grouped into coarse-level labels, we define hierarchical adversarial examples as the ones leading to a misclassification at the coarse level. To improve the resistance of neural networks to hierarchical attacks, we introduce a hierarchical adversarially robust (HAR) network design that decomposes a single classification task into one coarse and multiple fine classification tasks, before being specifically trained by adversarial defense techniques. As an alternative to an end-to-end learning approach, we show that HAR significantly improves the robustness of the network against $\ell_{\infty}$  and $\ell_{2}$bounded hierarchical attacks on CIFAR-100.

Under review as a conference paper at ICLR 2021
IMPROVING HIERARCHICAL ADVERSARIAL ROBUST- NESS OF DEEP NEURAL NETWORKS
Anonymous authors Paper under double-blind review
ABSTRACT
Do adversarial examples have the same consequences? An autonomous driv- ing system misclassifying a pedestrian as a may induce a far more dangerous and even potentially behavior than, for instance, a car as a bus. In order to better tackle this important problematic, chical adversarial robustness. Given a dataset whose classes can be grouped into coarse-level labels, we define hierarchical adversarial examples the ones lead- ing to a misclassification at the coarse level. To improve the resistance neural networks to hierarchical attacks, we introduce a hierarchical adversarially robust (HAR) network design that decomposes single classification task into one coarse and multiple fine classification tasks, before being specifically trained by adver- sarial defense techniques. As an alternative to an end-to-end learning approach, we show that HAR significantly improves the robustness of the network against l and fxx bounded hierarchical attacks on the CIFAR-100 dataset.
introduce the concept of hierar-
INTRODUCTION
Deep neural networks (DNNs) are highly vulnerable to attacks based on small modification of the input to the network at test time (Szegedy et al. 2013). Those adversarial perturbations are carefully crafted in way that they are imperceptible to human observers, but when added to clean images, can severely degrade the accuracy of the neural network classifier. Since their discovery. there has been a vast literature proposing various attack and defence techniques for the adversarial settings (Szegedy
ctt al. 2013] Goodfellow et al.) 2014 Kurakin et al. 2016; Madry et al.) 2017] Wong et al.) 20200). These methods constitute important first steps in studying adversarial robustness of neural networks. However, there exists a fundamental flaw in the way we assess a defence or an attack mechanism.
That is, we overly generalize the mistakes caused by attacks. Particularly, the current approaches focuses on the scenario where different mistakes caused by the attacks are treated equally. We argue that some context do not allow mistakes to considered equal. In CIFAR- 100 (Krizhevsky et al.) 2009) it is less problematic to misclassify pine tree as a oak tree than fish as a truck.
As such, we are motivated to propose the concept of hierarchical adversarial robustness to capture this notion. Given dataset whose classes can be grouped into coarse labels, we define hierarchical adversarial examples as the ones leading to a misclassification at the coarse level; and we present a variant of the projected gradient descent (PGD) adversaries (Madry et al. 2017) find hierarchical adversarial examples. Finally, we introduce simple and principled hierarchical adversarially robust (HAR) network which decompose the end-to-end robust learning task into a single classification task into one coarse and multiple fine classification tasks, before being trained by adversarial defence techniques. Our contribution
We introduce the concept of hierarchical adversarial examples: a special case of the standard adversarial examples which causes mistakes the coarse level (Section 2).
We present worst-case targeted PGD attack to find hierarchical adversarial examples. The attack iterates through all candidate fine labels until a successful misclassification into the desired target (Section 2.1).
We propose a novel architectural approach, HAR network, for improving the hierarchical ad- versarial robustness of deep neural networks (Section B). We empirically show that HAR networks significantly improve the hierarchical adversarial robustness against foc attacks (e 2 (Section 4 and &g attacks (e 0.5) (Appendix A.4) on CIFAR-100.

---

Under review as a conference paper at ICLR 2021
We benchmark using untargeted PGD20 attacks well as the proposed iterative targeted PGD attack. In particular, we include an extensive empirical study on the improved hicrar- chical robustness of HAR by evaluating against attacks with varying PGD iterations and We find that a vast majority of the misclassifications from the untargeted attack are within the same coarse label, resulting failed hierarchical attack. The proposed iterative targeted attacks provides a better empirical representation of the hierarchical ad adversarial robustness of the model (Section 4.2).
We show that the iterative targeted attack formulated based on the coarse network are weaker hierarchical adversarial examples compared to the ones generated using the entire HAR net- work (Section
2 HIERARCHICAL ADVERSARIAL EXAMPLES
The advancement in DNN image classifiers is accompanied by the increasing complexity of the network design (Szegedy al. 2016: He et al. 2016), and those intricate networks has provided state-of-the-art results on many benchmark tasks (Degg et al. al. [2009] Geiger et al. [013 Cordts et al., 2016 Everinnhhm et al. 2015). Unfortunately, the discovery of adversarial examples has revealed that neural networks extremely vulnerable to maliciously perturbed inputs at test time (Szegedy) ct al. 2013). This makes it difficult to apply critical areas.
techniques in mission-critical and safety-
Another important develeopment along with the advancement of DNN is the growing complexity of the dataset, both in size and in number of classes: i.e. from the 10-class MNIST dataset to the 1000-class ImageNet dataset. As the complexity of the dataset increases exponentially, dataset can often be divided into several coarse classes where each coarse class consists of multiple fine classes. In this paper, we use the term label and class interchangeably.
The concept of which input image is first classified into coarse labels and then into fine labels referred to as hierarchical classification (Tousch et al. 2012). Intuitively, the visual separability be- tween groups of fine labels can be highly uneven within given dataset, and thus some coarse labels are more difficult to distinguish than others. This motivates the use of more dedicated classifiers for specific groups of classes, allowing the coarse labels to provide information on similarities between the fine labels at an intermediate stage. The class hierarchy can be formed in different ways, and can be learned strategically for optimal performance of the downstream task (Deng et al., 2011). Note that it is also valid strategy to create customized class hierarchy and thus be able to deal with sensitive missclassification To illustrate our work, we use the predefined class hierarchy of the CIFAR-10 10 and the CIFAR-100 dataset (Krizhevsky et al. 2009): fine labels are grouped into coarse labels by semantic similarities.
All prior work on adversarial examples for neural networks, regardless of defences attacks, fo- cuses on the scenario where all misclassifications are considered equally (Szegedy et al.) 2013] Goodfellow et al. 2014, Kurakin al., 2016 Madry et al. 2017| Wong 2020). However, in practice, this notion overly generalizes the damage caused by different types of attacks. For exam- ple, in an autonomous driving system, confusing a perturbed image of a traffic sign pedestrian should not be treated the same way as confusing bus as pickup truck. The former raises a major security threat for practical machine learning applications, whereas the latter has very little impact to the underlying task. Moreover, misclassification across different coarse labels poses potential ethical concerns when the dataset involves sensitive features such as different ethnicities, genders, people with disabilities and age groups.
Mistakes across coarse classes leads to much more severe consequences compared to mistakes within coarse classes.
As such, to capture this different notion of attacks, we propose the term hierarchical adversarial examples. They are specific case of adversarial examples where the resulting misclassification occurs between fine labels that come from different coarse labels.
Here, provide clear definition of the hierarchical adversarial examples to differentiate it from the standard adversarial examples. We begin with the notation for the classifier. Consider a neural network F(x) Rdd IR with softmax its last layer (Hastie et al. 2200). where d and
2

---

Under review as a conference paper at ICLR 2021
denote the input dimension and the number of classes, respectively. The prediction is given by arg max; F(z).
In the hierarchical classification framework, the classes categorized (c.g. by the user) into fine classes and coarse classes [1] The dataset consists of image and fine label pairs: {a, y), . In the later, use the set theory symbol to characterize the relationship between fine and coarse label: y E if the fine label y is part of the coarse class 2. Note that this relation holds for both disjoint and overlapping coarse classes. Given an input data x, suppose its true coarse and fine labels z* and y" respectively. Under the setting defined above, a hierarchical adversarial example must satisfy all the following properties:
the unperturbed input data is correctly classified by the classifier: arg max, F(z), v": the perturbed data z' = z + 8 is perceptually indistinguishable from the original input .;; the perturbed data is classified incorrectly: arg max; F(x'); = y where y + y²
the misclassified label belongs to a different coarse class: y' E 2².
Notice that satisfying the first three properties is sufficient define standard adversarial examples, and that hierarchical adversarial examples are special cases of adversarial examples. is worth mentioning that measuring perceptual distance can be difficult (Li et al. 2003), thus the second property is often replaced by limiting that the adversary can only modify any input x to x + ó with 8 A. Commonly used constraints are e-balls w.r.. 4 no-noms, though other constraint sets have been used too (Wong et al. 2019). In this work, we focus on fx- and En-norm attacks.
2.1 GENERATING HIERARCHICAL ADVERSARIAL PERTURBATIONS
common class of attack techniques are gradient- based attacks, such as FGSM (Goodfellow et al, 2014). BIM (Kurakin al. 2016) and PGD (Madry et al., 2017). that utilize gradient (first-order) information of the network to compute perturbations. Such methods are motivated by linearizing the loss function and solving for the perturbation that optimizes the loss subject to the fp-norm constraint. Their popularity is largely due to its simplicity, because the optimization objective can be accomplished in closed form at the cost of one back-propagation.
The main idea of gradient-based attacks can be summarized as follows. Given the prediction of F(x) and a target label y, the loss function of the model is denoted by {(x, y) - {( ((F()),)) v). e.g.
cross-entropy loss. Here, we omit the network parameter in the loss because it is assumed to be fixed while generating adversarial perturbations. Note that the choice of and whether to maximize or minimize the loss depend on if the attack is targeted or untargeted. For targeted foo attack, gradient- bbaed methods rely on the opposite direction of the loss gradient, sign v, y), to solve for the perturbation that minimizes the loss with respect a non-true true target label (y * y*)- Despite its simplicity, gradient-based based attacks are highly effective at finding 4p bounded perturbations that lead to misclassifications.
In our work, we introduce a simple variant of the projected gradient descent (PGD) adversary to find hierarchical adversarial examples. Given an input image with true coarse and fine labels 2" and y respectively. Let z, denote the perturbed input at iteration j. we define:
Ij+1 = (z (m.e) {zy - a sign (Vz((z), 0))}
(1)
where the target label comes from a different coarse class: 1 /f 2". Algorithm D summarize
the procedures for generating an for -constrained hicrarchical adversarial examples. The projection operator II after each iteration ensures that the perturbation an e-neighbourhood of the original image. We also adopt the random initialization in PGD attacks (Madry et al. 2017): ) 2g x + "),
where 7 = (m 7/2.- .,., ma) and πΙę ~ e)).
There are several approaches to choose the target class (Carlini & Wagner 2017). The target class can be chosen in an average-case approach where the class is selected uniformly at random among all eligible labels. Alternatively, they can be chosen in strategic way, best-case attack, to find the target class which requires the least number of PGD iterations for misclassificatios.
our work, consider worst-case attack by iterating through all candidate target labels, i.e., fine labels that
We could go beyond this 2-level hierarchy. Here we keep the presentation simple for didactic purposes.
3

---

Under review as a conference paper at ICLR 2021
Algorithm 1: A worst-case approach for generating E. -bounded hierarchical adversarial exam- ple based on a targeted PGD attack.
Input A pair of input data (x, v"), where fine label y" belongs to the coarse label ="; neural network F(:); loss function e(-); Eoo constraint of e; number of PGD iterations
k; PGD step-size
Define 5 = {y y & 2" ",
) collection of all fine labels that do not belong in the coarse label =";
for 1 E S do
Ty +- x - 7/ where r f- (71, : na)) and Tn4 ~ u( c).
for j = 0, ..... k do
2j+1 = [ {az - a sign (Val(z),0)) where the projection operator.
end
if arg max; F(xx);; then Terminate (successful attack);
else
10
S V::
if S is emply then
Terminate (failed attack);
13
end
14 end
end
do not belong in the same coarse class, This iterative targeted attack process terminates under two conditions: perturbation results in a successful targeted misclassification; 2. all candidate fine labels have been used as targets.
2.2 RELATED WORK ON HIERARCHICAL CLASSIFICATION
In image classification domain, there is a sizable body of work exploiting class hierarchy of the dataset (Tousch al., 2012). For classification with large number of classes, it is common technique to divide the end-to-end learning task into multiple classifications based on the semantic hierarchy of the labels (Marszalek & Schmid 2008 Liu et al., 2013 Deng et al. 2012). They are motivated by the intuition that some coarse labels are more difficult to distinguish than others, and specific category of classes requires more dedicated classifiers.
popular hierarchy structure is to divide the fine labels into label tree with root nodes and leaf nodes. Deng et al. (2011) propose an efficient technique to simultaneously determine the structure of the tree as well as learning the classifier for each node in the tree. Instead of learning the optimal tree structure, it is also common to use the predefined hierarchy of the dataset Deng et al. (2012).
3 HIERARCHICAL ADVERSARIALLY ROBUST (HAR) NETWORK
To improve the hierarchical adversarial robustness of neural networks, we propose a simple and principled hierarchical adversarially robust (HAR) network which decompose the end-to-end robust learning task into two parts. First, we initialize neural network for the coarse classification task, along with multiple networks for the fine classification tasks. Next, all the networks are trained using adversarial defence techniques probability distribution all the fine classes are computed based on Bayes Theorem. For brevity, coarse neural network (CNN) and fine neural network (FNN) to denote the two different types of networks. Intuitively, the HAR network design benefits from a single robustified CNN with improved robustness between coarse classes, and multiple robustified FNN with improved the robustness between visually similar fine classes.
improve the robustness of their task at hand. The final
3.1 ARCHITECTURE DESIGN OF HAR
Instead of the traditional flat design of the neural network, HAR consists of one CNN for the coarse labels and several FNNs for the fine labels. Note that there is one-to-one correspondence between
4

---

Under review as a conference paper at ICLR 2021
Course label Fish:
FNN
H1
(aquarium fish, flatfish, ray, shark, trout)
Course Vehicle:
H
FNN
(bicyele, bus, motorbike, pickup truck, train;
Final Prediction
:
Eq.
Coarse label People: (buby, buy, girl, man, woman]
FNN
CNN
Figure 1: Pipeline of the proposed HAR network design to improve hierarchical adversarial robust- ness of the neural network.
particular FNN and specific group of fine labels. Such module design mimics the hierarchical structure of the dataset where the fine classes are grouped into coarse classes. Recall that our defini- tion of the neural network Fxx) includes the softmax function as its last layer, so the output of the network can be interpreted as the probability distribution of the classes: P(y x). Conditioned on the probability of the coarse class, we can define the fine class probability
P(y x)) Ply x P( x).
Here, the probability distribution of the fine classes are computed as the product of two terms. Given input æ, the first term P(y 2,2) represents the probability of being fine label y where y belongs to a coarse class 2. This is essentially FNNs' prediction of the fine classes within a coarse category. The second term P( x:) represents the probability of being coarse label and it can be understood as the prediction from the CNN. With this decomposition of the original learning task, we can reconstruct the fine label distribution by probabilistically combining the predictions from the different networks.
An important advantage of this flexible modular network design is that it allows us train the com- ponent networks using adversarial defence techniques to improve the robustness of their associated task. Especially, robustified coarse neural network leads to improved hierarchical adversarial ro- bustness between coarse labels. During training, each component of the HAR network is trained independently, allowing them to trained in parallel. We use the entire dataset with the coarse la- bels, (z, 2). to train the coarse class network G(r), followed by training multiple fine class network H (z) using only portion the dataset.
The inference procedure can be described as follows. Suppose the number of coarse classes in dataset C, and each coarse class contains j number of fine classes. Similar to the definition of F(I), use G(z) denote the output of the CNN: G(x) [91.... ... 9e]. We use (x(x) to denote where j is an positive integer indicating the number
the output of the FNN: (x) = [hi...., nij] of fine classes the coarse class In this setting, the output of the combined neural network is:
F(x)= =
(3)
3.2 RELATED WORK ON ADVERSARIAL DEFENCE METHODS
plethora of defence mechanisms have been proposed for the adversarial setting. Adversarial training (Szegedy et al. 2013) is one of the standard approaches for improving the robustness of deep neural networks against adversarial examples. unperturbed training data with adversarial examples and updates the network with the replaced data points. Intuitively, this procedure encourages the DNN not to make the same mistakes against an adversary. By adding sufficiently enough adversarial examples, the network gradually becomes robust to the attack it was trained on. Existing adversarial training methods (Szegedy et al., 2013] Goodfellow et al. 2014 Kurakin al. 2016, Madry al., 2017 Wong et al. 2020) differ in
a data augmentation method that replaces
5

---

Under review as a conference paper at ICLR 2021
the adversaries used in the training. Another related line of adversarial defence methods focuses regularizing the loss function instead of data augmentation. TRADES (Zhang et al. 2019) introduces regularization term that penalizes the difference between the output of the model on training data and its corresponding adversarial example. The regularized loss consists of a standard cross- entropy loss the unperturbed data and KI--divergence term measuring the difference between the distribution of clean training data and adversarially perturbed training data.
4 EXPERIMENTS
In this section, we evaluate the hierarchical adversarial robustness of the HAR network design, in- corporating two popular adversarial defence methods: adversarial training with PGDIO adversaries (Madry et al. 2017) and TRADES (Zhang et al. 2019). In this section, we focus on evaluations based on for norm attacks, and defer evaluations on &g Appendix [.44 Compared the traditional flat design of neural network, our experiments show that HAR leads to significant improvement in hierarchical adversarial robustness under various targeted and untargeted lo attacks.
4.1 EVALUATION SETUP
We use network architectures from the ResNet family (He et al. 2016) on the CIFAR-100 dataset. The hierarchical structure of classes within the two dataset llsttrated in Table G To establish bascline, we train ResNet50 networks using the following methods: (1) Standard: training with unperturbed data; (2) ADV: training with 10-step untargeted PGD examples (2) ADV-T: training with 10-step randomly targeted PGD examples and (4) TRADES. ADV-T is targeted-version of the PGD adversarial training. Specifically, given an input pair from the training set (x. y) and y E =,, the perturbation is computed based a targeted 10-step PGD attack where the target label is uniformly random sampled from {y y & } We refer the flat models as vanilla models. For training HAR networks, we use ResNet10 for both the coarse network and the fine network. We use models with a lower capacity to reduce the difference in the order of magnitude of parameters between a single ResNet50 model and multiple ResNet10 models. This is eliminate the concern of which the improved hierarchical adversarial robustness is obtained due to the increasing network complexity. comparison between the number of trainable parameters is included in Appendix [A.]] Note that in the HAR network, all component networks (CNN and FNNs) are trained using the same adversarial defence approach. As concrete example, HAR network trained with TRADES on CIFAR 100 consists of one coarse classifier and twenty fine classifiers where they are all trained using TRADES.
For all four methods (Standard, ADV, ADV-T and TRADES), networks trained for total of 200 epochs, with an initial learning rate of 0.1. The learning rate decays by an order of magnitude at epoch 100 and 150. We used a minibatch size of 128 for testing and training. We used SGD optimizer with momentum of 0.9 and a weight decay of 2e-4. For TRADES, we performed a hy- perparameter sweep on the strength of the regularization term B and selected one that resulted in the highest accuracy against untargeted fo bounded PGD20 attacks. The optimization procedure is used for both the vanilla models and all component models in the HAR network.
4.2 HIERARCHICAL ROBUSTNESS UNDER UNTARGETED AND TARGETED ATTACKS
There are several threat models to consider while evaluating adversarial robustness, regardless of standard or hierarchical robustness. The white-box threat model specifies that the model architecture and network parameters are fully transparent to the attacker (Goodfellow et al. 2014). Despite many white-box attack methods exist, perturbations generated using iterations of PGD remain as one of the most common benchmarks for evaluating adversarial robustness under the white-box setting. As such, we use PGD as the main method to generate both untargeted and targeted attacks. Specifically, perform 20, 50, 100 and 200 iterations of PGD for the untargeted attacks in Table [ Due to the large number fine labels in CIFAR- 100, we randomly selected 1000 test set input and perform the iterative, worst-case hierarchical adversarial perturbations introduced in Section 2.1 Note that the evaluation on untargeted attacks uses the entire test set. The results on the worst-case targeted attack included in Table 2 Note that, besides 8/255, we also evaluated HAR against attacks with

---

Under review as a conference paper at ICLR 2021
Table 1:
Accuracy of different models on CIFARI00 against foo bounded white-box untargeted PGD attacks. (a higher score indicates better performance)
Clean
PGD20 (e
PGD20 (e
Method
255
253
Fine
Coarse
Fine
Coarse
Fine
Coarse
Standard
73.21%
82.57%
0.01%
24.89%
0.00%
20.13%
Vanilla
ADV
58.62%
69.81%
21.36%
37.80%
11.56%
29.06%
ADV-T
64.74%
75.02%
17.19%
41.30%
7.60%
34.74%
TRADES
57.12%
67. 67.67%
26.69%
41.47%
17 17.32%
32.36%
Standard
63.49%
81.24%
0.12%
29.25%
0.00%
22.63%
HAR
ADV
48.53%
66.23%
20.28%
30.53%
11.64%
20.71%
TRADES
46.62%
62.49%
22.00%
32.86%
14.29%
22.59%
PGD50 (e
PGD100
)
PGD200 (E
Method
Coarse
Fine
Coarse
Fine
Coarse
Standard
0.01%
24.84%
0.00%
25.12%
0.01%
24.94%
Vanilla
ADV
21.05%
37.16%
20.87%
36.96%
20.94%
37.02%
ADV-T
16.94%
41.07%
16.88%
40.99%
16.79%
40.84%
TRADES
26.48%
41.22%
26.58%
41.40%
26.52%
41.27%
Standard
0.15%
28.91%
0.14%
29.46%
0.15%
29.27%
ADV
19.91%
29.94%
20.03%
29.99%
19.89%
29.93%
TRADES
21.99%
32.66%
21.90%
32.60%
21.87%
32.36%
Table 2: Accuracy of different models on CIFAR 100 against Eoo bounded worst-case targeted PGD attacks generated based on Algorithm higher score indicates better performance)
PGD20
PGD20
PGD50
PGD100
PGD200
Method
(6 255
(E 265
(e
8
(c
8
(e 255
256
255
Standard
0.00%
0.00%
0.00%
0.00%
0.00%
Vanilla
ADV
43.30%
24.60%
24.60%
24.50%
24.00%
ADV-T
43.50%
22.10%
21.70%
20.70%
21.00%
TRADES
47.20%
30.00%
29.80%
29.70%
28.80%
Standard
8.60%
4.00%
3.50%
3.40%
3.30%
HAR
ADV
43.70%
25.80%
25.50%
25.30%
24.00%
TRADES
45.80%
29.20%
28.90%
29.30%
28.90%
4/255. All PPG adversarial examples used for all evaluations are generated a step size of </4 (pixel values are normalized to [0, 1).
Along with the two attacks, we also include results on unperturbed testset data (Clean). For clean and untargeted attacks, we report the percentage of correct fine class prediction fine accuracy, and the percentage fine class prediction belonging to the correct coarse class as coarse accuracy. For targeted, its accuracy refers to the percentage of the testset data where the targeted attack fails to alter the final prediction to the desired target, even after iterating through all eligible target labels. It is important to realize that successful targeted attack implies misclassification for both coarse and fine classes. summarrie the accuracy the HAR model and vanilla models on standard unperturbed data, and against untargeted and targeted attacks.

---

Under review as a conference paper at ICLR 2021
Table Accuracy of the hierarchical classifier on CIFAR-100 against loo bounded targeted attacks (e = 8/255) generated using the coarse network (Coarse). As a comparison, the attack counterpart generated using the entire HAR network is also included (HAR). (a higher score indicates better performance)
Method
Coarse
HAR
Standard
0.00%
3.30%
ADV 29.96%
24.00%
TRADES
29.38%
28.00%
4.2.1 DISCUSSIONS
Before making the comparison between the HAR model and the vanilla model, we make an in- teresting observation: untargeted attacks often results in misclassification within the same coarse class, shown by the high coarse accuracy under Untargeted. In particular, vanilla networks trained with unperturhed training data have 0% fine accuracy under Untargeted, while a vast majority of the misclassified classes still belong to the correct coarse class. This shows that the untargeted at- tacks do not provide a good representation of the hierarchical adversarial robustness as an empirical evaluation. On the other hand, the iterative targeted attack leads to a severe damage in hierarchical adversarial robustness for vanilla models trained with all three methods. On Standard trained mod- els, despite the high hierarchical robustness under untargeted attacks, nearly all of the CIFAR 10 and CIFARIOR 100 testset data can be perturbed into a desired target class from another coarse class. As such, we emphasize the use of the iterative worst-case targeted attack for a more accurate evalua- tions for the hierarchical adversarial robustness of the model. For vanilla models trained with ADV and TRADES, we notice that the improved adversarial robustness fine classes also translates to an improvement on hicrarchical adversarial robustness. We observed that vanilla models trained using ADV-T shows improved robustness against untargeted PGD attacks compared to the original adversarial training method. However, we noticed that there is a significant decrease in the hierar- chical robustness of ADV-T models against the hierarchical adversarial examples, leading hierarchical robust accuracy compared to ADV. Finally, we observe that HAR network trained with ADV and TR ARES significantly improves the robustness against iterative targeted attacks compared to the vanilla counterparts, On CIFAR- 100. HAR network achieves a 1.2% improvement on PGD20 adversaries (e 8/255) when trained with ADV.
worse
4.3 HIERARCHICAL ROBUSTNESS UNDER TARGETED ATTACKS BASED ON THE COARSE NETWORK
Under the white-box threat model, attackers with a complete knowledge of the internal structure of HAR can also generate perturbations based the coarse network. During evaluations, inves- tigate whether the targeted PGD adversaries based on the coarse network are stronger hierarchical adversarial examples compared to the ones generated using the entire network. Such attacks can be understood as finding more general perturbation which alters the probability distribution of the coarse class: P(z 2). Similar to the attack proposed in Section 2. we perform an iterative, worst- case targeted PGD20 attack based on the coarse neural network. Specifically, we replace ((F(x), y) with (G((),, 2) in Eq. [ and iterate through all eligible coarse classes as target labels. For exam- ple, to generate such attacks for HAR with ADV-trained component networks, the iterative targeted attack is performed based on the ADV-trained coarse network the original HAR network. Note that there is distinction between the above attack procedure and transfer-basee attack where the perturbation is transferred from an independently trained source model (Papernot et al. 2017). Since the perturbation is generated using part of the HAR network, such attacks still belongs the white- box setting. Our results in Table 3 show that the perturbations generated using the coarse network weaker attacks compared to the ones generated using the entire network.
8

---

Under review as a conference paper at ICLR 2021
5 CONCLUSION
In this work, we introduced novel concept called hierarchical adversarial examples. For dataset which classes can be further categorized into fine and coarse classes, we defined hierarchical adver- sarial examples as the ones leading to misclassication at the coarse level. To improve the hierarchi- cal adversarial robustness of the neural network, we proposed the HAR network design, a composite of coarse network and fine networks where each component network is trained independently by adversarial defence techniques. We empirically showed that HAR leads to significant increase in hierarchical adversarial robustness under white-box untargeted/tageted attacks CIFAR- 10 and 100-5000
The rapid adoption of machine learning applications has also led an increasing importance in im- proving the robustness and reliability such techniques. Mission-critical and safety-critical systems which rely on DNN in their decision Decision-making process shall incorporate robustness, along with ac- curacy, in their development process. The introduction of the hierarchical adversarial examples and ways to defend against them is important step towards safe and trustworthy Al system.
REFERENCES
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium security and privacy (sp). pp. 39-57. IEEE, 2017.
Marius Cordts, Mohamed Omran, Sebastian Ramos, Timo Rehfeld, Markus Enzweiler, Rodrigo Benenson, Uwe Franke, Stefan Roth, and Bernt Schiele. The cityscapes dataset for semantic urban scene understanding. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 3213-3223, 2016.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hi- erarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp. leee, 2009.
Jia Deng, Sanjeev Satheesh, Alexander C Berg, and Fei Li. Fast and balanced: Efficient label tree learning for large scale object recognition. In Advances in Neural Information Processing Systems, pp. 567-575, 2011.
Jia Deng, Jonathan Krause, Alexander C Berg, and Li Fei-Fei. Hedging your bets: Optimizing sccuracy-specifiitt trade-offs in large scale visual recognition. In 2012 IEEE Conference on Computer Vision and Pallern Recognition, pp. 3450-3457. IEEE, 2012.
Mark Everingham, SM Eslami, Luc Van Gool, Christopher KI Williams, John Winn, and Andrew Zisserman. The pascal visual object classes challenge: A retrospective. International journal of computer vision, 1 91)9998-833, 2015.
Andreas Geiger, Philip Lenz, Christoph Stiller, and Raquel Urtasun. Vision meets robotics: The kitti dataset. The International Journal of Robotics Research, 32(11):121-1123,, 2013.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 2014.
Trevor Hastie, Robert Tibshirani, and Jerome Friedman. The Elements of Statistical Leurning: Data Mining, Inference, and Prediction (2nd edition). Springer, 2009.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp- 770-778, 2016.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. arXiv preprint 161 1.01366, 2016.

---

Under review as a conference paper at ICLR 2021
Beitao Li, Edward Chang, and Yi Wu. Discovery of perceptual distance function for measuring image similarity. Multimedia systems, 8(6):512-522 -22, 2003.
Baoyuan Liu, Fereshteh Sadeghi, Marshall Tappen, Ohad Shamir, and Ce Liu. Probabilistic label trees for efficient large scale image classification. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 843-850, 2013.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks. arXiv preprint arXiv:/706.0608. 2017.
Marcin Marszalek and Cordelia Schmid. Constructing category hierarchies for visual recognition. In European conference on computer vision, pp. 479-491. Springer, 2008
Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia conference on computer and communications security, pp. 506-519, 2017.
Christian Szegedy, Wojciech Zaremba, Iyy Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv: 3/1.6199,9 2013.
Christian Szegedy, Sergey loffe, Vincent Vanhoucke, and Alex Alemi. Inception-vel v4, inception- resnet and the impact of residual connections on learning. arXiv preprint arXiv:160..0722 2016.
Anne-Marie Tousch, Stéphane Herbin, and Jean-Yves Audibert. Semantic hierarchies for image
annotation: survey. Pattern Recognition, 45(1):333-344 2012.
Eric Wong, Frank R Schmidt, and J Zico Kolter. Wasserstein adversarial examples via projected sinkhorn iterations. arXiv preprint
2019.
Eric Wong, Leslie Rice, and Zico Kolter. Fast is better than free: Revisiting adversarial training. arXiv preprint arXiv:2001.025 .03994, 2020.
Hongyang Zhang. Yaodong Yu, Jiantao Jiao, Eric P Xing, Laurent El Ghaoui, and Michael I Jordan. Theoretically principled trade-off between robustness and accuracy. arXiv preprint 19110:1901 2019.
10

---

Under review as a conference paper at ICLR 2021
A APPENDIX
A. COMPARISON OF TRAINABLE MODEL PARAMETERS
In our evaluations, we use ResNet50 for the vanilla models, and use multiple ResNet10 for the HAR network. We use models with lower capacity to reduce the difference in the order of magnitude of parameters between single ResNet50 model and multiple ResNet10 models. This helps to address the concern of which the improved hierarchical adversarial robustness is obtained due to the increasing network complexity.
Table Number trainable parameters in ResNet10 and ResNet34
Model
Number of Parameters
ResNet10
4.9 M
ResNe150
23.3 M

---

Under review as a conference paper at ICLR 2021
A.2 HYPERPARAMETER SWEEP FOR TRADES ON RESNETIO
The following results show the hyperparameter sweep on TRADES. We include the one with the highest PGD20 accuracy in Section 4
Table 5: Hyperparameter sweep of TRADES ResNet10:
evaluation based performance
CIFAR-10 against &o bounded adversarial perturbations (e = 8/255).
Standard
FGSM
PGD20
15
72.80%
48.85%
44.80%
13
73.46%
49.18%
45.09%
11
74.46%
49.39%
44.86%
9
75.61%
50.06%
45.38%
7
76.74%
50.05%
45.04%
5
78.39%
50.22%
44.40%
3
80.20%
49.84%
42.53%
83.69%
45.61%
35.27%
0.5
84.00%
46.16%
34.40%
0.1
84.64%
41.12%
16.52%
12

---

Under review as a conference paper at ICLR 2021
A.3
HIERARCHICAL STRUCTURE OF CLASSES WITHIN THE CIFARIO 10 DATASET
Table 6: The hierarchical structure of classes within the CIFAR-10 and CIFAR-100 dataset
Coarse labels
Fine labels
Animals
bird, cat, deer, dog. frog, horse airplane, automobile, ship, truck
CIFAR-10
Vehicles
Aquatic mammals
beaver, dolphin, otter, seal, whale aquarium fish, flatfish, ray, shark, trout orchids, poppies, roses, sunflowers, tulips bottles, bowls, cans, cups, plates apples, mushrooms, oranges, pears, sweet peppers clock, computer keyboard, lamp, telephone, television hed, chair, couch, table, wardrobe bee, beetle, butterfly, caterpillar, cockroach bear, leopard, lion, tiger, wolf" bridge, castle, house, road, skyscraper cloud, forest, mountain, plain, sea camel, cattle, chimpanzee, elephant, kangaroo fox, porcupine, possum, raccoon, skunk crab, lobster, snail, spider, worm baby, boy, girl, man, woman crocodile, dinosaur, lizard, snake, turtle hamster, mouse, rabbit, shrew, squirrel maple, oak, palm, pine, willow bicycle, bus, motorcycle, pickup truck, train lawn-mower, rocket, streetcar, tank, tractor
Fish
CIFAR-100
Flowers
Food containers
Fruit and vegetables
Houschold electrical devices
Houschold furniture
Insects
Large carnivores
Large man made outdoor things Large natural outdoor
Large omnivores and herbivores Medium-sized mammals
Non-insect invertebrates
People
Reptiles
Small mammals
Trees
Vehicles
Vehicles 2
13

---

Under review as a conference paper at ICLR 2021
A.4 RESULTS ON CIFARIO0 WITH & ATTACKS
Overall, we observe a similar robustness improvement with the HAR network. Note that we were able achieve reasonable robustness results with TRADES against l2 attacks. One possible reason is that the hyper-parameter sweet was based on the &oo results, as such not suitable for & attacks. For this reason, we omit TRADES in this section.
Table 7: Accuracy of different models CIFARI00 against &g bounded white-box untargeted PGD attacks. (a higher score indicates better performance)
Clean
PGD20
0.5)
PGD20 (e 0.25)
Method
Fine
Coarse
Fine
Coarse
Fine
Coarse
Vanilla
Standard
73.21%
82.57%
0.29%
31.86%
3.05%
35.95%
ADV
64.38%
74.85%
36.35%
53.77%
50.04%
64.05%
ADV-T
68.73%
78.58%
31.41%
53.10%
48.78%
64.62%
HAR
ADV
56.96%
73.31%
31.91%
48.94%
43.87%
60.68%
PGD50
0.5)
PGD100
0.5)
PGD200
0.5)
Method
Fine
Coarse
Fine
Coarse
Fine
Coarse
Standard
0.17%
32.17%
0.13%
32.55%
0.12%
32.07%
Vanilla
ADV
36.16%
53.6 53.64%
36.11%
53.61%
36.07%
53.59%
ADV-T
31.21%
52.97%
31.15%
52.82%
31.09%
52.78%
HAR
ADV
31.90%
48.78%
31.76%
48.70%
31.70%
48.91%
Table 8: Accuracy of different models on CIFAR100 against &g bounded worst-case targeted PGD (a higher score indicates better performance)
attacks generated based on Algorithm [
PGD20
PGD50
Method
0.5)
0.5)
Standard
0.10%
0.10%
Vanilla
ADV
43.60%
42.90%
ADV-T
39.20%
38.50%
HAR
ADV
44.30%
44.00%
14


Reviews:
[{"review_id": "u4YmQnc_I1S", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The authors discuss a new notion of adversarial robustness, specifically, robustness to hierarchical adversarial examples. This is motivated by the idea that some types of misclassifications (e.g. mistaking one type of dog for another) may be less harmful than others (e.g. mistaking a dog for a truck); thus, adversarial examples will be more harmful if they cause coarse-grained errors as opposed to fine-grained ones. The authors further propose a network architecture that is designed to be more robust in the hierarchical sense, and they provide some experimental evidence comparing their methodology to standard adversarially trained networks.\n\nI am in favor of rejecting this paper because it does not provide adequate baselines or proper and thorough robustness evaluation, which is especially important for the field of adversarial robustness.\n\nThe main strength of this work is the idea to analyze hierarchical adversarial examples. The reasoning for studying this is sound, and using CIFAR-100 to do so seems quite reasonable (The fact that the authors focused on CIFAR for their work is fine for me. If the authors wish to also do experiments on ImageNet, hierarchies based on ImageNet can also be created based on https://wordnet.princeton.edu/, for example, as in https://arxiv.org/abs/2008.04859.)\n\nHowever, the paper has weaknesses in terms of its baselines and evaluation. The main idea of studying hierarchical adversarial examples is clear, but is simple, so it would be good to have comprehensive evaluation to help us understand how different architectures, different training methods, and different Lp-norms and Lp-epsilon values affect this property. The authors only present results that vary the training method and they try two architectures (a standard ResNet34 and their proposed HAR architecture), but they do not study different Lp norms, epsilons, or a larger number of standard architectures.\n\nNext, it is not surprising that standard models, which are trained to be robust to standard (fine-grained) adversarial examples, are less robust to coarse-grained adversarial examples compared to HAR, which is specifically designed with the task of coarse-grained adversarial examples in mind. Instead, I would have liked to see a simple adversarial training baseline that involves creating coarse-grained adversarial examples during the adversarial training phase. Otherwise, it is hard to understand how much the HAR architecture itself is important (as opposed to focusing on coarse-grained adversarial robustness rather than fine-grained adversarial robustness during training). Finally, HAR is actually worse than standard networks (trained for fine-grained robust classification) on most evaluation metrics except for “targeted” coarse attacks, where HAR shows some improved robustness.\n\nNext, evaluating robustness to adversarial examples in general requires much more rigor than is presented. This is a particularly problematic aspect of the robustness field, as pointed out in https://arxiv.org/abs/1802.00420, https://arxiv.org/abs/1902.06705, and https://arxiv.org/abs/2002.08347. One example of a change is that the authors could perform a much stronger attack than PGD20 (e.g. PGD200 or PGD1000, and ideally with random restarts), in addition to performing the sanity checks discussed in https://arxiv.org/abs/1902.06705, before claiming improved empirical robustness.\n\nMinor comment:\n\nMy understanding was that generating worst-case targeted hierarchical adversarial examples takes a long time, because it requires iterating over all possible fine-grained classes. Is there a way to make this faster? A faster way to do this would make it more feasible to do standard adversarial training, where coarse-grained adversarial examples are generated during the training.\n\n\nPost Rebuttal Update:\n\nI have read the author's rebuttal, and appreciate the additional experiments. I will maintain my score due to the importance of extensive evaluation for showing empirical robustness, and a lack of proper baselines. In particular, I think that some version of \"adversarial training with coarse labels\" should be better than standard adversarial training in terms of hierarchical robustness; only after that can we evaluate the benefits of HAR in comparison to \"adversarial training with coarse labels.\"", "extra_scores": {}, "extra_text": {}}, {"review_id": "h6eIfKjZsti", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Summary: This paper tackles the problem of building hierarchical adversarially robust (HAR) models---i.e., models that are less prone to coarse-grained misclassifications in the face of adversarial manipulation. Specifically, the authors propose HAR networks, wherein the learning/inference problem is decomposed into coarse-grained classification followed by a number of fine-grained classifications. The proposed approach is evaluated on CIFAR-10 and (a subset of) CIFAR-100 for linf adversarial attacks.\n\nComments: The problem studied in this paper is a natural and pertinent one. The paper is also fairly well-written. The proposed approach does seem to offer some gains in coarse targeted accuracy, albeit occasionally at the cost of fine accuracy.  However:\n\n* One thing that is not entirely clear from the paper is how exactly the authors perform the worst-case targeted attack. The description in Section 2.1 is vague and the authors should clarify. From what I understand, the authors maximize the loss with respect to every fine-grained label belonging to a different coarse class and pick the worst. How exactly do the authors determine the loss with respect to fine-grained labels from other coarse classes? What happens if you instead do an *untargeted* attack on the *coarse classifier* alone? This exactly corresponds to the quantity of interest and the authors should include an evaluation based on this attack.\n\n* The authors do not justify why they choose separate networks for the coarse and fine classification tasks. One could imagine training a single flat model with a hierarchical robust loss. This idea has been explored in prior work for standard models---for instance, YOLO 9000 does this for ImageNet https://arxiv.org/abs/1612.08242. Does this perform worse than the HAR architecture proposed in the paper? Overall, training a flat classifier with a hierarchical loss seems like a more efficient and scalable approach for larger datasets that may have many levels of coarse classes.\n\n* I also think the claims in the paper would be stronger with additional evaluation. Specifically: (i) The authors should show that these trends hold for a few different eps and for l2-robust models as well. It would also be valuable to validate these results on all of CIFAR100 or even subsets of ImageNet (which may have more than one level of coarse labels). (ii) As a sanity check, the authors should evaluate the robustness of their models (trained with linf eps=8/255) as a function of inference time eps ([0, 1]) and PGD steps. Further, the authors should evaluate black box accuracy of their models.\n\nMinor:\n- Section 2.1 typo: “none-true target label”.\n- Section 4.1 typo: “traininig”.\n\nOverall, I think this paper studies an interesting problem, but could be improved in terms of experimental evaluation and comparison to baselines (as described above). I also have concerns about the scalability of this approach to larger datasets with a multi-level hierarchical structure. I would be happy to increase my score if the authors address my concerns.\n\n\n### Post-Rebuttal Update ###\n\nI thank the authors for their response and edits to the paper. In particular, the authors have tried to address comments from the reviewers pertaining to further empirical evaluation of their approach. However, I still have two concerns about the paper post-rebuttal:\n\n[Baselines] I share Reviewer 4's concern that the authors do not compare to several natural baselines. As I mentioned in my review, I am still not convinced about the design choice of using multiple networks for each set of coarse/fine-grained labels. There are a host of approaches (both training losses and architectures) to deal with hierarchical classification in the standard setting. The authors do not justify quantitatively why adapting these methods to the robust setting (i.e., incorporating ADV/TRADES there) will not work. Further, I do not find the justification of fine-grained labels within a dataset being uneven for using multiple networks to be sufficient . This seems like a more fundamental problem that should be fixed by changing the dataset/class hierarchy. In fact, having even coarse/fine classes is essential to justify the merits of HAR in the first place.\n\n[Evaluation] Based on the new results added to the paper in the rebuttal phase, it seems that HAR does worse than vanilla ADV on coarse accuracy under untargeted attacks (Table 1); while vanilla ADV  does worse than HAR using worst-case attacks (Table 2). If we compare the minimum over the two attacks (as is standard to correctly measure robustness), the coarse robustness is actually *better for vanilla ADV than HAR* (24.60% vs 20.71%). This finding seems to go against the main claim of the paper.\n\n[Other] There seems to be a discrepancy in Table 1---the robust accuracies go up between the PGD20 eval and PGD50 eval.\n\nBased on the concerns listed above, I will maintain my original score.", "extra_scores": {}, "extra_text": {}}, {"review_id": "eI6KKwmwqyw", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "# Summary\nThis paper investigates adversarial attacks in the hierarchy of labels. Misclassifying a person for a car is a “coarse misclassification”, but misclassifying a bus for a car is a “fine misclassification”. The paper introduces both a metric for hierarchical adversarial robustness, and a method to improve this metric (which is a hierarchical formulation of resnet architectures). \n\n# Strong & Weak points\n## Strong points\n\n  * This paper addresses the problem of hierarchical adversarial examples, which is a phenomenon most often ignored in related literature. Adversarial attacks, like PGD, often yield classes in the same coarse class. \n  * Table 2 shows that the Hierarchical formulation of the network improves robustness against worst case targeted adversarial attacks. \n\n## Weak points \n\n  * The paper relies on experimental results with small datasets, like CIFAR10 and a subset of CIFAR100. Moreover, the ImageNet dataset is mentioned already in the second paragraph and the frequent citation “Deng 2012” also uses ImageNet. So I am surprised that this paper does not cover this dataset. If this paper aims to focus future research on hierarchical adversarial robustness, I suggest including at least the definition of coarse labels for the ImageNet and OpenImages datasets.\n  * It is unclear to me how the adversarial class is defined. To quote from the paper “ In our work, we consider a worst-case attack by iterating through all eligible target labels until a successful misclassification occurs, and the attack is unsuccessful when the target list is exhausted.” The definition of a worse-case attack is key to the proposed method, and necessitates a clear explanation.\n\n# Statement\nRecommendation: 4\nReasons\n\n  * Results on small datasets like CIFAR10 and a subset of CIFAR100, while the ImageNet is mentioned and cited multiple times. \n  * Motivation is not backed by data or citations. The paper hinges on the claim that PGD attacks yield misclassifications within the same coarse label, but this claim is not substantiated with data or citations. \n\n# Supporting arguments\n\n  * I suggest the paper gets grounded in more relevant literature, or provide more extensive experiments. The paper contains only two experiments (table 2 and table 3), has no “related work” section, and has nor 23 cited works. I’m aware that the ICLR conference places no restriction on the structure of the paper, or the number of experiments, but I suggest expanding either the experiments or the related work to increase the arguments in the paper. \n  * The paper misses numbers to quantify the motivation for this research. The contributions even state that “We find that a vast majority of the misclassifications from the untargeted attack are within the same coarse label”, but this statement is not backed by data in the rest of the paper. The proposed method is only useful when PGD attacks indeed yield misclassifications within the same coarse label, so quantifying this phenomenon will provide a strong argument for adoption of the new metric.\n\n# Questions\n\n  * The paper defines a new subset of CIFAR100, named CIFAR100-5x5. What were the design choices for this new dataset and why?\n  * In what light to ResNet10 and ResNet34 have the same capacity? To quote from the paper “We use models with a lower capacity so that both vanilla models and the hierarchical classifiers have the same order of magnitude of parameters”. Could you please elaborate on the calculation?\n\n# Minor feedback\nThese points are not part of the assessment\n\n  * When defining $F(x) : R^d \\arrow R^n$, the variables $d$ and $n$ are not defined. Moreover, when defining the dataset, $\\{ x, y \\}_n$, the variable $n$ is reused in a different context. \n  * Please be consistent in the mathematical expressions. On page 2, the prediction is defined as $\\arg \\max_i F(x)_i$, on page 3, the prediction is defined as $\\arg \\max F(x)$, and later on page 3 the prediction is indicated with lower case, $f(x)$. \n  * Table 2 (and its reference in the main text) consider “performance” of the model. Please either a) use terms such as accuracy/error-rate to indicate what the numbers represent, or b) write in the caption whether a higher score or lower score indicates better performance. \n\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "6mCk8Jr9bY9", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The authors present an interesting hierarchical decomposition of cifar classification and show that it helps the model perform better against adversarial robustness. \n\nThere are some general issues with the paper. For starters, it is usual in benchmarking to show a plot of accuracy against PGD steps. This is done because eventually, accuracy should stabilize somewhere. It is not clear why the authors settle on 20 steps. While the authors show HAR gives an improvement against the vanilla model at 20 steps, this might not hold if the number of attack steps were increased.\n\nI am not sure how this method's cifar accuracies compare to sota. The authors should show an improvement against the state of the art on cifar-10. Otherwise, it is difficult to understand what is the value of including this two-step training procedure.\n\nI would also like to see how sensitive the coarse model is to the choice of z input; an ablation study should be performed. One possible suggestion for this would be to train two models, p(z|x) and p(y|x,z) but where z is just the repeated, fine-grained y label. This would tell us what is the amount of improvement coming simply from having a two-step classification process involving different neural net architectures.", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This work targets an important problem: susceptibility of ML models to adversarial perturbations that make them completely misclassify an input, as opposed to "just" fail to get the right fine-grained class while getting the correct coarse-grained one. This natural question did not receive enough attention so far, so having this work look into it is a definite plus.

However, as the reviewers point out, this study has a number of issues in terms of the methodology of the experiments. For example, it is unclear whether the proposed (natural) variant of training the robust model is particularly beneficial for the stated goal. As such, it seems that the paper is not ready for publication and the authors are strongly advised to revise the article and submit it again.
Decision: Reject