Adversarially Robust Models may not Transfer Better: Sufficient Conditions for Domain Transferability from the View of Regularization
Authors: Xiaojun Xu
Jacky Y. Zhang
Evelyn Ma
Danny Son
Oluwasanmi O Koyejo
Bo Li
Venue: ICLR 2022 Submitted (2022)
Keywords: Domain transferability
model regularization

Abstract: Machine learning (ML) robustness and generalization are fundamentally correlated: they essentially concern about data distribution shift under adversarial and natural settings, respectively. Thus, it is critical to uncover their underlying connections to tackle one based on the other. On the one hand, recent studies show that more robust (adversarially trained) models are more generalizable to other domains. On the other hand, there lacks of theoretical understanding of such phenomenon and it is not clear whether there are counterexamples. In this paper, we aim to provide sufficient conditions for this phenomenon considering different factors that could affect both, such as the norm of last layer norm, Jacobian norm, and data augmentations (DA). In particular, we propose a general theoretical framework indicating factors that can be reformed as a function class regularization process, which could lead to the improvement of domain generalization. Our analysis, for the first time, shows that ``robustness" is actually not the causation for domain generalization; rather, robustness induced by adversarial training is a by-product of such function class regularization. We then discuss in details about different properties of DA and we prove that under certain conditions, DA can be viewed as regularization and therefore improve generalization. We conduct extensive experiments to verify our theoretical findings, and show several counterexamples where robustness and generalization are negatively correlated when the sufficient conditions are not satisfied.

Under review as a conference paper at ICLR 2022
ADVERSARIALLY ROBUST MODELS MAY NOT TRANS- FER BETTER: SUFFICIENT CONDITIONS FOR DOMAIN TRANSFERABILITY FROM THE VIEW OF REGULARIZA- TION
Anonymous authors Paper under double-blind review
ABSTRACT
Machine learning (ML) robustness and generalization are fundamentally corre- lated: they essentially concern about data distribution shift under adversarial and natural settings, respectively. Thus, it is critical to uncover their underlying con- nections to tackle one based on the other. On hand, recent studies show that more robust (adversarially trained) models are more generalizable to other do- mains. On the other hand, there lacks of theoretical understanding of such phe- nomenon, and it is not clear whether there are counterexamples, In this paper, we aim to provide sufficient conditions for this phenomenon considering different fac- tors that could affect both, such norm of the last layer, Jacobian norm, and data augmentations (DA). In particular, we propose a general theoretical framework indicating factors that can be reformed which could lead to improvements of domain generalization. Our analysis, for the first time, shows that "robustness" is actually not the causation for domain gener- alization; rather, robustness induced by adversarial training is by-product of such function class regularization. We then discuss in details about different properties of DA and we prove that under certain conditions, DA can be viewed as regular- ization and therefore improve generalization. We conduct extensive experiments to verify our theoretical findings and show several counterexamples where robust- ness and generalization are negatively correlated when the sufficient conditions are not satisfied.
function class regularization process,
INTRODUCTION
Domain generalization (or transferability) is the task of training machine learning models with data from one or more source domains that can be adapted to targer domain, often via low- cost fine-tuning. Thus, domain generalization refers to approaches designed to address the natural data distribution shift problem (Muandet et al. [013 Rosenfeld et al.) (02TT) A wide array of approaches have been proposed to address domain transferability, including fine fine-tuning the last layer of DNNs (Huang al. 2018), invariant feature optimization (Muandet al. 2013), efficient model
selection for fine-tuning You et al. 2019). and optimal transport based domain adaptation (Courty) al. 2016). Improving domain generalization has emerged as an important task in the machine learning community: for instance, it is among the key technologies to enable an autonomous driving vehicle trained city scenarios to make correct decisions in the countryside as well.
On the other hand, robust machine learning aims to tackle the problem of adversarial data distribution shift. Both empirical and certified robust learning approaches have been proposed, such empirical adversarial training (Madry al., 2018) and certified defenses based on deterministic and probabilistic approaches (Cohen et al. 2019).
As domain transferability and robust machine learning tackle different kinds of data distribution shifts, this work seeks to uncover their underlying connections and tradeoffs. For instance, recent studies suggest that adversarially robust models are domain transferable (Salman al. 2020), which, in turn, provides new insights on improving domain generalization. However, a theoretical analysis of their relationship is still lacking, and it unclear whether such positive correlations al-

---

Under review as a conference paper at ICLR 2022
Sufficient conditions for domain transferability
Adversorially robust models may not transfer better
(a) Data augmentations
(b) Jacobian norm
(c) Last-Layer norm
(b)
(c)
Are
OL
60
15
Source
Feature Extractor
Last Layer
011-0.917
2.105
Arc
(89)
Figure I:
Illustration of robustness and domain transferability in different conditions.
ways hold. In this paper, take the first steps towards formally analyzing the relationship between model robustness and domain transferability to answer the following questions: What are sufficient conditions for domain transferabilitt? Is model robustness the cause of domain transferabilityy Can robustness and domain transferability be negatively correlated?
To answer the above questions and uncover the underlying relationship between robustness and domain transferability, we propose a general theoretical framework that characterizes sufficient con- ditions for domain transferability from the view of function class regularization. Our analysis shows that if the function class of feature extractors is more regularized, the model based on feature extractor trained from the function class, composed with fine-tuned last layer, can be more trans- ferable. Formally, we prove that there is monotone relation between the regularization strength and tight upper bound on the relative domain transfer loss.
Under the proposed framework, we analyze several common factors for model training, including the Jacobian norm, the last layer norm, data augmentation, and adversarial training as shown in Fig. [ In particular, controlling the Jacobian norm and last layer norm can be viewed as function- class regularization, thus can be analyzed in our framework. We also analyze how other common regularization operations be mapped to function class regularization. For instance, consider noise-dependent and independent data augmentation procedures based on feature average and loss average aggregation algorithms.
We conduct extensive experiments on ImageNet (CIFAR-10 as target domain) and CIFAR-10 (SVHN target domain) based different models to verify analysis. We show that regulariza- tion can control domain transferability, and robustness and domain transferability can be negatively correlated, which counter-examples against (Salman et al. (222)) Taken together, this indicates that robustness is not a cause of transferability.
Technical Contributions. We aim uncover the underlying relationship between robustness and domain transferability and lay out the sufficient conditions for transferability from the view of reg- ularization. We make both theoretical and empirical contributions.
We propose a theoretical framework analyze the sufficient conditions for domain transferability from the view of function class regularization. We provably show that stronger regularization on the feature extractor implies decreased tight upper bound on the relative transferability loss; while model robustness could be arbitrary.
We prove the tightness of our transferability upper bound, and provide the generalization bound of the relative transferability loss from the view of regularization.
We analyze several factors such as different data augmentations (e.g., rotation and Gaussian) under the framework, and show how they can be mapped to function class regularization and therefore affect transferability.
We conduct extensive experiments on different datasets and model architectures verify our theo- retical claims. We also show several counterexamples that indicate significant negative correlation between robustness and the relative domain transferability.
2 RELATED WORK
Domain Transferability has been analyzed in different settings. Muandet al. present gener- alization bound for classification task based on the properties of the assumed prior over training environments. Rosenfeld et al. model domain rransfrrbilltyy/eeerriii show that generalizing beyond the convex hull of training environments is NP-hard, and Zhang et al. provides generalization bound for distributions with sufficiently small H-divergence. Given the
online game and
2

---

Under review as a conference paper at ICLR 2022
complexity of domain transferability analysis. recent empirical studies show that adversarially bust models transfer better (Salman et al. 2020). In this paper, we aim to relax the assumptions and focus understanding the domain transterability from the view of regularization and theoretically show whether "robustness" is indeed a causation for transferability or not.
Model Robustness is important topic given recent diverse adversarial attacks (Goodfellow al., 2014 Carlini & Wagner 2017). These attacks may be launched without access to model param- eters TTu al.j 2019) or even with the model predicted label alone (Chen al.) 2020). Different approaches have been proposed to improve model robustness against adversarial attack. Adversar- ial training has been shown be effective empirically (Madry et al., 2018 Zhang al. 2019a]
Miyato et al.) 2018). Some studies have shown that robustness is property related to other model characteristics, such as transferability and invertibility (Engstrom et al. 2019).
SUFFICIENT CONDITIONS FOR DOMAIN TRANSFERABILITY
In this section, we theoretically analyze the problem of domain transferability from the view of regularization and discuss some sufficient conditions for good transferability. All of the proofs are provided in Section in the appendix.
Notations. We denote the input space as X:; the feature space as 2 and the output space as V. Let the fine-tuning function class be E G. Given a feature extractor f X + Z and fine-tuning function g 2 + V, the full model is g
+ y. We denote Pxxy the set of distributions on X x V. The loss function denoted by y x y - R., and the population loss based on data distribution D Pxxx and a model g f is defined
lplg o f) == ((ww) ( f()),
Before diving into the details, we first provide the following example to illustrate why one might investigate domain transferability from the view of regularization.
3.1 EXAMPLE: ROBUSTNESS AND TRANSFERABILITY ARE INDEPENDENT
In this subsection, we construct simple example where domain transferability depends on regular- ization, yet domain transferability and robustness are independent. Moreover, this example serves as motivation to consider domain transferability from the view of regularization.
Given the source and target distributions Ds, Dr E P Pxxx, we denote their marginal distributions on the input space X' as Dÿ and Dj, respectively. We consider the case that X' C 1 being low-dimensional manifold in R and y Rd. Given an input E X. the ground truth target for the source domain yss(a) generated by a function ys I + Rd. Similarly, we define yr for neglect the fine-tuning process but directly
the target domain. In this example, for simplicity, consider learning a function f R + Rd with norm ||- on Rd, For the source domain we have the population loss:
lD. (f) = Enw [z) - (s]
distribution Pxx on the input space X, defines a norm function f R. + Rd
|| = (l)
where we view two functions f1, f2 as the same if [| f2ll = O. Therefore, we can define the ysllpg and the target domain loss (x.
source domain loss ED3 (f)
yrllpz-
For the sake of illustration, we consider the simple case where the input distributions D D are the same, and hence we denote = D = D.. Note that ys and yr are different.
Denoting a function space = (ʃ R R I/// < oc), we assume that ys: yr E F and we can compare f, Us yr in the same space. Therefore, given 0 as regularization parameter, the domain transferability problem can be defined as:
Learning a source model:
1 E arg min argginn feF
(Ds()) s.t. U
(I)
Testing target domain:
(FD')
3

---

Under review as a conference paper at ICLR 2022
where the minimizer fe Us min c |. the source domain loss is EDy (f) 1l.f ys Ip,
and the target domain loss is ED (f) = IIf - yrlpp. We prove in Proposition 3.1 that f2 is indeed minimizer of ① and provide an intuitive illustration in Figure 2
We show that the robustness can be independent to domain transferabilityy as follows. Consider the X (c.g., m e(f2= 6), (z()))) Since the transferred loss LD (J only evaluates f2 on which is a low-dimensional manifold in RR, an adversarial perturbation g E IT could make x + å R when the loss function is sufficiently big outside the manifold X. Therefore, the robustness could be arbitrarily bad without changing the value of fD, (f²²). ).F)).ie i... the performance of the source model on the target domain.
adversarial robustness of f2 on an input
As we can see, the robustness is independent to domain transferabiliity in this example. On the contrary, if change the perspective consider the the regularization parameter following interesting finding. An illustration of the finding is shown in Figure 2 and a more formal statement provided in Proposition 3.1
have the
Ys
Source Loss tn,0E"
Yr 2o
Transferred Loss (by
Ds
Relative Domain Transferability Loss f Uo 2o2 0c
Different
llBlb c
F
Source Training Function Class
The left figure illustrates the example in the function space F given regularization parameter c. The right figure shows the relations between domain transferability and the c. In this example, the weaker the regularization effect (greater e) is, the greater the relative domain transferability loss (violet arrow becomes).
Figure 2:
Proposition 3.1. Given the problem defined above, fo is a minimizer of equation 0 then the relative domain transferability loss LD - (o, 2 (f2 LD. (f2+).
cf 2 O,
We can see that robustness is not sufficient to characterize domain transferability. However, there is a monotone relation between the regularization strength and the relative transferability loss, where adversarial robustness could be arbitrary. Similar behavior is also observed in our experiments, as we will discuss in Section 4 Naturally, these findings motivate the study of the connections between the regularization of the training process and domain transferability in general,
consider next.
3.2 UPPER BOUND OF THE RELATIVE DOMAIN TRANSFERABILITY
In this subsection, we consider the general transferability problem with fine-tuning. We prove that there is a monotone relationship between the regularization strength and relative domain transfer- ability loss. We also present tight upper bound on the relative domain transferability loss. Denote the training algorithm as A that takes a data distribution D and outputs feature extractor f E FA chosen from a function class FA and a fine-tuning function g E G. Next we formally define relative domain transferability.
Definition (Relative Domain Transferability Loss). Given the training algorithm A and a pair of distributions Ds. Dr E Pxxxy, the relative domain transferability loss between Ds, Dr is defined to be the difference of fine-tuned losses, i.e.,
Ts, Dr) inf CD (g (2) gEg
LD f2
Note that the training algorithm A is not required to optimal, i.e., could be the case that lD Da o fDa) > inf EDS (g f). As we can see, the smaller T(A; Dr) is, the better the model's 's relative performance becomes the target domain.
Another perspective of Definition I is that inf (Dy (D=) = ( ( Ds, D7). From this perspective, the transferred loss is the source loss plus an additional term to be upper is common
bounded by certain distance metric between the source and target distributions in the literature of domain adaptation (c.g.. Ben- David et al. (2007): Zhao et al. (2019)). The key question of the "distance metrie" remains unanswered. To this end, propose the following.
4

---

Under review as a conference paper at ICLR 2022
Definition 2 (G, F pseudometric). Given fine-tuning function class G, a feature extractor func- tion class F and distributions Ds. Dr E Pxxy, the J-seuudooooo between Ds, Dr is (g Dr) == sup inf &D (g f) inf &D, (g o f)l- fEF sEG
gEG
Since the fine-tuning function class is usually simple and fixed, we will use d as an abbreviation in the context where G is clear.
can be easily verified that dg.z is pseudometric that measures the distance between two distri- butions, as shown in the following proposition.
Proposition 3.2. dg.F(-.)) : Pxxx x Pxxy + RR satisfies the following properties: (Symme- try) dg. Dr) (Dr, Ds); (Triangle Inequality) VD' E Pxxx dg.5(Ds, (T),s))))))))) S
dg. D') dg. Dr); (Weak Zero Property) VD Pxxy: :G. =0
In this section, we consider fixed fine-tuning function class & and feature extractor function class FA given by the training algorithm A. Thus, denote dg. as dr for the remainder of the paper. With the definition of d we can derive the following result.
Theorem 3.1. Given training algorithm A, for vDs, Dr Pxxy we have
T(A Ds Dr) S dr (Ds, DT),
or equivalently,
inf bDD (g f DD) S LD. ( o f2 dDs, Dr). SEG
Interpretation: As we can see, the above theorem provides sufficient conditions for good domain transferability. There a monotone relation between the regularization strength and d (Ds, Dr) )r), i.e., the upper bound on the relative domain transferability loss T r(A; Ds, Dr). More explicitly, if a training algorithm A' has FA S FA, then d x. (Ds, Dr) S dr, (Ds, Dr). Moreover, small that
dr. (Ds, Dr) implies good relative domain transferabilitty From this perspective, need both small dy (Ds, Dr) and small source loss LD3 D fD)) to guarantee good ab- solute domain transferability. Note that there is a possible trade-off, i.e., with FA being smaller, dr (Ds, Dr) decreases but possibly fD (gA Ds
f) increases due to the limited power of FA- On the other hand, there may not be such trade-off if Ds and Dr close enough such that d5, (Ds, Dr) is small.
To make the upper bound more meaningful, need study the tightness it.
Theorem 3.2. Given any source distribution Dg E PxxxS, any fine-tuning function class & where includes the zero function, and any training algorithm A, denote
E c==los fR=)=
lDs (g f). inf
SEG.JEJA
We assume some properties of the loss function é RRd Rd + R4: it is differentiable and strictly convex w.r.1. its first argument; Ely.y) 0 for any y E Rd, and lim inf ynlllllll E(ō, y) = co, where Ô is the zero vector. Then, for any distribution xxx on X, there exist some distributions Dr E Pxxxa with its marginal on X being D'X such that
(A; Dr) S d (Ds, DT) (A;Dss Dr) + or equivalently dy, (Ds, Dr) - c ((A Dr) S dy, (Ds, Dr).
Interpretation: In the above theorem, we show that given any Ds. and the marginal Dx there exists some conditional distributions of y|ı such that by composing it with the given D we have a distribution D, to make the bound in Theorem 3.1 tight.. Note that is the difference between the source loss and the its infimum, i.e., with a good enough algorithm A, the e could be arbitrarily small.
3.3 GENERALIZATION UPPER BOUND OF THE RELATIVE DOMAIN TRANSFERABILITY
Here we investigate the proposed theory on relative transferability with finite samples. For a distri- bution D E Pxxx,, we denote empirical distribution with n samples as Dr. That being said,
(g f) = =E (Ey 16(g f(x), w)]
Elg o v.).).))
5

---

Under review as a conference paper at ICLR 2022
where Vs) are i..d. samples from D. Therefore, given two distributions Ds, Dr E Pxxy, the empirical - between them is (D D+).
Note that dg.= is not only a pseudometric of distributions, but also complexity measure, and we will first connect it with the Rademacher complexity.
Definition (Empirical Rademacher Complexity (Bartlett & Mendelson 2002 Koltchinskii
2001 Denole the loss function class induced by G F
Cg = (higs : X RR+ Iggg, where hg.5 lgo f()),)).
Given empirical distribution Do (i.e., data samples), the Rademacher compleexii of is
Rad.n(Co.F)) (Cg.F) -E sup Edh yi) hECG i=1
where & E R are Rademacher variables, i.e., each E, is i.i.d. uniformly distributed on {-1,1}.
We can see that if there is a F' F. then Rad (.g. I Radgg((g..)) (Lg.z). With the above defini- tions, we have the following lemma connecting the (G.FF))ssuudomete
Rademacher complexity.
Lemma 3.1. Assuming the individual loss function f x y + [0, cl. given any distribution D E Pxxx and V8 O, with probability 2 - we have
1n(4/0)
dg.r(D,D") 2Rad (Cg.r) 30y
2n
Therefore, denoting again dr,, as dg.FA. the empirical version of Theorem 3.1 is as follows.
Theorem 3.3. Assuming the individual loss function é y/ y [0, c). given vDs, DT E Pxxx, for 45 > 0 with probability 2 1 - 5 we have
In(8/0)
T TAA DT) S dr, (Ds, DT) + 2Rad By (Co,Fx) + 4Rad (.) + 90V
2n
We can see that a smaller feature extractor function class FA implics both a smaller d, and the Rademacher complexity. Therefore, the monotone relation between the regularization strength and the upper bound on the relative domain transferability loss also holds for the empirical settings.
Other than direct regularization, empirically find that the transferability is also related to the use of data augmentation. Can we explain such phenomena from the view of regularization again? We discuss this question next.
3.4 WHEN CAN DATA AUGMENTATION BE VIEWED AS REGULARIZATION?
In this subsection,
discuss the connections between data augmentation (DA) and regularization. We present the results and their interpretation in this subsection, while deferring the detailed discus- sion to the Section B in the appendix.
Empirical research has shown evidence of the regularization effect of DA (Hernández-Garde & König 2018a|b) b). However, there lack of theoretical understanding on when can data augmen- tation be viewed as regularization in general. In an attempt to address this question, we consider a general DA setting of affine transformation (Perez & Wang 2017) with parameters (W., b.) whose distribution represents specific DA.
General Settings. We consider the fine-tuning function g: Rd - IR as linear layer, which will be concatenated to the feature extractor f _ + d Given model f. the squared loss E(g o fx)) y) (g o f(x) - 2) and accordingly apply second-order Taylor expansion to the objective function to study the effect of data augmentation.
DA categories. We discuss two categories of DA.. feature-level DA and data-level DA. Feature-level DA (Wong al. 2016 Deeess & Taylor 2017) requires the transformation to be performed in the learned feature space: given a data sample E I and a feature extractor f. the augmented feature is W.f(x) + b. where W. E Rddx b IRd are sampled from distribution. On the other hand,

---

Under review as a conference paper at ICLR 2022
data-level DA requires the transformation to be performed in the input space: given data sample z, the augmented sample is W.r + b, where W. E Rmx" b. E R" are sampled from a distribution.
Intuition on sufficient conditions. For either the feature-level the data-level DA, the intuitions given by our analysis are similar. Our results (Theorem B. suggest that the following condi- tions indicate the regularization effects of a data augmentation: 1) Ew, Ew,[W_] = I: 2) Es, [b,] 0;
3) W, and b, are independent, where T is the identity matrix and Ô is the zero vector; 4) W. is not a constant if it is the feature-level DA; 5) DA is of a small magnitude if is the data-level DA.
Empirical verification. Combining with Theorem 3.3 it suggests that DA satisfying the conditions above may improve the relative domain transferability. In fact, it matches the empirical observa- tions in Section 4 Concretely, 1) Gaussian noise satisfies the four conditions, and empirically the Gaussian noise improves domain transferability while robustness decreases bit (Figure (5): 2) Ro- tation, which rotates input image with a predefined fixed angle with predefined fixed probability. violates IEyy [W_] = II, and empirically the rotation barely affects domain transferability (Figure [4] in Appendix D.3 ; 3) Translation, which moves the input image for a predefined distance along
pre-selected axis with fixed probability, violates Es, [b.] 0. and empirically the translation dis-
tance barely co-relates to the domain transferability (Figure 14 in Appendix D.3)
EVALUATION
4.1 EXPERIMENTAL SETTING
Source model training We train our model on two source domains: CIFAR-10 and ImageNet. Unless specified, we will use the training setting as follow?" For CIFAR-10, we train the model with 200 epochs using the momentum SGD optimizer with momentum 0.9, weight decay 0.0005, an initial learning rate 0.1 which decays by factor of 10 at the 100-th and 150-th epoch. For ImageNet, we train the model with 90 epochs using the momentum SGD optimizer with momentum 0.9, weight decay 0.0001, an initial learning rate 0.1 which decays by a factor of 10 at the 30-th and 60-th epoch. We use the standard cross entropy loss denote as LC (h,, x y). where ht, = Is o f is the trained model and x; y the input and label respectively. To evaluate the robustness on the source domain, we follow the evaluation setting in Ilyas et al. (2019) and perform the PGD attack with 20 steps using e 0.25. We also evaluate the robustness using AutoAttack in Appendix D.4 For both tasks we use ResNet-1 8 as the model structure. We provide results of other model structures in appendix D.2
Domain Transterability We evaluate the transfcrability from CIFAR-IO to SVHN and from Im- ageNet to CIFAR-10. For the ImageNet transferability, we focus on CIFAR as the target domain, since it is the domain that is the most positively correlated with robustness as shown in Salman et al. (2020). We evaluate the exed-feature transfer where only the last fully-connected layer fine-tuned following our theoretical framework. We fine-tune the last layer with 40 epochs using momentum SGD optimizer with momentum 0.9, weight decay 0.0005, an initial learning rate 0.01 which de- cays by factor of 10 at the 20-th and 30-th epoch. To mitigate the impact of benign accuracy, we evaluate the relative domain transfer accuracy (DT Acc) as follows. Let acCare and accsst be the accuracy of the fine-tuned model source and target domain, and acci and accfge be the accuracy of vanilla model (i.e., models trained with standard setting) on source and target domain, then the relative DT accuracy is defined as:
DT Acc = (aCCrgt aCCare) - (acclyt aacc
We also provide the results of absolute DT accuracy in Appendix D.I
4.2 RELATIONSHIP BETWEEN ROBUSTNESS AND TRANSFERABILITY UNDER CONTROLLABLE CONDITIONS
We train the model under different controllable conditions to validate our analysis. In particular, we train the methods by controlling different regularization or data augmentations to evaluate the change of model robustness and transferability.
'hese settings are inherited from the standard training algorithms for CIFAR- 10 (atsps:://ithhb com/ kuangl wwwponggggiitttttooohhhoo tree/mmaster/mmagenn
ci far) and ImageNet
7

---

Under review as a conference paper at ICLR 2022
CIFARIO -2x SVHN
ImageNeet > CIFARIO
CIFARID >> SVHN
ImageNitt >> CI
Relative DT Acc (%)
LLR(A)
-0.01
LLOT
0.1
0.01
1.0
1.0
0.1
10.0
0
-5
-5
-10
-10
.8.82
-3
R: -0.918
R: 00.96.
R:-0.954
24
10
20
Robust Acc (%)
Robust Acc (%)
Robust Acc (%)
Robust Acc (%)
Figure 3: Relationship between robustness and transferability under different norms of last layer, via training with last-layer regularization (LLR) and last-layer orthogonalization (LLOT).
Controlling the norm of last layer As shown in our framework, domain transferability is related with the regularization on the feature extractor. Here we regularize the transferability by controlling the norm of last linear layer Is- Intuitively, when we force the norm of g, to be large during training, the corresponding norm of f will be regularized to be small. We use two approaches to control the last layer norm:
Last-layer regularization (LLR): we impose a strong 12-regularizer with parameter x specifically on the weight of g, and therefore our training loss becomes: I.Lnnh,,, 3. y) (h, 2,, y) +
b - -11g-11. where ||]||F is the frobenius norm of the weight matrix of ga.
Last-layer orthogonal training (LLLOT): we directly control the 12-norm of gs with orthogonal training (Huang et al.] (2020)). The orthogonal training will enforce the weight to become a 1- norm matrix and we multiply a constant to obtain the desired norm ||g=|12.
The result of LLR and LLOT are shown in Figure 3 We observe that when we regularize the norm of last layer to be large (i.e. smaller in LLR and larger ||g/ll in LLOT), the domain transfcrability will increase while the model robustness will decrease (their negative correlation is significant with Pearson's 's coefficient around -0.9). This is because larger last layer norm will produce a feature extractor f with smaller norm, which, according to our analysis, leads to a better domain transfer- ability. On the other hand, the model Is o ʃ will have larger norm and therefore becomes less robust under adversarial attacks.
Controlling the norm of feature extractor We directly regularize the feature extractor f and check the impact on domain transferability. We implement two regularization as follows:
Jacobian regularization (JR): we follow the approach in Hoffman et al. (011)) to apply JR on the feature extractor. Given model he I. f. the training loss becomes: LJR(h,, I. y) LCE(h,, 3) + D IIJ x) where J Jf x)) denotes the Jacobian matrix of f on and ||- is the frobenius norm.
Weight Decay (WD): we impose strong weight decay with factor Au the feature extractor if during training. This is equivalent to imposing a strong 12-regularizer with factor Aw on the feature extractor (excluding the last layer).
The results under JR and WD are shown in Figure 4 We observe that with larger regularization on the feature extractor, the model shows higher domain transferability, which matches our analysis. Meanwhile, the robustness decreases significantly with large regularizer. This is because a large regularization will harm the model performance on source domain and lead to low model robustness.
CIFARIO SVHN
ImageNot >> CIFARIO
CIFARIO SVHN
ImageNet -> CIFAR10
Relative Acc (96)
15
(R(Á,)
40
WDD
0.0:055
15
WDJA_1
0.0001
100
0.001
0.0005
1000
30
JR(A)
0,001
10
0.01
10
20
0.01
10
R:
0.313
R: 0.105
R::33
R:
-0.944
20 30
40
50
60
70
15
25
35
45
55
10
20
10
15
20
Robust Acc (%)
Robust Acc (%)
Robust Acc (%)
Robust
Figure& 4: Relationship between robustness and transferability when we regularize the feature ex-
tractor with Jacobian Regularization (JR) and weight decay (WD).
8

---

Under review as a conference paper at ICLR 2022
CIFARIO >> SVHN
ImageNet CIFAR1O
CIFAR1O SVHN
ImageNett CIFARID
60
Relative DT (%6
40
Gaussto)
10
05
30
Gauss(o)
0.25
0.05
20
0.25
1.0
20 R:-0. -0.44
0.168 Robust Acc (%)
0.566
R: 0.880
20
30
Robust Acc (%)
Robust Acc (%)
Robust Acc (%)
Figure 5: Relationship between robustness and transferability when we use Gaussian noise (Gauss) and posterize (Pos) as data augmentations.
ResNet18
ResNet18
WideResNet-50
WideResNet-50
Relative DT Acc (%6
80
Rescale(m)
15
Blurlk)
80
Rescale(m)
Blurtik
60
60
S
40
20
5
20
R:
0
0.842
R: -0.993333
R: -0.852
10
22
24
Robust Acc (%)
Robust Acc (%)
Robust Acc (%)
Robust Acc (%)
Figure 6: Relationship between robustness and transferability on ImageNet when we use rescale and blur as data augmentations.
Data augmentation As shown in Section 3.4 data augmentation can be viewed as type of reg- ularization during training and thus affects the domain transferability. Here consider both noise dependent and independent data augmentations.
Noise-dependent data augmentation We include two noise-dependent augmentations:
Gaussian Noise data augmentation (Gauss): add zero-mean Gaussian noise with variance o² to the input image.
Posterize (Pos): we truncate each channel of one pixel value into bits (originally they are bits).
The results of Gauss and Pos shown in Figure We observe that the domain transferabilityy of trained model keeps improving with larger data augmentation, which matches our theory. The robustness also benefits from small data augmentation, but decreases when it becomes large.
Resolution-related (noise-independent) data augmentation. Specifically, for ImageNet to CIFAR-10 transferability, we consider resolution-related data augmentations. The intuition is that when the target domain has a lower resolution than the source domain (ImageNet is 224 x 224 while CIFAR-10 32 x 32), the data augmentations that down- wawple the inputs during the training on source domain will help transferability. We consider the below resolution-related augmentations:
we rescale the input to be m times smaller (i.e., shape ImageNet as (224/m) x (224/m)) and then rescale them back to the original size.
Rescale:
Blur: apply Gaussian blurring with kernel size on the input. The Gaussian kernel is created with standard deviation randomly sampled from (0.1,2.0)
We show the results of rescaling and blurring in Figure 6 The experiments are evaluated only for ImageNet to CIFAR-10, and we include the results of both ResNet18 (the default model) and WideResNNt50.. We can see that these data augmentations help with transferability to target domain, although the robustness on the source domain decreases since these augmentations do not include any robustness-related operations.
CONCLUSIONS
In this work, we theoretically analyze the sufficient conditions for domain transferability based on the view of function class regularization. We also conduct experiments verify our claims and observe some counterexamples that shows a negative correlation between robustness and domain transferability. These results helpful in the domain generalization of machine learning models.

---

Under review as a conference paper at ICLR 2022
ETHICS STATEMENT
Our work focuses on theoretically and empirically studying the domain transferability of a machine learning model. All the datasets and packages we use are open-sourced. We do not have ethical concerns in our paper.
REPRODUCIBILITY STATEMENT
We have tried our best to provide training details to facilitate reproducing results. In Section 4.1 we provide detailed results on how to train the model and how to transfer the trained model to target domain, well how evaluate model. We also upload the zip file of our code with the submission. We will open-source our code once accepted.
REFERENCES
Peter L Bartlett and Shahar Mendelson. Rademacher and gaussian complexities: Risk bounds and structural results. Journal of Machine Learning Research, 3(Nov):463 482, 2002.
Shai Ben-David, John Blitzer, Koby Crammer, Fernando Pereira, et al. Analysis of representations for domain adaptation. Advances in neural information processing systems, 19:137, 2007.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium security and privacy (sp). pp. 39-57, IEEE, 2017.
Jianbo Chen, Michael Jordan, and Martin J Wainwright. Hopskipjumpattack: A query-efficient decision- based attack. In 2020 ieee symposium on security and privacy (sp), pp. 1277-1294. IEEE, 2020.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In International Conference Machine Learning, pp. 1310-1320. PMLR, 2019.
Nicolas Courty, Rémi Flamary, Devis Tuia, and Alain Rakotomamoniy. Optimal transport for do-
main adaptation. IEEE transactions pattern analysis and machine intelligence, 1853- 1865, 2016.
Terrance DeVries and Graham W Taylor. Dataset augmentation in feature space. arXiv preprint 1rXiv:1702.05550 05538. 2017.
Logan Engstrom, Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Brandon Tran, and Alek- sander Madry. Adversarial robustness prior for learned representations. arXiv preprint 1909099500.0 2019.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.
Alex Hernández- García and Peter König. Data augmentation instead of explicit regularization. arXiv preprint 1tt.:::8886008855.. 2018a.
Alex Hernández-Gareia and Peter König. Further advantages of data augmentation on convolutional neural networks. In International Conference Artificial Neural Networks, pp. 95-1 Springer, 2018b.
Judy Hoffman, Daniel A Roberts, and Sho Yaida. Robust learning with jacobian regularization. arXiv preprint ar0iv:1908.00 02729, 2019.
Haoshuo Huang, Qixing Huang, and Philipp Krahenbuhl. Domain transfer through deep activation matching. In Proceedings of the European Conference on Computer Vision (ECCV), pp. 590-605, 2018.
Lei Huang, Li Liu, Fan Zhu, Diwen Wan, Zehuan Yuan, Bo Li, and Ling Shao. Controllable orthog- onalization in training dnns. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 6429-6433 2020.
10

---

Under review as a conference paper at ICLR 2022
Andrew Ilyas, Shibani Santurkar, Logan Engstrom, Brandon Tran, and Aleksander Madry. Ad- versarial examples are not bugs, they are features. Advances neural information processing systems, 32, 2019.
Vladimir Koltchinskii. Rademacher penalties and structural risk minimization. IEEE Transactions on Information Theory, 47(5):1902-199 2001.
Clare Lyle, Marta Kwiatkowksa, and Yarin Gal. An analysis of the effect of invariance on gen- eralization neural networks. In International conference on machine learning Workshop on Understanding and Improving Generalization in Deep Learning, volume 1, 2019.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
Takeru Miyato, Shin-ichi Maeda, Masanori Koyama, and Shin Ishii. Virtual adversarial training: regularization method for supervised and semi-supervised learning. IEEE transactions on pattern analysis and machine intelligence, 41(8):179--199) 2018.
Krikamol Muandet, David Balduzzi, and Bernhard Schölkopf. Domain generalization via invariant feature representation. In International Conference Machine Learning, pp. 10-18. PMLR, 2013.
Luis Perez and Jason Wang. The effectiveness of data augmentation in image classification using deep learning. arXiv preprint arXiv: 2017.
Elan Rosenfeld, Pradeep Ravikumar, and Andrej Risteski. An online learning approach to interpo- lation and extrapolation in domain generalization. arXiv preprint arXiv:2102.13128, 2021.
Kevin Roth, Yannic Kilcher, and Thomas Hofmann. Adversarial training is a form of data-dependent operator norm regularization. arXiv preprint (tti::/906001555 2020.
Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adver- sarially robust imagenet models transfer better? arXiv preprint arXiv:2007.08488) 2020.
Chun-Chen Tu, Paishun Ting, Pin-Yu Chen, Sijia Liu, Huan Zhang, Jinfeng Yi, Cho-Jui Hsieh, and Shin-Ming Cheng. Autozoom: Autoencoder-basee zeroth order optimization method for attack- ing black-box neural networks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 33, pp. 742-749, 2019.
Sebastien C Wong, Adam Gatt, Victor Stamatescu, and Mark D McDonnell. Understanding data augmentation for classification: when to warp? In 2016 international conference on digital image computing: techniques and applications (DICTA), pp- 1-6. IEEE, 2016.
Kaichao You, Ximei Wang, Mingsheng Long, and Michael Jordan. Towards accurate model selec- tion in deep unsupervised domain adaptation. In International Conference on Machine Learning, pp. 7124-7133. PMLR, 2019.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning, pp. 7472-7482, PMLR, 2019a.
Linjun Zhang, Zhun Deng, Kenji Kawaguchi, Amirata Ghorbani, and James Zou. How does mixup help with robustness and generalization? arXiv preprint arXiv:2010.04819, 2020.
Yuchen Zhang, Tianle Liu, Mingsheng Long, and Michael Jordan. Bridging theory and algorithm for domain adaptation. In International Conference on Machine Learning, pp. 7404-74133 PMLR, 2019b.
Han Zhao, Remi Tachet Des Combes, Kun Zhang, and Geoffrey Gordon. On learning invariant representations for domain adaptation. In International Conference Machine Learning, pp. 7532-7532. PMLR, 2019.
11

---

Under review as a conference paper at ICLR 2022
Appendix
A PROOFS
Proposition A.1 (Proposition 3.1 Restated). Given the problem defined in subsection 3.1
fD is
minimizer of equation 1 Moreover, ifc 2 d' 2 O, then the relative domain transfer loss ED (J:
(D.(52>) 2 &D (fe -)=)))()))))) (D (12
Proof. Recall that ED (f) Il - ysllo, CDr (f) Ilf vellD and f2 ys e }-
llusll
First, let's verify that
fes E arg lD. (f), s.t. [l cc
jef
If 2 llvsll, then fe == ys achieves the minimum. If < lıuslla then for any f E F: FIfld we have
lDs (f) |ff ysllp 2 llsllo Il lluslo
[[ Tuee >lllD llys l
c us lD (fs(
Therefore, p indeed achieves the minimum.
Now, let's prove the proposition. For any 2 |lus|a. we have lD (f 0 and LD (fP=) a constant. Therefore, there is no difference for all e 2 ||ys|lp ID and the proposition holds for P d' |lus||D. Then, We only need to verify the case for |uus| 2 d:
(Ds(S20) - LDs (s = c- - d' = Tiell Us
Tus Us|lp ||D
= 150s fe ID = 11 yT + yT - 1o
2 11 yr al D 11yT fe ||
2 1520 yr 1yr f: 11
lx (S?:) - (J2
Rearranging the above inequality gives the proposition.
Proposition A.2 (Proposition 3.2 Restated). dg. Pxxy x Pxxx - R4 satisfies the follow- ing three properties.
1. (Symmetryy (Ds, Dr) = dg..a(Drr) Ds).
2. (Triangle Inequality) For VD' E Pxxx: dg. F (Ds, DT) S (D. DT).
3. (Weak Zero Property) For VD Pxxy: (D, D)
Proof. Recall that
dg Dr) = sup inf & fgo inf ED f)l- FEF geg
gEG
We can see that the symmetry and weak zero property are obvious. For triangle inequality, given VD' E Pxxxi
dD.
sup inf (g
inf CD (g f)
JeF gEg
gEg
sup
inf
LD (g
inf ED (g 0 f) inf ED (g f)
inf &D (g o f)l
SeF gEg
BEG
gEG
gEg
< s inf (p f) inf (g o f)l +
inf t (g o f)
inf
pD (g 0 f)l)
lef ges
gES
ges
geg
I sup inf ( f) inf e (g o f)l +
sup
inf lo
inf tD (g f) gEG
JEF gEG
gEG
feF
gEG
dg.r(Ds, D') + d Dr))
12

---

Under review as a conference paper at ICLR 2022
Proposition A.3. Denote the function class
Lg.F = (hg.s : X x y + R+ Ee where ha.5 = fg f()),
Let d X x R be metric X Y, and assume vh E Lg L-Lipschitz continuous with respect to the metric d. Then, we have
Pr) (
where WDDs, Dr) is the Wasserstein distance:
(Ds, Dr)
sup oxXXy-R
B(z,)) lo(a, v)] ((,,) [0(x,)) s.I. ó is I-Lipschitz.
Proof. Recall that
(g (T) = sup inf LD f) inf &D (g f)l- FEF gEg
sEg
By the definition of inf, for Ve > 0 there exist gs.e: . E G such that
inf &DS (g fe) 2 fg (gs. o fc) - gEg
inf ED, (g fe) 2 LD (9r,c fe) gEG
By the definition of sup, there exists f. E F such that
(g, Dr) S
inf (g fe) inf &D (g fe)l + 9EG
gEg
max inf ( - fe) - inf lD (g o fe), inf lD fe) inf la (g f() te geg
gEG
gEg
gEg
max(Eps (gr, o fe) inf Dr (g o fc), (gs fc) inf la (g fc) +
gEg
9Eg
max fe) lD (gT, fe), (gs, o fe) (os. f()) + 2e. (2)
Let's first consider the first term the max above.
fos(,r, fe) tDr (gr,e o fe)
L (or fe) (or, o fe))
(E(r (ggT, o fc(x), w)] ( Mt (gg, fe(x),)))
S L W(Ds: Dr),
where the inequality is due that both Hllgs, fe(x),v) and felgr, o fc(x), y) are 1-Lipschitz w.r.t. (z, y) and the metric d.
Similarly, we also have
DD (gs. o fe) (gs,e fe) < -- (DDs, Dr).
Therefore, equation iimplies
(Ds, Dr) 2
Letting + 0 completes the proof.
Proposition A.4. Consider multi-class classification where [Rc] for some k 2 2. Define the loss function as
Elg f(x), = 1 1arg maxig o f()),, + y}
JE(K]
Let 8ry (Ds, Dr) denote the total variation distance. Then we have
(Ds, Dr) drv (Ds, Dr)
13

---

Under review as a conference paper at ICLR 2022
Proof. Fix f E F. By the definition of inf, there exists 9r, such that
inf lD (g o f) inf (D o f)
gEg
geg
< inf ED3 (y f] lDr of] +e 9E9
< 1 (gr,e o - (gr, fe +
[(au)) Ds [e(gr,e f(x), v)] - (eaa),,l((gx, f(x), +
(z {arg ma, o f(x)); # b - (x.g) {arg (ar, f(x)); + vJll te
sE(K]
jE(N]
(3)
Let A be the event such that A {(r, y) arg maxzel (gT,e o f(x)) + y).
Then write
equation 3 as
3
(a DD [A] - P (r (A] +
sup
P (x:)) [B] (2.))= [B] +e
B
8TV (Ds. Dr) +
Send 0. Noting that f F was arbitrary, apply sup to both sides gives the desired inequality.
Theorem
3.1 can proved easily by definition.
Theorem A.1 (Theorem 3.1 Restated). Given training algorithm A, for vDs, Dr E Pxxy
have
T(A Dr) S (Ds, Ds
or equivalently,
inf tD, (g f ( {R8) + (Ds, Dr). SEG
Proof. By definition,
T(A Dr) = inf LD fg0 fR0) - lD Dz f2
gEG
S inf ED (g 0 f2 inf gEG
l (g f2
gEG
< inf l (g [ - inf l (g o [2o)]
gEg
9Eg
s sup inf Dr (g 0 f)
inf Dg (g f) SEg
JEFA gEG
(Ds,
To prove Theorem 3.2. we first prove the following interesting lemma.
Lemma A.1. Let S = (y E Rd ||m|| r) denotes the (d 1)-dimensional sphere in Rdd with
radius r > O. If a function h: S 1- - I2d satisfies
Vy E s
(h(v). <0,
(4)
then have
de conv(h(S,
i.e. Õ the convex hull of (h(y) y E SØ-1).
Proof. We assume that Ō & conv (onv(h(S, and prove by contradiction. Since & conv(h(S,
we can find hyperplane that separates and the convex set conv(h(S, ))). By the separating hyperplane theorem there exists a nonzero vector IRd and e 2 0 such that
Zz E conv(b(S,-1))
(2
2020 0.
(5)
14

---

Under review as a conference paper at ICLR 2022
We choose y re/l|ell2 and observe that h(y) conv(h(SS;-))) Hence, by equation 5 (h(v). 2 0,
we have
which contradicts to the condition of equation Therefore, it must be that 0 E conv(b(S,-1))
Theorem A.2 (Theorem 3.2 Restated). Given any source distribution Ds E Pxxxs, any fine-tuning function class 9 where includes the zero functiin, and any training algorithm A, denote
6 : eD= Ds {R²)- inf gEB.JEFA
LD 1o f).
We assume some properties of the sample individual loss function R x Rd + R4: it is differentiable and strictly convex wrr.. its first argument: E(y, y) 0 for any y E R and lim inf y:llull==r ((0, y)
Then, for any distribution DD X, there exist some distri- butions Dr E Pxxy with its marginal on being Dx such that
TA: Dr) S dr (Ds, Dr) (A: Dr) +c.
Proof. The Ds, Dr) S dr. (Ds. Dr) is proved by Theorem 3.1, we only need to prove that there exists some Dr E Pxxx with its marginal on X' being D such that
(Ds, Dr) 3 7 Ds; Dr) + inf DD (g fRo) gEg
inf gEB,fEFa
lD (go f)-
We begin by observing that lim inf y: 1ollll22 E(O.g) y) = co, and thus there exists such that
Vy E S ((Ō,)) 2 ED3 (0) = E (m (((,,))).
(6)
where S (y E Rd ||v||2 r denotes the (d 1)ddimensional sphere with radius Note the we abuse the notion bit to let also denotes the zero function (i.e., maps all input zero). Now, let us define at the following set
v (V, y S
where V, is taking the gradient w.r.t. the first argument of ). By the strict convexity of ((:,),
we have
(v. ((, Vie(O.,).v))
Noting that E(y, y) = 0 is the unique minimum of {(- y), we have É(ŌŌ y) > 0. Accordingly,
Vy s 0> -((0, y) V e( v).
Having the above property, and noting that v,((ū,)) -) S + Rd, we can invoke Lemma A.1 to see that
0 E conv (V). Therefore, there exists n points {y:) C S such that
σ = v(),))))
where o; > and Σi= G. 11
Therefore, we can define the target distribution Dr the following. Given any D. the distribution of y conditioned on æ is: y; with probability G. Now we verify the distribution Dr indeed makes the bound c-tight. Denote strictly convex function h Rd - R4 as the following
h(-) = Σ ccl(v16))
15

---

Under review as a conference paper at ICLR 2022
Since h is strietly convex and Vh(0) 0 (equation 7/
that h(0) achieves the unique
global minimum of h on R
Therefore, given the Pr for any Vf E FA we have
inf CD (g o f) = inf ((a.y)Dr,l(l [E(g s(x),
geg
geg
inf BR-Di DM gEg
Σ clllg ((x)
inf BENDD [hig f(x)))
gEg
h(o)
(g contains the zero function)
Σ c (c((ū,,)).
(8)
Recall that d7,(Ds, Dr) = SuDJEFA |infgeg CD (g f) infgeg ED (g o f)l, we can see that
dr, (Ds, )
sup
GE(0, y:) inf Σ
&D (g f)l
JEFA
gEB
i=1
By equation 6 for Vf FA. we have
ce(( vi) 2 lD. LD. (ūc 2 inf LD (g f).
gEg
Hence, we can continue
9
sup JEFA
c(( SEG
inf
tot (o0 Σ ((( inf gegifer,
lD
inf inf lD (g 128)- gEGifEFA 9EG
lD
(by equation g
-inf lD (g 120) - (9 fD8) + ED Ds f2o)- 9E9
inf gEg.JEFA
(g
=s(A;Ds, Dr) +c.
Therefore, it holds that dr, (Ds: Dr) S T(A Dr) + and thus the theorem.
Lemma A.2 (Lemmal 3.1 Restated), Assuming the individual loss function é: y:yYy - [0,c]. given any distribution D E Pxxy and v8 0, with probability 2 8 we have
In In(4/5)
dD. D)) < 2Rad (Cg.F) 30y
2n
Proof. Given any 8> 0, / F,g G. D PXxx. and taking any hg. E L.gFF (Definition) 3
with probability 2 1 we have
tplg f) (00 = E /
(2, (2,v)] - 1
Σ
1=1
(2(2/))
< 2Rad (Lg.F) + 3eV
(10)
2n where the inequality by the well-known Rademacher complexity uniform bound. Similarly,
(g f) Eolgo f) = -l 1
hg ys)
1=1
/In(2/8)
S 2Rdd (-6g,5) + 3e/
2n
In(2/8)
2Rad (Co,r) + 3ey
(11)
2n
16

---

Under review as a conference paper at ICLR 2022
The probability that both events equation 10 and equation 11 happen can be upper bounded by union bound, i.e.,
Pr( 10
Pr
10
;) 2 1 - (Pr( 10 9 + Pr(
1 - 28.
Therefore, combining the above with probability 2 1 å we have
In(4/0)
[C o - (gn f)l 2Rad (Lg.F) 301
(12)
2n
we can prove the lemma the following. Given Ve 0, by the definition of infimum there exists a 9s E 9 such that
With equation 12
(g f) < inf Eolo f) t
gEg
By equation 12 with probability - 8 we have
In(4/0)
Ln o f) S lo(g. f) + 2Rad (Lg,)) 30/
2n
Moreover, by definition
inf Em () (g o
gEG
Combining the above three inequalities we have
In(4/0)
inf 5m (g < inf lolgo o f) + e + 2Rad R.. (fg.F) + 3eV
gEg
gEg
2n
Letting + 0, we can see that
Lm (g f) inf lo f) (Rg.).(Cg.F)) 30// In(4/8)
inf
gES
sEg
2n
Similarly, derive the above inequality again but with D and Dr switched. Therefore,
inf C (g o f) inf Eo(g f) S (Rg.F) + 30y In(4/0)
DEG
gEş
2n
Since the above inequality holds for ff E F, taking the supremum over f E F gives the lemma.
Lemma A.3. Assuming the individual loss function f y y - [0, c), given any distributions
Ds, DT E Pxxx and v8 > O, with probability 2 1 - we have
In(8/8)
dr (Ds, Dr) < dr (Dg. D 2(Rad (CG.Fa) + Rad (Cg.Fa)) + Bcy
2n
Proof. By Proposition 3.2
apply the triangle inequality derive
(Ds. Dr) s dr (Ds, D4) + drr, (D+. ds D4) + dr, (D. Dr) Pr)++ dr Ds).
By Lemma 3.1 we can apply the union bound argument (e.g., see the proof of Lemma 3.1 to bound dy, (Dy. Dr) and dy, (Da, Dz). That being said, v8' > 0 with probability 2 1 28' we have
In(4/8")
dr, (D', Ds) < 2Rad By (Co,F,) + 3ey
2n
/ln(4/8')
dy, (D7, Dr) < 2Rad Ba (Lo.r,) + 3e/
2n
Therefore,
In(4/8')
dr, (D),Dr) Dr) + dd. (D3, Ds) < 2(Rad (Lg.Fa) Radd (Cg.Fa)) + Gog
2n
Denoting 8 = 25' gives the lemma.
17

---

Under review as a conference paper at ICLR 2022
Theorem A.3 (Theorem 3.3
Restated), Given vDs, Dr Pxxx, for 48
with probability
2 1 5 we have
In(8/0)
TAA;D3, S dr (D3, DH) + 2Rad (Lg.Fa) + 4Rad (Lg.Fx) Vey
2n
Proof. For 46 > 0, from the proof of Lemma A.3 we can see that with probability 2 1- -::
In(8/8)
dr (D'. Ds) S 2Rdd (Lg,Fx) + 3
(13)
2n
In(8/6)
ds (D7, Dr) S 2Rad (Cg,r + +
2n
and Lemma A.
holds. Therefore
T(A; D3. Dr)
= inf l (g o fa gEG
0g SA
D
:
S inf D (g (33)
l (g (2))
inf gEy
9E9
D3 inf inf lp (g I gEy
lD (go 12
+ inf gEg
ls
(g f2
inf geg
&g (g 13
gEg
S d (Ds, DT) d (D's Ds)
Im(8/0)
S dyy, (Ds, Dr) + 2Rad Dy (Lg,FA) + 30/
2n
In(8/5)
S dr (D's DT) + 2R (Cg.Fa) + 4a (Cg.Fx) 9e 2n
where the first inequality is by definition of infimum, the second inequality is by the Definition the third inequality is by equation and the last inequality is by Lemma A.3
B DATA AUGMENTATION (DA) AS REGULARIZATION
In this section, we discuss data augmentation (DA) as a concrete example of regularization for train- ing feature extractor /P= and explore its impact on the function class FA discussed in Section 3
Empirical research has shown evidence of the regularization effect of DA Flernández-Garcia & König 201 2018abb) b). However, there is a lack of theoretical analysis, and thus we aim to construct understand under what sufficient conditions DA can be viewed as regu- larization on the feature extractor function class FA We categorize DA into feature-level DA and data-level DA, and for each category, we analyze different DA algorithms characterize the suf- ficient conditions under which DA regularizes the function class FA. Combined with analysis in Theorem 3.3 we also provide concrete sufficient conditions to tighten the upper bound of relative transferability TAA; Dr)).
theoretical framework
General Settings. For the following discussion apply a general DA setting of affine transfor- mation (Perez & Wang 2017), taking the form of x = W x + b,, where (æ, xx,) a pair of the original and augmented samples, (W., b.) are parameters representing specific DA policies. We set g: IRd + R as the linear layer corresponding to the weight matrix Wg. which will be composed with
the feature extractor f T > Rd. We use squared loss for e: IR x R + RR and let f.= (g f)
be the objective function given by training algorithm A from Theorem 3.3
B. FEATURE-LEVEL DA (AFL)
Feature- level DA (Wong et al. 2016 DeVries & Taylor 2017) requires the transformation to be performed in the learned feature space, which gives us an augmented feature Wzf(x) + b,. We Aves-Aveggg algorithm where we take average of the loss over augmented features for
18

---

Under review as a conference paper at ICLR 2022
training. Denote the training algorithm based on feature-level DA A the objective function is as below.
1 - Ew. Ew... (V).
A (g
1=1
Theorem B.1. Apply feature-level DA with affine transformation parameters (W,, b.) s.t. 1) Ew. G..[W.] Im: 2) W. # In (i.e., W, not an identity matrix); 3) Es, [b.] Omi 4) W. and b, are independent. Set f: + R as squared loss; Define Aw. == W. Im. then we have
An (g f)= eb 1) RAF
where DAFZ= = Ei=1 Ew. [l)) Aw. W + Eb, |6_ W
Proof. (W, f(x))) for squared loss. Apply Taylor expansion f99 (W.f(z)) + b.). 3/ around f(x;), , all higher-than-teee order terms will vanish:
B, b. e (g9 (3i) +b.).
-Bw, d. ((W. o f(x.). vk) + W. (Aw. f(x,) +..) (. f(z:).
W. (Aw, (x:; (AW, ((x;) + b.) E" (W. Mas)).
-e =e(WT f(x)). wi + Ew,, [W. (Aw. (x; + b.)(A.. w. f(x,) b.)) b.)TT,
=e(WT f(xx). w.) Ew. [I] Aw. W w/ll]] Es, || W l1]]
The second equality holds since Eaw. Ew. [W, [m] ((,,m) and Es.
Om. The third
equality holds since W; and are independent. Therefore, Lnn Aro (gof) = 1 n
Em Ew, Ew,,. D.
Eggo
f) QAFZ.
Interpretation. QAFZ is composed of two segments: 1) l2 regularization f-dependent scalar averaged over W. and x;; 2) l2 regularization to an f-independent scalar averaged over b.. Due to the regularization effect on from the first segment of AF. can reasonably expect the function class FA enabled by FL to be subset of that enabled by general training algorithm A.
Sufficient conditions. Combined with Theorem 3.3 the sufficient conditions to tighten the upper bound dr,, (D3, DT.) for the relative transferability TAA; Ds, Dr) are: feature-level DA (AF4) with parameters satisfying: 1) Ew, [W.] Im 2) W. # m 3) Es, [b+] Ōm: 4) W, and b, are independent.
B.2 DATA-LEVEL DA (APL)
Detellevel DA requires that the transformation to be performed in the input space to generate aug- mented samples W, + b.. We cover analysis two ubiquitous algorithms for data-level DA training: PredictionAveragiin (AP") (Lyle et al. 2019) and Averagngg (AP") (Wong et al,
2016). The difference between ABL and AL lies whether we take the average of the prediction or the losses:
1
( (go
e ((Ew. v. [g S(W.,, + b.)).
(14)
L Ln Apo (go
Ew.,e. [E(g o f(W.x, + bb)).
n
19

---

Under review as a conference paper at ICLR 2022
Theorem B.2. Define the data-level deviation caused by data-level DA A {APE, .A,, with parameters (W,, b.) from the original data sample as A., == (W, - J. + b,. and define A ==
| ll Suppose we apply data-level DA s.I. Ew. = ml 2) Es. [b.] Gmi 3)
Xm ( Ri 0, Vj E N+.j 2 3; 4) W. and b, are independent. Define Áw. == W. II mR,
Ag. == W f(z;) y/ E R. Let Way E IR be the kth dimension component of W g and then define
(i,(k: == wh Ag. E IR; Denote the Hessian matrix of the kth dimension component in f(x)) as
H Let v f be the Jacobian matrix of f. then we have
e (g f) - a
-QAD + +(A2),
where DABl 1 2i=1 -i=1 En 1= (A)))) (r [Ew AA,, A 174 ( where Az, -W+- Tx + b.i
DAPL AAA Ei=l
Ew. | Aw. V (.( W, 1 Es, | [b.VS(a.)WWll]]
Proof. Let Sm,p = b.,,b. fWW 2, b.) fzx), then
A fr, =-Bw. b. f(W, 2; b..) f(xi)
.b...b. Vf(x;) T (A.: ) +
1 Bw.,b. b. A 20 (xx) (x:) (
O(w.,b. (Ax,,1
1 Bw..b. A f/. (v:))a. (x: + O(EW,,,, 114,,,11 112).
(15)
where [.00]] denotes a d-dimensional vector and denotes the 4tth dimension element. Since 8 is squared loss, the third-and-highe higher derivative are O. therefore, the hard-aand-igghr order terms in Taylor expansion (EE.... P. [g f(W.,; + b.)]. ys) around (xx)) will vanish:
(( [g f(W,r; + (1)) = =( f(x.). f(x.). v:) + W a (A Jn (g f(x)).
1
2 W (A (. ) AB 8n (go f(x)), v.)
=( o f(z;). wt) W و f. A. ) (g f(x)) vi) + O,
(16)
Substitute Eq. [15) into the first-order term in Eq. 16 we have
WT 9 (A sp ) (g (z.)). =W, Ew.,..
Aq. + O(Ew. 11..
(( Ew
AJ. H
(k), Dz. + 10(...,.llA...
(i, lr (Ew, M. AAn, AT, (., + O(Ew,, 114,,
k=
(17)
Substitute Eq. 177 into Eq. (16). we have
(EE..... [g f(W,(W + b.)] vi) ((g (1))).:)> + Σ wwr,oytr(Ew... |Ar, AT, AT (100
(EE., 1...,,.1..... 112))
(18)
Substitute Eq.
18 into Eq. 14
which is the definition of Lxx, Ap (g f), and recall that A =
Exg.W,, W,,, A 11
we have
(g f)
(E.., [go SWW.r b.)], (0 f) + S ΩApt 0(4)).
(19)
20

---

Under review as a conference paper at ICLR 2022
Let A S.AAp xW - VVf b.) 2(1142;11))
Applying Taylor expansion to Ew., (((g o fWW,, + b.), Wi)] around f f(z;) will give us Bw..s [((g f(W,,; + b.), = (1 (wx), vi) + W Ew, (g ( ('(1 (x))
W Bw, b. ( J[, of (go f(zz), vn)
(20)
Since Ew.,b A Si,g = =Am A.pp, the first-order term in Eq. 20 is exactly Eq.
WTE..
9 Ew. s. A (g
W A S.. (x.).
(r (r.))t((Ew...) 14 AT OBB.. .1...11)
(21)
The secen term in Eq. 20
W. Ew.,, b. (ASr.pp )(4 SLAPL))
W /" (g f(ts)
2
- Ew,a, b. (x;) W. 24 (Aw: Ti + b.) V/( + (IE.. A1
-Ew. | AW, V
2 + Es.. b. (. 11 1le.....AA..ll
(22)
Substituting Eq. 21 and Eq. 22 into Eq. 20 we have
Ew,,a, [6(g o fWW., +6),
=((g f(.)).)) +
Wi,(k) (r. (Bw., A AT (B)))
Ew, |r] Aw. Vs( Es,, |b (x;)) O(Ew, || 112)
(23)
Substitute Eq. 23 into the definition of fn Ap (g f), then
Agr o 1) Ew.,. [(( l(W,,; + b.), vi)l = (g 44 +(44))
(24)
The proof is complete by Eq. 199 and Eq.
24
Interpretation. Ragz and RApt turn out to be: 1) Rags is weighted trace expectation dependent on the Hessian matrix of f: 2) Ω Rupz is equivalent to sAp together with the summation of two norm expectations dependent on V.. Therefore, the data-level DA algorithms ADL and AD are expected to regularize f so that the f function class FDL enabled by A E {Ap1 Dt A would be reasonably expected subset of FA enabled by general training algorithm A.
Sufficient conditions. Combined with Theorem 3.3 the sufficient conditions indicated here to tighten the upper bound dr, (D3, Di.) of the relative transferability T(A; Ds, Dr) are: data-
level DA (ADL) with DA parameters satisfying that 1) [w,[W.] = -Im; 2) Es, [b.] = om: 3) O(AL) R 0,Vj N4.j 2 3; 4) W. and b. are independent.
Empirical verification. We further provide empirical verification in Section for the sufficient conditions above, investigating the concrete cases DA methods: 1) Gaussian noise satisfies the sufficient conditions, then we empirically show that Gaussian noise improves domain transferability while robustness decreases a bit (Figure 5): 2) Rotation, which rotates input image with predefined fixed angle with predefined fixed probability, violates Ew. [W.] Im and empirically show that rotation barely affect domain transferability (Figure 14jin Appendix D.3): Translation, which moves the input image for predefined distance along a pre-selected axis with fixed probability, violates Es, [b+] Ö. (Figure 14 in Appendix D
21

---

Under review as a conference paper at ICLR 2022
Corollary B.2.1. the neural network in Theorem B.2 is activated by Relu or Max-poolingg then Theorem B.2 becomes
A (g f) = 55 (1 1) + Rror + +0()))
where Ωt DAR. 0; St
Ap n Ei=1 Bw. 1o Aw. Vf 12 +Es.
Es, |||1 V (x) [[]]
Proof. Denote an L- L-layer NN go o f(z) = W 211-11, _, where 2|0 := /¹¹ - ( |-1 2(1-11). 1)
1 1.2,3......... ..., L Define that _ (Wr)) =00) == x, then fgo (B.2 of Zhang et al.
2020 Since (g f(x)) = W < (xx) we have ((x(2) =.
Combine this with Theorem B.2 we have
(e.(K) (r 1...IA..AT,1
Aaps n1 1=1 1=1
=0;
AAp = Q2 Ap
+
Ew. || Aw. Vf(::) + Es, V[
11
1
Ew. ||o Dw, Wsw.)), B.. Bo.lloVV/(<
71
Remark. Corollary B.2.1 analyzes special cases (Relu/ Max-pooling activation) of Theorem B.2
giving notably different regularization effect: in these cases the Ap (average the prediction) fails as regularizer, therefore, doesn't 't fulfill our sufficient conditions for improving domain transferability (Theorem 3.3 APT (average the loss) only reserves the regularization on V f-ddependent norms, but no longer regularizes Hx) Since A still induces regularization, the induced sufficient conditions analyzed after Theorem B.2 for promoting domain transferability won't be affected.
C ADVERSARIAL TRAINING AS A REGULARIZER
In this section, show, under certain conditions, why adversarial training may improve domain generalization by viewing adversarial training as a function class regularizer.
We first provide some notation. Let
F= (-f((-) = W (1
where oi are activations, W b² are weight matrix and bias vector, 0 is the collection of parameters (i.e. 0 (W 6,. ...., w (b)). For the rest of the article, assume that のi are just ReLUs.
Now fix E X. Define the preactivation as
_²_ : W x + b²
W + - ( + b. 2
Define the activation pattern dx = (o_,..., (b-1) E (0. 1mmm such that for each j E [T. - 1]
such
05 1( > 0)
where 1l is applied elementwise.
Now, given an activation pattern & {0,1) 1)m we define the preimage X()) (xr E Rdd dx +}
Theorem C.1. (In the proof of theorem in Rooh et al. 2020
Lei > 0 s.1. (x(x) C X(xz) where (xxx) denotes the In ball centered at x with radius Let =1). Then
p (1,2, )o) and q be the Holder conjugate of p (i.e.
Peyy)~(((1 (x)) + max 115(x) [(x)) E f(x)) + (²
max
= 1 11
22

---

Under review as a conference paper at ICLR 2022
This theorem provides equivalence between the objective functions for adversar- ial training (left term) and jacobian regularization (right term). We give some intuition on the size of Let us first consider shallow 2 layer network f(x) W <(W ( x +bbb). Suppose W E mm and W E mh xd Given a matrix M, let Mj denote the jth row M. We study the activation pattern &r which equals
Interpretation:
1(W 6/}
0x = (0
1(W 1h x on,)
We wish to compute the largest radius such that the activation pattern dg is constant within (z). This is simply the distance from the closest hyperplane of the form Hw3.0g {xr E Rd
W + b) 0} where 0...... my (i.c. min, dist(z, Hw3 oz)). In particular, if W Laxd and 1² = 0, = minjealzzy
Furthermore, we note that is nondecreasing function of the number of layers. However, it has been observed empirically in (Roth et al., 2020) that approximate correspondence holds in much larger ball.
Definition 4. (source and target function class) Let Get G be fine tuning function classes for source and target domains, respectively. We define the class of source models as
HS = = F [g fo g E f
and the class of larget models as
HT. GT oF - og g oo fo
Definition 5. (empirical training objective with jacobian regularization) Let X, >> O. Take any
hypothesis ho g$ So E HHS Let R(ho) = E. ((ho(za), v)) denote the empirical risk where 1(0 3) = || y 12 We define the empirical training objective with jacobian regularization as
Obj R((ho) + A
Σ
|h (2:))lz
Theorem C.2. Fix regularization strength À > O. Define
= 3g E s.L. Obj o 5
where denotes the zero function (i.e. the class of feature extractors that outperform the zero function). Suppose (x, y) X x y is bounded such that max ([[=Il bollooolllll lllv12) S R. Fix ö > 0. Suppose we additionally restrict our fine tuning class models to linear models where
G = (W WW dxn n RxR
1, min [W 2 53
(where W, is the jth column of W) and
GT = = W E Rdxn 121}
(Here we are abusing notation to let g E GS to denote the last linear layer as well as the fine tuning function).
Then for 0 S Ai < A2
CACA CF
(where C. denotes proper subset). In particular, if H.A. =T o we have
HAT C HAT Ç HT
Interpretation:
At the high level, this theorem captures the idea that minimizing the empirical risk with jacobian regularization puts a constraint on the set of feature extractors. In particular, FA) represents the potential class of feature extractors select after training with jacobian regularization. Therefore,
23

---

Under review as a conference paper at ICLR 2022
the class of fine tuned models H AA with feature extractors trained with jacobian regularization for the target domain smaller than the class fine tuned models H. with feature extractors trained show that the space of feature extractors shrinks
without any regularization. Furthermore, increase the regularization stength X. Since we showed section 3.3 that smaller function classes have smaller drĄ- this theorem shows that jacobian regularization reduces dy To connect back to adversarial training, if satisfies the hypothesis in theorem C.1 we have that
((..))~P((V (x)) + À max (x)
(1f(z) f(x*) |4 = (e..)) (()) + + max
Therefore, minimizing the training objective with jacobian regularization is equivalent to minimizing the adversarial training objective. Using this connection, this theorem essentially shows that, given sufficient number of samples, adversarial training reduces the class of feature extractors which in turn reduces d'
Finally, comment the assumption that ||g0 6. Since 5 > is arbitrary, small as we like and thus we are essentially excluding the 0 last layer which is hardly a constraint on considering regularization the whole
make it as
the function class. This assumption is necessary model go f as opposed to regularization on just the feature extractor. Thus, this assumption prevents the scenario where only the last linear layer is regularized.
Proof. We first show that if S X X2, we have that
E
We first prove the following lemma
Lemma C.1. Suppose the conditions of theorem C.2 are satisfied. Suppose additionally we have that == 3.2 Ei=13 Yi * 0 (note this occurs with probability if marginal distribution over y is continuous). Then for every X 2 O, there exists function fa E FR and a fine tuning layer g" gs such that
Og fo) inf Obj fo) Ob) gEGs
Choose another X 2 (can equal A). Then there exists a g" E G be the fine tuning layer such that inf ingg (g fo) = ObjA fo) and
(1:r) >0
Proof.
Fix a 2 0 and <>> R. Set biases
V = 0, j22
and weights
0
0
0
0 0
W
W =
j 2 2
Define zι be the jth entry of the data point x4. Define
0₁ == a - 1i,1
Y1
i=1
U4
i=1
24

---

Under review as a conference paper at ICLR 2022
Now observe that for fixed À 0 and any Go, we have that
Og fo) = R(g fo) t..
go (2s)ll2
==1
2
911
11
n
(aTi111 + c)
:
Yi
9
11
11
(dl
n
(1a; + c)g1
y4 +
a
1111|
11
Σ
(aa; + c)g1
wil + x- e- |111|2
11
Therefore,
inf DEgs
(gi fo)
equivalent to solving
inf wER' 11 25
Σ (aa + +cw
vil 122 x ec 1//l1/22
(25)
Utilizing lagrange multipliers, we find the minimizer is
8
(26)
when c |
Now consider the function
S(c,a) 1 Σ (1(a 21,1 + c)g: - -vili + A 6a 1191122
Note that this function is continuous with respect to the input ac. Now fix a 0, c | Set w = 5
Then we have that
1
|0 0) m S( 8
1 n Σ
1
34
n y
Objá
The inequality comes from the fact that we assumed T &f 0 and noting that ÿ is the minimizer of the function p(z) = || 1:112- Continuity S ensures that there exists on > such that
lill S( 8
0O) <
1121 = Obj (0)
Now consider ((t) 5(( + t) || (1 t)om) for t > 0. Note that U is continuous with respect to t. Furthermore, we note that t + oo implies (t) + oo which implies there exists some time
t = T, such that UTyy) > Obj (0). Therefore, by the intermediate value theorem, there exists time T such that (T) Obj (0). Finally, set e = (T + 1) 171,
(T + 1) and g" as
5
the matrix where oî = 5 y and O for the other columns. By equation 25 and equation 26 we have
Obj (g" fa) inf Obj (g fe) U (T) Obj (0) geg
Furthermore, if we choose another X' 2 0, since c = (T + 1) | that
|xll by equation 26 we have
Ob fo)= inf gEgs
(g
25

---

Under review as a conference paper at ICLR 2022
and
1
10 (2x)ll2 =a =all""112 ad
i=1 (T 1)a0" 0.
which is nonzero and
Clearly, we have F C FA If we can show that fo, & Fx then we have Fx1 & Fx.
Using lemma C.1
we can find for E Fx such that
inf Obj (g Jo,) = Obj (0)
gEGs
In addition lemma C.1
guarantees minimizers gi and g such that
inf Obj (g fo,) and 1 "
Obi (gf so,)
Σ
|| ofo (2x) (2r))l2 >0
gEGS
Obj (5 S0,) inf
Obj (g o f0₂) and
19 (zi))l2 > 0
BEGS
1=1
Thus, we have that
1
Obj (o2 fo,) = R(gz o fo,) + x2-
Jozofo, (2x)ll2
n
1
Rlgg fo.) + +
11 (2x)ll2
since A2 > A1
2 Riggi o fo.) + A1
def of gi lemma C.1
Obja, (0)
Thus fo, & F5t which implies FSt S Fx. remains to show for A 2 0, we have that FX, F..
Consider any E gs For j E [L]. define W as the weight matrix where W = -axd (identity and let the final weight WL B Iaxd for some constant B 0. Set the
matrix) for j E [ bias vectors 5 = 0 for 2 2. Let the first bias equal b² = R Il where 1 is the vector of all I's and R is the upper bound such that | R. Set (W2 62 ...,, WL, b4) and let he o fo
We compute
n
Obj (ho) R(ho) A1
Jhh (a:)ll2
1
[B + R1) yell2 +
J (2x)ll2
[B(r; + R1) vell2 + B llll|2
1V
|[(x; + R1) 3ill2 + B8
We note that sending B + we get Obj (ha) + oo which implies that there exists B B' such that Obj (ho) > Obj (0). Setting B = B' implies so & FA
26

---

Under review as a conference paper at ICLR 2022
D EXTRA EXPERIMENT RESULTS
D.1 ABSOLUTE TRANSFERABILIT
We show the results with absolute transferability in Figure 7 and 10 respectivvey.
CIFAR10
ImageNet
CIFAR1O SVHN
ImageNet CIFAR10
Domain Transfer Acc (%)
LERCA
-0.1
76
LLRAA
-6.01
40
LLOTi|Ie lc)
0.01
76
o.
0.5
35
0.1
1.0
74
35
30
74
72
25
30
798
70
R:
-0.922
20
72
10
20
30
18
20
22
24
10
20
30
20
30
40
Robust (%)
Robust
Robust
Robust Acc (%)
Figure 7: Robustness and absolute transfcrability when we control the norm of last layer with last- layer regularization (LLR) and last-layer orthogonal training (LLOT) with different parameters.
CIFAR10 > SVHN
ImageNet CIFAR10
CIFAR1O -2 SVHN
ImageNet > CIFAR10
Domain Transfer Acc (%)
.5
R: -0669
JR(A)
0.0001
0.001
35
0.0005
30
0.01
0.001
1.0
80
JR(A)
25
10
75
30
0. 0000
00.000
100
0.005
1000
70 R: 0.902
R: 0.889
0.01
65 R: 0.909
50
70
15
25
45
10
20
15
20
Robust Acc (%)
Robust Acc (%)
Robust Acc (%)
Robust Acc (%)
Figure 8: Robustness and absolute transfcrability when we regularize the feature extractor with Jacobian Regularization (JR) and weight decay (WD) with different parameters.
CIFARI0
ImageNet- CIFAR10
CIFAR1O
ImageNet CIFAR10
Domain Transfer Acc 1%)
45
Gaussto)
Gauseto)
45 Postb]
P)
77
0.25
80
0.25
1.0
75
35
30
R: 0.963
20
30
50
60
20
30
20
30
Robust Acc (%)
Robust Acc (%)
Robust Acc (%)
Robust Acc (%)
Figure 9: Robustness and absolute transferability when we use Gaussian noise (Gauss) and posterize (Pos) as data augmentations with different parameters.
D.2 RESULTS OF OTHER MODEL STRUCTURES
To further validate our evaluation results, we evaluate the experiments on another model structure. We use simpler CNN model for CIFAR-10 to SVHN and more complicated WideResNet-50 for ImageNet to CIFAR-10. The CNN model consists of four convolutional layer with x 3 kernels and 32,32,64,66 channels respectively, followed by two hidden layer with size 256. A 2 x 2 max pooling calculated after the second and fourth layer. Other settings are the same as in the main text. Note that in some settings the new model cannot converge, and therefore we will omit the result. In addition, Jacobian regularization cannot be applied on WideResNet-50 because of the large memory cost, do not include it in the figures. The results shown in Figure] 11 12 and
27

---

Under review as a conference paper at ICLR 2022
ImageNet >> CIFAR10
Imagelet
Domain Transter Acc 196)
Rescalsim)
80
Bkkr
80
75
R:-0.991
-0.557
10
20
15
20
Robust (%)
Robust
Figure 10: Robustness and absolute transferability when rescale and blur data augmenta- tions with different parameters.
ImageNet
ImageNet
Relative DT Acc (9)
LUR(A) -0.01
[L 0.01
LLTT [adla
0.1
LIR(AU
-0.1
-10
R:-0.468
R: -0.890
R0-9.994
-0.977
16
18
20
22
24
28
32
15
25
35
25
27
Robust Ace (%)
Robust Acc (%)
Robust Acc (9)
Robust (%)
Figure 11: Robustness and transferability for the other model structure when control the norm of last layer with last-layer regularization (LLR) and last-layer orthogonal training (LLOTT) with different parameters.
D.3 DATA AUGMENTATIONS THAT VIOLATE SUFFICIENT CONDITION
We study rotation and translation. the two data augmentations that violate the sufficient condition for regularization. The result is shown in Figure [4] We observe that these augmentations do not have obvious impact domain transferability.
D.4 ROBUSTNESS EVALUATION WITH AUTOATTACK
Besides PGD attack, we also evaluate the model robustness using the stronger AutoAttack. We use APGD-CE, APGD-T and FAB-T as the sub-attacks in AutoAttack with 100 steps. Since the accuracy will decrease after the stronger attack, we use slightly smaller 0.2 to better visualize the trend. The results are shown in Fig. 15 We can observe that the trend is similar with what we observed before when we used the PGD attack domain generalization an effect of regularization and data augmentation, and it is sometimes negatively correlated with model robustness. Also,
CIFAR1O
CIFARI0
Imag CIFAR10
Relative DT Acc (%)
JR(A)
30
WDXA,)
0.0005
10
WD
3.005
0 0.001
-10
1000
0.01
-20
0
02.0..66
-0.607
40
60
10
20
15
Robust Acc (%)
Robust Acc (%)
Robust Acc (%)
Figure 12: Robustness and transferability for the other model structure when we regularize the fea- ture extractor with Jacobian Regularization (JR) and weight decay (WD) with different parameters.
28

---

Under review as a conference paper at ICLR 2022
Imag eNet
CIFARIO SVHN
ImageNat CIFARID
60
GaussLo)
Gousstat
Postb)
Relative Acc
40
2
20 R:
Posib)
-5
0.358
R:
0.776
20
30
40
50
20
30
40
20
30
20
40
Robust (%)
Robust
Robust (%)
Robust Acc (%)
Figure 13: Robustness and transferabilityy for the other model structure when Gaussian noise (Gauss) and posterize (Pos) as data augmentations with different parameters.
CIFAR10 SVHN
ImageNel -> CIFAR1O
CIFARIO - SVHN
Imageflel -> CIFAR10
Relative DT Acc (%)
Rotatel '1
Rotater
0
15
15
45
+8
-3
Translate(d)
Translate(d)
0.05
0.05
R: 0.012
R: 0.978
R: 0.716
0.1
0.25
-3
R: 0.238
0.1
0.25
20
20
10
20
Ro Acc (%)
Robust Acc (%)
Robust: Acc (36)
Robust Acc (%)
Figure 14: Relationship between robustness and transferability when we use rotation and translation as data augmentations.
augmentations like rotation and translation, which violates the sufficient condition, do not improve the domain generalization.
29

---

Under review as a conference paper at ICLR 2022
CIFARIO SVHN
CIFARIO
Relative DT Acc (%6
LIRIA
LLOTilIo (a)
0.01
IRU
WDTA
100
0.001
0.005
1.0
10.0
10
0.01
-5
-10
-10
R:-9.447
0.336
-0.74
60 Robust Acc (%)
Robust Acc (%)
Robust Acc (%)
Robust Acc (%)
CI SVHN
CIFAR1O SVHN
CIFARIO SVHN
CIFAR10 SVHN
Relative DT Acc (%)
10
5
Rotatel ')
30
Gaussia)
45
0.05
20
0.25
Translatelo)
1.0
0.439 Robust Acc (%)
0 686
0.25
Robust Acc (%)
Robust Acc (%)
Rabust Acc (%)
Figure 15: Relationship between robustness and transferability on CIFAR-10 when we use AutoAt- tack to evaluate model robustness.
30


Reviews:
[{"review_id": "tg_G2jSM_Mn", "reviewer": "Reviewer_nSDW", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "This paper investigates a very interesting problem from a theoretical standpoint. Author(s) have been somehow successful in bounding the domain generalization loss from a source domain to a target, via a number of newly-defined (and possibly fundamental) measures which involve the distributions and function sets of the problem configuration. In particular, a new (as far as I am aware) measure has been proposed which mimics the role of Rademacher complexity, but this time works when one wants to transfer a learned model from a domain S to a target domain T. I haven't completely checked the proofs yet, but results seem legit.\n\n\nThe main problem is that although the overall theoretical framework is interesting, but results might not be that much strong at the moment With some extra time and effort, far more interesting achievements can be reached. For example, the $\\left(\\mathcal{G},\\mathcal{F}\\right)$-pseudometric between source and domain distributions, i.e., $\\mathcal{D}_S$ and $\\mathcal{D}_T$, can be more mathematically analyzed and perhaps new theoretical insights might become available. In particular, how the similarity (for example in terms of TV distance) between $\\mathcal{D}_S$ and $\\mathcal{D}_T$ affects this measure? In another example, showing that adding more regularization on the feature extractor gives better \"domain generalization\" is not enough; Since this might degrade the overall performance in return. Please note that the constant function $f(x)=0$ performs equally bad on all domains. However, author(s) have not discussed this issue in details.\n\nThe other problem is that there are numerous grammatical errors and also a number of minor flaws inside the main body. Writing of the paper should be completely reviewed. I have pointed to some of the grammatical errors below in the \"Minor comments\" section. Also, some minor technical ambiguities are noticeable: At some point, authors have referred to Vapnik-Chervonenkis (VC) dimension of a function set, which includes functions from $\\mathcal{X}$ to $\\mathbb{R}^{+}$. Based on my understanding of SLT, VC-dimension can only be defined for a class of binary classifiers, and not functions that output continuous values.\n\n-----------------------------------------------------------------------------------------------------------------------------------\n\nMinor comments and suggestions:\n- Abstract -> \"On one hand,\"\n- Abstract -> \"Norm of last layer norm\"?\n- Introduction -> please refrain from underlining long phrases for the sake of emphasis. Instead, you can use quotation marks ``...\", or the italic form.\n- Section 2 (Related Works) has been poorly organized. Sentences are vague, unrelated to one another, and need much more discussion to convey meaningful information to the reader. Fo example, what exactly \"generalizing beyond convex hull\" refers to here? Or, what are $\\mathcal{H}$-divergences.\n- Please use \\ eqref{} (and not \\ ref{}) to refer to equations. For example, your first reference to equation (1) is not standard.", "summary_of_the_paper": "This paper aims to investigate the theoretical connection between domain generalization (aka Transferability) and adversarial robustness in some general settings. Authors claim that a thorough theoretical treatment of this problem has not been given yet, and therefore set out to establish a number of fundamental relations.\n\nA simple example has been proposed which shows the existence of cases, where adversarial robustness and transferability can be independent (or even negatively correlated). Also, paper proves that adding more restriction (tighter regularization) on the feature extractor stage of a learning algorithm gives better domain generalization. Additionally, some intrinsic and fundamental measures have been defined to bound the domain generalization error for transferring a learned model from domain S to domain T. In this regard, uniform convergence bounds have been derived to show the gap between empirical and statistical versions of such measures remain small or even converge to zero when sample size asymptotically increases.\n\nFinally, a number of experimental results have been shown to support the above theoretical achievements. I have not gone through the experimental parts nor the proofs, yet.", "summary_of_the_review": "The proposed analysis, in its current shape and form, might not be ready for publication at ICLR. While the proposed framework in this paper is interesting and definitely worthy of more analysis, the current results including all high-probability concentration bounds and etc. are still incremental and need more work.\n\nThe other problem is writing. There are grammatical errors throughout the paper and the quality of writings can be greatly improved.\n\nOverall, I believe the paper is not ready for publication yet. My vote is weak reject.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "Rq1MJczyHwc", "reviewer": "Reviewer_ijfD", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths: This paper studies the relation between robustness and generalization, which are both interesting and relevant topics in machine learning. On the theoretical side, it provides a new definition called relative domain transferability loss as well as a pseudometric, and gives generalization bound based on Rademacher complexity. On the experimental side, it says with a bigger regularization and stronger augmentation, the generalization measured by relative DT accuracy improves.\n\nWeaknesses: \n\nThis paper is not clearly written and there are many confusing parts. See below: \n1. Clarity: I'm not sure how the robustness is defined in this paper. Throughout the paper, I only see the discussion on the regularization (either Jacobian or last-layer) and the data augmentation, but how they correlate with robustness is unclear. Is the robustness mentioned distributional robustness or robustness wrt sample perturbation? More clarification is needed.\n2. Clarity: In Sec 3.1, are you doing regression or classification? In Sec 4 the experiments are classification but here you are treating the label $y_S$ as real number. Shouldn't the predictor $f$ output a label?\n3. Clarity: Prop 3.1, what is the relative domain transferability? Any reference? \n4. Clarity: I'm not sure about the motivation of Def 2. In domain adaptation there has been many papers that study the distance metric, e.g.:\n\n[1] Ben-David et al, A theory of learning from different domains, Machine Learning 2010.\n\n[2] Mansour, Y., Mohri, M., and Rostamizadeh, A. Domain adaptation: Learning bounds and algorithms. COLT 2009.\n\n[3] D. Acuna, G. Zhang, M. Law and S. Fidler, f-Domain-Adversarial Learning: Theory and Algorithms, ICML 2021.\n\nCould you compare your Def 2 with existing metrics? \n\n5. Clarity: In Theorem 3.2, what is individual loss function? How would it relate to $\\ell_{D_S}$?\n6. Minors: Def 3: reference for Rademacher complexity is needed; Prop 3.2, $D'$ is not defined; \n7. Clarity: in the experimental section, it is observed that wth stronger regularization/augmentation the DT acc is higher. However, the meanings of Relative DT Acc and Robust Acc are not clear or not well-explained in the paper.\n8. Clarity: how would your theory help in the experiments? The connection between regularization and the proposed pseudo metric is not clear.\n9. Novelty: how would you compare the conclusion in your paper with Salman et al 2020? In their paper it is claimed that robustness helps generalization, which seems to be contradictory.\n", "summary_of_the_paper": "This paper aims to convey the message that adversarially robust models may not have better transferability in terms of transfer learning in vision tasks. However, this message is unclear due to the mixture of data augmentation, regularization, robustness in the presentation. Some definitions are confusing and the conclusion seems to contradict with existing literature, e.g,  Salman et al arxiv: 2007.08489.\n\n--post rebuttal--\n\nThanks to the authors for the draft revision and the additional appendix C. Now the paper is clearer to me: the general idea is to say that robustness is a type of regularization, and this regularization is the key to generalization. However, I think the former is not novel as already mentioned in Roth et al NeurIPS 2020. Besides, there are still many presentation issues even after the revision, e.g.:\n1) Prop 3.1 mentioned the relative domain transferability, but the formal definition is introduced later in Def 1.\n2) The added paragraph is confusing to me. How would you define the input space ${\\cal X}$? Is it a compact set? Why would the perturbation go outside ${\\cal X}$? Shouldn't $x + \\delta$ still be in the domain of $f_c^{{\\cal D}_{\\cal S}}$ as otherwise it is not well-defined?\n3) Def 2 should be compared with existing metrics. \n4) In Section 3.4 the authors use the squared loss but in experiments they use cross entropy loss.\n\nDespite the interesting topic, I would keep my current score until a more well-written version is presented.\n\n", "summary_of_the_review": "Overall this paper aims to address an important issue: does robustness help generalization? However, in practice it mostly does experiments on regularization and data augmentation, which may not be directly related to robustness. Comparison with existing work is needed, and the presentation (especially some introduction of Theorems and Definitions) needs to be improved. Therefore I would not recommend acceptance.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "12SSE3p9wIy", "reviewer": "Reviewer_5SD9", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n1. This paper challenges a fundamental claim in ML: stronger robustness leads to better domain generalization, and gives a solid analysis. \n2. This paper presents a theoretical framework to analyze the relationship between regularization strength and domain transferability. \n3. The empirical experiments are also very interesting. Specifically, they show that the robustness does not necessarily correlate to domain transferability.\n\nWeaknesses/Question:\n1. How to obtain robust accuracy? Using PGD to evaluate the robust accuracy while controlling the norm of the last layer is very tricky. See the temperature scaling attack here https://arxiv.org/pdf/1607.04311 . This is my biggest concern, please validate the results using a more advanced attack method, e.g., AutoAttack. If you can obtain the same conclusion with AutoAttack, I will raise my rating. \n\n\n\n\n", "summary_of_the_paper": "This paper discusses a very interesting question: what is the relationship between adversarial robustness and cross-domain transferability. The previous studies show that a more robust model can transfer better. This paper argues that the true reason for the cross-domain transferability is not the adversarial robustness, but the effect of regularization, which can also be achieved through other methods, such as data augmentation.", "summary_of_the_review": "This paper provides a great theoretical framework for analyzing domain transferability and explains why improving adversarial robustness can improve domain generalization. The empirical experiments are very interesting. However, the method of evaluating the adversarial robustness is not very appropriate. This is very important, as it may alter the conclusion of this paper, especially for the norm controlling experiments. If the author can obtain the same conclusion with a more advanced attack method (e.g., AutoAttack), I will raise my rating. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "10yPRw4NZW0", "reviewer": "Reviewer_MEJz", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The paper is well-written.\n\nHowever, there are several big problems:\n\n1. Overselling: transfer better due to regularization is not initiated by this work as they claim, for instance, Adversarial Training Helps Transfer Learning via Better Representations by Deng et al. have theoretically analyzed the regularization effect of adversarial training. Also, data augmentation served as regularization has also been extensively studied. Such as in On Mixup Regularization by Carratino, L et.al, Dropout Training as Adaptive Regularization by Wager et al.\nMore discussion is needed\n2. The counterexample in 3.1, the explanation and intuition is not right, delta wishes to maximize the loss, instead, the author say there exists delta such that example is pushed outside the manifold of input, so the robustness could be arbitrarily strong. This intuition is completely mysterious. \n3. The monotonic relationship between regularization and performance is not quite right, since it is common sense that too strong regularization could result in bad performance. Thus, this claim is a little too exaggerated.\n4. The tight upper bound has no lower bound to support. The tightness is not rigorously justified.\n\n", "summary_of_the_paper": "This paper studies theoretically how adversarially trained models can transfer better, and disentangle the robustness and accuracy on the target domain. They claim that the main reason is more of regularisation rather than robustness. Corresponding examples and theory are presented.", "summary_of_the_review": "This paper is overclaiming their contribution. Details are in the main review.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper tries to analyze the relationship between regularization, adversarial robustness, and transferability.

Pros:
- An interesting problem was tackled.

Cons:
- The main claim (Prop.3.1) is almost trivial.  Prop. 3.1 shows that "relative" transferability is smaller for stronger regulariation, which is just a slight generalization of the triangler inequality ||YT = YS|| <= ||YT - Y|| + ||YS - Y|| for any Y in Fig.2.  
- Experiments show negative correaltion between the relative transferability and accuracy, which is trivial.  Large regularization degrades the accuracy which increases the "relative transferability".  "Absolute" transferability in Appendix doesn't show clear negative correlations.
- Salmann et al. claimed that adversarially "trained" models transfer better, and did not claim that there are positive correlations between the transferability and robustness for general classifiers without adversarial training.  So the finding in this paper is not surprising nor against Salmann et al.

To prove that adversarial robustness is just a subproduct of regularization, the authors should show that the "absolute" transferability by adversarially trained classifier can be achieved by other regularization.  Defining relative transferability is fine if it is just a decomposition to conduct an analysis of the absolute transferability.  But no conclusion on the performance should be made from its analysis, because a trivial correlation will appear, i.e., (A-B) and B should be negatively correlated unless A strongly correlates to B.  Also, this is highly misleading so that some reviewers seem to have misunderstood that the authors would have claimed that negative correlations between regularization and absolute transferability were observed in the original submission.

Overall, the paper requires major revision.
Decision: Reject