Exploring and Exploiting Decision Boundary Dynamics for Adversarial Robustness
Authors: Yuancheng Xu
Yanchao Sun
Micah Goldblum
Tom Goldstein
Furong Huang
Venue: ICLR 2023 poster (2023)
Keywords: Adversarial Robustness
margin maximization
dynamical system

Abstract: The robustness of a deep classifier can be characterized by its margins: the decision boundary's distances to natural data points. However, it is unclear whether existing robust training methods effectively increase the margin for each vulnerable point during training. To understand this, we propose a continuous-time framework for quantifying the relative speed of the decision boundary with respect to each individual point. Through visualizing the moving speed of the decision boundary under Adversarial Training, one of the most effective robust training algorithms, a surprising moving-behavior is revealed: the decision boundary moves away from some vulnerable points but simultaneously moves closer to others, decreasing their margins. To alleviate these conflicting dynamics of the decision boundary, we propose Dynamics-aware Robust Training (DyART), which encourages the decision boundary to engage in movement that prioritizes increasing smaller margins. In contrast to prior works, DyART directly operates on the margins rather than their indirect approximations, allowing for more targeted and effective robustness improvement. Experiments on the CIFAR-10 and Tiny-ImageNet datasets verify that DyART alleviates the conflicting dynamics of the decision boundary and obtains improved robustness under various perturbation sizes compared to the state-of-the-art defenses. Our code is available at https://github.com/Yuancheng-Xu/Dynamics-Aware-Robust-Training.

Published as a conference paper at ICLR 2023
EXPLORING AND EXPLOITING DECISION BOUNDARY DYNAMICS FOR ADVERSARIAL ROBUSTNESS
Yuancheng Xu Yanchao Sun
Micah Goldblum
Tom Goldstein
Furong Huang!
f University of Maryland, College Park
1 New York University
f (ycxu, yes, tomg, furongh] ) e @umd. edu
$goldblumenge edu
ABSTRACT
The robustness of a deep classifier can be characterized by its margins: the decision boundary's distances natural data points. However, it is unclear whether existing robust training methods effectively increase the margin for each vulnerable point during training. To understand this, we propose continuous-time framework for quantifying the relative speed of the decision boundary with respect to each individual point. Through visualizing the moving speed of the decision boundary under Adversarial Training, one of the most effective robust training algorithms, a surprising moving-behavior is revealed: the decision boundary moves away from some vulnerable points but simultaneously moves closer to others, decreasing their margins. To alleviate these conflicting dynamics of the decision boundary, we propose Dynamics-Aware Robust Training (DyART), which encourages the decision boundary to engage in movement that prioritizes increasing smaller mar- gins. In contrast to prior works, DyART directly operates the margins rather than their indirect approximations, allowing for more targeted and effective robust- ness improvement. Experiments verify that DyART alleviates the conflicting dynamics of the decision boundary and obtains improved robustness under various perturbation sizes compared the state-of-the-art defenses, Our code is available at ht https: / ////tttii /iithuu. com/ Yuancheng- -ui--u/DDDuua Xu/Dynamics Aware Roteset--outttt- Robust-Traininee
the CIFAR-10 and Tiny-ImageNet datasets
INTRODUCTION
Deep neural networks have exhibited impressive performance in a wide range of applica- tions (Krizhevsky et al., 2012; Goodfellow et al., 2014; He et al., 2016a). However, they have also been shown to be susceptible to adversarial examples, leading to issues in security-critical applications such autonomous driving and medicine (Szegedy al., 2013; Nguyen al., 2015). To alleviate this problem, adversarial training (AT) (Madry et al., 2017; Shafahi et al., 2019; Zhang et al., 2019; Gowal et al., 2020) was proposed and is of the most prevalent methods against adversarial attacks. Specifically, AT aims to find the worst-case adversarial examples based on some surrogate loss and adds them to the training dataset in order improve robustness.
Despite the success of AT, it has been shown that peeepparameterized neural networks still have insufficient model capacity for fitting adversarial training data, partly because AT does not consider the vulnerability difference among data points (Zhang et al., 2021). The vulnerability of a data point can be measured by its margin: its distance to the decision boundary. As depicted in Figure la, some data points have smaller margins and are thus more vulnerable to attacks. Since AT does not directly operate on the margins and it uses a pre-defined perturbation bound for all data points regardless of their vulnerability difference, it is unclear whether the learning algorithm can effectively increase the margin for each vulnerable point. Geometrically, we would like to know if the decision boundary moves away from the data points, especially the vulnerable ones. As illustrated in Figure 1b, there can exist conflicting dynamics of the decision boundary: it moves away from some vulnerable points but simultaneously moves closer other vulnerable ones during training. This motivates to ask:
Given a training algorithm, how can we analyze the dynamics of the decision boundary with respect to the data points?
Question 1

---

Published as a conference paper at ICLR 2023
More Robust
Continious movemont
A A
Less Roburt
A
(a) The decision boundary, vulnera- (b) An update with conflicting im- (c) Continuous movement of the de- cision boundary.
ble (solid) and robust (hollow) points. pacts on robustness.
The movement of the decision boundary. Red triangles and green circles are data points from two classes. Figure la shows the vulnerability difference among the data points: some closer the decision boundary, whereas others are farther from Figure 1b, the decision boundary after an update moves away from some vulnerable points (made more robust) but simultaneously moves closer to other vulnerable ones (made less robust). Figure c describes the continuous movement of the decision boundary in Figure lb.
Figure 1:
To answer the above question, we propose continuous-timg framework that quantifies the instanta- neous movement of the decision boundary as shown in Figure Ic. Specifically, we define the relative speed of the decision boundary w.r.t. point to be the time derivative of its margin, which can be interpreted as the speed of its closest adversarial example moving away from it. We show that the speed can be derived from the training algorithm using closed-form expression.
Using the proposed framework, we empirically compute the speed of the decision boundary w.r.t. data points for AT. As will be shown in Figure 3, the aforementioned conflicting dynamics of the decision boundary (Figure 1b,1c) is revealed: the decision boundary moves towards many vulnerable points during training and decrease their margins, directly counteracting the objective of robust training. The desirable dynamics of the decision boundary, on the other hand, should increase the margins of all vulnerable points. This leads to another question:
Question 2 How to design algorithms that encourage the decision boundary to engage in movements that increase margins for vulnerable points, and not decrease them?
To this end, we propose Dynamics-Aware Robust Training (DyART), which prioritizes moving the decision boundary away from more vulnerable points and increasing their margins. Specifically, DyART directly operates on margins of training data and carefully designs its cost function on margins for more desirable dynamics. Note that directly optimizing margins in the input space is technically challenging since it previously unclear how to compute the gradient of the margin. In this work, we derive the closed-form expression for the gradient of the margin and present an efficient algorithm compute it, making gradient descent viable for DyART. In addition, since DyART directly operates on margins instead of using a pre-defined uniform perturbation bound for training in AT, DyART naturally robust for wide range of perturbation sizes Experimentallyy we demonstrate that DyART mitigates the conflicting dynamics of the decision boundary and achieves improved robustness performance on diverse attacking budgets.
Summary of contributions. (1) We propose continuous-timg framework to study the relative speed of the decision boundary w.r.t. each individual data point and provide a closed-form expression for the speed. (2) We visualize the speed of the decision boundary for AT and identify the conflicting dynamies of the decision boundary. (3) We present close-form expression for the gradient of the margin, allowing for direct manipulation of the margin.
(4) We introduce efficient alternative to compute the margin gradient by replacing the margin with our proposed soft margin, a lower bound of the margin whose approximation gap is controllable. (5) We propose Annamics-Aware Robust Training (DyART). which alleviates the conflicting dynamics by carefully designing a cost function on soft margins prioritize increasing smaller margins. Experiments show that DyART obtains improved robustness over state-of-the- defenses on various perturbation sizes.
RELATED WORK
Decision boundary analysis. Prior works on decision boundary of deep classifiers have studied the small margins in adversarial directions (Karimi et al., 2019), the topology of classification regions
2

---

Published as a conference paper at ICLR 2023
(Fawzi et al., 2018), the relationship between dataset features and margins (Ortiz-Jimened et al., 2020) and improved robust training by decreasing the unwarranted increase in the margin along adversarial directions (Rade & Moosavi-Dezfoolii 2022). While these works study the static decision boundary of trained models, our work focuses on the decision boundary dynamics during training.
Weighted adversarial training. Adversarial training and its variants (Madry et al., 2017; Zhang et al., 2019; Wang et al., 2019; Zhang et al., 2020b) have been proposed to alleviate the adversarial vulnerability of deep learning models. To better utilize the model capacity, weighted adversarial training methods are proposed (Zeng et al., 2020; Liu et al., 2021; Zhang et al., 2021) aiming to assign larger weights more vulnerable points closer the decision boundary. However, these methods rely on indirect approximations of margins that are not optimal. For example, GAIRAT (Zhang et al., 2021) uses the least number of iterations needed to flip the label of clean example as an surrogate to its margin, which is shown to be likely to make wrong judgement on the robustness (Liu et al., 2021). I). As another approximation, the logit margin (Liu et al., 2021; Zeng et al., 2020) is used but larger logit margin values do not necessarily correspond to larger margins. In contrast, our proposed DyART directly uses margins to characterize the vulnerability of data points.
Margin maximization. Increasing the distance between the decision boundary and data points has been discussed in prior works. The authors of Elsayed et al. (2018) propose to maximize the first order Taylor's expansion approximation of the margin at the clean data point, which is inaccurate and computationally prohibitive since it requires computing the Hessian of the classifier. The authors of Atzmon et al. (2019) propose maximize the distance between each data point and some point on the decision boundary, which is not the closest one and thus does not increase the margin directly. MMA (Ding et al., 2020) uses the uniform average of cross-entropy loss on the closest adversarial examples as the objective function, indirectly increasing the average margins, All of these methods maximize the average margin indirectly and do not consider the vulnerability differences among points. In contrast, our proposed DyART will utilize our derived closed-form expression for margin gradient to directly operate on margins and moreover, prioritize increasing smaller margins.
PRELIMINARIES AND NOTATIONS
Data and model. We consider classification task with inputs E A' and corresponding labels E = {1,2, ..., K}. . A deep classifier parameterized by 0 is denoted by fo (z) arg m 2/ where =z(xr) is the logit for class c.
Decision boundary.
Denote the logit margin for class y as follows:
(x (x) max 2 (1)
v' d'
In this paper, we will use (x) and (x, 0) interchangeably. Observe that x is classified as y if and
only if (x)) > O. Therefore, the zero level set of 6y (z). denoted by I, far : ob (x)) 0). is the decision boundary for class y. For a correctly classified point (z, y), its margin Rg (z) defined to be the distance from to the decision boundary for class That is,
Ro(x) min | - zrllp s.t. (b(+)= =0
where || Ilpp is the Ep norm with 1 5 p S co.
Difference between logit margin and margin. The logit margin (x)x) is the gap between the logits values that are output by the neural network. On the other hand, the margin Ro(x) is the distance from the data point to the decision boundary, and is measured in the input space X.
Continuous-time formulation. To study the instantaneous movement of the decision boundary in Section 4, we will use the continuous- time formulation for the optimization on the parameters 8, denoted as (t). Let ('(t) be the continuous-tima description of the update rule of the model parameters. When using gradient descent on a loss function L., we have (( - v (((())
4 DYNAMICS OF THE DECISION BOUNDARY
In this section, will study the dynamics of the decision boundary in continuous time. We first define its speed w.r.t. each data point, and then provide a closed-fore expression for it. Finally, we visualize the speed of the decision boundary under Adversarial Training and analyze its dynamics.
3

---

Published as a conference paper at ICLR 2023
4.1 SPEED OF THE DECISION BOUNDARY
Consider a correctly classified clean example (2t;, v:). Our goal is to capture the movement of the decision boundary I v: (1) = {x: d (1r (()) = 0} w.r.t. Iy as L varies continuously. To this end, consider the curve of the closest boundary point 2 (() on Ty, (1) to zy;:
Definition 1 (Curve of the closest boundary point (.))).. Suppose that (I; vs) is correctly classified by So(t) in some time interval 1. Define the curve of the closest boundary point ēx(+) 1 X as
(t) arg ming 2| 24 lp s.t. (², 0.
(3)
Define the margin of 2; at time to be R(x,, t) = (t) - xzllp-
An example of the curve of the closest boundary point is depicted
((ss)
in Figure 2. To understand how the distance between the decision boundary I y. (t) and H; changes, it suffices to focus on the curve of the closest boundary point (t). We define the speed of the decision boundary be the time derivative of the margin follows:
R(a, ta)
a(6))
Definition 2 (Speed of the decision boundary s(zx,t), Under the setting of definition 1, define the speed of the decision boundary w.n.t. I; as sz,, t) = 2 R(z,, t) = d (t) -z:llp
R(a, 6)
t2
x
Note that the speed sz,, f) > O means that the robustness is improv- ing for x at time t, which desirable during robust training. The following proposition gives closed-form expression for the speed, given a training algorithm (t).
Figure 2: The curve of the closest boundary point a(t) (in blue) of the data point z.
Proposition 3 (Closed-form expression of the speed s(x,, f)). Let (t) be the curve of the closest boundary point w.r.t. F2. For 1 S S co, the speed of decision boundary w.r.t I; under lp norm is
s(x;, t) =
do O(t)ll, Vogu (2) 0(t)) (t)
(4)
where q satisfies that 1/9 + 1/p 1. In particular, q= when p 0o.
Remark. Note that equation 4 is still valid when (t) is just a locally closest boundary point (i.e. local optimum of equation 3). In this case, s(x;, f) is interpreted as the moving speed of decision boundary around the locally closest boundary point é; (l). The main assumption for equation 4 is the local differentiability of 6 (-, ((t)) at (t). The full assumptions, proof and discussions are left to Appendix B. Special care has been taken for p = oo since for norm is not diffcrentiable.
According to equation 4, the speed s(x,, to) is positive at time to when Ved" (2o O(to)) 8((tu) > 0, i.e., 6t (t), A(t)) increases at time to, meaning that the boundary point (t will be correctly classified after the update. Also, the magnitude of the speed tends to be larger if 2 (t), O(()) is smaller, i.e., the margin function 6 is flatter around L; (1). In the remaining part of the paper, will denote s(2;,) () and R(xa, () as s(x:) and R(x:)) when the indication is clear.
Computing the closest boundary point. We use the Fast Adaptive Boundary Attack (FAB) (Croce & Hein, 2020a) to compute (t) in equation 4. Specifically, FAB iteratively projects onto the linearly approximated decision boundary with a bias towards the original data point, so that the resulting boundary point is close to the original point z,. Note that FAB only serves as an algorithm to find (t), and can be decoupled from the remaining part of the framework. In our experiments we find that FAB can reliably find locally closest boundary points given enough iterations, where the speed expression in equation 4 is still valid. We give more details of how to check the local optimality condition of equation and the performance of FAB in Appendix C. Note that Section 5.2, we will see that directly using FAB is computationally prohibitive for robust training and we will propose a more efficient solution. In the next section, we will still use FAB to find closest boundary points for more accurate visualization of the dynamics during adversarial training.
4.2 DYNAMICS OF ADVERSARIAL TRAINING
In this section, we numerically investigate the dynamics of the decision boundary during adversarial training. We visualize the speed and identify the conflicting dynamics of the decision boundary.
4

---

Published as a conference paper at ICLR 2023
Experiment setting. To study the dynamics of AT in different stages of training where models have different levels of robustness, we train a ResNet-18 (He et al., 2016a) with group normalization (GN) (Wu & He, 2018) on CIFAR-10 using 10-step PGD under & perturbation with 255 from two pretrained models: (1) a partially trained model using natural training with 85% clean accuracy and 0% robust accuracy; (2) partially trained model using AT with 75% clean accuracy and 42% robust accuracy under 20-step PGD attack. Note that we replace the batch normalization (BN) layers with GN layers since the decision boundaries are not the same during training and evaluation when BN is used, which can cause confusion when studying the dynamics of the decision boundary. On both pretrained models, we run one iteration of AT on batch of training data. For correctly classified points in the batch of data, we compute the margins as well as the speed of the decision boundary.
8
Conflicting dynamics. The dynamics of the decision boundary on both pretrained models under AT is shown in Figure 3. The speed values are normalized so that the maximum absolute value is for better visualization of their relative magnitude. We can observe that on both pretrained models, the decision boundary has neg- ative speed w.r.t. a significant proportion of non-robust points with R(xg)) 255 That is, the margins of many vulnerable points decrease during adversarial training even though the current update of the model is com- puted on these points, which counteracts the objective of robust training. In the next section, we will design dyname
Naturally pretrained model
Partially Robast model
100
Mangin
Figure 3: Margin-speed plot of AT training batch. Among points with margins smaller than 255 there are 28.8% and 29.4% points with negative speed on each pretrained model.
dynamics aware robust training method to mitigate such conflicting dynamics issue.
5 DyART: DYNAMICS-AWARD ROBUST TRAINING
In this section, we propose Dynamics-Aware Robust Training (DyART) to mitigate the conflicting dynamies issue. In Section 5.1, we show how design an objective function prioritize improving smaller margins and how to compute the gradient of such objective. In Section 5.2, we overcome the expensive cost of finding the closest boundary points and present the full DyART algorithm.
5.1 OBJECTIVE FOR DESIRABLE DYNAMICS
We aim to design a loss function (()) to directly increase the overall margins for effective robustness improvement. We propose to use the robustness loss [()0)= == E, (R)()))) where h R + 18 is a carefully selected cost function that assigns cost value h (R) to a margin R. When designing h(-). it crucial that minimizing L (i) = E. [h Ro (z)) encourages the desirable dynamics of the decision boundary: the decision boundary has positive speed w.r.t. vulnerable points with small margins.
Dynamics-aware loss function. To design such a dynamics-uware loss function, the following two properties of the cost function ht are desired. (1) Decreasing (i.e., If(-) < O): a point with a smaller margin should be assigned a higher cost value since it is more vulnerable. (2) Convex (i.e.. h²(-) > 0): the convexity condition helps prioritize improving smaller margins. To see this, consider minimizing the loss function L (0) on m points {x,, 3 with margins { [R; ) where the objective becomes #/ Σm (x:)) At each iteration, the optimizer should update the model to decrease the objective value. Therefore, in continuous-time we have that d de Em h(R((, f)) < 0. Using the chain rule and the definition that the speed s(2,, () = d
di R(x,, (), we obtain that Em h'(R,) (R,)s(z;;) t) < O. Given that h-(-) < O, the ideal case is that s(z,, t) > 0 for all x; and thus the sum Em h' (((RR)s(z;.)) f) < O. In this case, the margins of all data points increase. However, due conflicting dynamics as described in Section 4.2, some points may have negative speed s(x;, 1) < 0 while Eim l (((R))s(a;) 1) stays negative. In the presence of such conflicting dynamics, if (R,R)) is large (i.e., l/' Ii(RR) is small since I((-) < 0), it is more likely that a sxx,, > since otherwise it is harder to make Σ N (R.))s(z,tt) t) negative. When k²(-) >> 0, a smaller margin R2 has smaller h' (R,) and thus s s(x,, t) tends to be positive. Therefore, requiring h²(-) > 0 incentivizes the decision boundary to have positive speed w.r.t. points with smaller margins.
to the existence
How to design the optimal h(-) is still an open problem. In this paper, we propose to use
{ 1 exp( Ra)), R < ro
h h(R)-
(5)
0,
otherwise
5

---

Published as a conference paper at ICLR 2023
where the hyperparameters >> 0 and ro >> O. Larger values prioritize improving smaller margins. The threshold ro is used to avoid training on points that are too far away from the clean data points.
Difficulties of computing margin gradient. Directly minimizing Eg Rg (z))] through gradient- based optimization methods requires computing the gradient V (oh(Ro(z;) w.r.t the model parame- ters. However, it was previously unclear how to compute V (oh(Ro(z:) previous works did not directly operate on the margins. The difficulty of computing (ah(Ra(z)) lies in the fact that Rs (x:)) as defined in equation 2, involves a constrained optimization problem and thus its gradient V R& (1:; cannot be computed straightforwardly. An additional challenge is dealing with the mootthetssssss of the Lo norm, which widely used in the robust training literature.
which partly explains why
Our solution. We overcome the above challenges and provide the following close-form expression for the gradient of any smooth function of the margin. The proof is provided in Appendix B. Theorem 4 (The gradient Volí( Ro (3:4) of any smooth function of the margin). For 1 S S oo,
((((( V VoRt (f;, Voh(Ro(z;)) VV (æe, 0)ll,
(6)
where q satisfies that 1/9 + 1/p- = 1. In particular, q = 1 when p 0c.
Note that another expression for the margin gradient (i.e., h is the identity function in equation 6) was derived in MMA (Ding et al., 2020), with the following distinctions from us: (a) The expression in MMA does not apply to the & norm while ours does. (b) The coefficient [V,.0% in
our expression is more informative and simpler to compute. (c) MMA treats the aforementioned coefficient as a constant during training, and therefore does not properly follow the margin gradient.
Computing Voh( Ro (2:)) requires computing the closest boundary points G., which can be computa- tionally prohibitive for robust training. In the next section, we propose to use the closest point 4- on the soft decision boundary instead, whose quality of approximation to the exact decision boundary controllable and computational cost tractable. We will then present the full DyART algorithm.
5.2 EFFICIENT ROBUST TRAINING
Directly finding the closest boundary points is expensive. Since the closest boundary point ④ can be on the decision boundary between the true class and any other class, FAB needs to form a linear approximation of the decision boundary between the true class and every other class at each iteration. This requires computing the Jacobian the classifier, and the computational cost scales linearly with the number of classes K (Croce & Hein, 2020b). Therefore, finding the closest points the exact decision boundary is computationally prohibitive for robust training in multi-class classification settings, especially when K is large. To remedy this, we propose instead use the closest points on the soft decision boundary as elaborated below.
Soft decision boundary. We replace the maximum operator in logit margin (equation 1) with smoothed maximum controlled by the temperature 3 > 0. Specifically, we define the soft logit margin of the class y as
6g B) (x)
log Σ exp(322 (x))
B
1/ s/
The soft decision boundary is defined as the zero level set of the soft logit margin: I = {x (x;;)) = 0}. For x, with (x:;; () > O, the closest soft boundary point is defined as
a arg min, || xiile s.t.
= 0,
(8)
and the soft margin is defined as ( = || - x; p.l Note that we do not define Rzo0((z)) when T (zx; B) < The relationship between the exact and soft decision boundary is characterized by the following proposition:
Proposition 5. If x is on the soft decision boundary Toof i.e. (x; then
Ing(-1)
>
B
2 (x) 2 O. Moreover, when $ (I.6 B) > O, then R2ool (x:) S Ro(x.).

---

Published as a conference paper at ICLR 2023
In other words, the soft decision boundary is always closer 2; than the exact decision boundary as shown in Figure 4. Moreover, the quality of approximation to the exact decision boundary is controllable: the gap between the two decreases / increases and vanishes when 3 + oo. Therefore, increasing the soft margins will increase the exact margins as well.
Benefits of the soft decision boundary. (1) Computational effi- ciency. Using the smoothed max operator, finding the closest soft boundary point does not require forming linear approximations for the decision boundary between the true class and all the other classes anymore. We adapt the FAB method to solve for 2,thh (see details in Appendix C.2). Its computational cost for each iteration is in- dependent of the number of classes K, which is the same as the PGD training. (2) Effective information usage. Another benefit of using the smoothed max operator in soft logit margin that, unlike the logit margin 0g (z:), the soft logit margin & (ay; B) contains information logit values all classes. Therefore, the information of all classes is used each iteration when finding 2.00..
gmott
R(x)
R
Figure 4: Exact decision bound- ary (in blue) for three classes (yel- low, green and grey regions) and the soft decision boundary (in red) for the class of x.
Loss function and its gradient. The overall objective of DyART is to increase the soft margins and also achieve high clean accuracy. Denote a training data batch B of size n and B3 of size m to be {i E B proposed method DyART uses the following loss function
4 (a:B) > 0)- Our
1 Σ Lo( = n2 ies (x Ui) +
Σ 12
M (R:gg((x:))
iEB
where the first term is the average cross-entropy loss on natural data points and the second term is for increasing the soft margins. The hyperparameter À balances the trade-off between clean and robust accuracy. By applying equation 6, the gradient of the objective can be computed as
- n1 iEB Vol(Ei, Mh) n Σ
h' ((
VoLo
Vo (#:00 B)
iEB
V T (A 3)1
Since the soft margin Rg (z;) is only defined for I. with D (z,;; 9) DyART requires training on a pretrained model with a relatively high proportion of points with positive 4 values. In practice, we find that burn-in period of several epochs of natural training is enough for such pretrained model.
Novelty compared with prior works. (1) Direct and efficient manipulation of the margin. (la) In contrast to prior works that depend on indirect approximations of margins, DyART directly operates on margins by utilizing the closed-from expression for the margin gradient in equation 6 whose computation was previously unclear. (1b) We significantly reduce the computational cost of computing margins and its gradients by introducing the soft margin, lower bound of the margin whose approximation gap is controllable. (2) Prioritizing the growth of smaller margins by carefully designing the cost function hi-) to mitigate the conflicting dynamics. Therefore, DyART achieves more targeted and effective robustness improvement by directly and efficiently operating on margins as well prioritizing the growth of smaller margins.
6 EXPERIMENTS
In this section, we empirically evaluate the effectiveness and performance of the proposed DyART on the CI (Krizhevsky et al., 2009) and Tiny-ImageNet (Deng et al., 2009) datasets. In Section 6. we evaluate the adversarial robustness of DyART and compare it with several state-of- the-art baselines. In Section 6.2, we visualize the dynamics of the decision boundary under DyART and analyze how it alleviates the confficting dynamics.
6.1 ROBUSTNESS EVALUATION
Architectures and training parameters. In the experiments on the CIFAR- 10 dataset, we use the Wide Residual Network (Zagoruyko & Komodakis, 2016) with depth 28 and width factor 10 (WRN-
7

---

Published as a conference paper at ICLR 2023
28-10), On the Tiny-ImageNN dataset, use pre-activation ResNet-18 (He et al., 2016b). Models are trained using stochastic gradient descent with momentum 0.9 and weight decay 0.0005 with batch size 256 for 200 epochs CIFAR-10 10 and 100 epochs Tiny-ImageNet. We use stochastic weight averaging (Izmailov et al., 2018) with a decay rate of 0.995 as in prior work (Gowal et al., 2020). We use cosine learning rate schedule (Loshchilov & Hutter, 2016) without restarts where the initial learning rate is set to 0.1 for all baselines and DyART, To alleviate robust overfitting (Rice et al., 2020), we perform early stopping on a validation set of size 1024 using projected gradient descent (PGD) attacks with 20 steps.
Baselines. On CIFAR-10, the baselines include: (1) standard adversarial training (AT) (Madry et al., 2017) which trains on the worst case adversarial examples; (2) TRADES (Zhang et al., 2019) which trades off between the clean and robust accuracy; (3) MMA (Ding et al., 2020) which uses cross-entropy loss on the closest boundary points; (4) GAIRAT (Zhang et al., 2021) which reweights adversarial examples based on the least perturbation iterations. (5) MAIL (Liu et al., 2021) which reweights adversarial examples based their logit margins. (6) AWP (Wu et al., 2020) which adversarially perturbs both inputs and model parameters. On Tiny-ImageNet, we compare with AT, TRADES, and MART whose hyperparameter settings are available for this dataset. The hyperparameters of the baselines and full experimental settings are found in Appendix D.I.
Evaluation details. We evaluate DyART and the baselines under boe norm constrained perturbations. The final robust accuracy is reported on AutoAttack (AA) (Croce & Hein, 2020b). For all methods, we choose the hyperparameters achieve the best robust accuracy under the commonly used perturbation bound 255 To fully compare the robustness performance among different methods, we report
the robust accuracy under four additional perturbation bounds: 255 255 233
2 4 12 and 16
255
Hyperparameters of DyART. We use the cost function h(-) in equation 5. On CIFAR- 10. we use = 3, ro = 255 À 1000 and apply gradient clipping with threshold 0.1. On ImageNe,,,,e, we use = 5, ra 255
16
32 X 500 and apply gradient clipping with threshold 1. The temperature 33 is set to 5. We use 20 iterations to find the closest soft boundary points using the adapted version of FAB.
We use 10 epochs of natural training the burn-in period.
Defense
Clean
16
265
255
265
AT
85.65 + 0.25
79.08
0.12
71.24
- 0.28
0.16
32.94
0.32
16.12 0.23
TRADES
82.92 0.30
77.69
0.16
70.68
+ 0.15
54.28
0.119
+ 0.24 36.65
21.59 + 0.31
MART
83.37 0.25
76.58 16.58+00.2 0.24
70.19
+ 0.18
52.91
0.224
35.16+0..1
18.80 + 0.14
MMA
83.22 0.388
0.552
64.42 1 0.29
0..33
26.45
1.221
13.78 1 0.25
GAIRAT
8.31
0.228
64.64
+ 0.25
0..3
19.01
7.55
TRIDES
83.96 0.52
77.65
0.33
69.11
0.35
0..1
31.57 + 0.24
16.98 0.15
AWP
84.27 0.19
0.221
70.82
1 0.26
53.92
13.24.0.220
20.40
0.14
DyART
85.55 + 0.24
79.21 + 0.14
71.73 0.18
54.69 + 0.14
35.74 + 0.25
20.79 0.18
Table 1: Clean and robust accuracy on CIFAR-1O under AA with different perturbation sizes on WRN-28-10.
Defense
Clean
2
12
16
256
256
255
265
265
AT
48.09 + 0.38
38.82 + 0.26
30.18 + 0.27
16.46 0.19
7.74 0.20
3.05 1005=00 0.17
TRADES
46.68 + 0.30
37.84 + 0.21
29.85 + 0.19
16.76
8.97 -997000 0.23
1.43+0..1
MART
45.51 + 0.29
36.68 + 0.34
29.15 + 0.25
17.79+0..15
9.91 + 0.17
5.31 + 0.17
DyART
49.71 + 0.18
39.30 0.14
30.69 0.21
18.02 + 0.18
10.08 - 0.09
5.65 + 0.12
Table 2: Clean and robust accuracy on Tiny- under AA with different perturbation sizes on ResNet-18.
Performance. The evaluation results on CI and Tiny-Im are shown in Table I and Table 2. respectively. On CIFAR- 10, under three out of five perturbation bounds, DyART achieves the best robustness performance among all baselines. On Iing-lmag,Net, DyART obtains the highest robust accuracy under all perturbation bounds and also achieves the highest clean accuracy. These results indicate the superiority of DyART in increasing the margins. (1) Specifically, on CIFAR- 255 and achieves the 12 and 16 which is lower than TRADES. (1a) Since second highest robust accuracy under 255 255
10, DyART achieves the highest robust accuracy under = 255 255
4 and 8
DyART prioritizes increasing smaller margins which are more important, DyART performs better than TRADES under smaller perturbation bounds and achieves much higher clean accuracy. (1b)
8

---

Published as a conference paper at ICLR 2023
Although GAIRAT and AT have higher clean accuracy than DyART, their robustness performance is lower than DyART under all perturbation bounds. (Ic) Thanks to directly operating on margins in the imput space and encourage robustness improvement points with smaller margins, DyART performs better than GAIRAT and MAII--TRADE which use indirect approximations of the margins. (2) On Ima DyART achieves the best clean accuracy and the best robust accuracy under all perturbation bounds. Further experimental results on both datasets using various hyperparameter settings and types of normalization layers are left to Appendix D.2. We also provide results of DyART when trained with additional data from generated models (Rebuffi et al., 2021) in Appendix D.3.
6.2 DYNAMICS OF DYART
In this section we provide further insights into how DyART encourages the desirable dynamics by comparing it with adversarial training.
Experimental setting. To compare the dynamics of the decision boundary during training using DyART and AT, we empirically compute the margins and speed values for both methods. For fair comparison, we run DyART and AT on the same pretrained models for one iteration on the same batch of training data points. The pretrained models include partially trained model using natural training and a partially trained model using AT, which are the same as in Section 4.2. For all the correctly classified points in this batch, we compute the margins and speed values under both methods. Note that the speed and margins correspond to the exact decision boundary, instead of the soft decision boundary used by DyART for robust training. Since both methods train on the same model and the same batch of data at this iteration, the margins are the same and only the speed values differ, which corresponds to the difference in dynamics of the decision boundary.
DyART mitigates the conflicting dy- namics. We visualize the dynam- ies on both pretrained models under DyART and AT in Figure 5. Specifi- cally, we divide the range of margins into multiple intervals and compute the proportion of positive and nega- tive speed within all the correctly clas- sified points. On the naturally pre-
Prpgetion of pusilive and negel ive spoed
Properiion posi ve repaliie spredd
50000 projortin
positive
sauand projettinn
Ours
NNNS Al
trained model, most of the points have margins less than 255 (the first bin) and are considered more vulnerable. Among these points, DyART reduces the proportion of the negative speed from 29 to 15.3% when compar- ing with AT. Therefore, a higher per- centage of the margins vulnerable
100
69
799
35
76
margin Interval
intervel
(a) Naturally pretrained model
(b) Partially robust model
Figure 5: Proportion of positive and negative speed values in each margin interval for AT and DyART on a naturally pretrained model and a partially robust model. Observe that DyARI has lower proportion negative speed for points with small margins (< ).
points will increase using DyART. On the adversarially pretrained model, DyART reduces the propor- tion of negative speed values in the first three margin intervals and therefore has better dynamics of the decision boundary. We conclude that compared with AT, DyART leads to better dynamics of the decision boundary where increasing smaller margins is prioritized.
7 CONCLUSIONS AND DISCUSSIONS
This paper takes one more step towards understanding adversarial training by proposing a framework for studying the dynamics of the decision boundary. The phenomenon of conflicting dynamics is revealed, where the movement of decision boundary causes the margins of many vulnerable points to decrease and harms their robustness. To alleviate the conflicting dynamics, we propose Dynamics- Aware Robust Training (DyART) which prioritizes moving the decision boundary away from more vulnerable points and increasing their margins. Experiments on CIFAR-10 and Tiny- Imageem demonstrate that DyART achieves improved robustness under various perturbation bounds. Future work includes (a) theoretical understanding of the dynamics of adversarial training; (b) developing more efficient numerical methods to find the closest boundary points for robust training.

---

Published as a conference paper at ICLR 2023
ACKNOWLEDGMENTS
The authors would like thank Zhen Zhang, Chen Zhu and Wenxiao Wang for helpful discussions over the ideas. This work is supported by National Science Foundation NSF-IIS-FAL program, DOD- ONR-Office of Naval Research, DOD Air Force Office of Scientific Research, DOD-DARPA- Advanced Research Projects Agency Guaranteeing Al Robustness against Deception (GARD), Adobe, Capital One and JP Morgan faculty fellowships.
REFERENCES
Alireza Aghasi, Misha Kilmer, and Eric L Miller. Parametric level set methods for inverse problems. SIAM Journal on Imaging Sciences, 4(2):61 8-650, 2011.
Matan Atzmon, Niv Haim, Lior Yariv, Ofer Israelov, Haggai Maron, and Yaron Lipman. Controlling neural level sets. In H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alché-Buc; E. Fox, and R. Garnett (eds.), Advances in Neural Information Processing Systems, volume 32. Curran As- sociates, Inc., 2019. URL https: httptttttttt/eeeeeeeeeeeeeteee/e pttpe/edoooceeeceeeeeeeeepc neurips wwtppppppppaaeeeccccceeee b2 wwd.ddddd9... 6588 Papee .df.
file/
Tianlong Chen, Zhenyu Zhang, Sijia Liu, Shiyu Chang, and Zhangyang Wang. Robust overfitting may be mitigated by properly learned smoothening. In International Conference Learning Representations, 2020.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In International Conference Machine Learning, pp. 1310-1320. PMLR, 2019.
Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with fast adaptive boundary attack. In International Conference on Machine Learning, pp. 2196-2205. PMLR, 2020a.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning, pp. 2206-2211 PMLR, 2020b.
Francesco Croce, Maksym Andriushchenko, and Matthias Hein. Provable robustness of relu networks via maximization of linear regions. In the 22nd International Conference on Artificial Intelligence and Statistics, pp. 2057-2066. PMLR, 2019.
Jiequan Cui, Shu Liu, Liwei Wang, and Jiaya Jia. Learnable boundary guided adversarial training. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 15721-15730, 2021.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp. 248 255. Ieee, 2009.
Gavin Weiguang Ding, Yash Sharma, Kry Yik Chau Lui, and Ruitong Huang. Mma training: Direct in- put space margin maximization through adversarial training. In International Conference on Learn- ing Representations, 2020. URL https: /ttp:///eee/////////////e net forum 2id=:kerryxBtRR.
Gamaleldin Elsayed, Dilip Krishnan, Hossein Mobahi, Kevin Regan, and Samy Bengio. Large margin deep networks for classification. Advances in neural information processing systems, 31, 2018.
Alhussein Fawzi, Mehee- Moosavi-Dezfooll, Pascal Frossard, and Stefano Soatto. Empirical study of the topology and geometry of deep networks. In Proceedings of the IEEE Conference on 2018
Computer Vision and Pattern Recognition, pp.
Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde- Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. Advances in neural information processing systems, 27, 2014.
Sven Gowal, Krishnamurthy Dvijotham. Robert Stanforth, Rudy Bunel, Chongli Qin, Jonathan Uesato, Relja Arandjelovic, Timothy Mann, and Pushmeet Kohli. On the effectiveness interval bound propagation for training verifiably robust models. arXiv preprint
2018.
10

---

Published as a conference paper at ICLR 2023
Sven Gowal, Krishnamurthy Dj Dvijotham, Robert Stanforth, Rudy Bunel, Chongli Qin, Jonathan Uesato, Relja Arandjelovic, Timothy Mann, and Pushmeet Kohli. Scalable verified training for provably robust image classification. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 4842-4851 2019.
Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03593. 2020.
Sven Gowal, Sylvestre-Alvise Rebufli, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy A Mann. Improving robustness using generated data. Advances in Neural Information Processing Systems, 1144218-42333 2021.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference computer vision and pattern recognition. pp. 770-778, 2016a.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In European conference computer vision, pp. 630-645. Springer, 201 6b.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems, 33:6840-688 6851, 2020.
Pavel Izmailov, Dmitrii Podoprikhin, Timur Garipov, Dmitry Vetrov, and Andrew Gordon Wilson, Av- eraging weights leads to wider optima and better generalization. arXiv preprint (03.0000, 2018.
Hamid Karimi, Tyler Derr, and Jiliang Tang. Characterizing the decision boundary of deep neural networks. arXiv preprint arXiv: 19/2. 1460, 2019.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. Citeseer, 2009.
Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolu- tional neural networks. Advances in neural information processing systems, 25, 2012.
Feng Liu, Bo Han, Tongliang Liu, Chen Gong, Gang Niu, Mingyuan Zhou, Masashi Sugiyama, et al. Probabilistic margins for instance reweighting in adversarial training. Advances in Neural Information Processing Systems, 34, 2021.
Ilya Loshchilov and Frank Hutter. Sgdr: Stochastic gradient descent with warm restarts. arXiv
preprint arXiv:1608.0399 033983 2016.
Aleksander Madry. Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv: 10ee 06083, 2017.
Amir Najafi, Shin-ichi Maeda, Masanori Koyama, and Takeru Miyato. Robustness to adversarial perturbations in learning from incomplete data. Advances Neural Information Processing Systems, 32, 2019.
Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 427-436, 2015.
Guillermo Ortiz-Jimenez, Apostolos Modas, Seyed-Mohsen Moosavi, and Pascal Frossard. Hold me tight! influence of discriminative features on deep network boundaries. Advances in Neural Information Processing Systems, 33:2935-200 2946, 2020.
Stanley Osher, Ronald Fedkiw, and K Piechor. Level set methods and dynamic implicit surfaces. Appl. Mech. Rev., (7(3):115-B1) 2004.
Rahul Rade and Seyed-Mohsen Moosavi-Dezzooli. Reducing excessive margin to achieve better accuracy vs. robustness trade-off. In International Conference on Learning Representations, 2022.
URL https:tt//// /tttpp:://ppeeee http//ppeeeeeveeeeeeee net./ forum? d= Ad-AAhh

---

Published as a conference paper at ICLR 2023
Prajit Ramachandran, Barret Zoph, and Quoe V Le. Searching for activation functions. arXiv preprint arXiv:1710.05941, 2017.
Sylvestre-Alvise Rebuffi, Sven Gowal, Dan A Calian, Florian Stimberg, Olivia Wiles, and Tim- othy Mann. Fixing data augmentation to improve adversarial robustness. arXiv preprint arXiv:2103.01946. 2021.
Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in adversarially robust deep learning. In International Conference on Machine Learning, pp. 8093-8100 -194- PMLR, 2020.
Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! Advances in Neural Information Processing Systems, 32, 2019.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties neural networks. arXiv preprint arXiv:1312.6199, 2013.
Florian Tramèr, Jens Behrmann, Nicholas Carlini, Nicolas Papernot, and Jömn-eerik Jacobsen. Fun- damental tradeoffs between invariance and sensitivity to adversarial perturbations. In International Conference on Machine Learning, pp. 9561-9571. PMLR, 2020.
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. International Conference on Learning Representations, 2019.
Eric Wong and Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. In International Conference Machine Learning, pp. 11886-299... PMLR, 2018.
Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust general- ization. In Proceedings of the 34th International Conference on Neural Information Processing Systems, NIPS'20, 20, Red Hook, NY, USA, 2020. Curran Associates Inc. ISBN 9781713829549
Yuxin Wu and Kaiming He. Group normalization. In Proceedings of the European conference on computer vision (ECCV), pp. 3-19, 2018
Ashkan Yousefpour, Igor Shilov, Alexandre Sablayrolles, Davide Testuggine, Karthik Prasad, Mani Malek, John Nguyen, Sayan Ghosh, Akash Bharadwaj. Jessica Zhao, Graham Cormode, and Ilya Mironov. Opacus: User-friendly differential privacy library in PyTorch. arXiv preprint arXiv:2109. 12298, 2021.
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. arXiv preprint 4rXiv:1605.07146. 2016.
Huimin Zeng, Chen Zhu, Tom Goldstein, and Furong Huang. Are adversarial examples created equal? learnable weighted minimax risk for robustness under con-uniform attacks, arXiv preprint arXiv:2010. /2989, 24, 2020.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference machine learning, pp. 7472-7482. PMLR, 2019.
Huan Zhang, Tsui- Bei Weng, Pin-Yo Chen, Cho-Jui Hsich, and Luca Daniel. Efficient neural network robustness certification with general activation functions. In Proceedings of the 32nd International Conference on Neural Information Processing Systems, NIPS' 18, pp. 4944 4953, Red Hook, NY, USA, 2018. Curran Associates Inc
Huan Zhang, Hongge Chen, Chaowei Xiao, Sven Gowal, Robert Stanforth, Bo Li, Duane Boning, and Cho-Jui Hsich. Towards stable and efficient training of verifiably robust neural networks. In International Conference on Learning Representations, 2020a. URL https:://peeteeeeeee /pppn//veee.....e/////e/e net/forum d=5kxuk1 wFw...
12

---

Published as a conference paper at ICLR 2023
Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankan- halli. Attacks which do not kill training make adversarial learning stronger. In International conference on machine learning, pp. 11278-12211 11287. PMLR, 2020b.
Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan Kankanhalli. Geometry-aware restehee-e adversarial training. In International Conference on Learning Representations, 2021. URL https: / /openreveew wet//eortiie ? 1
13

---

Published as a conference paper at ICLR 2023
Supplementary Material
A ADDITIONAL RELATED WORK
Decision boundary analysis In this paper, we mathematically characterizes the dynamics of decision boundaries and provide methods to directly compute and control the dynamics. Prior to this work, there are also some interesting studies on the dynamics of margins, though from different perspectives. Rade & Moosavi-Dezfoolf (2022) point out that adversarial training leads to superfluous increase in the margin along the adversarial directions, which can be reason behind the trade-off between accuracy and robustness. Ortiz-Jimenez et (2020) investigate the relationship between data features and decision boundaries, and reveal several properties of CNNs and adversarial training. Their results show that adversarial training exploits the sensitivity and invariance of models to improve the robustness. Tramèr et al. (2020) studies invariance-basee adversarial examples and expose a fundamental trade-off between commonly used sesitivity- based adversarial examples and the invariance-basee ones, where the behaviors of decision boundaries are identified.
Other Approaches to Improve Adversarial Training. Recent works (Najafi et al., 2019; Rebuffi al., 2021; Gowal et al., 2021; 2020) have shown that the robust accuracy of adversarial training can be improved significantly with additional data from unlabeled datasets, data augmentation techniques and generative models. These approaches enhance the robustness of models by augmenting the dataset, which is orthogonal to our proposed algorithm that focus on how to optimize the model with the original dataset. Wu et al. (2020) show that model robustness is related to the flatness of weight loss landscape, which is implicitly achieved by commonly used adversarial learning techniques. Based on this insight, the authors propose to explicitly regularize the flatness of the weight loss landscape, which can improve the robust accuracy of existing adversarial training methods. Cui et al. (2021) propose to use logits from clean model guide the learning of robust model, which leads to both high natural accuracy and strong robustness.
We note that our method focuses on a different perspective of adversarial training, i.e., dynamics of decision boundary, and can be combined with these techniques to further improve the robust accuracy of the model. The investigation of such combination is out of the scope of this paper, and will be addressed in our future work.
Certifiable Robustness. There is an important line of work studying guaranteed robustness of neural networks. For example, convex relaxation of neural networks (Gowal et al., 2019; Zhang et al., 2018; Wong & Kolter, 2018; Zhang et al., 2020a; Gowal et al., 2018) bounds the output of a network while the input data is perturbed within f, norm ball. Randomized smoothing (Cohen al., 2019) is another certifiable defense which adds Gaussian noise to the input during test time. Croce et al. (2019) propose a provably robust regularization for ReLU networks that maximizes the linear regions of the classifier and the distance to the decision boundary. Note that certifiable robust radius is strict lower bound of the margin, which is the focus of our work.
14

---

Published as a conference paper at ICLR 2023
B PROOF OF THE CLOSED-FORM EXPRESSION FOR THE SPEED IN EQUATION 4 AND THE MARGIN GRADIENT IN EQUATION 6
In this section, our goal is to prove the closed-form expression equation 4 as well as the margin gradient in equation 6 and provide further discussions. We first provide two preliminary lemmas and present the mathematical assumptions. Then we rigorously derive the closed-fore expressions. Finally, discuss more about the expression and its assumptions.
Lemma 6. For 1 S p S and let q satisfies 1/q
1/p 1. Let a be any fixed vector. Then
Ve || alp 11pp11 =
Proof. Without loss of generality, assume a is the zero vector. Write the k-th component of as Tt.
Case 1: 1:15p3 o0 By calculation,
d|alee dag
[Trll, yo- ! sign(xx).
Since
p
we have that
p-1.
0 0|11l1
x
)z
sign(r>>)
Osr
[ar||
27k |
||
1
Therefore, V x |1e1|, 111111 = =x
@llalle 1/9 1. dara
Case 2: p
In this case, Va l/ is one-hot vector (with the one being the position of the element of æ with the largest absolute value). Therefore, || V || 1.
The following lemma deals with the optimality condition for cc. Special care needs to be taken since Lo norm is not differentiable function.
Lemma 7. Let be a local optimum of the constrained optimization problem:
arg min ||:: alloo s.I. Φ(xx) =
where is any fixed vector with Φ(a) 0. Assume that o is differentiable at point â. Denote the coordinates set J {}- | asl = | al Denote the k-th component of V V((
as V. Then (a) for j J. Vi)(t) and ūj aj have opposite signs; (b) for k. & J.
V Vz0(2)) = 0.
Remark. o(a) < 0. then for j E J. V o(ē), and it - aj have the same sign; for k $ J. V.b(f)= 0.
Proof. (a) Consider the perturbation f(e) = 4 + (0.... Eijr.... "im.""""""""" 0) where J (Jr.... }m} and is m dimensional vector with j-th component Ej. Since d(a) > and is a local optimum, ||æ alloo < || a alloe imply o(x) > 0 if x is sufficiently close to â. Therefore. every ej. chosen so that | + <j aj [.y - -aj. (that is, é; has different sign from S. aj.) and ||e|| sufficiently small, then ||ā(()
all < || all and thus ((ā(c)) > 0.
On the other hand, by Taylor expansion and the fact that ((+) O. we have that
((a(c)) Σ Vo(E), +(()))))))))))))))))
jEJ
15

---

Published as a conference paper at ICLR 2023
Therefore, Eeeo Vo( 0 for any such By taking other c₁ - 0 if necessary, obtain that Vj J, JC 2 where ej has different sign from 3. aj- Therefore, Vo( and ēy 0j have different signs.
(b) Take any k $ and consider the perturbation .(e) & + (0, Eji..... Ek, Ei where e - (fjn:"
0)
- ..,)). Choose any so that ||e|| is sufficiently small, each ej has the opposite sign of f; aj, and Eg small enough (which can be positive or negative), we have that ((((E)) > 0 since al < ||
By Taylor expansion, Σjej ( V vz)(E) > 0 for any such e. By taking + 0 and using the fact that e; can be positive or negative, we conclude that Vz 0.
Now we are ready to derive the closed-form expression of the speed. We first provide the full assumptions, then derive the expression, and finally we will discuss more about the assumptions. We will write (t) as i; when the indication clear.
Assumption 8. Suppose that (I,, ys) is correctly classified by fo(e) in some time interval E I and it (t) is locally closest boundary point in the sense that for any & E 1, it is the local optimum of the following:
a,(1) arg ming ||
xz
8t (5, 0.
Assume that in the time interval I: (a) (t) is differentiable t; (b) t is differentiable point &. (t) and at the current parameter (I)).
Proposition (Closed-fort form expression of the speed s(x;, t)). For S < xo and under Assumption
define the (local) speed according to ât (1) in Assumption 8 as s(x,, 1) ă ( (1) - I3 pp we have the following:
s(xt,t)
V (1), (()))l vodh (t)) (t())
where satisfies that 1/4 + 1/p= 1. In particular, q = 2 when p 2 and q = when DC.
Proof. Case 1: 1:15p<0
d (i::(()) r:112, we need to characterize the curve of the closest boundary To compute s(x,, t) de point (f),, where two key points stand out. First, (t) is on the decision boundary (t) and thus dd (ā)(),)) (()) = 0 for all E 7. By taking the time derivative on both sides, we obtain the level set equation (Osher et al., 2004; Aghasi et al., 2011)
2 (2,(1),00) 20(00 + (E. -
(1) = 0
(10)
Second, (t) is the optimal solution of constrained optimization equation 3. Therefore, we have the following optimality condition:
6d (2,(1),(tt) X(t -
(II)
Since z; is correctly classified, 6th (xx)
> 0. Since (t) is the closest point to x; whose 6 value is zero, X(t) O. By taking the Lg norm in Equation equation 11 and using Lemma 6, we obtain that
X(1) = V 2h (fx(1), 0(())l
Now, we derive sxxi as follows:
16

---

Published as a conference paper at ICLR 2023
d
s(ri, ()
[[2:(t) xillp
di
(t) sillp (1)
X V vdth (f.(1), #1(1)
(By the optimality condition equation 11)
0 (i,(1), 0'(1)
(By the level set equation equation 10)
Vodm (z)))),(())
IV 6 (,((1)
Case 2: 00
Note that since Loo is not differentiable, the optimality condition in Equation equation 11 does not hold anymore.
Denote the j-th component of (:((1) and x; as (t) and Maj- Let J [j ( Figl =
||x:(() 1a oo By Lemma 7, ( 1) (1)( Tiyl (1) sign kzj)
- (t) sign( (" for all j E J. Therefore, by Equation equation 10 and Lemma 7
-V00" (f:(1),0(1) (1())
V (0) 11(1)
Σ
m (it) (1)
JEJ
s 1) sign V (f:),)
ri (#:)) ($:)))
JEJ
G (it)sl ((xi,()
=
JEZ
Therefore, s(x;,)) = Vogt (8))
d2 where the last equality follows
Ejer V (2,))
from Lemma 7 that the components of V v (f,) are zeros if they are not in J.
As an corollary of the proposition we prove above, we can obtain the closed-form expression for the gradient of margin (or the gradient of any smooth function of the margin) as follows: Theorem (Closed-form expression of Vol( Ro (x:))), For 1 s oo. h' (((Ro(z))
Voh(Ro(I:))
|V 0)1l, "2,
where q satisfies that 1/q + 1/p=1.
Proof. In continuous time we consider h ((((2,,,) t)) (or more rigorously, h ((xx, ((t))) and its time derivative. We use the following relationship between the gradient and the time derivative, where 0' (1) can be any update rule:
d M(((s,;)) ()) Voh(R(E,, 0)) (1())
dt
On the other hand:
(R(x,,))) = N((R(a,,)) d dt
R(x,,t)
dt
=R((a 1))s(11(()
(R(())))
Vog (2+(1),0())- ('(1)
(2,) ((t))ll
17

---

Published as a conference paper at ICLR 2023
where the last equality uses the closed-form expression for the speed s(2,, t).
Therefore we have that for any (1), Vah( 6)) (1)) = (2.)))))
((((())))
(2.()
(= (t)... We conclude that Vah(Ra (2+)) (2,,0 Vod (2,, 0).
DISCUSSIONS ON THE ASSUMPTIONS
Assumption 8 has several points that need to be explained further.
First, we only require that (t) local closest boundary point. This is important because in practice when an algorithm for searching the closest boundary point is used (e.g. FAB), a local solution is the best one can hope for due the non-convex nature of the optimization problem. When (,(() is local solution, the speed should be interpreted as how fast the distance changes around that local solution. this case, although L; is not the globally closest adversarial example, the local speed around é still has much information especially when the distance || x; || is relatively small and the input space is a high-dimensional space (e.g. pixel space).
the relative movement of the decision boundary w.r.t. 2;,
Second, we require that (t) is differentiable curve in time interval I. Note that if we constrain i, (L) to be the global closest boundary point, f; is unlikely to be differential for large time interval I, especially in high dimensional space. This is because as the decision boundary moves. the closest point might switch from one point to another point that is very far away abruptly. Fortunately, this problem is alleviated because our derived closed-form expression still works when (;) is a locally closest boundary point. Note that however, due the topological change the decision boundary, it still can happen that (t) stops existing (and thus stops being differentiable) at some time point, when typically the speed will go infinity. From a mathematical point of view, this is related to shock in partial differential equation (PDE) theories. More exploration on this is left to future work. In this work, we only consider the speed of the decision boundary at each discrete time step.
18

---

Published as a conference paper at ICLR 2023
C COMPUTATION OF THE EXACT AND SOFT CLOSEST BOUNDARY POINT
Either computing the speed of the decision boundary or using DyART to directly optimize a function of margins requires the computation of the closest boundary point J: (or the closest soft boundary point ), where we omit the subscript i in this section. As discussed in Appendix B, it suffices to find the locally closest (soft) boundary point in order for the closed-form expression 4 and expression for the speed and the gradient of margin to be valid.
C.I CLOSEST BOUNDARY POINT
In this section, we will explain how to check the quality of the found E for the constrained optimization problem 3 in practice. We will also give a simple analysis on how FAB(Croce & Hein, 2020a), the algorithm we use in our implementation, solves the problem 3 in practice. We include both 2 and p = oo although in our work, only p = oo used. We discuss both of them in order to highlight the difference in checking optimality conditions for smooth (p 2) and non-smooth norm (p oo).
The key points of analyzing & are that (*) = 0 and the KKT conditions of problem
Case 1: =
In this case, the KKT condition is given by V V (.) + X(a x) for some >> (since dd (x) > 0). In other words, IV O
F- = 1. In practice, we check the following two
conditions (a) [x(2|| < 0.11 (b)
0.8. We observe in experiments that FAB find high-quality closest boundary points for over 90% of the correctly classified data points.
V
>
[
---
Case 2: p = 00
In this case, we consider the optimality condition given in Lemma 7 of Appendix B. Denote #B
the number of points in a set B. Using the notation J = {j |ā² xyl - || x x||oc] } and J the complement set of J, # (B),
check the following conditions in practice: (a) [+) S 0.1; (b)
> 0.9; (c) # =("
0.8. Note the unlike p 2, the optimality conditions for p x are on each coordinate of J. which is more difficult to satisfy in practice. We observe in our experiments that FAB with 100 iterations can find high-quality closest boundary points for about 85% of the correctly classified points. However, when only 20 iterations are used, condition (3) is barely satisfied for all of the found boundary points (the first two conditions are still satisfied).
#J
#J6
In our visualizations of dynamics of the decision boundary for AT in Section 4.2, we use 100 iterations for FAB and only use high-quality closest boundary points, so that the visualization results are relatively accurate.
C.2 CLOSEST SOFT BOUNDARY POINT
Adapt FAB for soft decision boundary. DyART, the closest point 3:5oft on the soft decision boundary is used. To find fsoft we adapt the FAB method. The original FAB method aims to find the closest point on the exact decision boundary. In particular, FAB forms linear approximations for decision boundary between the ground truth class and every other classes. The only adaptation do on the FAB method is that now FAB only forms one linear approximation for the soft decision the smoothed max operator in the soft
boundary of the ground truth class. This is because logit margin, and there is no concept of the 'decision boundary between the ground truth class and another class' anymore.
Computational efficiency. By using the soft decision boundary, every iteration of FAB only requires one linear approximation of the soft decision boundary, which cost one pack-propngation. In contrast, the original FAB which aims to find the closest boundary point on the exact decision boundary costs K back ceco-praaaattionn at each iteration, where K is the number of classes. Therefore, using the soft decision boundary is more efficient and is used in our proposed robust training method DyART.
19

---

Published as a conference paper at ICLR 2023
Local optimality condition. The procedure of checking optimality condition is similar to the one in the last section. Denote # the number of points in a set B. Using the notation J {í द2, 2j = || - x [lo}) f and J the complement set of J, we check the following conditions in practice: (a) [o(+)] s 0.1; (b)
0.9; We find that when the temperature / is relatively large (we use 3 5 in all of our experiments) and 20 iterations used, 95% of the soft boundary point found for the correctly classified points satisfy these two conditions. During training, we only use these higher quality points and discard the rest of the boundary points that do not satisfy these two conditions. Note that we do not consider the third condition (c) #(KgJ:| (0)(0))))) > 0.8. This is because condition (c) cannot be satisfied unless a very large iteration number is used, which is computationally prohibitive for robust training.
#J
#
Experimentally DyART achieves improved robustness over baseline methods, indicating that the closest soft boundary points used by DyART are indeed useful for robust training. Designing faster and more reliable methods to solve the constrained optimization problem 3 is left for future work.
20

---

Published as a conference paper at ICLR 2023
D EXPERIMENTS
In this section, provide the details of experimental settings and further results of DyART using various choices of hyperparameters. In addition, we provide experimentll results when using additional data from the generated models. We also provide further analysis on the decision boundary dynamics.
D.1 DETAILED EXPERIMENTAL SETTINGS
Architectures and training settings. In all experiments on the CIFAR-10 dataset, we use the Wide Residual Network (Zagoruyko & Komodakis, 2016) with depth 28 and width factor 10 (WRN-28-10) with Swish activation function (Ramachandran et al., 2017). On the pre-activation ResNet-18 (He et al., 2016b). In all experiments, we use stochastic weight averaging (Izmailov et al., 2018) with decay rate of 0.995 in prior work (Gowal et al., 2020; Chen et al., 2020). All models are trained using stochastic gradient descent with momentum 0.9 and weight decay 0.0005. We a cosine learning rate schedule (Loshchilov & Hutter, 2016) without restarts where the initial learning rate is set to 0.1 for baselines. To alleviate robust overfitting (Rice et al., 2020), we compute the robust and clean accuracy at every epoch on validation of size 1024 using projected gradient descent (PGD) attacks with 20 steps using margin loss function. All experiments are run on NVIDIA GeForce RTX 2080 Ti GPU.
dataset, we use
Normalization layers We consider two types of normalization layer in WRN-28- 10 and ResNet- 18, which are Batch Normalization (BN, used in their original architecture design) and Group Normalization (GN). When using GN, the decision boundaries are the same during training and evaluation, which is consistent with our theoretical analysis on the decision boundary dynamics. In the following sections, we will show the robustness performance on both cases: WRN-28-10 10 and ResNet--1 18 with BN and GN. We find that when applying DyART on original WRN-28-10 10 and ResNet-18 with BN, gradient clipping needs to be applied in order to learn the BN parameters stably. We apply gradient clipping with norm threshold 0. for experiments for CIFAR-I0 on WRN-28-10 10 with BN and apply gradient clipping with norm threshold 1 for Tiny-ImageNet
ResNet-18 with BN. For experiments on architectures with GN, we do not apply gradient clipping. Note that for all experiments of computing speed and margins for interpretation (Section 4 and Section 6.2), we use the ResNet-Ie 18 with GN.
Additional training settings For experiments with Group Normalization, models are run for 100 epochs on both datasets. For DyART on Tiny- ImageNe,,,,,, use the cosine learning rate schedule with initial learning rate 0.05 and on CIFAR-1O, the learning rate begins at 0. and is decayed by a factor of 10 the 50th and 75th epoch. For experiments with Batch Normalization, models run for 200 epochs on CIFAR 10 and 100 epochs on Tiny-ImageNee For DyART on both datasets, we use cosine learning rate schedule (Loshchilov & Hutter, 2016) without restarts where the initial learning rate is set to 0.1, which is the same as the baselines.
Compared baselines and their hyperparameters. In all experiments consider the foo pertur- bation setting. On CIFAR-10, 10, the baseline defense methods include: (1) standard adversarial training (AT) (Madry et al., 2017) which trains on the worst case adversarial examples generated by 10-step PGD (PGD-10) on the cross-entropy loss. The perturbation bound is & and the step size of PGD is 255
255 the training setting follows Rice et al.' (Rice et al., 2020). (2) TRADES "(Zhang et al., 2019) which trades off between the clean and robust accuracy. The perturbation bound is 8
2
255 with the
step size of PGD-10 0.007. The regularization constant beta (or 1/lambda) is set to 6. (3) MMA (Ding et al., 2020) which trains on the closest adversarial examples (closest boundary points) with uniform weights. The MaxEps is set to 255 (4) GAIRAT (Zhang et al., 2021) which reweights adversarial examples using the least perturbation steps. The perturbation bound 255 with step
'Robust Overfitting's Github
"TRADES's Github
"MMA's Github
"GAIRAT's Github
21

---

Published as a conference paper at ICLR 2023
size 0.007 using PGD-10 and the 'tanh' weight assignment function is used. (5) MAIL $ "Liu et al., 2021) which reweights adversarial examples using margin value. We choose its combination with which provides better robustness performance than combining with AT (MA Its hyperparamters beta, bias and slope are set to 5.0, - 1.5 and 1.0, respectively.
TRADES (MAIL-TRADEE
(6) AWP (Wu et al., 2020) which adversarially perturbs both inputs and model parameters. (7) FAT (Zhang et al., 2020b) that exploits friendly adversarial data, where the perturbation bound & (8) MART (Wang et al., 2019) which explicitly differentiates the mis-classified and correctly classified examples. On Imag-em, we compare with AT, TRADES, and MART whose hyperparameter settings are available for this dataset. We follow the PyTorch implementation of (Gowal et al., 2020; Rebuffi et al., 2021)* for AT, TRADES and MART for both datasets.
set 255"
Evaluation details. We evaluate DyART and the baselines under fox norm constrained perturbations. The final robust accuracy is reported on AutoAttack (AA) (Croce & Hein, 2020b), which uses an ensemble of selected strong attacks. For all methods, we choose the hyperparameters to achieve the best robust accuracy under the commonly used perturbation bound
255 To fully compare the robustness performance among different methods, we report the robust accuracy under four additional 12 and 16
perturbation bounds: 2
255
Per-sample gradient For computing the speed of the decision boundary in Section 4.2 and Sec- tion 6.2, we need to compute the per-sample gradient VoΦ" (á,,0) for every correctly classified point TG. We use the Opacus package (Yousefpour et al., 2021) for computing per-sample gradients in parallel. Also, another reason why we replace BN with GN is because Opacus does not support BN for computing per-sample gradients. Although using this package will increase the memory usage, it worth mentioning that during robust training, DyART does not need to compute the per-sample gradient and thus does not have the excessive memory issue. Per-sample gradients are only collected for computing speed, which is for interpretation of dynamics of different methods and not for robust training.
D.2 HYPERPARAMETER SENSITIVITY EXPERIMENTS
In this section, we present the robustness performance of DyART under different hyperparameter settings. We first show the results for architectures using Group Normalization (note that in Section 6.1 we use the original architectures using Batch Normalization) and analyze the effect of different hyperparameters. We then demonstrate more ablation experiments for architectures using Batch Normalization used in Section 6.1.
Defense
Clean
265
255
205
AT
85.36 + 0.17
77.16 0.29
67.84 = 0.24
46.27 0.199
26.62 + 0.18
12.40
0.12
TRADES
84.67 + 0.24
0.11
69.38 + 0.15
49.29
0.15
+.117
16.42 + 0.18
MART
81.02 0.17
0.20
64.94
0.22
48.06
0.220
30.61
1.04
MMA
0.44
62.21 = 0.39
38.61 0.44
0.229
9.92
GAIRAT
+.27
73.87
+
0.15
37.77
18.87 +0.15
8.1
TRADES
84.48
77.18 0.26
68.20 + 0.31
0.12
+
15.62
0.16
TRADESDEES
86.58 0.25
78.96 1 0.17
69.54 1 0.12
48.07
1..19
27.66 0.12
13:22
0.23
DyART
85.64 0.10
78.20 0.16
0.19
50.03 + 0.16
30.87 0.20
16.55 0.12
Table 3: Clean and robust accuracy on CIFAR-10 under AA with different perturbation sizes WRN-28-10 16
with Group Normalization. The hyperparameters for DyART a = =,
X 100.
255
Overall performance of DyART on architectures with GN In Table 3 and Table 4, the overall comparison between DyART and baselines are demonstrated. Overall on both datasets, under four out of five perturbation bounds, DyART achieves the best robustness performance. This indicates the superiority of DyART in increasing margins.
(1) Specifically, on CIFAR-I0, DyART achieves the highest clean accuracy well as robust accuracy under all perturbation bounds among all basclines except FAT-TRADES. (Ia) Since FAT-TRADES prevents the model from learning on
"MAIL's github
AWP'' github
7 FATT's ' github
Ainnovering-TTTiiisss Github
22

---

Published as a conference paper at ICLR 2023
Defense
Clean
12
1G
205
255
AT
43.76 + 0.53
35.54 + 0.36
28.20 + 0.21
16.92 + 0.24
9.34
10440.10 0.18
4.75 - 0.14
TRADES
16.56 + 0.29
37.23 + 0.17
28.68 + 0.19
16,20 0.21
8.38 1338:00 0.10
4.23 0.06
MART
38.74 + 0.42
32.18 + 0.74
26.08 + 0.31
16.90
+ 0.26
10.14 0.22
6.10 # 0.19
DyART
47.67 + 0.15
38.19
0.18
29.59 0.14
17.79 + +.188
10.24 0.13
5.41 0.11
Table 4: Clean and robust accuracy on Imageeee under AA with different perturbation sizes on ResNet- with Group Normalization. The hyperparameters for DyART a 3.70
20
À 500.
255
highly adversarial data in order to keep clean accuracy high, it achieves the best clean accuracy and robustness under very small perturbation bound 2. However, its performance on larger perturbation bounds is inadequate. (1b) Thanks to directly operating on margins in the input space and encourage robustness improvement on points with smaller margins, DyART performs better than GAIRAT and MAIL-TRADES which use indirect approximations of the margins. (2) On Tiny- ImageNet, DyART achieves the best clean accuracy and the best robust accuracy under all perturbation 16 bounds except the largest 255 Although MART is the most robust under 255 it has much lower
16
clean accuracy (8.93% lower than DyART) and worse robustness under smaller perturbation bounds.
Hyperparameters of DyART In this paper, we the cost function of the form h(R) 1 (x) when R < ro and h(R) = 0 otherwise. We present results under different decay strengh a > 0, margin threshold ro as well as regularization constant À for the robustness loss.
Performance results. The evaluation results on CIFAR-IO and Tiny-ImageNet with Group Nor- malization are shown Table 5 and Table 6, respectively. We analyze the effects of hyperparameters as follows.
(1) Effect of a: Larger a corresponds a cost function h(-)) that decays faster, and therefore prioritize improvement on even smaller margins. Therefore, it should be expected that larger a leads to higher clean accuracy and higher robust accuracy under smaller perturbation sizes, and results in lower robust accuracy under larger perturbation sizes. For example, on CIFAR-10, when a 5 is increased to a = 8 when rp = 255
16 A = 400, the clean accuracy as well as the robust accuracy
8 improves, while the robust accuracy under larger gets lower. The same patterns can also be observed on Imag-ema,,Net, for example, when 8 is increased to a 10
under e = 255 : 255 and 253
when ro- 255
20 A = 1000.
(2) Effect of ro: To is from preventing DyART from training boundary points that are too far away from clean data points. Therefore, it should be expected that training on smaller To tends to increase the clean accuracy and the robust accuracy under relatively small perturbation sizes. Indeed, on Tiny-ImageNet, when ru = observe that the clean accuracy as well as robust accuracy under 2 accuracy under larger perturbation sizes
24 is decreased to ro 255
20 when = 10 and A = 1000, we can
255
255 increases but the robust
12 and 16 decreases. 255
255
(3): Effect of robust loss constant A: A larger tends to increase the robustness of the model (in particular, the robust accuracy under relatively larger perturbation sizes) while decrease the clean accuracy and the robust accuracy under relatively small perturbation sizes. For example, on Tiny- ImageNet, when À 800 is increased to x 1000 when a 10 and ro- 255 the clean accuracy and robust accuracy under relatively small e 255 255 perturbation sizes increase.
drops but the robust accuracy under larger
(4) Effect of the burn-in period: burn-in period of natural training is necessary for DyART since its robust loss function depends on the closest boundary points, which can only be found on correctly classified points. That is, DyART requires descent initial clean accuracy. In our experiments, we find that the learning rate of the burn-in period is important: DyART will train successfully if the learning rate of the burn-in period is relatively large (e.g. 0.1 for CIFAR-10 10 and Tiny- Imageeeae However, when the learning rate is small (such 0.001), DyART sometimes drives the clean accuracy to be very low at first, and fails to train. Our suggestion is to use a larger learning rate to obtain a naturally pretrained model.
23

---

Published as a conference paper at ICLR 2023
Defense
Clean
205
200
250
255
205
AT
85.36 0.17
77.16 + 0.29
0.24
46.27
0.19
0.18
0.12
TRADES
84.67 0.24
77.72
0.18
69.38 0.15
49.29
0.15
30.25 0.17
16.42 0.18
MART
81.02 4 0.17
73.04
0.21
64.94 0.22
48.06 a 0.20
30.61 0.13
16.42 0.09
MMA
85.52 + 0.36
74.78 0.42
62.21 0.39
38.61 0.47
22.13 0.29
9.95 + 0.20
GAIRAT
83.72 1: 0.27
73.87
0.33
61.7 1: 0.15
37.77 0.21
18.87 0.15
8.1 =: 0.11
MAIL-TRADES
84.48 + 0.22
77.18 + 0:26
68.20 0.31
48 : 0.12
29.87 0.11
15.62 : 0.16
FAT-TRADES
86.58
0.25
78.96 0.17
69.54 0.12
48.07 0.19
27.68 0.12
13:22 0.23
10,
À 100
84.17 + 0.12
76.85 + 0.15
68.47 1: 0.15
49.11 0.20
32.07 0.17
18.72 = 0.10
a 5,70
20
300
83.33
0.19
75.96 0.24
67.82 0:22
49.55 0.24
32.29 1: 0.14
19.16 1: 0.15
8,
16
400
85.64
78.20 0.16
69.59 +: 0.19
50.03 + 0.16
30.87 0.20
16.55 + 0.12
5, 70
0.09
0, 0g
76.77
0.20
0.15
0.18
Table 5: Clean robust accuracy on CIFAR-I0 under with different perturbation bounds on WRN-28-10 with Group Normalization. The results on different sets of hyperparameters for DyART starts from the eighth row.
Defense
Clean
955
258
953
955
955
AT TRADES
43.76 0.53
35.54 0.36
0.21
16.92 + 0.24
9.34
4.75 0.14
46.56 0.29
37.23 0.17
28.68 0.19
16.20
0.21
8.38 - 0.10
1.23 0.06
MART
38.74 0.
32.18 0.71
26.08
0.31
16.90 0.26
10.14 0.22
6.10 + 0.19
10,
À 500
48.98 1: 0.24
38.38 1 0.32
29.76 1: 0.22
17.30 1: 0.19
9.87 0.11
5.19 0.15
253
10,
À 1000
45.27 0.19
36.58
0.52
29.03
0.32
17.35 + 0.24
10.03 + 0.18
5.61 0.16
253
10,
255
A 1000
46.37
0.26
33..4 0.32
29.01 0.19
17.61 + 0.20
9.91 + 0.18
5.27 0.14
10,
25
À 800
47.09 0.22
38.01 1 0.12
29.55 : 0.17
17.22 0.15
9.59 0.20
5.08 0.11 0.11
8, rg
1000
45.69 0.17
36.74 4: 0.20
28.57 + 0.12
17.31 + 0.21
10.13 0.15
5.19 0.16
5,
20
45.61 0.144
36.87 0.16
29.01 0.19
17.58 + 0.10
10.38 0.16
5.33
3, Fo
47.67 0.15
38.19 0.18
29.59 0.14
17.79 0.18
10.21 0.13
5.41
1000
0.20
0.16
0.16
9.80
4.92 0.13
Table 6: Clean robust accuracy on
under AA with different perturhation bounds on ResNet- 18 with Group Normalization. The results on different sets of hyperparameters for DyART starts from the fourth row.
24

---

Published as a conference paper at ICLR 2023
More ablation architectures with BN In Table and Table 8, demonstrate results for more hyperparamter settings for experiments with Batch Normalization Section 6.1. The role of each hyperparameter is similar to the GN case.
Defense
Clean
4
8
12
16
200
205
255
205
205
AT
85.63 + 0.25
79.08 + 0.12
71.21 = 0,28
53.20 # 0.16
32.91
0.32
16.12 0.23
TRADES
82.92 + 0.30
77.69 + 0.16
70.68
0.15
54.28
0.19
36.65
0.24
21.59 0.31
MART
83.37 0.25
76.58 0.24
70.19 0.18
52.91 0.24
35.16 0.13
18.80 0.14
0.38
0.52
0.29
0.33
0.21
GAIRAT
86.59
76.72
0.28
64.64 0.25
38.16 0.32
0.18
7.55
AWP
84.27 0.19
78.33 0.21
70.82 0.26
53.92 0.17
35.24 0.26
20.40 0.14
1000
85.10 0.21
78.08
0.18
71.67
0.28
54.78
0.21
36.26
0.24
0.16
1000
85.53 0.21
79.21
0.14
71.73
0.18
54.69 0.14
35.74 0.25
0.18
3,
253
1500
85.34 + 0.19
78.97 0.21
71.82
0.27
54.39 0.17
35.94 0.13
20.83 0.19
8,
253
1000
86.36 = 0.32
79.81 0.25
72.29 + 0.29
53.93 0.14
35.06 0.22
20.08 0.11
8, 253
2000
86.10 11:00:0000 0.15
79.33 1: 0.22
72.04 0.32
54.38 0.19
$5.36 0.27
20.68 1: 0.14
8,
233 À 3000
86.03 - 0.27
79.64 1: 0.25
72.24 0.28
54.24 1: 0.17
35.63 0.21
20.52 1 0.18
O, T
500
83.64 + 0:24
77.28 0.31
70.11 0:21
54.21 0.26
37.75 0.21
23.85 0.20
0, Fu
20
1000
02.23
76.20 0.24
69.48 = 0.26
54.82 + 0.25
38.17 + 0.21
21.80 0.20
3, Po
20
400
0.08
0.14
70.65 0.18
54.24 0.15
37.28 0.15
22.95 0.18
3, 7,
20
83.56
77.41 0.24
0.28
0.23
0.18
0.17
1000
0.12
77.79 0.31
0.28
51.39 : 0.27
37.59 0.19
0.23
5,
233
500
81.52
0.31
75.58 0.21
68.03
0.24
53.50 0.17
38.41 0.17
26.30 + 0.14
Table 7: Clean and robust accuracy CIFAR-10 under AA with different perturbation hounds WRN-28-10 (with original Batch Normalization layer). results on different sets of hyperparameterss DyART starts from the seventh row.
Defense
Clean
16
AT
09
0.38
38.83 +
0.27
16.46 0.19
7.74 0.20
3.05 0.17
TRADES
0.30
(37.84
29.85 0.19
0.17
MART
36.68
17.79 0.15
5.31
10.70
02
500
08.98-2
0.33
38.38 + 0.26
29.76 = 0.21
17.30 0.23
9.87 + 0.18
5.19 0.12
To
1000
46.49
0.25
37.60 +: 0.24
29.17 = 0.16
0.19
9.02 + 0.15
4.59 0.14
0,
20
33.53
30.20
0.27
0.10
4.87 0.07
0,
43.9
36.23
28.89
0.19
0.19
5.53 0.11
0,
2000
0.28
34.79
27.66 0.21
16.55 0.34
9.43 0.19
5.01 0.16
0,
20 À 500
48.27 0.25
33.75 + 0.20
30.02 0.16
18.00 0.18
10.15 0.18
5.56 0.08
5,
25
À 500
50.86 +: 0.28
39.81 0.18
30.63 0.19
17.20 0.25
9.36 -: 0.11
4.99 0.13
5
255 A 1000
41.59 + 0.32
36.3 + 0.30
28.6 6: 0.27
17.28 0.16
10.16 0.17
5.76 0.06
0, 0,
A 500
46.19 0.22
37. 67.61 + 0.30
29.19 0.21
18.05 + 0.15
10.66 + 0.13
6.27 = 0.09
230
3,50
À 500
48.56 0.20
39.32 + 0.23
30.22 = 0.19
17.03 0.15
10.22 0.15
5.84 0.13
250
5, 1,
À 500
49.71 0.18
39.30 + 0.14
30.69 0.21
18.02 - 0.18
10.08 1 0.09
5.65 0.12
a
5,
À S00
45.90 0.34
37.65 0.25
29.53 0.27
17.96
0.20
10.55 0.15
6.07 0.14
Table 8: Clean and robust accuracy Tiny-ImageNet under AA with different perturbation bounds on ResNet- 18 (with its original Batch Normalization layer). The results different sets of hyperparameters for DyART starts from the fourth row.
25

---

Published as a conference paper at ICLR 2023
D.3 EXPERIMENTAL RESULTS WITH ADDITIONAL DATA
Recent work shows that generative models which are trained solely on the original training data can be used to drastically improve the adversarial robustness performance (Rebuffi et al., 2021; Gowal et al, 2021). In this section, we demonstrate the results of DyART on CIFAR-10 10 using 1M additional data from DDPM (Ho et al., 2020). The experimental setting follows previous works (Rebuffi et al., 2021; Gowal et al., 2020) and their PyTorch implementation" ", which is consistent with Section D.1 except that now we run 600 epochs with batch size 512 using the additional data. The initial learning rate is still set to 0.1. Note that in the original implementation in previous works (Rebuffi et al., 2021; Gowal et al., 2020), 800 epochs are run with batch size 1024, with initial learning rate 0.4, which could improve the performance compared with 600 epochs and 512 batch size that use for DyART. All experiments in this section use the original batch normalization layer in WRN.
Hyperparameters DyART with additional data We use WRN-28-10 10 and we choose a = 3, ro = 18 À = 800, 3 5 and apply gradient clipping with threshold 0.1. We use 10 epochs of natural 255 training as the burn-in period.
Performance of DyART with additional data The experimental results are shown in Table 9. We have the following two observations: (1) Compared with the results in Table 7, it is clear that the additional data can drastically improve the robust accuracy of DyART (about 6% boost in robust accuracy under é DyART achieves higher clean accuracy and comparable robust accuracy under (2021) does not report robust accuracy under other perturbation bounds.).
255 (2) Compared with the state-of-the-art results in Rebuffi et al. (202 1), (Rebuffi et al.
&
Defense
Architecture
Clean
8
12
16
235
255
255
Rebuffi et al. (2021)
WRN-28-10 10
85.97
NA
NA
60.73
NA
NA
Rebulfi et al. (2021)
WRN-70-16
86.94
NA
NA
63.58
NA
NA
DyART
WRN-28-10
87.46
82.30
75.68
60.35
42.38
26.42
Table 9: Clean and robust accuracy on CIFAR- 10 under 3o AutoAttack with different perturbation sizes when IM additional generated data from DDPM is used for training.
D.4 FURTHER ANALYSIS ON DECISION BOUNDARY DYNAMICS
In Section 4.2 and Section 6.2 we have presented the dynamics of both AT and DyART on the same pretrained models using the same batch of data at one iteration. In this section, we demonstrate the dynamics of the decision boundary throughout the whole training process.
Experiment setting. To study the decision boundary dynamics throughout the training process, we train a ResNet-18 (He et al., 2016a) with group normalization (GN) (Wu & He, 2018) CIFAR-10 using (1) Adversarial Training with 10-step PGD under fox perturbation with e = 255 from scratch;
(2) DyART with a 8, A = 400, ro = trained with a initial learning rate of 0.01 and the learning rate decays to 0.001 at 20000 iteration. At each iteration, we compute the proportion of negative speed among points with margins smaller than 8 that are regarded vulnerable.
16 from a naturally pretrained model. The models are
255
255
Conflicting dynamics throughout training In Figure 6, the clean and robust accuracy of both methods are shown, along with the proportion of negative speed among vulnerable points. We apply curve smoothing for negative speed proportion plot for better visualization. Note that we omit the initial part of training (first 10 epochs) since at this initial stage, there are not enough correctly classified data points but speed and margin are only defined for these points. We can see that both methods exhibit some degree of robust overfitting, where the training robust accuracy becomes larger than the test robust accuracy. In addition, the conflicting dynamics exists throughout the whole training process, since the proportion of negative speed is never zero. We can see that DyART consistently has less conflicting dynamics than AT. Interestingly, the proportion of negative speed decreases over time during training for both methods. The connection between the decreasing degree
" UncoveringgATI .imits's Github
26

---

Published as a conference paper at ICLR 2023
of conflicting dynamics the training data and the robust overfitting phenomenon is left for future research.
0.4
propentie
0.4
0.2
0.5
0.5
3.5
Sicratiors
Hecracoon
(8) Accuracy
(b) Accuracy DyART
(c) Negative speed progrottin
Figure accuracy of AT and DyART as well as proportion negative speed among points whose
margins are smaller than 255
D.5 RUN TIME ANALYSIS
In this section provide the run time analysis. The main computational bottleneck for DyART is finding the closest boundary points, which is an iterative algorithm adapted from FAB. Each iteration costs one back propaaaptoa,nn which is the same Projected Gradient Descent (PGD). Once we find these closest boundary point candidates, we check if the KKT condition is approximately satisfied and filter out points that do not meet the KKT condition. The computational cost of this step takes one pack-propagation.
We use the torch. Event functionality in PyTorch to measure the execution time for one iteration of each method. In the case of DyART, this means measuring the total time of finding the closest boundary points and back propagation using the full loss function. We use ResNet-18 with GroupNorm a batch size of 128 on the CIFAR 10 dataset. We use one NVDIA RTX A4000. The results are as follows:
Natural training: 46 0.9 ms
AT (PGD-10 on Cross-Entropy loss): 531 5.2 ms
TRADES (PGD-10 KL divergence loss): 573 2.8 ms
DyART (10 steps for finding the closest boundary point): 743 + 10.3 ms
. DyART (20 steps for finding the closest boundary point): 1171 + 17.8 ms
Developing faster algorithms for finding the closest boundary points is left for future research.
27


Reviews:
[{"review_id": "uQ3GI7_ic5", "reviewer": "Reviewer_wA1W", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper first proposes a continuous-time framework for quantifying the speed of decision boundary changes and empirically shows conflicting dynamics in adversarial training: the decision boundary moves closer to some examples even if the model just learns these examples. This paper proposes a novel adversarial training method, DyART, aiming to increase margins to alleviate the conflicting dynamics. By evaluating DyART on CIFAR10 and Tiny-Imagenet datasets, this paper shows that the proposed method performs better.", "summary_of_the_review": "I thoroughly enjoy reading this paper, but I think that there needs more clarification. One concern is comparisons to some recent related works on adversarial training are missing.", "strength_and_weaknesses": "Strength:\n\n+ This paper shows that there are conflicting dynamics in adversarial training. It is interesting to know that the decision boundary of some examples becomes even worse after training.\n+ This paper proposes a novel adversarial training method, DyART, which has a novel loss to alleviate the conflicting dynamics.\n+ By evaluating on CIFAR10 and Tiny ImageNet, the proposed method outperforms other methods.\n+ The paper is well-written and easy to follow.\n\nWeakness & Questions:\n\n- In Section 4.1, this paper studies how boundary changes by evaluating CIFAR10 models. The decision boundary speed is evaluated by training an additional iteration on pretrained models. For this experiment, I am not quite clear about some settings: \n\n1. Why do you use a pretrained model to calculate the dynamics? Why don’t train a model from scratch and observe the dynamics?\n2. The dynamics are only calculated for one batch and one iteration, which makes it more like a case study or qualitative analysis. Why don’t you collect the dynamic across the whole training process and analyze the speed at different epochs? Maybe this conflict only happens at the beginning of the training and will be stable later.\n3. I don’t get the reason behind replacing BN with GN, which may indicate that the proposed method to evaluate the decision boundary speed is not general enough.\n \n- In Section 6.1, I notice that a validation set is used to mitigate the robust overfitting. How often do you calculate the validation accuracy, and do you apply the same thing on other baseline methods to mitigate robust overfitting? \n\n- Although the proposed method outperforms selected baseline methods, there are other state-of-the-art (SOTA) methods reported to have better performance than selected baseline methods in https://robustbench.github.io/. What is the advantage of the proposed method compared to other more recent SOTA adversarial training methods?", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "pbYAGonIn6X", "reviewer": "Reviewer_o95F", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper aims to improve the adversarial robustness of deep models.      \nI. The authors observe that during traditional adversarial training, margins to the decision boundary for some examples are enlarged while margins to the decision boundary for other examples even become smaller.     \nII. Based on this phenomenon, the paper proposes dynamic-aware robust training,  giving high priority to examples suffering from smaller margins.   \nIII. Experiments on CIFAR-10 and Tiny-ImageNet show some improvements over baselines.   ", "summary_of_the_review": "This paper aims to improve model adversarial robustness with a dynamic-aware robust training strategy. However, the inconsistent experimental setting and lack of comparisons with state-of-the-art methods make it unconvinced.   ", "strength_and_weaknesses": "Strength:     \n(1) The paper give sound theoretical analysis.\n(2) The insight of giving high priority to examples with smaller margins is interesting.    \n\nWeakness:      \n(1) This paper identified the phenomenon that during adversarial training, the decision boundary moves away from some vulnerable points but simultaneously moves closer to others, decreasing their margins. However, it is well-known that adversarial training suffers from the overfitting issue, i.e., adversarial examples in training can be well classified in the late training stage. So, does the identified phenomenon only exists in the early adversarial training stage?   \n(2) Experimental setting is not consistent with previous work, e.g., TRADES uses wideresnet34-10 and achieves 53.08% while wideresnet28-10 is adopted and only reports 49.3% in this paper.     \n(3) Comparisons with state-of-the-art methods are missed, like AWP[1], and LBGAT[2].       \n(4)  Experiments on CIFAR-100 should be included to verify consistent improvements of the proposed method.       \n\n[1] Adversarial Weight Perturbation Helps Robust Generalization. NeurIPS 2020.     \n[2] Learnable Boundary Guided Adversarial Training. ICCV 2021.\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "Not applicable"}, "extra_text": {}}, {"review_id": "oWJM1Xfe9C", "reviewer": "Reviewer_1WcD", "summary": "", "questions": "", "limitations": "", "rating": 10, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes DyART: a new regularization method that encourages that the decision boundaries of a neural network move away from the data points with the smallest marginss during training. This regularizer is motivated by the observation that during adversarial training, the distance to the decision boundary does not grow uniformly for all data points, and instead decreases for a large portion of the training set. To alleviate this issue, the authors derive a closed-form expression for the margin velocity around a given data point that can be tractably regularized during training. In two datasets (CIFAR10 and TinyImageNet), DyART outperdorms can achieve stronger robustnesss than SOTA methods based on adversarial training, despite being based on a conceptually very different approach.", "summary_of_the_review": "Overall, I believe this paper clearly deserves to be accepted to ICLR. It brings forward a novel idea based on interesting insights and provides useful mathematical derivations for the community. The empirical results also seem to indicate that DyART could be a strong contender for the SOTA in adversarial robustness.\n\nIf the ablation studies mention in the **weaknesses** section of my review were included in the paper, I would be open to increase my score even further.", "strength_and_weaknesses": "# Strengths\n1. **A fresh and effective idea**: There are thousands of papers on adversarial robustness, all of them trying to improve the robustness of neural networks in different ways. However, among the empirical defenses, only adversarial training and its variants have managed to stand the test of time. This paper tries to tackle the same problem, using a very different approach (regularizing the exact distance to the boundary), which seems to be very effective. \n2. **Brilliant derivations**: The derived mathematical expressions on the movement of the decision boundary are absolutely brilliant and very noteworthy. Above all, the main value of this paper does not lie on their idea to obtain robustness, but the fact that the authors could manage to execute it by cleverly and elegantly deriving tractable expressions to track the movement of the decision boundary. The main theorems of the paper do not require advanced math to be proved, and are very intuitive. This is a very strong point.\n3. **Very competitive robustness numbers and a correct evaluation**: The reported results are competitive with other methods and the authors seem to have followed the right protocols to evaluate the robustness of their models.\n4. **Clean writing**: The paper is very well-written and it is easy to read. The storyline flows nicely, and the theoretical bits, including the proofs, are easy to follow.\n\n# Weaknesses\n\n1. **Lack of ablations on new method**: I find the paper would be stronger if, besides reporting best performances on two datasets, it also described how different hyperparameters affect the performance and dynamics of their proposed method. How do $\\alpha, \\lambda, r_{0}$ affect performance? And the burn-in period? Knowing the effect of these parameters and the sensitivity of the method to their exact values is fundamental for its wide adoption. It would also be nice to provide runtime numbers of DyART and compare them to the competing methods.\n2. **(Minor) Missing relevant citations**: In general, I find the paper is missing citations to a few relevant works that also have studied the dynamics of the margins of adversarial training or been inspired by them to improve the performance of robust models:\n   - R. Rade, S. Moosavi-Dezfooli. Reducing excessive to achieve a better accuracy vs. robustness tradeoff. ICLR 2022   \n   - G. Ortiz-Jimenez, A. Modas, S. Moosavi-Dezfooli, P. Frossard. Hold me tight! Influence of discriminative features on deep network boundaries. NeurIPS 2020.\n   - F. Tramèr, J. B., Nicholas Carlini, N. Papernot, J. Jacobsen. Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations. ICML 2020\n\n3. **(Minor) Figure 3 and Figure 5 could be improved**. Although informative, I find the design of this two plots a bit suboptimal. In Fig. 3, instead of showing just a snapshot of the margin-speed distributions, it would be more interesting, in my opinion to show how this distribution evolves with training. One option to do that is to show the statistic described in the caption through time (i.e., what is the proportion of points with negative speed below a given margin at step t). The problem with Fig. 5, on the other hand, is that the graph is a bit confusing. What is the meaning of the bar heights, and why is it the same for AT and DyART?\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "k84j23d8Cx", "reviewer": "Reviewer_xLGt", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper provides another viewpoint of investigating the robustness of DNNs. The motivation is that when a model is training, the decision boundary w.r.t. the model is dynamically changing over epoch time, so that the distance of training data points and the decision boundary varies. When the distance gets closer, that data point becomes vulnerable. Due to this motivation, the paper defines some functions such as “curve of the closest boundary point” and “speed of the decision boundary”, that are helpful to visualize the phenomenon of the dynamics of decision boundaries, and to alert which data point may not be safe. Moreover, this paper proposes a robust training algorithm, called Dynamics-Aware Robust Training (DyART), to encourage the decision boundary leaving away from vulnerable training data points. By combining the close-form for the gradient of smooth cost function of the margin, and the soft decision boundary, into the loss function, DyART can be trained efficiently, and can take both clean and robust accuracies into account.", "summary_of_the_review": "Overall, I think that this is a good paper. It starts from the nature of dynamics of decision boundary, pointing out some shortcomings of existing robust model. Then, it proposes a training algorithm, called DyART, to mitigate such issue. With some experimental results, DyART is verified to be an effective robust model.", "strength_and_weaknesses": "Strength:\n1. The motivation is interesting and heuristic, pointing out the remaining shortcomings of adversarial training.\n2. The idea is simple and clear, for mitigating the concerning robustness issue.\n3. The presented experimental result outperforms previous works (2021 or ealier) in similar area.\n\nWeaknesses:\n1. Almost every individual idea is too intuitive, so that none of them is groundbreaking or novel.\n2. A few experimental results shown. Maybe try some large-scale multiclass dataset like ImageNet.\n3. Some sentential expression is not very clear: at the end of 2nd/3rd paragraph of Section 2, the conclusions are likely the same.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "Not applicable"}, "extra_text": {}}, {"review_id": "gXh2xhJWat8", "reviewer": "Reviewer_rwTE", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This work presents a new robust training approach by pushing the nearby soft boundaries away for points that are closer to the boundaries. The motivation of the paper is an observation that some points are not pushed away from the boundary in the existing PGD training; therefore, it is straightforward to design an algorithm that is aware of the decision boundary. The authors test their method on CIFAR-10 and Tiny-ImageNet to show the effectiveness of the work.\n", "summary_of_the_review": "\n\nIn summary, I am currently on the fence. I like the theoretical part of the paper but the empirical part is not that convincing to me. I will vote for a weak accept for now but may be happy to raise if my concerns are resolved. \n\n", "strength_and_weaknesses": "### Strength\n\n**Presentation.** The presentation of the paper is very clear and easy to follow. Thank you for the writing. \n\n**Motivation.** This paper is well-motivated. The problem of pushing decision boundaries away from points that are hard to produce robust predictions has existed for a long time. The proposed solution is very intuitive and the key message is easy to grasp (thanks to the clear writing). \n\n**Theoretical Contributions.** Theorems characterizing the boundary speed and soft boundaries are important contributions. These are very interesting results and measurements, potentially can be used by future researchers for similar topics. \n\n### Weakness\nMy biggest concern of this work is the empirical evaluation of the paper. I also have some minor concerns regarding the novelty of the work (I will elaborate this in the next review box). \n\nFirstly, my biggest concern on the empirical results is simply that the baseline robust accuracy on CIFAR-10 (i.e. AT) is too low for a new method proposed in 2022. Although the improvement of the robust accuracy compared against the baseline numbers still show the new method is effective, they are still outside the ballpark of the state-of-the-art numbers. For example, on the benchmark page (https://robustbench.github.io/), the top-15 entries on CIFAR-10(linf, 8/255) have robust accuracy higher than 60% while all methods reported in this paper are below 50%. Even though I don’t think a paper has to outperform the state-of-the-art results to get accepted (and personally I am very enjoying reading and studying the solution proposed in this paper), empirical results at least within the ballpark will make the experiments stronger. I think the same problem happens to the Tiny-ImageNet results. \n\nSecondly, there are a few hyper-parameters in the proposed method. It would be nice to have some sensitivity experiments to tell how the results are affected by these parameters and what are the recommended numbers for any follow-up work to use. \n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Accept: poster