Reducing Excessive Margin to Achieve a Better Accuracy vs. Robustness Trade-off
Authors: Rahul Rade
Seyed-Mohsen Moosavi-Dezfooli
Venue: ICLR 2022 Poster (2022)
Keywords: adversarial training
robustness

Abstract: While adversarial training has become the de facto approach for training robust classifiers, it leads to a drop in accuracy. This has led to prior works postulating that accuracy is inherently at odds with robustness. Yet, the phenomenon remains inexplicable. In this paper, we closely examine the changes induced in the decision boundary of a deep network during adversarial training. We find that adversarial training leads to unwarranted increase in the margin along certain adversarial directions, thereby hurting accuracy. Motivated by this observation, we present a novel algorithm, called Helper-based Adversarial Training (HAT), to reduce this effect by incorporating additional wrongly labelled examples during training. Our proposed method provides a notable improvement in accuracy without compromising robustness. It achieves a better trade-off between accuracy and robustness in comparison to existing defenses. Code is available at https://github.com/imrahulr/hat.

Published as a conference paper at ICLR 2022
REDUCING EXCESSIVE MARGIN TO ACHIEVE A BETTER ACCURACY VS. ROBUSTNESS TRADE-OFF
Rahul Rade
Seyed-Mohsen Moosavi-Dezfoolii Imperial College London, UK seyed. www.svi @eteaavvi@iiirriiam ac..c.uk
ETH Zürich, Switzerland rade@ethz.cch
ABSTRACT
While adversarial training has become the de facto approach for training robust classifiers, it leads drop in accuracy. This has led to prior works postulat- ing that accuracy is inherently at odds with robustness. Yet, the phenomenon remains inexplicable. In this paper, we closely examine the changes induced the decision boundary of deep network during adversarial training. We find that adversarial training leads to unwarranted increase in the margin along cer- tain adversarial directions, thereby hurting accuracy. Motivated by this obser- vation, we present a novel algorithm, called Helper-based Adversarial Training (HAT), reduce this effect by incorporating additional wrongly labelled exam- ples during training. Our proposed method provides a notable improvement in accuracy without compromising robustness. achieves better trade-off between accuracy and robustness in comparison to existing defenses. Code is available at bttps://githun wwwom//mmaauur//aa.ea
INTRODUCTION
Despite the remarkable success of modern deep networks on computer vision tasks, they notoriously fragile to small, imperceptible
2id8/eesNet.8834-10
PreAct Re
(2021)
+HAT
changes in the input (Szegedy et al.] 2014). Ever since the introduction of 2--norm based adversaries (Goodfellow et al. 2015) Moosavi-
Robust Accuracy
62
+HAT ->
60
Dezfooli et al. 2016). a growing body of researchers has focused on developing solu- tions for improving the robustness of DNNs. At present, adversarial training (Madry et al.
58
+HAT
56
(2018)
2018) remains the most effective approach for robustification. Nevertheless, it is known to cause an undesirable reduction in accuracy, thus leading to the much-dehated trade-off between accuracy and robustness (Tsipras et al.) 2019)] Yang et al. 22020). Subsequently, in an endeav- our to alleviate the accuracy-robusttes. trade- off, several refinements have been proposed to the vanilla adversarial training, e.g.. Zhang al. (2019); Wang al. (2020): Rice (2020); ; Wu et al. (2020); Zhhng et al. (2021). However, as shown in Fig. D the progress has been rather incremental over the last few years. Notwithstanding these recent advances, closing the large gap between accuracy and robustness still remains open challenge and every modest improvement in this regard remains significant.
Clean Accuracy
Figure 1: Accuracy-robusttess trade-off obtained by prominent defenses on CIFAR-10 against loo perturbations. We compile top models which use additional data and are available in Croce et al. 2020). From 2018 to 2021, the accuracy for ro- bust WideResNNet22/34. creased by around 2.5%. While our proposed HAT, combined with recent approaches, advances clean accuracy further by about 2-4%.
models has only in-
In this paper, we take a step towards demystifying and improving the aforementioned trade-off. To this end, take closer look the effect of training with adversarial examples the geometry of decision boundaries learnt by deep networks. Specifically, relying on the perspective proposed by Ortiz--imenez et al. (2020) which relates the directional margin with the discriminative features

---

Published as a conference paper at ICLR 2022
used by network, we uncover unwanted consequence of adversarial training. That is, we identify that adversarial training leads to a superfluous increase in the margin along the adversarial directions of the input space computed for regularly trained network. We refer to these directions initial adversarial directions In other words, the network be- comes excessively robust (compared to the attack radius e) along the directions which are otherwise pivotal for regular networks, and hence the accuracy drops. Further, we es- tablish an empirical connection between the margin along initial adversarial directions and the classification perfor- mance of the network. In particular, a smaller margin along these directions corresponds to higher accuracy. Thus, while the excessive margin is not essential for robustness, it severely derails the performance on clean samples. This naturally raises the following question:
+
2r
r
I' +
2r
Can we foresee an improvement in accuracy by reducing the margin along initial adversarial directions while preserving the same level of robustness?
To address this question, propose heuristic adversarial training scheme to reduce the directional margin and thus, achieve better accuracy without sacrificing robustness. We call this algorithm, Helper-based Adversarial Training (IAT), the name derived from the fact that incorpo- rate additional training examples comprising of overly per- turbed adversarial images (possibly) wrongly labelled using a standard trained network to help impede excessive direc- tional robustness and hence, improve clean accuracy (see Fig. 2) We also provide an extensive analysis of HAT and compare it with statc-of-the-ee AT methods. The main con- tributions of this paper include:
ship
ship
frog
Figure 2: (Top): Illustration depicting the purpose behind introducing helper examples labelled by a standard clas- sifier. Solid black line: standard net- work. Dashed red line: adversarially trained network. Dashed blue line: desired decision boundary. (Bottom): + 2r is visually dissimilar from and the classifier is not needed to be robust to such large distortions.
We demonstrate that adversarial training leads to a large margin along initial adversarial directions. In addition, we identify direct connection between the excessive margin and the reduction in clean accuracy caused by adversarial training.
We propose Helper-based Adversarial Training (HAT) to explicitly reduce the excessive margin by augmenting the training data with properly-labelee helper examples.
Experimentally, show that HAT consistently improves accuracy without sacrificing bustness. Notably, in combination with recent improvements from Rebuffi et al. (2021). HAT sets new state-of-the- -hr and improves clean accuracy by 3.33% CIFAR- T0 and 4.63% on CIFAR-100 100 using PreAct ResNet-18 against foo perturbations of size 8/255.
1.1 RELATED WORK
Improving adversarial robustness. To mitigate the adversarial susceptibility of DNNs, myriad of defense methodologies (Papernot et al.) 2016 Tramer et al. 2018 Kannan et al. 2018 Wang al. 2019 Xiao et al. (2000) have been proposed. Yet, many of them have been shown provide superticial robustness by introducing gradient obfuscation (Ataly et al. 2018), hence calling for cautious evaluation of robustness TTrmer al., 2020 Croce et al.) 2020). Nonetheless, adversarial training (AT) (Madry et al.] 2018) or training with worst-case inputs has been the most popular approach for improving the robustness DNNs albeit at the cost of sizeable drop in accuracy. Notably, AT has been able to withstand newer sophisticated adversaries (Gowal et al. 2019 Croce & Hein 2020). Another prominent defense is TRADES (Zhang et al., 2019), which provides a systematic way to control the trade-off between accuracy and robustness by solving:
arg min
Σ CE(y, so(x)) +
max 8.:1|8el|pSe
(o( 6,)),
'The reason for such terminology will become clear in the later sections.
2

---

Published as a conference paper at ICLR 2022
where CE is the cross-entropy loss, KL is the Kullback- divergence and B controls the trade-off between accuracy and robustness. More recent attempts to improve the accuracy vs. ro- bustness trade-off have predominantly dealt with refining adversarial training by (i) modifying the
objective function (Wang et al.] 2020 Zhang et al. 2020] 2021). (ii) early-stopping (Rice et al.
2020), (iii) heuristics and hyperparameter selection (Pang et al. 202T Gowal et al. (0211) D. (iv) extra data (Hendrycks et al., 2019; Alayrac et al. 20119] Carmon et al. 2019 Rebuffi et al. 2021 Schwag
/
al. 2021), and (v) weight initialization for training with large perturbations (Shaeini al. 2020).
Despite these advancements, the problem is far from being solved with a huge gap between accuracy
and robustness on practical image recognition benchmarks. We revisit this issue in our paper and build upon TRADES to further ameliorate the trade-off.
Understanding adversarial vulnerability. A concurrent stream of prior works has provided plau- sible reasons for the existence of adversarial examples. Adversarial vulnerability of DNNs has been accredited to the existence of highly generalizable, but non-robust features the data which are exploited by DNNs to achieve state-of-the-art performance (Jetley et al. 20118 [lyas et al., 2019). Besides, Ortiz-Jimenez et al. 2020) devised a novel experimental framework which relates the dis- tance of data points to the decision boundary of DNN with the discriminative features used by the DNN in order to understand the mechanism behind AT.
2
PRELIMINARIES
Consider the input space X' C. Rd. Let fe X + RC represent deep neural network classifier
parameterized by 0, where C is the number of output classes. Let Fo(x:) = arg max; fa)) be the class label predicted by So for any x E X, where fo(#:); is the 1thh component of fo(æ).
Margin. Given a classifier Fe, input and an unit vector & E gd-1, we define margin ja at æ along the direction f as:
pl f) = arg min |o|| s.t. Fo(x + of) F Fo(ar)
Additionally, note that we refer to a deep network trained only on clean samples as standard network and a network trained via adversarial training as robust network, Besides, we reuse the definitions of clean (natural) and robust (adversarial) accuracy as stated by Zhang et al. (2019).
Initial adversarial directions. Given standard network So, input dataset {( )= we define the set of initial adversarial directions as Rinit (r:/1Irs|l223) where r, is obtained by solving:
P;
max Lyy, Sole; 1 6:)).
5 11
where, {(., :) is an arbitrary loss function e.g. cross-entropy (CE). This optimization is usually solved via multi-step procedure called projected gradient descent (PGD) (Madry et al. 2018).
ADVERSARIAL TRAINING INTRODUCES EXCESSIVE INVARIANCE
We begin our analysis by examining the effect of adversarial training (AT) on the decision boundary of DNNs. Via novel analysis on synthetic dataset and CIFAR- 10 (Krizhevsky 2009), we show that AT triggers superfluous increase in the margin along the initial adversarial directions compared to the nominal increase required to attain robustness. In addition, we provide empirical evidence which signifies connection between the increase margin and reduction in clean accuracy.
Toy problem. First, we study toy setting to shed some light on the phenomenon of excessive directional margin caused by AT. We construct 3-d binary classification dataset drawn from two distributions which live on two noisy concentric circles of different radii in the x1-22 plane and being linearly separable along the third dimension Øz. In particular, Σ1 = Ps cos(2) + 61, Z2 = U1(0, 2T) and e1, 62 (N, o2) where i = 1,2 for class and respectively. We train a single hidden-layer MLP via both standard training and adversarial training. Fig. visualizes the decision regions with both the training procedures. It is
P, sin(2) + éq and æ3 U(a,, (,) where
3

---

Published as a conference paper at ICLR 2022
1,0
1.0
1.0
1,0
05
0.5
0.5
0.5
-05
-0.5
-0.5
-0.5
-10
-10
-10
-10
-1.
-15-100-05 05 1.0
15
05
0.0
0.7
0.8
1.0
-15-10-05 00 0.5
255
0.
0.6
0.7
0.8
0.9
1.0
X2
X3
(a) Standard training
(b) Adversarial training
Figure 3: Decision boundary learnt by MLP visualized in two dimensions: 21-22 and -1-23 respec- tively. Adversarial training improves robustness substantially from 41% to 74%, yet causes about 9% drop in accuracy. For each left subplot, 23 = 0.85 and for each subplot the right, I2 0.4.
evident that the network primarily uses to achieve zero classification error when trained using standard training, but the resulting model performs poorly in terms of robustness. In contrast, when we use AT, the learned decision boundary is completely different from that in the standard case. Here, the network becomes reasonably invariant along 23 (Fig. 3b), thus causing the directional margin along 23 to tend to co. This enables the network to attain robustness at the cost of small increase in classification error.
Evidence on CIFAR-10. Next, we illustrate that a similar phenomenon occurs in the case of state- of-the-art deep networks trained on CIFAR-10. To this end, we measure directional margin (as defined by Eq. 2 to the classification boundary which allows us partly capture the geometry of decision boundary. We restrict ourselves to the following setting. We take a ResNet- 18 (He et al.] 2016) trained until convergence
CIFAR-10 (achieving 94.6% accuracy and 0% robustness to Loo- PGD perturbations on the test set) and then fine-tune it using AT with adversarial examples. This framework allows to study the evolution of the decision boundary caused by AT in comparison to that learnt by a standard network. We use lx -PG with norm E = 8/255 for training. The network attains 83.3% accuracy and 51.6% robustness the test after adversarial fine-tuning. Please refer to App. B. for more details of the experimental setup.
Meanwhile, during adversarial fine-tuning, track the margins along the adversarial directions found by PGD to shed some light on the learning dynamics. Suppose R2 = {r / /lrr/lla) where r denotes adversarial perturbation found by PGD at 4thh epoch of adversarial fine-tuning for the input sample æ;, Thus, Ruit Ro represents the set of initial adversarial directions. We hypothesize that during adversarial training, the network becomes excessively robust to these initial adversar- ial directions Ro while slightly shifting the decision boundaries along other adversarial directions RA21- Fig. (illustrates the margins along Ro, R2 and R₂ before and after adversarial fine-tuning respectively. The dashed red line indicates the value of used for training, i.c., any allowable pertur-
Margin along adversarial directions R;
Margin along adversarial directions R;
Margin along adversarial directions R
25
Final Margin
Final Margin
Final Margin
25
25
25
60
6n
0.5
2.0
0.5
1.0
2.0
Initial Margin
Initial Margin
Initial Margin
Figure 4: Final margins for adversarially trained model vs. initial margins before the start of adver- sarial fine-tuning on CIFAR-10 along Ro (= Rimi), R2 and Rs respectively. Dashed line indicates the value of & used during training and evaluation. The increase in margin along Ro is much larger than that along other directions R, and Rs.
4

---

Published as a conference paper at ICLR 2022
bation has ||r| I 8/255 equivalently ||r||2 S 1.74. Intuitively, might expect adversarial fine-tuning to cause small shifts in the decision boundary so that the margin becomes greater than 1.74, and attain robustness. However, this is not the case in practice. Intriguingly, the classifier instead resorts to becoming largely insensitive along Ro for some data points as evident in Fig. 4 while undergoing small shifts along other directions Rx21. We also observe decrease of 11.3% clean accuracy after fine-tuning.
Connection between margin along Rinit and clean accuracy. We now provide a two-fold argument which justifies the following hypothesis: "The dras- tic rise in the margin along Rinit is directly correlated to the observed reduction in accuracy". In fact, a larger margin contributes to a larger drop in accuracy.
Table 1:
Median margin along Rini and the corresponding clean and robust accuracy with TRADES on CIFAR- 10 test set for dif- ferent values of f3. Robust accuracy is evalu- ated with AutoAttack (Croce & Hein 2020
(i) Firstly, we complement our hypothesis with the following observation by Ortiz-Jimennt
3
Median Margin
Clean
Robust
et al. (2020). The directions of input space with small margins and in tur,, the initial adversarial directions in the case of standard network, are associated with discriminative features learnt by the network. We believe that these directions are crucial for the performance of the net- work. Thus, a drastic directional margin along these directions contributes to the drop in classification accuracy. (ii) We train a robust network on CIFAR- 10 using TRADES with different values for the trade-off parameter 3. (Please refer to Sec. [.1 for the exact experimental setup.) As / increases, we observe an increase in the margin along Rimi (computed subset of 1024 examples from the CIFAR-10 10 test set) and corresponding reduction in clean accuracy (see Table D. This further corroborates our hypothesis.
1.0
8.3
88.1
43.8
2.0
9.3
85.6
46.3
3.0
9.7
84.7
47.9
4.0
10.3
83.6
48.5
5.0
10.5
82.9
48.8
4 HELPER-BASED ADVERSARIAL TRAINING
As demonstrated in Sec. 3] AT triggers an unwarranted increase in the margin along initial ad- versarial directions, thus hindering the network from using highly discriminative features in those directions. Note that large margin is not a sufficient condition for fp-based e-robustness. A trivial example of this is a constant classifier which has an infinite margin, but has both poor robustness and poor accuracy. Instead, the excessive rise in margin translates to large changes in the geometry of decision boundary compared a standard network and causes corresponding drop in clean accuracy. We here base our algorithm on the intuition that slightly pushing the decision boundary away from data should suffice for attaining robustness as opposed to the large shifts observed. Our results in Sec. suggest that HAT, by reducing margin, can indeed lead to improved performance.
Now, we introduce our proposed algorithm, helper-based adversarial training (HAT), to reduce the excessive directional margin observed in practice. We aim to preserve certain geometric properties of a standard trained network viz. the predictive power along adversarial directions while learning robust model. To this end, we add additional training examples, called helper examples, which are generated on-the-fly during the adversarial training procedure. In particular, a helper example constructed by extrapolating the adversarial perturbation found during training and is (possibly wrongly) labelled by a standard network (see Fig. Pb. Formally, we define a helper example as:
Helper examples. Given an input sample (æ.,, yz) a standard network Se robust network iterate fex at 1ith training iteration and adversarial example af computed by the adversary for fee the corresponding helper example is given by (æ., where
き; = x; + 2r: T; = x x; and 0 arg max; fe., (x))
The motivation behind this definition is illustrated in Fig. where it is evident that we can stimulate a slight push to the decision boundary along any adversarial direction by making the network predict the correct label y; at adversarial example æi and have it predict 5i (often J. + yi) at helper example I; to preserve the discriminative characteristics as modelled by standard network. Defining the helper examples
+ 2r; is a heuristic choice that provides good compromise between the helper example being sufficiently dissimilar (from x) for the model to assign a different label (see Fig. P for a visual example), and not too dissimilar to affect the performance on other clean samples. In
5

---

Published as a conference paper at ICLR 2022
Algorithm Helper-based Adversarial Training
Input:
Training dataset D = (a y: Hi)
Parameter: Batch size learning rate 77. weight of robust loss B, weight of helper loss 7 attack radius E, attack step size a and number of attack iterations K
1: Train a network few. via standard training on D i.e., std + arg ming CE(y:, fo(x,))
2: Randomly initialize the network parameters θHAT
3: repeat
Train robust classifier
4: Sample a mini-batch {(Ziy: (1 from
5: for j 1, 2,......
do 1/ f- Fi + 0.001 (O
6:
Construct adversarial example
7:
for 1, 2.... K do
8:
1/,- + e) (xl, + sign( (enn(Vai, Val, KL (2) fow (z(,))))
9:
end for
Compute helper example: Big mi 2 (ark, xig)) 11: Set helper label: Vi, &- arg max; Sa (xr1,),
10:
end for
13: OHAT + OHAT - I -. VensT (CE (3h,, form (cxi,) )) + KL(Sou (wir)) Sour (3//y)
+ 7 CH(Di,, Soua (T:;)))
14: until training completed
contrast to AT, this allows preventing the undesirable excessive rise in the margin some extent, thus making it possible to achieve significantly better performance on clean samples. Put differently, HAT can also be framed as performing geometric self-distillation (Hinton et al. 2015) to mimic certain geometric properties of standard trained network.
HAT algorithm. We to instantiate HAT by extending TRADES which alike TRADES allows us to balance the accuracy accuracc-robusttess robustness trade-off. Aggorthmm[[smmmaizzss summarizes the pseudo-code for HAT. The training objective for HAT comprises three terms: standard loss, robust loss, and an additional helper loss. Thus, in comparison to TRADES, we have additional parameter y which controls the weight of helper loss and thus, the extent of resistance to excessive directional margin. Finally, note that extension can be easily plugged into other recent techniques e.g. [Wu al. (2020); Gowal iet al. (2021); |Rebuffi et al. (202 ). In fact, in our experiments, we indeed combine HAT with the
approach in Rebuffi et al. 2021 advance the prior art by significant margin (Sec. 5.3)
5 EXPERIMENTS
This section constitutes an extensive evaluation of HAT. Initially, to test the universality of our approach, we study the performance HAT with ResNets on different datasets and attack configu- rations. Next, we leverage extra data and wider networks to obtain state-of-the-art performance on conventional robustness benchmarks. Towards the end, we conduct experiments to analyze HAT.
5.1
PERFORMANCE EVALUATION WITH RESNETS
We here empirically validate the performance of HAT. We report results using ResNet-18 (He et al.
2016 on three datasets: CIFAR-10. CIFAR-IO0 (Krizhevsky) 2009) and SVHN (Netzer et al.
2011 We compare HAT with three prominent adversarial defenses: (i) AT (Madry et al. 2018). (ii)
TRADES (Zhang et al. 2019) and (iii) MART (Wang al., 2020).
Training setup. We borrow the set of training hyperparameters from DAWNBench (Coleman et al.)
2017). Precisely, we use SGD optimizer with Nesterov momentum (Nesterov) (983); cyclic learning rates (Smith & Topin 2018) with cosine annealing and maximum learning rate of 0.21 for CIFAR- 10, CIFAR-IO0 100, and 0.05 for SVHN. We train each model for 50 epochs on CIFAR- 10 and CIFAR- SVHN. For foo training,
100 whereas
PGD attack with maximum perturbation E = 8/255 and run the attack for K = 10 iterations for all datasets. The PGD step size set to e/4 2/255 for CIFAR-10, CIFAR- 100: 1/255 for SVHN. For HAT, fix y to
apply 15 epochs

---

Published as a conference paper at ICLR 2022
0.5 and use 8 = 2.5 for CIFAR- 10 and SVHN; B 3.5 for CIFAR-100. Whereas the regularization parameter / for TRADES is set to 5.0 for CIFAR-10, SVHN and 6.0 for CIFAR-100. For MART, choose 3 5.0. More details can be found in App. C.I
Evaluating robustness. During training, we perform early stopping (Rice et al., 2020) and select the model that has the highest robustness against PGD (K = 20) for further evaluation. Further, to evaluate the robust accuracy of our models, we use Auto.Attack (Croce & Hein 2020) which comprises an ensemble of four diverse attacks (including black-box attack). AutoAttack has been consistently shown to provide a reliable estimation of robustness. Nevertheless, we also conduct additional evaluations and checks with HAT to eliminate the possibility of gradient obfuscation in App. C.4
Table 2: Comparison of HAT using ResNet-18 on CIFAR-10, CIFAR-100 and SVHN with other adversarial defenses under &oo perturbations of size 8/255. We report the average scores over runs and relegate the standard deviations to Table App
CIFAR-10
CIFAR-100
SVHN
Method
Clean
Robust
Clean
Robust
Clean
Robust
Standard
94.57
0.0
76.00
0.0
96.14
0.14
AT
84.01
47.74
57.50
23.88
92.57
46.33
TRADES
82.73
48.80
56.70
23.63
91.01
52.99
MART
79.52
47.98
50.82
24.52
91.30
48.46
HAT
84.90
49.08
59.19
23.75
93.08
52.83
Results. Table reports the performance of HAT and other prominent defenses in the literature. It is evident that HAT can notably increase the clean accuracy of the models with little to no degradation of robustness. In other words, HAT consistently shrinks the gap between accuracy and robustness by around 2% compared to prior adversarial training schemes. For example, in the case of CIFAR- 10, HAT boosts clean accuracy by 2.17% whilst achieving similar robustness TRADES. In addition, we find that the 2.17% gain in clean accuracy on CIFAR-10 equates to a 2.08% jump on common corruptions (Hendrycks & Dietterich) 2019) (see App. CK3) which is highly desirable given the practical relevance of common corruptions. Finally, we note that our models do not show any signs of gradient obfuscation as evident from the analysis in App. C.4
5.2
OTHER THREAT MODELS AND LARGER DATASETS
To verify the generality of our results, we now experiment with different attack configurations and larger benchmarks.
Threat models. We investigate two dif- ferent threat configurations on CIFAR-10: (i too with norm 12/255 and (ii) l2 with norm 128/255 and follow the same setup Sec. 5.1 Here, we compare HAT only with TRADES since TRADES achieves superior results than other techniques on CIFAR- 10. As shown in Table 3 HAT surpasses TRADES by a large margin. Specifically, with for perturbations of size 12/255, HAT clearly surpasses TRADES, effecting 5.95% improvement in clean accuracy while simultaneously bettering robustness by 0.70%. Moreover, HAT achieves higher clean accuracy (f 1.46%) against & perturbations well. However, the improvement here is rather limited owing to the fact that when training with smaller e's, the phe- nomenon of excessive directional margin might not be very severe.
Table Performance of TRADES and HAT with ResNet-18 on CIFAR-10 under l consstrrad ad- versaries. We report the average results over runs.
Norm
Method
Clean
Robust
TRADES
73.35
32.77
Ex
12/255
HAT
79.30
33.47
TRADES
87.41
68.99
Eg
128/255
HAT
88.87
69.09
Larger datasets. The efficacy of HAT indeed holds for large-scale datasets such as Tiny IinylmageNet- 200 and ImageNet-100 (Deng al., 2009), where AT is known cause huge degradation in accuracy. We observe that HAT improves the accuracy of AT from 47.76% to 52.60% and robust- ness from 17. 17.92% to 18.14 14% TinylmageNet-200 against fxx distortions of size 8 8/255. With
7

---

Published as a conference paper at ICLR 2022
Table 4: Comparison of HAT with other state-of-the-art approaches on CIFAR-I0 and CIFAR-100 under &or adversary. Following Gowal et al. (2021), we report the result of a single run.
Dataset
Model
Method
Extra data
Clean
Robust
Rebuffi et al.
2021)
DDPM
83.53
56.66
PRN-18
HAI HAT
DDPM
86.86
57.09
80M TI
89.02
57.67
Rebuffi et al.
2021
DDPM 85.97
60.73
CIFAR-10 10
HAT
DDPM
88.16
60.97
WRN-288-10
AWP (u al.
2020)
80M TI 88.25
60.04
Gowal et al. 2021
80M TI 89.48
62.80
HAI
80M TI 91.30
62.50
WRN-34-10
HAT
80M TI 91.47
62.83
Rebuffi et al. (2021)
DDPM
56,87
28.50
PRN-18
HAT
DDPM
61.50
28.88
CIFAR-100
Rebuffi et al. 2021
DDPM
59.18
30.81
WRN-28-10
HAT
DDPM
62.21
31.16
ImageNet- 100 against for perturbations of size 4/255, HAT outperforms TRADES by 4.20% on clean accuracy and 1.92% on robustness; surpasses AT by 1.36% on clean accuracy and 0.98% on robustness. More details on the experiment can be found in App.
5.3 EFFECT OF ADDITIONAL DATA AND WIDER NETWORKS
has been observed that robust generalization benefits remarkably from the use of extra training data (Schmidt et al. 2018) and increased model capacity (Madry et al. 2018). We investigate the impact of these two factors on HAT training. Specifically, we build upon the recent approaches from Gowal et al. (2021) and Rebuffi et al. 1022 which provide carefully designed experimental suite composed of model weight averaging, SiLU activation function, larger models and additional training data considerably progress the state-of-the-art performance multiple robustness bench- marks. While et al. (2021) uses an additional subset of 500k natural images extracted from 80 Million Tiny Images (80M TI) dataset (Torralba al. 22008), RRebufii et al. (2021) leverages 1M syn- thetic images generated by DDPM (Ho et al. (0220). Following the exact experimental setup from these p we train several models on CIFAR-10 and CIFAR- 100 using three different model architectures namely, PreAct ResNet-18 (PRN-18) (He et 2016)) WideResNet (WRN- 28- 10) and N4deResNett34-110 (WRN-34-10) (Zagoruyko & Komodakis 2016). However, since the additional data from Gowal et al. (2021) is not publicly available we resort to using similar dataset provided by Carmon et al. (2019). Note that we always pick ,5 3.5 and 7 = 0.5 for HAT.
In Table 4 we benchmark the performance of HAT along with that of state-of-the-art approaches. Using PRN-18 and synthetic DDPM- -eeeergeee images, HAT improves clean and robust accuracy by (i) 3.33% and 0.43% respectively on CIFAR-10 and (ii) 4.63% and 0.38% respectively CIFAR- 100 against for perturbations with norm 8 8/255. Notably, HAT sets a new state-of-the-an on CIFAR- 10 obtaining 89.02% clean accuracy and 57.67% robust accuracy. More importantly, these sizeable improvements with PRN-18 suggest that smaller networks have not yet exhausted their limits and must invent techniques which better exploit the capacity of these networks. Moreover, with 1RN-28-10, HAT also surpasses the state-of-the-art accuracy in the respective categories by 2-3%.
5.4 ANALYSIS
Accuracy vs. robustness trade-off. We investigate the sensitivity of HAT to its hyperparameters namely, the weight of robust loss 3 and the weight of helper loss 7. Fig. includes plot which
Note that we not use CutMix augmentation Yun al. 2019) with the setup from Rehuffi et al. 2021
Gowal et al. (2021) use custom regenerated dataset which contributes to around 0.7% improvement robustness in comparison the data from Carmon al. (019). See Sec. 4.3 from Gowal et al. (002
8

---

Published as a conference paper at ICLR 2022
TMODS MATO v-2251
Table Median margin for dif- ferent methods along Rini For a fair comparison, the hyperpa- rameters of AT, TRADES and HAT are suitably chosen so that all the three methods have the same robustness of about 47.9% to AutoAttack.
15.3 855
16.0
CeanAAC ACC
Figure 5: Accuracy vs. ro- bustness trade-off exhibited by different adversarial defenses. From left to right, we decrease the trade-off parameter 3 for TRADES and HAT.
Figure 6: Difference between
robust accuracy (PGD")) of HAT and TRADES vs. Elest (foo norm of PGD). The red line corresponds to the value of the models are trained with.
Algorithm
Median Margin
AT TRADES
9.3
9.7
HAT
9.1
demonstrates the performance of HAT at different values of 3 E [1.5, 4.0) and 7 fixed to 0.25. We also show the curve obtained by varying the regularization parameter / of TRADES in Fig. [ We do not include MART here since it achieves relatively poor trade-off. We can clearly that for HAT, 3 controls the trade-off between accuracy and robustness where increasing 3 improves robustness. Next, study the impact of y. First, expected, HAT with y = 0 performs identically to TRADES. Second, E {0.25, 0.5} achieves the best trade-off and within this range, the choice of y has negligible influence on the resulting trade-off exhibited by HAT. Third, increasing y beyond 0.75 causes the robust accuracy to deteriorate due to the dominance of helper loss over robust loss. The hyperparameter sweeps for y are presented in App. C.5
How does HAT improve clean accuracy. The improvement in the performance on clean samples provided by HAT can be accredited the following two observations on CIFAR-I0: (i) In contrast to TRADES, HAT marginally compromises robustness to fx perturbations with larger norm. We take robust network and evaluate using PGD attack (K 40) for different values of -nom 20, (25] Fig. 6 plots the difference between robustness of HAT and TRADES vs. E. We observe that while HAT outperforms TRADES at smaller e's, it performs slightly worse after the exceeds the value used during training, i.e., 8/255. This implies that we have traded robustness to high E's for an improvement in accuracy. (ii) HAT exhibits a slightly lower directional margin along initial adversarial directions Rinit in comparison to AT and TRADES. The margin along Riit for different algorithms (as evaluated on a random subset of 1024 samples from the CIFAR-10 test set) is illustrated in Table 5 Note that in Table 5 list the models that achieve the same robust accuracy (~ 47.9% to AutoAttackk.. Yet, the median margin for HAT is slightly lower than that for AT and TRADES. Additionally, in comparison to TRADES, HAT reduces the number of samples with margin greater than 10e from 40% to 27%.
CONCLUSION
We presented experimental evidence to highlight that state-of-the-art adversarial defenses foster a superfluous increase in the margin along certain adversarial directions of the input space. This largely destroys the discriminative characteristics along these directions and partly contributes to the much-debated accuracy vs. robustness trade-off. Further, inspired by our analysis, we introduced a novel algorithm, Helper-based Adversarial Training (HAT), to alleviate the problem of excessive directional margin. HAT attempts to mimic the discriminative features learnt by standard trained networks to improve the accuracy on clean samples, hence achieving a superior accuracy vs. robust- ness trade-off compared to existing defenses. Moreover, HAT surpasses the known state-of-the-ar clean accuracy by 3-5% without sacrificing robustness. Finally, we verify that HAT slightly reduces the directional margin, thus directly benefiting the accuracy. We believe that our experiments and the proposed HAT algorithm can open the door for further research on relieving the accuracy vs. bustness trade-off under limited model capacity. While HAT is only one possible candidate. future works can come up with more effective techniques to alleviate the problem of excessive margin.

---

Published as a conference paper at ICLR 2022
ACKNOWLEDGMENTS
The authors would like to thank Alhussein Fawzi and Guillermo Ortiz-Jimenez for their feedback on an earlier version of this paper.
REFERENCES
Lean-Baptiste Alayrac, Jonathan Uesato, Po-Sen Huang, Alhussein Fawzi, Robert Stanforth, and Pushmeet Kohli. Are labels required for improving adversarial robustness? In Advances in Neural Information Processing Systems, 2019.
Maksym Andriushchenko. Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square at- tack: query effrccefficient black-box adversarial attack via random search. In Proceedings of the European Conference on Computer Vision, 2020.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of se- curity: Circumventing defenses to adversarial examples. In Proceedings of the 35th International Conference Machine Learning, 2018.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium Security and Privacy (SP), 2017.
Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C Duchi, and Percy Liang. Unlabeled data improves adversarial robustness. In Advances in Neural Information Processing Systems, 2019.
Tianlong Chen, Zhenyu Zhang, Sijia Liu, Shiyu Chang, and Zhangyang Wang. Robust overfitting may be mitigated by properly learned smoothening. In International Conference on Learning Representations, 2021.
Cody A. Coleman, Deepak Narayanan, Daniel Kang, Tian Zhao, Jian Zhang, Luigi Nardi, Peter Bailis, Kunle Olukotun, Chris Re, and Matei Zahari. Dawnbench: An end-to-end deep learning benchmark and competition. In NIPS ML Systems Workshop, 2017.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensem- ble of diverse parameter-free attacks. In Proceedings of the 37th International Conference Machine Learning, 2020.
Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: a standardized adversarial robustness bench- mark. arXiv preprint arXiv:2010.09670, 2020.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hier- archical image database. In 2009 IEEE Conference Computer Vision and Pattern Recognition, 2009.
Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations, 2015.
Sven Gowal, Jonathan Uesato, Chongli Qin, Po-Sen Huang, Timothy Mann, and Pushmeet Kohli. An alternative surrogate loss for pgd-based adversarial testing. arXiv preprint 1rXiv:1910.094 1900.0338, 2019.
Sven Gowal, Chongli Qin, Jonathan Uesato. Timothy Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03599, 2021.
K. He, X. Zhang, S. Ren, and J. Sun. Deep residual learning for image recognition. In 2016 IEEE Conference on Computer Vision and Pattern Recognition, 2016.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In Proceedings of the European Conference Computer Vision, 2016.
10

---

Published as a conference paper at ICLR 2022
Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common ruptions and perturbations. In International Conference on Learning Representations, 2019.
Dan Hendryeks and Kevin Gimpel. Gaussian enror linear units (gelus). arXiv preprint
arXiv:1606. 08415, 2016.
Dan Hendrycks, Kimin Lee, and Mantas Mazeika. Using pre-training can improve model robustness and uncertainty. In Proceedings of the 36th International Conference on Machine Learning, 2019.
Geoffrey Hinton, Oriol Vinyals, and Jeffrey Dean. Distilling the knowledge in a neural network. In NIPS Deep Learning and Representation Learning Workshop, 2015.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In Advances in Neural Information Processing Systems, 2020.
Andrew lyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. In Advances in Neural Information Processing Systems, 2019.
Pavel Izmailov, Dmitrii Podoprikhin, Timur Garipov, Dmitry Vetrov, and Andrew Gordon Wilson. Averaging weights leads to wider optima and better generalization. 34th Conference on Un- certainty in Artificial Intelligence, 2018.
Saumya Jetley, Nicholas Lord, and Philip Torr. With friends like these, who needs adversaries? In Advances in Neural Information Processing Systems, 2018.
Harini Kannan, Alexey Kurakin, and Ian Goodfellow. Adversarial logit pairing. arXiv preprint /803.06630 2018.
Alex Krizhevsky. Learning multiple layers of features from tiny images, 2009.
Cassidy Laidlaw, Sahil Singla, and Soheil Feizi. Perceptual adversarial robustness: Defense against unseen threat models. In International Conference on Learning Representations, 2021.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE Conference Com- puter Vision and Pattern Recognition, 2016.
Seyed-Mohsen Moosavi-Dezfolde Alhussein Fawzi, Jonathan Uesato, and Pascal Frossard. Robust- ness via curvature regularization, and vice versa. In 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2019.
Y. E. Nesterov. A method for solving the convex programming problem with convergence rate O(1/k²). Dokl. Akad. Nauk SSSR, 1983.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Ng. Reading digits in natural images with unsupervised feature learning. In NIPS Workshop on Deep Learning and Unsupervised Feature Learning, 2011.
Guillermo Ortiz-Jimenen Apostolos Modas, Seyed-Mohsee Moosavi, and Pascal Frossard. Hold me tight! influence of discriminative features on deep network boundaries. In Advances Neural Information Processing Systems, 2020.
Tianyu Pang, Xiao Yang, Yinpeng Dong, Hang Su, and Jun Zhu. Bag of tricks for adversarial training. In International Conference on Learning Representations, 2021.
Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation defense to adversarial perturbations against deep neural networks. In 2016 IEEE Symposium on Security and Privacy (SP), 2016.
11

---

Published as a conference paper at ICLR 2022
Sylvestre-Alviss Rebuffi, Sven Gowal, Dan A. Calian, Florian Stimberg, Olivia Wiles, and Tim- othy Mann. Fixing data augmentation to improve adversarial robustness. arXiv preprint arXiv:2103.01946. 2021.
Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in adversarially robust deep learning. In Proceedings of the 37th International Conference on Machine Learning, 2020.
Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry, Adver- sarially robust generalization requires more data. In Advances in Neural Information Processing Systems, 2018.
Vikash Sehwag. Saeed Mahloujifar, Tinashe Handina, Sihui Dai, Chong Xiang. Mung Chiang, and Prateek Mittal. Robust learning meets generative models: Can proxy distributions improve ad- versarial robustness? arXiv preprint arXiv:2 09425, 2021.
Amirreza Shaeiri, Rozhin Nobahari, and Mohammad Hossein Rohban. Towards deep learning mod- els resistant to large perturbations. arXiv preprint arXiv:2003.13370 2020.
Leslie N. Smith and Nicholay Topin. Super-convergence: Very fast training of residual networks using large learning rates. arXiv, 2018.
Gaurang Sriramanan, Sravanti Addepalli, Arya Baburaj, and Venkatesh Babu R. Guided adversarial attack for evaluating and enhancing adversarial defenses. In Advances in Neural Information Processing Systems, 2020.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfel- low, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Reprexentations, 2014.
Antonio Torralba, Rob Fergus, and William T. Freeman. 80 million tiny images: A large data set for nonparametric object and scene recognition. JEEE Transactions on Pattern Analysis and Machine Intelligence, 2008.
Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. Advances in Neural Information Processing Systems, 2020.
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and defenses. In International Conference Learning Representations, 2018.
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. In International Conference on Learning Representa- fions, 2019.
Yisen Wang, Xingjun Ma, James Bailey, Jinfeng Yi, Bowen Zhou, and Quanquan Gu. On the convergence and robustness of adversarial training. In Proceedings of the 36th International Conference on Machine Learning. 2019.
Yisen Wang, Difan Zou, Jinfeng Yi. James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In International Conference on Learning Representations, 2020.
Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust gener- alization. In Advances in Neural Information Processing Systems, 2020.
Chang Xiao, Peilin Zhong, and Changxi Zheng. Enhancing adversarial defense by k-winners-take- all. In International Conference on Learning Representations, 2020.
Yao-Yuan Yang, Cyrus Rashtchian, Hongyang Zhang, Russ Salakhutdinov, and Kamalika Chaud- huri. A closer look at accuracy vs. robustness. In Advances in Neural Information Processing Systems, 2020.
Sangdoo Yun, Dongyoon Han, Sanghyuk Chun, Seong Joon Oh, Youngjoon Yoo, and Junsuk Choe. Cutmix: Regularization strategy to train strong classifiers with localizable features. In 2019 IEFF/CVF International Conference Computer Vision, 2019.
12

---

Published as a conference paper at ICLR 2022
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In Proceedings of the British Machine Vision Conference, 2016.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In Proceedings of the 36th International Conference on Machine Learning, 2019.
Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankan- halli. Attacks which do kill training make adversarial learning stronger. Proceedings of the 37th International Conference on Machine Learning, 2020.
Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan Kankanhalli. Geometry-aware -rereghheee adversarial training. International Conference on Learn- ing Representations, 2021.
13

---

Published as a conference paper at ICLR 2022
A TOY PROBLEM
A.1 EXPERIMENTAL SETUP
Fig. illustrates the toy dataset used for experiment from two different viewpoints. To be precise, we draw the features 21, 22 and F3 as follows. 21 = p. cos(2) (2) + é1. 22 = P. sin(2) (2) + 1,2 for class and respectively. We set a = 0.2, p1 = 0.35, P2 = 1, = 0.65, 31 = 0.70, 02 = 0.80 and 32 = 0.85.
and 23 ~ U(a,, 3,) where
U(0, 2x) and 61, f2 (N( o²) where
We single hidden layer MLP with 25 hidden units and ReLU activation. For training, SGD with momentum 0.9, weight decay 0.0005 and set the learning rate to 0.1. We train the model via standard training and adversarial training respectively for 100 epochs. We use &oo PGD with step size a 0.05, maximum perturbation radius 0.1 and run K iterations for AT.
1,0
05
0.0
-0.5
1.0
1.0
1.5
-15
0.80
-15
-10
0.65
0.0
0.0
4
0.5
1.0
1.5
0.70
0.75
0.80
-1.5
-1.0
-0.5
#9
Figure 7: Toy dataset used in experiment.
A.2 HAT ALLEVIATES EXCESSIVE MARGIN
In this part, check whether HAT correct the failure mode of adversarial training for the toy problem studied in Sec. 3 Fig. shows the classification boundary learnt with HAT. Clearly, the decision boundary in the T1-23 plane tilted and not completely parallel the I3 axis, indicating some dependence on the feature Tz. Thus, HAT indeed attenuates the problem of excessive margin which is also reflected 4% improvement accuracy over adversarial training. Additionally, improves robustness from 73.8% to 74.6%.
03
03
0.0
0.0
-15
-15-100005 000
06
6.8
Figure 8: Decision boundary learnt by MLP visualized in two dimensions: 21-T2 and - respec- tively. HAT reduces the margin along za and improves accuracy by 4% over AT. For the subplot on the left, we fix 33 0.85 and for the right subplot, 22 = 0.4.
14

---

Published as a conference paper at ICLR 2022
Margin along adversarial directions Rio
Margin along adversarial directions Rig
Margin along adversarial directions Mag
30
30
Finel Margin
20
Final Morgin
20
Finel Margin
10
10
5
5
0.0
0.5
1.0
1.5
2.0
2.5
3.0
0.0
0.5
1.0
1.5
2.0
2.5
3.0
0.0
0.5
1.0
1.5
2.0
2.5
3.0
Initial Margin
Initial Margin
Initial Margin
Figure 9: Final margins for adversarially trained model vs. initial margins before the start of adver- sarial fine-tuning on CIFAR-10 along R10. R1s and R20 respectively. The red dashed line indicates the value of e used during training and evaluation.
B SEC. CONTINUED: EVIDENCE ON CIFAR-10
B.1 EXPERIMENTAL SETUP
For the margin experiment, train ResNet-18 (He al. 2016) CIFAR-IO (Krizhevsky 2009) training set. We simply adopt the set of hyperparameters and some improvements from DAWN- Bench (Coleman et al. 2017) submissions. We use SGD optimizer with Nesterov momentum 0.9 [Nesterov] 1983) and weight decay 0.0005. We further use cyclic learning rates (Smith & Topin 2018) with cosine annealing and a maximum learning rate of 0.21. We train the model for 50 epochs via standard training. Then, we perform adversarial fine-tuning for 25 epochs with the same scheduler and learning rate settings. Further, we evaluate margins on a set of 512 samples drawn uniformly at random from CIFARIO test set for the visualizations in Fig. (and Fig.
B.2 ADDITIONAL MARGIN PLOTS
The margins along other adversarial directions R10, R15, R20 before and after adversarial fine- tuning are displayed in Fig. 9 Here, R, corresponds to the adversarial directions computed the :thh iteration of adversarial fine-tuning. We see an increase in the margin along other adversarial directions as expected. Nevertheless, the relative increase along these directions not as large as compared to that along initial ones Ro (see Fig. 4).
C FURTHER PERFORMANCE EVALUATION
C.I EXPERIMENTAL SETUP FOR SEC. 5.1
In this section, we list all the details of our training and evaluation setup. We run all our experiments thrice and report the average scores obtained unless stated otherwise.
Training setup. We use ResNet-18 18 (He et al. 2016 for CIFAR-10 and CIFAR- 100 (Krizhevsky) 2009); and PreAct ResNet-18 (He et al. 2016) for SVHN Netzer al. 2011). For all our exper- iments, we use SGD optimizer with Nesterov momentum [Nesterov] 1983). momentum factor 0.9 and weight decay 0.0005. We further employ cyclic learning rates (Smith & Topin 2018 with co- sine annealing and maximum learning rate of 0.21 for CIFAR- 10 and CIFAR- 100; 0.05 for SVHN. For CIFAR-10 and CIFAR- 100, we train the models for 50 epochs with a batch size of 128. In the case of SVHN, we only train for 15 epochs.
For computing adversarial examples during training, we apply foe PGD with the following hyper- parameters: foc norm 8/ 8/255, step size a 2/255 and run the attack for K 10 iterations. Note that we re-implement AT, TRADES and MART and train existing methods and HAT according to the aforementioned settings. The hyperparameters of TRADES. MART and HAT are as follows. For HAT, we fix 7 to 0.5 and use 3 = 2.5 for CIFAR-10 and SVHN; 3 3.5 for CIFAR- 100. The regularization parameter 3 for TRADES is set to 5.0 for CIFAR-10. 10, SVHN and 6.0 for CIFAR-100. For MART, we choose 3 = 5.0. We also use the same setup to train a standard model for computing helper labels during HAT training.
15

---

Published as a conference paper at ICLR 2022
Table 6: Comparison of HAT using ResNet-18 on CIFAR-IO, CIFAR-100 and SVHN with other
adversarial defenses under foc adversary (E = 8/255). We report the average scores over 3 runs.
CIFAR-I0
CIFAR-100
SVHN
Method
Clean
Robust
Clean
Robust
Clean
Robust
Standard
94.57 = 0.07
0.0 = 0.0
76.00 + 0.24
0.0 + 0.0
96.14 + 0.04
0.14 = 0.03
AT
84.01 = 0.11
47.74 + 0.16
57.50 = 0.14
23.88 = 0.07
92.57 + 0.16
46.33 = 0.24
TRADES
82.73 1 0.36
48.80
0.08
56,68 1 0.20
23,63 0.07
91.01
0.20
52.99 1 0.03
MART
79.52 1 0.65
47.98
0.08
50.82
1 0.02
24.52 0.13
91.30
0.10
48.46 1 0.22
HAT
84,90 1 0.10
49.08
1 0.01
59.19 1 0.07
23.75 1 0.14
93.08
0.03
52.83 1 0.04
Evaluation protocol. During training, we perform early stopping (Rice et al. 2020) i.e., we track the robustness of the model to PGD (K = 20) on the test set and pick the model that performs the best for further evaluation. In order to benchmark the &oo robustness, we always test our models against AutoAttack (AA) (Croce & Hein (020) using the default code available httpp:: //
github.com. meccm/fra311 /cccm//Eralllauttattttae auto-attack
Setup for other attack configurations. We reuse the exact aforementioned setup when investi- gating different threat models on CIFAR-10. In the case of & perturbations, we use the following training adversary:
128/22 /255, a 15/255 and K 10. We choose 3 2.5 and 7 0.5 for HAT and 3 = 5.0 for TRADES. Whereas we set a = 4/255, K = 10 for foo perturbations with norm E 12/255. Additionally, we pick 8 = 3.5 and y 0.5 for HAT and 3 6.0 for TRADES.
C.2 EXPERIMENTAL SETUP FOR SEC. 5.3
we follow the setting designed by Gowal jet al. (2021) and Rebuffi et al.] (2021) respectively. For the sake of completeness, we briefly recap the training setup here. We use SiLU activation function (Hendrycks & Gimpel 2016) with PreAct ResNet (He et al. Wede (Zagoruyko & Komodakis (0166) bone The optimizer used is SGD with Nesterov momentum (Nesterov) 1983), momentum factor 0.9 and weight decay 0.0005. We further use cyclic learning rates (Smith & Topin 2018) with cosine annealing, a max- imum learning rate of 0.4 and warmup of 10 epochs. The training batch size is set to 1024 with 70% of the batch comprising of extra/synthetic data. We also use model weight averaging (Izmailov al.) 2018)) with decay 5 0.995 and train the models for 400 CIFAR-IO-equivall the extra data from Carmon et al. (201)). In the setting with synthetic DDPM-generan data, we apply 800 epochs. The training attack used PGD (K 10) with step size 2/255 and norm E = 8/255. Finally, we perform early stoppngg by tracking the performance on disjoint validation set using PGD (K=40) with margin loss (Carlini & Wagner) 2017). We separate first 1024 samples from the training set for validation. Note that we do not employ CutMix (Yun et al. 2019.
For training the models enumerated in Table Sec. 5.3
epochs with
C.3 ADDITIONAL RESULTS FOR SEC. 5.1
Detailed version of T2 The complete performance evaluation with ResNet- 18 across different datasets appears in Table 6. Here, we also include the standard deviation over 3 runs for complete- ness. It is clear that HAT outperforms other existing methods, hence narrowing the gap between accuracy and robustness.
Evaluation with other adversaries. We additionally scrutinize the performance of robust models trained on CIFAR-10 10 against conventional adversaries. In order benchmark the Eo robustness, we apply PGD with = 8/ //255, a = 0.01, K 40 and r = 5 restarts following the evaluation al. (0119) we denote this adversary as PGD+. We also evaluate the vulnerability of our models to PGD with CW loss (Carlini & Wagner, 2017).
protocol used in Carmon
8/255, a 0.01 and K 40 steps. Besides, we also test the vulnerability against naturally occurring benign corruptions. Specifically, we use the CIFAR- dataset from Hendrrycks & Dietterich (2019). The results presented in Table 7 show that HAT does not break down against other adversaries. Crucially. HAT leads to 2.08% improvement against common corruptions. This suggests that one needs to improve both accuracy as well as robustness in order to advance the performance under real-world distortions.
16

---

Published as a conference paper at ICLR 2022
Table 7: Performance of HAT using ResNet-18 on CIFAR-10 against other Lo adversaries and common corruptions. We report the average scores over 3 runs.
Method
Clean
AutoAttack
PGD+
CW
CIFAR-IO-C
Standard
94.57
0.0
0.0
0.0
72.92
AT
84.01
47.74
50.81
50.28
75.53
TRADES
82.73
48.80
52.03
49.94
74.66
MART
79.52
47.98
54.20
49.66
71.81
HAT
84.90
49.08
52.02
50.29
76.74
Combination with other adversarial defenses. To study the utility of HAT in concert with recent adversarial de- fenses, we examine the performance of HAT when in- tegrated with two schemes that improve over TRADES namely, (i) FAT (Zhang et al. 2020) which utilizes early- stopping when constructing adversarial data during train- ing and (ii) AWP (Wu et al. 2020) which encourages flat- ness in weight loss landscape. Note that although HAT is based TRADES, it can be easily integrated into these defenses. In our experiments, we follow the same training and evaluation setup as employed by Zhhang al. (2000) and [Wu et al. (2200) respectively. The resulting perfor- mance on CIFAR-I0 summarized in Table As shown in Table 8 incorporating HAT pushes the clean accuracy of FAT by 2% and also benefits robust accuracy by 0.9%. In combination with AWP, HAT leads to 2.6% gain in clean accuracy relative to AWP. These results underline that newer methods also suffer from the phenomenon of excessive margin and HAT indeed provides general fix to alleviate this problem.
Table 8: Performance of HAT (using ResNet-18 CIFAR-10 against foo perturbations of size 8/255) when com- bined with two recent adversarial train-
ing schemes: FAT (Zhagg et al. 2020)
and AWP (Wu al. 2020). We report the scores of a single run.
Method
Clean
PGD
FAT TRADES
83.7
49.5
HAT + FAT
85.7
50.4
AWP HAT +AWP
82.0
55.4
84.6
55.4
Table 9: Comparison of HAT using PreAct ResNet-18 18 Tinylmagenet-200 and ImageNet-100 with other adversarial defenses under fo adversary. We report the scores of single run.
TinylmageNet-200 Robust
ImageNet- Robust
Method
Clean
Clean
Standard
65.02
0.0
86.71
0.0
AT
47.76
17.92
75.90
49.58
TRADES
48.25
17.17
73.06
48.64
HAT
52.60
18.14
77.26
50.56
Larger datasets. We also examine the performance of HAT on large-scale datasets such as TiyllmaeeNet-200 and ImageNet-100 (Deng al. 2009). ImageNet-100 (Laidlaw al.) 2021 is 100-class subset of ImageNet. We use a similar setup as Sec. 5.1 with PreAct ResNet-18 except the following changes. We train for 30 epochs on Tiny IinylmaeeNet-200 against &oo perturbations of size 8/255. Whereas on ImageNet-100, we train for 50 epochs with batch size 256, weight decay 0.0001, use input normalization and &oo perturbations of size 4/255. On these datasets, we observed that TRADES performed significantly worse than AT. This might be due to the use of KL-divergence loss instead of cross-entropy (CE) loss for crafting adversarial examples. So, we use AT-based formula- tion of HAT which utilizes CE loss as robust loss as well as for computing adversarial perturbations. For TRADES, we use 3 = 8.0 for TinylmageNet-2000
= 6.0 for ImageNet- 100 while we pick 1.75 and y 1.0 for HAT on both the datasets. The results are presented in Table g Note that we measure robust accuracy using AutoAttack.
C.4 CHECKING FOR GRADIENT OBFUSCATION
We evaluate our models with AutoAttack (Croce & Hein 2020) which has been consistently shown provide reliable evaluation of robustness. Nevertheless, we also include additional sanity checks
17

---

Published as a conference paper at ICLR 2022
Table 10: Robust accuracy vs. number of steps K of PGD on CIFAR-10.
Table I: Robust accuracy vs. number of random restarts of PGD on CIFAR-10.
No. of steps K Robust
No. of restarts r
Robust
40
52.34
52.34
200
52.30
52.02
500
52.24
10
51.90
Figure 10:
Robust accuracy vs. at-
1000
52.20
20
51.85
tack radius of PGD40
Robust accuracy against transfer black- box PGD attack on CIFAR-10. For black-box PGD attack, the source model is used to compute adversarial perturbations for evaluating the target model.
Table 12:
Table 13: Robust accuracy on CIFAR-10 against non-transfer blxck-box square at- tack (Andriushchenko et al. 2020) with 5000 queries.
Target model
Source model
Model
Square attack (5000 queries)
HAT
AT
TRADES
HAT
56.26
HAT AT TRADES
62.89
61.80
AT TRADES
56.04
62.01
62.20
55.13
60.10
61.64
to eliminate the possibility of gradient masking. First, following the guidelines in Athalye et al. 2018), we examine the impact of following changes on the robustness of a model trained via HAT on CIFAR-10 against lo perturbations of size 8/255:
Attack radius E: Fig. plots the robustness of HAT vs. the radius e of PGD (K 40) tack. As expected, increasing the attack budget causes the robust accuracy to monotonically drop to 0%. particular, unbounded PGD adversary reduces the robustness to 0%.
Attack iterations K and random restarts r: Increasing the number of attack iterations K number of random restarts only marginally lowers the robust accuracy (see Table I0 and Table ITI. In order words, the attack has converged and does not suffer from gradient obfuscation.
As shown in Tables and 13 transfer and non-transfer black box evaluations do not show any signs of gradient obfuscation. We use square attack (Andriushchenko et al.) 2020) for non-transfer black box evaluation. Importantly, black box attacks have lower success rate than white box attacks.
8.30
-0.5
boss
33
-1525
4.25
0055
10255
48255
2000
Pondiv cveitie
New couctionn
5255
K0
Randon Erecten
(a)
(b)
Figure 11: Loss landscapes surrounding the s and 5th example respectively from CIFAR- test set for ResNet-18 18 trained with lop perturbations of size 8/255. Adversarial direction is the worst-case direction found using 2GD20 attack. The loss landscapes are very smooth and do not exhibit the typical patterns of gradient obfuscation.
18

---

Published as a conference paper at ICLR 2022
Table 14: Comparison of HAT with other state-of-the-an approaches on CIFAR-I0 and CIFAR-100
under for AutoAttack (Croce & Hein 2020 and GAMA-PGD (Sriramanan et al. 2020) attack.
Dataset
Model
Method
Extra data
Clean
AutoAttack
GAMA
Rebuffi et al.
2021
DDPM
83.53
56.66
56.81
CIFAR-10
PRN-18
DDPM
86.86
57.09
57.23
Rebuffi et al.
2021
DDPM
56.87
28.50
28.63
CIFAR-100
PRN-18
HAT
DDPM
61.50
28.88
28.99
Moreover, as sanity check, we also visualize the loss landscapes of our trained models in Fig. The loss landscapes are smooth exhibit low curvature which are the typical characteristics of robust network Gloosavi-Dezfoul et al., 2019). In summary, these observations indicate that HAT does not lead to gradient obfuscation.
Evaluation with GAMA-PGD. To further confirm that method does not suffer from gradient masking, we investigate the robustmess of models reported in Table against GAMA-PGD (Sri- ramanan et al. 2020), stronger adversary than vanilla PGD attack. The evaluation results provided in Table 14 As evident from Table [4 the performance of HAT does not break down even against GAMA attack which signifies that HAT does cause obfuscated gradients.
C.5 HAT: ANALYSIS (CONTINUED)
Accuracy vs. robustness trade-off. Fig. compares the trade-off obtained by HAT with that of
AT and MART (Wang et al. 2020). For HAT, we fix 0.25 and vary / E [1.5, 4.0]: for MART, we vary 5.0.. HAT surpasses AT and MART by large margin. With MART, we observe notable improvements in robustness to weaker adversaries such as PGD (see Table 7). but the gains
diminish when evaluated with stronger adversary such as AutoAttack (Croce Hein 2020).
AT
MART
HAT y=0.25)
TRADES
HAT (, V=0
HAT 1. V=0.75)
6, y=0.0)
(,
49
Robust Acc.
Acc.
49
47
48
47-
45
79
80
81
82
83
84
85
86
82
83
84
85
06
07
Clean Acc.
Clean Acc.
Figure 12: Accuracy robustness trade-off exhibited by AT, TRADES, MART and HAT. From left right, we decrease the trade-off pa- rameter 3 for TRADES, MART and HAT (7 is fixed to 0.25).
Figure 13: HAT accuracy robustness trade- off obtained for different values of 7. From left right, we decrease the trade-off parameter for TRADES and HAT. Robust accuracy is eval- uated using Auto/ttack.
Sensitivity of HAT to y. We here examine the impact of the weight of helper loss y on the accuracy vs. robustness trade-off exhibited by HAT and conduct additional the corresponding trade-off curves for HAT with 7 E {0.0, 0.25, 0.5, 0.75) in Fig I3 As expected, 0 almost coincides with that of TRADES (note that there is minor
sweeps. We show
the trade-off curve for difference due to randomness). Further, Y E (0.25, 0.5) achieve the best performance and identical trade-off curves. With 0.75, the robust accuracy starts to deteriorate due the dominance of helper loss over robust loss with the effect being more severe for lower values of B. We believe that increasing 7 beyond 0.75 would further negatively affect the performance.
19

---

Published as a conference paper at ICLR 2022
Next, conduct ablation studies on CIFAR-10 (fx.. 8/255) to better understand HAT algorithm. While we elaborate on the HAT design choices below for the sake of completeness, note that we do not conduct any hyperparameter tuning concerning these choices and naively resort to the set- ting mentioned in Algorithm [ throughout this work. In the following analysis, we use the same experimental setup as in Sec. 5.1
Impact of helper example definition. We analyze the influence of different choices for defining helper examples for HAT (refer Algorithm [ We consider the following choices: + or where r is the adversarial perturbation computed at x and a E {1.5, 2.0, 2.5, 3.0, 3.5}. Note that the helper label is always queried at x + r as Algorihum[] !I Selecting a 2.0 means that the helper examples are given by + 2r which represents the setup used in this paper. Fig. [14 illustrates the performance obtained by the resulting HAT-trained models. hinders the model from increasing the margin and hence, the resulting model achieves high clean aceuracy but a slightly poor robust accuracy. a = 2.0 and a 2.5 achieve identical results, and the model does not compromise robustness yet achieves gain in clean accuracy. Further increasing beyond 3.0 leads to a drop in both clean as well as robust accuracy. This is because the resulting training samples might not be well separated and their target labels may conflict with each other.
lower value for a e-g. a = 1.5,
Clean Acc.
Robust Acc.
Clean Acc.
Robust Acc.
08
54
88
06
-52
86
-22
Acc.
84
500
84
-00
Robist Acc.
Robust
Clcan
82-
82
43
80
46
80
46
78
44
78
44
2.00 2.25 2.50
3.50
1.0
1.5 2.0
a: Helppr sample defined as x ar
a:: Helpee label queried at x or
Figure 14: Effect of different helper example definitions. We define helper example x ar. Choosing & = 2.0 corresponds to the setting used throughout this paper and is indi- cated by the red dashed line in the plot. Note that the helper label is still queried +r. We pick 3 = 2.5 for HAT.
Figure 15: Effect of different choices for obtain- ing helper labels. We query helper label V. via a standard model fe... at x + ar. Choosing 1.0 corresponds to the setting used in this paper and is indicated by the red line. Note that the helper example is still defined as æ + 2r. (Solid line): We fix / = 2.5 for HAT. (Dashed); We use a higher 3 with HAT for larger a's.
Ablation study for obtaining helper labels. We perform an ablation study with different choices for obtaining the labels for helper examples during HAT training (refer Algorithm [T]. Specifically, we query the helper label y, via regularly trained model sam. at x + or where r is the adversarial perturbation computed for input and vary E (0.5, 1.0, 1.5,2.0, 2.0, 2.5, 3.0, 3.5). In other words, the helper label is defined as the prediction of the standard model Se.. at x or; whereas the helper example is always defined be x + 2r. Setting a 1.0 recovers the setup used in this work. The results are shown in Fig. 15 (solid lines). For a E {0.5, 1.0, 1.5]. we observe a similar performance relative to that reported in Table 2 With a 2 2.0, the clean accuracy of the robust model slightly increases whilst its robust accuracy starts to degrade. This is because helper labels queried at farther points with a > 2.0 might be much more pessimistic (worst-case) and hence, present more opposition to the robust loss. Thus, we observe a drop in robust accuracy which can be fact addressed by simply increasing the weight of robust loss. This is indicated by the dashed lines in Fig. 15 where increase the weight of robust loss 3 in proportion to the rise in a. Taking this adjustment into account leads to the same performance as that with a = 1.0, indicating that the underlying trade-off still remains the same.
C.6 COMPARISON WITH CHEN ET AL. (202T)
The work by Chen et al. (202)) is closest our approach in the sense that also uses knowledge distil- lation or self-training. However, the standpoint and the way of using is significantly different from
20

---

Published as a conference paper at ICLR 2022
work. We use distillation with motivation prevent excessive margin and benefit clean accu- racy, whilst Chen et al. (2021) uses from the usual perspective of using self-learning to improve generalization and thereby alleviate robust overfitting. Moreover, it applies self-training at the adver- sarial inputs while we apply for overly perturbed helper data. From a computational perspective, of which is adversarially trained,
the approach from Chen et al. (202T) uses two self-teachers, which presents a significant overhead compared to HAT which requires only regularly trained one. In addition, Chen et al. (202I) use model weight averaging which begs a larger number of training iterations to obtain improvements. Empirically, the distillation setup from Chen et al. (202T) which uses two self-teachers attains 83.67% accuracy and 48.03% robustness against AutoAttack. Clearly, HAT outperforms these results by achieving 84.90% accuracy and 49.08% robustness. Moreover, we also replicate their setup with model weight averaging and perform HAT to further improve per- formance. In contrast to their scores of 84.65% accuracy and 49.35% robustness, our proposed HAT obtains 85.69% accuracy and 49.3 49.34% robustness.
21


Reviews:
[{"review_id": "yIqdH0bzQi", "reviewer": "Reviewer_P4Wc", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "### Strengths:\n- Extremely simple method, which can be useful for practitioners.\n- A slight improvement over baseline defences on CIFAR-10 and CIFAR-100 datasets.\n\n### Weaknesses:\n- The method is based on intuition and the authors didn't provide any theoretical justifications for the proposed defence. Based on my intuition, I believe the method is fundamentally flawed as its assumptions are incorrect. For example, it is incorrect to assume that all adversarial examples with perturbations $2 \\epsilon$ should be labelled with its adversarial label.\n- The authors should compare the robustness of their method for moderate size perturbations as well, e.g. $\\epsilon = 12/255$ and $\\epsilon = 16/255$ on CIFAR-10 and CIFAR-100. It is quite likely that their method will be less robust for moderate size perturbations.\n- The overall procedure is ad-hoc and requires training and storing the model trained without any regularization first. The model is then finetuned with the proposed training procedure.\n- Some references are missing and the comparison is outdated. The method should also be compared with [1], [2] and [3] defenses, which improve upon Trades defense.\n- The experimental comparison can be improved. The authors evaluated the models with AutoAttack. The authors can also compare their method against GAMA [4] attack. The authors should also include the gradient masking checks in the experimental results or at least discuss gradient masking.\n\n[1] Amirreza Shaeiri, Rozhin Nobahari, and Mohammad Hossein Rohban. Towards deep learning models resistant to large perturbations. arXiv preprint arXiv:2003.13370, 2020.\n\n[2] Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankanhalli. Attacks which do not kill training make adversarial learning stronger. In International Conference on Machine Learning, pp. 11278–11287. PMLR, 2020.\n[3] Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. Advances in Neural Information Processing Systems (NeurIPS), 2020.\n\n[4] Gaurang Sriramanan, Sravanti Addepalli, Arya Baburaj, and R Venkatesh Babu. Guided Adversarial Attack for Evaluating and Enhancing Adversarial Defenses. In Advances in Neural Information Processing Systems (NeurIPS), 2020.\n\n### Update after the author's response\nThe authors addressed all my concerns. In particular, the authors:\n- Added adversarial robustness results with $\\epsilon = 12$.\n- Added adversarial robustness results with other attacks.\n\nOverall, based on the new results for the larger perturbations and the author's comments to other reviewers, I am discarding my doubts about the paper's approach, that it is somewhat ad-hoc. I believe the empirical contributions of this work are significant and novel. Therefore, I recommend accepting the revised paper.", "summary_of_the_paper": "The authors aim to reduce the gap between clean accuracy without adversarial training and with adversarial training. To improve the robustness-accuracy trade-off, the authors introduce Helper-based Adversarial Training. The main idea is to use adversarial examples $\\mathbf{x}_{\\text{adv}} = \\mathbf{x} + 2 \\mathbf{r}$, where $\\mathbf{r}$ is standard PGD adversarial perturbation, as helper adversarial examples. The model is trained to classify these helper adversarial examples as the adversarial label predicted by the model trained without adversarial training. In the experiments, the authors show that HAT improves clean accuracy and robust accuracy on CIFAR-10 and CIFAR-100 datasets when compared with TRADES defense.", "summary_of_the_review": "The authors proposed a simple technique to improve clean accuracy. However, the method is based on intuition, which in my opinion, is flawed: not all large perturbations should be labelled with its adversarial label. The authors should provide a theoretical justification for their intuition. Besides that, the experimental comparison is outdated with few recent defenses missing, which improve upon TRADES defense.\n\n### Update after the author's response\nI sincerely thank the authors for addressing the majority of my comments and concerns. The experimental results are undeniable and clearly demonstrate the advantages of the proposed technique. Based on the new results for the medium perturbation $\\epsilon = 12$ and additional experiments with other attacks, I tend to overlook my doubts about the paper's approach.\n\nI recommend accepting the revised version of the manuscript.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "sZqouZvlDio", "reviewer": "Reviewer_vhey", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n- The writting is easy to follow, while the illustration of the idea of HAT is clear and reasonable.\n- I especially admire the empirical evaluations in this paper, which involve large-scale experiments using DDPM generated data and 80M TI extra data. The improvements are significant, and the sanity check for, e.g., gradient masking is also presented.\n\nWeaknesses:\n- The modifications introduced in HAT are simple (which is good), but they depend on an assumption that ``the model should not be robust beyond the threat model``. Namely, under an 8/255 $\\ell_{\\infty}$-norm threat model, an adversarial example with 16/255 perturbation is encouraged by HAT to fool the model, while the label of the adversarial example may not change. For me, this assumption is quite ad-hoc, and introducing another standard model $f\\_{\\theta\\_{\\textrm{std}}}$ seems not an elegant solution.\n\nIn conclusion, I think the pros and cons of this paper are quite clear. Strong empirical evaluations and promising improvements, but the method itself is somewhat ad-hoc and not very principled. So I would like to recommend an acceptance, but the method could be further polished.\n", "summary_of_the_paper": "This paper proposes a helper-based adversarial training (HAT) method to alleviate the trade-off between robustness and accuracy. Empirical evaluations are done on several datasets, and under AutoAttack and common corruptions.", "summary_of_the_review": "Strong empirical evaluations and promising improvements, but the method itself is somewhat ad-hoc and not very principled.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "51tXBdYq3KZ", "reviewer": "Reviewer_dhm9", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "**Strengths**:\n* Clean, original and novel idea leading to good experimental results. Very well written paper with a clear story, with clear arguments and experiments to support the story.\n* Very extensive experiments in the main paper and in the appendix. It gives a lot of intuitions about the problem and Lp-norm robustness in general.\n* The proposed analytic tools are useful beyond the analysis of the proposed algorithm. Big plus for the toy problem giving interesting intuitions, the margin analysis in Figure 4 and the per epsilon analysis in Figure 6.\n* The code is attached in the supplementary materials and anyway, the experimental details and code are very well described in the paper. Hence, the paper seems reproducible.\n\n**Weaknesses/Suggestions/Questions**:\n1) In the bullet points in page 2 and other parts of the paper, please specify when the accuracy is the \"clean\" or \"robust\" accuracy. Otherwise, there is an ambiguity.\n2) It would be great to see how the proposed method performs compared to TRADES on larger models such as WRN-70-16. Maybe by fine-tuning an already pre-trained model to avoid expensive computations.\n3) In Figure 6, maybe specify that the variable $\\epsilon$ on the x-axis is used for the test-time robust accuracy and not the training procedure.\n4) In Figure 13 in the appendix, why do the curves TRADES and HAT ($\\gamma=0$) do not match while they are the same method? Is the difference due to the variance in the results?\n5) (Very optional but curious to check) I would be curious to see the performance of an alternative helper: $x' = x + r + r'$ where $r'$ is the adversarial perturbation computed at $x + r$. In this way, helper samples could possibly look more \"natural\" rather than when using $x + 2r$, thus possibly improving the final results. It would require twice as more computations but would be interesting to check.", "summary_of_the_paper": "**Few sentences summary**: the paper proposes a new training loss for adversarial training in the Lp-norm setting. Based on the observation that adversarial training increases the classification margin in a disproportionate manner compared to the nominal training setting, the authors introduce additional samples called \"helpers\" to reduce the classification margin. The helper samples, which are samples translated further away in the worst adversarial direction, can change labels compared to the adversarial samples. Helper samples get assigned labels from a standardly trained model, thus acting as a constraint coming from this standardly trained network.\n\nRegarding the **results** and **contributions**:\n* Novel method using helpers to define a new training loss for adversarial training.\n* On par or better results in robust accuracy compared to the SOTA training loss TRADES on CIFAR-10/100, SVHN, TinyImageNet and a subset of ImageNet.\n* Much improved results in clean accuracy compared to TRADES, thus reducing the gap between clean and robust accuracy which is primordial for the application of Lp norm models to practical uses.\n* Clear analytical tools based on the margin analysis to investigate the proposed method and how/why it works.", "summary_of_the_review": "Paper enjoyable to read with extensive experiments supporting a clear and novel idea leading to improved results. The authors also propose great analytical tools to investigate their hypothesis. Hence, I vouch for acceptance.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "4_R6URpLpSa", "reviewer": "Reviewer_fdwg", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n* The paper is well written and easy to understand. The motivation behind the design choices is clear. All the related works are properly addressed and the baselines are also strong.\n* The paper achieves a significant boost as compared to existing methods on strong attacks like Auto-Attack. The approach shows consistent gains across multiple datasets.\n\nWeaknesses:\n\n* I think the results shown in Figure-4 are quite expected as initially when the perturbations are generated from a standard trained model, they will be non-smooth similar to random noise. Thus the final model will have high invariance to the directions of these random noise as compared to the perturbations which are smooth in nature and have features. These smoother perturbations would be generated by the adversarially trained models and thus the model would be easily fooled as we go in the direction of these perturbations. This is addressed by the Final Margin of figure 4-c. Although the proposed approach reduces the invariance in the directions of the initial perturbations which are similar to random noise, (as shown in table 1, 5 and stated in section 3), I think ideally the model should focus on reducing the invariance in the direction of smooth perturbations which have semantic features. Could the authors clarify a bit on this. I dont think it would matter much if the model will reduce the invariance in the directions of initial perturbations(similar to random noise) since they won't change the semantics of the image to some other class image. While the smooth perturbations which have some semantics and are generated using an adversarial model have the potential to change the semantics of an image and thus change the true class of the image as well as shown in [1] and thus it is desired to reduce invariance in these directions.\n\nSome minor concerns:\n\n* Could the authors clarify how they plotted the class boundaries in figure 3? I think this is plotted by examining the predictions of all the points possible in the 3D space?\n* In table 5 it is shown that the models are trained so that they have the same robustness. I think this is not a good idea for an ideal comparision. Could the authors show the same table with the median margin in R-init , R-5 and R-15 where the models do not have any constraint on having the same robust accuracy. If possible could the authors share the results of table-1 for R-5 and R-15 also.\n* I think the training budget for the results reported in Table 6 is only 50 epochs. If possible could the authors share the results of HAT for all three datasets for 200 epochs training budget? This will help in better understanding the proposed approach. I think the activation used without additional data is ReLU. If this is true could the authors also share the CIFAR10 200 epochs without additional data results for SiLU activation. In case the authors have used SiLU can they share the results with RelU.\n* If possible could the authors share the PRN18 and WRN-28-10 for CIFAR10 and CIFAR100(if possible) results as shown in table 4 using the ReLU activation? This would help in understanding the influence of SiLU activation.\n* An ablation study on using different perturbation bounds for getting the helper label in Algorithm-1 can also help a lot in better understanding the proposed approach.\n\n[1] Tramèr, F., Behrmann, J., Carlini, N., Papernot, N., & Jacobsen, J. (2020). Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations. ArXiv, abs/2002.04599.", "summary_of_the_paper": "The paper highlights the presence of excessive invariance in the prediction of robust models along the initial adversarial directions. Initial adversarial directions refers to the directions in which adversarial images generated using a standard trained model are present. Based on this hypothesis the authors propose a training method where the excessive invariance is minimized using the cross entropy loss between the prediction(made using the standard trained model) of larger epsilon adversarial image and the prediction of the adversarial image, in addition to the TRADES loss formulation. This additional loss term indeed improves the accuracy-robustness trade-off by giving a significant boost in clean accuracy along with a slight boost in adversarial robustness as compared to the existing methods. Overall the paper is well written and easy to follow.", "summary_of_the_review": "Overall I think the paper is well written. It shows a significant boost as compared to existing art and has some minor issues at present.\nIf the concerns are properly addressed I am willing to increase my score.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The authors propose a simple addition to adversarial training methods that improves model performance without significantly changing the complexity of training.  The initial reviews raised some questions about whether experiments were sufficiently extensive, but these issues were resolved during the rebuttal and discussion period, resulting in a strong consensus that the paper should be published.
Decision: Accept (Poster)