Cycle monotonicity of adversarial attacks for optimal domain adaptation
Authors: Arip Asadulaev
Vitaly Shutov
Alexander Korotin
Alexander Panfilov
Andrey Filchenkov
Venue: ICLR 2022 Submitted (2022)
Keywords: Optimal Transport
Domain Adaptation
Adversarial Attacks

Abstract: We reveal an intriguing connection between adversarial attacks and cycle monotone maps, also known as optimal transport maps. Based on this finding, we developed a novel method named source fiction for semi-supervised optimal transport-based domain adaptation. In our algorithm, instead of mapping from target to the source domain, optimal transport maps target samples to the set of adversarial examples. The trick is that these adversarial examples are labeled target samples perturbed to look like source samples for the source domain classifier. Due to the cycle monotonicity of adversarial attacks, optimal transport can naturally approximate this transformation. We conduct experiments on various datasets and show that our method can notably improve the performance of optimal transport methods in semi-supervised domain adaptation. 

Under review as a conference paper at ICLR 2022
CYCLE MONOTONICITY OF ADVERSARIAL ATTACKS FOR OPTIMAL DOMAIN ADAPTATION
Anonymous authors Paper under double-blind review
ABSTRACT
We reveal an intriguing connection between adversarial attacks and cycle mono- tone maps, also known as optimal transport maps. Based this finding, devel- oped a novel method named source fiction for semi-supervised optimal transport- based domain adaptation. In our algorithm, instead of mapping from target the source domain, optimal transport maps target samples to the set of adversarial examples. The trick is that these adversarial examples are labeled target samples perturbed to look like source samples for the source domain classifier. Due to the cycle monotonicity of adversarial attacks, optimal transport can naturally ap- proximate this transformation. We conduct experiments on various datasets and show that our method can notably improve the performance of optimal transport methods in semi-supervised domain adaptation.
INTRODUCTION
Optimal Transport (OT) is a powerful framework to solve mass moving problems for probability distributions. Over the past decades, it has been successfully applied in mathematics (Ferradans) al. 4).14), economics (Reich) 2013) and machine learning (Arjovsky et al. 2017, Mroueh 2019] Solomon et al. [015 Colombo et al. (2021). The key property of OT maps is cycle monotonic- ity (McCann] 1995). such maps cannot improved; is impossible to perturb it and get something more economical [Villani 2008 85).
In machine learning, OT finds a rich application domain adaptation (DA) problem (Courty et al, 2015 Perrot et al.) 2016 Rakotomamoniy et al. 2020). In DA, the task is to learn model fe. c.g., a classifier, from a source domain Q2 to perform well on different (related) target domain 2 (Ben-Davide map f4 >> 22, to transform target domain 24 to source Ω2 and then apply the model fo to mapped samples.
al.; (2010a). The conventional OT approach for domain adaptation is use OT
With few labeled samples in target domain Ssemi we can apply semi-supervised domain adapta- tion (Wang & Deng. 2018). For semi-supervised OT, labels are used to prevent the transportation of the target sample into the source sample from another class (Courty et al.) 2016 Yan et al.) 2018). But labels do not provide supervision for the map between two domains because supervision volves input-output pairs, and labels do not give such pairwise matching between source and target samples. Moreover, supervision for OT has to involve cycle monotone matching between source and target samples and save the class-wis structure.
In our paper, we propose an algorithm we call source fiction that provides cycle monotone supervi- sion to OT and improves the performance of OT in semi-supervin DA. The core of this algorithm our finding that adversarial attacks (Szegedy al. 2014), more precisely Iterative Fast Sign Gra- dient Descent (Goodfellow al. 2014 FSGD) are cycle monotone transformations over the dataset with quadratic cost.
We propose to replace source domain Q, with domain R2 that is constructed by the adversarial attack on labeled samples in target domain Qeems to be accurately classified by source domain classifier fo- Since domain 12 is cycle monotone transformation of the target domain Zoemi. it becomes natural to use Quemi + Oy as supervision for OT mapping and then use the resulted map to transport from target domain without labels to Ry.

---

Under review as a conference paper at ICLR 2022
The main contributions of this paper are: (i) We prove that adversarial attack produces cycle monotone transformation of the dataset (Section 3); (ii) We propose a novel source fiction algorithm for OT-based semi-supert supervised domain adaptation. The algorithm incorporates the adversarial attack to the conventional pipeline of OT for DA (Section 4).
BACKGROUND AND RELATED WORK
2.1 ADVERSARIAL. ATTACKS
Adversarial examples are samples that are similar to the true samples D(I,x') S but "fool" selected classifier and tend it to make incorrect predictions argmax x') * Yuue (Szegedy al., 2014). The phenomenon of the vulnerability of machine learning models to adversarial examples breeds great deal of concern many learning scenarios (Papernot al. 2017 Yuan et 2019
Schott et al. 2019 Xie et al. 2017).
large body of work on adversarial attacks exists; in our paper, we consider Fast Sign Gradient Descent (FSGD) by Goodfellow et al. (2014); iterative version of FSGD can be presented as
2/0 = x. x' i+1 = clip,,, {a's - sign L (6, x' v))}
With sample I, the target label and classifier f with parameters 0, we can obtain adversarial examples using gradient descent, by solving the min-max problem, maximizing the loss and minimizing perturbation for a sample æ in some class y with respect to some perturbation size e.
Newly, various properties of adversarial examples were studied (Petrov Hospedales) 2019 Paper- not et al. 2016 llyas et al. 2019), and applications of adversarill examples for models accuracy improvements were proposed (Xie et al. 2019 Yang al. 2020).
Previously connection of OT and adversarial examples were studied in the context of robustness problems (Pydi & Jog 2020 Bouniot al. (02T). Wong et al. (2019) proposed the idea of Wasser- stein adversarial attack with Sinkhorn iterations; this algorithm allows to find adversarial perturba- tions with respect to Wasserstein ball.
2.2 OPTIMAL TRANSPORT
OT aims at finding solution to transfer mass from one distribution to another with the least effort. Monge's 's problem was the first example of the OT problem and can be formally expressed as follows:
inf T T Sup
(xxx(xx))((xxdx
(2)
The Monge's formulation of OT aims at finding mapping T Ω2 - S2 of the two probability measures μ and / and a cost function e 22 x Ω - R4, where ## = 1/2 represents the mass preserving push forward operator. In Monge's formulation, T cannot split the mass from a single point. The problem is that with such constraints, the mapping T may not even exist.
To avoid this problem, Kantorovitch proposed relaxation (Villani 2008). Instead of obtaining mapping, the goal is to seek joint distribution over the source and the target that determines how the mass is allocated. For given cost function S2 S2 + R,, the primal Kantorovitch formulation can be expressed as the following problem:
eEl((a)) (1 c(x, y(x,))) = [cxx,))
min
In primal Kantorovitch formulation, we look for a joint distribution 7 with μ and μ marginals that minimize the expected transportation cost. If the independent distribution 7(x, (y)))(y) respects the constraints, linear program convex and always has solution for semi-continuous
IT (14 v) {7 7E (w) ((x.8)dy== u(x), / y)dx =(x))
(4)
2

---

Under review as a conference paper at ICLR 2022
The primal Kantorovitch formulation can be also presented in dual form stated by the Rockafellar-
Fenchel theorem (Villani 2008):
(EC(O,,) cddu + /idee Φ(x)) + v(y) S c(x,5)}
max
(5)
After finding a solution to the transport problem, OT provides measure of dissimilarity between the two distributions. This similarity is also called the Wasserstein distance (Villani) 2008):
( c(x,y)d
W (Hs. v/) 1/)=
min yEll(p))) R,
(6)
where y) =||= y/1 and > 1. The Wasserstein distance encodes the geometry of the space through the optimization problem and can be used on any distribution of mass.
The main geometric property of the OT is cycle monotonicity. Informally, c-cycle monotone plan is a plan that cannot be improved, for all points
Fi, y0 ... holds:
Σ c yx) S
Σ (xx,
It is impossible to perturb it and get something more economical (Villani 2008 35).
2.3 OPTIMAL TRANSPORT FOR DOMAIN ADAPTATION
Domain Adaptation: DA techniques try to make the target domain S4 samples X₂ = -xx{) be closer to the source domain Ω2 samples X, = (x)) to make the source classifier Sa perform ac- curately on the target domain (Ben-David et 22100a b Germain et al. 2013). In semi-supervised
settings, target domain Asemi consists of unlabeled samples X, (a Di and small number of samples X₁ = ( associated with labels Y = (u!),=) These labels can be used to train DA algorithm match target samples with source samples that have the same labels.
Different discrete OT algorithms can be applied for domain adaptation (Courty et al. 2015). For example, Earth Mover's Distance (EMD) (Courty et al.] 2015 Flamary et al. 202 sol solves the most typical primal Kantorovich OT problem (equation 4). This method seeks an optimal coupling Y which minimizes the displacement cost between two domains with respect to some distance.
Sinkhorn algorithm (Cuturi 2013) and its variations with a group lasso regularization (LIL2) and Laplacian regularization (LILP) (Courty et al. (015) OT algorithms that apply lightspeed com- putation OT DA. |Perrot et al. (2016) proposed Linear OT mapping estimators (MapT) that jointly learn the coupling 7 equation and transport map T linked the original Monge prob- lem equation]]
In semi-supervised DA with OT, labels are used to penalty the transport Ω Uxemi (7) (r. M) by n, X n, cost matrix M) where ji. = 0 when y = u/ and +oo otherwise (Courty et al. 2016 Yan al. 2018). In domain adaptation with label and target shift, OT was used to alrgn probability distributions even for a few domains (Redko et al. 2019, Rakotomamoniy et al., 2020). Most of
these algorithms are presented POT library (Flamary et al. (021), which provides state-of-the-and OT algorithms to solve the domain adaptation.
Discrete OT: Different discrete OT algorithms can applied for domain adaptation (Courty al. 2015). For example, Earth Mover's Distance (EMD) (Courty et al. 2015) Flamary et al. 2021 solves the most typical primal Kantorovich problem (equation[4) (4). This method seeks an optimal coupling 7, which minimizes the displacement cost between two domains with respect to some distance.
Neural OT: The connection between OT and deep networks was proposed for unsupervised domain adaptation (Damodaran et al. 2018)) and representation transfer between teacher and student in trans- fer learning (Li et al. 2020). It was also shown that mini-batch learning that is correctly applied in deep learning can employed to OT for efficient measure between data distributions (Fatras et al. 2021].
3

---

Under review as a conference paper at ICLR 2022
Recently, there has been a solid push incorporate Input Convex Neural Networks (ICNNs) (Amos et al. 2017) in OT problems. According to Rockafellar's Theorem [Rockafellar 1966). every cycli cal monotone mapping g is contained in sub sub-gradient of some convex function f X' + R. Fur- thermore, according to Brenier's Theorem (Theorem 1 1.22 of ofSSataamboogoo (2015), these gradients uniquely solve the Monge problem equation Following these theorems, range of approaches plored ICNNS as parameterized convex potentials in dual Kantorovich problem equation Taghvaei & Jalali 2019;
Makkuva al. 2020).
Further development of this approach enabled the construction of the non-minimax Wasserstein-2 generative framework (Korotin al. 2019) that can solve domain adaptation and Wasserstein-2 Barycenters estimation (Fan et al.J [0200] Korotin et al. (021b). Compared to discrete OT, neural methods provide generalized OT methods that can ensure out-of-sample estimates.
In our paper, in comparison to this method, we do not propose new domain adaptation algorithm, new OT algorithm, adversarial attack and defense based on OT. We presented connection be- tween OT and adversarial attacks and showed how this connection can be used for semi-supervised OT.
CYCLE MONOTONICITY OF ADVERSARIAL ATTACKS
This section demonstrates the cyclical monotonicity adversarial attacks. prove that with mild assumptions on the attack, it is cycle monotone w.r.t. the quadratic cost c(a, = 1 $||a: yl
Lemma 1 (Cycle monotonicity of small perturbations of a dataset.). Let 21...., IN RD be dataset of N distinct samples. Let x'1....,''' be its S e-perturbation, i.e. || - 2'all S for all n = ,. Assume that e < min ||<En Inall i.e. the perturbation does not exceed 1 of 2 mi.92
N.
the minimal pairwise distance between samples. Then for all K and 1, N it holds:
K
K
Inne - s'n,11
I'n 112 I
(8)
2
iee set (x1,21). (IN, xnx) or, equivalently, the map vk + Ioki is cycle monotone.
Proof. Due triangle inequality for ||- we have | x
||
Tnami
| |
I'antall
(9)
22c
Taking the square both sides and summing equation
9 for -1,2.... K yields
K
Fan
1
2 2= Ke?
(10)
Due to the assumptions of the lemma, the following inequality holds true:
Fm
"'a,''
11
<
2
ke..
(11)
k=1
We combine equation 10 and equation
11 to obtain
K
K
ITn 4/12 11
|
k=
which is equivalent to
K c(Fm Fnn <
K cl (n wheas)
(12)
1=1
and yield cycle monotonicity w.r.t. quadratic cost c(2,,) 2/1100 y112.
4

---

Under review as a conference paper at ICLR 2022
Adversarial attacks are small perturbations of the dataset, therefore, immediately obtain
Corollary 1. Let di ,i,..., NN E RRD be dataset of N distinct samples. Then any udversarial atlack Zn + Inn on the dataset with S min || Ingll is cycle monotone.
Corollary D suggests using the optimal map to transform target domain S2 to domain G2 formed by the syycle-monoton adversarial attack.
4 SOURCE FICTION ALGORITHM
Standard settings
Proposed method
Class 0
Clazs
Source Domein f
Target Domain 0g
Figure 1: Visual example of adaptation with source fiction. Each object in target domain is closest the corresponding object source fiction domain terms of some distance.
Algorithm 1: Source fiction for optimal domain adaptation
Input: Classifier fe. optimal transport algorithm OT, source Qg, labeled X; and unlabeled X, samples in target domain Qgemis empty set X perturbations size Initialize: S min || Ing || for z,, in X₁
n1."g
Pretrain classifier fo on source Q, domain X₃ Y, pairs.
for x. in (X1, Yi) do
for steps n, n.....N N do
z/6 x, x' = clipa,c (x', sign (V,L (0, (0,2,, end for
Append x' examples to X, end for
Return: Domain f2 Find a map 2semi + S2g using OT.
Apply the classifter fo samples X, mapped from X,,
In the previous section, considered that adversarial attack applies cycle- mole-moontooe transformation over the dataset. In this section, we propose an application this property for DA. To manage this property, we propose replace the source domain with the domain that is cycle monotone the target domain, and at the same time, accurately classifying by source domain classifier. Due to the vulnerability of machine learning models to perturbation, classified in practice, in the same way we create adversarial examples.
any sample into accurately
In our method, we propose to targeted FSGD adversarial attack (equation 1 source domain classifier Sa. with target label equal to the true class of the given sample. Such attack adds to the image features of the class which the image really belongs (Ilyas al., 2019). Applying attack using labeled target samples X; (i with y value in equation lequal the true class,
we obtain a new domain Q, with samples X, = (x. M that are examples of cycle monotone transformation of the target domain samples, and at the same time accurately classifying by source
5

---

Under review as a conference paper at ICLR 2022
domain classifier fa- Following corollary to obtain monotonicity, the size of perturbation is set $ 1 min || - -n, for all 2n in X₁.
2 101.222
As a result, for each sample in the labeled target domain, we obtain a corresponding sample in Ω2-- While f is cycle monotone the target domain, we have low quadratic cost between each target sample and its corresponding sample in Oy and a higher quadratic cost between this sample and all other samples in y. To apply adaptation of classifier fo on the target domain samples without labels 24 we use OT to find map between Qsemi to S2,, and then apply transport on samples without labels Ωz.
Figure I demonstrates the difference between standard DA by OT and DA using source fiction. The pipeline of learning OT for DA using source fiction 22 is presented in Algorithm [
5 EXPERIMENTS
In this section, present details and the results of the experiments. The goal of our experiments to demonstrate that our algorithm can improve the performance of fundamental discrete OT algo- rithms and novel neural networks based OT methods.
5.1 DATASETS
Digits datasets: We evaluated our method on Digits datasets MNIST (LeCun & Cortes 2010). USPS (Hull 1994). SVNH (Netzer et al., 2011), and MNIST-M (Ganin & Lempitsky] 2015). The experiments are conducted using two settings on each dataset: (1) optimizing OT using available labels to find map between target and source domains and (2) optimizing OT to find a map between target and source fiction domains. Each dataset consists of 10 classes of digits images with different numbers of train and test samples.
Besides the Digits dataset that consists of only ten classes in each domain, we tested the performance of OT with the source fiction method on the Modern Office-31 dataset (Ringwald & Stiefelhagen/ 202TI) The Modern Office-31 dataset one of the most extensive and diverse datasets for domain adaptation, with 31 classes in three domains: Amazon (A), Synthetic (S), and Webcam (W). Compared to the Digits and original Office-31 dataset (Saenko et al. 2010), this dataset includes synthetic real transfer tasks, which is problematic. In our experiments, used DLSR (D) domain from the original Office-31 31 to properly estimate the proposed algorithm.
Modern Office-31 dataset:
5.2 SETTINGS
Source classifier: For the source domain classifier, we trained ResNet50 (He et al. (2016) to achieve 90+ accuracy on the test set of each domain Digits and Modern Office-31 dataset. The classifier was trained using Adam (Ruder 2016) optimizer with 1e-3 learning rate, the size of latent space before the output layer was set equal to 2048. After training, we applied domain adaptation by moving mass in the latent space of the source classifier.
Discrete OT: We tested several OT algorithms that apply semi-supervised adaptation: EMD, Sinkhorn, SinkhoraLIL22, Sin,hornLPI.2, and MapT. For experiments, used the POT library with quadratic cost distance in each method. Regularization size was equal to for Sinkhorn, Sin,hornL SinkhornLPL2, and MapT; all other hyperparameters were similar to the de- fault, presented in POT. For source fiction, we used 50 steps FSGD with equal to 0,45, we find that such value allows achieve strong perturbations and at the same time mostly satisfies S 2 min ||r,, Ina requirement for all domains. The results are presented in Table 1. All m1.02
results are averaged over ten runs with different sets of labeled samples in the target domain. The top part of the table represents standard settings the bottom part presents results using source fiction. It is important to note that for mapping target to source, available target domain labels were used in OT solvers to apply regularization (Courty et al.) 2015 85).
Neural OT: Following recent benchmarking results of neural OT (Korotin et al. 2021al choose two methods to apply domain adaptation: W2GN (Korotin et al. (2119) and MMMR Nhan Dam Korotin al. 2021a). As potentials & and d in neural OT methods, used Dense
al. 2019

---

Under review as a conference paper at ICLR 2022
ICNN (Korotin al. 2019) with three hidden layers [64, 64, 32] for W2GN and MM.R methods. Potentials were pertained to apply invariant transformation using Adam optimizer with ir equal to le-4. For Wasserstein's objective, potentials were trained 300 epochs with Adam optimizer and ir equal to le-3. The results are presented in Table 2, the top part of the table represents standard settings with 10 and 100 known lahels per class, and the bottom part presents results using source fiction. In setting with the target to source mapping, labels were used to build class wise pairs.
METHOD
MNIST SVIIN
SVHN MNIST
MNIST USPS
USPS MNIST
MNIST M-MNIST
87.37
EMD
21.2
68.7
79.2
79.48
$6.1
SINKHORNLPLI
21.8
68.8
84.8
82.73
55.7
SINKHORNL.I12
21.8
68.8
84.8
82.73
55.7
MAPOT
21.8
84.
62.3
EMD
23.0
86.3
83.1
92.8
62.7
SINKHORN
62.9
LI
25.5
86.3
88.3
93.0
63.0
SINKHORNT.II.2
25.5
86.3
88.3
93.0
63.00
MAPOT
25.5
88.4
89.3
64.5
AVERAGE BOOST
13.1
20.3
4.1
12.0
9.7
Table 1: Accuracy of domain adaptation by optimal transport in the latent space of ResNet50 model with the known labels for each class in the target domain on Digits datasets.
METHOD
MNIST SVHN
SVHN MNIST
MNIST USPS
USPS MNIST
MNIST M-MNIST
W2GN TO)
79.9
91.2
MM:R (10)
20.3
80.1
78.0
90.0
63.8
W2GN (100)
20.4
79.9
89.1
91.2
74.1
MMR 20.3
80.2
90.2
63.8
W2GN (10)
21.3
70.6
63.8
89.6
54.2
MM:R (10)
75.1
85.3
W2GN (100)
24.4
74.4
85.1
92.0
68.5
MM:R (100)
21.5
79.1
79.1
89.2
70.3
Table 2: Accuracy of domain adaptation by Neural OT in the latent space of ResNet50 model with the 10 and 100 known labels for each class in the target domain Digits datasets.
METHOD
W
D
S
W
W
A
D
W
S
TARGET
67.9
44.3
6.2
70.3
41.6
3.0
80.8
45.6
EMD
50.7
46.2
38.4
9.3
45.2
45.6
32.7
16.4
62.6
67.1
13.6
36.7
SINKHORNLPLI
51.1
46.7
38.1
10.4
45.2
45.3
33.0
16.5
63.8
68.3
13.1
37.2
SINKHORNLIL2
51.1
46.7
38.1
10.4
45.0
45.3
33.0
16.5
63.8
68.3
13.1
37.2
МAPT
45.8
48.0
37.1
11.0
38.7
47.5
36.5
4.1
61.8
39.6
EMD
70.9
72.5
56.8
29.7
64.9
73.9
56.6
47.3
75.7
75.1
40.1
60.1
72.7
73.9
74.8
SINKHORNEPLI
70.6
72.8
57.2
31.0
65.2
74.0
56.8
47.3
77.4
75.5
40.1
60.1
SINKHORNLIL2
70.6
72.8
57.2
31.0
65.2
74.0
56.8
47.3
77.4
75.5
40.1
60.1
MAPT
71.3
73.6
58.5
29.8
65.2
74.4
59.8
47.3
76.6
75.1
40.1
AVR BOOST
29.4
35.8
33.8
66.3
32.7
38.0
41.4
70.3
18.2
11.5
70.4
38.0
Table 3: Results of domain adaptation in the latent space of ResNet50 model on Modern Office-31
dataset semi -unniiiueeeiiee settings with the 10 known labels for each class the target domain.
5.3 RESULTS
Our results show that adversarially based source fiction improves the performance of OT. For Digits datasets, our approach achieves improvements on all domains, even MNIST-SVHN domain adap- tation, which a complicated transformation task. Generally, the simplest EMD method achieved less accuracy and MapT method accuracy slightly higher for all domains; group lasso and Laplacian regularizations for Sinkhorn did not provide notable improvements. The mean and std of our results less than 10% for all experiments. On average, our method achieves mean improvement equal to 32.7 7 for all adaptation tasks, with min improvement value equal to 4.1 and max value 70.4, The results with only known labels in class presented in Appendix

---

Under review as a conference paper at ICLR 2022
MNIST USPS
USPS MNIST
100
05
90
05
PSGD
DHD
[HD
Smrnio
Sinthmmpp
0.5
MNIT to SVHN
MMNIST MNST
90
20
03
FSGD
FSGD
Sinthomipn SishhmL10
Senthomppp
SminomL12
0.1
025 03 0.35 04
3.0 5.0
60
7.0
apsioo
apallon
Figure 2: Results of ablation parameter for MNIST to M-MNIST (left) and SVHN to MNIST (right) datasets. FSGD denotes how accurately the source domain model classifies source fiction domain obtained with different value.
In opinion, method advances the performance while OT applications for moving sume closeness of source Ω2 and target Q4 distributions (Lee et al.] (201)). This assumption does not hold many empirical datasets, especially in some Digits and Modern Office-31 domains.
While OT maps are cycle monotone, i.e., exhibit a specific structure of the map. thus, transportation 2 Ω via OT maps might not apply some problems,
(Courty et al. [013 Figure 3)
for counter-examples. Also, discrete OT techniques are susceptible to regularization terms (Courty
al. 2015 Dessein et al. 2018 Paty & Cuturi 2020) and require special scaling (Meng et al. 2021
As shown in our results, the performance of Neural OT methods is less dependent on the mono- tonicity of the target domain. It is known that neural networks are data- data-intensive; using the source fiction domain as target, we have less training data, which makes optimization harder. However, in case with a higher number of labeled samples in the target domain, source fiction outperforms the standard settings for Neural OT.
While adversarial examples via FSGD are noisy, there appear problems with learning Neural OT on this data. We hypothesize that adversarial training (Goodfellow et al., (014) for robust source classifier can be a solution for this problem. Adversarial attack on robust models allows interpolation between classes and the generation of new data points that are close to human perception (Tsipras) et al. 2019). It has been shown that this property be used for image generation, image-to- image translation, in-painting, and super resolution (Santurkar et al.). With robust source classifier source fiction domain will contain less noisy samples, which improve the accuracy of Neural OT methods.
5.4 ABLATION STUDY
In this section, we show the adaptation results with different e values in the FSGD algorithm. We evaluated few transportation tasks: MNIST to USPS, USPS to MNIST, MNIST to M-MNIST, and
MNIST SVHN datasets with different values of c. The value of 1 min || Ina || is various Ri.
for different datasets, for SVHN this value 0.74, for MNIST is 0,29, for M-MNIST is 10.9 and for USPS is equal to 0.85. These values were computed in the latent space of the ResNet50 classifier trained on the corresponding dataset. For each domain, we applied source fiction with different values of and then fit OT to find map between target and source fiction domain. Our results
8

---

Under review as a conference paper at ICLR 2022
show trade-off between the size of perturbations and the cyclical monotonicity of the resulted domain. See the adaptation accuracy with different in Figure 2 It can be noticed that when the value becomes larger than y min distance between samples, the accuracy of adaptation decreases since the set becomes less monotone. However, with a small value c, the adaptation achieves the highest accuracy.
6 CONCLUSION
We propose an algorithm that modifies domain adaptation toward making target data closer to the domain formed by adversarial attack. We conducted a range of experiments on different datasets and showed that the OT method works more efficiently in conjugate with our method. In some domains for discrete OT methods, adaptation with source fiction achieved dramatic improvement. The main limitation of our approach is that necessary to have access to the labels in the target domain.
Multi-domain adaptation: Usually, in DA, is necessary to modify classifier architecture and train separately each target domain (Ganin & Lempitsky 2015 Long et al. 2018: 2013 [017 Gretton et al. 2012). OT solves DA by moving target domains samples closer to the source data, and it is unnecessary change or fine-tune the source classifier. this paper, we presented an algorithm that improves OT performance, which means that a single source domain classifier can be used to make predictions on a range of target domains more effectively.
Data privacy: Nowadays, data are shared on separate devices and usually contain personal infor- mation, which is inefficient for data transmission and may violate data privacy. [Liang et al. (2020) address challenging DA setting without access to the source data for higher privacy. In our method, we adapt the source classifier to the new domain without access to the source data, which can also help avoid privacy issues.
Future work: Our method admits many straightforward applications:
Neural OT for adversarial examples generation; fast generation of shareable adversarial examples in a framework similar to Attack-Inspired GAN (Bai et al. (202)) with additional supervising using gradient-based adversarial examples. See experiments using discrete OT for this task in Appendix A.I
In our settings, discrete OT methods showed impressive results in domain adaptation with a low number of labeled samples; this ability can be used for low data image recogni- tion, where OT learns map test dataset to the accurately classifying samples for model learned on train dataset. Such experiments on digits and CIFAR-10 datasets are presented in Appendix A.2 A.2
While OT can solve domain adaptation with target shift and unbalanced classes (Redko) et al. 2019 Rakotomamoniy al. 2020), promising directions is using of source fiction for such problems too.
We expect our research to contribute the development less complicated domain adaptation tech- niques and open doors for the future application of adversarial attacks cycle monotonicity.
7 ETHICS
There is currently no regulatory framework for the use adversarial attacks machine learning environment. Adversarial attacks can be used in real-world scenarios and can harm infrastructures with machine learning models in the pipeline. On the contrary, we examined the adversarial at- tack property and showed how this technique learning models. We do not provide any new methods for adversarial attacks or protection against them.
be used to improve the performance of machine

---

Under review as a conference paper at ICLR 2022
8 REPRODUCIBILITY
To reproduce experiment provide source code in supplementary materials, run / /tt/uuuuueerrereeeeeeeeeeee www.eeeeeese.sseee to start the training process. Details on used hyperparameters are presented in Section 52
REFERENCES
Brandon Amos, Lei Xu, and J. Zico Kolter. Input convex neural networks. In Doina Precup and Yee Whye Teh (eds.). Proceedings of the 34th International Conference on Machine Learning, ICML 2017, Sydney, NSW, Australia, 6-11 August 2017, volume 70 of Proceedings of Machine Learning Research, pp. 146 155-155. PMLR, 2017. URL /tL/ttp::/prrceedingg v7C/amos aaas 7b. html
mlr. press/
Martin Arjovsky, Soumith Chintala, and Léon Bottou. Wasserstein generative adversarial networks. In International conference on machine learning, pp. 214-223. PMLR, 2017.
Tao Bai. Jun Zhao, Jinlin Zhu, Shoudong Han, Jiefeng Chen, Bo Li, and Alex Kot. Ai-gan: Attack- inspired generation of adversarial examples. In 2021 IEEE International Conference on Image Processing (ICIP), pp. 2543-2547. IEEE, 2021.
David Belanger and Andrew McCallum. Structured prediction energy networks. In Maria-Florina Balcan and Kilian Q. Weinberger (eds.), Proceedings of the 33nd International Conference on Machine Learning, ICML 2016. New York City, NY, USA, June 19-24, 2016, volume 48 of
JMLR Workshop and Conference Proceedings, pp. 983-992. JMLR.org, 2016. URL URLhttp: iiproceedings.. ml wtt....pe.e//////eaeea///
html
Shai Ben-David, John Blitzer, Koby Crammer, Alex Kulesza, Fernando Pereira, and Jennifer Wort- man Vaughan. A theory of learning from different domains. Mach. Learn., 79(1-2):151- 175, 2010a. doi: 10. 10.10077/119994-09-51222 610994-009- 5152--4
URL httts:://cc..rg///// 1007/
Shai Ben-David, Tyler Lu, Teresa Luu, and Dávid Pál. Impossibility theorems for domain adap- tation. In Yee Whye Teh and D. Mike Titterington (eds.), Proceedings International Conference Resort, Sardinia, Italy, May 13-15, 2010, volume JMLR.org, 2010b. URL http:::ppppceeeeeeeeeeeee
Thirteenth Artificial Intelligence and Statistics, AISTATS 2010, Chia Laguna
JMLR Proceedings, pp. 129 136. mlr www.presssssee /veess//v/// david//dvidaaa.... html
Quentin Bouniot, Romaric Audigier, and Angelique Loesch. Optimal transport defense against adversarial attacks. In 2020 25th International Conference on Pattern Recognition (ICPR), pp. 5044-5051. IEEE, 2021.
Pierre Colombo, Guillaume Staerman, Chloe Clavel, and Pablo Piantanida. Automatic text evalua- tion through the lens wasserstein barycenters. arXiv preprint arXiv:2108. 1tt.:21088.146,, 2021.
Nicolas Courty, Rémi Flamary, Devis Tuia, and Alain Rakotomamonjy. Optimal transport for do-
main adaptation. CoRR, 0bs//507.00504 2015. URL
00504
Nicolas Courty, Rémi Flamary, Devis Tuia, and Alain Rakotomamoniy. Optimal transport for do- main adaptation. IEEE transactions pattern analysis and machine intelligence. 39(5):1853- 1865, 2016.
Marco Cuturi. Sinkhorn distances: Lightspeed computation of optimal transport. In Christopher C. Burges, Léon Bottou, Zoubin Ghahramani, and Kilian Q Weinberger (eds.), Advances in Neural Information Processing Systems 26: 27th Annual Conference on Neural Information Processing Systems 2013. Proceedings of meeting held December 5-8, 2013, Lake Tahoe, Nevada, United htt.://wwwe....................e paper/ cc/paper/
States, pp. 2292 2300, 2013. URL ht httpp::/ppocceiiinneieeeo//oo/ee
10

---

Under review as a conference paper at ICLR 2022
Bharath Bhushan Damodaran, Benjamin Kellenberger, Rémi Flamary, Devis Tuia, and Nicolas Courty. Deepjdot: Deep joint distribution optimal transport for unsupervised domain adapta- tion. In Proceedings of the European Conference Computer Vision (ECCV), pp. 447-463, 2018.
Arnaud Dessein, Nicolas Papadakis, and Lean-Luc Rouas. Regularized optimal transport and the rot mover's distance. The Journal of Machine Learning Research, 19(1):590-642, 2018.
Jiaojiao Fan, Amirhossein Taghvaei, and Yongxin Chen. Scalable computations of wasserstein barycenter via input convex neural networks. CoRR, abs/2007.04462, 2020. URL https:
/ //axxiv.org/////.a.lv.a..... (argg/bss/200
04462
Kilian Fatras, Thibault Séjourné, Rémi Flamary, and Nicolas Courty. Unbalanced minibatch optimal transport; applications to domain adaptation. In International Conference on Machine Learning,
pp. 3186-3197. PMLR, 2021.
Sira Ferradans, Nicolas Papadakis, Gabriel Peyré, and Jean-François Aujol. Regularized discrete optimal transport. SIAM Journal on Imaging Sciences, 7(3):1853-1882, 2014.
Rémi Flamary, Nicolas Courty, Alexandre Gramfort, Mokhtar Zahdi Alaya, Aurélie Boisbunon, Stanislas Chambon, Laetitia Chapel, Adrien Corenflos, Kilian Fatras, Nemo Fournier, al. Pot: Python optimal transport. Journal of Machine Learning Research, 22(78):1-8, 2021.
Yaroslav Ganin and Victor S. Lempitsky. Unsupervised domain adaptation by backpropagation. In Francis Bach and David M. Blei (eds.), Proceedings of the 32nd International Conference on Machine Learning, ICML 2015, Lille, France, 6-11 July 2015, volume 37 of JMLR Workshop and Conference Proceedings, pp. 1180-1188 1189. JMLR.org, 2015. URL mlr www.s/v37/cc.. ganinni html
Pascal Germain, Amaury Habrard, François Laviolette, and Emilie Morvant. A pac-bayesian ap- proach for domain adaptation with specialization to linear classifiers. Proceedings of the 30th International Conference on Machine Learning, ICML 2013, Atlanta, GA, USA, 16-21 June 2013, volume of JMLR Workshop and Conference Proceedings, pp. 738-746. JMLR.org. 2013. URL http://proceed/ ngs mm press /t////2//////// inmaainl33. 1113.n33.mm 1.3... html
Ian J Goodffllow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.655 2014.
Arthur Gretton, Karsten Borgwardt, Malte Rasch, Bernhard Schölkopf, and Alexander Smola. A kernel two-sample test. J. Mach. Learn. Res., 13:723-773, 2012. URL http:
7/dl. acm. www...ooog/.aaaiiinccooioooo cfmidd 2188410
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference computer vision and pattern recognition, pp.
770-778, 2016.
Hull. A database for handwritten text recognition research. IEEE Transactions on Pattern Analysis and Machine Intelligence, 16(5):550-555 554, 1994, doi: 10.1109/34.29144))
Andrew lyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examlees are not bugs, they are features. CoRR, 000b/1995.0215,, 2019. URL
02175
Alexander Korotin, Vage Egiazarian, Arip Asadulaev, and Evgeny Burnaev. Wasserstein-2 gen- crative networks. CoRR, abs/1909.13082 2019. URL http://arxiv.org//eeee
13882
Alexander Korotin, Lingxiao Li, Aude Genevay, Justin Solomon, Alexander Filippov, and Evgeny Burnaev. Do neural optimal transport solvers work? a continuous wasserstein-2 benchmark. arXiv preprint NXKYv2110600999 2021a.
Alexander Korotin, Lingxiao Li, Justin Solomon, and Evgeny Burnaev. Continuous wasserstein- barycenter estimation without minimax optimization. CoRR, abs/2102.01752, 2021b. URL
https://arxiin http:////aaxi.oorr////////0.2..

---

Under review as a conference paper at ICLR 2022
Y. LeCun, S. Chopra, R. Hadsell, M. Ranzato, and F. Huang. A tutorial energy-based learning. Predicting Structured Data, 2006.
Yann LeCun and Corinna Cortes. MNIST handwritten digit database. 2010. URL httt:::/://an
lecun commexxb/mmiice
John Lee, Max Dabagia, Eva L. Dyer, and Christopher Rozell. Hierarchical optimal transport for multimodal distribution alignment. arXiv preprint arXiv: 11768, 2019.
Xuhong Li. Yves Grandvalet, Rémi Flamary, Nicolas Courty, and Dejing Dou. Representation transfer by optimal transport. arXiv preprint arXiv:2007.06737 2020.
Jian Liang, Dapeng Hu, and Jiashi Feng. Do we really need to access the source data? source hy- pothesis transfer for unsupervised domain adaptation. In Proceedings of the 37th International
Conference on Machine Learning. ICML 2020, 13-18 July 2020, Virtual Event, volume 119 of Proceedings of Machine Learning Research, pp. 6028-6039. PMLR, 2020. URL http: 1 wellinngee aang2 html
//proceedings ml allr... prwss v1 19 9
Mingsheng Long, Yue Cao, Jianmin Wang, and Michael I. Jordan. Learning transferable features with deep adaptation networks. In Francis R. Bach and David M. Blei (cds.), Proceedings of the 32nd International Conference Machine Learning. ICML 2015, Lille, France, 6- 11 July 2015, volume 37 of JMLR Workshop and Conference Proceedings, pp. 97-105. JMLR.org. 2015. URL httt::/pprocett
mlr. wwwps/vve3 v37/1ong11133 htmll
Mingsheng Long, Han Zhu, Jianmin Wang, and Michael I. Jordan. Deep transfer learning with joint adaptation networks. In Doina Precup and Yee Whye Teh (eds.), Proceedings of the 34th International Conference on Machine Learning, ICML 2017, Sydney, NSW, Australia, 6-11 August 2017, volume 70 of Proceedings of Machine Learning Research, pp. 2208-2217. PMLR, 2017. URL WtRLhttp::// hattt:::/ppoeeedngggg..e mll prress//70/Long1//
Mingsheng Long, Zhangjie Cao, Jianmin Wang. and Michael Jordan. Conditional ad- versarial domain adaptation. In Samy Bengio, Hanna M. Wallach, Hugo Larochelle, Kristen Grauman, Nicolò BisacBianchi, and Roman Garnett (eds.), Advances Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems 2018, NeurlPS 2018, December 3-8, 2018, Montréal, Canada, pp. 1647- newrips. http//aap/2211//heeee 1657, 2018. URL hnttps://proceettt Abstt Absttttttaaaaatattatc.tt.... html
Ashok Vardhan Makkuva, Amirhossein Taghvaei, Sewoong Oh, and Jason D. Lee. Optimal transport mapping via input convex neural networks. In Proceedings of the 37th International Conference on Machine Learning, ICML 2020, 13-18 July 2020, Virtual Event, volume 119 of Proceedings of Machine Learning Research, pp. 6672-666 6681, PMLR, 2020. URL httt::////poceeee mlr. wwwppppssss.... http///111maakkaaa2000 html
Robert McCann. Existence and uniqueness of monotone measure-pressrrving maps. Duke
Mathematical Journal, 80(2):309-323, 1995.
Cheng Meng, Yuan Ke, Jingyi Zhang, Mengrui Zhang, Wenxuan Zhong, and Ping Ma. Large- scale optimal transport map estimation using projection pursuit. arXiv preprint arXiv:2106.05838, 2021.
Youssef Mroueh. Wasserstein style transfer. arXiv preprint arXiv: 2019.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. 2011.
Quan Hoang Nhan Dam, Trung Le, Tu Dinh Nguyen, Hung Bui, and Dinh Phung. Threeplayer wasserstein gan via amortised duality. In Proc. the 28th Int. Joint Conf. on Artificial Intelligence (IJCAI), 2019.
Nicolas Papernot, Patrick D. McDaniel, and Ian J. Goodfellow. Transferability in machine learning: from phenomena to black-bor box attacks using adversarial samples. CoRR, 0als/1605.0721 2016. URL httpt:t/p///iiieeeeeeee wwtpriiw.v......ooooooo. httgg//bs/1666 /tt 07277
12

---

Under review as a conference paper at ICLR 2022
Nicolas Papernot, Patrick D. McDaniel, Ian J. Goodfellow, Somesh Jha, Z. Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM Asia Conference Computer and Communications Security, AsiaCCS 2017, Abu Dhabi, United Arab Emirates, April 2-6, 2017, pp. 506-319, 2017. doi: 10.1 (0.1145/305993. 3053009. htttpsss::///dt http:///oo..org//////// 01110//091111135597733333
François-Pierre Paty and Mareo Cuturi. Regularized optimal transport is ground cost adversarial. In International Conference on Machine Learning, pp. 7532-7542. PMLR, 2020.
Michaël Perrot, Nicolas Courty, Rémi Flamary, and Amaury Habrard. Mapping estimation for dis-
crete optimal transport. In Daniel D. Lee, Masashi Sugiyama, Ulrike von Luxburg, Isabelle Guyon, and Roman Garnett (eds.), Advances in Neural Information Processing Systems 29: Annual Conference on Neural Information Processing Systems 2016. December 5-10, 2016, Barcelona, Spain, pp. 4197 2016. URL /ttL:tts///:/cccciiinng neurips. ccs
CoRR, http://Ahhhaaaacccccccccaaaaaaan Abbeaaaaaeoeee0000eeaaeaaaea html
Deyan Petrov and Timothy M. Hospedales. Mcasuring the transfcrability of adversarial examples.
2019. URL
Muni Sreenivas Pydi and Varun Jog. Adversarial risk via optimal transport and optimal couplings.
In International Conference on Machine Learning, pp- 7814-7823, PMLR, 2020.
Alain Rakotomamoniy, Rémi Flamary, Gilles Gasso, Mokhtar Z Alaya, Maxime Berar, and Nico- las Courty. Optimal transport for conditional domain matching and label shift. arXiv preprint arXiv:2006.08161, 2020.
levgen Redko, Nicolas Courty, Rémi Flamary, and Devis Tuia. Optimal transport for multi- source domain adaptation under target shift. In The 22nd International Conference on Artificial Intelligence and Statistics, pp. 849-858 PMLR, 2019.
Sebastian Reich. A nonparametric ensemble transform method for bayesian inference. SIAM Journal on Scientific Computing, 35(4) 2013.
Tobias Ringwald and Rainer Stiefelhagen. Adaptiope: A modern benchmark for unsupervised domain adaptation. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pp. 101-110, 2021.
Ralph Rockafellar. Characterization of the subdifferentials of convex functions. Pacific Journal of Mathematics, 17(3):9775510, 1966.
Sebastian Ruder. An overview of gradient gradient descent optimization algorithms. CoRR, abs/1609,04747, 2016. URL
Kate Saenko, Brian Kulis, Mario Fritz, and Trevor Darrell. Adapting visual category models to new domains. In European conference computer vision, pp. 213-226. Springer, 2010.
Filippo Santambrogio. Optimal transport for applied mathematicianss. calculus of varia- tions, pdes and modeling. 2015. URL
OTAM-cvgmt.... pdf
Shibani Santurkar, Dimitris Tsipras, Brandon Tran, Andrew Ilyas, Logan Engstrom, and Aleksander Madry. Image synthesis with single (robust) classifier.
Lukas Schott, Jonas Rauber, Matthias Bethge, and Wieland Brendel. Towards the first adversar- ially robust neural network model on MNIST. In 7th International Conference on Learning Representations, ICLR 2019, New Orleans, LA, USA, May 6-9, 2019, 2019. URL https: //openzeview.neee net wtw.ee/ooomii--l1llloa
Abhinav Shrivastava, Abhinav Gupta, and Ross B. Girshick. Training ragion- object detectors with online hard example mining. In 2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA, June 27-30, 2016, pp. 761-769, IEEE Computer Society, 2016. doi: 10.11099/2... URL https: wttp://t........o/o//oo////oo 201 6. 89
11099/000//...111/2....... 1109/CVPR.
13

---

Under review as a conference paper at ICLR 2022
Justin Solomon, Fernando De Goes, Gabriel Peyré, Marco Cuturi, Adrian Butscher, Andy Nguyen, Tao Du, and Leonidas Guibas. Convolutional wasserstein distances: Efficient optimal transporta- tion on geometric domains. ACM Transactions Graphics (TOG), 34(4):1-11, 2015.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, lan J. Good- fellow, and Rob Fergus. Intriguing properties of neural networks. In Yoshua Bengio and Yann LeCun (eds.), 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16. 2014, Conference Track Proceedings, 2014. URL http:
//arxiv. abs/ 1312. 6199
Amirhossein Taghvaei and Amin Jalali. 2-wasserstein approximation via restricted convex potentials with application improved training for gans. CoRR, abs/1902.07197, 2019. URL http:
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry.
Robustness may be at odds with accuracy. In 7th International Conference Learning
Representations, ICLR 2019, New Orleans, LA. USA, May 6-9, 2019, 2019. URL https:
//openzeview. net wttp:eeeetooommiddyyys..........
C. Villani. Optimal Transport: Old and New. Grundlehren der mathematischen Wissenschaften. Springer Berlin Heidelberg. 2008. ISBN 9783540710509, URL http:///oooooo.olllll....
Eu/books?id-hve8
5tkC
Mei Wang and Weihong Deng. Deep visual domain adaptation: A survey. Neurocomputing, 312: 135-153, 2018.
Eric Wong, Frank R. Schmidt, and Zico Kolter. Wasserstein adversarial examples via projected sinkhorn iterations. In Proceedings of the 36th International Conference on Machine Learning, ICML 2019, 9-15 June 2019, Long Beach, California, USA. pp. 6808-6817, 2019. URL http: //proceedings mlr. press / v 7two///woggl. 9a html
Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. Adver- sarial examples for semantic segmentation and object detection. In Proceedings of the IEEE International Conference Computer Vision, pp. 1369-1378. 1378, 2017.
Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan L. Yuille, and Quoc V. Le. Adversarial examples improve image recognition. CoRR, 1.00966,, 2019. URL http://arxiv: brg/abs 1911.1 09665
Yuguang Yan, Wen Li, Hanrui Wu, Huaqing Min, Mingkui Tan, and Qingyao Wu. Semi-supervised optimal transport for heterogeneous domain adaptation. In ICCAL volume 7, pp. 2969-2975, 2018.
Jihan Yang, Ruijia Xu, Ruiyu Li, Xiaojuan Qi, Xiaoyong Shen, Guanbin Li, and Liang Lin. An adversarial perturbation oriented domain adaptation approach for semantic segmentation. In The Tourty-Fourth AAAI Conference on Artificial Intelligence, AAAI 2020, The Thirty-Second Innovative Applications of Artificial Intelligence Conference, IAAI 2020. The Tenth AAAI Symposium on Educational Advances in Artificial Intelligence, EAAI 2020, New York, NY, USA, February 7-12, 2020, pp. 12613 12620. AAAI Press, 2020. URL https:://aai..rgg/////
index php/ AAAI http://AAA/atttteeleeeee...
6952
Xiaoyong Yuan, Pan He, Qile Zhu, and Xiaolin Li. Adversarial examples: Attacks and defenses for deep learning. IEEE Trans. Neural Netw, Learning Syst., 30(9))2805-2224 2019. doi: 1091 TNNLS.2018.288. 2882.811177 URLbttps. /oi. ort. 1109/ TNNLS 2018. 2886017
14

---

Under review as a conference paper at ICLR 2022
A
APPENDIX
A.1 ADVERSARIAL ATTACKS APPROXIMATION
In this section, we propose the usage of OT for Adversarial attack approximation. We used MNIST, MNIST-M, and SVHN datasets and trained three Shirivatsava-like classifiers (Shrivastava et al., 2016) on each dataset individually. To create adversarial examples, we used a simple FSGD method. We transformed 10k images from each training dataset via FSGD into adversarial examples. Having the original and adversarial examples, we used OT to find a map between them. The 10k test samples without associated adversarial examples and labels were input the OT algorithms too.
Method
MNIST
USPS
M-MNIST
SVHN
CIFAR-10
No attack
99.0
99.0
98.0
98.0
81.0
EMD
4.0
4.0
4.0
2.0
7.0
Sinkhorn
5.0
4.0
5.0
3.0
7.0
Sinkhom L.II.p
5.0
4.0
4.0
3.0
7.0
Sinkhom L.L.2
5.0
4.0
3.0
Table 4: Results of different OT algorithms on digits datasets, on the test the adversarial examples transportation task. 10k samples from train set was used to build adversarial examples.
As shown in Table 4 the resulted examples significantly reduce the accuracy of the classifiers. Also, the inference of adversarial examples using OT is much faster than iterative gradient descent methods. Our results confirm that OT can naturally learn the distribution of adversarial examples.
A.2 IMAGE CLASSIFICATION
0
24
10
Figure Examples of source fiction in input space for MNIST, USPS, M-MNIST and SVHN.
comparison to the previous section here, we turn to the opposite side. Our idea is to use source fiction for image classification using OT inside the single domain, in other words between test and train data. While discrete OT methods showed impressive results in DA with a low number of labeled samples, we propose use mapping from the test set the source fiction dataset of classifier (OT())) Source fiction in such a scenario is obtained by the adversarial attack to the model trained on low number training samples. Shirivatsava-Iie classifiers (Shrivastava al.) (0166) were used for training. We evaluated the Sinkhorn algorithm on MNIST and USPS datasets with 10 known labels and CIFAR-10 10 with 100 known labels per class. Results are presented Table
METHOD
MNIST
USPS
CIFAR-10
SOURCE
69.1
82.0
31.8
SINKHORN
72.2
82.0
55.7
Table 5: Results of application of Sinkhorn optimal transport in the latent space of classifiers with 10 known labels for each class.
In Figure 3 are presented examples of cycle monotone transformation for source fiction via adver- sarial attack in the dataset space.
A.3 ADDITIONAL EXPERIMENTS ON DA
In this section, we provide additional experiments using the source fiction method:
15

---

Under review as a conference paper at ICLR 2022
Results with 3 (Table 6) and 100 (Table known labels per class in target domain using ResNet50 classifier.
Digits dataset using Resner18, with 10 (Table 8 and 100 (Table 9 known labels.
ResNet18 trained epoch source domain Modern Office-31 datasets 10
Experiments the Caltech dataset, unfortunately. full dataset is not available pub-
licly now, so we used an abbreviated version, results are presented in Table
Resnet18 adaptation on CIFARIOSSTEL adaptation task (Table 12
METHOD
MNIST
SVHN MNIST
MNIST USPS
USPS MNIST
MNIST M-MNIST
SVHN
SOURCE
22.0
79.0
63.0
80.0
60.0
EMD
21.3
72.5
66.1
67.8
SINKHORN
21.7
73.0
67.3
68.7
44.6
SINKHORNIPL.I
21.7
73.4
67.3
68.8
45.0
SINKHORNLIL2
21.7
73.4
67.3
68.8
45.0
MAPT
21.8
73.4
67.4
68.8
45.0
EMD
23.11
83.5
82.6
$6.5
54.7
SINKHORN
23.7
85.0
82.6
86.8
54.8
LINL
23.7
85.2
86.3
86.9
54.9
SINKHORNLIL2
23.8
85.2
86.3
86.9
54.9
MAPT
23.9
85.3
86.3
86.9
55.1
Table 6: Accuracy of domain adaptation by optimal transport in the latent space of ResNet50 model with only known labels for each class the target domain on Digits datasets. The top part of the table represents standard settings the bottom part presents results using source fiction.
METHOD
MNIST SVHN
SVHN MNIST
MNIST USPS
USPS MNIST
MNIST M-MNIST
SOURCE
21.68
72.54
70.0
83.3
24.3
EMD
24.24
73.5
83.1
80.1
53.6
SINKHORN
21.6
74.5
84.0
80.4
55.6
SINKHORNLPI.I
21.6
74.3
85.5
81.1
55.6
SINKHORNLIL2
21.6
85.5
81.1
55.6
MAPT
21.6
74.3
85.5
81.1
55.6
EMD
25.8
85.8
86.1
91.2
52.4
SINKHORN
27.8
85.8
86.8
91.2
56.3
LINLHORNLPLI
27.8
86.0
88.0
91.6
SINKHORNLIL2
27.8
86.0
88.0
91.6
56.3
SINKHORNLIL2
27.9
86.1
88.0
91.6
56.3
MAPT
27.9
86.1
88.0
91.6
56.3
Table Accuracy of domain adaptation by optimal transport in the latent space of ResNet50 model with 100 known labels for each class in the target domain Digits datasets. The top part of the table represents standard settings the bottom part presents results using source fiction.
16

---

Under review as a conference paper at ICLR 2022
METHOD
MNIST SVHN
SVHN MNIST
MNIST
USPS MNIST
MNIST
USPS
M-MNIST
SOURCE
22.0
79.0
63.0
80.0
60.0
EMD
15.4
64.3
77.0
80.8
70.8
SINKHORN
16.0
65.2
77.9
81.2
70.9
SINKHORN LILP
16.8
65.7
79.8
85.1
71.8
SINKHORN L1L2
16.0
65.7
79.8
85.1
71.8
MAFT
16.1
67.1
79.8
86.2
71.8
EMD
35.1
87.1
85.2
95.2
82.3
SINKHORN
38.0
88.3
88.3
95.2
83.5
SINKHORN LILP
37.1
88.3
88.2
95.2
83.5
SINKHORN LIL2
37.1
88.3
88.3
95.2
83.5
MAPT
38.0
90.0
88.2
95.2
83.5
Table Accuracy of domain adaptation by optimal transport in the latent space of ResNet18 model with the 10 known labels for each class in the target domain Digits datasets. The top part of the table represents standard settings the bottom part presents results using source fiction.
METHOD
MNIST SVHN
SVHN MNIST
MNIST USPS
USPS MNIST
MNIST
M-MNIST
SOURCE
22.0
79.0
63.0
80.0
60.0
EMD
18.4
71.3
85.0
88.0
75.1
SINKHORN
76.2
85.3
86.0
81.9
SINKHORN LILP
20.8
76.5
85.0
81.7
SINKHORN L1L.2
20.0
75.5
85.2
86.0
81.7
MAPT
20.9
76.2
85.0
86.9
81.6
EMD
24.3
89.1
87.3
96.0
86.3
SINKHORN
27.1
90.0
89.3
96.0
87.1
SINKHORN LILP
28.3
90.0
89.2
96.0
87.1
SINKHORN LIL2
28.3
90.0
89.2
96.0
88.1
MAPT
29.0
90.2
89.3
96.2
88.0
Table Accuracy of domain adaptation by optimal transport in the latent space of ResNet18 model with the 100 known labels for each class in the target domain Digits datasets. The top part of the table represents standard settings the bottom part presents results using source fiction.
METHOD
A
A
D
S
D
A
A
A
S
D
S
SOURCE
37
43
25
8
57
41
20
2
65
3
27
EMD
57
42
27
53
38
32
28
53
19
37
SINKHORN
43
SINKHORNLPLI
58
43
27
17
53
40
32
29
53
20
38
SINKHORNLIL2
58
43
27
17
53
40
32
29
53
20
38
MAPT
58
43
27
17
53
40
32
29
53
20
38
EMD
67
SINKHORN
77
67
51
43
75
63
57
77
41
60
SINKHORNLPL.
77
67
51
43
75
63
59
57
77
41
60
SINKHORNLIL2
77
67
51
43
75
63
59
57
77
41
60
MAPT
77
67
51
43
60
AVERAGE BOOST
25
37
47
63
27
39
45
53
30
57
39
Table 10: Results of domain adaptation in the latent space of ResNet18 model on Modern Office-31 dataset semi sumi-supervised settings with the 10 known labels for each class the target domain
A.4 ENERGY-BASER MODELS FOR EPSILON FREE SOURCE FICTION
As shown in section our algorithm depends on the size of perturbations, to avoid it and make method free, propose to input convex energy-based classifier. Energy-based leamn ing provides a unified framework for many probabilistic and non- probabbilist approaches, partic- ularly for non-probabilistic training of graphical models, including discriminative and generative
17

---

Under review as a conference paper at ICLR 2022
METHOD
W
C
W
SOURCE
49
27
65
70
42
26
62
36
EMD
42
44
30
59
40
24
53
38
SINKHORN
43
43
30
60
37
24
52
38
SINKHORNLPP.1
42
43
30
60
37
25
53
38
SINKHORNL1122
42
43
30
60
37
2,5
5.3
38
MAPT
42
43
30
60
37
25
53
38
EMD
54
51
52
68
67
39
69
47
SINKHORN
54
51
52
68
67
39
69
48
SINKHORNLPLI
54
51
52
68
67
39
69
48
SINKHORNLIL2
54
51
52
68
67
39
69
48
MAPT
54
51
52
68
67
39
69
48
AVERAGE BOOST
15
42
12
36
23
Table 11: Results of domain adaptation in the latent space of ResNet18 model on Office-31-Caleee
dataset semi- cune-supereised settings with the 10 known labels for each class in the target domain
METHOD CIFAR-SS STL
SOURCE
EMD
SINKH
SINKH LILP
SINKH LIL2
MAPT 48.1
37.0
48.1
48.1
48.0
48.0
CIFAR STL-CIFAR STL-SF
51.1
51.0
51.0
51.0
51.0
75.0
74.1
74.1
74.1
74.1
74.1
76.2
76.2
76.2
76.2
76.2
Table 12: Results on MNIST and USPS dataset in semi-supervised settings. U is USPS, M is MNIST, SF is source fiction. The top table presented results for the settings with the 10 known labels for each class in the target domain, and the bottom table presents the result with the 100 known labels for each class
approaches and conditional random fields, graph-transformer networks, maximum margin Markov networks, and several manifold learning methods (LeCun al. 2006). In energy-basee settings for some given fixed x and possibly some fixed elements of y we can perform inference by:
Energy-based learning approaches can be considered an alternative probabilistic estimation for prediction, classification, or decision-making tasks. The energy-based representation must capture both the discriminative interactions between x and y and allow for efficient combinatorial optimiza- tion over y.
A.4.1 CONVEX ENERGY- BASEDD INFERENCE
Here is our approach in more detail. First of all, we build model fo that is Partly Input Convex Neural Network (PICNNs) (Amos et al. 2017) over x instead of (Amos et al., 2017). is made possible apply convex inference over æ. Secondary we train model Jo on the source domain (X., Y.) ) in setup equal to Structured Prediction Energy Networks (SPEN) (Belanger & McCallum 2016), but instead of multi-label classification, we simply perform multi-class classification.
In the next step, we apply the core idea of our approach, we use model trained on (X,, Y.), create source fiction domain which cyclical monotone the target domain (X,, Y;) and contain features from the source domain samples. We simply input x² samples to the model fo and apply inference over with the fixed y!:
arg min f(x, 0)
(13)
As stated before, according to Rockfellar (Rockaflllar 1966) and Breirer's theorems (Theorem 1.22 (Santambrogio 2013)), we know that the gradient of a convex function cyclical monotone and solves Monge problem (Villani 2008).
18

---

Under review as a conference paper at ICLR 2022
We used the gradient descent method to inference and while our fo is input convex the 2, applying this procedure over the target samples we can collect a new source fiction domain (X,, f: Y/) where Xy samples class wise cycle monotone to X,. And according the theorems presented before, there exists optimal transport that can solve transportation from X to X, inside each class. Connecting resulted domain with penalty ssemi
( M) by n. My matrix M) where
M(i, = 0 when y = yÿ and +oo otherwise (Courty et al. 2016 Yan et al. 2018) we achieve improvement accuracy without value restrict the seize perturbations.
A.4.2 EXPERIMENTS
We tested our model MNIST (LeCun & Cortes 2010) and USPS datasets (Hull 1994). In both experiments, we train PICNNs with a one hidden layer size of 100, in the SPEN settings using SGD Ruder 2016) optimizer with learning rate equal 1e-3 and momentum equal to 0.9.
METHOD
SOURCE
EMD
SINKH
SINKH L.L.P
SINKH LII.2
MAPT
U-M
28.84
39.33
37.76
31.14
11.8
28.15
U-SF
76.13
76.13
76.13
76.13
68.21
M-+U 28.56
34.43
30.42
25.75
14.29
28.68
M-+FF
68.72
62.74
57.92
16.02
56.11
U-M
28.84
45.54
35.52
29.19
9.41
33.58
U-SF
86.39
86.39
86.34
86.34
72.09
M-+U 28.56
45.01
29.9
26.09
9.68
48.12
M-SF
85.80
77.60
69.31
12.59
61.35
Table 13: Results on MNIST and USPS dataset in semi-supervised settings. is USPS, M is MNIST, SF is source fiction. The top table presented results for the settings with the 10 known labels for each class in the target domain, and bottom table presents the result with the 100 known labels for each class
Based on the POT library (Flamary al. 2021) we tested the different variations of discrete optimal transport in this task. First of all. we tested and basic EMD and Sinkhorn (Sinkh) (Cuturi 2013) algorithms. Then we tested regularized versions the Sinkhorn algorithm with group lasso regu- larization (L1L2) and Laplacian regularization (LILP) (Courty et al. 2013). Finally, our method is benchmarked on MapT (Perrot et al.) 2016).
The results presented in Table 13 In the table, we can see that mapping to the source fiction do- main improves the accuracy the optimal transport algorithms, but due to inference problems with energy-based models, accuracy is less than in settings with standard networks.
19


Reviews:
[{"review_id": "oNyZ8yh-ZzP", "reviewer": "Reviewer_bUjz", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "**Strengths:**\n- The paper develops an interesting connection between \"slightly perturbed samples\" (possibly misnamed adversarial examples) that gives a cycle monotone map with respect to the original samples.\n\n- Empirical results demonstrate that the proposed algorithm can boost the performance of prior OT-based domain adaptation algorithms.\n\n- The paper gives some interesting future direction ideas including the fact that the source dataset is not needed, rather just the source classifier.\n\n\n**Weaknesses:**\n- If my understanding is correct, the discrete OT versions only work if you have access to the full target dataset *at test time* since you must learn a map from $\\Omega_{semi}$ to $\\Omega_f$ to do the target classification.  Thus, this mapping step must be done whenever a new sample comes in---i.e., it cannot be done once during training and then work for any new test sample.  Other methods like the neural-based methods should work for any new test point after training. However, the results in the case of neural-based approaches are significantly weaker.\n\n- Fundamentally, this paper only compares to OT-based domain adaptation methods.  What about adversarial-learning based domain adaptation.  It is unclear if this would actually produce state-of-the-art results.  Are there some baseline semi-supervised domain adaptation methods that could be compared against (or even unsupervised domain adaptation methods) to compare against?  It is unclear that OT-based methods are in fact state-of-the-art currently. If they are not, then what is the reason to use OT-based domain adaptation over the state-of-the-art methods (i.e., what additional benefit is gained by using OT if performance is the main concern)?\n\n- The paper writing, theoretical development, and algorithm descriptions could be clarified.  There are typos throughout the paper (see below).  For example, more intuition about the lemma and the corollary are important.  What does this mean intuitively?  Does it mean that the \"pair\" of any sample is closest to it's corresponding adversarial example?  More generally, does this mean that the adversarial perturbations *implicitly* give the *optimal* mapping between samples from the data distribution and samples from an \"adversarial distribution\"?  Relatedly, Given that cycle monotonicity is a key term used, there should be more background and a more precise definition in the background section, rather than just an informal statement.\n\n**Other comments or questions**\n- By restricting the perturbation epsilon, can the perturbations be thought as finding nearby parts of the classifier that classify correctly?  Or put another way, does this find samples that are closer to the \"correct\" parts of the source classifier?\n\n- Are these actually the opposite of adversarial examples because you want to decrease the loss function for the \"perturbed sample\"?  It seems that they are \"adversarial\" only in the fact that they are small perturbations but they are NOT adversarial in terms of trying to fool the source classifier.  If this is true, then I think the terms should be different.  Something like \"perturbed\" samples rather than \"adversarial\" samples.  Also, in Corollary 1, this shouldn't necessarily be called an \"attack\" since it is not trying to fool a classifier.\n\n- What is $\\overline{1,N}$ in Lemma 1?\n\n- There are multiple typos and small issues with wording (e.g., \"FSGD\" which is probably meant to be \"FGSM\").  For example the sentence \"While OT maps are cycle monotone, i.e., exhibit a specific structure of the map, thus, transportation $\\Omega_t \\to \\Omega_s$ via OT maps might not apply to some problems, see (Courty et al., 2015, Figure 3) for counter-examples.\" doesn't make sense.  Are you saying that the cycle monotonicity causes OT maps to be poor, or are you saying that they could be poor even though they are cycle monotonic?\n\n- For clarity, it should be more strongly emphasized that you are applying OT methods in the latent space of the classifier, NOT the raw pixel space.\n\n- The algorithm and figure should be presented after they are reference in section 4.\n\n- Table captions should be above tables.\n", "summary_of_the_paper": "The paper proposes an algorithmic trick (related to adversarial examples) to enhance existing semi-supervised domain adaptation techniques.\nThe enhanced method does require at least a few labeled samples in the target domain.\nThe paper first shows that if you perturb target samples by a small enough epsilon, you can maintain cycle monotonicity (and thus it is strongly related to the optimal mapping between two empirical distributions by construction).\nThe paper proposes to create a \"source fiction\" dataset where each labeled target point is perturbed by a bounded epsilon amount (as in adversarial examples) but *unlike* adversarial examples, you are trying to move the point to be **correctly** classified.\nThen, all the target data is mapped to this \"source fiction\" dataset and the classifier is applied to this mapped target data.\nThe paper shows that this idea can possibly boost the performance of existing OT-based domain adaptation methods.\n", "summary_of_the_review": "Overall, the connection between perturbed samples and cycle monotone maps is interesting. However, the paper lacks clarity and intuition about why this is good or useful.  From the experimental side, the paper does not compare to any non-OT domain adaptation methods and is challenging to apply in real-world scenarios because either an OT problem would need to be solved for each new target sample (that wasn't in the original target dataset) or a neural OT would need to be used (whose results were less significant).\n", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "gCl3_W_ib3v", "reviewer": "Reviewer_kk9C", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths: this paper aims to use adversarial attacks to generate good samples for the task of semi-supervised domain adaptation. It takes three steps: first, pretrain a source classifier $h$; second, attack the source classifier with labeled target samples; finally, use optimal transport to align the unlabeled target samples and label them using $h$. This approach seems interesting. I appreciate the authors' effort to conduct experiments on various vision datasets and several OT algorithms. The new approach seems to perform better than unsupervised domain adaptation.\n\nWeaknesses: \n\n1. cyclical monotonicity is equivalent to optimal transport (Exercise 2.21, [1]). The adversarial attack in this paper essentially says that after small perturbations, the new samples are still the optimal plan when transporting the initial samples. This is always true if the perturbations are small enough, and this paper gives the upper bound of the perturbation. While cyclical monotonicity is a good evaluation metric to check optimal transport. I feel it is unnecessary to introduce this concept in this work, and doing so would intimidate and confuse the readers. All we need to say is that the small perturbations are not far so that the modified samples are still the closest to the original samples, among all permutations. \n\n2. The definition of cyclical monotonicity (CM) is not clear in this paper. CM would require a subset $\\Gamma$ such that for all $(x_1, y_1), \\cdots, (x_m, y_m) \\in \\Gamma$, eq. (7) is satisfied. However, it is not clearly written before eq. (7) and Lemma 1. Moreover, in the paper \"cycle monotonicity\" is used several times, instead of \"cyclical monotonicity\" [1].\n\n3. On the experimental side, I am a bit worried that the comparison is not fair. The authors compared the \"standard setting\" with their semi-supervised settings. This \"standard setting\" is not detailed in the paper. I can guess from Figure 1 that this standard setting is unsupervised domain adaptation (Gaini et al JMLR 2016, Domain-Adversarial Training of Neural Networks), but in Algorithm 1, labeled data from target domain is used. Thus it is not fair to compare unsupervised domain adaptation with semi-supervised domain adaptation, as in the latter case we have additional labeled data from the target.\n\n4. From Figure 2 it seems that with larger perturbation, the source classifier can perform better on the source fiction domain. Could the authors explain why it happens? \n\n5. How many labeled samples have you used in the target domain? If it is large then there is no need to do domain adaptation: we can just train on the target domain. I think we could see it more clearly if we train a new classifier on both the source domain and the labeled part of the target domain, and compare with Algorithm 1. Moreover, adversarial training methods should be used so as to achieve better generalization property [2].\n\n\n[1] Cédric Villani, Topics in Optimal Transportation, American Mathematical Soc., 2003.\n\n[2] Song et al, IMPROVING THE GENERALIZATION OF ADVERSARIAL TRAINING WITH DOMAIN ADAPTATION, ICLR 2019.\n", "summary_of_the_paper": "This paper proposes using the method of adversarial attacks for the task of semi-supervised domain adaptation. The adversarial perturbations are constrained to satisfy cyclical monotonicity [1].\n\n [1] Cédric Villani, Topics in Optimal Transportation.", "summary_of_the_review": "Using adversarial attacks for domain adaptation is an interesting idea and has been explored before (https://arxiv.org/pdf/1810.00740.pdf). This paper proposes generating adversarial attacks and using OT to label the target domain. However, I think the current version is not well written: the theory can be greatly simplified and the experimental settings are not clear. Therefore I would recommend rejection.  ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "eT2glnTY7yk", "reviewer": "Reviewer_Kkzh", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n- Studying the use of adversarial attacks for domain adaptation is an interesting topic, which has not been extensively covered yet.\n- The results using discrete OT methods suggests that the proposed approach can bring some improvement.\n\n\nWeaknesses:\n\n1) Motivation/intuition behind the proposed method.\n1.1) The authors spend time explaining the notion of cycle monotonicity and showing that FSGD attacks are cycle monotone. However, they do not explain why this is important, what is the connection between cycle monotonicity of adversarial attacks and the success of domain adaptation. This explanation is needed, as the current version of the paper gave me no intuition as to why the method should work.\n\n1.2) In fact, the method is quite counter-intuitive. Let me describe Algorithm 1 in words: Given a classifier trained on the source data, one generates adversarial examples for the labeled target examples. As such, these adversarial examples will be misclassified by the source classifier. One then maps the vanilla target examples to the domain of the adversarial examples, and applies the same source classifier. As this classifier is ineffective for the adversarial examples, I do not see why it would work for the transformed unlabeled target samples. I would highly appreciate if the authors could explain this.\n\n2) The experimental results are not truly convincing.\n2.1) While the results with discrete OT are fine, the ones with neural OT (Table 2) are disappointing. In short, there is no clear benefit of the method in this case. This is problematic because neural OT methods tend to give better results than discrete OT ones, as can be seen by comparing Table 1 and Table 2. This significantly reduces the attractiveness of the method.\n\n2.2) The results of neural OT are only shown on the Digits datasets, not the Modern Office-31 one.\n\n2.3) As there are no references, is not entirely clear to me if the discrete OT and neural OT methods used in the experiments correspond to the state-of-the-art methods for OT-based domain adaptation. If not, a comparison to such methods would be needed.\n\n3) Clarity: Although the paper is altogether clear enough, it could be improved in several ways.\n3.1) The introduction would not be easy to follow for someone not familiar with the notion of cycle monotonicity. It would help if the authors could give an intuitive explanation of what it is and why it is useful in this context.\n\n3.2) In the second paragraph, the authors state that the conventional OT approach for domain adaptation is to transform the target domain to the source one. I would argue that the reverse transformation is more common (e.g., Rakotomamonjy et al., 2020, Damodaran et al., 2018).\n\n3.3) The background on OT is quite detailed, which may not be truly necessary. This could be moved to the appendix.\n\n3.4) By contrast, the cycle monotonicity equation (eq. 7) lacks some information, i.e., the fact that $y_{N+1} = y_{1}$. Note also that, above the equation, it should be $x_N$ and $y_N$ instead of $x_i$ and $y_i$.\n\n3.5) The result in Lemma 1 is not surprising considering the assumption on $\\epsilon$. As it is intuitive, the authors could consider moving the proof to the appendix.\n\n3.6) Minor comment: The use of $N$ in Algorithm 1 is a bit unfortunate, as it typically refers to the number of samples.\n", "summary_of_the_paper": "This paper studies the use of adversarial attacks and optimal transport (OT) in the context of semi-supervised domain adaptation. The authors show that adversarial attacks satisfy the cycle monotonicity property. They then propose an algorithm that generates adversarial examples for the labeled target samples using the source classifier, and maps the vanilla target samples to this new domain via OT.\n", "summary_of_the_review": "Although this paper studies an interesting scenario, I am convinced neither by the motivation behind the proposed approach, nor by the experimental results.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "auTt92gf8yH", "reviewer": "Reviewer_Ux4r", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "## Strengths:\n1. There is some setting where the proposed algorithm improves over the baseline.\n2. From a non-expert of the field perspective, the experimental results seem relatively extensive. \n\n## Weaknesses: \n1. The theory is relatively weak. \nIt is fine to prove relatively weak results but it seems to me that a lot of space is used to only apply the triangle inequality. Maybe this space should be used to show to what extent the assumption of Lemma 1 holds or examples of assumption of the data distribution that insure that such an assumption holds ($\\min_{n_1,n_2} \\|x_{n_1} - x_{n_2}\\| \\geq 2\\epsilon$). \n2. The explanation of why this method works could be developed more. \nIt is said that this method works because the data points in $\\Sigma_f$ contain the non-robust features of the source dataset “Such attack adds to the image features of the class to which the image really belongs (Ilyas et al., 2019).“ \nThis reason is not investigated experimentally. For instance, these reasons should have two consequences: \nA. The predictions should be non-robust (i.e. very sensitive to adversarial perturbation)\nB. such a technique should not work with a robust classifier $f_\\theta$.\n\n3. The writing of the paper could be significantly improved. Its clarity and quality (in terms of writing is significantly under ICLR standard) \nIn my opinion, this paper is not polished enough for a venue such as ICLR. There are many small mistakes in the paper. I also found the flow of this paper confusing:\n- Why does cycle monotonicity suggests using optimal transport? \n- Is the OT map between $\\Sigma_f$ and $\\Sigma_t$ or $\\Sigma_{semi}$ and $\\Sigma_f$? It it seems that is has to be between $\\Sigma_f$ and $\\Sigma_t$ (in order to classify non-labeled examples) but Algorithm 1 mentions  $\\Sigma_{semi}$ and $\\Sigma_f$.\n- Usually, the transport map is from the source to the target domain (see Courty et al 2016). Why is it the other way in this work?\n- The conclusion contains unfinished sentences “The main limitation of our approach is that necessary to have access to the labels in the target domain.“\n\n4. There is no rigorous measure of uncertainty in the experiments:\n“The mean and std of our results are less than 10% for all experiments.“ What are you referring to?\nIf the stds are less than 10% it means that you should not bold any results that are within error bars. \nUsually, error bars are 1.96 stds. Thus in order to have a significant difference between the baseline and your results you may need a difference of 1.96 * 2 * 10= 39.2 %\nI am confident that you can reduce these confidence intervals with more rigorous experiments but with the current uncertainties, the results displayed in this paper may not be significant. \n\n### Minor comment:\n- The $p$-Wasserstein distance is defined for $p \\geq 1$\n- “Are used to penalty”\n- Cost matrix $M \\rangle$\n- Lemma 1: we need to assume that $n_1 \\neq n_2$\n- What does $\\bar{1,N}$ mean?\n- Algorithm 1 $X_f$ should be $\\Omega_f$\n- Steps $n,...,N$\n- $x’_{n+1}$\n- “*The* source domain classifier”\n- “Such *an* an attack”\n", "summary_of_the_paper": "This paper proposes a technique for domain adaptation in the semi-supervised setting (we have access to some labels of the target domain). The idea developed in the paper is to train a classifier (source classifier) on the source domain in order to use the latent representations of this classifier for two things: \n1. “anti” Adversarial examples are computed on the labeled target data in order to have them classified correctly by the source classifier. (I call them anti adversarial examples since the goal is to change the labeled target example to improve the accuracy of the source classifier). Such a modified set is called $\\Omega_f$\n2. An Optimal transport algorithm (OT) is used to transport the latent representations of $\\Omega_t$ to the latent representations of the target domain $\\Omega_f$ (with a consistency constraint between labeled examples of $\\Omega_t$ and $\\Omega_f$)\n\nThe authors eventually try their algorithm experimentally. \n", "summary_of_the_review": "As a summary the ideas from this paper are interesting but it is clearly an unfinished work. I encourage the authors to polish their paper and improve their experimental results to eventually resubmit their work. \n", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Meta-review: In this paper  propose a novel approach for semi-supervised domain adaptation based on the cyclic monotonicity property of optimal transport map. The main idea is to adapt (perturbed wrt a source classifier)  the labeled source samples  toward the target samples while preserving the known labels via the cyclical monotonicity. Then these perturbed samples can be used to perform classical OT domain adaptation. This pre-processing of the data has been shown in the numerical experiments to lead to better performance in average.

The proposed method has been found intriguing by all reviewers but the writing of the paper has been found clearly lacking and several suggestions were proposed by the reviewers. The choice of the authors to call the perturbed samples adversaries for instance made the paper harder to understand and the (anti-adversarial is also not a good choice of words). Another concern was that despite encouraging numerical results lack more baselines semi-supervised Domain Adaptation methods discussed by the reviewers were not compared (with or without OT). 

The authors provided a short but clear response that was appreciated by the reviewers. But the clarifications promised by the authors were not done in the PDF during the editing period which means that the paper clearly needs a new round of reviews.  For this reason the consensus during the discussions was that this paper should be rejected. The AC believes that this is an interesting research direction that should be investigated but that the paper needs some more work before reaching the threshold for acceptance in selective ML venues. The authors are strongly encouraged to take into account the comments form the reviewers before resubmitting their work.
Decision: Reject