Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?
Authors: Vikash Sehwag
Saeed Mahloujifar
Tinashe Handina
Sihui Dai
Chong Xiang
Mung Chiang
Prateek Mittal
Venue: ICLR 2022 Poster (2022)
Keywords: adversarial robustness
certified adversarial robustness
adversarial attacks
generative models
proxy distribution

Abstract: While additional training data improves the robustness of deep neural networks against adversarial examples, it presents the challenge of curating a large number of specific real-world samples. We circumvent this challenge by using additional data from proxy distributions learned by advanced  generative models. We first seek to formally understand the transfer of robustness from classifiers trained on proxy distributions to the real data distribution. We prove that the difference between the robustness of a classifier on the two distributions is upper bounded by the conditional Wasserstein distance between them. Next we use proxy distributions to significantly improve the performance of adversarial training on five different datasets. For example, we improve robust accuracy by up to $7.5$% and $6.7$% in $\ell_{\infty}$ and $\ell_2$ threat model over baselines that are not using proxy distributions on the CIFAR-10 dataset. We also improve certified robust accuracy by $7.6$% on the CIFAR-10 dataset. We further demonstrate that different generative models brings a disparate improvement in the performance in robust training. We propose a robust discrimination approach to characterize the impact and further provide a deeper understanding of why diffusion-based generative models are a better choice for proxy distribution than generative adversarial networks.

Published as a conference paper at ICLR 2022
ROBUST LEARNING MEETS GENERATIVE MODELS: CAN PROXY DISTRIBUTIONS IMPROVE ADVERSARIAL ROBUSTNESS?
Vikash Sehwag" Saeed Mahloujifar', Tinashe Handina", Sihui Dai Chong Xiang"
Mung Chiang", Prateek Mittal
Princeton University, CCaltech, Purduu University
2XXi:2104.00925550 [cs.LG] 3 Mar 2022
ABSTRACT
While additional training data improves the robustness of deep neural networks against adversarial examples, presents the challenge of curating a large number of specific real-world samples. We circumvent this challenge by using additional data from proxy distributions learned by advanced generative models. We first seek to formally understand the transfer of robustness from classifiers trained on proxy distributions to the real data distribution. We prove that the difference be- tween the robustness of classifier on the two distributions is upper bounded by the conditional Wasserstein distance between them. Next we use proxy distri- butions to significantly improve the performance of adversarial training on five different datasets. For example, we improve robust accuracy by up to 7.5% and 6.7% in loo and l threat model over baselines that are not using proxy distri- butions on the CIFAR-10 dataset. We also improve certified robust accuracy by 7.6% on the CIFAR-10 dataset. We further demonstrate that different generative models bring disparate improvement in the performance in robust training. We propose a robust discrimination approach to characterize the impact of individ- ual generative models and further provide deeper understanding of why current sfate-f-thee-ss art in diffusion- based generative models are a better choice for proxy distribution than generative adversarial networks.
INTRODUCTION
Deep neural networks are powerful tools but their success depends strongly on the amount of
training data (Sun et al., 2017 Mahajan et al.) 2018). Recent works show that for improving ro- bust training against adversarial examples (Biggio et al.
2013
Szegedy et al. 2014 Biggio & Roli 2019; Schmidt et al., 2018a| Uesato et al.,
2018 additional training data helpful (Carmon et al.
2019 Deng et al. 202I). However, curating more rooldworld data from the actual data distribution is usually challenging and costly (Recht et al. 2019). To circumvent this challenge, we ask: can robust training be enhanced using proxy distribution, i.e., approximation of the real data distri- bution? In particular, can additional samples from a proxy distribution, that is perhaps cheaper to sample from, improve robustness. If so, can generative models that trained on limited training images in small scale datasets (LeCun & Cortes 2010 Krizhevsky et al. 2014), act as such a proxy distribution
When training on synthetic samples from generative models, a natural question is whether robustness on synthetic data will also transfer to real world data. Even if it does, can we determine the features of synthetic data that enable this synthetic-to-real robustness transfer and optimize our selection of
'Corresponding author: wwikashheprinceton..ed Our code is available at /ettpa:/ggithie httpp////ggiabbb..ooooooooeeeee/ htwp://ppirrorroooooorooddddddde stri but ions
'Proxy distributions may not necessarily be modeled by generative models. When a proxy distribution is the output of generative model, we call it synthetic distribution and refer to data sampled from it as synthetic data.

---

Published as a conference paper at ICLR 2022
generative models based these features? Finally, also optimize the selection of individual synthetic samples to maximize the robustness transfer?
Q.1 When does robustness transfer from proxy distribution real data distribution? This question is fundamental to develop a better understanding of whether a proxy distribution will help. For a classifier trained on only synthetic samples, argue that in addition to empirical and generalization error, distribution shift penalty also determines its robustness on the real data distribution. We prove that this penalty is upper bounded by the conditional Wasserstein distance between the proxy distribution and real data distribution. Thus robustness will transfer from proxy distributions that are in close proximity real data distribution with respect to conditional Wasserstein distance.
Q.2 How effective are proxy distributions in boosting adversarial robustness on real-world dataset? Our experimental results on five datasets demonstrate that the use of samples from PrOxy distribu- tions in Robust Training (PORT) can significantly improve robustness. In particular, PORT achieves up to to 7.5% improvement in adversarial robustness over existing otate-of-the-art (Croce et al.) 2020). Its improvemett is consistent across different threat models (foo E2), network architec- tures, datasets, and robustness criteria (empirical or certified robustness). We also uncover that synthetic images from diffusion-based generative models are most helpful in improving robustness on real datasets. We further investigate the use of proxy distributions in robust training. In particular, investigate why current state-of-the-aee in inffusion-based models are significantly more helpful than their counterparts, such as generative adversarial networks (GANs).
Q.3 Can we develop a metric to characterize which proxy distribution will be most helpful in robust training? ? Our theory motivates the design of a measure of proximity between two distributions that incorporates the geometry of the distributions and can empirically predict the transfer of robustness. We propose a robust learning based approach where we use the success of a discriminator in dis- tinguishing adversarially perturbed samples of synthetic and real data measure of proximity. Discriminating between synthetic and real data is a common practice (Goodfellow et al. 2014 Gui al.) 2020). however, we find that considering adversarial perturbations on synthetic and real data samples is the key to making the discriminator an effective measure for this task. We demonstrate that the rate of decrease in discriminator success with an increasing size of perturbations can effec- tively measure proximity and it accurately predicts the relative transfer of robustness from different generative models.
We also leverage our robust discriminators to identify most helpful synthetic samples. We use the proximity of each synthetic sample to real data distribution, referred to as synthetic score, as a metric to judge their importance. This score be computed using output probability from a discriminator that is robustly trained to distinguish between adversarially perturbed samples from proxy and real data distribution. We demonstrate that selecting synthetic images based on their synthetic scores can further improve performance.
Contributions. We make the following key contributions.
We provide an analytical bound on the transfer of robustness from proxy distributions to real data distribution using the notion of conditional Wasserstein distance and further validate it experi- mentally.
Overall, using additional synthetic images, we improve both clean and robust accuracy on five different datasets. In particular, we improve robust accuracy by up to 7.5% and 6.7% in Eoo and & threat models, respectively, and certified robust accuracy (E2) by 7.6% on the CIFAR-10 dataset.
When selecting a proxy distribution, we show that existing metrics, such as FID, fail to determine the synthetic-to-real transfer of robustness. We propose a new metric (ARC) based on the dis- tinguishability of adversarially perturbed synthetic and real data, that accurately determines the performance transfer.
We also develop metric, named synthetic score, to determine the importance of each synthetic sample in synthetic-to- robustness transfer. We demonstrate that choosing samples with lower synthetic scores provide better results than randomly selected samples.
INTEGRATING PROXY DISTRIBUTIONS IN ROBUST TRAINING
In this section we propose to use samples from proxy distributions to improve robustness. We first provide analytical bounds the transfer of adversarial robustness from proxy real data
2

---

Published as a conference paper at ICLR 2022
distribution. Next, using robust discriminators provide metric based our analytical bound, which can accurately determine the relative ranking of different proxy distributions in terms of robustness transfer. Our metric can be calculated empirically (using samples from both distributions) and does not require the knowledge of the proxy or real data distribution. Finally, we present our robust training formulation (PORT) which uses synthetic samples generated by the generative model, together with real samples.
Notation. We represent the input space by X' and corresponding label space as V. Data is sampled from joint distribution D that is supported on X' x V. For a label we use D | to denote the conditional distribution of class y- We denote the proxy distribution as D. We denote the neural network for classification by : X' Z. parameterized by which maps input images to output probability vectors (z). We use h to refer to the classification functions that output labels. For a set S sampled from a distribution D, we use á to denote the empirical distribution with respect to set S. We use S D to denote the sampling of a dataset from a distribution D. We use (x; y) - D to denote the sampling of single point from D.
2.1 UNDERSTANDING TRANSFER OF ADVERSARIAL ROBUSTNESS BETWEEN DATA DISTRIBUTIONS
Since goal is to use samples from proxy distribution to improve robustness real data distribu- tion, we first study the transfer of adversarial robustness between two data distributions.
Definition (Average Robustness). We define average robustness for classifier h on distribution D according to distance metric d as follows: Roba(h, h, D) () DDinf M(e))ty ;(x,,))] where classifier h : X - y predicts class label of an input sample
This definition refers the expected distance to the closest adversarial example for each sample.
Formalizing transfer of robustness from proxy to real data distribution. In robust learning from proxy distribution, we are interested in bounding the average robustness of the classifier obtained by a learning algorithm (L), on distribution D, when the training set is a set S of n labeled examples sampled from a proxy distribution Í. In particular we want to provide lower bound on (ho D)].
the transferred average robustness i.e, E s- L=L(8)
In order to understand this quantity better, suppose h is classifier trained set S that is sampled from D, using algorithm L. We decompose Roba(h, D) to three quantities as follows:
Roba(h, D) = (Roba(h, D) Roba(h, D)) + (Roba(h, D) Roba $)) + Rob, S).
Using this decomposition, by linearity of expectation and triangle inequality we can bound trans- ferred average robustness from below by
E
[Rob,(h,
E [Rob,(h, D) Rob -
E [Rob, D) Rob, D)]]
St L(S)
8- L(8)
L(S)
Empirical robustness
Generalization penalty
Distribution-shift penalty
As the above decomposition suggests, in order to bound the average robustness, we need to bound both the generalization penalty and the distribution shift penalty. The generalization penalty has been rigorously studied before multiple works (Cullina et al., 2018 8 Montasser et al. 2019; Schmidt et al. 2018b1 8b). Hence, we focus bounding the distribution shift penalty. Our goal is to provide a bound on the distribution-shiff penalty that is independent related to the properties of the distributions. With this goal, we define a notion of distance between two distributions.
the classifier in hand and only
Definition 2 (Conditional Wasserstein distance). For two labeled distributions D and D supported on X x V, we define cwd according to a distance metric d as follows:
cw,
E
inf JeJ(Dly, (w.a²)) [d(x,
E
(-a)eD
2 Thii notion of robustness is also used in Gilmer et al. 2018
Diochnos et al. 2018 and Mahloujifar et al.
2019a
3

---

Published as a conference paper at ICLR 2022
where D) is the set of joint distributions whose marginals are identical D and D.
It is simply the expectation of Wasserstein distance between conditional distributions for each class. Now, we are ready to state our main theorem that bounds the distribution shift penalty for any learning algorithm based only the Wasserstein distance of the two distributions.
Theorem (Bounding distribution-shift penalty). Let D and D be two labeled distributions sup- ported on X y with identical label distributions, i.e., Vy E EY, ((,P((()))- y Pr(xy)-bly = y Then for any classifier h X² + y
[Roba(h, D) - Roba(h, D)1 s cwd,(D,,)
Theorem 1 shows how one can bound the distribution-shift penalty by minimizing the conditional Wasserstein distance between the two distributions. We provide its proof and empirical validation in Appendix A Even if we successfully reduce the generalization penalty, the distribution-shift penalty may remain the dominant factor in transferred robustness. This theorem enables us to switch attention from robust generalization to creating generative models for which the underlying distribution is close to the original distribution. In Appendix [A] we also provide two other theorems about the tightness of Theorem I and the effeet of combining clean and proxy data together.
2.2 WHICH PROXY DISTRIBUTION TO CHOOSE? APPROXIMATING CONDITIONAL WASSERSTEIN DISTANCE USING ROBUST DISCRIMINATORS
Our analytical results suggest that proxy distribution that has small conditional Wasserstein dis- tance to the real data can improve robustness. This means that optimizing for conditional Wasser- stein distance in proxy distribution (e.g., a generative model) can potentially lead to improvements in adversarial robustness. Unfortunately, it is generally a hard task to empirically calculate the con- ditional Wasserstein distance using only samples from the distributions (Mahloujifar al.] [201bb] Bhagoji et al. 2019). In this section, we introduce metric named ARC as surrogate for conditional Wasserstein distance that can be calculated when we only have sample access to the data distribu- tions. Before defining our metric, we need to define the notion of robust discrimination between two distributions.
Robust discrimination. Our metric works based on how well discriminator can robustly distinguish between samples from the real and proxy distributions. Compared to typical discriminator, the robust discriminator should be accurate even when there is an adversary who can per- turb the sampled instance by a perturbation of size c. In- tuitively, if there exists a successful and robust discrimi- nator for two distributions D and D. then it means that adversary can make instances of D to look like instances of even by making perturbations of size e. This means that D and D are far away from each other (Figure [b). On the other hand, if no robust discriminator exists, then it means that the adversary can "align" most of the mass of proxy distribution with that of real distribution by mak- ing perturbations of size at most e. This notion is closely related to the optimal transport between the proxy and real distribution. In particular, the optimal adversary here corresponds to a transport J E J(D, D) that minimizes ((D,,))-- z²) s e] (Compare with Definition 2). To be more specific, the goal of a robust discriminator a is to maximize its robust accuracy
Real o Procc-1 &
Real
o Pronysl Pracy--
(a) Original samples.
(b) Perturbed samples,
Figure 1: Why robust discrimination
is effective. (a) Without adversar- ial perturbations, a non-robust discrim- inator can perfectly distinguish both proxy distributions from the real distri- bution. (b) Under adversarial pertur- bations, classification between real and proxy-1 is much harder compared to real and proxy-2 distribution. The suc- cess of robust discriminator is depen- dent on the proximity of real and proxy distributions.
Racc, (a, D, δ) = I. Pr Va'' E Ball, Ball, (x')) = =1}+
- Pr..- [V'' E Ball, = =0]
'All the definitions of accuracy and robust accuracy in this section are defined for true distributions. How- ever, in the experiments work with their empirical variant.
4

---

Published as a conference paper at ICLR 2022
We Racc, (D, to denote the accuracy of best existing robust discriminator, namely, Ra, = min, Racc, D, D). Note that grows from 0 to co, the robust accuracy of any discriminator will decrease to at most 50%. If two distributions D and D are close to each other, this drop in accuracy happens much faster since the adversary can make images from two dis- tributions to look alike by adding smaller perturbations. We use this intuition and define our metric ARC as follows:
(,
1 ARC(D, = J (D, - -2)de.
In other words, the ARC metric is equal to the area under the robust discrimination accuracy perturbation curve (See Figure 3 for a sample of this curve.) In Section 3.2 we discuss how this metric can be calculated with only samples from the real data and proxy distributions. When lecting a proxy distribution, we choose the one with the smallest ARC value, since it is expected be closest to real data distribution. We also demonstrate that ARC metric is directly related to conditional Wasserstein distance. In particular, we have the following Theorem:
Theorem 2. For any two distributions D and D with equal class probabilities have cwd(D, D) 2 4 - ARC(D, Moreover, if for all labels y , (D y) and (D y) are two concentric uniform spheres, then have cwd(D, = 4 ARC(D, D).
Why non-robust discrimination is not an effective metric. Deep neural networks are commonly used as discriminator between synthetic and real images (Goodfellow al. 2014 Gui et al. 2020). In our experiments, we find that even a four-layer convolutional network can achieve near 100% classification accuracy on all selected proxy distributions (Appendix (.T). This result shows that non non-so discrimination is not an effective measure of proximity (as highlighted in Figure la
2.3 BRINGING IT ALL TOGETHER: IMPROVING ADVERSARIAL ROBUSTNESS USING PROXY DISTRIBUTIONS
Overview of robust training. The key objective in robust training is solve min E Ludo (0,I, U,,,,,90 Q), where Lade is determined by the training objective and Ω is the threat (z.g)-D
model. In adversarial training (Madry al. 2018 Zhang al.) 2019)] Carmon al.] 2019 Pang cet al. 2021). we train against projected gradient descent based (PGD) adversarial examples by sc- lecting Lodv (.) E(O, PGD(x. x. v)) In randomized smoothing (Cohen al., 2019 Salman et al. 2019 Sehwag et al. 2020 Carmon et al. 2019), where the objective is to achieve certified robustness (Wong& & Kolter 2018), we aim achieve invariance random Gaussian Noise by se-
lecting (.) E(0, xz 2) + (foax) (a + 8)), where ó N(0, o² 1). and Dzr.,.) is the KL-divergence. This loss function (Zheng et al. 2016), referred to as robust stability training (RST), performs better than using E x o. y) (Carmon et al. 2019). We refer the Lado in adversarial train- ing and randomized smoothing as Lggd and Lemooth. respectively. We represent the cross-entropy loss function, which is used to train the classifier, as {(.), where É(0, x, = (=log(fe(#)), y) and y is the one-hot vector encoding of yf
Our objective is to integrate synthetic samples from Proxy distributions in Robust Training (PORT). In particular, we use the following robust training formulation that combines samples from a real training dataset with synthetic samples.
min Laggi Logg = ?
E "(
Lad x. y. + (1 (1-
Ladu ( (0, x, y. (2)
(a.y)-
where 7 E [o. 1] and Lagg is the aggregated adversarial loss over both D and D. Depending on training objective, select either Lpgd or Ssmooth Lude- We approximate the aggregated loss using available training samples from the real data distribution (D) and set of synthetic images sampled from the proxy distribution (D). We select y through a hyperparameter search.
Which synthetic samples to choose? In particular, which set (S) of N synthetic samples from the proxy distribution (D) leads to maximum transferred robustness on real data, i.e.. sy- [R D)], where Ż is robust learning algorithm. While it can be solved in many different ways, we follow a rejection sampling based approach. In particular, we measure proximity of each synthetic sample real data distribution and use it metric accept or reject a sample.
5

---

Published as a conference paper at ICLR 2022
We output probability score from our trained robust discriminators measure of proximity. In particular we define synthetic-score( ) = miall (x;)) as the final score for each synthetic sample, where samples with lowest score prioritized in the selection.
EXPERIMENTAL RESULTS
First, we show that our proposed approach of using proxy distributions brings significant improve- ments in the performance of both adversarial training and randomized smoothing across both & and lg threat models (Section B. We also uncover that diffusion- basond generative models are more ef- fective proxy distributions than generative adversarial networks (GANs) on multiple datasets. Next delve deeper into why diffusion-based generative models are highly effective proxy distributions (Section 3.2). We find that the key reason behind the success of diffusion based models is the that there is no robust discriminator that can robustly distinguish between the samples from diffusion based models and real data distribution. We demonstrate that our proposed metric (ARC) provides a better characterization of the effectiveness of diffusion- based models than other widely used metrics. Finally, we investigate the effectiveness of adaptively selecting synthetic images in our framework.
3.1 IMPROVING ROBUSTNESS USING SYNTHETIC IMAGES FROM PROXY DISTRIBUTIONS
Setup. We consider five datasets, namely CIFAR-10
Krizhevsky et al. 2014), CIFAR- 100 (Krizhevsky et al. 2014), CelebA (Liu al., 2015). AFHQ (Choi et al. 2020). and Ima- geNet (Deng et al. 2009). We also work with commonly used Loo and l2 threat models for ad- versarial attacks and use AutoAttack (Croce Hein 2020) measure robustness. We provide
extensive details on the setup in Appendix B
Evaluation metrics for robust training. We use two key metries to evaluate performance of trained models: clean accuracy and robust accuracy. While the former refers to the accuracy on unmodified test set images. the latter refers to the accuracy on adversarial examples generated from set images. We refer to the robust accuracy of any discriminator trained to distinguish between synthetic and real data as robust discrimination accuracy. We also use randomized smoothing to measure certified robust accuracy, i.e., robust accuracy under strongest possible adversary in the threat model.
Synthetic data. We sample synthetic images from a generative models, particular from denoising diffusion-based probabilistic models (DDPM) (Ho et al., 2020; Nichol & Dhariwal, 2021). We pro- vide extensive details on the number of images sampled and the sampling procedure in Appendix [B] We y 0.4 it achieves best results (Appendix D). We combine real and synthetic images in 1:1 ratio in each batch, thus irrespective of the number of synthetic images, our training time is only twice of the baseline methods.
Table 1: State-of-the-art adversarial robustness. Comparing experimental results of our frame- work (PORT) with baselines for adversarial training the CIFAR-10 dataset for both too and & threat model. We sample synthetic images from the diffusion- generative model (DDPM). Clean/Auto refers clean/robust accuracy measured with AutoAttack.
(a) Eo threat model.
(b) lg threat model.
Method
Architocture
Parameters (M)
Cleme
Anto
Method
Architecture
Parameters (M)
Cleon
Anto
Zhang et all
2019
ResNet-18
11.2
62.0
48.7
Rice ct.
2020
ResNet-18
11.2
56.7
67.7
PURT
ResNet-18
11.2
84.6
55.7
POK
ResNet-18
11.2
89.8
74.4
2020
Wan-34-20
181.
Madry et
2015
ResNet-50
23.5
Gowal
X020
WaN-70-16
266.8
85.3
57.2
Gowal
X020
16
266.8
90.9
74.5
Zhong all
2019
WRN-34-10
46.2
84.9
13.1
Wi al.
20206
WRN-34-10
46.2
88.5
73.7
PURT
WRN-34-10
46.2
87.0
60.6
PURT
WRN-34-10
46.2
90.8
77.8
3.1.1 IMPROVING PERFORMANCE OF ADVERSARIAL TRAINING
State-of-the-art robust accuracy synthetic images (Table
Using synthetic images from diffusion-basse generative models (DDPM), our approach achieves ofate-of-the-ar the-hht-r robust accuracy in the category of not using any extra real world data (Croce et al. 2020). We improve robust accuracy by up to 7.5% and 6.7% over previous works in too and &g threat model, respectively.

---

Published as a conference paper at ICLR 2022
Notably, the gain in performance is highest for the CIFAR- 10 and Celeb-A datasets. Note that by using only synthetic images, our work also achieves competitive performance with previous works that use extra real-world images. For example, using additional real-data Carmon et al. (2019) achieve 59.53% robust accuracy on CIFAR-10 (foo) while we achieve 60.6% robust accuracy by using only synthetic data.
Table 2: Similar improvement on additional datasets. Our approach further improves both clean and robust accuracy on each of datasets of Tables [ and 2 Unless a better baseline is available in previous works, we compare
results with baseline robust training approach from Madry et al. (2018). Clean/Auto refers to clean/robust accuracy measured with AutoAttack. We provide results for AFHQ dataset in Table 8 in Appendix.
(a) CelebA (64 X 64)
(b) CIFAR-100 (32 x 32)
(c) ImageNet (64 x 64) F 2/255)
(r = 8/255)
fgfc 1.0)
Le 8/255)
6/ = 0.5)
Clean
Auto
Clean
Auto
Clean
Anto
Clean
Auto
Clean
Auto
Baseline
82.4
80.6
Baseline
58.4
27.8
62.9
Basaline
54.8
28.1
PORT
81.8
63.1
82.3
00.0
PORT
65.9
31.2
70.7
17.8
PORT
55.1
28.4
A
+2.4
+3.2
+1.7
+1.1
A
+7.5
+3.4
+7.8
+5.7
4
+0.3
+0.3
Proxy distribution offsets increase in network param- eters. We find that gains from using synthetic samples are equivalent to ones obtained by scaling network size by an order of magnitude (Table [D. For example, ResNet-18 18 network with synthetic data achieves higher robust accu- racy (foo) than WRN-34-20 trained without it, while having 16x fewer parameters than the latter. Similar trend holds for 34-0 networks, when compared with much larger WRN-70-16 network. This trend also holds for both for and Eg threat models.
Table 3: Additional baselines, Using
foo 8/255) attack for both datasets.
CIFAR-10U
Clean
Auto
Wu al
3020al
60.4
28.9
Rade & Moosavi Destooli
2021
61.5
28.9
Cui al
2021
60.6
29.3
PORT
60.6
30.5
CelobA
Clean
Auto
Simultaneous improvement in clean accuracy. Due to the accuracy vs robustness trade-off in adversarial train- ing, improvement in robust accuracy often comes at the cost of clean accuracy. However synthetic samples pro- vide boost in both clean and robust accuracy, simultaneously. Using adaptively sampled synthetic images, we observe improvement in clean accuracy by up to 7.5% and 7.8% across Loo and &g threat models, respectively.
TRADES
86.1
61.2
PORT
86.1
62.7
A
0.0
1.5
Comparison across generative models. We find that synthetic samples from diffusion-based gener- ative models (Ho et al. 2020 Nichol & Dhariwal 2021) provides significantly higher improvement in performance than generative adversarial networks (GANs) (Table 4 We further investigate this phenomenon in the next section.
We further analyze sample complexity of adversarial training using synthetic data in Appendix D. We also provide visual examples of real and synthetic images for each dataset at the end of the paper.
3.1.2 IMPROVING CERTIFIED ROBUSTNESS WITH RANDOMIZED SMOOTHING
We provide results on certified adversarial robustness in Table 5 We first compare the performance of our proposed approach with the baseline technique, i.e., RST (Carmon al. 2019). We achieve significantly higher certified robust accuracy than the baseline approach at all & perturbations bud- gets for both ResNet-18 and WRN-28-10 network architectures. Additionally, the robustness of our approach decays at a smaller rate than the baseline. At foo perturbation of 2/255, equivalent to & perturbation of 111/255, our approach achieves 7.6% higher certified robust accuracy than RST. We also significantly outperform other certified robustness techniques which aren't 't based on random- ized smoothing (Zhang et al.) 20200; Wong et al.) 2018: Balunovic & Vechev 2019). Along with better certified robust accuracy, approach also achieves better clean accuracy than most previous approaches, simultaneously.
Synthetic images vs real-world images. Using only synthetic samples (10M), we also outperform RST where it uses an additional curated set of 500K real-world images 3RST) While the latter achieves 63.8% certified robust accuracy, we improve it to 66.2%.
7

---

Published as a conference paper at ICLR 2022
Table 4: Comparing gener-
Table 5: Comparison of cer- tified robustness. Comparing clean accuracy (Clean) and cer- tified robust accuracy (Certi- fied) of our work with earlier approaches 110/255 lz per- turbation budget (equivalent to 252 so perturbation budget) on the CIFAR-10 dataset.
ative models. When choos- ing proxy distribution in PORT (Coo). DDPM model outper- forms the leading generative adversarial network (GAN) on each dataset.
Centifree accuracy
0.7
2.5
Our (talied-30 -0
0.1
0.6
4 rodius
Damase
Proxy Distribution
Cloae
Auto
Figure 2: Certified robust-
ness. Certified robust accuracy of baseline randomized smooth- ing technique, Lee,, RST (Car-)
None
84.9
63.1
CIFAR-10
StyleCIAN
86.0
52.5
Malhel
Ceniiled
DDPM
60.6
(eingic)
ColebA
StyleFommer
None
82.4
60.2
mon et al., 2019) and our work
CROWN
Wung er
Balomnic
Tormn al. 2020
X0b retemublll
61.1
TL.5
54.0
63.6
DDPM
84.8
63.4
at different perturbation budgets across two different network ar-
XST
Camter
None
64.8
28.1
RSTaa
Lamaon
90.7
63.
ImageNett
BigGAN
29.2
Polt (RceNct-11
70.1
04.0
DDPM
65.1
28.4
chitectures.
3.2 DELVING DEEPER INTO USE OF PROXY DISTRIBUTIONS IN ROBUST TRAINING
we showed that diffusion-based generative models are an excellent choice for proxy distribution for many datasets. Now we characterize the benefit of individual proxy distributions in our robust training framework. We consider seven different generative models, which are well-representattie of the state-of-the-ari on the CIFAR- 10 dataset.
Earlier in Section 3.1
Using synthetic-to-real transfer of robusiness as ground truth. From each generative model we sample one million synthetic images. We adversarially train ResNet-18 (He et al., 2016) network on these images and rank generative models in order of robust accuracy achieved on the CIFAR-10 test set. We provide further experimental setup details in Appendix C
Calculating ARC. At each perturbation budget (c), we adversarially train a ResNet-18 classifier to distinguish between synthetic and real images. We measure robust discrimination accuracy of trained classifier balanced held-out validation set. We calculate ARC by measuring the area under the robust discrimination accuracy and perturbation budget curve (Figure 3). We provide detailed comparison of it with other metrics in Table
Table 6: Comparing different generative models. We first ad- versarially train a ten class ResNet-18 18 model only on 1M syn- thetic images and measure its robust accuracy on the CIFAR-I0 test set. We use this transferred robustness as a ground truth for benefit of each model. Next we match ranking predicted by each metric with the ground truth ranking. In contrast to all three three baseline, ranking from our proposed metric (ARC) aceu- rately matches the ground-truth.
Robuse deecttiintion acturery
agaa
0.7
0.6
Calculating ARC. For every generative model and perturbation budget (e), we first adversarially train a binary clas- sifier on adversarial perturbed synthetic and CIFAR-10 im- ages. Next we measure its ro- bust discrimination accuracy on the validation set at the e value used in training. ARC is the area under the robust discrimination accuracy vs c curve.
Figure 3:
Rank
Model
Robust accurnyy
HD)
(1)
I-NNL))
ARG
CIFAR-10
48.7
(UC
(2)
0.06(D)
StyleGAN (C)
46.0
21)
10:24(1)
9.42
0.32
3
WGAN-ALP (LC)
43.5
12.96 (7)
8.34
10:10
(3)
(UC)
11.26 (5)
8.51
1.19
DiECCBigGAA (C)
33.7
4.30
9.17
9.84 (6)
(.30
NDA (C)
33.4
12.61 (6)
8:47 (6)
9.72 (5)
1.43
DiffBigGAN (C)
32.4
4.61
(4)
(7)
Mean absolute ranking difference
1.7
1.7
2.0
0.0
Using 50,000 training images from the CIFAR-J J0 dataset.
"C and refers uncooditioal and conditional generative models, respectively.
"We use numpy. trapz (Racc-O. 0.5, 5, <) calculate ARC.
8

---

Published as a conference paper at ICLR 2022
ARC is highly effective at determining synthetic to real transfer of robustness (Table b). Each of the baseline metrics, including FID which is widely used, fail in accurately predicting the transfer of robustness from synthetic to real distributions. Even more, they also fail to identify DDPM (Ho et al. 2020) as the most successful proxy distribution, Our proposed metric (ARC), which measures the distinguishability of perturbed synthetic and real images, exactly predicts the ranking of different generative models in terms of the transfer of robustness. It also provides deeper insight into why synthetic samples from DDPM models are highly effective compared to other models. As shown in Figure [] discrimination between DDPM samples and real images becomes almost impossible even very small perturbations budgets. more detailed comparison is provided in Appendix C.2
Adaptive sampling of synthetic data based on ARC (Appendix C.3 We compare the benefit of adaptive sampling with random sampling on CIFAR-10 dataset (for both &z and foo threat models).
Our adaptive sampling achieves an average of 0.5% and 0.2% improvement in robust accuracy over random sampling in the fo and lo threat models, respectively.
RELATED WORK
Transfer of adversarial robustness. This line of work focuses on the transfer of adversarial ro- bustness, i.c., correct classification even under adversarial perturbations, when testing the model on different data distributions (Shafahi et al., 2020 Sehwag al.) 2019). Note that this is different from just achieving correct classification on unmodified images across different distributions (Taori jet al., 2020 Hendrycks & Dietterich 2019). Here we provide a theoretical analysis of the transfer of adversarial robustness between data distributions.
Using extra curated real-world data in robust training. Prior works (Zhii et al., 2019 Carmon al. 2019 Uesato et al., 2019 Najafi et al.) 2019: Deng et al.) [02T] have argued for using more training data in adversarial training and often resort to curating additional real-world samples. In contrast, model the proxy distribution from the limited training images available and sample
additional synthetic images from this distribution.
Generative models for proxy distributions. State-of-the-us art generative models are capable of mod- cling the distribution of current large- image datasets. In particular, generative adversarial net- works (GANs) have excelled at this task (Goodfellow al. [014 Karras et al.] 2020 Gui et al., 2020). Though GANs generate images with high fidelity, they often lack high diversity (Ravuri & Vinyals 2019). However, samples from recently proposed diffusion process based models achieve both high diversity and fidelity (Ho et al.) 2020; Nichol & Dhariwal (021). Fréchet Inception Dis-
tance (FID) (Heusel et al., 201 7) and Inception Score (IS) (Heusel al.) 2017) are two common metrics to evaluate the quality of samples from generative models.
Using generative models to improve adversarial robustness. Earlier works have used generative models to learn training data manifold and the use it to map input samples to data manifold (Saman- gouei et al., 2018 Jaaal et al. [017]] Xu et al. 2018). However, most of these techniques are broken against adaptive attacks (Athalye et al. 2018 Tramer et al.) 2020). We use generative models to sample additional training samples which further improve the adversarial robustness.
Comparison with Rebuffi et al. (021). A concurrent work by Rebuffi et al. (2021) also uses randomly sampled synthetic images to improve adversarial robustness. In comparison, we provide a theoretical analysis of when synthetic data helps along with metrics optimize the selection of both generative models and individual samples. We also demonstrate an improvement in certified robust accuracy using synthetic samples. Despite these differences, similar benefits of using proxy distri- butions in two independent and concurrent works further ascertain the importance of this research direction.
DISCUSSION AND BROADER OUTLOOK
Using synthetic data has been compelling solution in many applications, such as healthcare (Jordon) jet al. 2018) and autonomous driving (Mayer et al., (016) since it makes collecting a large amount of data feasible. In a similar spirit, against adversarial attacks. We investigate foundational questions such as determining the transfer of robustness from synthetic to real data and determining selection criteria for how choose generative
synthetic data to make deep neural networks more robust

---

Published as a conference paper at ICLR 2022
models or individual samples. Finally, note that while it is crucial improve robustness against the threat of adversarial examples, it also has an unwanted side-effect in domains where adversarial examples used for good. Recent works use them to provide privacy the web (Shan et al. 2020) or to evade website fingerprinting methods (Rahman et al. 2020). Improving defenses against adversarial examples will negatively hurt these applications.
REPRODUCIBILITY
We provide proof of each of our theorems in Appendix A Similarly, we provide extensive details on our experimental setup in Appendix B Our work is also featured on RobustBench (Croce al.) 2020), an external benchmark for standardized evaluation adversarial robustness. Our robustly trained models are also available through the RobustBench APL. For further reproducibility, we have also submitted our code with the supplementary material.
REFERENCES
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of se- curity: Circumventing defenses to adversarial examples. In International Conference on Machine Learning, pp. 274-283. PMLR, 2018.
Mislav Balunovic and Martin Vechev. Adversarial training and provable defenses: Bridging the gap. In International Conference on Learning Representations, 2019.
Arjun Nitin Bhagoji, Daniel Cullina, and Prateek Mittal. Lower bounds on adversarial robustness from optimal transport. In Advances in Neural Information Processing Systems, pp. 7508, 2019.
Battista Biggio and Fabio Roli. Wild patterns: Ten years after the rise of adversarial machine learning. volume 84, pp. 317-331. Elsevier, 2018.
Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Šmdić Pavel Laskov, Gior- gio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. In Joint European conference on machine learning and knowledge discovery in databases, pp. 387-402. Springer, 2013.
Andrew Brock, Jeff Donahue, and Karen Simonyan. Large scale gan training for high fidelity natural image synthesis. In International Conference on Learning Representations, 2019.
Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C Duchi, and Percy S Liang. Unlabeled data improves adversarial robustness. In Advances in Neural Information Processing Systems, pp. 11190-1 1201, 2019.
Yunjey Choi, Youngjung Uh, Jaejun Yoo, and Jung- Woo Ha. Stargan v2: Diverse image synthesis for multiple domains. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 8188-8197, 2020.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In International Conference on Machine Learning, pp. 1310-1320. PMLR, 2019.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter- free attacks. In International Conference on Machine Learning, pp. 2206- 2216. PMLR, 2020.
Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: standardized adversarial robustness bench- mark. arXiv preprint arXiv:2010.09670, 2020.
Jiequan Cui, Shu Liu, Liwei Wang, and Jiaya Jia. Learnable boundary guided adversarial training. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 15721-15730, 2021.
10

---

Published as a conference paper at ICLR 2022
Daniel Cullina, Arjun Nitin Bhagoji, and Prateek Mittal. Pac-learning in the presence of adversaries. volume 31, pp. 230-241, 2018.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hi- erarchical image database. In 2009 IEEE conference computer vision and pattern recognition, pp. 2-5. leee, 2009.
Zhun Deng, Linjun Zhang, Amirata Ghorbani, and James Zou, Improving adversarial robustness via unlabeled out-of-domain data. In International Conference Artificial Intelligence and Statis- tics, pp. 2845-2855 PMLR, 2021.
Dimitrios I Diochnos, Saeed Mahloujifar, and Mohammad Mahmoody. Adversarial risk and robust- ness: general definitions and implications for the uniform distribution. In Proceedings of the 32nd International Conference on Neural Information Processing Systems, pp- 10380-10389, 2018.
DC Dowson and BV Landau. The fréchet distance between multivariate normal distributions. In Journal of multivariate analysis, volume 12, pp. 450-455, 1982.
Justin Gilmer, Luke Metz, Fartash Faghri, Samuel S Schoenholz, Maithra Raghu, Martin Watten- berg, and Ian Goodfellow. Adversarial spheres. arXiv preprint 1rXiv:180.00277 2018.
Clark R Givens, Rae Michael Shortt, et al. A class of wasserstein metrics for probability distribu- tions. In The Michigan Mathematical Journal, volume 31, pp. 231-240, 1984.
Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In Advances in Neural Infor- mation Processing Systems, volume 27, 2014.
Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint Stt1:20000035933 2020.
Jie Gui, Zhenan Sun, Yonggang Wen, Dacheng Tao, and Jieping Ye. A review generative adver- sarial networks: Algorithms, theory, and applications. arXiv preprint arXiv:2001.069.77 2020.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference computer vision and pattern recognition, pp- 770-778, 2016.
Dan Hendrycks and Thomas G. Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. In 7th International Conference on Learning Representations, 2019.
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge local nash equilibrium. In Advances in neural information processing systems, volume 30, 2017.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In Advances in Neural Information Processing Systems, volume 33, pp. 6840-6851, 2020.
Ajil Jalal, Andrew Ilyas, Constantinos Daskalakis, and Alexandros G Dimakis. The robust manifold defense: Adversarial training using generative models. arXiv preprint 17 2017.
James Jordon, Jinsung Yoon, and Mihaela Van Der Schaar. Pate-gan: Generating synthetic data with differential privacy guarantees. In International Conference on Learning Representations, 2018.
Tero Karras, Miika Aittlla, Janne Hellsten, Samuli Laine, Jaakko Lehtinen, and Timo Aila. Training generative adversarial networks with limited data. In Advances Neural Information Processing Systems, volume 33, pp. 12104-121 121 14, 2020.
Alexander Kolesnikov, Lucas Beyer, Xiaohua Zhai, Joan Puigcerver, Jessica Yung. Sylvain Gelly, and Neil Houlsby. Big transfer (bit): General visual representation learning. In ECCV, 2020.
Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton. The cifar- 10 dataset. online: http://www. cs. foronto. edu/kriz/cifar huml, 2014.
11

---

Published as a conference paper at ICLR 2022
Yann LeCun and Corinna Cortes. MNIST handwritten digit database. AT&T Labs [Online]. Avail- able: http://yann. lecun. com/exdb/mmist, 2010.
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of the IEEE international conference on computer vision, pp- 3730-3738, 2015.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant adversarial attacks. International Conference Learning Representations, 2018.
Dhruv Mahajan, Ross Girshick, Vignesh Ramanathan, Kaiming He, Manohar Paluri, Yixuan Li, Ashwin Bharambe, and Laurens Van Der Maaten. Exploring the limits of weakly supervised pretraining. In Proceedings of the European Conference Computer Vision (ECCV), pp. 181- 196, 2018.
Saeed Mahloujifar, Dimitrios Diochnos, and Mohammad Mahmoody. The curse of concentration in robust learning: Evasion and poisoning attacks from concentration of measure. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 33, pp. 4536-4543, 2019a.
Saeed Mahloujifar, Xiao Zhang, Mohammad Mahmoody, and David Evans. Empirically measuring concentration: Fundamental limits on intrinsic robustness. arXiv preprint arXiv:190s 12202,, 2019b.
Nikolaus Mayer, Eddy Ilg, Philip Hausser, Philipp Fischer, Daniel Cremers, Alexey Dosovitskiy, and Thomas Brox. A large dataset to train convolutional networks for disparity, optical flow, and scene flow estimation. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 4040-4044 2016.
Omar Montasser, Steve Hanneke, and Nathan Srebro. classes are adversarially robustly learnable, PMLR, 2019.
but only improperly. In Conference on Learning Theory, pp.
Amir Najafi, Shin-ichi Maeda, Masanori Koyama, and Takeru Miyato. Robustness to adversarial perturbations in learning from incomplete data. In Proceedings of the 33rd International Confer- ence on Neural Information Processing Systems, pp. 5541-5551, 2019.
Preetum Nakkiran, Behnam Neyshabur, and Hanie Sedghi. The bootstrap framework: Generaliza- tion through the lens of online optimization. In International Conference Learning Represen- tations, 2021.
Alexander Quinn Nichol and Prafulla Dhariwal. Improved denoising diffusion probabilistic mod- els. In Proceedings of the 38th International Conference on Machine Learning, volume 139, pp. 1162-81771 PMLR, 2021.
Tianyu Pang, Xiao Yang. Yinpeng Dong, Hang Su, and Jun Zhu. Bag of tricks for adversarial training. In International Conference on Learning Representations, 2021.
Jeeseung Park and Younggeun Kim. Styleformer: Transformer based generative adversarial net- works with style vector. arXiv preprint arXiv:2106.07002, 2021.
Rahul Rade and Seyed-Mohsen Moosavi-Dezfooli. Helper-based adversarial training: Reducing excessive margin to achieve better accuracy robustness trade-off. In ICMI. 202/ Workshop on Adversarial Machine Learning, 2021.
Mohammad Saidur Rahman, Mohsen Imani, Nate Mathews, and Matthew Wright. Mockingbird: Defending against weep-learming-baeee based website fingerprinting attacks with adversarial traces. vol- ume 16, pp. 1594-1609. IEEE, 2020.
Suman Ravuri and Oriol Vinyals. Classification accuracy score for conditional generative models. In Advances in Neural Information Processing Systems, volume 32, 2019.
Sylvestre-Alvis Rebuffi, Sven Gowal, Dan A Calian, Florian Stimberg, Olivia Wiles, and Tim- othy Mann. Fixing data augmentation to improve adversarial robustness. arXiv preprint 103.v:2103.01946, 2021.
12

---

Published as a conference paper at ICLR 2022
Benjamin Recht, Rebecca Roelofs, Ludwig Schmidt, and Vaishaal Shankar. Do imagenet classifiers generalize to imagenet? In International Conference on Machine Learning, pp. $389-5400. PMLR. 2019.
Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in adversarially robust deep learning. In International Conference Machine Learning, pp.
PMLR, 2020.
Hadi Salman, Jerry Li, Ilya P. Razenshteyn, Pengchuan Zhang, Huan Zhang, Sébastien Bubeck, and Greg Yang. Provably robust deep learning via adversarially trained smoothed classifiers. In 32 Annual Conference on Neural Information Processing Systems, pp. 11289-11 11300, 2019.
Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-gan: Protecting classifiers against adversarial attacks using generative models. In International Conference on Learning Represen- fations, 2018.
Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. Adver- sarially robust generalization requires more data. In Advances in Neural Information Processing Systems, volume 31, 2018a. 8a.
Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. Ad- versarially robust generalization requires more data. arXiv preprint arXiv: 11285, 2018b.
Vikash Sehwag, Arjun Nitin Bhagoji. Liwei Song, Chawin Sitawarin, Daniel Cullina, Mung Chiang, and Prateck Mittal. Analyzing the robustness of open-world machine learning. In Proceedings of the 12th ACM Workshop Artificial Intelligence and Security, pp. 105-116, 2019.
Vikash Sehwag, Shiqi Wang, Prateek Mittal, and Suman Jana. Hydra: Pruning adversarially robust neural networks. Advances in Neural Information Processing Systems, volume 33, pp. 19655- 19666, 2020.
Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! In Advances in Neural Information Processing Systems, 2019.
Ali Shafahi, Parsa Saadatpanah, Chen Zhu, Amin Ghiasi, Christoph Studer, David W. Jacobs, and Tom Goldstein. Adversarially robust transfer learning. 8th International Conference on Learn- ing Representations, 2020.
Shawn Shan, Emily Wenger, Jiayun Zhang, Huiying Li, Haitao Zheng, and Ben Y Zhao. Fawkes: Protecting privacy against unauthorized deep learning models. In 29th USENIX Security Sympo- sium, pp. 1589-1604, 2020.
Abhishek Sinha, Kumar Ayush, Jiaming Song, Burak Uzkent, Hongxia Jin, and Stefano Ermon. Negative data augmentation. In International Conference on Leurning Representations, 2021.
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In Interna- tional Conference on Learning Representations, 2020.
Chen Sun, Abhinav Shrivastava, Saurabh Singh, and Abhinav Gupta. Revisiting unreasonable ef- fectiveness of data deep learning era. Proceedings of the IEEE international conference on computer vision, pp. 843 852, 2017.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfel- low, and Rob Fergus. Intriguing properties of neural networks. In 2nd International Conference on Learning Representations, 2014.
Rohan Taori, Achal Dave, Vaishaal Shankar, Nicholas Carlini, Benjamin Recht, and Ludwig Schmidt. Measuring robustness to natural distribution shifts in image classification. In Advances in Neural Information Processing Systems, volume 33, pp. 3583-185599 2020.
Dávid Terjek. Adversarial lipschitz regularization. In International Conference on Learning Repre- sentations, 2019.
13

---

Published as a conference paper at ICLR 2022
Yuan Tian, Qin Wang, Zhiwu Huang, Wen Li, Dengxin Dai, Minghao Yang, Jun Wang, and Olga Fink. Off-policy reinforcement learning for efficient and effective gan architecture search. In European Conference on Computer Vision, pp. 175-192. Springer, 2020.
Antonio Torralba and Alexei A Efros. Unbiased look dataset bias. In Conference on Computer Vision and Puttern Recognition (CVPR), pp. 1521-1528. IEEE, 2011.
Florian Tramèr, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. In 33 Annual Conference on Neural Information Processing Systems, 2020.
Jonathan Uesato, Jean-Baptiste Alayrac, Po-Sen Huang, Alhussein Fawzi, Robert Stanforth, and Pushmeet Kohli. Are labels required for improving adversarial robustness? In Advances in Neural Information Processing Systems, volume 32, 2019.
Linnan Wang, Saining Xie, Teng Li, Rodrigo Fonseca, and Yuandong Tian. Sample-efficient neural architecture search by learning action space. arXiv preprint arXiv:1906.0668 2019.
Eric Wong and Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. In International Conference on Machine Learning, pp. 5286-5295. PMLR, 2018.
Eric Wong, Frank R. Schmidt, Jan Hendrik Metzen, and J. Zico Kolter. Scaling provable adversarial defenses. 3/ Annual Conference on Neural Information Processing Systems, pp. 8410-8419, 2018.
Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust gener- alization. Advances in Neural Information Processing Systems, 33, 2020a.
Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust gener- alization. volume 33, 2020b.
Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. In 25th Annual Network and Distributed System Security Symposium, 2018.
Sergey Zagoruyko and Nikos Komodakis. Conference, 2016.
Wide Residual Networks. In British Machine Vision
Runtian Zhai, Tianle Cai, Di He, Chen Dan, Kun He, John Hopcroft, and Liwei Wang. Adversarially robust generalization just requires more unlabeled data, arXiv preprint arXiv: 00555, 2019.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning, pp. 7472-7482, 2019.
Huan Zhang, Hongge Chen, Chaowei Xiao, Sven Gowal, Robert Stanforth, Bo Li, Duane S. Boning, and Cho-Jui Hsieh. Towards stable and efficient training of verifiably robust neural networks. In 8th International Conference on Learning Representations, 2020.
Shengyu Zhao, Zhijian Liu, Ji Lin, Jun-Yan Zhu, and Song Han. Differentiable augmentation for data-efficient gan training. Advances in Neural Information Processing Systems, 33, 2020.
Shuai Zhao, Liguang Zhou, Wenxiao Wang, Deng Cai, Tin Lun Lam, and Yangsheng Xu. Towards Better Accuracy-efficienge Trade-offs: Divide and Co-training. arXiv preprint arXiv:2011. 2020.
Stephan Zheng, Yang Song. Thomas Leung, and Ian Goodfellow. Improving the robustness of deep neural networks via stability training. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 4480-4485 2016.
14

---

Published as a conference paper at ICLR 2022
A THEORETICAL RESULTS
In this Section, we first provide the proofs of Theorem and 2. Then we provide some additional results showing the tightness of our Theorem I and also the effect of combining real and proxy data on our Theorem. Finally, we provide some experimental result that validate our theory.
A.1 PROOF OF THEBREE 1
Theorem 1: Let D and D be two labeled distributions supported X x y with identical label distributions, ie.. Vy E E,, DV,Yr(a))nnL = y²1 PI(x.))-Dly = y y'1. Then for any classifier h x +
[Roba(h, D) Roba(h, D)I cwd,(D,
Sketch of the proof. We first provide an informal sketch of the proof and then formalize the steps after that. Consider D' to be the distribution that is the outcome of the following process: First sample (x, v) from D, then find the closest z' such that h(x') y and output (x', v1 Also consider similar distribution D' corresponding to D. We now prove Lemma that shows the conditional Wasserestein distance between D and D' is equal to Roba(h, D).
Lemma 3. We have Roba(h, D) = cwd( D, D') and Roba(h, D) = (D) D').
Proof. Let Jy be the optimal transport between DIy and D'ly. Also let Jy be the joint distribution (x, a') that obtained by first sampling from y and then setting x' arg min d(x, a²). The marginals of Jy are equal to D) y and D¹ Hence, Jy is valid transport between D) | and D' y. Also, define a potentially randomized perturbation algorithm A that given an input x samples (x,xx') + Jyy x, conditioned on x and outputs a'. We have Roba(h, D)
E inf d(x, x')] (x.,y)- h(a")ay
IE [ inf d(s, x0)1= (-y)=D x- Mad')ty
E E [d(x,>')]] [d(,,, (x,2)),,
On the other hand, because for all x we have h(A'(()) inf, infyenee)) d(x, x'). Therefore we have
# y then d(x, (')))) 2
Roba(h, D)
E inf d(r,,')] (a.0)=D Me))+y
E E [d(x, (x))) (a,y)=
[d(x x1)1
(o,
Therefore we have
Rob
E [d(x, [d(x,,))]]=
E
E
(d(z,x'))
(1)
(sa)= D',DD"rr, (,,,)'1,
(sy)= (x,))=1,
On the other hand, because Jy is the optimal transport, we have
E E cwd,(D, (1a) (n,)))J,
[d(x, x')]
E
E
[d(x,x)))
(2)
(1a0)= (a
Now combining Equations and conclude that
E CD, (-a)= (1,2))1 [d(xx x
E
E [d(x, x']] Rob D).
(-0)) (n,")=
Similarly, also prove that cwd,, (D, D') (h,
Herre assume that the closest point exists. Otherwise, We can set o' so that the distance is arbitrarily close the infimum and the proof follows.
15

---

Published as a conference paper at ICLR 2022
By the way the distributions D' and D' are defined have
cwd cwd(D, and cwd(D, cwd cwd(D, D').
Roughly, the reason behind this is that all examples (x',v) sampled from D' could be seen as an adversarial example for all elements of D with the label And we know that D' consists of optimal adversarial examples for D, therefore, the optimal transport between D and D' should be smaller than the optimal transport between D and D'. Also, by triangle inequality for Wasserestein distance we have,
cwd (D, D') cwd(D,, D) cwd(D, D')
Now using Lemma 3 and Equations and and we have
Roba(h, D) cwd D, D') s cwd( D') cwd( +)w D') cwd( D)) D). (5)
With similar argument, because of symmetry of and D, we can also prove
Rob,(h, D) cwd(D, Roba(h,
(6)
Combining inequalities 5 and 7
get
- -wd D) s Roba(h, D) Rob,(h, D) s cwd(D, D)
(7)
which finishes the proof.
Full proof. The following is a succinct formalization the proof steps mentioned above, let J inf (Dly be the optimal transport between the conditional distributions D y and | y. We have
Roba(h, D)
E
E
inf d(a',a)) xx]]
x= Dly (.
E (.,))D
E
inf d(r',=)] h(a))(
E (./)=D
E
inf d(x", ,a) + d(x x))
(2,2") LMx')+
inf d(x² .e)) ]] (.u))D (= MMz/)y
E
[d(x") .]]]
(.w))D
(n.a)))
E [ inf d(x", a²)] (D. (=".))= M(23)e
Roba(h, D) + (D, D).
With a similar argument we get Ro D) Roba(h, +)d D) and the proof is complete.
A.2 PROOF OF THEOREM 2
Theorem 2. For any two distributions D and D with equal class probabilities have cwd(D, D) z 4ARC(D,D) Moreover, if for all labels y (D y) and (D 3) two centric uniform I, spheres, then we have cwd(D, D) 4ARC(D,
Proof. We start by proving a lemma.
"The statement of theorem in the main body has typographical that is fixed here.
16

---

Published as a conference paper at ICLR 2022
Lemma 4. Let J E D) be arbitrary transport between D and D. Then, for any discrimi- nator a we have,
1 (o, D,D) $ Pr(x,))- [d(x, xx) >e]
Proof. Consider an adversary AG that on input x sampled from D, samples a pair (x, xr,x)) J J[1] x from the transport and return center point x' between æ and x' such that d(z, x") d(x', (0) = d(x, x/2 d(x, x²) s c. Otherwise, it returns z. Also, on a in input x' sampled from D it samples pair (x,x²) - J ][2] x. from the transport and return a center point x between x and x' such that d(x, = d(x', x d(x, a') //2 if d(x,, x') S Otherwise, it returns x'.
Denote DA = #5# to be the push-forward of under Ay. And also denote D = A Now we have, A(DA. DA) P((a.)))s_d((; x/) <] where 5 is the total variational distance. Therefore, no discriminator a can distinguish D' from D with accuracy more than 1 (ld(..a)
Now, let J Eyy- a be transport between D and D where J the optimal transport between D and D y and oi is the probability of class for D and D. using Lemma we have
Racc (D, 1 -(d,, x²) 2c]
2
Therefore we have
S( [Racc" (D. 2 Ide 00 P"(w:))->rd(x,,))) 2c]
(o
0o P"(z.d))-((((x,)) E]
de
4 de.
Now, by integration by parts we have
So 00
(a ( e] 00 + +fo Pr [d(xxx') Id = elede (na))
Pr [d(x,x') clde = Pr [d(x,2)) (x."")--
+
(a,a")--*
cwd(D,
Therefore, we have
ARC(D, D) [Racc, (D, - 1 cwd(D,
Now prove the second part theorem about the case of concentric spheres we start by following lemma.
Lemma 5. Let D, = D y and Dy 5 y- Assume Dy and Dy are two concentric spheres according the some lp norm. Also let J JDD Dyy be the optimal transport between Dy and Dy with respect to the same norm. Then we have,
Prezeee [d(xr x') > >
1 Racc 2 (D, =
2
Proof. let D be the uniform sphere centered point and with radius and let D be the uniform sphere centered at point e and with radios r. Observe that the optimal robust distinguisher for any E < r+f rIf is the one that assigns to æ if d(c,x) f=r and assigns otherwise and for any 2
for we have 2
/2 (D, D) 1.
17

---

Published as a conference paper at ICLR 2022
On the other hand, for any f-r we have
22, = 0.5.
(10)
Now consider optimal transport J between D and D. Observe that this transport is equivalent to the following distribution:
J' (D, (D-
Therefore, we have Pr(x,.) (d(x,x))) F - r] Which implies for any < F we have
Pr [d(x, x > = (x,a")-
(11)
and for any e F
Pr (a,a") -
[d(2, c] =
(12)
Putting Equations equation 9 of Lemma.
equation
10 equation
and equation
12 together, finish the proof
Having Lemma we can follow the same steps as before except that instead of Inequality equation have an equality of the following form.
00 [Race, (D, z Ide
00 P[(0,))---dd((,))) 2e] de
0
y de
cwd( DD D)
4
A.3 EFFECT OF COMBINING PROXY AND REAL DATA ON THEOREM 1
natural question what happens when we combine the original distribution with the proxy dis- tribution. For example, one might have access to generative model but they want to combine the samples from the generative model with some samples from the original distribution and train robust classifier on the aggregated dataset. The following corollary answers this question.
Theorem 6. Let D and D be two labeled distributions supported on X Y with identical label distributions and let D p- (1-p)- be the weighted mixture of D and D. Then for any classifier h : X Y
(Rb&(h, D) Rob,(h, D)I (1 p1) (D, D).
Note that the value of is usually very small as the number of data from proxy distribution is usually much higher than the original distribution. This shows that including (or not including) the data from original distribution should not have a large effect the obtained bound distribution-she penalty.
We just need to show that (w, (1 (1-p) cD, Note that since the label distributions are equal, we have
Proof of Theorem 6
DIy=p. (1-p)-
Now let Jy, be the optimal transport between D y and D y. Now construct a joint distribution J = (1 (1-p) J + (x,2).-Diy Notice that J is joint distribution with marginals equal to D and D. Therefor J' is transport between D and 1 and calculate its cost. We have
18

---

Published as a conference paper at ICLR 2022
E [d(x, [ (r,a")>
E
[d(x,x)]++ I [d(x,x)]] (1-p) E [d(z,x))]
(,,")),,
x+Dly
(z,z)~J,
Therefore, we have
cwd(D, D, D) s E (ww))= (a,")>,,
[d(x, x z')]] (1-p)- (1a)=D (2,z))J,
E
[d(2, x )]] (L-p))cwd(D) D).
A.4 TIGHTNESS OF THEOREM
Here, show theorem that shows bound distribution-shit penalty is tight. The following theorem shows that one cannot obtain bound on the distribution-shi penalty for a specific classifier that is always better than our bound.
Theorem (Tightness of Theorem 1). For any distribution D supported X XxY, any classifier h, any homogeneous distance d and any Roba(h, D), there is labeled distribution D such that
Roba(h, D) Roba(h, D) cwd D)=
Proof. for E [O0, let D, be the distribution of the following process: First sample (z, y) from D, then find the closest x' such that M(aa) y and output (x + a(x' x), ft); y). By definition, the conditional Wasserestein distance between D and D equal to Rob,(h, D). We also have Cw D.)) a cw
Observe that for any classifier we have Roba(h, (1- ar Rob, D) because (x',y) is an adversarial example for (ar, y), then a' is also an adversarial example for (a + a(x' - x)..) with distance (1 a)d(x, 2'). On the other hand we have Roba(h, Da) 2 (1 - a) Roba D) because any adversarial example for (æ + a(x' - =), y) with distance r is also an adversarial example for with distance at most r ad -x) and since be at least a('' - x). Therefore, we have Roba(h, D = (1 a)) Roba(h, D). Putting everything together and setting e/ (h, D)we have
the optimal adversarial example for x then must
Roby D) Roby(h, D.) aRoba D) = acwd(D, Dy) cwd(D, D.) =e.
Note that Theorem Only shows the tightness of Theorem for specific classifier. But there might exist a learning algorithm L that incurs much better bound in the expectation. Namely, there might exist such that for any two distributions and H have
E
(R, D) Roba D)] < cwd(D, (od(DD)) D).
S-1" L(S)
We leave finding such an algorithm as an open question.
A.5 EXPERIMENTAL VALIDATION OF MAIN THEOREM
In theorem we prove that transfer of adversarial robustness between two distributions is upper bounded by their conditional Wasserstein distance. Now we provide empirical validation of this result. We consider a 10-class classification problem where each class is modeled using 128- dimensional multivariate normal distribution. In contrast to real-world datasets, where the underly- ing distribution of the data is unknown, we can efficiently and exactly calculate Wasserstein distance on this synthetic dataset. We robustly train four-layer convolutional network it. To construct a proxy distribution, we perturb both mean and covariance parameters across each class. On each proxy distribution, measure the average robustness of the pre-trained model and its conditional
19

---

Published as a conference paper at ICLR 2022
Diff. in Avg. robustness
10a
10
10-3
10
100
10a
Conditional Wasserstein distance
Figure 4: Validating the upper bound from Theorem 1. The green line is the upper bound calculated by Wasserstein-2. Note that the Wasserstein-1 (The bound of Theorem 1) is a tighter upper-bound but it does not have a closed form for normal distributions.
Wasserstein distance from the original distribution. We use Wasserstein-2 distance which has closed-form expression for normal distributions (Givens et al. 1984). As shown in Figure 4 the difference in average robustmess upped bounded by the conditional Wasserstein distance.
B ADDITIONAL DETAILS ON EXPERIMENTAL SETUP
We describe experimental details common across most experiments in this section. We discuss design choices pertaining to individual experiments in their respective sections.
Training setup. We use network architectures from the ResNet family, namely ResNet- 18 (He et al. 2016) and variants of WideResNet (Zagoruyko & Komodakis (016). We train each network using stochastic gradient descent and 0.1 learning rate with cosine learning rate decay, weight decay of 10 batch size 128, and 200 epochs. We use x 10 weight decay on CIFAR-100 --0 dataset, since higher weight decay further reduces the generalization gap on this dataset. We work with five datasets, namely CIFAR-10, CIFAR- 100, ImageNet (64 x size images), CelebA (64 x 64), and AFHQ (224 x 224). For CelebA (Liu et al. 2015) dataset, we consider four-class classification problem based on the attribute smile and male, i.e., smile/male, smile/not-male, not-smile/male, not-smile/not-male (total 200K images). Animal Faces-High-Quality (AFHQ) dataset comprises 15K images for three classes: cat, dog, and wild animals. Thus we consider the task three-class classification this dataset. To reduce the computational cost on ImageNet dataset, we use the free adversarial training (Shafahi et al. 2019) procedure. We use the ResNet- 88 model for CIFAR-10, ImageNet, CelebA, and AFHQ dataset. However, for CIFAR-10 and CIFAR-100 dataset, also use much larger WRN-34-10 network.
Robust training parameters. We consider both 1oo and threat models. For CIFAR-10 and CIFAR-100 dataset, we use the commonly used perturbation budget (e) of 8/255 and 127/255 for los and l2 threat model, respectively. For other three dataset too, we choose commonly used pertur- bation budgets. We perform adversarial training using 10-step projected gradient descent attack (PGD-10) and benchmark test set robustness with the much stronger AutoAttack Croce & Hein 2020). We use 3 = 6, a = 0.25, 100 samples for selection, and 10, 000 samples for estimation in randomized smoothing, as described in CnChh et al. (2019).
Generative models. We consider seven different generative models for the CIFAR-10 and two different networks for the CelebA and ImageNet dataset. In Table 7 We provide the number of synthetic images generated from each model and whether the generated images are labelled or un- labeled. If the model is unconditional, i.e., only generates unlabeled images, label the images using an additional classifier. We use state-of-the-art LaNet (Wang et al. 2019) network to label
'The bound in our thcorem is based on W,. Since we know W, Wz, using W2 provides loose upper bound.
We don't it report numbers with PGD attacks as AutoAttack already captures them while also making it casier compare with other works (Croce al. 2020
20

---

Published as a conference paper at ICLR 2022
images for the CIFAR-10 dataset. LaNet network is trained only on the training images of the CIFAR-10 dataset and achieves 99.0% accuracy on its test set. For CelebA dataset, we train a ResNet50 model to label synthetic images. For adaptive sampling of synthetic images for CIFAR- 10 dataset, we first sample of set of 15M" synthetic images from the DDPM model. Next we select 10M synthetic images with the lowest synthetic score from this set.
Table 7: Generative models for each dataset. In this table list the different generative models used for each dataset and the number of synthetic images sampled form each model. We also indicate whether the generative models generate labeled images, i.c., class-conditioned. not class- conditioned, the model only generated unlabeled synthetic images.
Number of training
Number of synthetic images
Generative model
Class-conditined
images in dataset
DDPM Ho al.
2020
10M
StyleGAN Karras et al 2020
10M
WGAN-ALP Terjek
2019
1M
CIFAR-10
50K
E2GAN (Tia et 2020
DifiCrBigGAN Zhao
2020
1M
NDA (Sinha et ul. 202
1M
DiffBigGAN Zhao
2020
StyleFormer Park & Kim
202
1M
CelebA
120K
DDPM Song et all,
2020
BigGAN Brock al.
2019
ImageNet
1.2M
DDPM Niicoo & Dhariwal
2021
400K
CIFAR-100
50K
DDPM Nichoo Dhariwal
2021
AFHQ
15K
StyleGAN Karras al.
2020
300K
Evaluation metrics for generative models. We use following existing baseline metrics to evaluate the quality of synthetic samples. 1) Fréchet Inception Distance (FID): It measures the Fréchet distance (Dowson & Landau 1982) between features of synthetic and real images extracted from an Inception- network. 2) Inception score (IS): Unlike FID, Inception score only uses synthetic data with the goal to account for both fidelity and diversity of synthetic data. 3) Nearest neighbour distance (I-NN): It computes the average distance synthetic image to the nearest real image in the pixel space. 4) ARC: This is the metric propose and it measures distance between synthetic and real data based on the success of a robust discriminator, We compare performance all three baselines with proposed metric.
Computational cost. In addition to robust training, sampling from generative models is another key contributor to the computational cost in approach. We sample images from the DDPM model using 250 steps for both CIFAR-10 and ImageNet datasets. Using an RTX 4x2080Ti GPU cluster, it takes 23.8 hours to sample one million images the CIFAR-10 dataset. With the
setup, it takes 26.1 hours to sample 100K images for the 64 x 64 ImageNet dataset. On both models, we use the publicly available checkpoints of pretrained generative model
[0] Note that both training generative models and sampling from them is a one-time cost. Once the pretrained checkpoints and
synthetic images are made publicly available, they can be directly used in downstream tasks. We will make our code and synthetic data publicly available.
C DELVING DEEPER INTO ROBUST DISCRIMINATION AND ARC
We propose metric (ARC), to rank different generative models in order of robustness transfer from their samples to real data. Now we provide experimental details on how we measure ARC and its comparison with other baselines.
We use the 6M randomly sampled images made available by Nakkiran 2021 along with 9M more sampled by us using improved sampling techniques (Nichol Dhariwal 2021) from the DDPM model.
10 httpss: / thub. com/ oppnaii imm di Ffusion
21

---

Published as a conference paper at ICLR 2022
Table 8: Using synthetic data also improves clean and robust accuracy on AFHQ (Choi et al. 2020) dataset. Baseline refers to adversarial training based on Madry et al. Madry et al. 2018). Clean/Auto refers to clean/robust accuracy measured with AutoAttack. We use a ResNet- 18 net- work and randomly sampled synthetic images.
4/255
8 8/255
5.0
Clean
Auto
Cleon
Auto
Clean
Audo
Clean
Auto
Baseline
98.8
93.3
98.4
84.3
98.9
93.7
98.7
88.8
PORT
99.1
93.5
98.8
86.5
99.0
94.0
98.8
89.2
A
+0.4
+0.1
+0.1
-0.4
Table 9: Success of different network architectures in classifying synthetic images from real-world image on CIFAR-10 dataset.
Model
DDPM
StyleGAN
WGAN-ALP
E2GAN
DilICrBigGAN
NDA
DiABiiGAA
CNN-2
59.1
94.3
99.1
97.3
92.2
95.4
97.7
CNN-4
97.0
99.1
99.9
99.7
94.6
99.8
99.7
R8sNet-18
98.3
99.9
99.9
99.9
99.6
99.9
99.9
Setup. A critical component in approach is training robust binary discriminator to distinguish between real and synthetic data. We use a ResNet-18 network for this task and train it for 100 epochs with 0.1 learning rate, 128 batch size, and le-4 weight decay. We use randomly sampled set of one million images from each generative model. We keep 10, 000 synthetic images from this set for validation and train on the rest of them. We specifically choose 10, 000 images as it's equal to the number of test images available in the CIFAR-I0 test set, thus balancing both classes in our test set. We train for only 391 steps per epoch, i.e., equivalent images in the CIFAR- 10 dataset. Thus over 100 epochs, we effectively end up taking five passes through the one million synthetic images. Given the randomness in multiple steps, we aggregate results over three different runs of our experiments.
single pass through 50, 000 training
C.I WHY ROB-STUUST DISCRIMINATORS ARE NOT EFFECTIVE MEASURING PROXIMITY?
We argue that most synthetic samples can be easily distinguished from real data, irrespective of prox- imity, in absence of adversarial perturbations (E 0). This is likely because deep neural networks have very high expressive power. So a natural question is whether shallow networks, which have much lower capacity, are more suitable for this task. We test this hypothesis by using two-layer (16 and 32 filters) and four-layer (16, 16, 32, and 32 filters) convolutional neural network. We refer them as CNN-2 and CNN-4, respectively. We find that even these shallow networks achieve more than 90% accuracy in distinguishing synthetic images from real images 9). The CNN- network itself is achieving more than 99% accuracy for four out of seven generative models. A much larger ResNet- 18 network achieves near vear-perfect classification accuracy for most models. Such high success of even shallow networks uniformly across generative models shows that non-robust discrimination is not effective measure of proximity.
C.2 ON EFFECTIVENESS OF ARC MEASURING PROXIMITY
In this section, we delve deeper into the comparison of our proposed metric (ARC) with other base- lines. We judge the success of each metric by how successfully predicts the transfer of robustness from synthetic real samples the CIFAR-10 data. (referred to as transferred robust accuracy). We report our results in Table 10
Is FID in CIFAR-10 10 feature space effective? When calculating FID, the recommended approach is to measure it in the feature space of network trained on the ImageNet dataset (Heusel et al. 2017). One may ask, whether the reason behind the failure is using ImageNet feature space for CIFAR-10 10 images. This might be true as it is well known that most image datasets have their specific bias (Torralba & Efros 2011). To answer this question, we measure FID in the feature of
22

---

Published as a conference paper at ICLR 2022
state-of of-te-of-theeart LaNet (Wang et al. 2019) networks trained the CIFAR-10 10 dataset. We refer to this metric as FID (CIFAR-IO), 10). Similar to FID in ImageNet feature space, FID in CIFAR-10 feature space also fails to predict robustness transfer. It follows similar trend as the former, where it ranks models like DiffBigGAN and StyleGAN much higher than other models.
Generalizing to natural training. If the objective is to maximize clean accuracy instead of ro- bustmess, one may ask whether ARC will remain effective in selecting the generative model. We answer this question by measuring the success of ARC in predicting how much clean accuracy is achieved on the CIFAR-10 10 test set when we train a ResNet- 18 network only on one million synthetic images without any adversarial perturbation. Note that ARC dependent only on samples, thus can be directly used for this task. We find that ARC correctly ranks DDPM over StyleGAN model for transferred clean accuracy. Similarly, it also correctly rank WGAN-ALP and E2GAN model higher than other BigGAN models where the former achieves higher clean accuracy on the CIFAR- 10 test set. However, there are small variations in transferred clean accuracy with some models, such as WGAN-ALP and E2GAN, which ARC doesn't 't capture in its ranking.
Table 10: Testing how much each proxy distribution helps on CIFAR- 10 dataset and whether FID/IS captures it. We train 1M synthetic images and measure transferred robustness (which determines the rank) to cifar 10 test set. UC and C refers to unconditional and conditional generative models, respectively.
Rank
Model
Transfered clesi recuncy (Nataral training) (1)
Transferredd robust accuracy (Adverrrial training)
(ImageNNet
FID
(CIFAR-IB))
FID
15
(-NN())
ARC
DDPM (UC)
94.8
58.1
3.17
11.30
9.46
9.34
0.06
StyleGAN (C)
91.2
45.0
2.90
0.55
10.24
9:12
0.32
WGAN ALP (LC)
52.3
43.5
12.96
5.84
8.34
10.10
1.00
EZGAN
11.26
4.52
8.51
DIRC-BigGAN
33.7
4.301
11336
NDA
33.4
12.61
DUIBIGGAN (C)
C.3 ADAPTIVE SAMPLING OF SYNTHETIC DATA.
Finding synthetic samples which leads to highest synthetic-to-real robustness transfer. We use proximity of a synthetic sample to the original distribution, which we measure using syn- thetic score from our trained robust discriminators (using 0.25/255 size loo perturbations), as
a metric to judge transfer performance from the proxy distribution to original distribution.
We sort the synthetic score for each of 6M synthetic images from the DDPM model and combine them into equal-size groups. Next, we adversarially train ResNet- 18 network on images from each group, along with CIFAR-IO 10 training images, and measure robustness achieved on the CIFAR-I0 test set (Figure 5). Our re- sults validate the effectiveness of synthetic scores, where groups with the lowest synthetic score achieve highest ro- bust test accuracy. The difference in the robust test accu- racy is up to 4% between the group with the lowest score and the one with the highest score.
Robust Accuracy (t.)
Groups based synthhtic
thetic High)
Figure 5: Effectiveness of synthetic score. We sort 6M DDPM images us- ing their synthetic score and divide them into ten equal-size groups We find that groups with lower score achieve higher transferred robust accuracy (foo) on the CIFAR-10 test set.
Improvement in performance with adaptive sampling. We select set of 10M synthetic images (from a set of 15M) with the lowest synthetic score. We compare the success of these adaptively selected images with a set of 10M randomly selected images. We present our results in pling further improves the performance our framework (PORT) across threat models (fse and f2) and network architectures.
Table It shows that adaptively sam-
23

---

Published as a conference paper at ICLR 2022
Table 11: Further improvement in adversarial robustness using adaptive sampling. Experimen- tal results with adversarial training on the CIFAR-10 dataset for both foo and l threat model. Using additional synthetic data brings a large gain in adversarial robustness across network architectures and threat models. We also show further improvements brought in by adaptive sampling, in compar- ison to random sampling, of synthetic images. Clean/Auto refers to clean/robust accuracy measured with Attok.
(a) to thrcat model.
(b) & threat model.
Mothod
Architecture
Parameters (M)
Clean
Auto
Method
Archilecture
Parameters (M)
Cleon
Auto
Zhang et al.
2019
ResNet-18
11.2
$2.0
48.7
Rice et
2020
ResNet-18 18
11.2
98.7
67.7
PORT (rundro)
(nundom)
PORT (adaptive)
ResNet-18
11.2
84.6
55.7
PCRT (adaptive)
ResNet-18
11.2
59.8
74.4
Rioe et al.
2020
WaN-34-20
184.5
85.3
13.4
Madry et al
2018
ResNet-50
23.5
90.8
69.2
Jowal et al.
2020
WRN-70-16
206.8
85.3
57.2
Gowal cs al
2020
WRN-70-16
206.8
90.9
74.5
Zhang et al.
2019
WRN-34-10
46.2
81.9
53.1
Wa ct
20206
WRN-34-10
48.2
58.5
73.7
ECRT (rundom)
WRn-34-10
WRN-34-10
PCRT (odaptive)
WaN-34-10
46.2
87.0
PCRT (adaptive)
WRN-34-10
16.2
90.8
77.8
Table 12: Hyperparmeter search for using ResNet- 18 on CIFAR-100 dataset.
0.15
0.40
0.50
0.75
0.90
Clean Accuracy
60.6
64.7
64.5
62.2
59.8
Robust Accuracy
27.6
27.7
26.4
23.7
21.9
D BRINGING IT ALL TOGETHER: USING SYNTHETIC SAMPLES IN ROBUST TRAINING
In this section, we first analyze the synthetic images and later provide additional analysis based on them in robust training. We will primarily use synthetic images sampled from the DDPM and StyleGAN model.
Analyzing synthetic images. Since DDPM is an unconditional model, it only generates unlabelled synthetic images. We label these images using LaNet network the CIFAR-10 dataset. We visualize the frequency of different classes in Figure(6) shows that the synthetic images are almost uniformly distributed across classes. On the ImageNet dataset, we the classifier conditioned sampling to generate labeled images from the improved DDPM model (Nichol & Dhariwal 2021 We also provide samples images from different generative models Figure and
Hyperparameter search for 7 Before using DDPM images in robust training, we perform hyper- parameter search for y. We consider ten different values from and train ResNet-18 network using PORT at each of them. We measure both the clean accuracy and robust accuracy of each net- work (Figure 7). We find that y 0.4 achieves the highest clean and robust accuracy. Thus we used 0.4 in our experiments.
Fraction of images
Robust Clean
0.10
60 08
0.05
58
56
0.00
0.2
0.4
0.6
0.8
Image class
Figure 6: Histogram of class labels for synthetic images from DDPM model.
Figure 7: Hyperparameter search for 7 in PORT.
24

---

Published as a conference paper at ICLR 2022
D.1 SAMPLE COMPLEXITY OF ADVERSARIAL TRAINING
Given the ability to sample an unlimited amount of synthetic images from a proxy distribution, now we investigate the performance of adversarial training with an increasing number of training samples. We train the network only on synthetic images and measure its performance on another held-out set of synthetic images. We also measure how much the clean and robust accuracy transfers on the CIFAR-10 test set.
Setup. We primarily work with the CIFAR-10 dataset and its two-class subset, i.e., an easier problem of binary classification between class-1 (automobile) and class-9 (truck). We refer to the latter as C We robustly train a ResNet-18 network on 2K to 10M synthetic images from the StyleGAN model, as in both 10-class and 2-class setup. We opt for StyleGAN over DDPM model as sampling images from the former is much faster, thus we were able to generate up to 10M synthetic from it. Note that the cost of adversarial training increases almost linearly with the number of attack steps and training images. Thus to achieve managcable computational cost when training on millions of images, opt for using only a 4-step PGD attack (PGD-4) in both training and evaluation. Since robustness achieved with this considerably weak attack may not hold against a strong attack, such as Auto/ttack, we opt for evaluating with the PGD-4 attack itself. We also perform natural training, i.e. training on unmodified images in some experiments. We test each network on a fixed set of 100K images from the StyleGAN and 10K images from the CIFAR-IO test set.
Accuracy vs robustness trade-off. We compare the clean accuracy achieved with both natural and adversarial training in Figure [] Indeed with a very small number of samples, clean accuracy in adversarial training is traded to achieve robustness. This is evident from the gap between the clean accuracy of natural and adversarial training. However, with the increasing number of training samples, this gap keeps decreasing for both CIFAR-2 and CIFAR-10 10 datasets. Most interestingly, this trade-off almost vanishes when we use a sufficiently high number of training samples for the CIFAR-2 classification.
On sample complexity of adversarial training. We report both clean and robust accuracy with adversarial training in Figure 9 We find that both clean and robust accuracy continues to improve with the number of training samples. We also observe non-trivial generalization to test images from the CIFAR-10 dataset, which also improves with the number of training samples. Both of these results suggest that even with a small capacity network, such as ResNet-18 18, adversarial robustness can continue to benefit from an increase in the number of training samples.
D.2 EXPLORING EFFECT OF IMAGE QUALITY OF SYNTHETIC SAMPLES
We explore different classifiers to label the unlabeled synthetic data generated from the DDPM model. In particular, we use BiT (Kolesnikov et al.] 2020), SplitNet (Zhao et al.] 2020). and LaNet (Wang et al. 2019) where they achieve 98.5%, 98.7%, and 99.0% clean accuracy, respec- tively, on the CIFAR- dataset. We notice that labels generated from different classifiers achieve slightly different downstream performance when used with adversarial training in the proposed ap- proach. We find that only up to 10% of synthetic images are labeled differently by these networks, which causes these differences. On manual inspection, we find that some of these images are of poor quality, i.e., images that aren't photorealistic or wrongly labeled and remain hard to classify, even for human labeler. Since filtering millions of images with human in the loop is extremely costly, we use two deep neural networks, namely LaNet (Wang et al. 2019) and SplitNet (Zhao) al. 2020)), to solve this task. We avoid using labels from BiT as it requires transfer learning from ImageNet (Deng et al. 2009) dataset, whereas our goal is to avoid any dependency on extra real- world data. We discard an image when the predicted class of both networks doesn't match and is classified with less than 90% confidence by both networks. While the former step flags images which are potentially hard to classify, the latter step ensures that we do not discard images where at least one network is highly confident in its prediction. We also try the 50% and 75% confidence threshold but find that 90% gives the best downstream results. In particular, using the filtering step improves robust accuracy by another 0.1%.
25

---

Published as a conference paper at ICLR 2022
100
90
CFAA22
SiyKGAN
OHAR
SylrGA
Clean accuracy
100
Robust accuracy
100
80
Clean
70
60
10
10a
Number of training images es
101
10a
10f
10a
103
10
(a) CIFAR-2 2
Number training images
training images
(a) CIFAR-2
accuracy
100
StyeeGi
Clean accuracy
Robust accuracy
80
80
80
10a
Number of training images
40
40
(b) CIFAR-10
10a
10a
10f
10a
10a
Number of training images
Number of training images
Figure 8: Reduction in accu- racy vs robustness trade-off. Accuracy robustness trade- off when training on an increas- ing amount of synthetic images from the StyleGAN model. It shows that the drop clean ac- curacy with adversarial training decreases with increase in train- ing samples.
(b) CIFAR-10
Figure 9: Sample complexity of adversarial training. Clean and robust accuracy on the test set of synthetic samples when trained on an increasing number of synthetic samples from the StyleGAN model. It shows that performance of adversarial training continues to benefit from increase number of train- ing samples. We also measure generalization to the CIFAR-10 dataset, which also improves with number of training samples.
26

---

Published as a conference paper at ICLR 2022
(a) CIFAR-10
(b) DDPM
(tyleGAA
(d) WGAN-ALP
Figure 10: Visualizing images from different sets. Randomly selected images form the CIFAR-10 10 dataset and synthetic images from different generative models. Rows in each figure correspond to following classes: Airplane, automobile, bird, cat, deer, dog, frog, horse, ship, and truck.
27

---

Published as a conference paper at ICLR 2022
(c) E2GAN
(f) DiftCrBigGAN
(g) NDA
(h) DiffBigGAN
Figure 10: Visualizing images from different sets. Randomly selected synthetic images from different generative models. Rows in each figure correspond to following classes: Airplane, auto- mobile, bird, cat, deer, dog, frog. horse, ship, and truck.
28

---

Published as a conference paper at ICLR 2022
(a) ImageNet Deng et al.
2009
(b) Improved DDPM Nichol & Dhariwal 2021
(c) BigGAN-Deep Brock et al. 2019
Figure 11: ImageNet (64 x 64) samples along with synthetic images from two different generative models. Rows correspond to the following classes: hummingbird, english foxhound, arctic fox, basketball, iPod, ping-pong ball, rumning shoe, and water tower.
29

---

Published as a conference paper at ICLR 2022
CelebA (Real)
(b) CelebA (Synthetic)
Real and synthetic images for the CelebA dataset. We consider four-class classi- fication problem based on the attribute smile and male, i.e., not-smile/not-mabe smile/not-male, not-smile/male, smile/male.
Figure 12:
(a) AFHQ (Real)
(b) AFHQ (Synthetic)
Figure 13: Real and synthetic images for the AFHQ dataset. Rows correspond to the following three classes: cat, dog, and wild animals.
30


Reviews:
[{"review_id": "oFAJ6Vkd-J1", "reviewer": "Reviewer_sAeN", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n- The ARC metric is interesting and novel. The authors also show that has concrete benefits in allowing us to estimate which generative model would help in robust training.\n- Empirical results are good, good number of datasets.\n\nWeakness:\n- One issue is a missing part of the proof of theorem 1. In the proof, the authors define a distribution D' by a mapping of average distance epsilon from D. This is clearly an upper bound on the Wasserstein distance, but to show that it is the Wasserstein distance, i.e. the minimal coupling is missing. Without this correction, I cannot take the theoretical part (which is the major novelty) into account.\n- While the ARC metric is interesting, to compute it we need to compute several robust classifiers. This makes it pointless in practice as we could, in less computation time, directly measure the robust accuracy that we are interested in.\n- Missing ablation study - in C.3 the authors show that if they generate 15M and then sample 10M to do robust training, their sampling is better than randomly taking 10M. What is missing is the results of training on the whole 15M. As the whole 15M are already generated, what would be the benefit of sampling 10M if it doesn't perform better?", "summary_of_the_paper": "The paper investigates how adding additional synthetic data can help with robust training.\nWhile the basic idea is very simple, the paper adds an interesting theoretical analysis that allows us to estimate what generative distribution would work best for robust training.", "summary_of_the_review": "The paper offers some interesting theoretical and practical results, but without the hole in the proof fixed I do not think it should be accepted. I will gladly raise my review if this is adressed.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "gO2T0JsAatw", "reviewer": "Reviewer_c1MR", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n\n1. The paper captures the utility of a proxy distribution for ensuring robustness via conditional Wasserstein distance between the proxy distribution and real distribution.\n\n2. Given that estimating the conditional Wasserstein distance is prohibitive, the paper proposed a tractable metric based on robust discrimination between proxy and real distribution to measure the utility of a proxy distribution for the underlying task.\n\n3. Extensive experiments on five standard image benchmarks demonstrate the utility of the proposed method in improving model robustness by utilizing synthetic images produced by generative models.\n\n4. The experimental results in the paper also show that widely used quality metrics for the generative models (e.g., FID) fail to capture their utility to general synthetic images that can ensure robustness for real images.\n\nWeaknesses/questions:\n\n1. What does PORT stand for?\n\n2. What is the motivation for working 64x64 size images for ImageNet as opposed to utilizing usual 256x256 or 224x224 image sizes? Would the performance improvements attained by the proposed method scale to larger images?\n\n3. In last line of page 5, '...our trained discriminator...' --> '...our trained *robust discriminator...'?  Also, should $f(x)$ be $\\sigma(x)$?\n\n4. What does ARC stand for?\n\n5. While comparing with RST in Section 3.1.2, do you use $L_{smooth}$ in the definition of $L_{adv}$ in Section 2.3?", "summary_of_the_paper": "This paper focuses on utilizing synthetic images generated by a generative model for the task of achieving robustness to adversarial attacks. Towards this, the paper aims to assess the suitability of the proxy distribution defined by the generative model for the underlying task. The paper shows that conditional Wasserstein distance serves as a selection criterion for the proxy distribution. Acknowledging the intractability of estimating the conditional Wasserstein distance, the paper then proposed a novel metric based on robust discrimination between the proxy distribution and the real distribution. Finally, the paper empirically demonstrates that using synthetic images from a suitable generative model can indeed improve the robust and clean accuracy of the model over existing baselines.", "summary_of_the_review": "The paper studies an important problem of improving the model robustness against adversarial attacks. Towards this paper aims to leverage the recent advancements in the area of generative models. The paper shows that utilizing the synthetic images generated from suitably chosen generative models can boost model robustness. The paper both theoretical and empirically studies various metrics to select the correct generative model for the underlying task.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "GiT74xYE6Tf", "reviewer": "Reviewer_NSbG", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The paper studies an important problem for adversarial robustness, and I like the theoretical analysis part. My concern is mainly on the experiments:\n* For CelebA, CIFAR-100, ImageNet, why is there only one baseline while for Table 1, there are several other baselines.\n* Could you provide some comparisons between the adversarial training on normal synthetic distribution and robust synthetic distribution?\n\nAnd I have an additional questions:\n* It's quite interesting that the performance of DDPM is much better than other generative models, is there any explanations for this? Could you provide an ablation study where a) use DDPM and standard synthetic metric b) use DDPM and robust synthetic metric?", "summary_of_the_paper": "The paper proposed a new metric for how well a synthetic distribution can help to improve the adversarial robustness. This metric is designed based on measuring conditional Wasserstein distance between the two distributions.", "summary_of_the_review": "The paper studies an important problem for adversarial robustness, and I like the theoretical analysis part. My concern is mainly on the experiments. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "1JFbyS6bPkg", "reviewer": "Reviewer_fLTj", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The paper is a very good contribution to the research on adversarial robustness. The authors manage to push the SOTA, explain why certain generative models work better at improving the robustness and extensively evaluate their approach across lots of datasets, attack models and hyperparameters. Related work is described and contrasted. Using generative models for robustness certainly is a very important direction for research.\n\nARC could also be an interesting metric for generative models in general. \n\nThe paper is clearly written but sometimes a little bit cramped as the authors do a lot of things, especially in section 3. \n\nSmall comments and questions:\n\n\n- You write that you do a hyperparameter search on γ. Did you find that different values work better for different generative models?\n- Have you tried different ratios of real and synthetic images in the batch? How does it interact with γ?\n- The improvement on especially imagenet is rather small. Do you have any intuition why?\n- On the top of page 8 you talk about outperforming Zhang et al. 2020 but I don't see it listed in table 4.\n- While you can infer it from the rankings it would be helpful to remind readers what metrics in table 5 are increasing or decreasing with quality (just a small arrow pointing up or down next to the metric would help). \n\n- The epsilon ball is sometimes written as Ball_e(x) and sometimes as Ball_x(e) (bottom of page 4 and bottom of page 5)\n- Figure 1: The caption starts with \"Why robust discrimination is effective?\" Either this should be \"Why is robust discrimination effective\" or shouldn't end in a question mark. Same for page 5 \"Why non-robust discrimination...?\". \n", "summary_of_the_paper": "The paper investigates if generative models can be used to improve the robust accuracy of image models. The authors show that the current SOTA across multiple attack models and commonly used datasets can be significantly improved by using generative models. They show that the conditional Wasserstein difference between the test distribution and the one learned by the generative model is an upper bound for the difference in robustness achieved by models trained on either distribution. \nThey investigate what generative models provide good proxy distributions by robustly training discriminators and using their accuracy at different attack strengths as a metric. The discriminators are also shown to be helpful to order generated samples by their effectiveness for adversarial training. ", "summary_of_the_review": "The authors provide an in depth evaluation of using generative models to augment adversarial training, showing large improvements and interesting insights both empirical and analytical. I think the paper should be accepted.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Meta-review: In this work, authors use proxy distributions learned by advanced generative models to improve adversarial robustness. In the discussion period, authors did a good job in addressing reviewers' questions and comments. All reviewers think the paper is above the accept threshold, so do I.
Decision: Accept (Poster)