Just Avoid Robust Inaccuracy: Boosting Robustness Without Sacrificing Accuracy
Authors: Yannick Merkli
Pavol Bielik
PETAR TSANKOV
Martin Vechev
Venue: Submitted to ICLR 2023 (2023)
Keywords: robustness

Abstract: While current methods for training robust deep learning models optimize robust accuracy, they significantly reduce natural accuracy, hindering their adoption in practice. Further, the resulting models are often both robust and inaccurate on numerous samples, providing a false sense of safety for those. In this work, we extend prior works in three main directions. First, we explicitly train the models to jointly maximize robust accuracy and minimize robust inaccuracy. Second, since the resulting models are trained to be robust only if they are accurate, we leverage robustness as a principled abstain mechanism. Finally, this abstain mechanism allows us to combine models in a compositional architecture that significantly boosts overall robustness without sacrificing accuracy. We demonstrate the effectiveness of our approach for empirical and certified robustness on six recent state-of-the-art models and four datasets. For example, on CIFAR-10 with $\epsilon_\infty = 1/255$, we successfully enhanced the robust accuracy of a pre-trained model from 26.2% to 87.8% while even slightly increasing its natural accuracy from 97.8% to 98.0%.

Under review as a conference paper at ICLR 2023
JUST AVOID ROBUST INACCURACY: BOOSTING Ro- BUSTNESS WITHOUT SACRIFICING ACCURACY
Anonymous authors Paper under double-blind review
ABSTRACT
While current methods for training robust deep learning models optimize robust accuracy, they significantly reduce natural accuracy, hindering their adoption in practice. Further, the resulting models are often both robust and inaccurate on numerous samples, providing false sense of safety for those. In this work, we extend prior works in three main directions, First, we explicitly train the models to jointly maximize robust accuracy and minimize robust inaceuracy. Second, since the resulting models are trained to be robust only if they are accurate, we leverage robustness as principled abstain mechanism. Finally, this abstain mechanism al- lows us to combine models in a compositional architecture that significantly boosts overall robustness without sacrificing accuracy. We demonstrate the effectiveness of our approach for empirical and certified robustness on six recent state-of-the- art models and four datasets. For example, on CIFAR-10 with & = 1/255, we successfully enhanced the robust accuracy of pre-tra mre-trained model from 26. 5% 87.8% while even slightly increasing its natural accuracy from 97.8% to 98.0%.
INTRODUCTION
In recent years, there has been a significant amount of work that studies and improves adversar- ial (Carlini & Wagner 2017 Croce & Hein 2020b] Goodfellow et al.) 2014 Madry et al. [018]] Szegedy et al. (2013) and certified robustness (Balunovic & Vechev [019 Cohen al. [019]] Salman ct al. 2019 Xu et al. 2020 Zhai et al. 2020 Zhang et al. (0199) of neural networks. However, currently, there is key limitation that hinders the wider adoption of robust models in practice.
Robustness vs Accuracy Tradeoff Despite substantial progress in training robust models, existing robust training methods typically improve model robustness the cost of decreased standard accuracy. To address this limitation, a number of recent works study this issue in detail and propose new methods
mitigate it (Mueller et al. 2020: Raghunathan et al. 2020 Stutz et al. 2019 Yang al. 2020).
Our Work In this work, we advance the line of work that aims to boost robustness without sacrific- ing accuracy, but we approach the problem from a new perspective - by avoiding robust inaccuracy.
Concretely, we propose a new training method that jointly maximizes robust accuracy while mini- mizing robust inaccuracy. We illustrate the effect of our training on a synthetic dataset (three classes sampled from Gaussian distributions) in Figure showing the decision boundaries of three models, trained using standard training Luta, adversarial training LTRADES (Zhang et al. 2019a), and our training LERA (Equation 4). First, observe that while the Letd trained model achieves 100% accuracy, only 91.1% of these samples are robust (and accurate). When using LTRADES, we can observe the
Table 1: Improvement of applying our approach to models trained to optimize natural accuracy only. Here, Reee denotes the robust accuracy and Rnot denotes the standard (non-adversarial) accuracy.
CIFAR-10 2020
CIPAR-100
NTSD (ReeNet-50),
SBB (ReeNet-500),
Zhao
WideReeeNet-28-100
R re
26.2
161.0%
87.8
3.1 133.8%
41.9
40.7
429.2% 2%
69.9
44.7
187.7% 82.4
Rast
97.8
98.0
80.17
+0.01%
80.18
93.8
+0.2%
94.0
91.4
-0.1%
91.3

---

Under review as a conference paper at ICLR 2023
robust & accurate
inacourate
con-robust.co accurate
(ours)
Lard
ÉTRADES
CERA
non robust inaccurale
Figure 1: Decision regions for models trained via standard training Lata, adversarial training LTRADES (Zhang et al.) 2019a), and our training LERA (Equation 4. Here, our LeRA achieves the same robust accuracy as LTRADES but avoids all robust inaccurate samples by making them non-robust. Note that all models predict over all three classes, however, the decision regions for class 2 of the LtraDES and CERA trained models are too small to be visible. For more details, please refer to Appendix A.2
robustness accuracy tradeoff the robust accuracy improves 98.4% the expense of 1.6% (robust) inaccuracy. In contrast, using LERA, we retain the high robust accuracy of 98.4% but avoid all robust inaccurate samples by appropriately shifting the decision boundary, rendering them non-robust.
Since our models are trained to be robust only if they are accurate, we leverage robustness as a principled abstain mechanism. This abstain mechanism then allows us combine models in compositional architecture that significantly boosts overall robustness without sacrificing accuracy. Concretely, Figure [T] we would define selector model that abstains on all non-robust samples. Then, the abstained (non-robust) samples are evaluated by the standard trained model Letd, while the selected samples are evaluated using the robust model LERA- This allows us to achieve the best of both models high robust accuracy (98.4%). high natural accuracy (100%), and no robust inaccuracy.
We show the practical effectiveness of our approach by instantiating over several datasets and existing robust models for both empirical and certified robustness. Table [ summarizes the main results of our approach, showing that we significantly improve the robust accuracy R,o of standard trained conposoposiii models, with minimal loss of standard accuracy Rnat. In fact, in most of the cases, the compositional architecture even slightly improves the standard accuracy. We release code at: https: hatps///nnonmussss 40p.n.oopennnoo 8 ence/ r/ r/rbusttttttt absta -
RELATED WORK
There is growing body of work that extends models with an abstain option. Existing approaches include selection mechanisms such as entropy selection (Mueller et al. 2020), selection function (Cortes et al., 2016, Geifman & El-Y Yaniv 2019 Mueller et al. (2020), softmax response (Geifman Stutz
EI- Yaniv 2017: Stutz et al.] (020). or explicit abstain class (Laidlaw & Feizi 2019 Liu et al. 2019). In work, explore an alternative selection mechanism that uses model robustness. The advantage of this formulation that the selector provides strong guarantees for each sample and never produces false-positive selections. The disadvantage is that it introduces significant runtime overhead, compared to many other methods that require only single forward pass.
Other recent works address adversarial examples through model calibration. Stutz al. (2020) proposes biasing models towards low confidence predictions on adversarial examples, which allows rejecting them through softmax response selector. An alternative approach taken by Gal & Ghahramani (2018); Kingma et al. (2015); Molchanov et al. (2017), which train Bayesian neural networks to estimate prediction uncertainty by approximating the moments of the posterior predictive distribution, or by (Senooy et al. (2018), which estimates the posterior distribution using deterministic neural network from data. Instead of calibrating model confidence, our work, we calibrate model robustness, by optimizing the model towards non-robust predictions misclassified examples.
Simultaneously, several recent works investigate the robustness and accuracy tradeoff both theo- retically (Dobriban et al. 2020) Yang al. 2020) and practically by proposing new methods to mitigate it. Stutz et al. (2019) considers a new method based on on-manifold adversarial examples, which are more aligned with the true data distribution than the l -n-m noise models. Mueller et al. (2020) focuses on deterministic certification and proposes using compositional models to control the robustness and accuracy tradeoff. In work, also compositional models, but focus
2

---

Under review as a conference paper at ICLR 2023
empirical and probabilistic certified robustness. Our selector formulation is based new training that minimizes robust inaccuracy and can be used to fine-tune any existing robust model. Further, we provide individual robustness at inference time, rather than distributional robustmess considered in prior works.
Finally, some recent works also consider learning misclassified examples. For example, MMA (Ding et al. 2018) maximizes the margins of correctly classified examples while minimizing the classifica- tion loss misclassified examples. MART (Wang et al., 2019) combines the standard adversarial risk with consistency loss that optimizes misclassified examples towards robust predictions. Note, that this formulation actively encourages the model toward robust inaccurate predictions, while our work does the opposite we minimize robust inaccuracy by penalizing robust misclassified examples.
3 PRELIMINARIES
Let fo: < R* be a neural network classifying inputs a Rd outputs R (e.g., logits or probabilities). The hard classifier induced by the network is given Fo(x) arg m fo(x);, where fo(x), the output for the i-th class and V, [D]| = k the finite set of discrete labels.
Natural Accuracy Given distribution over input-label pairs D and classifier Fg: X' - y, an input-label pair (a, y) is considered accurate iff the classifier F6 predicts the correct label y for x:
Roat (Fa) B(a.))D 1 ((F - =y}
Robust Accuracy Given an input-label pair (ær, y). we say that the classifier Fa is robust and accurate iff it predicts the correct label y for all samples from predefined region B (ar), such
ep-norm ball centered at with radius E, i.e., (x)) = {x': || - ælIp I $). Formally:
Roo Fo) = (=(w))D (FF((x) = y} (Va' e (x). Fo(x') = Fo())
(1)
Robust Inaccuracy Similarly to robust accuracy, an input-label pair (x, y) is considered robustly inaccurate iff the classifier Fe predicts an incorrect label Fo(x) + y and Fø robust towards that misprediction for all inputs in (z)). Formally, the robust inaccuracy is defined as:
Ryob (Fo) = ((..)>D (x) + 3} A 1[Ve' E (x)) Fo(x') = Fo(x)}
(2)
4 REDUCING ROBUST INACCURACY
In this section, we present our training method that extends existing robust training approaches by also considering samples that are robust but inaccurate. We start by describing high-level problem statement which we then instantiate for both empirical robustness as well as certified robustness.
Problem Statement Given a distribution over input-label pairs D, goal is to find model parameters 0 such that the resulting model maximizes robust accuracy, while at the same time minimizing robust inaccuracy. Concretely, this translates the following optimization objective:
arg min EE (a.y)> 0
3 (x,
F(Fo(x) + y) Cyas (æ, y)
optimize robust accuracy
penalize robust inaccuracy
where & E R+ is a regularization term, (())(x) # y} is an indicator function denoting samples for which the model inaccurate, and Lrob (z, y) with Cpace y) are loss functions that optimize robust accuracy and penalize robust inaccuracy, respectively. Here, the first loss function Cros (xe v) standard and can be directly instantiated using existing approaches. The main challenge comes in defining the second loss term, well as ensuring that the resulting formulation is casy optimize, e.g., by defining a smooth approximation the non-diffcrentiable indicator function.
4.1 ADVERSARIAL TRAINING
We instantiate the loss function from Equation wheen training empirically robust models follows:
LERA 3 LIRADES(fe.) (x. v)) + (1 fo(x)y) min
(c arg max fo(x'))) (4)
(B)

---

Under review as a conference paper at ICLR 2023
Following, we introduce each term in more detail and discuss the motivation behind our formulation.
Crob To instantiate Lrob. we can use any existing adversarial training method (Ding et al. 2018 Goodfellow et al.] 2014 Wang et al.) 2019, Zhang et al. 2019a). For example, considering TRADES (Zhang al. 2019a). Lrob is instantiated as:
CTAADES (f y) (3)) DKL. (fo
(5)
where DKL. is the Kullback-Leebler divergence Kullback Leibler 1951p.
((F(()) y} Next, we consider the indicator function, which encourages learning on inaccurate samples. Since the indicator function is computationally intractable, we replace the hard qualifier by a soft qualifier fo (z) The soft qualifier will be small for accurate and large for inaccurate samples, thus providing smooth approximation of the original indicator function.
Crop Third, define the loss that penalizes robust but inaccurate samples. This can be formulated similar to the adversarial training objective (Madry et al., 2018), however, instead of optimizing the prediction of the adversarial example fo(æ') towards the correct label y, optimize towards the most likely adversarial label arg (()(a)))( fo This leads to the following formulation:
ming LCE (CE(fo(z'), arg max (EM fo()')))
(6)
The purpose of the C, loss is to penalize robustness by making the model non-robust. As result, it is sufficient to consider only a single non-robust example, thus the minimization (rather than maximization) in the loss objective!'
4.2 CERTIFIED TRAINING
Similarly to Section 4.1 we now instantiate the loss function from Equation for probabilistic certified robustness via randomized smoothing (Cohen et al.) 2019). Randomized smoothing constructs smoothed classifier Ge: X' + ) from base classifier Fe. where Gø(æ) predicts the class which Fo is most likely to return when æ is perturbed under isotropic Gaussian noise. Our proposed instantiation of Equation for probabilistic certified robustness is as follows:
CCRA(for (I, v)) B Enoise (fo, (x, v)) + Σ (1 fa(x + m)) CR(fe, (x,
(7)
where m....., 7h are h i.i.d. samples from NNO, I² Note that, since the robustness guarantees provided by randomized smoothing hold for the smoothed classifier Gg, the three loss components from Equation 3 need to be formulated with respect to the smoothed classifier Gg.
Lrob To instantiate Lrob. we can use any existing certified training method for randomized smooth- ing, such as the methods defined by Cohen et al. (2019) or Zhai et al. (2020). Concretely, when using Cohen et al. (2019). the loss is defined using Gaussian noise augmentation:
Lnoise
tcr (fo + v). n ~~ (O,
8
1(Fo(a)) # y} We again replace the computationally intractable hard qualifier by soft qualifier Eg E8-N(0,==1)_ fe (x H)], which encodes the misprediction probability of the smoothed classifier. In practice, we approximate expectations over Gaussians via Monte Carlo sampling, thus leading to the approximated soft inaccuracy qualifier 1/E Σ fa( + nz)y-
Srace Finally, we instantiate the Crace loss term, which encourages the model toward non-robust predictions on robust but inaccurate samples. We propose to minimize robustness by directly minimizing the certified radius of the smoothed classifier Go. The certified radius formulation by
Naturally, this assumes that the method used to check robustness can correctly detect the non- robustnessss even if is caused by single example. Note that, for fair evaluation, PGD (Maryy et al. 2018) attack during training and strong 40-step APGD (Croce Hein 20206) for evaluation.
relatively weak 10-step
4

---

Under review as a conference paper at ICLR 2023
Cohen al.
2019) involves sum of indicator functions, which is not differentiable. However, Zhai
et al. 2020) have recently proposed the following differentiable certified radius formulation:
& folæ + my: - + maxx Vf Fy
CRifo, (z, = Φ
Σ folæ + m5i m;; [)
where d- is the inverse of the standard Gaussian CDF, I is the inverse softmax temperature multiplied with the logits of fe, and misk are i.idd samples from /V o²I). Note that, by setting the loss term yyob to CR(ff, , (α.y)) v)). we directly penalize robustness of the smoothed classifier Gg.
5 ROBUST ABSTAIN MODELS
Next, we extend the models trained so far by leveraging robustness as a principled abstain mechanism.
Abstain Model Given imput space X' C 12d and label space V, model with an abstain option EI Yaniv al. 2010) is pair of functions (Fe, S), where Fo: X' + J is a classifier and S: X' {0, T is binary selector for Fg. Let S(x) = 0 indicate that the model abstains on input æ E X, while ((x) indicates that the model commits the classifier Fg for input æ and predicts (z)z).
Robustness Indicator Selector We instantiate abstain models with robustness indicator selector, that abstains on all non-robust samples. For adversarial robustness, the selector is defined as:
SEar (x) 1 E B(x)): Fe (zx) = Fo())}
(10)
For certified robustness, the selector is defined as:
(car( = 1 E B(x)): Ga(x') = Gz(z)}
(11)
Robustness Guarantees: Robust Selection Similar to robust accuracy, the robustness of abstain model needs to be evaluated with respect to a threat model. In our work, we consider the same threat model as for the underlying model Fg. namely (x)) = (ar' ||ar æ11, e), fp-norm ball
centered at æ with radius E. Then, we define the robust selection of an abstain model as follows:
Red (x.))>D 1 (Va'' (zr).. S(x') =]
That is, we say that model robustly selects x if the selector S would select all valid perturbations x' (x)). Combined with our definition of SERI. we obtain the following criterion (cf. Appendix A.3)
Rec (SERI) = El E (z). Fo(x') = [x))
In other words, guarantee that the selector SERI is robust for all x' E (x)),, we in fact need to check robustness of the model F3 to double that region x' E B (x). This is important in order to obtain the correct guarantees and is reflected in our evaluation Section 7
Note that when evaluating robust selection for certified training, it is sufficient to show that the smoothed model Go can be certified with radius R 2 E. Then, the smoothed model guarantees that Go(x') for all æ' (xx), which is equivalent our condition Væ <B(x): Go(æ') Ga(
6 BOOSTING ROBUSTNESS WITHOUT ACCURACY LOSS
Consider an abstain model (Fe, S) and dataset D. The selector S partitions into two disjoint subsets the abstained inputs D and the selected inputs D, for which Fa makes prediction. For some tasks, making a best-effort prediction on all samples D, UDD may desirable, which leads to compositional architectures, already used by prior works (Mueller et al. 2020 Wong et al., 2018).
Let ((Frobust, S), Fcore) be a 2-compositional architecture consisting of a selection mech- anism S, a robustly trained model Frobust and a model Foore. Given input X, the selector S decides whether the model confident on æ and commits to the robust model Frobust or whether the model should abstain and fall back to the
model Foore. Formally:
(12) While Frabust: Feore be chosen arbitrarily, here combine robust trained models (which have lower natural accuracy). with models trained using standard training (which have high natural accuracy but low robustness). The performance of H then depends the quality of the selector S.
H(x) = S(x) Frobuse((r) + (1 5(x)) (e)re(x))
5

---

Under review as a conference paper at ICLR 2023
Zhing al.
armonn et
Gowal
Rebuil et
Zhang etall
7 Zhang et
B 2/255
B 255
B 2/250
2/ 205
B 2/255
B 2/256
Robust. Accuracy Revob. [X]]
75-
23
25
84.
40-
35-
70
80
CIFAR-10
18- CIFAR-10
CIFAR-10
CIPAR-100
NT50
50
38B
20
2.5
5.
Robust Inaccuracy Ryob [96]
better
Figure 2: Robust accuracy (Roo)) and robust inaceuracy (RTob)) of existing robust models (4. P), and models fine-tuned with our loss (o, @). Our approach consistently reduces robust inaccuracy across various datasets, existing models and different regularization levels B..
EVALUATION
In this section, we present thorough evaluation of our approach by instantiating it four different datasets, six recent state-of-the-art models, for both adversarial and certified robustness, including top-trained models from RobustBench (Croce al. 2020). We show the following key results:
Fine-tuning models with our proposed loss successfully decreases robust inaccuracy and provides Pareto front of models with different robustness tradcoff'.
Combining our proposed loss and robustness as an abstain mechanism leads to higher robust selection and accuracy compared to softmax response and selection network baselines.
Our 2-compositional models significantly improve robustness by up to +61% % and slightly increase the natural accuracy by up to +0.2% (for Bi/255 and (22/55))
We perform all experiments on a single GeForce RTX 3090 GPU and use PyTorch (Paskke et al. 2019) for our implementation. The hyperparameters used for experiments provided in Appendix A.2
Our proposed training method requires neither retraining classifiers from scratch nor modifications to existing classifiers, thus our approach can applied fine-tune a wide range of the following robust pre- pre-trained models:
Models
existing model 2 To demonstrate this,
For empirical robustness, we evaluate existing models from Carmon et al. 2019), Gowal et al. 2020) Rebuffi et al. (2021). and Zhang al. (2019a), which were all trained for 6 8/255, and all but the last model are top models in RobustBench (Croce et al. 2020). In our evaluation, we fine-tune each model for 50 epochs for the considered threat model (Eoo E (1/25s, 2/25s, 4/255 )), using LTRADES (Zhang et al. (2019a) and CERA (ours). Further, we also consider models Ding et al. (2018) and Wang al. (2019) additional baselines.
For certified robustness, we use a a = 0.12 Gaussian noise augmentation trained model by Cohen al. (2019) and 2 0.5 adversarially trained model by (Sewwag al. (2021). Similar empirical robustness, we fine-tune the models for 50 epochs using Enoise (Cohen et al. 2019) and LCRA (ours).
Datasets We evaluate our approach on two academic datasets - CIFAR-10 and CIFAR-100 (Krizhevsky al., 2009), and two commercial datasets Mapillary Traffic Sign Dataset (MTSD) (Ertlr et al. 22000) and a Rail Defect Dataset kindly provided by Swiss Federal Railways (SBB). Consider Appendix A. for full details.
When training on the CIFAR-10 and CIFAR-100 datasets, we use the AutoAugment (AA) policy by Cubuk al. (2018) the image augmentation. For the MTSD and SBB datasets, we standard image augmentations (SA) consisting of random cropping, color jitter, and random translation and rotation. For completeness, our evaluation also includes models trained without any data augmentations.
Metrics We use the natural accuracy, robust accuracy, and robust inaccuracy
main evaluation
metrics, as defined Section 3 but evaluated on the corresponding test dataset.
Our method also he used train from scratch, in which case scheduler for should be introduced.

---

Under review as a conference paper at ICLR 2023
Carmon ct al
//250
Gowal et al.
B 1/256
Rebuth et al.
B3/255
Zhang et al
B2/250
130.0
120
CIFAR-100
Arcuracy Rass
57.5
77.5
36
26
$2.5
02.5
better
50.0
42
62.5
47.5
50
85.0
15.0
CIFAR-10
CIPAR-10
66
M130
10.0
$6.0
Robust Selection R2 R. [76]
better
Figure 3: Comparison of different abstain approaches including existing robust elassifiers TRADES
(4, A), MR (4), MMARI (D), classifiers fine-tuned with our proposed loss ERAşT (o, O), selection network (m, ) and softmax response (0. +) abstain models. Higher Ricd and Roo is better (top right corner is optimal). Observe that the Parent front of our approach (o, generally dominates the results of all baselines, significantly improving robust selection and robust accuracy.
When evaluating empirical robustness, we use 40-step APGDcr (Croce & Hein 2020b) (referred to as APGD) to evaluate robustness of classifiers Fo. To evaluate certified robustness, we use the Monte Carlo algorithm for randomized smoothing from Cohen et al. al. (209)). We certify 500 test samples and use the same randomized smoothing hyperparameters as Cohen al. (2019) (cf. Appendix A.2)
7.1 REDUCING ROBUST INACCURACY
We first summarize the main results obtained by using our proposed loss functions Lera and LCRA-
Empirical Robustness The results in Figure 2 show the robust accuracy (Ruce) and robust in- accuracy (Root of different existing robust models fine-tuned via TRADES (Zhang al. 2019a) with (a) and without (A) data augmentations, and the same models fine-tuned via our LERA with (0) and without (O) data augmentations. Further, we show MART (Wang al. 2019) (4), and MMA Ding et al., 2018) (D) finetuned models as additional baselines. We can see that our approach consistently improves over existing models. For example, for CIFAR-10 and 22/255 the Carmon et al. (201)) model achieves 86.5% robust accuracy, but also 1.34% robust inaccuracy. In contrast, using LERA. obtain number of models that reduce robust inaccuracy to 0.29%, while still achieving 83.8% robustness. Similar results are obtained for other models, perturbation regions, and datasets (cf. Appendix A..7). We observe that our approach achieves consistently lower robust inaccuracy compared to adversarial training. Further, by varying the regularization term 3, we obtain Pareto front of optimal solutions.
Certified Robustness Similarly, we evaluate the robust accuracy (Rao) and robust inaccuracy (Ryase) for certifiably robust models fine-tuned using Lnoise and LCRa (ours). In Table 2a we show results on CIFAR-10 for B3.12 and B8 We observe that our approach achieves lower robust inaccuracy compared to existing models. For example, CIFAR-10 and B 25 the Cohen al. (2019) model achieves 62% robust accuracy, but also 1% robust inaccuracy. In contrast, our approach reduces robust inaccuracy 0.4% while still achieving 53.8% robust accuracy. For the (Sewwag et al. (2021) model, our approach even improves both robust accuracy and robust inaccuracy. For B8.25 our approach improves the robust accuracy by +4.8% and reduces the robust inaccuracy by -0.6%.
7.2 USING ROBUSTNESS TO ABSTAIN
Next, we evaluate using robustness as an abstain mechanism (Section 5 and how it benefits from the training proposed in our work. We compare the following abstain mechanisms:
Softmax Response (SR) (Geifman & EI- Yaniv 2017), which abstains if the maximum softmax output of the model fe is below threshold for some input æ' E (z),, that is:
Sea (z:) 1 (Vaa' B (x)) max.ey fo )e 7)
(13)
7

---

Under review as a conference paper at ICLR 2023
Similar to SRI, guarantee robustness of S5a, need to check the maximum softmax output of fo on double the region B (z). To evaluate robustness of Ssn. we use a modified version APGD called (e.g..Carmon APGDconf (Appendix A.5). For each considered model (e.g.. Carmon et al. (2019)), evaluate its
corresponding abstain selector: (o, CARMONsR, GOWALsR. etc. (all fine-tuned using TRADES).
Robustness Indicator (RI) (our work), which abstains if the model Fg is non-robust:
SpI (x) = 1 1(vx's (x) Fo(x') = (a
(14)
Note that, unlike other selectors, our robustness indicator is by design robust against an adversary using the same threat model. For each base model, we consider two instantiations (a. a) TRADES and (o, ERARI (Equation 4. Further, for CIFAR-10, we also instantiate models from Ding et al. (2018); Wang et al. (2019) with robustness indicator abstain: MARTaI (4), and MMARI (D).
Selection Network (SN), which trains separate neural network sp: X' - R and selects if:
Sex (x) 1 (55 2 r}
(15)
When evaluating the robustness of an abstain model (Fa, Sex), the robustness of both the classifier and the selection network have to be considered. We compare against two instantiations of this
approach, both trained using certified training: (m) ACE-COLTg (Balunovic & Vechev 2019 Mueller
ct al. 2020). and ACE-IBPst sx
(Gowal et al. 2018 Mueller et al. 2020).
Empirical Robustness In Figure we compare different abstain approaches using two metries robust selection (Rea)), and the ratio of non-abstained samples that are robust and accurate (R We would like to maximize both. but typically there tradeoff between the two. This is evident in Figure 3 where both our approach and softmax response produce Pareto front of optimal solutions.
Overall, the main results in Figure 3 show that, designed, our approach consistently improves robust accuracy. For example, on CIFAR-10, B1/255 and Carmon et al. (2019) model, we successfully improve robust accuracy by +1.18% at the cost of -3.78% decreased robust selection. This is close to optimal since increasing robust accuracy is typically achieved by correctly abstaining on misclassified samples. Interestingly. in some cases, strictly improve over baseline models by increasing robust accuracy and robust selection. For CIFAR-10, 11/255 and Gowal et al. (2020) model, we increase robust accuracy by +1.06% and robust selection by +1.61 (traiiing without data augmentations).
Compared the other abstain methods, our approach generally improves both metrics while also providing much stronger guarantees. Concretely, our approach guarantees that selected samples are robust in the considered threat model. Softmax response only guarantees that all samples in the considered threat model have high confidence and is thus vulnerable to high confidence adversarial examples, and the selection network provides no guarantees with regards the selector's robustness.
Certified Robustness Applying our training for certified robustness LCRA with 3 1.0 consis- tently improves robust accuracy Rec of robustness indicator abstain models. In Table 2b. we show results CIFAR-10 for B3 and 2 For instance, for the Cohen al. (2019) model trained at a = 0.12, we are able to improve the robust accuracy by +0.85% for B. at the expense of -8.8% decrease in robust selection. For the Sehwag et al. (0021) model, our approach improves both metrics. For B3,25- we increase robust accuracy by +0.2% and robust selection by +4.2%.
Table 2: Comparison existing robust models fine-tuned with Cnoise and LCra (ours). Table 2a shows robust accuracy (Roo)) and robust inaccuracy (R,a0)) of fine-tuned models Fg. Table 2b shows robust selection (R and robust accuracy (Roog) of corresponding RI abstain models (Fe, Scar).
(a) Finetuned models Fe.
(b) Finetuned abstain models (Fa. Soa)
CIFAR-10
By 10 = 0.6)
25 = 0.12)
B (a 0.6)
B (a ==== 0.12)
Model
Finetuning
Rece
R rob
Ruce
Ruscc
uc!
aul
Cohen et al.
Ensise
74.0
2.8
62.0
1.0
76.8
96.35
63.0
98.41
LeRA
71.6
2.6
53,8
0.4
74.2
96.50
54.2
99.26
Sehwag et al.
Lnoise
77.4
88.8
97.97
78.8
98.22
Lera
82.2
98.27
8

---

Under review as a conference paper at ICLR 2023
Carmon ot al.
B 1/205
Gowal et al.
1//50
Zhang et al.
2/255
Zhang ct al.
2//25
[%6]
50
03.2
Robast. Accuracy (2
00.3
Destis
72.5
73.3
CIFAR-10
CIFAR-10
07.
SBB
92 22
20 31
95 30.0
12.0
Natural Accuracy Ruad (%6)
better
Figure 4: 2-compositional natural (Rmor) and robust accuracy (Root) for ERAgT (O, ). TRADESRI (a. 4), MARTRI (4), MMARI (D), ACE-COLTss. ACE-IBPau (m, )) and TRADES (0, models. The core models used in the compositional architectures are listed in Appendix A. We can see that
the Parent front of our method strictly improves over the prior work the most important region
significantly improving model robustness while the model accuracy does not decrease.
7.3 BOOSTING ROBUSTNESS WITHOUT ACCURACY Loss
Finally, we present the results of combining the abstain models trained so far with state-of-the-ar models trained to achieve high accuracy. Note that, as discussed in Section 5 when evaluating
adversarial robustness for B3, we in fact need to consider B robustness of the abstain model.
summary of the results shown Figure Similar to the results shown so far, the 2-compositional architectures that use models trained by our method (o, improve over existing methods that optimize robust accuracy (4, A, 4, D), as well as over models using softmax response (o, +) or selection network (m, to abstain. For example, for 1IFAR-10 with Ex =1/25 and the Carmon et al. (2019) model, we improve natural accuracy by +0.58% and +0.62%, while decreasing the robustness only by -2.55% and -2.82% when training with and without data augmentations respectively.
More importantly, our approach significantly improves robustness of highly accurate non- compositional models, with minimal loss of accuracy, which have summarized in Table 1 We provide full results, including additional models and perturbation bounds in Appendix AA.9 and an evaluation of the considered highly accurate non-compositional models in Appendix A. A.
CONCLUSION
In this work, we address the robustness vs accuracy tradeoff by avoiding robust inaccuracy and leveraging model robustness selection mechanism. We present minimizes robust inaccuracy and maximizes robust accuracy. The key concept was extending an existing robust training loss with term that minimizes robust inaccuracy, making our method widely applicable since it can be instantiated using various existing robust training methods. We show the practical benefits of our approach by both, using robustness an abstain mechanism, and by leveraging compositional architectures to improve robustness without sacrificing accuracy.
training method that jointly
However, there are also limitations and extensions consider in future. First, while there are cases where our training improves robust accuracy and reduces robust inaccuracy, it does typically result in trade-off between the two reduced robust inaccuracy also leads to reduced robust accuracy. To address this issue, we compute a Pareto front of optimal solutions, all of which can be used to instantiate the compositional model. interesting future work is exploring this trade-off further and develop new techniques to mitigate it. Second, given that we compute Pareto front of optimal solutions, another extension to consider model cascades that consist of different models along this Pareto front, and progressively fall back to models with higher robust accuracy but also higher robust inaccuracy. Third, we observed that the training becomes much harder as robust inaccuracy approaches zero (i.e., the best case). This is because these remaining robust inaccurate examples the hardest to fix, and because there are only a few. our work, we explored using data augmentation address this issue, but more work is needed make the training efficient in such low data regime.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: query-efficient black-box adversarial attack via random search. In European Conference on Computer Vision, pp. 484-5011 Springer, 2020.
Mislav Balunovic and Martin Vechev. Adversarial training and provable defenses: Bridging the gap. In International Conference on Learning Representations, 2019.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pp. 39-57. IEEE, 2017.
Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, Percy Liang, and John C Duchi. Unlabeled data improves adversarial robustness. arXiv preprint urXiv:/905. 19t.//9553.330 2019.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. International Conference on Machine Learning, pp. 1310-1320. PMLR, 2019.
Corinna Cortes, Giulia DeSalvo, and Mehryar Mohri. Learning with rejection. In International Conference on Algorithmic Learning Theory, pp. 67-82. Springer, 2016.
Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with fast adaptive boundary attack. In International Conference on Machine Learning, pp. 2196-2205. PMIR, 2020a.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning, pp. 2206-2222222 2216. PMLR, 2020b.
Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flam- marion, Mung Chiang. Prateek Mittal, and Matthias Hein. Robustbench: standardized adversarial robustness benchmark. arXiv preprint arXiv:2010.09670 2020.
Ekin D Cubuk, Barret Zoph, Dandelion Mane, Vijay Vasudevan, and Quoc V Le. Autoaugment: Learning augmentation policies from data. arXiv preprint 1 2018.
Gavin Weiguang Ding, Yash Sharma, Kry Yik Chau Lui, and Ruitong Huang. Mma training: Direct input space margin maximization through adversarial training. arXiv preprint arXiv: 18/2.02637 2018.
Edgar Dobriban, Hamed Hassani, David Hong, and Alexander Robey. Provable tradcoff's in adversar- ially robust classification. CoRR, abs/2006.0516 161 2020.
abs/
2006. 05161
Ran Yaniv et al. On the foundations of noise-free selective classification. Journal of Machine Learning Research, 11(5), 2010.
Christian Ertler, Jerneja Mislej, Tobias Ollmann, Lorenzo Porzi, Gerhard Neuhold, and Yubin Kuang. The mapillary traffic sign dataset for detection and classification on a global scale. European Conference Computer Vision, pp. 68-84. Springer, 2020.
Yarin Gal and Zoubin Ghahramani. Bayesian convolutional neural networks with bernoulli approxi- mate variational inference, 2018.
Yonatan Geifman and Ran Ylniv... Selective classification for deep neural networks. In Proceedings of the 31 International Conference on Neural Information Processing Systems, NeurlPS" 17, pp. 4885 4894, 2017.
Yonatan Geifman and Ran El-Yaniv. Selectivenet: A deep neural network with an integrated reject option. In International Conference on Machine Learning, pp. 2151-2159, PMLR, 2019.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint 14Xiv:1412.6577 2014.
10

---

Under review as a conference paper at ICLR 2023
Sven Gowal, Krishnamurthy Dvijotham, Robert Stanforth, Rudy Bunel, Chongli Qin, Jonathan Uesato, Relja Arandjelovic, Timothy Mann, and Pushmeet Kohli. On the effectiveness interval bound propagation for training verifiably robust models. arXiv preprint
2018.
Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint MrXiv:2010.03593, 2020.
Durk P Kingma, Tim Salimans, and Max Welling. Variational dropout and the local reparameter- ization trick. In Advances in Neural Information Processing Systems, volume 28. Curran As- sociates, Inc., 2015. URL
neurips. wal.app.ccpappeee cc/paper/2015/Ele. pdf
Alex Krizhevsky, Geoffrey Hinton, al. Learning multiple layers of features from tiny images. 2009.
Solomon Kullback and Richard Leibler. On information and sufficiency. The annals of mathemati- cal statistics, 22(1):79-B8) 76. 1951.
Cassidy Laidlaw and Soheil Feizi. Playing it safe: Adversarial robustness with an abstain option. arXiv preprint arXiv:1911.11255 2019.
Ziyin Liu, Zhikang Wang, Paul Pu Liang, Russ Salakhutdinov, Louis-Philippe Morency, and Masahito Ueda. Deep gamblers: Learning to abstain with portfolio theory. Advances in Neural Information Processing Systems, 32:10623-10633, 2019.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
Dmitry Molchanov, Arsenii Ashukha, and Dmitry Vetrov. Variational dropout sparsifies deep neural networks. In International Conference on Machine Learning, ICML'17, pp. 2498 2498-2507. ....25570..... JML..org. 2017.
Mark Niklas Mueller, Mislav Balunovic, and Martin Vechev. Certify predict: tified robustness with compositional architectures. In International Conference on Learning Representations, 2020.
Boosting
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Kopf, Edward Yang. Zachary Vito,o Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala. Pytorch: An imperative style, high-performance deep learning library. In Advances in Neural Information Processing Systems 32, pp. 8024-8035. Curran Associates, Inc., 2019.
Aditi Raghunathan, Sang Michael Xie, Fanny Yang, John Duchi, and Percy Liang. Understanding and mitigating the tradeoff between robustness and accuracy. In Proceedings the 37th International Conference on Machine Learning, volume 119 ICML'20, pp. 7909-7919, PMLR, 13-18 Jul 2020.
Sylvestre-Alvise Rebuffi, Sven Gowal, Dan A Calian, Florian Stimberg, Olivia Wiles, and Tim- othy Mann. Fixing data augmentation to improve adversarial robustness. arXiv preprint 2XXv:21033.1146, 2021.
Hadi Salman, Greg Yang. Jerry Li, Pengchuan Zhang, Huan Zhang, Ilya Razenshteyn, and Sebastien Bubeck. Provably robust deep learning via adversarially trained smoothed classifiers. arXiv preprint arXiv:1906.0455 2019.
Vikash Sehwag, Saeed Mahloujifar, Tinashe Handina, Sihui Dai, Chong Xiang, Mung Chiang, and Prateek Mittal. Improving adversarial robustness using proxy distributions. arXiv preprint 1xXiv22/4409944 2021.
11

---

Under review as a conference paper at ICLR 2023
Murat Sensoy, Lance Kaplan, and Melih Kandemir. Evidential deep learning to quantify classification uncertainty. In S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa- Bianchi, and R. Garnett (eds.), Advances in Neural Information Processing Systems, volume 31. Curran Associates, Inc., 2018.
David Stutz, Matthias Hein, and Bernt Schiele. Disentangling adversarial robustness and generaliza- tion. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 6976-6987, 2019.
David Stutz, Matthias Hein, and Bernt Schiele. Confidence-calibrateed adversarial training: Generaliz- ing to unseen attacks. International Conference on Machine Learning, pp. 9155-9166. PMLR, 2020.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 2013.
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In International Conference on Learning Representations, 2019.
Eric Wong, Frank R. Schmidt, Jan Hendrik Metzen, and J. Zico Kolter. Scaling provable adversarial defenses. In Advances Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems 2018, NeurIPS 2018, NeurlPS' 18, pp. 8410- 8419, 2018.
Kaidi Xu, Zhouxing Shi, Huan Zhang, Yihan Wang, Kai-Wei Chang, Minlie Huang, Bhavya Kailkhura, Xue Lin, and Cho-Jui Hsich. Automatic perturbation analysis for scalable certified robustness and beyond. Advances in Neural Information Processing Systems, 33, 2020.
Yao-Yuan Yang, Cyrus Rashtchian, Hongyang Zhang, Russ R Salakhutdinov, and Kamalika Chaud- huri. A closer look at accuracy vs. robustness. In Advances in Neural Information Processing Systems, volume 33 of NeurlPS' 20, pp. 8588-8601. Curran Associates, Inc., 2020.
Runtian Zhai, Chen Dan, Di He, Huan Zhang, Boqing Gong, Pradeep Ravikumar, Cho-Jui Hsich, and Liwei Wang. Macer: Attack-free and scalable robust training via maximizing certified radius. arXiv preprint arXiv:2001.02372 2020.
Hongyang Zhang. Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. International Conference on Machine Learning, pp. 7472-7482. PMLR, 2019a.
Huan Zhang, Hongge Chen, Chaowei Xiao, Sven Gowal, Robert Stanforth, Bo Li, Duane Boning, and Cho-Jui Hsich. Towards stable and efficient training of verifiably robust neural networks. arXiv preprint arXiv:1906.06 06316, 2019b.
Shuai Zhao, Liguang Zhou, Wenxiao Wang, Deng Cai, Tin Lun Lam, and Yangsheng Xu. Towards better accuracy-efficient trade-offs: Divide and co-training, arXiv preprint arXiv:2011. 20.1. 14660, 2020.
12

---

Under review as a conference paper at ICLR 2023
A APPENDIX
A.1 DATASETS
We ram our evaluations on four different datasets, namely on CIFAR-10 and CIFAR-100 (Krizhessky et al. 2009), the Mapillary Traffic Sign Dataset (MTSD) (Ertler et al. 2020), and a rail defect dataset provided by Swiss Federal Railways (SBB). Additionally, used synthetic dataset consisting of two-dimensional data points. In the following, we explain the necessary preprocessing steps to create the publicly available MTSD dataset.
Mapillary Traffic Sign Dataset (MTSD) The Mapillary traffic sign dataset (Ertler et al. 2020) is large-scale vision dataset that includes 52 000 fully annotated street-level images from around the world. The dataset covers 400 known and other unknown traffic signs, resulting in over 255 55000 traffic signs in total. Each street-level image is manually annotated and includes ground truth bounding boxes that locate each traffic sign in the image, shown in Figure Sa Further, each ground truth traffic sign annotation includes additional attributes such as ambiguousness or occlusion. Since the focus of this work is classification, (described below) by cropping to each ground truth bounding box. We show samples from the resulting cropped MTSD dataset in Figure 5b
convert the base MTSD dataset to classification dataset
(a) Base Mapillary Traffic Sign Dataset (MTSD). The ground truth bounding boxes visualized in green.
information pedestrians-
complementary chevron-right
regulatory yield gl
regulatory no- entry
complementary
(b) Preprocessed Mapillary Traffic Sign Dataset (MTSD).
Figure 5: Illustration of Mapillary Traffic Sign Dataset (MTSD) samples. The base dataset consists of street-level images that include annotated ground truth bounding boxes locating the traffic signs (a). We convert the dataset a classification task by cropping to the ground truth bounding boxes (b).
We convert the MTSD objection detection dataset into classification dataset as follows:
1. Ignore all bounding boxes that are annotated as occluded (sign partly occluded), out-of- frame (sign off by image border), exterior (sign includes other signs), ambiguous (sign is not classifiable at all), included (sign is part of another bigger sign), dummy (looks like sign but is not) (Ertler et al. 2020). Further, we ignore signs of class other-sign, since this is general class that includes any traffic sign with a label not within the MTSD taxonomy.
2. Crop to all remaining bounding boxes and produce a labeled image classification dataset. Cropping is done with slack, i.e. we crop to randomly upsized version of the original bound- ing box. Given a bounding box BB = ([rmin Iman [ymin Vmaz)), the corresponding upsized bounding box is given
UBB = (IImin (Imaa Zminn: : Emaa + A(1 ax)(2maa - xmin)),
(16)
[Umin A0 Vmin), Vmaz + X(1 (1 vmin)))
where Cgg, ag (o and X is the slack parameter, which we set to À 1.0.
3. Resize cropped traffic signs to (64, 64).
MM. is the uniform distribution the interval [a,
13

---

Under review as a conference paper at ICLR 2023
Rail Defect Dataset (SBB) The rail defect dataset (SBB) is proprietary vision dataset collected and annotated by Swiss Federal Railways. It includes images of rails, each of which is annotated with ground truth bounding boxes for various types of rail defects. We note that all the models used in our work for this dataset are trained by the authors and not provided by SBB. In fact, for work, even consider a different type of task classification instead of the original object detection. As a consequence, the accuracy and robustness results presented in our work are by no means representative of the actual models used by SBB.
A.2 HYPERPARAMETERS
We use LTRADES (Zhang et al. (019a) to both train models from scratch and fine-tune existing models. When training models from scratch, we train for 100 epochs using LTRADES. with an initial learning rate le-1, which we reduce to le-2 and 1e-3, once 75% and 90% of the total epochs are completed. When fine- miee-tuning models, we train for 50 epochs using CTRADES. with an initial learning rate le-3, which we reduce to le-4 once 75% of the total epochs are completed. We use batch size 200, use 10-step PGD (Madry et al. 2018) to generate adversarial examples during training, and set the parameter in LTRADES STRADES 6.0.
TRADES
Empirical Robustness Abstain Training We fine-tune for 50 epochs using LeRa (Equation 4. with an initial learning rate le-3, which we reduce to le-4 once 75% of the total epochs are completed. We use batch size 200, use 10-step PGD [Madry et al. 2018) to generate adversarial examples during training, and set STRADES 6.0 for the loss term Lrob
LTRADES.
additional baseline to compare models against. In our evaluations, we use the dynax = 12/255 trained WideResNeet28- 10 published by Ding et al. (2018), and fine-tune it using MMA with dmea = 4/255 for 50 epochs. We decided to fine-tune with dmaz= = 1/256, since we typically evaluate smaller perturbation regions (6 E {1/255, 2/255, 1/255 }), and since Ding et al. (2018) claim that dmaa should usually be set larger than Eco in standard adversarial training We fine-tune for 50 epochs, using the same hyperparameters as Ding et al. (2018), and without using data augmentations.
MMA We MMA (Digg al. 2018)
We use MART WWagg et al. 2019) as additional baseline to compare models against. In our evaluations, we use the E = 5/255 trained WideResNet-288- (trained with 500K unlabeled data) published by Wang al. (2019) and fine-tune it using MART for the respective smaller perturbation region (c C 1/255, 2/255, $/255)) ). We fine-tune for 50 epochs, using the same hyperparameters as Wang al. (2019), and without using data augmentations.
MART
Certified Robustness Abstain Training We fine-tune for 50 epochs using Lera (Equation 7 with an initial learning rate 1e-3, which we reduce to le-4 once 75% of the total epochs are completed. We use batch size 50, ls = 16 ii.dd samples from (O, o² T2),, and set the inverse softmax temperature to 4.0 (cf. Section
Probabilistic Certification via Randomized Smoothing We use the practical Monte Carlo al- gorithm by Cohen et al.] (2019) for randomized smoothing, using the same certification hyperpa- rameters as them. We use No 100 Monte Carlo samples identify the most probable class ca. N = 100, 000 Monte Carlo samples to estimate a lower bound on the probability PA. and set the failure probability to a 0.001.
Synthetic Dataset In Figure 1 we illustrate the effect of our training a synthetic three-class dataset, where each class follows a Gaussian distribution. We then use a simple four-layer neural network with 64 neurons per layer, and train it on N 1000 synthetic samples, using L LTAADES (Zhang et al., 2019a), and LERA (Equation 4). For each loss variant, we train for 20 epochs, use a fixed learning rate Ic-1, and batch size 10. For LTRADES and LERA,
10-step PGD (Madry et al. 2018) to generate adversarial examples during training, and set STRADES = 6.0.
14

---

Under review as a conference paper at ICLR 2023
Table 3: Robust accuracy (Ro5)) and robust inaccuracy (Ryob ) of the 22/255 CERA (B 1.0) finetuned Gowal al. 2020) model, evaluated using both 40-step APGD (Croce & Hein 2020b) and AutoAttack (Croce & Hein 2020b).
B1/25
B 2/255
B
4/225
B
8/255
Ryoh
Ryoh
nace
Rybb
nace Ryoh
Ryob
yob
nace
Ryab
nacc yob
40-step APGD
92.93
1.01
86.45
0.33
64,09
0.06
17.20
0.0
AutoAttack
92.93
1.01
86.45
0.33
63.87
0.06
16.67
0.0
A.3 ROBUSTNESS GUARANTEES FOR ROBUST SELECTION
Recall from Section that, given an abstain model (Fe, S) and a threat model (x) = fz': ||
a: lp < <.). (Fo, S) is robustly selecting input x if the selector S selects all valid perturbations
(x)):
Reas (S) = (E,Y)~D 1 1 E (.)... S(x') 13
Further, recall that when evaluating the robustness of an empirical robustness indicator selector SERI (Equation TOp, in fact need to check robustness of the model Fg to double the perturbation region
x B x) which can be see from the following derivation:
Riod (SERT)
IVa'' (x)) SERI (a') = =13
[ (x)) 1 1Vv"" (xe). Fo(x") Fo( 1 E (2)) Fo Fo(w))
((
A.4 COMPARING APGD AND AUTOATTACK ROBUSTNESS
Recall from Section 7 that we use 40-step APGDeE (Croce& & Hein 2020b) (referred as APGD) to evaluate the empirical robustness of classifiers Fg. APGD is one of the adversarial attacks that constitute AutoAttack (Croce & Hein, 2020b). which is an ensemble of adversarial attacks. Concretely, AutoAttack consists of APGDcr (Croce & Hein 2020b), APGD DLR (Croce & Hein 2020b), FAB" (Croce & Hein 2020a), and SquareAttack (Andriushchenko al. 2020).
In the following, we conduct an ablation study over 40-step APGD and AutoAttack by comparing the robustness of an LERA trained model. Concretely, we consider the Gowal et al. (2020) WideResNet- 28-10 model, which was finetuned for 2/235 using our LERA loss (with 3 1.0) on CIFAR-10(Cf. Section 7.1.. We then evaluate its robust accuracy Race and robust inaccuracy R R, wace for the threat models 6oo E (1 (1/255, 2/255, 4/25s, $/255). using both 40-step APGD and AutoAttack, and show the results in Table 3 Observe that for small perturbation regions 6 {1/255, 2/255}, the robust accuracy and robust inaccuracy are equivalent for 40-step APGD and AutoAttack, whereas for larger perturbation regions 6oo E (4/255, */255). AutoAttack robust accuracy is marginally lower than 40-step APGD robust accuracy.
A.5 COMPARING ADVERSARIES FOR SOFTMAX RESPONSE (SR)
Recall from Section 7.2 that we evaluated the robustness of softmax response (SR) abstain models using APGDconf, which is a modified version of APGD (Croce & Hein 2020b) using the alternative adversarial attack objective by Stutz et al. (2020). This modified objective optimizes for an adversarial example x' that maximizes the confidence any label e * Fo (x)), instead of minimizing the confidence in the predicted label:
x arg max max fo(
(17)
(EBi(a) (F()
The resulting adversarial attack finds high confidence adversarial examples, and thus represents an effective attack against softmax response selector SEg.
15

---

Under review as a conference paper at ICLR 2023
Exc 1/255
Eo 2/255
Eoo 4/255
Ry (%6]
APGD
APGDcanf
1..0 [%6]
Figure 6: Robust selection (Ryat) and robust accuracy (Roo)) for CIFAR-10 softmax response (SR) abstain models [F, S ). for varying threshold 7 E [o, 1) and using the WideResNee-22- classifier
F by Carmon et al. (2019). Each SR abstain model is evaluated via APGD (Croce & Hein 20206 and APGDconf (Equation I7)
Table 4: Robust selection (Ryot) and robust accuracy (Rog of empirical robustness indicator abstain models (F, SERI), trained using LeRa (Equation 4 and LDGA (Equation 18..
CIFAR-10
B1/253
2/225
Pre-trained Model
Finetuning
Riah
Resh
LERA
86.31
96.63
78.24
97.33
Zhang et al. (2019a
CDGA
84.98
94.92
75.73
96.22
(ResNet-SO)
CERA -AA
83.44
97.47
74.63
98.31
LDGA
AA
80.72
96.56
73.59
97.88
In the following, we conduct an ablation study over APGD and APGDconf by evaluating the robust selection Ridd and robust accuracy Ryo of an SR abstain model (Fe. SSa) using both APCD and APGDconf. We use the adversarially trained WideResNet-28-- from RobustBench (Croce et al. 2020)), trained on CIFAR-10 for & = $/255 perturbations. We then evaluate the classifier as an SR abstain model (Fo, SSa) with varying threshold r E (0, 1), and report the robust selection and robust accuracy for varying foo perturbations in Figure Observe that for small perturbations such as oo = 1/255, APGD and APGDconf are mostly equivalent concerning robust selection and robust accuracy. However, for larger perturbations such as Exc 4/25s, the SR abstain model is significantly less robust to APGDconf than to standard APGD, showing the importance of choosing a suitable adversarial attack. High confidence adversarial examples generally more likely to be found for larger perturbations, thus an SR selector is significantly less robust to APGDconf than to APGD for larger perturbations.
model by (Crymon et al. (2019) (taken
A.6 LOSS FUNCTION ABLATION STUDY
Additionally to the LERA loss from Equation we consider an alternative loss formulation for training an empirical robustness indicator abstain model. The formulation based on the Deep Gamblers loss (Liu et al. 2019), which considers an abstain model (Fe, S) with an explicit abstain class as selection mechanism. Since we consider robustness indicator selection, we replace the output probability of the abstain class fa(x) with the output probability of the most likely adversarial label. This corresponds to the probability of sample being non-robust and thus the probability of abstaining under robustness indicator selector. Similar to LeRA. we also add the TRADES loss (Zhang al. 2019a) to optimize robust accuracy. The resulting loss is then defined as:
CoGa(fo. (æ,w)) v)) = LTRADES (fo, (æ, v)) log (fo(x), + maxeE) fo(x")) (18)
We conduct ablation study over the two loss functions, LERA and LDGA, for CIFAR-10 and E.c = 8/255 TRADES (Zhang et al. 2019a) trained ResNet-50 model. We fine-tune the model for foo perturbations of radii 1/253 and 2/255, using both LERA and LDGA, training for 50 epochs each and setting the regularization parameter 3 1.0. For each loss variant, we train the base model once without data augmentations and once using the AutoAugment (AA) policy (Cubuk et al. 2018).
16

---

Under review as a conference paper at ICLR 2023
CIFAR-10
CIFAR-100
MTSD
S83
Zhang B B1/258
Cammon el
Gowal et al.
Rebulli el
Zhang et al.
Zhang et al.
Robust Accorncy RR (96)
B1/
B 1/56
B1/255
B 1/28
B B1/258
16
hetter
325
33
73
2.5
73
Robust Inaceuracy Re [96]
better
Figure 7: Robust accuracy (Roch) and robust inaccuracy (R of existing robust models (4, fine-tuned with our proposed loss (o, Further, we also show models finetuned via MART (Wang
al., 2019) (4) and MMA (Ding et al. 2018) (D). Our approach consistently reduces the number of
robust inaccurate samples across vanous datasets, existing models and at different regularization
levels 3.
We show the robust accuracy and the robust selection of the resulting robustness indicator abstain models in Table 4 Observe that for all experiments, LERA trained models achieve consistently higher robust accuracy and higher robust selection, compared to LDGA trained models. For instance, when training for & = 1/255 perturbations without data augmentations, LERA achieves +1.71% higher robust accuracy and + +1.33% higher robust selection, compared to LDGA- Similarly, when training with AutoAugment, Cera achieves +0.91% % higher robust accuracy and +2.72% higher robust selection. Similar results hold for 6x = 2/255 perturbations.
A.7 ADDITIONAL EXPERIMENTS ON REDUCING ROBUST INACCURACY
In this section, we present additional experiments on reducing robust inaccuracy for empirical robustness.
Similar to the results in Figure 2 we show the robust accuracy (Rao)) and robust inaccuracy (R of different existing models fine-tuned with (4) and without (4) data augmentations, in Figure At the same time, Figure also shows the same models fine-tuned with our proposed loss with (+) and without (O) data augmentations. We again observe that our approach achieves consistently lower robust robust inaccuracy, compared to existing robust models. For example, on CIFAR-10 and for B7/2555 the model from Carmon et (2019) achieves 91.7% robust accuracy but also 1.8% robust inaccuracy. Using our loss LERA and varying the regularization term 33, we can obtain number of models that reduce robust inaccuracy 0.14% while still achieving robust accuracy of 75.8%.
A.8 ADDITIONAL EXPERIMENTS ON USING ROBUSTNESS TO ABSTAIN
In this section, we present additional experiments on comparing different abstain approaches for empirical robustness.
We compare robustness indicator abstain models SaI) using existing robust classifiers TRADES and classifiers fine-tuned with our proposed loss ERARI. Further, again consider softmax response and selection network abstain models, as described in Section 7.2 Equivalent to Section 7.2 we use the robust selection (Reet), and the ratio of non-abstained samples that are robust and accurate (RR0)) as our evaluation metrics.
We show the comparison of the different abstain models Figure Similar the results in Section 7.2] we again show that, as designed. our approach consistently improves robust accuracy. For instance, consider the CIFAR-10 Zhang et al. (2019a) model &oo 1/255, trained without data augmentations (O). The ERAgr model with the highest robust selection Reef improves robust accuracy by +2.39% at the expense -3.44% decrease robust selection. This tradeoff close to optimal since our approach increases robust accuracy by correctly abstaining from mispredicted samples, thus an increase in robust accuracy results in a corresponding decrease in robust selection. Further, again observe that by varying the regularization parameter B, front of optimal solutions. Considering the CIFAR-10 10 Zhang et al. (2019a) model at & = 1/255, trained with data augmentations
obtain Pareto
can improve the robust accuracy up 99.75% %, increase
17

---

Under review as a conference paper at ICLR 2023
CIFAR-10
NTS0
Zhang et
2019
Carmon 2019)
Gowal
2020
Zhang al 2019a
ResNet-5U, 2,, B1/255
WRN-28-111 28- 28-10,
2/255
WRN- 28- B2/asn
ResNet-50, 11555
Robhast Apcuracy R2.
$7.5
95
15
93
22.5
90
95-
bollerr
05
85
97
25.0
32.
$0.0
75
75
Robust Selection R2 R2 [96]
Figure 8: Comparison of different abstain approaches including existing robust classifiers TRADESRI (4. 4), MARTRI (4), MMARI (D), classifiers fine-tuned with our proposed loss ERAạI (O, @) selection network (m, ) and softmax response (o, +) abstain models. The higher Ryo and Ryos the better (top right corner is optimal).
of +4.38% compared the corresponding TRADES&I model (4). However, this comes the expense of disproportionally large decrease of -42.27% lower robust selection. We observe similar results for other models, datasets, and perturbations regions, shown in Figure
Further, we again note that our approach mostly improves both robust selection and robust accuracy when compared to softmax response and selection network abstain models.
A.9 ADDITIONAL EXPERIMENTS ON BOOSTING ROBUSTNESS WITHOUT ACCURACY LOSs
In this section, we present additional results combining abstain models with state-of-the-art models trained achieve high natural accuracy.
we put the abstain models trained so far in 2-composition (Section 6 with the standard trained core models discussed Appendix [A. We show the natural (Rnat) and adversarial accuracy (Reeg) of the resulting 2-compositional architectures in Figure g
Equivalent to Section 7.3
again observe that 2-compositional architectures using models trained by our method (o, improve existing methods that solely optimize for robust accuracy (a, 4). Further, method mostly improves both the natural and robust accuracy, compared to 2-compositional architectures using softmax response (0, or selection network (m, @) to abstain. For example, SBB and the Zhang et al. (2019a) model at coo = 1/255, our approach (O) improves natural accuracy by +0.68% while decreasing the robust accuracy by only- -1.4%.
Further, we show that 2-compositional architectures using models trained by our method achieve significantly higher robustness and mostly equivalent overall accuracy, compared state-of-the- art con-coopositional models trained for high natural accuracy. In Table 5 we show the natural (Rnar) and adversarial accuracy (Rao)) of our 2-compositional models and illustrate the accuracy improvement over the standard trained models discussed in Appendix I0 For instance, consider CIFAR-10 at Exc 2/255 and the 2-compositional architecture using the Gowal et al. (2020) model as robust model Frobust- Our model improves the robust accuracy by +75.3% and the natural accuracy by +0.1 %, compared to the standard trained model by Zhao et al. 2020)). Similar results hold for other models, datasets, and perturbation regions.
A.10 CORE MODELS
Recall from Section 6 that an abstain model (F, S) can be enhanced by a core model Feores which makes prediction on all abstained samples, resulting in 2- 2-compositional architectures. In Section 7.3 we presented an evaluation of 2-compositional architectures, where we used otate-of-the-art standard trained models models. In Table 6 we show the natural and adversarial accuracy of core
18

---

Under review as a conference paper at ICLR 2023
Table 5:
Improvements of 2-compositional architectures using models Frobust trained with our method over non-compositional models trained to optimize natural accuracy only (Appendix 10
CIFAR-10
CIFAR-100
MTSD
SBB
Feore
Zhao al.
2020
(iidoResNet-22
(BeeNet-50)
(ResNet-50)
Frobust
Carmon et al.
Gowal ct al.
Rebuffi et
Zhang et al.
Zhang et al
Ryob
86.5 (460, (460.39)) 398)
87.8 (461.6%)
44.0 (-24.19)
84,5 (+9.8%
88.4 (+12.79)
Blyass
Rnat
97.6 (-025%
98.0 (40.2%)
80.5 (+039%)
94,1 (40.38)
92.3 (+0.95)
Ryob
73.4 (+70.59)
78.2 (+75.39)
41.9 (-38,99)
69.9 (+29.25)
82,4 (+37.79)
Bayass
R R.at
97.8 (+0.0%)
97.9 (+0.1%)
80.18 (-0015)
94.0 (+0.2%)
91.3 (0.18)
models used in Section 7.3 for varying &oo perturbation regions, where we use 40-step APGD (Croce evaluate robustness.
Hein 20206)
Table 6: Natural (Reat) and adversarial accuracy (Rya)) of standard trained core models, used in
2-compositional architectures Section 7.3 and Appendix A.9
Ryab [%6]
Dataset
Model Foore
Rnat [%]
11/250
2/255
200 4/255
CIFAR-10
Zhao et al. 2020 (NideResllet:40-100)
97.81
26.18
2.92
0.06
CIFAR-100
(iideessNet-28-10)
80.17
19.9
3.06
0.15
MTSD
(ResNet-50)
93.79
74.66
40.71
7.51
SBB
(ReaNet-50)
91.37
75.65
44.69
8.76
A.11
ROBUSTNESSSACCCRAAC DATASET SPLITS
Consider robustness indicator abstain model (Fs, Sar) and a labeled dataset = {(xx, y1) on
which we evaluate the classifier Fo X + Y. Based on the robustness and accuracy of the classifier
Fg. we can partition into four disjoint subsets = {D DF D'A D7:
}, where:
D {(x, v) E D: Va' E (x).. Pa(x') Fo(æ)) A Fo(x)) y
D -a ((x,V) E D: Va' E (z) Pa(x') Fo(æ)) A Fo(x) + y}
Drr Drr ((0,V) D: Ea' E (x)... Po(x') + Fo(a)) A Fo(æ) y}
Dr ((x,v) D: Ea' E (z) Po(x') + Fo(æ)) A Fo(æ)) y}
We illustrate this dataset partitioning on the CIFAR-10 Krizhevsky et al. 2009) dataset. We consider
TRADES (Zhang et al.) 2019b) trained Re and the WideResNett 2t-22-100 10 models by Carmon eet al. (2019): Gowal et al. 2020) (taken from Robustbench (Croce et al. (020)), where each model is adversarially pretrained for 8:0 = 8/255 and then fine-tuned via TRADES to the respective fxx threat model illustrated Table 7 Further, we also consider a standard trained ResNet-50, We then evaluate the robustness and accuracy of each model using 40-step APGD (Croce & Hein 2020b). Considering Table 7 note that standard adversarial training methods do not necessarily eliminate the occurrence of robust inaccurate samples (ax, 3) E DrA-a and that the robust inaccuracy generally increases for smaller perturbation regions. Further, we note that while standard trained models have low robust inaccuracy, they also have low overall robustness, resulting low overall robust accuracy.
CIFAR-100 (Krizhessky Further, we also illustrate the robustness-accurace dataset partitioning al. 2009). We consider a standard trained WideResNet-22 -8-eett-2----- 28-10 10 and the adversarially trained pretrained for c.c = 8 /255 perturbations and then TRADES fine-tuned for the respective threat model indicated in
WideResNett28-UU by RRbbufii et al. (2021). Again, the model by Rebutfi et al. (2021)
Table 8 We again evaluate the aobustnss-accuraan dataset partitioning for varying foo perturbations
using 40-step APGD (Croce& & Hein 2020b), and list the exact size of each data split in Table
Notably, we observe that the model by Rebuffi al. (2021). 15.2 15.24% of all test samples robust but inaccurate for E = 1/255 perturbations, which is a significantly larger fraction compared to similar models CIFAR-10.
19

---

Under review as a conference paper at ICLR 2023
CIF EIFAR-10
SBB
Zhang et al 22019)
Carmon al 2019
Gowal et a.
2020
Zhang et
2019
ResNet- 2
11225
WIN 2/255
2/256
ResNet 11/255
Roluss Accuracy (oo (96)
70-
03
20-
32
20
120
92.0
22.5
925
Natural Accuracy Ruat [96
hetter
Figure 9: Natural (Rnat) and robust accuracy (R for 2-compositional ERAş: models (o, ) and 2-compositional TRADESRI (A, A), MART (4), and MMAar (D) models. Further, we also consider 2-compositional ACE-COLTsH. ACE-IBPaH (m, and 2-compositional TRADESgs (9, +) models. The core models used in the compositional architectures are listed in Appendix A.10
Table 7: CIFAR-10 Aooustness-accurac dataset partitioning. We consider TRADES (Zhang et al. 2019ab trained ResNet-50, adversarially trained WideResNet-28-11 10 models (Carmon et al. [2019] Gowal et al. 2020). and a standard trained ResNet-50. Adversarially trained models are trained for the respective perturbation region. Each model is evaluated for the indicated &oc threat model, using 40-step APGD (Croce & Hein 2020b).
Threat Model
Relative Split Size [%]
Data Split
Zhang et al. (ResNet-50))
Carmon et al. (WRN-28-10)
Gowal et al. (WRN-28-10)
Lurd (ResNet-50)
D
5.17
3.33
2.85
6.97
DE a
4.64
3.61
2.88
0.0
Bi
Dr DErAa
6.18
3.32
3.87
74.89
D
84.01
89.74
90.40
18.14
Dpr
7.94
7.38
4.86
6.97
DY
4.13
2.40
2.25
0.0
B2/250
Dppka
10.38
3.20
6.74
91.80
D
77.55
87.02
86.15
1.23
D Dark-o
13.42
8.23
6.64
6.97
DEC [I
3.31
1.05
0.87
0.0
B7/255
17.19
16.87
15.96
93.03
66.08
73.85
76.53
0.0
D D
18.17
9.55
6.97
D
2.64
0.76
1.31
0.0
B5/250
DErha
29.79
27.82
23.78
93.03
D
49.40
61.87
65.70
0.0
20

---

Under review as a conference paper at ICLR 2023
Table 8: CIFAR-100 robustness-accuracy dataset partitioning. We consider standard trained WideResNeet28-10 and the adversarially trained WideResNet-28.. by Rebufti et al. (021). trained for the respective perturbation region considered each evaluation. Each model is evaluated for the indicated xx threat model, using 40-step APGD (Croce & Hein 2020b).
Threat Model
Relative Split Size [%]
Data Split
Rebuffi et al. (WRN-28-10)
Laid (WRN-28-10)
Drg
15.20
19.80
D a
15.24
0.03
Bi/255
D
7.75
60.27
Di
61.81
19.9
32.75
19.82
Di
8.71
0.01
22/255
DrrAa
5.11
77.11
D
53.43
3.06
30.57
19.83
4.34
0.0
Rooc
4/225
DF
23.16
80.02
D
41.93
0.15
DR
33.70
19.83
D2A
3.91
0.0
$3/255
Dr.
26.66
80.17
D
35.73
0.0
21


Reviews:
[{"review_id": "k-9dVUAv8Ul", "reviewer": "Reviewer_KM7o", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a novel approach to improve the tradeoff between adversarial robustness and natural accuracy based on an abstain mechanism that discards datapoints which are not robust to its own predictions. To boos the performance of such model the authors propose a training protocol which minimizes the percentage of training points which are robust by innacurate. The paper claims that this training protocol can be applied only in a second fine-tuning stage still yielding good results. Results are provided comparing the proposed approach against different robustness benchmarks. The authors argue that their models consistently strike a better tradeoff between robustness and accuracy, while also minimizing robust innacuracy.", "summary_of_the_review": "Overall, I find the main idea of this work interesting and valuable. As I mentioned in **strengths** calibrating the robustness of adversarially trained models is an appealing line of work. However, due to the confusing presentation of results, where TRADES seems to always lie on the same Pareto front as thee proposed models, and lack of results on the standard $\\epsilon$ regimes I have my concerns about the credibility of the results. At this stage, I am voting for rejection, but I strongly urge the authors to engage with my questions during the rebuttal. I might have not understood some parts of their work properly, so if they can clarify my concerns, I will be willing to increase my score significantly.", "strength_and_weaknesses": "# Strengths\n\n1. **Interesting propoed method**: The abstain mechanism proposed in this work is an interesting concept with nice connections to the confidence calibration literature. Personally, I have found the idea of calibrating the robustness of a neural network a very appealing concept and an interesting research line.\n2. **Direct writing style**: I really appreciate the direct tone of the paper that goes directly to the main ideas after a short motivation. The paper structure is also very clean.\n\n# Weaknesses\n\n1. **Very unclear evaluation objective and presentation of results**: The main weakness of this work is that the main results of the experiments are presented in a very convoluted fashion. Despite several attempts at carefully reading the results Section 7 and inspecting the provided plots, I still am not sure which setting in the plots corresponds to the discussed numbers in the text, when can we say that a method is superior to another, or how are the different evaluation metrics measured in the context of the abstain models. Let me give a few examples of my confusion:\n   - Several times during the paper, the authors argue that their proposed method can strik a better balance between robust and natural accuracy. In fact, they highlight certain instances of this in the text. However, in all plots I always observe that the TRADES models lie exactly on the same Pareto frontier as the ones trained with the proposed protocols. If this is the case, then what is the added value of the proposed methods? Reaching different points in the Pareto front? If so, did the authors evaluate make sure that tuning the regularization strength of TRADES does not cover the full Pareto front as well?\n   - In page 3, the robust accuracy is defined using the standard notion, i.e., the percentage of points that are robust and accurate in the test set. However, later in page 8, the robust accuracy is defined as the percentage of points that are robust, accurate AND for which the model did not abstain. This is a big difference, as one could artificially increase robustness, by increasing the number of points for which the model abstains.\n2. **Robustness evaluations only at very small $\\epsilon$ values**: I find very surprising that all the results of this paper are given for non-standard $\\epsilon$ values. Especially, when the pretrained models used by the authors to finetune using their new loss where trained using larger $\\epsilon$ values. This makes me very suspicious that many of the results provided in this work might not hold for larger $\\epsilon$. If this was the case, this would seriously decrease the credibility of the findings and make the strong statements of the abstract and introduction much weaker.\n3. (Minor) **Hard-to-read plots**: I personally find the use of markers with and without filling, and different colors, to denote different methods with different training protocols very confusing and hard-to-read.\n\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "WoVEV6PZdDK", "reviewer": "Reviewer_6trG", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper addresses the robustness vs accuracy trade-off that is often observed in adversarial training of neural networks. It proposes the following ensembling technique to overcome this trade-off. The ensemble is made up of two models. The first model is trained using standard adversarial robustness techniques with one key modification: it is trained to be robust only on points that it accurately classifies. On points that it incorrectly classifies, the model is encouraged to be non-robust. The second model in the ensemble is a non-adversarially trained model (i.e, model trained to minimize standard classification error). These two models are aggregated as follows: any input is first sent through the first model. If the first model chooses to abstain, it is sent to the second model whose output is taken as the final output. If the first model doesn't abstain, then the output of the first model is considered to be the final output. ", "summary_of_the_review": "While the proposed approach is interesting, it is presented poorly, and not thoroughly compared with baselines. Moreover, the work isn't placed properly among the long line of work on robustness vs accuracy trade-off.  It'd be great if the authors address my concerns above.", "strength_and_weaknesses": "While the proposed technique is interesting, I believe the paper is a little bit under-cooked and needs a significant amount of work to be published. Here are some key concerns I have:\n\n* Experiments: \n\n    - Why isn't the proposed technique used to train models from scratch? Is it because of computational challenges? The current evaluation mechanism of 'fine-tuning existing models' makes it harder to understand why the proposed algorithm is working the way it is. I would appreciate if the authors train their models from scratch and compare with standard adversarial training techniques like AT, TRADES.\n\n    - It looks like the existing models were trained with epsilon=8/255, whereas the fine-tuning is done with smaller epsilon's. Why is there this mismatch? Can the authors report numbers for the setting where the epsilon used to train existing model is same as the epsilon used in fine-tuning? \n\n    - In section 7.1, it is claimed that the proposed technique gives Pareto front of optimal solutions. How can this claim be made just based on Figure 2? \n\n    - The curves in Figure 2 are confusing. Why are the triangles (TRADES) connected with circles (ERA)? \n\n    - For models fine-tuned using TRADES, can we vary the regularization parameter lambda and obtain the robust accuracy vs robust inaccuracy curves curves as in Figure 2? How do the curves compare with the results in Figure 2?\n\n    - I have concerns regarding \"robust selection\" described in Section 5.  For the \"robustness indicator selector\" to be robust, it looks like we need the model to be robust on double the region (2*epsilon). But the model is trained to be robust only for perturbations of size epsilon. Given this mismatch, one would expect the robustness indicator to be always 0 when there are adversarial perturbations.  Consequently, the model should always abstain. But I don't see this in the experimental results in sections 7.2, 7.3. Why is this the case? This also makes me wonder if one can come with a better attack (than APGD) to break the proposed technique. Let's say the attacker carefully chooses a point such that it is at most epsilon away from the original image, and at the same time the point is such that the model's predictions are not constant in an epsilon ball around it. Such a point would make the model to abstain and lead to incorrect predictions and make the model less robust. Is this correct? It'd be great if the authors comment on this.\n\n   - At a number of places in the paper, it is claimed that the proposed technique improves the robustness by 61%. I find these claims to be incorrect and misleading. When I look at the results, I don't see such huge gap in performance between baselines such as TRADES and the proposed approach. \n\n * The clarity and presentation of the paper needs to be significantly improved. I had to take multiple passes through the paper to clearly understand the terminology, notation and the main message. For example, 'robust inaccuracy' is used in multiple places in the introduction, but is never defined. I have to go to section 3 to understand it. No background was provided on certified robustness, TRADES. Only a very few people working in this area might understand this paper. In addition, the figures are hard to read. It is not clear what improvements the proposed technique is achieving. There are no error bars. So the statistical significance of the results is questionable.\n\n* There are several works that address the robustness vs accuracy trade-off. But these techniques were never properly compared with the proposed technique (neither experimentally nor methodologically). So it is hard to understand how good the proposed technique is and what additional insights it brings over existing techniques. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "ASN7b2HUUc", "reviewer": "Reviewer_HNzQ", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper proposes a training approach that optimizes the adversarial robustness of a neural network without hurting prediction accuracy.\n\nThe proposed methodology has two key components. First a network is trained to maximize robust accuracy (number of examples where the input is correctly classified and this prediction is stable in a small perturbation region) while minimizing robust inaccuracy (number of examples where the prediction is stable, but wrong). Then, this is combined with a traditionally trained network. When the prediction of the robust network is stable, then it is used for prediction. Otherwise the prediction is deferred to the traditionally trained network.\n\nThis configuration achieves the best of both worlds. High robust accuracy with high overall accuracy.", "summary_of_the_review": "The paper is borderline in my opinion. The idea is interesting and novel, but it is only supported empirically and the experiments show that it often does not beat the baselines, it offers a tradeoff between the objectives. The presentation could be improved.", "strength_and_weaknesses": "The proposed method is well motivated and it seems to offer a competitive tradeoff between the objectives. It very nice that the paper looks both at empirical robustness as well as certified robustness. They are sightly different takes on the same objective, and the method seems to work similarly well for both.\n\nThe efficacy is demonstrated in a few experiments. The experiments are thorough and good quality in my opinion.\n\nFirst, it is shown that the robust network is good at reducing the robust inaccuracies, although often at the cost of slightly reduced robust accuracy (Figure 2).\n\nThen, it is shown that the robustness criteria leads to abstaining less often while having higher robust accuracy at the same time (Figure 3). I think it's particularly interesting to see that abstaining based on stability works better than explicitly trained deferral systems and I am curious to hear the author's thoughts on why this happens. Table 2 presents similar results to Figure 3 for certified robustness, but these are not as conclusive. For the (Schwag et al.) model, $L_{CRA}$ has a clear edge, but for the (Cohen et al.) model, $L_{CRA}$ only wins in one of the two competing objectives.\n\nFinally, Figure 4 shows robust accuracy vs natural accuracy (i.e. accuracy). These results suggest that the proposed method offers a competitive tradeoff, but it is not better both in robust accuracy and natural accuracy than the baseline TRADES. Although admittedly, TRADES is a very strong baseline tuned for the CIFAR10 dataset. It's important to emphasize, however, that the model does very well compared to other high natural accuracy approaches. \n\nOverall, we see that the proposed method often does not beat the baselines in all objectives, rather, it offers a competitive tradeoff between them. It performs the best when compared to models with high natural accuracy.\n\nA weakness is that the paper does not go far in discussing the limitations: what is the computational cost? what happens when the threat $\\epsilon$ is under/overestimated?", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject