Adversarial Robustness Through the Lens of Causality
Authors: Yonggang Zhang
Mingming Gong
Tongliang Liu
Gang Niu
Xinmei Tian
Bo Han
Bernhard Schölkopf
Kun Zhang
Venue: ICLR 2022 Poster (2022)
Keywords: Adversarial examples
Causality

Abstract: The adversarial vulnerability of deep neural networks has attracted signiﬁcant attention in machine learning. As causal reasoning has an instinct for modeling distribution change, it is essential to incorporate causality into analyzing this specific type of distribution change induced by adversarial attacks. However, causal formulations of the intuition of adversarial attacks and the development of robust DNNs are still lacking in the literature. To bridge this gap, we construct a causal graph to model the generation process of adversarial examples and define the adversarial distribution to formalize the intuition of adversarial attacks. From the causal perspective, we study the distinction between the natural and adversarial distribution and conclude that the origin of adversarial vulnerability is the focus of models on spurious correlations. Inspired by the causal understanding, we propose the \emph{Causal}-inspired \emph{Adv}ersarial distribution alignment method, CausalAdv, to eliminate the difference between natural and adversarial distributions by considering spurious correlations. Extensive experiments demonstrate the efficacy of the proposed method. Our work is the first attempt towards using causality to understand and mitigate the adversarial vulnerability.

Published as a conference paper at ICLR 2022
CAUSALADV: ADVERSARIAL ROBUSTNESS THROUGH THE LENS OF CAUSALITY
Yonggang Zhang 1.2
Mingming Gong" Tongliang Liu"
Gang Niu
Xinmei Tian'
Bo Han 2,1
Bernhard Schölkopf" Kun Zhang
7.8
"University of Science and Technology of China 'Hong Kong Baptist University
The University of Melbourne 'The University of Sydney
5 RIKEN Center for Advanced Intelligence Project "Max Planck Institute for Intelligent Systems
Camegie Mellon University MMohamed bin Zayed University of Artificial Intelligence
ABSTRACT
The adversarial vulnerability of deep neural networks has attracted significant at- tention in machine learning. As causal reasoning has an instinct for modeling distribution change, it is essential to incorporate causality into analyzing this spe- cific type of distribution change induced by adversarial attacks. However, causal formulations of the intuition of adversarial attacks and the development of robust DNNs are still lacking in the literature. To bridge this gap, we construct a causal graph model the generation process of adversarial examples and define the ad- versarial distribution to formalize the intuition of adversarial attacks. From the causal perspective, we study the distinction between the natural and adversarial distribution and conclude that the origin of adversarial vulnerability is the focus models on spurious correlations. Inspired by the causal understanding, we pro- pose the Causal-inspires Adversarial distribution alignment method, CausalAdy to climinate the difference between natural and adversarial distributions by con- sidering spurious correlations. Extensive experiments demonstrate the efficacy of the proposed method. Our work is the first attempt towards using causality to understand and mitigate the adversarial vulnerability.
INTRODUCTION
The seminal work (Szegedy et al., 2014; Biggio et al., 2013) shows that DNNs are vulnerable to adversarial examples, which consist of malicious perturbations imperceptible to humans yet fool- ing state-of-the-art models (Krizhevsky et al., 2012: Szegedy et al., 2015; Simonyan & Zisserman, 2015; He et al., 2016). The lack of robustness hinders the applications of DNNs some safety- critical areas such as automatic driving (Tuncali et al., 2018) and healthcare (Finlayson et al., 2019). Therefore, mitigating the adversarial vulnerability critical the further development of DNNs.
Human cognitive systems are immune to the distribution change induced by adversarial attacks because humans are more sensitive to causal relations than statistical associations (Gopnik et al., 2004). Using causal language, causal reasoning can identify causal relation and ignore nuisance factors, i.e., not the cause of labels, by intervention (Pearl, 2009; Peters et al., 2017). As adversarial perturbations usually imperceptible and make no impact 2014; Goodfellow et al., 2015), adversarial examples comes from nuisance factors. This is because if task-relevant factors of some samples are changed, these samples will make both humans and DNNs change their decisions. From causal viewpoint (Zhang et al., 2020a), adversarial attacks distribution change resulting from the intervention on the natural data distribution. In summary, causal reasoning has the instinct for analyzing the effect of the intervention caused by adversarial attacks, so it is essential to leverage causality to understand and mitigate the adversarial vulnerability.
human decisions (Szegedy et al., reasonable to assume that the difference between natural and
be regarded specific type of
Corresponding author (bhanml www.woooo.......toeeoeee

---

Published as a conference paper at ICLR 2022
However, there are two significant problems to overcome before using causality understand and mitigate the adversarial vulnerability. Firstly, constructing a causal graph is arguably the fundamen- tal premise for causal reasoning (Pearl, 2009; Peters et al., 2017), but how construct causal graphs in the context of adversarial attacks is still lacking in the literature. Secondly, using causal language to formalize the intuition of adversarial attacks is the key to connect causality and adversarial vul- nerability, but it also remains to be solved. These two problems are fundamental obstacles, which prevent us from employing causality contribute adversarial learning.
To address these challenges, we first construct a causal graph to model the perceived data generation process where nuisance factors are considered. The constructed causal graph can entail a specific intervention distribution, i.e., the ad adversarial distribution. Moreover, the causal graph immediately shows that, given inputs, labels are statistically correlated with nuisance factors, which have no cause-effect to labels. The spurious correlation implies that if DNNs fit the conditional association between labels and nuisance factors, their performance on different conditional associations between labels and nuisance factors will change accordingly. Through investigating the distinction between these two distributions induced by nuisance factors, we conclude that adversarial distributions can be obtained by exploiting conditional associations between labels and muisance factors. where the conditional association of adversarial distributions is drastically different from that of natural dis- tributions. Namely, the origin of adversarial vulnerability is the focus of DNNs the spurious correlation between labels and nuisance factors.
According the causal perspective, an adversarial distribution is crafted by exploiting a specific conditional association between labels and nuisance factors, this association is drastically different from that of natural distributions. Intuitively, eliminating the difference in such conditional asso- ciations between natural and adversarial distributions can promote the performance of models on adversarial distributions. Thus, we propose the caussll-nsppred Adversarial distribution alignment method, CausalAdv, to eliminate the difference between these two distributions. Surprisingly, we find that the proposed method shares the same spirits to existing adversarial training (Goodfellow et al., 2015) variants, i.e., Madry (Madry et al., 2018) and TRADES (Zhang et al., 2019). We validate the efficacy of the proposed method on MNIST, CIFAR 10, and CIFARIOO 100 (Krizhevsky et al., 2009) datasets under various adversarial attacks such as FGSM (Goodfellow et al.. 2015), PGD (Madry et al., 2018), CW attack (Carlini & Wagner, 2017), and Auto/Atack (Croce & Hein, 2020). Extensive experiments demonstrate that CausalAdy can improve the adversarial robustness significantly.
Our main contributions are:
We provide a causal perspective to understand and mitigate the adversarial vulnerability, which is the first attempt towards using causality to contribute adversarial learning.
To leverage causality to contribute adversarial learning, we solve two fundamental prob- lems. Specifically, we construct a causal graph to model the adversarial data generation process and define the adversarial distribution to formalize adversarial attacks.
A defense method called causal-insping adversarial distribution alignment, CausalAdy, is proposed to reduce adversarial vulnerability by eliminating the difference between ad- versarial distribution and natural distribution. Extensive experiments demonstrate that the proposed method can significantly improve the adversarial robustness.
2 A CAUSAL VIEW ON ADVERSARIAL DATA GENERATION
The ability of humans to perform causal reasoning is arguably an essential factor that makes human learning different from deep learning (Schölkopf et al., 2021: Zhang et al., 2020a; Gopnik et al., 2004). The superiority of causal reasoning endows humans with the ability to identify causal re- lations and ignore nuisance factors that trained to fit the perceived information overlooking the ability to distinguish causal relations and sta- tistical associations. This shortcut solution could lead overfitting to these nuisance factors, which would further result in the sensitivity of DNNs to such factors. Therefore, we propose incorporating causal reasoning to mitigate the sensitivity of DNNs to these nuisance factors.
relevant to the task. In contrast, DNNs are usually
Before using causal reasoning to analyze adversarial vulnerability, we need to construct a causal graph, as causal graphs are the key for formalizing causal reasoning (Peters et al., 2017). In the
2

---

Published as a conference paper at ICLR 2022
context of adversarial learning, desire the causal graph by which both the natural and the ad- versarial distributions can be generated. In addition, the graph is required to reflect the impact of nuisance factors these two distributions, that can investigate the difference in nuisance factors between these two distributions. Consequently, we can formally establish the connection between nuisance factors and adversarial vulnerability. Therefore, we propose constructing a causal graph to model the adversarial generation process where the nuisance factors are considered. One approach is use causal structure learning infer causal graphs (Pearl, 2009; Peters et al., 2017), but it is challenging to apply this kind of approach to nigh-dimensional data. Using external knowl- edge construct causal graphs is another approach (Zhang et al., 2013; Tang et al., 2020; Schölkopf et al., 2021). As automatically learning precise causal graph is out of scope for this work, external human knowledge about the data generation process employed to construct the causal graph.
Specifically, we construct a causal graph 9 to for- malize the image data generation process using the following knowledge for analyzing adversarial vul- nerability. As there might be a number of different causes of natural data X, we propose to divide all the causes into two categories for simplicity. We group content-related causes into one category, called con- tent variable C. The rest causes, i.e., nuisance fac- tors, are grouped into another category. called style variable S, which is content-independeen
θ
Figure 1: Causal graph of the per- turbed data generation process. Each node represents a random variable, and gray ones indicate observable variables, where C,S, X, Y, E, X, O are content vari- able, style variable, natural data, label, per- turbation, perturbed data and parameters of a neural network, respectively.
i.c., S IL C. This implies that C X S. It is noteworthy that, in this paper, we assume that only the content variable is relevant for the task we care about, i.e.,
C' Y. Perceived data X are usually composed of perturbations E and natural data X. When the perturbation E is designed carefully to fool DNNs, E should be a compound result of X (the object to be perturbed), Y (the reference for the perturbation). and f (the targets affected by the perturbation), e.g., white-box attacks (Goodfellow et al., 2015; Car- et al., 2016), which means that (X, Y, 0) - E' Leverage all this background knowledge, we obtain the causal graph G formalizing the perturbed data gener- ation process, depicted in Fig. 1.
lini & Wagner, 2017; Moosavi-Dezíoe
Based on the causal graph, we can define valid interventions (Pearl, 2009; Schölkopf et al., 2021) and the corresponding intervention distributions. Defining valid interventions is equivalent to de- termining which variables or mechanisms in the causal graph can be intervened. In this work, we consider both hard and soft interventions (Eberhardt & Scheines, 2007; Correa & Bareinboim, 2020) on the perturbation variable E. Specifically, we can use a structural causal model to represent the generating mechanism of E:
E M(X
where the exogenous variable Ug stands for other indeterminacies, e.g., random start noise used in PGD attack (Madry et al., 2018).
By intervening E in different ways, we can obtain different intervention distributions, which could be either natural or adversarial, over the observed variables. For example, we do a hard interven- tion on E, i.e., do(E E 0) in the graph, the generated data distribution corresponds to the natural distribution P (X, Y). Different perturbations can be obtained by performing soft interventions on E, i.e.. modifying M. In the context of adversarial attacks, adversaries aim maximize a certain objective function É(-) to mislead a target model à () by searching for the worst perturbation for each instance (Goodfellow et al., 2015; Carlini & Wagner, 2017; Dong al., 2018; Madry al., 201 8), where stands for parameters of the target model. To formalize the intuition of adversarial
'These three causes not indispensable. Deleting 0 gives black-box attacks (Papernot et al., 2017; Dong et al., 2018) that only use (X, to perform attacks. Deleting leads to universal adversarial attacks (Moosavi- Dezfooli et al., 2017; Hendrík Metzen et al.. 2017). which assume that one adversarial perturbation is sufficient to fool DNNs. Recent works show that a specific transform to X effectively evaluates the sensitiv- ity of DNNs within small neighborhood (Rahaman et al., 2019; Zhang et al., 2020b), which corresponds to deleting (Y, 0) from the cause set.
3

---

Published as a conference paper at ICLR 2022
attacks, we can first search for the adversarial perturbation Eadu. and then a function to approx- imate the mechanism for generating Endu- The adversarial perturbation Eadu can be obtained by maximizing f(-):
Eadv arg max ((h(X Y),
E'eB
where is a set of valid perturbations. and the adversarial perturbation Ende is the result of the mechanism Madu. i.e., Eado == MMaa(XX (X,Y, Y, 0, UR). The intervention distribution that corresponds to the adversarial mechanism Mado is defined as the adversarial distribution Po(X, Y), where the subscript 0 indicates that Po(X, Y) is crafted to attack the target model h (X;0) with parameter O.
3 METHOD
To understand the adversarial vulnerability, we study the difference between the natural and ad- versarial distributions and conclude that conditional associations between labels and style factors play a crucial role in adversarial vulnerability. Inspired by the conclusion, we propose a method to eliminate the difference in such conditional associations mitigate adversarial vulnerability,
3.1 ORIGIN OF ADVERSARIAL VULNERABILITY
Inspired by the causal graph, we derive a causal understanding of adversarial vulnerability. Accord- ing to the causal graph 9 depicted in Fig. 1, there is a path, 5 - X C Y, from the style variable S to the label Y when X is given 2 which Ieads to the correlation between labels and style variables. The spurious correlation implies that DNNs can perform well on the training set by fiting the statistical association between Y and S, even though the genuine content information is dropped. Moreover, if the conditional association between Y and on the (natural) test set is similar to that on the training set, fitting these spurious correlations will also perform well on the test set. This is consistent with the recent work (Ilyas et al., 2019), which shows that training DNNs with incorrectly labeled data, i.e., the genuine content information is not utilized for training, yields good accuracy on the (natural) test set. However, suppose DNNs learn such spurious correlation. In that case, their performance will change with the conditional association between Y and S. Consequently, fit- ting such spurious correlation gives adversaries a chance to fool DNNs. Therefore, the conditional association between labels and style variables is a key to understand adversarial vulnerability.
To identify the origin of adversarial vulnerability from the spurious correlation perspective, we study the distinction between the adversarial distribution and the natural distribution. To look at what makes the adversarial distribution different from the natural distribution, we expand the natural PX) and the adversarial distribution Po
P(Y Σ P(s)X))(Y(Xxs)) Po(Y Σ Po(s)8)P((Y1Xx.)) SEB
(3)
EES
where we assume the set of valid styles S is discrete, and stands for certain style. We can see that the difference between P(Y and (x results from two terms, i.e., Po( and X s). (s() represents the change of style information, e.g., textures (Geirhos et al., 2018), transformations (Chen al., 2020; Mitrovic et al., 2020: He al., 2020), and domain shifts (Ganin et al., 2016). It is shown that changing image textures has a significant impact on predictions of DNNs (Geirhos et al., 2018), but such drastic style changes will hardly appear in the context of adversarial attacks as perturbations are required to be imperceptible Although modifying style variables S is not allowed, adversaries can exploit the conditional association between Y and S, i.e., PY X,x) s), via injecting a specifie perturbation to generate adversarial distributions. Specifically, under an appropriate soft intervention, i.e., Madn. the conditional distribution Po 8) can be drastically different from P(Y|X, 8). Namely, the property of adversarial distribution essentially results from the drastic difference in the statistical association between labels and style variables. Intuitively, if DNNs fit the conditional associations between Y and S, their performance will change
Here, use the underlined variable X represent that the variable X is given. In this work, we focus imperceptible adversarial examples, i.e., the widely studied fo-norm bounded adversarial examples, where drastic style changes hardly appear.
4

---

Published as a conference paper at ICLR 2022
with the spurious correlation. Consequently, drastic difference between the conditional association between Y and S will cause significant performance degradation of DNNs.
Hence, the origin of adversarial vulnerability is the excessive focus of DNNs spurious correlations between labels and style variables. This conclusion provides a causal perspective for the empirical observation, i.e. some features useful but not robust (Ilyas et al., 2019), so adversarial examples can be viewed as a model phenomenon rather than merely a human phenomenon.
3.2 THE ADVERSARIAL DISTRIBUTION ALIGNMENT METHOD
In light of the causal understanding of the adversarial vulnerability, improving adversarial robust- ness requires forcing DNNs fit the causal relations rather than merely the statistical associations. However, only the perceived data can be observed in practice, and the supervised information of content variables is usually unavailable. Therefore, approach that can avoid reliance on such supervised information is required.
To develop such an approach, we revisit the difference between the adversarial and natural distribu- tions. Intuitively, if the difference between the natural and the adversarial distribution is negligible, the adversarial vulnerability of DNNs can be mitigated, as DNNs perform well on the natural distri- bution (Krizhevsky et al., 2012; He et al., 2016; Zhang et al., 2021). Consequently, a straightforward solution for improving adversarial robustness is to align these two distributions. The aforementioned analysis shows that the property of adversarial distributions to fool DNNs comes from specific con- ditional associations between labels Y and style variables S, i.e., Po s) and P(Y)X, s). Inspired by the conclusion, we propose an adversarial distribution alignment method to eliminate the difference between the natural and adversarial distributions. Specifically, we regard the natural distribution P(YIX, s) as an anchor, then align the adversarial distribution P with the anchor such that the difference between these two distributions negligible. In addition, the rela- tionship between Y and X should also be the same both the adversarial and natural distributions. Concretely, we operationalize the intuition of the adversarial distribution alignment by:
min d (P(()))), Po (Y1 AE,d ( 0
(YIX,
(4)
Here d(-) is a metric reflecting the divergence between two distributions, and > 0 presents the weighting the misalignment penalty. In addition, we assume X and X have the same support set because adversarial perturbations are usually bounded. Solving the adversarial distribution align- ment objective is equivalent to search classifier h(X;0) 0) such that the adversarial distribution of the classifier is similar to the natural distribution. Benefiting from the consistency of these two distributions, classifier 1i( X; 0) can perform well on both the natural and adversarial distributions.
In practice, the adversarial distribution often cannot be obtained analytically, so relax the dis- tribution divergence in Eq. 4 to the sum of two divergences, see Appendix A for details. For the divergence between P(Y|X) and Po(Y| we have:
(L (Y1&) Qo (Y|&))
-E(x.Y)-PA(( (X:0) +) (L =B(x.Y)-PX.Y)CEE (I + Enavi 0), Y) + (CE(((
(5) where KL is the Seilbacck-eibbles divergence, CE is the cross-entropy loss, QY is the con- ditional distribution specified by the classifier h (X; 0), and 7 is tunable hyperparameter. Because adversarial examples are usually generated by adding perturbation to their corresponding natural samples rather than sampled from the adversarial distribution independently, approximate examples independently sampled from the adversarial distribution, where X is sampled from the natural distribution independently.
X Eado to
Similar to Eq. 5, the divergence between P(Y]X, and Po s) can be approximated by:
E Exx,y)-PXx,y) (g (X Endo): Wg) Y) 3 (g (x);
where (s (X): Wr) is a function used for modeling the statistically conditional association be- tween labels and style variables, (X) stands for the integrated representation of X and and B
5

---

Published as a conference paper at ICLR 2022
is tunable hyperparameter. Thus, the overall objective of the proposed adversarial distribution alignment method can be expressed as
min E CX..) + Endoi 0) (X; O,W,
+ + (E,CEE (x + Fudo): .,) Y) + SCF
To make sure that introducing g can benefit learning is necessary to design an approach con- nect model g and model h. In this paper, we connect 9 and h by representation sharing. Interestingly, according to Eq. 4 and Eq. 7, if we omit the spurious correlation between labels and style variables, i.e., À = O, and set et al., 2018). This suggests that the proposed adversarial distribution alignment method is consistent with the seminal variant Madry (Madry et al., 2018) of adversarial training.
0, Eq. 7 then becomes the objective function introduced by Madry (Madry
3.3 REALIZATION OF ADVERSARIAL DISTRIBUTION ALIGNMENT METHOD
According to Eq. 7, realizing the proposed adversarial distribution alignment method requires pre- dicting labels with all style variables, i.c., modeling the statistically conditional association between Y and S. However, there are two major obstacles preventing us from calculating the last term of Eq. 7. Specifically, a) the number of all possible styles is infinite, so the cost of calculating the expectation in Eq. 7 can grow to infinity; b) the representation of the integrated representation of X and s, i.e., (X), used for predicting labels unknown.
To calculate the expectation in Eq. 7, we have to make some assumptions to approximate the dis- tribution of the style variable, as the true distribution is unknown. Following previous work (Gal & Ghahramani, 2016; Kendall & Gal, 2017), we assume Gaussian distribution to approximate the unknown distribution. Specifically, the representation (X) is estimated by (XX sampled from a Gaussian distribution, i.e., & (X) .N (n (X), E), where (X) is employed to model the Gaus- sian distribution's s mean, and E is the covariance matrix. Because little prior knowledge about the covariance matrix is observed, we simply regard the covariance matrix Σ as identity matrix, i.e., o0 1). Then, the expectation can be approximated by & (X) - (n (X),
E,CE (g (s (x); Y) Thanks to the Gaussian distribution assumption, we can derive an upper bound of the expectation:
(8)
w,),,, s CE YY).Y),
(9)
where the probability of the th category of 7 (X); ; W,) is (see Appendix B for details)
WTsH(X)
P = (xx) Σ, e W. (T]sa(()) (W,,s w,,,) (o..-W.))'WW--M (W
(10)
Here, simply set g linear function, i.c., W, is linear mapping. Instead of caleulating all styles (X). the conclusion of Eq. 9 and Eq. 10 shows that only the mean and variance of (X) required to caleulate the expectation in Eq. 7.
In light of Eq. 9 and Eq. 10, the challenge of learning the representation of s (X) boils down to estimating the mean of & (X), i.e., no need to estimate every style representation explicitly. In addition, the variance can be treated as a hyperparameter. To estimate the mean, we draw inspi- ration from the proposed causal graph. According to the causal graph G. the content and style variables are statistically independent, i.e., C. 11 S. Thus, the estimated content è é(X) and style & (X) are desired be independent, i.c., è eXx I1 (X). The underlying intuition is that we aim to model the causal relation between the content variable and the style variable and omit the spurious correlation between ë o(X) and & (X), because the spurious correlation is not causal relation, although è (X) and 8 (X) are not statistically independent. Following previous work (Le- Cun et al., 1998; Bengio et al., 2013), we regard DNNs as a combination of representation learn- ing modules and linear classifier modules. Specifically, we apply linear function to the learned representation for approximating the content which is further used to predicting labels. Specifi- cally, have è (X) = è(r (X; W.): W.) Wer (X; W.). That is, W. are parameters used for predicting labels. According to the Gaussian distribution assumption, we can obtain the esti- mated style by the reparameterization trick, i.e., & (X) y (X; W.) + on, where W. presents

---

Published as a conference paper at ICLR 2022
parameters for modeling the mean, and is sampled from normal distribution. For simplic- ity, we assume that y (X; W.) an affine mapping applied to the learned representation 4, i.e., y (x; W.) (r (X; W.) = W,r (X; W,). Assume that r (X; W,) is a Gaussian distribu- tion with covariance matrix M. Then, the independence é (X) 11 $ (X) holds if we set W, as an instantiation of the orthogonal complement of We, i.e., ker (W.) LM ker (W,)* Here, we define (a, M (a, Mb), and the orthogonality of two subspaces is defined likewise. Therefore, we can simply employ the learned representation r (X; W and the parameters used for predicting labels, i.e., W., to estimate y (X), see Appendix C for details.
Combining Eq. 7 and Eq. 9, we derive realization of adversarial distribution alignment method:
min (x.) CE (N (X + Eadoi 0) + o,W,
(II)
+ (C (X + Endo): ; W₂) y) + SCE (T) Y)).
Given X. Eq. 11 encourages the statistically conditional association between labels and style vari- ables of the adversarial distribution to be close to that of the natural distribution. The explicit dis- tribution alignment can reduce the difference between the adversarial distribution and the natural distribution. If the conditional association of the adversarial distribution is similar to that of the nat- ural distribution, it should be hard for the adversary to find adversarial examples, which is consistent with recent work (Kilbertus et al., 2018; Schölkopf et al., 2021).
EXPERIMENT
4.1
SETUPS
Baseline methods. Our experiments designed to demonstrate the necessity of considering the spurious correlation between labels Y and style variables S when developing robust models. Eq. 7 shows that if we set the hyperparameter 7 S. the proposed method is equivalent to the adversarial training variant Madry (Madry et al., 2018). Thus, to demonstrate the necessity of considering the spurious correlation, we set y and X > in Eq. 7, named AdusalAdv-M, and compare the adversarial robustness of CausalAdv-M with that of Madry. In addition, the model capacity is often insufficient in adversarial training (Madry et al., 201 8), so replacing one-hot labels of the first term in Eq. 7 with soft targets, i.e., the model prediction h(X;)) 0), can relieve the problem of insufficient model capacity" 5 Considering the insufficient model capacity, we replace Y in the first term of Eq. with the model prediction, and the derived method called CausalAdv-T. We find that CausalAdv-T becomes the objective introduced in TRADES (Zhang et al., 2019) when we omit the spurious correlation, i.e., À = O, which shows that the proposed method also shares the same spirits to TRADES. Therefore, to demonstrate the importance of the spurious correlation between Y and S, we compare Adu- and Causal with Madry and TRADES, respectively.
and omit the spurious correlation between Y and
Evaluation metrics and training details. To evaluate the robustness for different methods, we compute the test accuracy on natural and adversarial examples with -nrm bounded perturbation generated by: FGSM (Goodfellow et al., 2015), PGD (Madry et al., 2018), and C&W (Carlini & Wagner, 2017) attacks. The robustness is evaluated on both the best checkpoint model suggested by (Rice et al., 2020) and the last checkpoint model used in (Madry al., 2018), respectively. For MNIST, we use the same CNN architecture as (Carlini & Wagner, 2017: Zhang et al., 2019). For CIFAR1O and CIFAR100, two architectures are employed: ResNet-18 (He et al., 2016) and WRN- 30-10 (Zagoruyko & Komodakis, 2016). The settings of attacks and hyprr-parameters for training are the same as previous works, more details can be found in Appendix D.
4.2 ROBUSTNESS EVALUATION
We evaluate the robustness of Madry, TRADES, and the proposed method on MNIST, CIFAR1O, and CIFAR100 against various attacks (Goodfellow et al., 2015; Madry et al., 2018; Carlini & Wagner, 2017), which are widely used in the literature. We report the classification accuracy on MNIST in
Stuudying non-linear functions is an interesting open question, and we leave it as future work. Knowledge distillation (Hinton al., 2015) shows that models with insufficient capacity prefer soft targets.
7

---

Published as a conference paper at ICLR 2022
Table 1: Classification accuracy (%) on MNIST under the white-box threat model with e 0.3. The best-performance model and the corresponding accuracy are highlighted.
Best checkpoint
Last checkpoint
Method
Natural
FGSM
PGD-40
CW-40
Natural
FGSM
PGD-40
CW-40
Madry
99.48
97.82
95.75
95.92
99.47
96.52
94.33
94.45
CausalAdv-M
99.53+004
98.02+007
96.37.012
96.47.u.17
99.49
96.83+0.1
94.67
94.84
TRADES
99.39
97.22
96.55
96.66
99.36
96.76
94,89
94.91
CausalAdv-T
99,492006
97.821007
96.7220.10
15
99.492004
97.3220.08
96.632013
96.6920.1
Table 2: Classification accuracy (%) of ResNet-18 on CIFAR-10 under the white-hox threat model
with 8/255. The hest-performance model and the corresponding accuracy are highlighted.
Best checkpoint
Last checkpoint
Method
Natural
FGSM
PGD-20
CW-20
Natural
FGSM
PGD-20
CW-20
Madry
83,56
56.69
51,92
51.00
84.65
54.37
46.38
46.73
CausalAdv-M
80,42.039
57.981021
54,44.0.8
52.51
83. 33.72.041
59.171024
51.82:0.9
50.9320.27
TRADES
81.39
57.25
53.64
51.39
82,91
57.95
52.80
51.27
CausalAdv-T
81.22x027
58.97.0.17
54.55
52.95:026
81.62:0.30
58.90.0.16
53.64:0.14
52.70
Table 1, where "Natural" denotes the accuracy on natural test images. We denote by PGD-40 the PGD attack with 40 iterations for generating adversarial examples, which also applies to the C&W attack. The results of ResNet- 18 on CIFAR 10 and CIFAR 100 are illustrated in Table 2 and Table 3, respectively. The results of WRN-34-10 are in Appendix E. We can see that the proposed method achieves the best robustness against all three types of attacks, demonstrating that taking into account the spurious correlation can significantly improve the adversarial robustness. To further understand the comparative effects of different terms of the proposed method, we reorganize the robust accuracy of the best checkpoint trained on CIFAR- 10 and CIFAR- 1100R-10011 in Appendix F.
4.3 DISCUSSION
Consideration of gradient obfuscation. Accord- ing to the criterion suggested by (Athalye et al., 2018), we exclude the potential effect of gradient ob- fuscation by showing the following phenomenons: a) the performance of our method on FSGM at-
70-
Accurazy (96)
30
tack (59.17%) is better than iterative attacks PGD- 20 (51.82%) and C&W-20 (50.93%); b) the per- formance of our method on black-box PGD-20 (83.65%) and C&W-20 (83.57%) attacks is better than that white-box attacks (51.82%); c) strong attacks cause lower accuracy than weak attacks, i.e., the accuracy PGD-20 and PGD-100 are 51.82% and 48.05%, respectively. In addition, no gradient shattering operator is used in our method. All these results are evaluated on the CIFARIO dataset using the last checkpoint of ResNet-11. Thus, according to the criterion suggested by (Athalye et al., 2018), the robustness improvement of the proposed method does not result from gradient obfuscation.
Kadry- Nat
Madry-Adv
Caudalldy--A--eet
CaudalAdy
Fpochs
Figure 2: Comparisons of Madry (dotted lines) and CausalAdv-M (solid lines) using ResNet-18 on the CIFAR-10 dataset under PGD-20 attack. Madry-Nat and Madry-Adv represent the accu- racy of Madry the natural and adversarial data, respectively, which also applies Adv-alAdy-M. To verify that CausalAdv-M effectively alleviates the robust overfitting rather than delaying the oc- currence of robust overfitting, we train these mod- els with 200 epochs which is larger than the basic setting.
Consideration of adaptive attack. According to the adaptive attack criterion (Tramer et al., 2020).
we augment the original objective function used in the PGD attack with the proposed adversarial distribution alignment loss implement adaptive attacks, i.c., Eq. 11. Under the adaptive attack, the accuracy is 51.68%, while under the original PGD-20 attack is 51.82%, demonstrating that the proposed method is genuinely robust.
Consideration of AutoAttack. Following previous work (Pang et al., 2020), we verify the effec- tiveness of the proposed method on AutoAttack (Croce & Hein, 2020). According to the commonly used setting, see (Pang et al., 2020), we report robust accuracy of WRN-34-11 trained with CIFARIO dataset on Auto-Attack, Madry: 49.58%, CausalAdy-M: 51.56%, TRADES: 52.46%, CausalAdy-
8

---

Published as a conference paper at ICLR 2022
Table Classification accuracy (%) of ResNet-18 on CIFAR-100 under the white-box threat model with = 8/255. The pest-performance model and the corresponding accuracy are highlighted.
Best checkpoint
Last checkpoint
Method
Natural
FGSM
PGD-20
CW-20
Natural
FGSM
PGD-20
CW-20
Madry
55,98
28.39
25.15
24.04
55,08
25.35
21.63
21.42
CausalAdv-M
04.07
29.76+016
27.62
25.444015
4428
16.83
23.34
22.93-0013
TRADES
53,85
29.04
27.91
24.09
53,54
29.29
26.80
23.79
CausalAdv-T
53.1720.99
30.6610.0 20
28.5720.18
25.74.0.18
54.792041
20.81
28.51
25.3220.27
T: 54.09%, and HE (Pang et al.. 2020): 53.74%. where HE is an adversarial variant achieving state-of-the-art performance. These results show that the proposed method can endow models with robustness comparable to the state-of-the-art performance.
Mitigating robust overfitting, The recent work (Rice et al., 2020) first studies the robust overfitting phenomenon. Robust overfitting means that further training will increase the robust training accu- racy and test accuracy on natural data after a certain training epoch, but the robust test accuracy will decrease. The robust overfitting phenomenon of Madry (Madry et al., 2018) is depicted in Fig. 2. can be seen that the robust test accuracy of Madry decreases to about 44%, while the best robust accuracy of Madry is 51.92%. In contrast, the proposed method drastically reduces the difference between the best robust accuracy 54.44% and the robust accuracy 50.93% of the last checkpoint.
5 RELATED WORK
Adversarial attack. Unlike the assumption employed in noisy labels (Han et al., 2020; Liu & Tao, 2015; Xia et al., 2020), adversarial attacks assume that the input determines noise. Since the realization of the adversarial example phenomenon (Biggio et al., 2013; Szegedy et al., 2014), tons of adversarial attacks have been proposed (Moosavi-Dezfooli et al., 2016; Goodfellow et al., 2015; Carlini & Wagner, 2017; Dong et al., 2018; Tu et al., 2019; Madry et al., 2018; Croce& & Hein, 2020). Among these attacks, FGSM Goodfellow et al. (2015), PGD attack (Madry al., 2018), C&W attack (Carlini & Wagner, 2017), and Auto-Attack (Croce & Hein, 2020) are the most commonly used attacks for evaluating robustness.
Adversarial defense. The development of adversarial attacks promotes the progress of adversarial defense and detection. Recent work on improving adversarial robustness mainly falls into two cat- egories: certified defense (Raghunathan et al., 2018; Wong & Kolter, 2018; Singla & Feizi, 2020) and empirical defense and detection with two-sample test (Najafi et al., 2019; Carmon et al., 2019; Shafahi et al., 2019; Wong et al., 2019; Pang et al., 2020; Rice et al., 2020; Ma et al., 2018; Gao et al., 2021). Detailed discussions of these exciting works can be found in Appendix G.
Causal reasoning. The field of graphical causality, like machine learning, has long history, see Pearl (2009); Schölkopf et al. (2021); Peters et al. (2017). One purpose of causal reasoning is to pursue the causal effect of interventions, contributing to achieving the desired objectives. Recent work shows the benefits of introducing causality into machine learning from various aspects (Zhang et al., 2020a; Mitrovic et al., 2020; Teshima et al., 2020; Tang al., 2020; Sauer & Geiger, 2020; Tang et al., 2021). More details about relevant works can be found in Appendix H.
6 CONCLUSION
In this paper, we provide a novel causality viewpoint for understanding and mitigating adversarial vulnerability. Through constructing the causal graph of the adversarial data generation process and formalizing the intuition of adversarial attacks, we show that the spurious correlation between labels and style variables is important for understanding and mitigating adversarial vulnerability. Inspired by the observation, we propose the adversarial distribution alignment method, which takes the spurious correlation into account for robustness improvement. In addition, we find that the proposed method shares the same spirits to existing adversarial training variants. In future work, we will develop more effective algorithms to leverage or eliminate the spurious correlation between labels and style variables to further improve adversarial robustness. In addition, will explore the uses of counterfactual statements to explain and mitigate the adversarial vulnerability. In sum, we make first step towards employing causality to contribute to adversarial learning.

---

Published as a conference paper at ICLR 2022
7 ACKNOWLEDGMENT
We thank the area chair and reviewers for their valuable comments. YGZ and BH were supported by the RGC ECS No. 22200720 and NSFC YSF No. 62006202. YGZ and XMT were supported by NSFC No. 61872329. MMG was supported by Australian Research Council Project DE2 DE210101624. TLL was supported by Australian Research Council Projects DE- 190101433 and DP- DP-220102121. KZ would like to acknowledge the support by the National Institutes of Health (NIH) under Contract R01HL159805, by the NSF- CSF--onvereeece Accelerator Track-D D award #2134901, and by the United States Air Force under Contract No. FA8650-17-C7715
8 ETHICS STATEMENT
This paper does not raise any ethics concerns. This study does not involve any human subjects, practices to data releases, potentially harmful insights, methodologies and applications, poten- tial conflicts of interest and sponsorship, diseriminatiion/ass/aaaesss concerns, privacy and security issues, legal compliance, and research integrity issues.
REPRODUCIBILITY STATEMENT
To ensure reproducibility of experimental results, we open source our code https:// writabb..c./oooggggngggggggrrrrs git.
10

---

Published as a conference paper at ICLR 2022
REFERENCES
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of se- curity: Circumventing defenses to adversarial examples. In International Conference on Machine Learning, pp. 274-283. PMLR, 2018
Yoshua Bengio, Aaron Courville, and Pascal Vincent. Representation learning: A review and new perspectives. IEEE Transactions on Pattern Analysis and Machine Intelligence, 35(8):1788 1828, 2013.
Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Smdić, Pavel Laskov, Gior- gio Giacinto, and Fabio Roli. Evasion attacks against machine learning test time. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases, pp. 387- 402. Springer, 2013.
Peter Bühlmann. Invariance, causality and robustness. Statistical Science, 35(3):404-426, 2020.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017
IEEE Symposium on Security and Privacy (SP). pp. 39-57. IEFE, 2017.
Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C Duchi, and Percy S Liang. Unlabeled data improves adversarial robustness. Advances in Neural Information Processing Systems, 32, 2019.
Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In International Conference Machine Learning, pp. 1597-1607. PMLR, 2020.
Juan Correa and Elias Bareinboim. A calculus for stochastic interventions: Causal effect identifica- tion and surrogate experiments. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pp. 10093-10100, 2020.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International Conference on Machine Learning, pp- 2206-
2216. PMLR, 2020.
Yinpeng Dong, Fangzhou Liao, Tianyu Pang. Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boost- ing adversarial attacks with momentum. In Proceedings of the IEEE conference on Computer Vision and Pattern Recognition, pp. 9185-9193, 2018.
Frederick Eberhardt and Richard Scheines. Interventions and causal inference. Philosophy of sci- ence, 74(5):981-99) 2007.
Samuel G Finlayson, John D Bowers, Joichi Ito, Jonathan L Zittrain, Andrew L Beam, and Isaac Kohane. Adversarial attacks on medical machine learning. Science, 363(3433)) 12876442) 2019. Yarin Gal and Zoubin Ghahramani. Dropout as bayesian approximation: Representing model uncertainty in deep learning. In International Conference on Machine Learning, pp. 1050-1059.
PMLR, 2016.
Yaroslav Ganin, Evgeniya Ustinova, Hana Ajakan, Pascal Germain, Hugo Larochelle, François Laviolette, Mario Marchand, and Victor Lempitsky. Domain-adversaria training of neural net- works. The Journal of Machine Learning Research, 17(1):20962200 2030, 2016.
Ruize Gao, Feng Liu, Jingfeng Zhang, Bo Han, Tongliang Liu, Gang Niu, and Masashi Sugiyama. Maximum mean discrepancy test is aware of adversarial attacks. International Conference on Machine Learning, pp. 3564-3575. PMLR, 2021.
Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A Wichmann, and Wieland Brendel. Imagenet-trained cnns are biased towards texture; increasing shape bias im- proves accuracy and robustness. In International Conference on Learning Reprexentations, 2018. lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations, 2015.
Alison Gopnik, Clark Glymour, David M Sobel, Laura E Schulz, Tamar Kushnir, and David Danks. A theory of causal learning in children: causal maps and bayes nets. Psychological review, 111
(1):3, 2004.
Bo Han, Gang Niu, Xingrui Yu, Quamming Yao, Miao Xu, Ivor Tsang, and Masashi Sugiyama. Sigua: Forgetting may make learning with noisy labels more robust. In International Conference on Machine Learning, pp. 4006-4016. PMLR, 2020.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp.
770-778, 2016.
11

---

Published as a conference paper at ICLR 2022
Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.
2020.
Christina Heinze- and Nicolai Meinshausen. Conditional variance penalties and domain shift robustness. Machine Learning, 11022):03--34, 2021.
Jan Hendrik Metzen, Mummadi Chaithanya Kumar, Thomas Brox, and Volker Fischer. Univer- sal adversarial perturbations against semantic image segmentation. In Proceedings of the IEEE International Conference on Computer Vision, pp. 2755-2764, 2017.
Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. Distilling the knowledge neural network. arXiv preprint orXiv:1503.02531 2015.
Andrew Ilyas, Shibani Santurkar, Logan Engstrom, Brandon Tran, and Aleksander Madry, Ad- versarial examples are not bugs, they are features. Advances in Neural Information Processing Systems, 32, 2019.
Alex Kendall and Yarin Gal. What uncertainties do we need in bayesian deep learning for computer vision? In Proceedings of the 31st International Conference on Neural Information Processing Systems, pp. 5580-5590, 2017. Niki Kilbertus, Giambattista Parascandolo, and Bernhard Schölkopf. Generalization in anti-causal learning. arXiv preprint arXiv: 000224, 2018.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convo- lutional neural networks. Advances in Neural Information Processing Systems, 15:1097-1105, 2012.
Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE,
1998.
Tongliang Liu and Dacheng Tao. Classification with noisy labels by importance reweighting. IEEE Transactions on Pattern Analysis and Machine Intelligence, 38(3)4447-411, 2015.
Xingjun Ma, Bo Li, Yisen Wang, Sarah M Erfani, Sudanthi Wijewickrema, Grant Schoenebeck, Dawn Song, Michael E. Houle, and James Bailey. Characterizing adversarial subspaces using local intrinsic dimensionality. In International Conference on Learning Representations, 2018. Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Reprexentations, 2018
Jovana Mitrovic, Brian McWilliams, Jacob C Walker, Lars Holger Buesing, and Charles Blundell. Representation learning via invariant causal mechanisms. In International Conference on Learn- ing Representations, 2020.
Seyed-Mohsen Noosavi-Dezfoolt: Alhussein Fawzi, and Pascal Frossard. Deepfool: simple and accurate method to fool deep neural networks. In Proceedings of the IEEE Conference on Com- puter Vision and Pattern Recognition, pp. 2574-2582, 2016.
Seyed-Mohsen Doosavi- Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 1765-1773, 2017.
Amir Najafi, Shin-ichi Maeda, Masanori Koyama, and Takeru Miyato. Robustness to adversar- ial perturbations in learning from incomplete data. Advances in Neural Information Processing Systems, 32, 2019.
Tianyu Pang, Xiao Yang, Yinpeng Dong, Kun Xu, Jun Zhu, and Hang Su. Boosting adversarial training with hypersphere embedding. Advances in Neural Information Processing Systems, 33: 7779-7792, 2020.
Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, pp. 506-519,2011
Judea Pearl. Causality. Cambridge university press, 2009.
Jonas Peters, Dominik Janzing, and Bernhard Schölkopf. Elements of causal inference: foundations and learning algorithms. The MIT Press, 2017.
Aditi Raghunathan, Jacob Steinhardt, and Percy Liang. Certified defenses against adversarial exam- ples. In International Conference on Learning Representations, 2018
12

---

Published as a conference paper at ICLR 2022
Nasim Rahaman, Aristide Baratin, Devansh Arpit, Felix Draxler, Min Lin, Fred Hamprecht, Yoshua Bengio, and Aaron Courville. On the spectral bias of neural networks. In International Confer- ence on Machine Learning, pp. 5301-5310. P0.3R...MRR. 2019.
Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in adversarially robust deep learning. In International Conference on Machine Learning, pp. 8093-8104. PMLR, 2020.
Shiori Sagawa, Pang Wei Koh, Tatsunori Hashimoto, and Percy Liang. Distributionally robust neural networks for group shifts: On the importance of regularization for worst-case generaliza- tion. In International Conference on Learning Representations, 2020.
Axel Sauer and Andreas Geiger. Counterfactual generative networks. In International Conference on Learning Representations, 2020.
Bernhard Schölkopf, Francesco Locatello, Stefan Bauer, Nan Rosemary Ke, Nal Kalchbrenner,
Anirudh Goyal, and Yoshua Bengio. Toward causal representation learning. Proceedings of the IEEE, 109(5):612-4)) 634, 2021.
Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis Gavin Taylor, and Tom Goldstein. Adversarial training for free! Ad- vances in Neural Information Processing Systems, 32, 2019.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. In International Conferencee on Learning Representations, 2015.
Sahil Singla and Soheil Feizi. Second-order provable defenses against adversarial attacks. In Inter- national Conference on Machine Learning, pp. 8981-8991. PMLR, 2020.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfel- low, and Rob Fergus. Intriguing properties of neural networks. In 2nd International Conference on Leurning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings, 2014.
Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Du- mitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 1-9, 2015. Kaihua Tang, Jiangiang Huang, and Hanwang Zhang. Long-tailed classification by keeping the good and removing the bad momentum causal effect. Advances in Neural Information Processing Systems, 33, 2020.
Kaihua Tang, Mingyuan Tao, and Hanwang Zhang. Adversarial visual robustness by causal inter- vention. arXiv preprint arXiv:2106 09534, 2021.
Takeshi Teshima, Issei Sato, and Masashi Sugiyama. Few-shot domain adaptation by causal mech- anism transfer. In International Conference on Machine Learning, pp. 9458-9469, PMLR, 2020.
Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. Advances in Neural Information Processing Systems, 33, 2020.
Chun-Chen Tu, Paishun Ting, Pin-Yu Chen, Sijia Liu, Huan Zhang, Jinfeng Yi, Cho-Jui Hsieh, and Shin-Ming Cheng. Autozoom: Autoencoder- based zeroth order optimization method for attack- ing black-box neural networks. In Proceedings of the AAAI Conference on Artificial Intelligence,
volume 33, pp. 742-749, 2019.
Cumhur Erkan Tuncali, Georgios Fainekos, Hisahiro Ito, and James Kapinski. Simulation- adversarial test generation for autonomous vehicles with machine learning components. In 2018 IEEE Intelligent Vehicles Symposium (/V). pp. 1555-1562. IEEE, 2018
Eric Wong and Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. In International Conference on Machine Learning, pp. 5286-5295. PMLR, 2018
Eric Wong, Leslie Rice, and Zico Kolter. Fast is better than free: Revisiting adversarial training. In International Conference on Learning Representations, 2019.
Xiaobo Xia, Tongliang Liu, Bo Han, Nannan Wang. Mingming Gong, Haifeng Liu, Gang Niu, Dacheng Tao, and Masashi Sugiyama. Part-dependent label noise: Towards instance-dependent label noise. Advances in Neural Information Processing Systems. 33:7597-7610, 2020.
Cihang Xie, Yuxin Wu, Laurens van der Maaten, Alan L Yuille, and Kaiming He. Feature denoising for improving adversarial robustness. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 501-509, 2019.
Yuzhe Yang, Guo Zhang, Dina Katabi, and Zhi Xu. Me-net: Towards effective adversarial robust- ness with matrix estimation. In International Conference on Machine Learning, pp. 7025-7034.
PMLR, 2019.
13

---

Published as a conference paper at ICLR 2022
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In British Machine Vision Conference 2016. British Machine Vision Association, 2016.
Cheng Zhang, Kun Zhang, and Yingzhen Li. causal view on robustness of neural networks. Advances in Neural Information Processing Systems, 33, 2020a.
Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals. Understanding deep learning (still) requires rethinking generalization. Communications of the ACM, 64(3):107-
115, 2021.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. International Conference on Machine Learning, pp. 7472-7482. PMLR, 2019.
Kun Zhang, Bernhard Schölkopf, Krikamol Muandet, and Zhikun Wang. Domain adaptation under target and conditional shift. In International Conference on Machine Learning, pp. 819-827.
PMLR. 2013.
Yonggang Zhang, Xinmei Tian, Ya Li, Xinchao Wang, and Dacheng Tao. Principal component adversarial example. IEEE Transactions on Image Processing, 29:4804-4815, 2020b.
14

---

Published as a conference paper at ICLR 2022
A DERIVATION OF DISTRIBUTION DIVERGENCE
Considering that the adversarial distribution often cannot be obtained analytically, we need to relax the distribution divergence in Eq. 4, i.e., dYP(Y)X) Po (YIX)). Without loss of generality, the metric in Eq. can be realized as total variation distance (TVD). Thus, according the definition of TVD, we have
d (P(YIX), (YIX)) s (PI())))) (YIX)) (((1))) ((P())X), Qo (YIX)),
(12)
where Qo is the conditional distribution specified by the classifier h (X; According to the Pinsker inequality, i.e., (P, s V (u(PlQ) where KL is the Kullback-Leible divergence, we have an upper bound of Eq.
s KL (Po (Y| 1100 (M|X)) (L I1Q (Y
2
2
(13)
Now, we can employ the upper bound Eq. 13 as surrogate loss. In practice, we can re-
place / [L(PPIQ) with (PIIQ). The intuition is that the difference between v KL(PIIQ) 2
and KL (PliQ) is relatively small when KL (PIIQ) is not extremely large, so the replacement will not introduce much difference. Thus, we derive Eq. 5: KL (Po (YIX) 11Q0 (YIX)) + ry (K 11Q (Y(X)), where 7 is a tunable hyperparameter.
Here, give intuitive explanation of why optimizing Eq. 5 can make the adversarial dis- tribution similar to the natural distribution. Considering that both the adversarial distribu- tion Pe (Y[X) and the anchor Qe (YI)) are parameterized by 0, so optimizing 0 to mini- mize (Pg (YIX) 11Qe (YIX)) can force the adversarial distribution be similar to the dis- tribution specified by the classifier h (X; i.c., Qo (Y That is, optimizing Qo (Y) will also change the adversarial distribution Po (YI In addition, minimizing the divergence KL (P (X| 11Q0 (Y] can endow the classifier with the ability to provide good prediction performance. Thus. minimizing KL (Po (Y 11Qo (Y(x)) will make the adversarial distribu- tion be similar with the natural distribution.
To verify the replacement will not introduce much difference, evaluate the robustness of CdusalAdy-M and CausalAdv-T T on the CIFAR-10 10 dataset with two losses, i.e., Eq. and Eq. 13. The results evaluated on best checkpoints are shown in Table 4.
Table 4: Classification accuracy (%) on CIFAR- under the white-box threat model with 8/255. Here, means that Eq. 13 is used for optimization.
Natural
FGSM
PGD20
CW20
Madry
83.56
56.69
51.92
51.00
CausalAdv-M
80.42
57.98
54.44
52.51
CausalAdv-M**
80.03
57.47
52.98
52.72
TRADES
81.39
57.25
53.64
51.39
Adv-al
81.22
58.97
54.55
52.95
CausalAdv-T*
79.94
58.46
54.12
52.28
B CALCULATION OF THE EXPECTATION ON THE STYLE INFORMATION
We provide details of calculating C ( Y). We assume normal
distribution for the styles, i.e., à (X) ~ N () o
rD). According to the definition of the cross-
entropy loss, for input pair (x., 3) we have:
15

---

Published as a conference paper at ICLR 2022
v)
= -B log
P(Y = ulg
slog Bu(a)-M((lo).011 P(Y (
=log
(((a)-N(((t) 1)
E 2an
EsggE ( Σ
- k(x)
log
(14)
log Σ (Wo.s W ) p(x)+ + y.s - w..?
I(W,, o W
Σ, Σ
s.s siss(())+
log
WT s.gf/ (x)
- log P((Y= (1) CF (F)
where the inequality follows from the Jensen's 's inequality: Blog(X) s log IX,, the expectation is calculated by leveraging the moment- soment-generating function:
Ee LX
fut X ((,
(15)
Note that, we define the function 7 (1 (x); Wg) for simplicity:
W 2 (x)
P((Y vl Σj= e
(16)
WT (au(()++ (Wo,s - Wo.u) " (W WW,,)
Besides seting y to linear model, non-linear models, e.g., neural networks, can also be employed in practice. To verify the influence introduced by selecting different instantiation of model y. we compare different realizations of mode g. i.c., linear mapping and non-linear neural networks. The following results suggest that method is relatively robust to the selection of model g. Note that, all these results are evaluated on the best checkpoint models trained on CIFAR-10 10 dataset.
Table 5: Classification accuracy (%) on CIFAR- 10 under the white-box threat model with e 8/255. Here, "+ Linear" means that model is instantiated with a linear mapping, and "+ Non-linear" means that model is instantiated with a neural network.
Natural
FGSM
PGD20
CW20
Madry Ady-a Linear
83.56
56.69
51.92
51.00
80.68
57.18
53.36
51.41
CausalAdv-M Non-linear
80.42
57.98
54.44
52.51
TRADES
81.39
57.25
53.64
51.39
Causal Linear
80.31
58.43
54.31
52.25
Causal Non-linear
81.22
58.97
54.55
52.95
C RELATIONSHIP BETWEEN ORTHOGONALITY AND STATISTICAL INDEPENDENCE
We give the proof for the following lemma in Sec. 3.3. Note that, we use to present the learned representation of X, and replace X with R for simplicity.
16

---

Published as a conference paper at ICLR 2022
Lemma 1. R E is the learned representation, where d is the number of dimension of R. Assume that R is a normal distribution with mean m and covariance matrix M. The content used for pre- dicting labels, i.e., logits, is obtained by applying linear functions R, i.e., e(R) W R, where We are parameters used for mapping R to logits. The style is modeled by a normal distribution, i.e & (R) (R.: W.) + (Y) 2 n, where W, presents parameters for modeling the mean of styles, and n. is sampled from standard normal distribution. Assume that p. (R; W, )) is a linear function, i.e. & (R) = R + Σ ( n. Then, setting Wa as an instantiate of the orthogonal complement S0, of We leads to statistical independence, Le., é (R) 11 & (R). Here, IL denotes the statistical inde- pendence, and we define (a, b) A = {a, Mb) for a given semi-defiitte matrix M. The orthogonality A M B of two subspaces and defined likewise.
Proof. Under the assumption in Lemma 1, setting W,, as an instantiate of the orthogonal comple- ment of We, we have:
ker( LM ker(W.)* = im( iM im( = (W." a, W: b) M = 0Va, b m) (R m) W:
(W.' a, MWw b) OVa, = W.MWW =0 =0=ErW (R
ER Ws (R+ Din m) (R m) W: =0 = Cov (R) ( (R)) = 0
(lI) 11 (R)
(17)
D MORE DETAILS ABOUT EVALUATION METRICS AND TRAINING DETAILS
Evaluation metrics. For MNIST dataset, we set the maximum perturbation bound = 0.3, pertur- bation step size 1) = 0.01, and the number of iterations K 40 for PGD and C&W attacks, which keeps the same (Zhang et al., 2019). Following (Rice et al., 2020), we set perturbation bound e = 8/255, perturbation step size 1 e/ /00 and the number of iterations K 20 for CIFAR-10 dataset.
Training details. For MNIST, we use the same CNN architecture as (Carlini & Wagner, 2017: Zhang et al., 2019). Following (Zhang al., 2019), the network is trained using SGD with 0.9 momentum for 50 epochs with an initial learning rate 0.01, and the batch size is set to 128. Hyper- parameters used craft adversarial examples for training are the same those used for evaluation. These two networks share the same hyper-parameters: we use SGD with 0.9 momentum, weight decay 2 x 10 batch size 128, and an initial learning rate of 0.1. The maximum epoch is 120, and the learning rate is divided by 10 at epoch 60 and 90, respectively. To generate adversarial examples 8/255, the perturbation step size 1 = 2/255, and
for training, we set the maximal perturbation the number of iterations K = 10, which is the same as (Rice et al., 2020). In all our experiments 3 is set to 1.0. For CausalAdv-M, À is set to 1.0 and 0.5 for CIFAR-10 10 and CIFAR-100 datasets, respectively. For CausalAdv-T, T, is set to 0.5 and 1.0 for CIFAR-10 10 and CIFAR-100 datasets, respectively.
E EXPERIMENTS OF WRN-34-10 ON CIFAR-
Table 6: Classification accuracy (%) of WRN-34-10 10 on CIFAR- 10 under the white-box threat model.
The best-performance model and the corresponding accuracy are highlighted.
Best checkpoint
Last checkpoint
Method
Natural
FGSM
PGD-20
CW-20
Natural
FGSM
PGD-20
CW-20
Madry
86.63
59.48
53.65
53.58
86,60
57.07
49.23
49,46
CausalAdv-M
85.24
61.22
55.17
55.68
85.61
60.08
51.76
52.59
TRADES
84.32
60.94
56.69
54.87
84.86
59.94
52.04
52.39
CausalAdv-T
84.19
61.62
$7.36
55.75
84.35
61.57
$5.15
55.23
In Table 6, we report the accuracy of WRN-34-10 (Zagoruyko & Komodakis, 2016) of Madry, TR TRADES, and the proposed method CIFAR-10 against various attacks, i.e., FGSM, PGD, and
17

---

Published as a conference paper at ICLR 2022
C&W attacks, which are widely used in the literature. Here, "Natural" denotes the accuracy of nat- ural test images. We denote by PGD-20 the PGD attack with 20 iterations for generating adversarial examples, which also applies to the C&W attack. We can that the proposed method achieves the best robustness against all three types of attacks, demonstrating that taking into account the spurious correlation significantly improve the adversarial robustness. Note that the standard deviations of 5 runs are omitted, because they hardly affect the results.
F ABLATION STUDY
Table 7: Robust accuracy (%) of ResNet-18 on CIFAR-10 and CIFAR-100 under the white-box threat model. For simplicity, we use t,, f22 and ty to represent the first, second, and third terms in Eq. 11, respectively. The best-performance model and the corresponding accuracy are highlighted.
CIFAR-I0
CIFAR-100
Method
4
l2
bs
FGSM
PGD-20
CW-20
FGSM
PGD-20
CW-20
Madry
56.69
51.92
51.00
56.69
51.92
51.00
-auMaLAdv-M
V
V
57.98
54.44
52.51
57.98
54.44
52.51
TRADES
57.25
53.64
51.39
57.25
53.64
51.39
CausalAdv-T
58.97
54.55
52.95
58.97
54.55
52.95
We implicitly conducted ablation studies when designing Table 1, Table 2, and Table 3. To further understand the comparative effects of different terms of the proposed method, reorganize the robust accuracy of the best checkpoint trained on CIFAR-10 and CIFAR- 100 in Table 7. Comparing Madry, TRADES, and CausalAdv-,, (13) can improve the robustness and that the effect of these two terms is close. Similarly, comparing TRADES and AdusalAdy-T, we that introducing the third term (lg) can further improve the robustness.
find that introducing the second (f2) and the third term
To further analyze the superiority of our method, we compare CauSalAdv-M with Madry explore which kind of adversarial examples that CausalAdv-M is more robust to. These analyses are based on the spurious perspective, as one main conclusion of our paper that the origin of adversarial vul- nerability is the excessive focus of DNNs on spurious correlations between labels and style variables. Specifically, we calculate the KI--divergence between K L (P (Y (x, s)) (Y (Fadus 8))) for each input and divide samples into several (10 in our experiment) bins according to the KI-- divergence. Then, we evaluate the robust accuracy of models trained with Causal Adv-M and Madry in each bin sample, and results are depicted in Fig. 3. We can that CdusalAdy- is more robust
Madry
70
CausalAdv-M
60
Accuracy (%)
30
20
10
1.7
Kl-divergence
Figure 3: Classification accuracy (%) CIFAR-10 under the PGD attack with with 8/255.
to samples leading to large KL-divergence than Madry. According to these empirical results, can conclude that the proposed method is more robust to samples causing a significant differenne between natural and adversarial distributions.
18

---

Published as a conference paper at ICLR 2022
To further verify that CausalAdv-T can outperform TRADES interms of both the natural and ad- versairal robustness, we compare the robust accuracy of CausalAdv-T with that of TRADES on CIFAR- 10 and CIFAR-100 100 dataset. The results evaluated on the best checkpoint models are shown in Table 8. We can see that CausalAdv-T can improve both the natural and the adversarial accuracy.
Table 8: Robust accuracy (%) of ResNet-18 on CIFAR-10 and CIFAR-100 under the white-box threat model.
CIFAR-10
CIFAR-100
Natural
FGSM
PGD20
CW20
Natural
FGSM
PGD20
CW20
TRADES
81.39
57.25
53.64
51.39
53.85
29.04
27.91
24.09
CausalAdy-T
81.72
58.26
54.06
51.90
53.91
30.19
28.11
24.90
To explore the sensitivity of our method on hyperparameterrs we evaluate our methods on CIFARIO and CIFARI00 datasets. The results are organized in Table 9, Results in Table 9 demonstrate that
Table 9: Robust accuracy (%) of ResNet-18 on CIFAR-10 and CIFAR-100 under the white-box threat model.
CIFARTO
CIFARTOO
Natural
FGSM
PGD20
CW20
Natural
FGSM
PGD20
CW20
Madry
83.56
56.69
51.92
51.00
55,98
28.39
25.15
24.04
CausalAdv-M X 0.2
82.17
57.13
53.28
51.80
54,68
29.85
27.32
25.88
CausalAdv-M 0.5
80.83
57.28
53.65
51.97
54.07
29.76
27.62
25.44
CausalAdv-M 1.0
80.42
57.98
54.44
52.51
52.69
29.77
27.80
26.04
CausalAdv-M À 1.5
80.17
57.53
53.24
51.40
52.37
30.74
28.49
26.71
CausalAdv-M À 2.0
80.35
58.29
53.16
52.71
48.40
30.07
28.52
25.97
TRADES CausalAdv-T 0.2
81.39
57.25
53.64
51.39
53.85
29.04
27.91
24.09
81.72
58.26
54.06
51.90
53.83
29.76
28.05
24.49
CausalAdy-T À 0.5
81.22
58.97
54.55
52.95
53.91
30.19
28.11
24.90
Ady-al X 1.0
79.65
58.48
54.45
52.89
53.17
30.66
28.57
25.74
CausalAdv- À 1.5
78,09
57.42
53.66
51.38
52.22
30.49
28.17
25.48
CausalAdv-T
74.42
$5.29
52.07
50.04
50.40
30.22
28.14
25.49
both CausalAdv-My and CausalAdv-T are relatively insensitive to the hyperparameters.
G MORE DETAILS ABOUT ADVERSARIAL LEARNING
Recent work on improving adversarial robustness mainly falls into two categories: certified defense and empirical methods.
Certified defense (Raghunathan et al., 2018; Wong & Kolter, 2018; Singla & Feizi, 2020) aims to endow the model with provably adversarial robustness against noundedudded perturbations. Al- though the certified defense strategy is promising, the empirical defense (Goodfellow et al., 2015; Madry al., 2018; Zhang et al., 2019; Pang et al., 2020: Wong Kolter, 2018: Xie et al., 2019; Yang et al., 2019), especially the adversarial training method (Goodfellow et al., 2015; Madry et al., 2018; Zhang al., 2019), is currently the most effective strategy. Empirical defense firstly generates adversarial examples using a certain adversarial attack, then incorporates the generated adversarial examples into the training process. Recently, an empirical detection strategy is utilize two- sample test to detect adversarial examples (Gao et al., 2021). In the following, we mainly discuss defense strategies, as the detection approach not the main focus of this paper.
Recently, various efforts (Najafi et al., 2019; Carmon et al., 2019; Shafahi et al., 2019; Wong et al., 2019; Pang et al., 2020; Rice et al., 2020) have been devoted to improving adversarial training. One line of work focuses accelerating the training procedure (Shafahi et al., 2019; Wong al., 2019). Another line of research (Najafi et al., 2019; Carmon et al., 2019) shows a promising direction that unlabeled training data significantly mitigate the adversarial vulnerability. Lastly, recent work (Pang et al., 2020; Rice et al., 2020) provides an interesting direction where these methods rethink the adversarial training from exciting aspect, i.e,, rethinking the role of normalization (Pang al.,
19

---

Published as a conference paper at ICLR 2022
2020) and basic training strategies (Rice al., 2020). However, all these methods overlook the spurious correlation between labels and the style information.
Another related work is (Ilyas al., 2019), which provides an interesting viewpoint, i..., adversarial examples can be viewed as a human phenomenon because the model's reliance on useful but not robust features leads adversarial vulnerabilityy. Our work gives new causal perspective of ad- versarial vulnerability. Specifically, a) (Ilyas et al., 2019) found some features were useful but not robust, while our work explores the phenomenon's 'ss fundamental cause and provides a clear explana- tion of why some features are useful but not robust: Given X, labels Y are spuriously correlated with the style variables, so fitting the spurious correlation can predict labels. Thus, the style variables can be viewed as 'eeatrres; ; b) (Ilyas et al., 2019) claimed that adversarial examples could be viewed as a human phenomenon, while our work shows that adversarial examples can be viewed as model phenomenon rather than merely a human phenomenon. Specifically, the adversarial vulnerability results from fitting the correlation between labels and style variables and failing to fit the causal relations, i.e., DNNs fail to extract content variables.
H MORE DETAILS ABOUT CAUSAL REASONING
The most relevant work is CAMA (Zhang et al., 2020a) that aims improve the robustness of DNNs on unseen perturbation via explicitly modeling the perturbation from a causal view. The main difference between our method and CAMA is that focus the adversarial vulnerabilityy while CAMA aims to improve the robustness of unseen perturbations. In addition, CAMA assumes hard intervention latent space. In this paper, we employ a soft intervention and propose to penalize DNNs when the adversarial distribution is different from the natural distribution. A recent work (Bühlmann, 2020) also aims to connect robust learning and causality, but the main focus of (Bühlmann, 2020) is on cut-of-distribution generalization, which different from adversarial learning.
latent variable. It promotes robustness via modeling the perturbation in the
Another related work is RELIC (Mitrovic et al., 2020), a regularizer used in self-supervised learning that uses the independence of mechanisms (Peters al., 2017) and encourages DNNs to be invari- ant to different augmentations of the same instance. The self-supervised learning method (Mitrovic al., 2020) also constructs causal graph to model the data generation process, but the focus of RELIC is the content invariant property, overlooking the importance of style information. One concurrent work (Tang et al., 2021) propose using the instrumental variable to perform causal inter- vention, based on a strong assumption that the adversarial vulnerability results from the confounding effect. In contrast, merely some general assumptions are required in this paper, e.g., causal model assumption. Although (Sagawa et al., 2020) takes spurious correlations into account, (Sagawa al., 2020) proposes using prior knowledge to group the training data to avoid the reliance on spurious correlations. Difference from (Sagawa al., 2020), our method does rely on prior knowledge. Another related work is CORE (Heinze- Deml & Meinshausen, 2021), a regularizer inspired by a causal graph is proposed to minimizing the variance of prediction and loss condition on label and ID information to mitigate the influence of domain shift. Different from (Heinze-Deml & Meinshausen, 2021), 1), our method is designed eliminate the difference between the natural and adversarial distri- butions.
20


Reviews:
[{"review_id": "eUycyggQ1YO", "reviewer": "Reviewer_aWQa", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The work provides a plausible causal representation of the adversarial attack process and derives a useful explanation for vulnerability. The robust approach derived from their explanation is quite reasonable and is novel to my knowledge. It shows improvement on MNIST, CIFAR-10, and CIFAR-100 datasets. However, the confidence intervals are omitted which makes the results less convincing. \nThe choice of comparing against only two baselines, Madry and TRADES, can be better motivated, especially since many alternative methods exists. Consider comparing against the top performing method from RobustBench (https://robustbench.github.io/).\nScope of the analysis is not well defined. The types of adversarial attacks, types of classifiers, and types of data are not specified, and implicitly assumed to be image-based neural networks. \nThe description of the causal graph makes it hard to understand that two processes are being represented - the natural data distribution and its relation to the distribution of images constructed from adversarial attack for a given classifier(s). The robust learning method based on adversarial alignment is not explained well and involves choices that are unjustified. Statements on relationship of the proposed method to Madry et al. 2017 and Zhang et al. 2019 are imprecise.\n \n \n# Related work\n\nAdmittedly the literature on this problem area is vast, however, the following two related works will be important to discuss.\nA causal graph motivated adversarial learning approach is proposed in Heinze-Deml and Meinshausen 2021 (Conditional variance penalties and domain shift robustness. Machine Learning https://link.springer.com/article/10.1007/s10994-020-05924-1). The graph has core (content) and style nodes although it is different from the one proposed in this work.\nThe relationship between causal and adversarial approaches to robust learning was discussed in Bühlmann 2020 (Invariance, Causality and Robustness. Statistical Science https://arxiv.org/abs/1812.08233). The discussion is for a different causal graph where X causes Y and different type of adversarial perturbations that are unbounded, however, the work is related as it also gives a causal interpretation to robust learning.\nAlthough non-causal in motivation, other robust learning work has also identified spurious correlation between labels and style features as reason for lack of generalizability. For example, see Sagawa et al. 2020 (Distributionally Robust Neural Networks for Group Shifts. ICLR https://arxiv.org/abs/1911.08731). Consider discussing this line of work into out-of-distribution generalization.\n \n \n# Questions that I would like the authors to respond to:\n \nWhat is the scope of domains for the proposed causal graph in Figure 1? Is it applicable to image or any high-dimensional data problems? Please specify the problems for which this causal graph is suitable. The graph makes unstated assumptions like Y is an effect not a cause of C (i.e. anti-causal learning) which should be motivated in context of some problem domains.\n\nWhy should the adversarial distribution be a result of an intervention on some causal graph, where the graph is shared with the one generating the natural distribution? This assumption does not seem necessary as the defintion of adversarial perturbation E_adv in Eq (2) does not rely on the causal graph. Please clarify if this is not a limiting assumption.\n\nWhat are type of adversarial attacks are in scope? This should be specified beforehand. The argument about origin of adversarial vulnerability relies on the assumption that conditional distribution of style P(s | X) does not vary much with adversarial attacks. However, some attacks change the image drastically such as ones that add image patches. \n \n \n# Questions below are minor and do not seriously affect my review:\n\nCan you test your hypothesis that spurious correlation between labels and style features is the reason for adversarial vulnesrabitliy such as by studying known attacks? This will provide more evidence to the analysis of the assumed causal graph.\n\nThe relation between the two causal models \\mathcal{M} and \\mathcal{M}_adv is not clear. Mention the specific hard or soft intervention that results in the latter one like do(E\\sim E_adv).\n\nOn the specific way of constructing adversarial distribution in Eq (2), the X and E are added instead of any other general function. Please state if this is a necessary assumption.\n\nCan you comment on the order of the standard deviations for numbers in Table 1, 2, 3? Ideally, these should be included in Appendix even if small.\n \n \n# Suggestions for improving the writing:\n\nThe statement claiming that objective in Eq. (7) is same as in Madry et al. 2017 for \\lambda and \\gamma equal to 0 is incorrect. The objective in Madry et al. solves a min-max problem maximising loss over perturbations of natural data points. Similarly, TRADES Zhang et al. 2019 also has a term containing maximum loss over perturbations.\n\nThe term nuisance factors is used in Sections 1,2 without defining it until later using the style features. Consider briefly mentioning an example of nuisance factors early on.\n\nThe term integrated representation s(X) in Eq (6) is not clear. Please give an example of such a function.\n\nI did not understand how Footnote 3 is an explanation for ignoring dependence between C and S. Even if the relation is not causal, it can be modelled as correlation exists based on the causal graph.\n \nRelationship with the work of Ilyas et al. 2019 on the origin of adversarial vulnerability can be moved to the main text from Appendix F as it is important to highlight what additional insights does a causal perspective provides. \n\nConsider mentioning the omitted explanation for change in P(Y | \\tilde{X}, s) since the path from S to Y given \\tilde{X} is open due to conditioning on a child of the collider X.\n\nSum notation in Eq (3) should clarify that \\mathbb{S} is discrete.\n \nThe remark from Gopnik et al. 2004 in the Introduction can be made more precise to the specific experimental conditions of that work instead of a claim for all of human cognition.", "summary_of_the_paper": "The work presents a causal perspective of adversarial attacks on image-based machine learning models by studying a causal graph of the adversarial data creation process and highlighting how such a process makes the learned models vulnerable. It argues that the main reason for adversarial vulnerability is the reliance of models on spurious correlations between labels and style. Accordingly, it proposes a method to learn models for which the conditional distribution of label given style and image does not vary much when attacked. Empirically, the method is shown to be more robust than two baselines on three datasets.", "summary_of_the_review": "The paper undertakes an original approach to studying the important problem of adversarial vulnerability. However, the description of the method, its design choices, and evaluation requires improvement. That said, the results are quite encouraging and authors should provide more evidence for their hypothesis on reasons for adversarial vulnerability and test their method against stronger baselines.\n\n---\nAfter the response\n\nMost of my concerns have been adequately addressed. The description of the method needs further clarification. I would encourage authors to clarify the choices made in Appendix A. Given that the approach to adversarial robustness is novel, empirically useful, and potentially will inspire further work, I have substantially improved the score and leaning towards a recommendation to Accept.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "e6LxAjFM69r", "reviewer": "Reviewer_Jqu4", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths\n1.\tOverall the paper is well written and easy to follow.\n2.\tThe proposed causal graph well models the generation process of adversarial attacks and sheds new light on how to understand and defend against attacks from a causal perspective.\n3.\tThe proposed approach is novel and well-motivated. \n4. The authors empirically validate the proposed method using several attacks on prevailing datasets.\n\nWeaknesses\n1.\tIn experiments, the current version only compares with SOTAs using attacks with 20 iterations. It would be helpful if attacks with more iterations are employed as the performance of some defense techniques is shown to drop significantly when the number of attack iterations increases.\n2.\tSome technical details may need to be clarified. See my questions below.\n\nQuestions\n 1. In the first term of Eq 4, the authors aim to minimize the divergence between $P(Y|X)$ and $P_{\\theta}(Y|\\widetilde{X})$. As  $P_{\\theta}(Y|\\widetilde{X})$ cannot be formulated analytically, the authors introduce $Q_{\\theta}$ as an anchor and minimize $KL(P_{\\theta}(Y|\\widetilde{X})||Q_{\\theta}(Y|\\widetilde{X}))$ and $KL(P(Y|X)||Q_{\\theta}(Y|X))$ instead. However, from my perspective this objective only optimize the anchor instead of pushing $P_{\\theta}(Y|\\widetilde{X})$ towards $P(Y|X)$, if I am not mistaken.\n\n2. How to connect $g$ and $h$ by sharing the same representation?  It seems that $g$ is a linear function while $h$ is supposed to be parameterized by a neural network.\n\n3. In Eq 8, why $\\hat{s}(X)$ can approximate $s(X)$? It seems that there is no supervision signal to ensure this point.\n\n4. If $\\hat{s}(X)$ is the integrated representation of both $s$ and $x$, as mentioned in the paper, are $\\hat{c}(X)$ and $\\hat{s}(X)$ supposed to be independent when $x$ is given?\n\nIt would be helpful if these questions can be addressed.\n", "summary_of_the_paper": "This paper proposes a causal graph to model the generation process of adversarial attacks. Based on the proposed causal graph, the authors identify the origin of adversarial vulnerability as the spurious correlation between style variable and class label. Under the adversarial distribution, such spurious correlation can be maliciously used to mislead a victim model. In this light, the authors propose a method to align the adversarial distribution and the natural distribution to prevent a model from learning spurious correlation. The proposed method is empirically validated on prevailing datasets under several attacks.", "summary_of_the_review": "Given the strengths listed, I tend to accept this paper. I suggest the authors concern the questions listed to be addressed.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "Y9rIuJ35pke", "reviewer": "Reviewer_65Tx", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The paper has a lot of strengths:\n* While the relationship between causality and adversarial robustness is often stated, this is the first paper I've seen that formally characterizes it. I like the simple separation of content and style variables that allows this characterization. \n* The paper derives a method based on the graph criterion. I am not sure about all the assumptions used here (e.g., independent gaussians), but at least on the benchmarks reported, the method performs well.\n* The authors provide an interpretation of past methods within their framework, which I thought was a nice unifying insight. \n\nOverall, the strength of this paper is in the formulation of adversarial examples as a causal problem. This provides a different view and motivates better methods for modeling the style-based spurious correlations. My feedback for the authors is:\n* Section 3.1: While the theoretical justification makes sense, can you provide a (toy) empirical example to show how the learnt spurious correlation leads to adversarial examples, and not P(x|s)? I get the intuition, but the claim is vague. If you can provide one toy example supporting the claim, it will be stronger.\n* Section 3.2: \n --I do not see how Eqn 5 is derived. Are you using something similar to the triangle inequality for the divergences? In that case, will it be an upper bound. Also I do not think KL divergence supports triangle inequality. So this approximation step seems arbitrary--can you justify it?\n --Does it mean that g and h are the same models? Is there any justification for this choice, besides convenience?\n* Section 4.2: Can you provide examples of the kind of adversarial examples that ADA method is robust to, which prior work is not? That will be provide more intuition on what exactly is ADA method capturing. Right now, we see that the accuracy increases but not sure why.\n\n", "summary_of_the_paper": "The paper shows a causal perspective to the adversarial robustness problem. It creates a graph over content and style variable sets. It identifies the spurious correlation between style and label as the main reason for adversarial examples, and then proposes a method to remove it from the trained model. Experiments on three datasets show that the proposed method is better than two baselines. ", "summary_of_the_review": "Great paper connecting causality and adversarial robustness", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "2Vj8Ze_iit", "reviewer": "Reviewer_iRoe", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n* This paper provides a new perspective on analyzing adversarial robustness and it is novel for me.\n* This paper is well organized and easy to follow.\n* The distribution alignment method inspired by theory shows good robustness\n\nWeakness:\n* I noticed the Natural accuracy on CIFAR-10 and CIFAR-100 can sometimes be worse than TRADES and Madry. Given the trade-off between natural and adversarial accuracy is adjustable, it would be good to adjust the trade-off to see if the proposed method can simultaneously surpass TRADES in terms of both natural accuracy and robustness.\n* How to select the hyper-parameters $\\lambda$, $\\beta$ and $\\gamma$. Are they sensitive? Are they consistent among different datasets?\n\nDetail comments:\n* First paragraph of Page 9, \"we report robust accuracy of WRN-34-10 trained with CIFAR10 dataset on Auto-Attack, Madry: 49.58%, ADA-M: 51.56%, TRATDES: 52.46%\" TRATDES --> TRADES\n* Some \"Mardry\" should be \"Madry\"", "summary_of_the_paper": "This paper presents a causal perspective on addressing adversarially vulnerability. It first constructs a causal graph, which then inspires the design of the distribution alignment method for reducing the gap between adversarial and natural data. Extensive experiments on CIFAR10, CIFAR100, and MNIST demonstrate the robustness of the proposed method against various attack methods.", "summary_of_the_review": "I enjoy reading the analysis of the paper. This new perspective is novel to me and I would tend to accept this paper. If the author can address my concerns on the experiments. I would be more convinced.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper shows a causal perspective to the adversarial robustness problem. Based on a causal graph of the adversarial data creation process, which describes the perceived data as a function of content and style variables, the authors identified that the spurious correlation between style and label is the main reason for adversarial examples. Based on this observation, they propose a method to learn models for which the conditional distribution of label given style and image does not vary much when attacked. Experiments on MNIST, CIFAR-10, and CIFAR-100 datasets show that the proposed method is better than two baselines, Madry and TRADES.

Overall, the paper contains interesting ideas and tackles an important problem. Due to some concerns regarding the clarity and motivation of the paper, we strongly recommend the authors take the reviewers' comments to heart and incorporate their thoughts in preparing the camera-ready version of their manuscript.
Decision: Accept (Poster)