Domain Invariant Adversarial Learning
Authors: Matan Levi
Idan Attias
Aryeh Kontorovich
Venue: ICLR 2022 Submitted (2022)
Keywords: adversarial Training
Robustness
Domain-invariant representation
domain adaptation

Abstract: The phenomenon of adversarial examples illustrates one of the most basic vulnerabilities of deep neural networks. Among the variety of techniques introduced to surmount this inherent weakness, adversarial training has emerged as the most effective strategy to achieve robustness. Typically, this is achieved by balancing robust and natural objectives. In this work, we aim to further reduce the trade-off between robust and standard accuracy by enforcing a domain-invariant feature representation. We present a new adversarial training method, Domain Invariant Adversarial Learning (DIAL), which learns a feature representation which is both robust and domain invariant. DIAL uses a variant of Domain Adversarial Neural Network (DANN) on the natural domain and its corresponding adversarial domain. In a case where the source domain consists of natural examples and the target domain is the adversarially perturbed examples, our method learns a feature representation constrained not to discriminate between the natural and adversarial examples, and can therefore achieve a more robust representation. Our experiments indicate that our method improves both robustness and standard accuracy, when compared to other state-of-the-art adversarial training methods.

Under review as a conference paper at ICLR 2022
DOMAIN INVARIANT ADVERSARIAL LEARNING
Anonymous authors
Paper under double-blind review
ABSTRACT
The phenomenon of adversarial examples illustrates one of the most basic vul- nerabilities of deep neural networks. Among the variety of techniques introduced surmount this inherent weakness, adversarial training has emerged the most effective strategy to achieve robustness. Typically, this is achieved by balancing robust and natural objectives. In this work, we aim further optimize the trade- off between robust and standard accuracy by enforcing domain-invarian feature representation. We present new adversarial training method, Domain Invariant Adversarial Learning (DIAL), which learns a feature representation that is both robust and domain invariant. DIAL uses a variant of Domain Adversarial Neural Network (DANN) main. In the case where the source domain consists of natural examples and the target domain the adversarially perturhed examples, our method learns feature representation constrained not to discriminate hetween the natural and adversarial examples, and can therefore achieve a more robust representation. Our experi- ments indicate that our method improves both robustness and standard accuracy, when compared other tatte-of-the-aee adversarial training methods.
the natural domain and its corresponding adversarial do-
INTRODUCTION
Deep learning models have achieved impressive success on wide range of challenging tasks. How-
ever, their performance was shown to be brittle to adversarial examplex: small, imperceptible pertur- bations in the input that drastically alter the classification (Carlini & Wagner] 2017a Goodfellow
al.
2014 Kurakin et al., 201 | Moosavo--ezioooe et al.) 2016] et al. [013]] Tramer et al,
2017 Dong et al. 2018 Tabacof & Valle| 2016 Xie et al.) 2019b; Rony et al. 2019)). Designing
rehable robust models has gained sigmificant attention in the arms race against adversarial examples.
Adversarial training (Szegedy et al., 22033] Goodfellow al. 2014 Madry et al. [017 Zhang al.)
2019b) has been suggested as one of the most effective approaches to defend against such examples,
and can be described solving the following min-max optimization problem:
min LE (r.y)>D
max =':laa'=ille
é (x', y: v:
where x/ is the e-bounded perturbation in the fp norm and E is the loss function. Different unre- stricted attacks methods were also suggested, such as adversarial deformation, rotations, translation
and more (Brown et al. 2018 Engstrom al. 2018 Xiao al. 2018 Alaifari al. 2018 Gilmer et al. 2018).
The resulting min-max optimization problem can be hard solve in general. Nevertheless, in the context of e-bounded perturbations, the problem is often tractable in practice. The inner maximiza- tion usually approximated by generating adversarial examples using projected gradient descent (PGD) (Kurakin et al. (2066a; Madry et al., 2017). A PGD) adversary starts with randomly initial- ized perturbation and iteratively adjust the perturbation while projecting it back into the e-ball:
E++1 = (x,) (x+ + a sign( ( ((G((t)))))
where xo is the natural example (with or without random noise), and II, (a) is the projection operator onto the e-ball, G is the network, and is the perturbation step size. As was shown by Athalye et al. (0018), PGD-based adversarial training was one of the few defenses that were not broken under strong attacks.

---

Under review as a conference paper at ICLR 2022
That said, the gap between robust and natural accuracy remains large for many tasks such as CIFAR- 10 (Krizhevsky et al. 2009) and ImageNet (Deng et al. (209).. Generally speaking, [Tsppaa et al. (2018) suggested that robustness may be odds with natural accuracy. and usually the trade-off is inherent. Nevertheless, growing body of work aimed to improve the standard PGDD-ased ad- versarial training introduced by Madry al. (2017) in various ways such improved adversarial
loss functions and regularization techniques (Kannan et al. 2018 Waang et al. 2019b] Zhang et al.
2019b), semi-supervised approaches(Carmor et al. 2019; Uesato et al. 2019) Zhai al. 2019)
adversarial perturbations on model weights (Wu et al. 20220) utilizing out of distribttion data (Lee
al. 2021 and many others. See related work for more details.
Our contribution. In this work, we propose novel approach to regulating the tradeoff between robustness and natural accuracy. In contrast to the aforementioned works, our method enhances ad- versarial training by enforcing a feature representation that is invariant actoss the natural and adver- sarial domains. We incorporate the idea Domain-Adversarie Neural Networks (DANN) Ganin & Lempitsky] 2015] Ganin al. 2016 directly into the adversarial training process. DANN is a representation learning approach for domain adaptation, designed to ensure that predictions are made based invariant feature representation that cannot discriminate between source and target domains. Intuitively, the tasks of adversarial training and of domain-invariant representation have a similar goal: given source (natural) domain X and a the target (adversarial) domain X', hope to achieve g(X) x g where a feature representation function (i.e., neural network). Achieving such a dual representation intuitively yields a more general feature representation.
In a comprehensive battery of experiments on MNIST (eeCun et al. 1998), SVHN (Neterr et al., 2011]. CIFAR-10 10 (Krizhevsky et al. 2009) and CIFAR- (Krizhevsky et al. 2009) datasets, we demonstrate that by enforcing domain-invarian representation learning using DANN simultane- ously with adversarial training, we gain significant and consistent improvement both robustness and natural accuracy compared to other state-of-the-art adversarial training methods, under Auto- Attack (Croce Hein, 2020) and various strong PGD (Madry et al. 2017), CW (Carlini & Wagner, 2017b) adversaries in white-box and black-box settings. Additionally, ing unforeseen "natural" corruptions (Hendrycks & Dietterich, 2018). unforeseen adversaries (e.g., f1, f2),, transfer learning, and perform ablation studies. Finally, we offer novel score function for quantifying the robust-natural accuracy tradeoff.
evaluate our method us-
Nacra Exput
Festure Extractoe
Labal Cansifar
Advamarial Essampees Gesecttion Process
Advvanarially Iestrdbed lzget
Gradien
Dusain
Btewecool Layer
Classtferr
Figure 1: Illustration of the proposed architecture to enforce domain invariant representation. The feature extractor and label classifier form the regular DNN architecture that can be used for the main natural task. The domain classifier is incorporated alongside the label classifier. The reversal gradient layer multiplies the gradient by negative number during the back-propagation.
2
RELATED WORK
2.1
DEFENSE METHODS
A variety of theoretically principled (Cohen et al. 2019:
Raghunathan et al.
2018a Sinha et al. Gowal al. 2018
2017
Raghunathan al. 2018b Wong al. 2018 Wong & Kolter 2018
2

---

Under review as a conference paper at ICLR 2022
and empirical defense approaches (Bai et al. 2021 were proposed to enhance robustness since the discovery of adversarial examples. Among the empirical defence techniques we can find adversarial
regularization (Kurakin et al., 2016a; Madry et al.,
2017: Zhang et al. 2019b;
Wang al.
2019b
Kannan et al. 2018), curriculum-based adversarial training (Cai et al.
2018
Zhang et al.
2020
Wang et al.] 2019a), ensemble adversarial training (Trammr et al.] 2017; Pang et al. 2019
Yang
ct al. 2020). ad adversarial training with adaptive attack budget (Ding et al.
[0118]
Cheng et al. 2020
semi-supervised and unsupervised adversarial training (Carmon al..
2019;
Uesato et al.)
2019
Zhai et al., 2019), robust self/pre- self/pre-trainingg training (Jiang et al. 2020; Chen et al.
2020 efficient adversarial
| 2019a), and many other techniques (Zhang & Wang Goldblum et al. [020 Pang et 20220b
training (Shafahi et al., [019] Wong et al. [2200] Andriushchenko Flammarion
2020 Zhang et al.,
Lee et al.] 2020). In an additional research direction, researchers suggested to add new dedicated
building blocks to the network architecture for improved robustness (Xie & Yuille, 2019 Xie et al.)
2019a Liu et al. 2020). Liu et al. (2020) hypothesised that different adversaries belong to different domains, and suggested gated batch normalization which is trained with multiple perturbation types.
Others focused on searching robust architectures against adversarial examples (Guo et al. 2020).
Our work belongs to the the family of adversarial regularization techniques, for which we elaborate on common and best performing methods, and highlight the differences compared to our method.
Madry et al. (017)) proposed technique, commonly referred to Adversarial Training (AT), to minimize the cross entropy loss on adversarial examples generated by PGD. Zhang et al. (2019b) suggested to decompose the prediction error for adversarial examples the sum of the natural error and boundary error, and provided a differentiable upper bounds on both terms. Motivated by this decomposition, they suggested a technique called TRADES that uses the Kullback-Lebbler (KL) divergence as regularization term that will push the decision boundary away from the data. Waang jet al.] (2019b) suggested that misclassifid examples have a significant impact on final robustness, and proposed a technique called MART that differentiate between correctly classified and miss- classified examples during training.
Another area of research aims at revealing the connection between the loss weight landscape and ad- versarial training (Prabhu et al., 2219: et 2018) Wu et al.) 2020). Specifically, /Wu al. (2020) (2.00)) identified a correlation between the flatness of weight loss landscape and robust generalization gap. They proposed the Adversarial Weight Perturbation (AWP) mechanism that is integrated into exist- formalized from a theoretical
ing adversarial training methods. More recently, this approach double-pertuuraation perturbation mechanism that standpoint by Tsai et al.) (202I). However, this method forms a double-perne perturbs both inputs and weights, which may incur significant increase in calculation overhead. Nevertheless, we show that DIAL still improves state-of-the-art results when combined with AWP.
A related approach to ours, called ATDA, was presented by [Song al. (2018). They proposed to add several constrains to the loss function in order to enforce domain adaptation: correlation alignment and maximum mean discrepancy (Borgwardt et al., 2006 Sun & Saenko 2016). While the objective is similar, using ideas from domain adaptation for learning better representation, we address it two different ways. Our method fundamentally differs from (oon et al. (2018) since we do not enforce domain adaptation by adding specific constrains to the loss function. Instead, we let the network learn the domain invariant representation directly during the optimization process, as suggested by Ganin & Lempitsky (2015): Ganin et al. (2016). Moreover, Seoner,,,Snnggg et al. (2018) focused mainly of FGSM. We empirically demonstrate the superiority of our method in Section In a concurrent work. Qian et al. (2021) utilized the idea of exploiting local and global data information, and suggested to generate the adversarial examples by attacking an additional domain classifier.
2.2 ROBUST GENERALIZATION
Several works investigated the sample complexity requires the ensure adversarial generalization compared to the non-adversarial counterpart. [Schmidt et al.] (2018) has shown that there exists a distribution (mixture of Gaussians) where ensuring robust generalization necessarily requires more data than standard learning. This has been furthered investigated in a distribution-
models via the
Rademacher Complexity. VC-dimension (Yin et al.) 2019 Attias et al.] 2019; Khim & Loh 2018
Awasthi et al. 2020 Cullina et al. 2018: Montasser et al. 2019 Tsai et al. 2021) and additional
settings (Diochnos al. 2018 Carmon al. 2019).
3

---

Under review as a conference paper at ICLR 2022
3 DOMAIN INVARIANT ADVERSARIAL LEARNING APPROACH
In this section, introduce Domain Invariant Adversarial Learning (DIAL) approach for ad- versarial training. The source domain is the natural dataset, and the target domain is generated using an adversarial attack on the natural domain. We aim learn model that has low on the source (natural) task (e.g.. classification) while ensuring that the internal representation cannot discriminate between the natural and adversarial domains. In this way, we enforce additional regularization on the feature representation, which enhances the robustness.
3.1 MODEL ARCHITECTURE AND REGULARIZED LOSS FUNCTION
Let us define the notation for our domain invariant robust architecture and loss. Let Gy 0y) be
the feature extractor neural network with parameters 8y. Let Gy(::8y) be the label classifier with parameters Og. and let Ga(:; the domain classifier with parameters 0g. That is, ( 0,); 0,) essentially the standard model (e.g., wide residual network (Zagoruyko & Komodakis 2016 while addition, we have a domain classification layer to enforce a domain invariant on the feature representation. An illustration of the architecture is presented Figure
Given a training set {(Ti, yi) y:)} 1= the natural loss is defined as:
S = # Σ CE(G,(G)(E:
We consider basic forms of the robust loss. One is the standard cross-entropy (CE) loss between the predicted probabilities and the actual label, which we refer to later as DIALCE- The second is the Kullback-Leibler (KL) divergence between the adversarial and natural model outputs (logits), as in Zhang et al. (2019b); Wang et al. (2019b), which we refer to as DIALKL.
C 1 E CC, (y):)))
CKL = Σn KL(G)(=(;0)) |I Gy(z;;,)) (G)
where {01, y4 1 are the generated corresponding adversarial examples. Next, define source domain label as (for natural examples) and target domain label de as 1 (for adversarial exam- ples). Then, the natural and adversarial domain losses are defined as:
C # Σー (E(G,(C
Cd adv = 3 CB(Ca(G((44:0)))000
We can now define the full domain invariant robust loss:
DIALCE C + AC r rLCatt + L.dv),
DIALKL = C.a + ACKL - r(C + Cdd.))
The goal is minimize the loss on the natural and adversarial classification while maximizing the loss for the domains. The reversal-ratio hyper-parament parammtrrree is inserted into the network layers as a gradient reversal layer (Ganin Lempitsky 2013, Ganin et al.] (0T6) that leaves the input un- changed during forward propagation and reverses the gradient by multiplying it with negative scalar during the mack-propagation. The reversal-ratio parameter initialized to a small value and is gradually increased to r, the main objective converges. This enforces resentation as the training progress: a larger value enforces a higher fidelity to the domain. A comprehensive algorithm description can be found in Appendix A
-iniinnnnvarian rep-
Modularity and semi-supervised extensions. We note that the domain classifier is a modular component that can be integrated into existing models for further improvements. Moreover, since the domain classifier does not require the class labels, additional unlabeled data can be leveraged in future work for improved results.
4

---

Under review as a conference paper at ICLR 2022
3.2 THE BENEFITS OF INVARIANT REPRESENTATION TO ADVERSARIAL EXAMPLES
The motivation behind the proposed method is to enforce an invariant feature representation to ad- versarial perturbations. Given natural example and its adversarial counterpart x'. if the domain classifier manages to distinguish between them, this means that the perturbation has induced a sig- nificant difference in the feature representation. We impose an additional loss on the natural and adversarial domains in order to discourage this behavior.
We demonstrate that the feature representation layer does not discriminate between natural and adversarial examples, namely Gz 0y) = Cy(²;; 0y). Figure 2 presents the scaled mean and standard deviation (std) of the absolute differences between the natural examples from test and their corresponding adversarial examples different features from the feature representation layer. Smaller differences in the mean and std imply a higher domain invariance achieves near-zero differences almost across the board. Moreover, DIAL's feature-level invariance almost consistently outperforms the naturally trained model and the model trained using standard adversarial training techniques (Madry et al. 2017). We provide additional features visualizations in Appendix
and indeed, DIAL
1MA) near difeeencc
DAL sti diference Cean and difirncc
Ciaa mean diflreecce
Stansard Al mean dfference
Stonsaro 20 diferencc
01
Pealcen
(a) Mean difference comparison
(b) Standard deviation difference comparison
Figure 2: Mean and std differences comparison between DIAL, naturally trained model and model trained using standard adversarial training five random features from the features layer. Each bar represent the difference between the means/std the natural examples and the mean/std of their corresponding adversarial examples on this same feature.
4 EXPERIMENTS
In this section we conduct comprehensive experiments to emphasise the effectiveness DIAL, including evaluations under white-box and black-box settings, robustness unforeseen adversaries, robustness to unforeseen corruptions, transfer learning, and ablation studies. Finally, we present a new measurement test the balance between robustness and natural accuracy, which named Fi-robust score.
4.1 A CASE STUDY ON SVHN AND CIFAR- 100
In the first part of analysis, conduct case study experiment
benchmark datasets:
SVHN (Netzer et al., 201T) and CIFAR- 100 Krizhevsky et al. (2009). We follow common experi- ment settings as Rice al. (2020) Wu et al. (2020). We used the PreAct ResNet- (He al., 2016) architecture on which we integrate a domain classification layer. The adversarial training is done using 10-step PGD adversary with perturbation size of 0.031 and step size of 0.003 for SVHN and 0.007 for CIFAR-100 100. The batch size is 128, weight decay is 7c and the model is trained for 100 epochs. For SVHN, the initial learinnig rate set to 0.01 and decays by a factor of 10 after 55, 75 and 90 iteration. For CIFAR-100, the initial learning rate is set to 0.1 and decays by a factor
after 75 and 90 iterations. Results are averaged over 3 restarts while omitting one standard deviation. As can be seen by the results in Tables | and 2 DIAL presents consistent im- provement in robustness (c.g., 5.75% improved robustness on SVHN against AA) compared to the standard AT while also improving the natural accuracy. More results presented in Appendix
4.2 BENCHMARKING THE STATE-OF-THE-ARTY ROBUSTNESS
In this part, we evaluate the performance of DIAL compared to other state-of-the-ee art methods on CIFAR-10. We follow the same experiment setups in Madry et al. (2017); Wang al. (2019h);

---

Under review as a conference paper at ICLR 2022
Table 1: Robustness against white-box, black-box attacks and Auto-Attack (AA) on SVHN, Black- box attacks are generated using naturally trained surrogate model.
White-box
Black-Box
Defense Model
Natural
PGD 20
PGD 100
!0D
1000
CW
PGD
PGD 100
PGD 1000
CW
AA
AT
89.90
53.23
49.45
49.23
48.25
86.44
86.28
86.18
86.42
45,25
DIALKL (Ours)
90.66
58.91
55.30
55.11
53.67
87.62
87.52
87.41
87.63
51.00
DIALCE (Ours)
92.88
55.26
50.82
50.54
49.66
89.12
89.01
88.74
89.10
46.52
Table 2: Robustness against white-box, black-box attacks and Auto-Attack (AA) on CIFAR100. Black-box attacks generated using naturally trained surrogate model.
White-box box
Black-Ba Box
Defense Model
Natural
PGD
PGD100
PGD
CW
PGD
PGD
PGD1000 CW
AA
AT
56.73
29.57
28,45
28.39
26.6
55.52
55.29
55.26
55,40
24.12
DIAL&L (Ours)
58.47
31.19
30.50
30.42
26.91
57.16
56.81
56.80
57.00
25,87
DIALCE (Ours)
60.77
27.87
26.66
26.61
25.98
59.48
59.06
58.96
59.20
23.51
Zhang al. (2019b). When experiment settings are not identical between tested methods, we choose the most commonly used settings, and apply it to all experiments. This way, keep the comparison as fair as possible and avoid reporting changes in results which are caused by inconsistent experiment settings (Pang et al. 2020a). To show that results not caused because of what is referred to as obfuscated gradients (Athalye et al.j 2018), we evaluate our method with same setup as in our defense model, under strong attacks (e.g., 1GD1000) in both white-box, black-box settings, Auto- Attack (Croce & Hein, 2020). unforeseen "natural" corruptions (Hendrycks & Dietterich] 2011)) and unforeseen adversaries. To make sure that the reported improvements overfitting (Rice et al. 22020), we report best robust results for each method on average of 3 restarts, while omitting one standard deviation. Additional results for CIFAR-1O well as comprehansive evaluation on MNIST can be found in Appendix D and
not caused by adversarial
CIFAR-10 setup. We use the wide residual network (WRN-34-10) ZZaoruykoo Komodakis 2016) architecture. Sidelong this architecture, we integrate domain classification layer. To generate the adversarial domain dataset, we use a perturbation size of = 0.031. We apply 10 of inner maximization iterations with perturbation step size of 0.007. Batch size is set to 128, weight decay is set to 7e -4, and the model trained for 100 epochs. Similar to the other methods, the initial learning rate was set to 0.1, and decays by factor of 10 at iteration 75 and 90. We also introduce version of our method that incorporates the AWP double- perturbation mechanism, named DIAL-AWP. For double-perturbation
black-box attacks, used two types of surrogate models (1) surrogate model trained independently without adversarial training, with natural accuracy of 95.61 % and (2) surrogate model trained using one of the adversarial training methods, Additional training details can be found in Appendix C
"Thite-box/Blacks robustness. As reported in Table 3 our method achieves better robustness over the other sfaeeofftthe-ar methods with respect to the different attacks. Specifically, in white-box settings, we see that our method improves robustness over Madry et al. (017)) by more than 2%, and roughly 2% over TRADES using the common 2GD attack while keeping higher natural accuracy. We also observe better natural accuracy of 1.65% over MART while also achieving better robustness over all attacks. Moreover, our method presents significant improvement of up to 15% compared to the the domain invariant method suggested by Song et al. (2018) (ATDA). When incorporating AWP, our method improves the TRADES-AW" variant by almost 2% Additional results are available in Appendix B When tested on black-box settings, DIALCE presents a significant improvement of more than 4.4% over the second-best performing method, and up to 13%. In Table we also present the black-box results when the source model is taken from of the adversarially trained models. In addition to the improvement in black-box robustness, DIALÇE also manages to achieve better clean accuracy of more than 4.5% over the second-best performing method. Moreover, based on the

---

Under review as a conference paper at ICLR 2022
auto-attack leader-board method achieves the 1st place among models without additional data using the WRN-34-10 architecture.
Table 3: Robustness against white-box, black-box attacks and Auto-Attack (AA) on CIFAR-10. Black-box attacks are generated using naturally trained surrogate model.
White-box
Black-Bo
Defense Model
Natural
PGD
PGD 100
CW
PGD
PGD100
CW
AA
TRADES
84.92
56.60
55.56
54.20
84.08
83.89
83,91
53.08
MART
83.62
58.12
56.48
53.09
82.82
82.52
82.80
51.10
AT
85.10
56.28
54.46
53.99
84.22
84.14
83.92
51.52
ATDA
76.91
43.27
41.13
41,01
75.59
75.37
75.35
40.08
DIALKI. (Ours)
85.25
58.43
56.80
55.00
84.30
84.18
84.05
53.75
DIALCE (Ours)
89.59
54.31
51.67
52.04
88.60
88.39
88.44
49.85
DIAL (Ours)
85.91 85.36
61.10
59.86
57.67
85.13
84.93
85.03
56.78
ARADESAWP
59.27
59.12
57.07
84.58
84.58
84.59
56.17
Table 4: Black-box PGD attack using the adversarially trained surrogate models on CIFAR-10.
Surrogate (source) model
Target model
robustness %
TRADES
DIALCE TRADES
67.77
DIAT.CE
65.75
MART
DIALCR MART
70.30
DIALCE
64.91
AT
DIALCE
65.32
DIALcE
AT
63.54
ATDA
DIALeE
66.77
DIALCE
ATDA
52.56
4.2.1 ROBUSTNESS TO UNFORESEEN ATTACKS AND CORRUPTIONS
Unforeseen Adversaries. To further demonstrate the effectiveness of our approach, we test our method against various adversaries that were not used during the training process. We attack the model under the white-box settings with f2-PGD, 4PPGD foo -DeepFool and fz-DeepFool (Moosavi-Dezfooli al., 2016) adversaries using Foolbox (Rauber al., (017). We applied com- monly used attack budget (perturbation for PGD adversaries and overshot for DeepFool adversaries) with 20 iterations for the PGD adversaries and 50 for the DeepFool adversaries. Results are pre- sented in Table As can be seen by the results, our approach gains an improvement of to 4.73% over the second best method under the various attack types and average improvement of 3.7% over all threat models.
Table 5: Robustness on CIFAR-10 against unseen adversaries under white-box settings.
Threat Model
Attack Constraints
DIALkI.
DIALcE
TRADES
MART
ATDA
0.5
76.05
80.51
76.82
76.57
75.07
66.25
P-P
0.25
80.98
85.38
81.41
81.10
80.04
71.87
4-PPGD
6
74.84
80.00
76.17
75.52
75.95
65.76
7.84
78.69
83.62
79.86
79.16
78.55
69.97
8 92-DeepFool
overshoot=0.02
84.53
88.88
84.15
84.23
82.96
76.08
lo Deeeppooo
overshoot=0.02
68.43
69.50
67.29
67.60
66.40
57.35
https://giithbb..omfr/aa//// attack

---

Under review as a conference paper at ICLR 2022
Unforeseen Corruptions. We further demonstrate that our method consistently holds against unforeseen "natural" corruptions, consists of 18 unforeseen diverse corruption types proposed by Hendrycks & Dietterich 2018) on CIFAR-10, which refer to CIFARIO-C. The CIFAR I0-C benchmark cov- noise, blur, weather, and digital categories. As can be shown in Figure D our method gains a significant and consistent improvement over all the other methods. Our approach leads to an average improvement of 4.7% with minimum improvement of 3.5% and maximum improvement of 5.9% compared the second best method over all unforeseen attacks. See Appendix F for the full experiment results.
sperid:
CLIME
10
ehow
Saumdan relee
shot_nopd
sturch
15g
PewcScmprecs on
Figure 3: Accuracy comparison all unfore- seen corruptions.
4.2.2 TRANSFER LEARNING
Recent works (Salman al. 2020 Utrera et al.] 2020) suggested that robust models transfer better on standard downstream classifi- cation tasks. In Table we demonstrate the ad- vantage our method when applied for trans- fer learning across CIFAR10 and CIFAR using the common linear evaluation protocol. Appendix G for detailed experiment set- tings.
Table 6: Transfer learning results comparison.
Target
Svurce
Defence Mode!
CIFARIO
CIFARIO0
CIFARIO
AT TRADES
26.95
25.40
DIAL
73,68
CIFAR100
4.2.3 ABLATION STUDIES
In this part, conduct ablation studies to further investigate the contribution of the additional domain head component introduced in our method. Experiment configuration are as in 4.2 and robust accuracy reported white-box 2GD We use the CIFAR-10 dataset and train WRN-34- 10. We remove the domain head from both DIALKI. and DIALÇE (equivalent to = 0) and report the natural and robust accuracy. We perform random restarts and omit one standard deviation from the results. Results are presented in Figure 4 Both DIAL variants exhibits stable improvements on both natural accuracy and robust accuracy. DIAT and DTAT<L. present an improvement of 1.82% and 0.33% on natural accuracy and 2.5% and 1.87% on robust accuracy, respectively.
Clean Accuracy (9)
90
DIAL KL
60
DIAL XL
258
Domain
Robust Accura
86
CE no Domain
56
CE no Domain
54
52
80
KL
CF
50
GF
Figure 4: Ablation studies for DIAL and DIALCE CIFAR-10.
4.2.4 VISUALIZING DIAL
To further illustrate our method, we visualize the model outputs using the different methods under natural test data and adversarial test data generated using 2GD20 white-box attack with step size 0.003 and e = 0.031 on CIFAR-10 10. Figure Shows shows the embedding received after applying t-SNE Van der Maaten & Hinton 2008) with components the model output for our method and for TRADES. DIAL seems to preserve strong separation between classes on both natural test data and adversarial test data. Additional illustrations for the other methods attached in Appendix
8

---

Under review as a conference paper at ICLR 2022
DIAL on nat. examples
(b) DIAL adv. examples
(c) TRADES nat. examples (d) TRADES on adv. examples
Figure 5: t-SNE embedding of model output (logits) into wwo-dimensional space for DIAL and
TRADES using the CIFAR-10 natural test data and the corresponding adversarial examples.
4.3 BALANCED MEASUREMENT FOR ROBUST AND NATURAL ACCURACY
One of the goals of our method is to better balance between robust and natural accuracy under given model. For balanced metric, adopt the idea of Fcocee, which is the harmonic mean between the precision and recall. However, rather than using precision and recall, we measure the Fi-score between robustness and natural accuracy, using a measure we call the F Fi-robust score.
true robust
Fi-robust true cuuerrobuttt (false_robuse robust + false (alss__ttural
where true_robust are the adversarial examples that were correctly classified, bolust are the adversarial examples that where mlas-class,fied, and false natural are the natural examples that were miss-classified. We tested the proposed Fi robbuttt score using PGD on CIFAR-10 dataset in white- box and black-box settings. Results are presented in Table 7 and show that our method achieves the best Fi -rbust score in both settings, which supports our findings from previous sections.
Table 7: Fobuuts measurement using 2GI) attack white and black box settings on CIFAR-10.
TRADES
MART
AT
ATDA
DIALcE
DIALKL
DIALAWP
TRADESAWE
White-box
0.659
0.666
0.657
0.518
0.660
0.675
0.698 0.854
0.682
Black-box
0.844
0.831
0.845
0.761
0.890
0.847
0.849
CONCLUSION
In this paper, we investigated the hypothesis that domain invariant representation can be beneficial for robust learning. With this idea in mind, we proposed new adversarial learning method, called Domain Invariant Adversarial Learning (DIAL) that incorporates Domain Adversarial Neural Net- work into the adversarial training process. The proposed method is generic and can be combined with any network architecture in wide range of tasks. Our evaluation process included strong adversaries unforeseen adversaries unforeseen corruptions, transfer learning tasks, and ablation studies. Using the extensive empirical analysis, demonstrate the significant and consistent im- provement obtained by DIAL both robustness and natural accuracy compared to other defence methods benchmark datasets.

---

Under review as a conference paper at ICLR 2022
ETHICS STATEMENT
We proposed DIAL to improve models' robustness against adversarial attacks. We hope that will help in building more secure models for real-world applications. DIAL is comparable the state- of-the-art methods we tested in terms of training times and other resources. That said, this work is not without limitations: adversarial training still a computationally expensive procedure that re- quires extra computations compared to standard training, with the concomitant environmental costs. Even though our method introduced better standard accuracy, adversarial training still degrades the standard accuracy. Moreover, models are trained to be robust using well known threat models such as the bounded l norms. However, once model is deployed, we cannot control the type attacks it faces from sophisticated adversaries. Thus, the general problem is still very far from being fully solved.
REPRODUCIBILITY STATEMENT
In this paper, great efforts were made to ensure that comparison is fair, and all necessary information for reproducibility is present. Section and Appendix [ and C contains all experiment settings for SVHN, CIFAR-10 and CIFAR-100 experiments. Appendix D contains all experiment details and results for MNIST experiments. Appendix G contains experiment
settings for the transfer learning experiment. In the supplementary material, we provided the source code to train and evaluate DIAL.
REFERENCES
Rima Alaifari, Giovanni S Alberti, and Tandri Gauksson. Adef: an iterative algorithm to construct adversarial deformations. arXiv preprint arXiv:1804.07729, 2018
Maksym Andriushchenko and Nicolas Flammarion. Understanding and improving fast adversarial training. arXiv preprint urXiv:2007.02617 2020.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of curity: Circumventing defenses to adversarial examples. In International Conference on Machine Learning. pp. 274-283. PMLR, 2018
Idan Attias, Aryeh Kontorovich, and Yishay Mansour. Improved generalization bounds for robust learning. In Algorithmic Learning Theory, pp. 163.183. PMLR, 2019.
Pranjal Awasthi, Natalie Frank, and Mehryar Mohri. On the rademacher complexity of linear hy- pothesis sets. arXiv preprint arXiv:2007. 1005,, 2020.
Tao Bai, Jinqi Luo, Jun Zhao, Bihan Wen, and Qian Wang. Recent advances in adversarial training 2021.
for adversarial robustness. arXiv preprint
Karsten M Borgwardt, Arthur Gretton, Malte Rasch, Hans-Peter Kriegel, Bernhard Schölkopf, and Alex J Smola. Integrating structured biological data by kernel maximum mean discrepancy. Bioinformatics, 22(14))44--c7, 2006.
Tom B Brown, Nicholas Carlini, Chiyuan Zhang, Catherine Olsson, Paul Christiano, and Ian Good-
fellow. Unrestricted adversarial examples. arXiv preprint 1800vv:800.00m 08352, 2018.
Qi-Zhi Cai, Min Du, Chang Liu, and Dawn Song. Curriculum adversarial training. arXiv preprint 1005::8805004300 2018.
Nicholas Carlini and David Wagner. Adversarial examples are not easily detected: Bypassing ten detection methods. In Proceedings of the 10th ACM Workshop Artificial Intelligence and Security, pp. 3-14, 2017a.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pp. 39-57. IEEE, 2017b.
Yair Carmon, Aditi Raghumathan, Ludwig Schmidt, Percy Liang, and John Duchi. Unlabeled data improves adversarial robustness. arXiv preprint arXiv: /905. 13736, 2019.
10

---

Under review as a conference paper at ICLR 2022
Tianlong Chen, Sijia Liu, Shiyu Chang, Yu Cheng, Lisa Amini, and Zhangyang Wang. Adversarial robustness: From supe-supe pre-training to fine-tuning. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattem Recognition, pp. 699-708, 2020.
Minhao Cheng, Qi Lei, Pin-Yu Chen, Inderjit Dhillon, and Cho-Jui Hsich. Cat: Customized adver- sarial training for improved robustness. arXiv preprint arXiv:2002.06778, 2020.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. International Conference on Machine Learning, pp. 1310-1320. PMLR, 2019.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-fiee attacks. In ICML, 2020.
Daniel Cullina, Arjun Nitin Bhagoji, and Prateek Mittal. Pac-learning in the presence of adversaries. In Advances in Neural Information Processing Systems, pp. 230-241, 2018.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hi- erarchical image database. In 2009 JEEE conference on computer vision and pattern recognition, pp. 248-255. Icee, 2009.
Gavin Weiguang Ding, Yash Sharma, Kry Yik Chau Lui, and Ruitong Huang. Mma training: Direct input space margin maximization through adversarial training. arXiv preprint arXiv: 1822.0237, 2018.
Dimitrios Diochnos, Saeed Mahloujifar, and Mohammad Mahmoody. Adversarial risk and robust- ness: General definitions and implications for the uniform distribution. In Advances in Neural Information Processing Systems, pp. 10359-10368, 2018
Yinpeng Dong, Fangzhou Liao, Tianyu Pang. Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boost- ing adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 9185-9193, 2018.
Logan Engstrom, Brandon Tran, Dimitris Tsipras, Ludwig Schmidt, and Aleksander Madry. A rotation and a translation suffice: Fooling enns with simple transformations. 2018.
Yaroslav Ganin and Victor Lempitsky. Unsupervised domain adaptation by backpropagation. In International conference on machine learning, pp. 1180-1 1189. PMLR, 2015.
Yaroslav Ganin, Evgeniya Ustinova, Hana Ajakan, Pascal Germain, Hugo Larochelle, François Laviolette, Mario Marchand, and Victor Lempitsky. Domaan-adversarial training of neural net- works. The journal of machine learning research, 17(1):2096-2300 2016.
Justin Gilmer, Ryan Adams, Ian Goodfellow, David Andersen, and George Dahl. Motivating the rules of the game for adversarial example research. arXiv preprint 1rXiv:1807.066 06732, 2018.
Micah Goldblum, Liam Fowl, Soheil Feizi, and Tom Goldstein. Adversarially robust distillation. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pp. 3996-4003, 2020.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint 112.v2141..6572, 2014.
Sven Gowal, Krishnamurthy Dvijotham, Robert Stanforth, Rudy Bunel, Chongli Qin, Jonathan Ue- sato, Relja Arandjelovic, Timothy Mann, and Pushmeet Kohli. On the effectiveness of interval bound propagation for training verifiably robust models. arXiv preprint 1rxiv:1810.1270 2018.
Minghao Guo, Yuzhe Yang, Rui Xu, Ziwei Liu, and Dahua Lin. When nas meets robustness: In search of robust architectures against adversarial attacks. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pp. 631-640, 2020.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In European conference on computer vision, pp. 630-645. Springer, 2016.
Dan Hendrycks and Thomas G Dietterich. Benchmarking neural network robustness to common corruptions and surface variations. arXiv preprint 1877:01807 2018.

---

Under review as a conference paper at ICLR 2022
Ziyu Jiang, Tianlong Chen, Ting Chen, and Zhangyang Wang. Robust pre-training by adversarial contrastive learning. In NeurlPS, 2020.
Harini Kannan, Alexey Kurakin, and Ian Goodfellow. Adversarial logit pairing. arXiv preprint arXiv: net.188030037, 2018.
Justin Khim and Po-Ling Loh. Adversarial risk bounds for binary classification via function trans- formation. arXiv preprint arXiv:/810.09519. 2, 2018.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. arXiv preprint arXiv:1611.01236. 2016a.
Alexey Kurakin, Ian Goodfellow, Samy Bengio, et al. Adversarial examples the physical world, 2016b.
Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient- based learning applied to document recognition. Proceedings of the IEEE, 86(11):227--2222 1998.
Saehyung Lee, Hyungyu Lee, and Sungroh Yoon. Adversarial vertex mixup: Toward better adver- sarially robust generalization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 272-281, 2020.
Sachyung Lec, Changhwa Park, Hyungyu Lee, Jihun Yi, Jonghyun Lec, and Sungroh Yoon. Removing undesirable feature contributions using out-of-distribution data. arXiv preprint arXiv:2/01.06639, 2021.
Aishan Liu, Shiyu Tang, Xianglong Liu, Xinyun Chen, Lei Huang, Zhuozhuo Tu, Dawn Song, and Dacheng Tao. Towards defending multiple adversarial perturbations via gated batch normaliza- tion. arXiv preprint arXiv:20/2.01655 2020.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks, arXiv preprint arXiv:1706.0660 06083, 2017.
Omar Montasser, Steve Hanneke, and Nathan Srebro. Vc classes are adversarially robustly learnable, but only improperly. Conference on Learning Theory, pp. 2512-2530 2019.
Seyed-Mohsen Noosavi-Dezfooli: Alhussein Fawzi, and Pascal Frossard. Deepfool: simple and accurate method fool deep neural networks. In Proceedings of the IEEE conference on com- puter vision and pattern recognition, pp. 2574-2582, 2016.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. 2011.
Tianyu Pang, Kun Xu, Chao Du, Ning Chen, and Jun Zhu. Improving adversarial robustness via promoting ensemble diversity. In International Conference on Machine Learning, pp. pp. 4970-4979. PMLR, 2019.
Tianyu Pang, Xiao Yang, Yinpeng Dong, Hang Su, and Jun Zhu. Bag of tricks for adversarial training, arXiv preprint arXiv:2010.00467, 2020a.
Tianyu Pang, Xiao Yang, Yinpeng Dong, Kun Xu, Jun Zhu, and Hang Su. Boosting adversarial training with hypersphere embedding. arXiv preprint x0Xiv=2002.08619 2020b.
Vinay Uday Prabhu, Dian Ang Yap, Joyce Xu, and John Whaley. Understanding adversarial robust- ness through loss landscape geometries. arXiv preprint arXiv:1907.0906) 2019.
Zhuang Qian, Shufei Zhang, Kaizhu Huang, Qiufeng Wang, Rui Zhang, and Xinping Yi. Improving model robustness with latent distribution locally and globally. arXiv preprint arXiv:2107.0440. 2021.
12

---

Under review as a conference paper at ICLR 2022
Aditi Raghumathan, Jacob Steinhardt, and Percy Liang. Certified defenses against adversarial exam- ples. arXiv preprint arXiv:1801.09344 2018a.
Aditi Raghunathan, Jacob Steinhardt, and Percy Liang. Semidefinite relaxations for certifying ro- bustness to adversarial examples. arXiv preprint arXiv:1811.0105: 2018b.
Jonas Rauber, Wieland Brendel, and Matthias Bethge. Foolbox: A python toolbox to benchmark the robustness of machine learning models. In Reliable Machine Learning the Wild Workshop, 34th International Conference on Machine Learning, 2017. URL
org/ abs/
1707. 04131
Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in adversarially robust deep learning. In International Conference on Machine Learning, pp. 6093-8104. PMLR, 2020.
Jérôme Rony, Luiz G Hafemann, Luiz S Oliveira, Ismail Ben Ayed, Robert Sabourin, and Eric Granger. Decoupling direction and norm for efficient gradient-based 12 adversarial attacks and defenses. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recog- nition, pp. 4322-4333, 2019.
Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adver- sarially robust imagenet models transfer better? arXiv preprint arXiv:2007.08488 2020.
Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Mądry. Ad- versarially robust generalization requires more data. arXiv preprint arXiv: 118800.1125 11255, 2018.
Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! arXiv preprint arXiv: 12843, 2019.
Aman Sinha, Hongseok Namkoong, and John Duchi. Certifiable distributional robustness with principled adversarial training. arXiv preprint arXiv:1710.10571 2, 2017.
Chuanbiao Song. Kun He, Liwei Wang, and John Hoperoft. Improving the generalization of adversarial training with domain adaptation. arXiv preprint arXiv/8110000440, 2018.
Baochen Sun and Kate Saenko. Deep coral: Correlation alignment for deep domain adaptation. In European conference computer vision, pp. 443 450. Springer, 2016.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint 1312.66311.6/999 2013.
Pedro Tabacof and Eduardo Valle. Exploring the space of adversarial images. In 2016 International Joint Conference on Neural Networks (IJCNN), pp. 426-433. IEEE, 2016.
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow; Dan Boneh, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and defenses. arXiv preprint arXiv: 1705007044 2017.
Yu-Lin Tsai, Chia-Y Yi Hsu, Chia-Mu Yu, and Pin- Yu Chen. Formalizing generalization and robust- of neural networks to weight perturbations. arXiv preprint arXiv:2/03. 00..02200022200000 2021.
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. arXiv preprint arXiv:1805.121: 2018.
Jonathan Uesato. Jean-Baptiste Alayrac, Po-Sen Huang, Robert Stanforth, Alhussein Fawzi, and Pushmeet Kohli. Are labels required for improving adversarial robustness? arXiv preprint arXiv: 13725. 2019.
Francisco Utrera, Evan Kravitz, N Benjamin Erichson, Rajiv Khanna, and Michael W Mahoney. tdversariallyy-traindd deep nets transfer better. arXiv preprint arXiv:2007.0586) 2020.
Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research, 9(11), 2008.
13

---

Under review as a conference paper at ICLR 2022
Yisen Wang, Xingjun Ma, James Bailey, Jinfeng Yi, Bowen Zhou, and Quanquan Gu. On the convergence and robustness of adversarial training. In JCML, volume pp. 2, 2019a.
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In International Conference Learning Representations, 2019b.
Eric Wong and Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. In International Conference on Machine Learning, pp. 5286 (2886-599,, PMLR, 2018.
Eric Wong, Frank R Schmidt, Jan Hendrik Metzen, and Zico Kolter. Scaling provable adversarial defenses. arXiv preprint arXiv: 1805. 2018.
Eric Wong, Leslie Rice, and J Zico Kolter. Fast is better than free: Revisiting adversarial training. arXiv preprint wrXiv:2001003990 2020.
Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust gener- alization. Advances in Neural Information Processing Systems, 33, 2020.
Chaowei Xiao, Jun- Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song. Spatially trans- formed adversarial examples. arXiv preprint arXiv: TrXXiv:801.026111 2018.
Cihang Xie and Alan Yuille. Intriguing properties of adversarial training at scale. arXiv preprint arXiv:1906.00 10w.00070.0..77.. 2019.
Cihang Xie, Yuxin Wu, Laurens van der Maaten, Alan L Yuille, and Kaiming He. Feature denoising for improving adversarial robustness. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp- 501-509, 2019a.
Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang. Zhou Ren, and Alan L Yuille. Improving transferability of adversarial examples with input diversity. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 2730-2739, 2019b.
Huanrui Yang, Jingyang Zhang, Hongliang Dong, Nathan Inkawhich, Andrew Gardner, Andrew Touchet, Wesley Wilkes, Heath Berry, and Hai Li. Dverge: diversifying vulnerabilities for en- hanced robust generation of ensembles. arXiv preprint arXiv:2009. /0ti::2009./7700, 2020.
Dong Yin, Ramchandran Kannan, and Peter Bartlett. Rademacher complexity for adversarially robust generalization. In International Conference on Machine Learning, pp. 7085-7094, PMLR, 2019.
Fuxun Yu, Chenchen Liu, Yanzhi Wang, Liang Zhao, and Xiang Chen. Interpreting adversarial robustness: A view from decision surface in input space. arXiv preprint arXiv: 18100001,, 2018.
Sergey Zagoruyko and Nikos Komodakis.
Wide residual networks.
arXiv preprint
1655::1605.071466 2016.
Runtian Zhai, Tianle Cai. Di He, Chen Dan, Kun He, John Hopcroft, and Liwei Wang. Adversarially robust generalization just requires more unlabeled data. arXiv preprint arXiv: 00555, 2019.
Dinghuai Zhang, Tianyuan Zhang, Yiping Lu, Zhanxing Zhu, and Bin Dong. You only propagate once: Accelerating adversarial training via maximal principle. arXiv preprint arXiv: 2019a.
Haichao Zhang and Jianyu Wang. Defense against adversarial attacks using feature scattering-basee adversarial training. Advances in Neural Information Processing Systems, 32:1831-1841 2019.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning, pp. 7472-7482. PMLR, 2019b.
Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama. and Mohan Kankan- halli. Attacks which do not kill training make adversarial learning stronger. In International Conference Machine Learning, pp. 11278-1123 1287. PMLRR 2020.
14

---

Under review as a conference paper at ICLR 2022
A DOMAIN INVARIANT ADVERSARIAL LEARNING ALGORITHM
Algorithm I describes a pseudo-code of our proposed DIALCE variant. As can be seen, a target domain batch is given in advance as with standard domain-adaptation task. Instead, for each natural batch we generate target batch using adversarial training. The loss function is composed of natural and adversarial losses with respect to the main task (e.g.. classification), and from natural and adversarial domain losses. By maximizing the losses on the domain we aim to learn feature representation which is invariant the natural and adversarial domain, and therefore more robust.
Algorithm 1: Domain Invariant Adversarial Learning
Input: Source data S = {(,, y:) y:) and network architecture G Gy. Ga Parameters: Batch size m, perturbation size e, pgd attack step size т, adversarial trade-off X, initial reversal ratio and step size
Initialize: Y, and Y1 source and target domain vectors filled with and respectively
Output: Robust network G ,, Gy. Ga) parameterized by i (0 fy. 0a) respectively
while user-specified stopping criterion is not met do Fetch mini-batch X, { Y. {1, (
# Generate adversarial target domain batch Xx for j ,...., . (in parallel) do
r'y - PGD((a U5:
Xt xx+ + z/z
end
fg 84 + (X.),,, (X)))) ed. dd + (E)))(G((X.)) Yo), ()
l 6 AlG- -r(e 2
① ((()
11
12 end
B ADDITIONAL RESULTS ON CIFAR-100 AND SVHN
Table 8: Robustness against white-box box, black-box attacks and Auto-Attack (AA) on SVHN. Black- box attacks are generated using naturally trained surrogate model and applied to the best performing robust models.
White-box
Black-Box
Defense Model
Natural
PGD 20
PGD 100
PGD 1000
CW
2GD
PGD 100
PGD 1000
CW
AA
TRADES
90.35
57.10
54.13
54.08
52.19
86.89
86.73
86.57
86.70
49.5
DIALgL (Ours)
90.66
58.91
55.30
55.11
53.67
87.62
87.52
87.41
87.63
51.00
DIALCE (Ours)
92.88
55.26
50.82
50.54
49.66
89.12
89.01
88.74
89.10
46.52
15

---

Under review as a conference paper at ICLR 2022
Table 9: Robustness against white-box, black-box attacks and Auto-Attack (AA) on CIFAR Black-box attacks are generated using naturally trained surrogate model and applied to the best performing robust models.
White-box
Black-Box
Defense Model
Natural
PGD 20
PGD
PGD
CW
PGD
PGD
PGD
CW
AA
TRADES
58.24
30.1
29.66
29.64
25.97
57.05
56.71
56.67
56.77
24.92
DIALKI. (Ours)
58.47
31.19
30.50
30.42
26.91
57.16
56.81
56.80
57.00
25.87
DIALCE (Ours)
60.77
27.87
26.66
26.61
25.98
59.48
59.06
58.96
59.20
23.51
C CIFAR- 10 ADDITIONAL EXPERIMENTAL SETUP DETAILS
Additional defence setup. For being consistent with other methods, the natural images are padded with 4- 4-pixel padding with 32-random crop and random horizontal flip. Furthermore, all methods are trained using SGD with momentum 0.9. For DIALKL. we balance the robust loss with = 6 and the domains loss with = 4. For DIALCE. we balance the robust loss with À and the domains loss with = 2. For DIAL-AWP, we used the same learning rate schedule used in Wu et al. (2020), where the initial 0.1 learning rate decays by factor of 10 after 100 and 150 iterations.
D BENCHMARKING THE STATE-OF-THE-AN ON MNIST
Defence setup. We use the same CNN architecture used in Zhang et al. (209b) which consists of four convolutional layers and three fully-connected layers. Sidelong this architecture, we integrate domain classification layer. To generate the adversarial domain dataset, of 0.3. We apply 40 iterations of inner maximization with perturbation step size of 0.01. Batch size is set to 128 and the model is trained for 100 epochs. Similar to the other methods, the initial learning rate was set to 0.01, and decays by a factor of 10 after 55 iterations, 75 and 90 iterations. All the models in the experiment balance the robust loss with X = 6 and the domains loss with 0.1.
perturbation size
trained using SGD with momentum 0.9. For method,
White-box/Black-box robustness. We evaluate all defense models using PGD PGD 100 PGD 1000 and CW oo (coc version Carlini & Wagner (2017b) attack optimized by PGD-100) with step size 0.01. We constrain all attacks by the same perturbation = 0.3. For our black-box setting, naturally trained surrogate model with natural accuracy of 99.51 %. As reported in Table TO our method achieves improved robustness over the other methods under the different attack types, while preserving the same level of natural accuracy, and even surpassing the naturally trained model. We should note that in general, the improvement margin on MNIST is more moderate compared to CIFAR- 10, since MNIST is an easier task than CIFAR-10 10 and the robustness range already high to begin with. Additional results are available in Appendix B
Table 10: Robustness against white-box, black-box attacks and Auto-Attack (AA) MNIST. Black-box attacks are generated using naturally trained surrogate model and applied to the best performing robust models.
White-box
Black-Box
Defense Model
Natural
PGD
IOD
CW
4GD
PGD
CW
AA
TRADES
99.48
96.07
95.52
95.69
98.12
97.86
98.21
92.79
MART
99.38
96.99
96.11
95.98
98.16
97.96
98.28
93.30
AT
99.41
96.01
95.49
95.78
98.05
97.73
98.20
88.50
ATDA
98.72
96.82
96.26
96.31
97.74
97.28
97.76
93.31
DIAL (Ours)
99.46
97.05
96.06
96.17
98.14
97.83
98.14
93.68
DIALCE (Ours)
99.52
97.61
96.91
97.00
98.41
98.12
98.48
93.43
16

---

Under review as a conference paper at ICLR 2022
E ADDITIONAL RESULTS ON MNIST AND CIFAR-10
In Table we present additional results using the PGD 1000 threat model. We use step size of 0.003 and constrain the attacks by the same perturbation
0.031. Table [ comparison of our method combined with AWP to other the variants of AWP that were presented in WW et al. (2200) In addition, in Table 13 we add the Fi-robust scores for different variants of AWP.
Table 11: PGD 1000 attack on MNIST and CIFAR-10 on white-box and black-box settings.
MNIST
CIFAR-10
Defense Model
White-box box
Black-box
White-box box
Black-box
TRADES
95.22
97.81
56.43
83.80
MART
95.74
97.89
56.55
82.47
AT
95.36
97.78
54.40
83.96
ATDA
96.20
97.34
41.02
75.11
DIALCE (Ours)
96.78
98.10
51.57
88.22
DIALKL (Ours)
95.99
97.89
56.73
84.00
Table 12: Robustness comparison of DIAL-AWP and other variants of AWP that do not require additional data under the foo threat model.
Defense Model
Natural
PGD
PGD100
CW oc
AA
DIAL-AWP (Ours)
85.91
61.10
59.86
57.67
56.78
TRADES-AWE (Wu et al.
2020)
85.36
59.27
59.12
57.07
56.17
MART-AWP (Wu et al. 2020)
84.43
60.68
59.32
56.37
54.23
AT-AWP (w et al. 2020
85.57
58.14
57.94
55.96
54.04
Table 13: Fy-robust measurement AWP variants based white-box attack.
Defense Model
Fi-robust
DIAL-AWP (Ours)
0.69753
TRADES-AVE (Wu al.
2020
0.68162
MART-AWP Wu ct al 2020)
0.68857
AT-AWP Wu et al. 2020)
0.67381
17

---

Under review as a conference paper at ICLR 2022
F EXTENED RESULTS ON UNFORESEEN CORRUPTIONS
We present full accuracy results against unforeseen corruptions in Tables 14 and 15 alize it in Figure 6
We also visu-
Table 14: Accuracy (%) against unforeseen corruptions.
Defense Model
brightnes
defocus blu
log
glass blur
jpeg compression
motion blur
TRADES
$2.63
80.04
60.19
78.00
82.81
76.49
81.53
80.68
30.14
78.62
56.78
ATDA
72.67
69.36
45.52
64.88
73.23
63.47
72.07
68.76
72.27
DIAL (Ouns
87.14
84.84
66.08
81.82
87.07
$1.20
86.45
84.18
84.94
Table 15: Accuracy (%) against unforeseen corruptions.
Defense
cuntrast
gasasian Dolse
impulse
spatier
TRADES
80.42
77.77
74.97
79.53
77.8
AT
43.30
79.58
77.53
79.47
73.76
82.78
80.85
90.19
79.58
ATDA
36.06
67.06
62.56
70.33
64.63
73.46
72.28
70.50
67.31
DIAT
78.26
85.13
brightness zoom
defocus blur
speckle_ngke __noise
elastic transform
spatter
frost
0.6
0.5
gaussian _nose
0.4
shot_noisé
glass blur
saturate
impulse_noiss noise
DIAL
fog
jpeg compeeesno
AT
TRADES
contrast
motion blur
MART
pixelate
ATDA
Figure 6: Accuracy comparison with all tested methods over unforeseen corruptions.
G TRANSFER LEARNING SETTINGS
The models used are the same models from previous experiments. We follow the common procedure of "fixed-feature" setting, where only a linear layer on top of the pre-trained network trained. We train linear classifier CIFAR-10. We also train a linear classifier on CIFAR-10 10 on top of the pre-trained nwork which was trained on CIFAR-100. We train the linear classifier for 100 epochs, and initial learning rate of 0.1 which is decayed by a factor of 10 at epochs 50 and 75. We used SGD optimizer with momentum 0.9.
CIFAR-100
top of the pre-trained network which was trained on
18

---

Under review as a conference paper at ICLR 2022
H EXTENDED VISUALIZATIONS
In Figure 8 we provide additional visualizations of the different adversarial training methods pre- sented above. We visualize the models outputs using I-SNE with two components on the natural test data and the corresponding adversarial test data generated using PGD white-box attack with step size 0.003 and 0.031 on CIFAR-10.
In Figure 7 we visualize statistical differences between natural and adversarial examples in the fea- ture representation layer. Specifically, we show the differences mean and std on thirty random feature values from the feature representation layer as we pass through network the natural test examples and their corresponding adversarial examples. We present the results on same network architecture (WRN-34-10), trained using three different training procedures: naturally trained net- work, network trained using standard adversarial training (AT) Madry et al. (2017), and DIAL on the CIFAR-10 dataset. When the statistical characteristics of each feature ditter from each other, it implies that the features layer is less domain invariant. That is, smaller differences mean/std yields better invariance to adversarial examples. One can observe that for DIAL, there is almost no differences between the mean/std of natural examples and their corresponding adversarial examples. Moreover, for the vast majority of the features, DIAL present smaller differences compared to the naturally trained model and the model trained with standard adversarial training. Best viewed in colors.
14
oilbwwer difeence
Vian 1Mr.0eeeec
23
(a) Mean difference comparison
Oka dfaana Kranned voleeeee
(b) Standard deviation difference comparison
Figure 7: Mean and std differences comparison between DIAL, naturally trained model and model trained using standard adversarial training on thirty random features from the features layer on the CIFAR-10 dataset with WRN-34-10 10 architecture. Each bar represents the absolute difference be- tween the means/std of the natural examples and the mean/std of their corresponding adversarial examples on this same feature.
19

---

Under review as a conference paper at ICLR 2022
(a) MART embedded model output on natural (b) MART embedded model output on adver-
test data
sarial test data
(c) AT embedded model output natural test (d) AT embedded model output on adversarial data
test data
(c) ATDA embedded model output on natural (f) ATDA embedded model output on adversar- test data
ial test data
Figure 8: t-SNE embedding of model output in two-dimensional space for MART, AT, and ATDA under natural and adversarial test data from CIFAR-10.
20


Reviews:
[{"review_id": "NHSw9GTLZc1", "reviewer": "Reviewer_8wyr", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "+ The paper is easy to follow and the idea is straightforward.\n- The experiment section is not comprehensive. Only a few methods are included in the comparison. More recent SOTA methods are missing.", "summary_of_the_paper": "In this paper, DANN is leveraged to generate domain invariant and robust feature representation. The authors claim that the proposed method outperforms other methods when the target domain is the adversarial examples.\n", "summary_of_the_review": "+ The paper is easy to follow and the idea is straightforward.\n- The experiment section is not comprehensive. Only a few methods are included in the comparison. More recent SOTA methods are missing.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "IetysIbv4sT", "reviewer": "Reviewer_FZTb", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Pros:\n\n(1) The paper is clearly written and easy to follow.\n\n(2) The motivation behind is very intuitive.\n\n(3) The paper conducts extensive experiments including multiple-$\\ell_p$-norm adversarial perturbations and unseen corruptions.\n\nCons:\n\n(1) My biggest concern is the novelty of this paper. Though showing promising performance, the idea of learning a feature extractor to minimize the distance between adversarial and clean distributions/domains has been widely studied and adopted before in the domain adaptation (DA) literature. In this paper, the author just simply introduced several DA loss terms and used the GAN framework to learn a more robust model. The experimental results are persuasive, however, the approach is too simple and not novel enough.\n\n(2) Some minor problems. I cannot find your paper in the autoattack leaderboard as you mentioned at the first line in Page 7.", "summary_of_the_paper": "This paper proposes DIAL to learn domain-invariant representations for clean and adversarial examples to improve model robustness and clean accuracy. The main idea is to treat the problem as a domain adaptation problem by considering the data shift between adversarial and clean distributions, and then use the generative adversarial network (GAN) principle to tackle this data shift.", "summary_of_the_review": "I think the paper conducts extensive experiments to demonstrate the effectiveness of the proposed method, including some interesting ones, e.g., robustness against unseen perturbations, transfer learning (I like them). However, the novelty of this paper is insufficient, and using the domain adaptation principle and learning invariant representation has been widely studied. Therefore, I vote for rejection.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "D6muCVpdaDB", "reviewer": "Reviewer_iRX5", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "**Strengths:**\n\n* The idea is simple, yet it leads to significantly more robust networks\n* The paper is well written, and it is easy to follow\n* While the experiments are only carried out on smaller scale datasets, they are thorough, and they support the claims of the authors\n\n\n**Weaknesses:**\n\nI don't see major weaknesses in the paper. Below are some minor points.\n\n* DIAL-AWP comes out of the blue in Table 3. For the sake of consistency, I suggest adding it to Tables 1 and 2 as well and providing the formulation (for self-sufficiency).\n\n* The TSNE plots in Figure 5 for clean and perturbed distributions seem to have been calculated separately, which means that we are effectively looking at two different embedding spaces when we look at (a) and (b). I suggest that the author append the clean and perturbed representations, calculate the TSNE embedding jointly, and then plot them into their corresponding plots.\n\n**Additional Comments/Questions:**\n\n* In your KL robustness loss you have,\n $$ \\mathcal{L}_{rob}^{KL}=\\frac{1}{n}\\sum_i KL(G_f(x'_i;\\theta_f)||G_f(x_i;\\theta_f))$$\nMy understanding is that $G_f$\n is your feature extractor, and $G_f(x'_i), G_f(x_i)\\in \\mathbb{R}^d$  are not probability vectors, this is while $KL(\\cdot||\\cdot)$ is a dissimilarity measure defined only for probability distributions. Could you comment on this? Also, wouldn't a simple MSE work fine here?\n\n* This might be a matter of style, but it could be helpful to add equation numbers to your equations.\n\n* Typos:\n\n  * Page 3 second paragraph: \"belongs to the the family\"\n  * Page 5 second to the last paragraph: \"the initial learinnig\"\n", "summary_of_the_paper": "The paper describes an adversarial training approach that, in addition to the commonly used robustness loss, requires the network to extract similar representation distributions for clean and attacked data. The proposed method is inspired by domain adaptation approaches that require a model to extract domain invariant/agnostic features from two domains. In the context of this paper, the two domains are the clean and adversarially perturbed images, and the network is required to extract domain invariant representation. To achieve domain invariance, the authors propose a domain classifier ( i.e., an adversarial network) that discriminates the representations from clean and attacked images. The feature extractor is then required to generate features that fool the domain classifier. The authors then provide extensive experiments on small-scale benchmark datasets (SVHN, CIFAR10, CIFAR 100, and MNIST in the supplementary material ) to show the robustness of their proposed approach against the state-of-the-art robustness methods under white-box and black-box attacks. The authors show that their proposed method provides: 1) higher accuracy on attacked data (more robustness), and 2) higher accuracy on clean data, closing the gap between the performance on clean and attacked data. In addition, the paper provides insightful experiments on robustness to unforeseen adversaries, robustness to unforeseen corruptions, transfer learning, and ablation studies.\n\n", "summary_of_the_review": "**Overall assessment:** The paper is well-written and easy to follow. While the main idea of learning domain invariant features is simple, its use in the context of robustness against adversarial attacks seems to lead to a significant performance boost. The experiments and, in particular, the ablation study section is insightful and aligned with the paper's claims. I think the paper is above average, and therefore I would like to vote for its acceptance.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "6KVt-ZCFPtF", "reviewer": "Reviewer_FjGF", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "This paper proposes a simple and effective adversarial learning method DIAL, which brings the idea from domain adaptation for robust representation. \n\nStrengths: \n1. This paper is well-written and easy to follow.\n2. It conducts various experiments to demonstrate the effectiveness of the proposed method ranging from robustness to white-box attacks, black-box attacks, unforeseen adversaries, unforeseen corruptions and transfer learning. The experimental results are solid and technically sound. \n\nWeaknesses: \n1. From my point of view, the novelty of the methodology is not enough, as the domain classifier and the gradient reversal layer are the same with those methods in domain adaptation such as [1].\n2. To better understanding the reversal-ratio hyper-parameter $r$, can the authors provides the robustness under different values of $r$.\n\n[1] Yaroslav Ganin and Victor Lempitsky. Unsupervised domain adaptation by backpropagation. In International conference on machine learning, pp. 1180–1189. PMLR, 2015. \n\n\n", "summary_of_the_paper": "This paper proposes a domain invariant adversarial training (DIAL) method, which learns the feature representation that is both robust and domain invariant.  Apart from the label classifier, the model is equipped with a domain classifier that constrains the model not to discriminate between natural examples and adversarial examples, thus achieving a more robust feature representation. Extensive experiments on image classification benchmark the robustness compared to other state-of-the-art methods. ", "summary_of_the_review": "Overall, this paper proposes a simple and effective adversarial learning method DIAL for robust representation learning. Extensive experiments are conducted to demonstrate the effectiveness of the proposed method and provide solid results. However, the novelty of the paper is not significant as similar methodology exists in domain adaptation. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper describes an adversarial training approach that, in addition to the commonly used robustness loss, requires the network to extract similar representation distributions for clean and attacked data. The proposed method is inspired by domain adaptation approaches that require a model to extract domain invariant/agnostic features from two domains. Although the experimental results are solid and technically sound, the novelty of the methodology is not enough, as the domain classifier and the gradient reversal layer are the same with those methods in domain adaptation such as "unsupervised domain adaptation by backpropagation". On the other hand, more recent SOTA methods are missing and only smaller scale datasets are used for evaluation. During the discussions, the major concerns from three reviewers are novelty. 

I totally agree that the simplicity of the method should be a virtue. However, the idea of domain-invariant representation learning is already established well, and its application to adversarial training is quite intuitive to the community. Also, the similar methodology already exists in domain adaptation. According to the top-tier conference culture in the ML community, what most valuable is the novelty and insight, not the performance. In the end, I think that this paper may not be ready for publication at ICLR, but the next version must be a strong paper.
Decision: Reject