Domain-wise Adversarial Training for Out-of-Distribution Generalization
Authors: Shiji Xin
Yifei Wang
Jingtong Su
Yisen Wang
Venue: ICLR 2022 Submitted (2022)
Keywords: Domain Generalization
IRM
Adversarial Training

Abstract: Despite the impressive success on many tasks, deep learning models are shown to rely on spurious features, which will catastrophically fail when generalized to out-of-distribution (OOD) data. To alleviate this issue, Invariant Risk Minimization (IRM) is proposed to extract domain-invariant features for OOD generalization. Nevertheless, recent work shows that IRM is only effective for a certain type of distribution shift (e.g., correlation shift) while fails for other cases (e.g., diversity shift). Meanwhile, another thread of method, Adversarial Training (AT), has shown better domain transfer performance, suggesting that it is potential to be an effective candidate for extracting domain-invariant features. In this paper, we investigate this possibility by exploring the similarity between the IRM and AT objectives. Inspired by this connection, we propose Domain-wise Adversarial Training (DAT), an AT-inspired method for alleviating distribution shift by domain-specific perturbations. Extensive experiments show that our proposed DAT can effectively remove the domain-varying features and improve OOD generalization on both correlation shift and diversity shift tasks.

Under review as a conference paper at ICLR 2022
DOMAIN-WISE ADVERSARIAL TRAINING FOR OUT- OF OF-DISTRIBUTION GENERALIZATION
A Anonymous authors
Paper under double-blind review
ABSTRACT
Despite the impressive success on many tasks, deep learning models are shown rely on spurious features, which will catastrophically fail when generalized to out- of-distribution (OOD) data. To alleviate this issue, Invariant Risk Minimization (IRM) is proposed to extract domain- invariaint features for OOD generalization. Nevertheless, recent work shows that IRM is only effective for a certain type of distribution shift (e-g., correlation shift) while fails for other cases (e.g. diver- sity shift). Meanwhile, another thread of method, Adversarial Training (AT), has shown better domain transfer performance, suggesting that it is potential to be an effective candidate for extracting domain-invariant features. In this paper, we investigate this possibility by exploring the similarity between the IRM and AT ob- jectives. Inspired by this connection, we propose Domain-wise Adversarial Train- ing (DAT), an AT-inspired method for alleviating distribution shift by domain- specific perturbations. Extensive experiments show that our proposed DAT can effectively remove the domain-varying features and improve OOD generalization under both correlation shift and diversity shift.
INTRODUCTION
Modern deep learning techniques have achieved remarkable success on many tasks (He et al. 2016 Brown et al. 2020). Yet, under some scenarios, deep models will suffer catastrophic performance degradation since they tend to seize on spurious correlations in the training data (Beery al.) 2018). One of those representative scenarios is the
(OOD) generalization, where one expects the trained model to perform well at the test time even when the training and testing data come from different distribution!!" Another representative scenario under which deep models unstable is the adversarial example. Researchers have found that deep models are quite brittle since one inject imperceptible perturbations into the input and cause the model to make wrong pre- dictions with extremely high confidence (Szegedy et al. 2014).
These two issues have some similarities to each other. They both arise because deep networks do not learn the essential causal associations (or intrinsic features). Nevertheless, in their corresponding fields, different approaches have been proposed. For OOD generalization. a large class of methods called Invariant Causal Prediction (ICP) (Peters et al. 2016) are proposed. Among them, Invariant Risk Minimization (IRM) (Arjovsky al. 2019) attracts significant attention, which intends to ex- tract features that are invariant across different data distributions and expects the model to ignore information related to the environment. While for adversarial robustness against adversarial exam- ples, Adversarial Training (AT) (Madry et al. 2018) is the most effective approach at the current stage (Athalye et al. 2018). trains a model on adversarial examples that are generated by in- jecting perturbations optimized for each image into natural examples. These two fields seem to be independent, and their connections are rarely studied. That is exactly what we are exploring in this paper.
Although IRM and its variants have shown promise on certain tasks, e.g., CMNIST (Arjovsky et al. 2019), recent studies (Gulrajani & Lapez-Paz 202T) show that large-scale controlled experi- ment on OOD generalization, all these methods fail to exceed the simplest i.i.d. baseline, i.e., Em- pirical Risk Minimization (ERM). Through a dissection of the benchmark datasets, Ye et al. (2021)
In current literature, the terminologies of "domain", "environment" and "distribution" are often used inter- changeably, so we do the same in the whole paper.

---

Under review as a conference paper at ICLR 2022
notice that there are actually two types of distribution shifts: correlation shift (same support, dif- ferent correlation) and diversity shift (different support, same correlation). IRM variants can only perform well under (some) correlation shift while performing poorly under diversity shift. Thus, need to seek better alternatives for OOD generalization, while AT seems to be a promising candidate from both theoretical and empirical aspects. Theoretically, by learning invariance w.r.f. local input perturbations, AT can be regarded as Distributionally Robust Optimization (DRO) (Sinha et al.) 2018 Volpi al., 2018; Rahimian & Mehrotra, 2019; Duchi al. (021)) over én éy-bounded distribu- tional shift. Thus, AT could reliably extract robust features, e.g., the object shape, from the input. Empirically. several recent works show that AT has better domain transferability than ERM (Salman
et al. 2020 These findings naturally leads to the questions:
Will AT perform better than IRM? Will AT be helpful for OOD generalization?
In this paper, we take further step to answering these intriguing questions. We first reveal the connections between IRM and AT; and find that IRM can be regarded as an instance-reweighree version of Domain-wise Adversarial Training (DAT), a new version of adversarial training that we propose for generalizing Universal Adversarial Training (Moosavi-Dezfooli al. (017) to multiple domains. Inspired by this connection, we further explore how DAT performs for OOD data. We first notice that DAT is suitable for solving domain generalization problems it can effectively remove the relatively static background information with domain wise perturbations. We further verify this intuition on both synthetic tasks (Xiao et al.) 202T) and real-world datasets, where show clear advantages over ERM. At last, we conduct extensive experiments on benchmark datasets and show our DAT can outperform ERM consistently tasks dominated by both correlation shift and diversity shift, and as result, achieve wate-of-the-aa performance (in average) on these datasets.
We summarize our contributions follows:
We develop a new kind of adversarial training, Domain Adversarial Training (DAT), for domain generalization, and we establish the intrinsic similarity between IRM and domain-wise AT objectives.
We analyze how DAT will benefit learning invariant features and verify our hypothesis through both synthetic data and real-world datasets.
Extensive experiments benchmark datasets show that DAT does not only perform better than ERM under correlation shift like IRM but also outperforms ERM under diversity shift like sammleewisee) AT. Therefore, our methods achieve state-of-the-ar results by surpass- ing ERM at both kinds of distribution shifts.
2 RELATED WORKS
IRM and Its Variants Invariant Risk Minimization (IRM) (Arjovsky et al. (0119) paradigm to extract causal (invariant) features and find the optimal invariant classifier on top over several given training environments. The work Kamath al. (202T) reveals the gap between IRM and IRMv1, show that even in simple model that echos the idea of the original IRM objective, IRMvl can fail catastrophically. RRosenfeld et al. (202T) prove that when the number of training environments is not large enough, IRM can face the risk of using environmental features. There also cxists a predictor feasible for IRMv1 I that is very similar to the ERM solution.
develops
AT and Its Variants Szegedy et al. (2014) report one can inject imperceptible perturbations to fool deep models. [Athalye et al. (2018) reveal that among the proposed defenses, adversarial training was the only effective one. Adversarial Training (AT) (Goodfellow et al. [014|] Madry et al. (008)) is the representative approach to train robust models. Recently, Kamath et al. (2021) show adversari- ally learned features can transfer better than standardly trained models, while various works ( (Volpi let al. 2021 adopt sample-wise adversarial training adversarial data augmentation improve OOD bustness. However, most of the discussions are limited to distributional robustness w.t.f. Wasserstein distance, making less practical for accounting real-world OOD scenarios discussed in this work.
2018; [Sinha et al. 2018 Ford et al., 2019) Qiao et al. [020 Yi et al.) 2021 Gokkale et al.-
Evaluating OOD Robustness Guirajani & Lopez-Paz (021)) recently noticed that the evalu- ation criteria are crucial for fair comparison of OOD robustness, where under fair settings, no
2

---

Under review as a conference paper at ICLR 2022
algorithm has performed consistently better than vanilla ERM. Ye et al. (2021) further iden- tifies two kinds of distribution shifts in current benchmark datasets: diversity shift and cor- relation shift. Diversity shift refers to the shift of the distribution support of spurious fea- ture 2, while correlation shift refers to the change of conditional probability of label y given spurious feature
the same support. We present illustrative example in Figure
In particular, they show that there seems to be a trade-
off between the two tasks an algorithm that performs
p(c)
Domain Domain 2
well at one task tends to perform poorly on the other.
Instead, in this work, we show that our DAT can achieve superior performance on both correlation shift and diversity shift tasks.
Universal Adversarial Training Universal adver- sarial perturbation proposed by MMoosavi-eeztooli et al. (2017) a type of adversarial attack that adopts universal perturbation for all images. Universal adver- sarial training (UAT) (Shafahi et al. (2020) is then pro- posed to defend against this attack by training against universally perturbed data. Instead, in our work, we firstly show that can adapt UAT for solving domain generalization problems.
ply 0 ply 1
(a)
(b)
Figure 1: An illustrative example of the
two kinds distribution shifts. (a) Di-
versity shift (b) Correlation shift, stands for spurious feature, and y stands for label class.
ON THE RELATIONSHIP BETWEEN IRM AND AT
3.1 PRELIMINARY
Notation Let X C. R" - R Rdd denotes the representation of 0-parameterized piecewise linear classifier, ie., (b-) o'
b/-1) ) +b,, where o² the activation function, and WT. 6t denote the layer-wise weight matrix and bias vector, collectively denoted by 6. Additionally, let 3 be the linear classifier on top, and the output of the network is 3 ((x) 33 (xx). Let ((ū, y) log (v9) be the sample logistic loss. We consider two-class
+1) classification
setting with output dimension d = 1. and our discussion can be easily extended to the general cases.
ERM The traditional Empirical Risk Minimization (ERM) algorithm optimizes over the loss on i..d. data, i.e.,
min R(B 2) where R(B ()) = =E v(x),v). 3.0
In OOD generalization problem, one faces set of (training) environments E, where each environ- ment corresponds to unique data distribution De- When facing multiple environments, the ERM objective simply mixes the data together and takes the form
(ERM)
min Σ (3 b), where (B +)) = -E E(3 ((r), 3,4
IRM and IRMy1 Instead of simply mixing the data together. IRM seeks to learn an invariant representation such that it can be minimizing with the same classifier B. Formally have
min B.0
Σ R (B-
(IRM)
s.t. B E arg min R (B b), Ve E
Since this bi-level optimization problem is difficult to solve, the practical version IRMv1 as regular- ized ERM, where the gradient penalty is calculated w.r.l. dummy variable w::
min Σ 3
(B )) A www=100f Ro (w (B-$))112 12)
(IRMv1)
(4)
PenaltyiRos

---

Under review as a conference paper at ICLR 2022
AT
Adversarial Training (Madry et al., 2018)) instead replaces ERM with minimax objective,
(AT) min RAT (3 ②) - min ((..)) 3,0
max E(3" ( 82),9). 11
(5)
3.
where one maximizes the inner loss by injecting sample-wise perturbations 6g and solve the outer minimization w.r. parameters 3, $ the perturbed sample (x + daz y). Typically, the perturbation is constrained within an En ball with radius e. In this way, AT can learn models that are robust to é perturbations.
UAT Instead of injecting sample-wise perturbations, MMooavi-Deztooli p can also adopt a universal perturbation ó for all samples, which results in the Unversarial Adversarial Training (UAT) objective as follows:
et al. (0117 notice that
(UAT)
min U.AA (3-4) 8
min max B(x,o)~D, E(B 4(x + 6),
(6)
3,0 Se
3.2 RELATING ADVERSARIAL TRAINING TO IRM
Motivation As shown above, it seems that IRM and AT are two distinct learning paradigms, while fact, we can show that IRM is closely related certain kind of adversarial training. To see this, first notice that AT can be rephrased into regularized ERM loss with penalty on sample-wise robustness through linearization:
RA (B +) ((wy)
max E(B ((TT((2 + 82),
118.115c
E |E(BT (x)) (()
max (e(3 dm).)) ((3T)(x)).)))
= R(3 1) + B
V V.l(3" ((r),0)
Penalty
which resembles the gradient penalty adopted in IRMv1. One main difference is that AT's penalty calculated w.r.f sample-wise gradients, while IRM's penalty w.r. the population loss. This dif- ference motivates us to adopt population-level perturbation 5 instead, which, in the literature of adversarial learning, corresponds to Universal AT (Eq. ( that could be rephrased as follows:
RUAT (B +) max B(x.))=E(()) ( 8).
Se
=B (I),U) +
E (( (8(3) o(x + +),0) E(3 +(x),))
(8)
R(3. +5 +
V V.B(a (3)) (xx),)))
Penaltyuxt
DAT Inspired by the connection above between UAT with IRM, we adapt UAT to the OOD set- ting with multiple domains and propose Domain- tisee Adversarial Training (DAT), which adopts domain-wise perturbation òe for each training domain e E E. Formally, we have
min Σ 3
B(. ( ( (xx
8c)).
330
s. E arg max B(Z,)) (3 ( + Ve
Se
The objective could be interpreted as the loss function of universal training in domain-wise fash- ion, which lead to solving for the perturbation vector individually for each domain. We name this method Domain-wise Adversarial Training (DAT), generalization of UAT for learning invari- ance from multiple domains. In practice, we solve the problem above with alternating update of model parameters 8, 4 and perturbations & Specifically, for each mini-batch B, sampled from do- main D... we update ó, with B, using gradient ascent to find the best adversarial perturbations. Then the adversarial samples used to train the model. A detailed description shown in Algorithm] 1
4

---

Under review as a conference paper at ICLR 2022
Algorithm Domain- Adversarial Training
Input: Dataset of multiple environments Da,e E E, desired Ip norm of the perturbation pertur-
bation step size o
Output: Model (#, (3)
Randomly imitiate 0, perturbation de, Ve E E for iterations 1, 3... do for each environment e do
1. Sample batch B. from environment
2. Update the perturbation 6, using one-step gradient ascent with step size a Project the perturbation 6e the lp ball of radius
4. Generate adversarial examples Tade f- 2 + 6e, vz E B; Update & and with gradient descent (Adam) on Zade
end for end for
3.3 CONNECTION BETWEEN IRM AND DAT
Here, we establish formal connection between IRM and DAT. To begin with, we note that DAT can also be reformulated regularized ERM in the multi-domain scenario.
DAT (3 4)
Σ 333
max E (a,,))D, {(B ((x + 5c),
18.1
(( E(B (z)).v) + max E (a.))~D, (E(3" 40 + +.).0) - E(8" (<x). v))]
11-11
3EE
83
Σ 330
[8
+
+
V. a(3 (x), (
Penaltynar
(10)
Based on this reformulation, can show that there exists an intrinsic relationship between DAT and IRM as the following proposition:
Proposition 1 Consider each De as the corresponding distribution of a particular training do- main e. For any B - 4 as a deep network with any activation function, the penalty term of IRMvl, Penaltyιии (Eq. 4. could be expressed as the square of reweighted version of the penalty term of the above approximate targer, Penalty (ET 10), on each environment with coefficients related the distribution DR, which could be stated as follows:
PenaltyIRM = |B, =|] and PenaltyDAT |Ep, Lz
(11)
where Lg = (1- oy8 4 4...
The proposition above shows that IRM can be regarded as instance-reweighted version of DAT, which indicates that DAT can also be applied to improve out-of-distribution generalization perfor- mance. We explore this possibility in the next section.
Besides, assume that each domain only contains one sample, we can further obtain a stronger result, that is, the equivalence between IRM and (linearized) DAT follows.
Remark (Equivalence under Single-sample Environments) When the environments degener- into single data point, we have the following relationship: If is sufficiently small, then for 3 t as a deep network with any activation function, the penalty term of IRMvl (Eq. (4) on each sample and the square of the maximization term of Linearized version of Eq. (LDAT, obtained by first-order approximation of DAT)
Penalty = (V (8" +8.)
(12)
on each sample with perturbation 8 = +Ex only differ by fixed multiple e2, Which is formally
stated as
Penalty PPenaltymx..
(13)
5

---

Under review as a conference paper at ICLR 2022
cat ON gToSs
CAt on SnOR
dog on beach
elephant forest
Figure 2: Images in different domains from NICO dataset and corresponding attention heatmaps of model trained by ERM. The model has strong focus on background information.
Proofs of Proposition and Remark can be found in Appendix C
UNDERSTANDING DOMAIN- WISE ADVERSARIAL TRAINING
The above connection between DAT and IRM highlights that our DAT is potentially helpful for addressing OOD problems. In this section, we further explore how domain wise perturbations could help alleviate distribution shift in real-world scenarios. particular, we notice that the domain-wing perturbations could successfully remove the domain- domain-varying varying background information, which usually corresponds to the spurious features for image classification tasks. And we empirically verify this property by applying DAT to well-designed OOD task based on background shift.
4.1 COMPARING ERM TO DAT FOR BACKGROUND REMOVAL
ERM Learns Spurious Background Features Our understanding of DAT hinges on the insight that image is composed of foreground object and the corresponding background, and typically, the object is the invariant feature while the background is only spuriously correlated with the labels. However, models relying on the spurious background information will easily fail when encountering images from a different domain. This phenomenon is also empirically verified by Xiao et al. (2021), who find that models trained on an ImageNet-like like dataset with ERM require image backgrounds for correctly classifying large portions of test sets. These findings point out the limitations of ERM and motivate us to find a solution that could effectively learn background-inge invariiann classifier.
Removing Background Information with DAT Comparing to the failure of ERM above, we notice that Domain-wise Adversarial Training (DAT) can applied to eliminate the domain-wise background information with its domain-specific perturbations.
Take the NICO images in Figure 2 for an example, where samples from the environment "on grass" have common background dominated by the green grass with low frequency, while the foreground object (e.g., the cats) has complex and instancc-specific shape and texture with much higher fre- quency. In fact, -Moosavi-Dezfooli et al. (2017) show that a universal perturbation vector lies in low dimensional subspace, which fits the background statistics and could be used to eliminate the low-frequency background factor. Therefore, when applying our DAT to these samples, the domain- wise perturbation will capture the common domain-speciff background. And consequently, the domain-wise AT will help remove the dependence these spurious background features.
4.2 EMPIRICAL VERIFICATION WITH CONTROLLED EXPERIMENTS
To verify the above analysis, we construct synthetic OOD task to evaluate a classifier's 's depen- dence on background information. It is based on two datasets introduced by Xiao et al. (202 Mixed-Same and Mixed-Rand Rand, which are constructed from subset of ImageNet images with the background of each image replaced by another background that either from the same class (Mixed- Same) or random class (Mixed-Raime in terms of its background dependence, we construct a new OOD task by using Mixed-Sam -Same as the training domain and evaluating the learned classifier on Mixed-Rand Rand as the test domain. If the clas-
As they are perfect candidates for evaluating classifier

---

Under review as a conference paper at ICLR 2022
Original
ERM
DAT
Mixed-Same
Mixed-Rand
Figure 3: Images from Mixed-Same and Mixed-Rand and corresponding attention heatmaps of ERM and DAT, DAT effectively fixed the problem of excessive attention on uncorrelated background information.
sifier relies too much on background information, will perform poorly in the test domain where objects and backgrounds are disentangled. In particular, experiment results show that ERM achieves test accuracy of 71 71.9%, while DAT achieved 72.6% on the test domain with random background, which means that DAT has better generalization ability by effectively removing background infor- mation. Sample images from the dataset and corresponding attention heatmaps are shown in Figure 3 which demonstrate that ERM may lose its focus when background correlation is broken while DAT doesn't. Details for the experiment are shown in Appendix A.I
5
EXPERIMENTS
5.1 EXPERIMENTAL SETUP
For the experiments, we follow the setting in Ye et al. 2202 and evaluate OOD generalization on both the two types of distribution shift, diversity shift and correlation shift. In particular, we select four representative tasks. For correlation shift, we use CMNIST (Arjovsky et al. 2019). synthetic dataset on digit classification which has color as the spurious feature, and NICO (He et al.) 2020), real-world dataset object classification with context the spurious feature. As for diversity shift, we use PACS (Li et al. 2017) and Terra Incognita (Beery et al. 2018), which are both real-world datasets with four domains. To ensure fair evaluation, conduct all our experiments following the DomainBed (Gulrajani & Lopez- Paz 2021). Specifically, we use the same strategy for dataset splitting and model selection in Ye et (202T) for each of these tasks. For datasets except for NICO, one of the domains is used as the test domain. We train the models in each run treating
evaluation pipeline
of the domains as the test domain with the rest of the domains training domains. Then report the average accuracy of all domains. For NICO, the training, test, evaluation, and test domains are predefined. We train the models on training domains, evaluate them on the evaluation domain for model selection, and report their accuracy on the test domain. More details of the experimental settings could be found in Appendix A..2
When training models using DAT, we first perform standard data augmentation Gulrajani & Lopez- Paz (02T), then proceed with the update on perturbation and model parameters as shown in where the perturbed samples are clipped to the legal range after data augmentation.
As discussed in Section 4 DAT can reduce the influence of background even when no domain labels are given, which corresponds to the single-source domain generalization setting, To see how this could help in this setting, we conduct experiments which strengthen this claim. Experimental setting and results can be found in Appendix
5.2 EVALUATION ON BENCHMARK DATASETS
We compare our results with previous works, including vanilla ERM, invariance-based methods including IRM (Ahuja et al. 2020). robust optimization methods including GroupDRO (Sagawal
et al. 2020), distribution matching methods including MMD (Li et al. 2018b) and CORAL Sun & Saenko 2016), a method based on domain classifier (DANN, (Ganin et al. (016)) and various
other algorithms. The results for the CMNIST dataset are adopted from Guirajani & Lopez-Pa7

---

Under review as a conference paper at ICLR 2022
Table 1: Test accuracy (%) on four representative tasks for OOD Robustness. According to OOD- Bench (Ye et al.] 202I), two are dominated by correlation shift, CMNIST and NICO, and two are dominated by diversity shift, PACS and Terralnc. We highlight the top two results on each task.
Correlation shift
Diversity shift
Algorithm
Avg
CMNIST
NICO
PACS
TerraInc
ERM (Baseline)
58.5 + 0.3
71.4 1.3
81.5 + 0.0
42.6 + 0.9
63.5
VREx (Kuuege et al. 2021
56.3 +
71.0
81.8
40.7 0.7
62.5
GroupDRO Sagawa
2020
61.2 0.6
71.8 1.8 0.8
80,4
36,8
1..81.11 1.1
62.6
IRM
(Ahuja el al. 2020
7
67.6
81.1
42.0 1.8
65.2
ARM (Zhang et al 2020
6.72
63.9
810
3.74
61.9
RSC (Huang et al. 2020
0.5
0.3
0.4
43.6
63.7
DANN (Gamn el al. 2016
0.2
6..6
81.1
0.2
61.9
MMD (L1 el al.
6.7
6..3
0.2
3.4
62.9
MIL. Blanhhard et al. 2021
0.3
0.6
0.4
38.9
62.0
MLDG (Li cf al. (2)) 8a
58.4
516+ 6.1
73.0
27.3
2.0
52.6
SagNet (Nam et al. 2221
58.2
69.3 1.0
81.6
4.7
62.9
CORAL [Sun & Sacnko, 2016
57.6 0.5
68.3 1.4
81.6 0.6
38.3 0.7
61.5
Mixup Yan et
2020)
0.2
66.6
7.6
39.8
61.2
AT (sample-wise)
(Goodfellow al. 2014]
57.9 0.4
7.7
82.0 0.2
42.6 0.3
63.3
UAT (Shafahi
(2020
58.7 2.3
89.1+1.2
8
41.9
1.8
62.6
WRM (Sinha ct al.
20018
+..93333
1.0
80.4
26.1
+ 1.5
58.2
ADA [Volpi et al. 2018
56.3 0.4
1.9
8.2
41.2
0.7
61.8
DAT (our work)
68.4
72.6
8.1
42.7
0.7
66.4
2021), which is the average of three domains, while the results of the other datasets are adopted
from
Ye et al. (202T). Apart from that, implement and test four AT based algorithms including saiple-wise adversarial training (AT (Goodfellow et al. 2014)) universal adversarial training (UAT
(Shafahi al. 2020) (which do not distinguish between different training domains), WRM (Sinha
ct al.
2018), and Adversarial Data Augmentation (ADA (Volpi et al. 2018)).
variety of OOD benchmark datasets, DAT has performance consistently better than ERM. In particular. DAT achieves statc-of-ther tfrt---rtthe-tttt- performance under both di- versity and correlation shift. In comparison, IRM only outperforms DAT on CMNIST and sample- wise AT fails on three of the four datasets. Com- pared to other AT-based algorithms (e.g., sample- wise AT, UAT, WRM, and ADA), DAT has superior performance by considering domain-wing wise pertur- bation that removes varying spurious fea- tures. The results demonstrate DAT"s effectiveness in dealing with domain discrepancy. RSC HHuang al. (2020) has the most superior performance un- der diversity shift, this may due to that RSC masks large gradients, which prevents the model from be- coming ever-confident by only capturing a few dom- inant features that are not invariant. However, RSC does not use domain labels, which makes fail to consider the change of correlation between features and label class when generalizing to new domain and leads poor performance under correlation shift. In comparison, DAT solves the same problem in reversed way, by perturbing inputs reduce dominant features, and results in a "weaker" augmentation compared to RSC under diversity shift. But DAT considers domain dif- ference explicitly, thus having better performance than RSC under correlation shift. We also note that DAT performs slightly worse than IRM on CMNIST, which could be due to the data genera- tion process of CMNIST. As synthetic dataset, CMNIST uses colored digits instead of colored background as the spurious features. In contrast, in real-world datasets like NICO (Figure 2 the spurious features mainly lie in the background instead of the object. This suggests that our method is more suitable for alleviating real-world distribution shifts.
From Table [ observe that
Table 2: Comparison of test accuracy of dif- ferent perturbation radius and step size a of 2--norm bounded DAT on the NICO dataset.
Radius e
Step Size a
Acc (%)
10-4,10 11033.1
72.6 + 1.7
110-2,10*
72.0 + 2.1
[10-2,10-1]
68.9 + 1.5
[10-3,10-2]
71.2 + 0.4
[10-1,109]
[10-2,1011]
66.6 + 1.7
[10-1,10
69.4 + 0.4
10-3,
64.6 + 0.3
[10% 10']
10-2.10-1
67.9 + 2.0
|10-1,109 100
67.4 + 0.4
8

---

Under review as a conference paper at ICLR 2022
5.3 ANALYSIS
We conduct experiments to understand better what our algorithm learns and how the magnitude of hyperparameters affects its performance.
Qualitative Analysis through Semantic Graphs We use GradCam (Selvaraju et al. 2017 Gildenblat & contributors, 2021) to visualize the attention heatmaps of models trained by ERM, sample-wise AT, and DAT on the NICO dataset. The results are shown in Figure where can see that DAT puts more attention lated background, while ERM and sample-wise AT tend to use environmental features instead.
the object itself instead of the strongly corre-
Perturbation Radius and Step Size We investi- gate the effect of perturbation radius & and perturba- tion step size a on the NICO dataset. The results are shown in Table 2 From the results, we find that the perturbation radius has huge impact on the OOD accuracy. When E is too large (> 10-1). it begins hurt the invariant feature and causes performance degradation (from 72.9% to 67.9%). The step size a has smaller influence, and choosing a value about // 100 to 1/10 times the size of would be appropri- ate.
Forest
Heach
Snow
Grass
Norm of Perturbations We also investigate the ef- fect of the norm used in DAT. We perform experi- ments on the NICO dataset using foo -norm bounded DAT. The results are shown in Table 3 Although there are slight differences, DAT bounded by both can achieve state-of-the-art per-
Original
ERM
AT DAT
Figure 4: (sample-wise) AT. and our DAT on the NICO dataset. Compared to ERM and AT, DAT has a more precise focus on the object itself.
Attention heatmaps of ERM,
2 and formance (72.6% and 72.5%) on the NICO dataset.
DISCUSSIONS Comparison with Sample-wise AT Previous works (Yi et al. 2021; Hendrycks et al. 2021) try exploit sample-wise AT as data augmentation strategy to get higher OOD performance. However, the performance only improves when the distribu- tion shift is dominated by diversity shift, e.g., noise, and blurring. Otherwise, the performance might be degraded, as shown in Table [ One possible expla- nation that because sample-wist wise AT fails to cap- ture the domain-level variations DAT. As result, could possibly add perturbations to the invariant features and lead to inferior performance, espe- cially under correlation shift.
Table 3: Test accuracy of l.x -nor bounded DAT on the NICO dataset.
Radius e
Step Size a
Acc (%)
11033 10-2
[10- 10-3)
68.5 + 0.2
[10 2 10-1
10 3 10-2
67.9 + 2.4
[10-1, 109
[10- 3, 10
72.5 + 1.6
Comparison with Invariant Causal Prediction A thread methods including ICP (Peters et al,, 2016), IRM (Arjovsky et al.] 2019), and IGA (Koyama & Yamaguchi 2020) try find the invariant data representations that could induce an invariant classifier. They have superior performance on synthetic datasets like CMNIST but fail to outperform ERM on real-world datasets (tasks dominated by both correlation shift and diversity shift). We believe their failures might be attributed to the lack of prior information their invariant learning principles. While our DAT, we effectively exploit the foreground-backgronn difference in image classification tasks through domain-wise perturbations.
CONCLUSION
In this work, we carefully analyze the similarity between IRM and adversarial training in a domain- wise fashion and establish a formal connection between OOD and adversarial robustness. Based on this connection, we propose new adversarial training method for domain generalization, namely Domainnwiise Adversarial Training (DAT). We show that it could effectively remove the spurious background features in image classification and obtain superior performance on benchmark datasets. Notably, our DAT could outperform ERM consistently on tasks dominated by both correlation shift and diversity shift, while previous methods typically fail in of the two cases.

---

Under review as a conference paper at ICLR 2022
REFERENCES
Kartik Ahuja, Karthikeyan Shanmugam, Kush Varshney, and Amit Dhurandhar. Invariant risk min- imization games. In ICML, 2020.
Martin Arjovsky, Léon Bottou, Ishaan Gulrajani, and David Lopez-Paz. Invariant risk minimization. arXiv preprint arXhv:1907.0289)) 2019.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of security: Circumventing defenses to adversarial examples. In ICML, 2018.
Sara Beery, Grant Van Horn, and Pietro Perona. Recognition in terra incognita. In ECCV, 2018.
Gilles Blanchard, Aniket Anand Deshmukh, Ürün Dogan, Gyemin Lee, and Clayton D. Scott. Do- main generalization by marginal transfer learning. J. Mach. Learn. Res., 22:2:1-2:55 2021.
Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert- Herbert-Voss, Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel Ziegler, Jeffrey Wu, Clemens Winter, Chris Hesse, Mark Chen, Eric Sigler, Mateusz Litwin, Scott Gray, Benjamin Chess, Jack Clark, Christopher Berner, Sam McCandlish, Alec Radford, Ilya Sutskever, and Dario Amodei. Language models are few-shot learners. In NeurIPS, 2020.
John C Duchi, Peter W Glynn, and Hongseok Namkoong. Statistics of robust optimization: A generalized empirical likelihood approach. Mathematics of Operations Research, 2021.
Nic Ford, Justin Gilmer, Nicholas Carlini, and Ekin Dogus Cubuk. Adversarial examples are a natural consequence of test error in noise. In ICML, 2019.
Yaroslav Ganin, F. Ustinova, Hana Ajakan, Pascal Germain, H. Larochelle, François Laviolette, Mario Marchand, and Victor S. Lempitsky. Domain-adversarial training of neural networks. J. Mach. Learn. Res., 17:59:1-59:35, 2016.
Jacob Gildenblat and contributors. Pytorch library for cam methods. https://github: com/ _acobgi grab 2021.
Tejas Gokhale, Rushil Anirudh, Bhavya Kailkhura, Jayaraman J. Thiagarajan, Chitta Baral, and Yezhou Yang, Attribute-guider adversarial training for robustness to natural perturbations. AAAI, 2021.
Ian J Goodfellow, Jonathon Shlens. and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572. 2014.
Ishaan Gulrajani and David Lopez-Paz. In search of lost domain generalization. In ICLR, 2021.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. CVPR, 2016.
Yue He, Zheyan Shen, and Peng Cui. Towards non-iid image classification: A dataset and baselines. Pattern Recognition, pp. 107383, 2020.
Dan Hendrycks, Steven Basart, Norman Mu, Saurav Kadavath, Frank Wang. Evan Dorundo, Rahul Desai, Tyler Zhu, Samyak Parajuli, Mike Guo, Dawn Song, Jacob Steinhardt, and Justin Gilmer. The many faces of robustness: A critical analysis of out-of-distribution generalization. In ICCV, 2021.
Zeyi Huang, Haohan Wang, Eric P. Xing, and Dong Huang. Self-challenging improves cross-domain generalization. In ECCV, 2020.
Pritish Kamath, Akilesh Tangella, Danica J. Sutherland, and Nathan Srebro. Does invariant risk minimization capture invariance? In AISTATS, 2021.
Masanori Koyama and Shoichiro Yamaguchi. When is invariance useful in an dustof-distt generalization problem? ? arXiv preprint arXiv:2008.0/888 2020.
10

---

Under review as a conference paper at ICLR 2022
David Krueger, Ethan Caballero, Jöm-Henrik Jacobsen, Amy Zhang, Jonathan Binas, Dinghuai Zhang, Rémi Le Priol, and Aaron C. Courville. Out-of-distribution generalization via risk extrap- olation (rex). In ICML, 2021.
Da Li, Yongxin Yang. Yi-Zhe Song, and Timothy M Hospedales. Deeper, broader and artier domain generalization. In ICCV, 2017.
Da Li, Yongxin Yang, Yi-Zhe Song, and Timothy M Hospedales. Learning to generalize: Meta- learning for domain generalization. AAAI, 2018a. 8a.
Haoliang Li, Sinno Jialin Pan, Shiqi Wang, and Alex Kot. Domain generalization with adversarial feature learning. In CVPR, 2018b.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018.
Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. In CVPR, 2017.
Hyeonseob Nam, HyunJae Lee, Jongchan Park, Wonjun Yoon, and Donggeun Yoo. Reducing do- main gap by reducing style bias. In CVPR, 2021.
Jonas Peters, Peter Bühlmann, and Nicolai Meinshausen. Causal inference by using invariant pre- diction: identification and confidence intervals. Journal of the Royal Statistical Society. Series (Statistical Methodology), 2016.
Fengchun Qiao, Long Zhao, and Xi Peng. Learning to learn single domain generalization. CVPR, 2020.
Hamed Rahimian and Sanjay Mehrotra. Distributionally robust optimization: A review, arXiv preprint arXiv:1908.055: 0065599000669..... 2019.
Elan Rosenfeld, Pradeep Kumar Ravikumar, and Andrej Risteski. The risks of invariant risk mini- mization. In ICLR, 2021.
Shiori Sagawa, Pang Wei Koh, Tatsunori B. Hashimoto, and Percy Liang. Distributionally robust neural networks. ICLR, 2020.
Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adver- sarially robust imagenet models transfer better? In NeurlPS, 2020.
Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based local- ization. In ICCV, 2017.
Ali Shafahi, Mahyar Najibi, Zheng Xu, John P. Dickerson, Larry S. Davis, and Tom Goldstein. Universal adversarial training. In AAAI, 2020.
Aman Sinha, Hongseok Namkoong, and John Duchi. Certifying some distributional robustness with principled adversarial training. In ICLR, 2018.
Baochen Sun and Kate Saenko. Deep coral: Correlation alignment for deep domain adaptation. In ECCV, 2016.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, D. Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. CoRR, abs/1312.6199, 2014.
Riccardo Volpi, Hongseok Namkoong, Ozan Sener, John C Duchi, Vittorio Murino, and Silvio Savarese. Generalizing unseen domains via adversarial data augmentation. In NeurIPS, 2018.
Kai Yuanqing Xiao. Logan Engstrom, Andrew Ilyas, and Aleksander Madry. Noise signal: The role of image backgrounds in object recognition. In ICLR, 2021.
Shen Yan, Huan Song, Nanxiang Li, Lincan Zou, and Liu Ren. Improve unsupervised domain adaptation with mixup training. arXiv preprint M0Xiv2001.00677 2020.

---

Under review as a conference paper at ICLR 2022
Nanyang Ye, Kaican Li, Lanqing Hong, Haoyue Bai, Yiting Chen, Fengwei Zhou, and Zhenguo Li. Ood-bench: Benchmarking and understanding out-of-distributtin generalization datasets and 2021. 2021.
algorithms. arXiv preprint vrXiv:2106.0372.)
Mingyang Yi, Lu Hou, Jiachen Sun, Lifeng Shang, Xin Jiang, Qun Liu, and Zhi-Ming Ma. Improved ood generalization via adversarial training and pre-training. ICMI., 2021.
Marvin Zhang, Henrik Marklund, Nikita Dhawan, Abhishek Gupta, Sergey Levine, and Chelsea Finn. Adaptive risk minimization: meta-learning approach for tackling group distribution shift. arXiv preprint arXiv:2007.0295: 2020.
A EXPERIMENT SETTINGS AND MORE DETAILED RESULTS
We train all the models based on the DomainBed benchmark presented in Gulrajani Lopez-Per Paz 2021..
A.1 MIXED-SAME AND MIXED-RAND
To construct the dataset, we use the validation set of Mixed-Same (4185 images) provided by Xiao et al. ( as the training environment and use the validation set of Mixed-Rand (4185 images) as the testing (OOD) environment.
For training, we use pretrained ResNet- 18 as backbone and train it for 5000 iterations. The hyperpa- rameters are same to those proposed Gulrajani & Lopez-Paz) (2021), except that the learning rate searching interval is altered to 110-5.5 10-1.), while we set hyperparameters search space of DAT
as 015- 10"), a E [10-1.5 1.5 10-1].
A.2 TYPICAL OOD DATASETS
We conduct experiments on four typical OOD datasets, including CMNIST, NICO, Terra Incog- nita, and PACS, We split the NICO dataset using the same strategy in Ye al. (2021) for a fair comparison.
For network architecture, models trained CMNIST adopt the four-layer convolution network MNIST-CNN provided in DomainBed benchmark (Gulrajani & Lopez-Paz (02T). while other datasets use ResNet-18 as the backbone. For Terra Incogmita and PACS, pretrained ResNet-18 is used. While on NICO, we use unpretrained ResNet-18 as the pretraining dataset contains photos that are largely overlapped with ImageNet classes.
For model selection, models trained on PACS and Terra Incognita are selected by saining-domaii validation, which selects the model with highest training accuracy averaged across all training do- mains. For NICO, extra OOD validation set is used. CMNIST, due to the large correlation shift, uses test-domain validation as its model selection criteria.
DAT, AT, and UAT models are trained for an appropriate number of iterations ensure convergence, that is, 5000 for Terra Incognita, 8000 for NICO, 10000 for CMNIST and PACS.
When training NICO using DAT, clamp the single sample adversarial loss to (0,2) to obtain better domain-wise perturbation as suggested in Shafahi et al. 2020).
We use the same hyperparameters those proposed in Ye et al. (2021) whenever possible while setting the hyperparameters search space for DAT, sample-wise AT and UAT as in Table 6 and [ We use DAT with perturbation bounded by fg-norm in experiments. For sample-wise AT, use a 10-step & PGD (Madry et al. 2018).
For WRM. set the step number to 10 in the inner maximization, while searching for the learning rate in the inner maximization in the range [10-2 2 1001] and in the range [10-0.5 100.5], We train the models for 5000 iterations to ensure convergence.
For ADA, we set the step number to 10 the inner maximization, while searching for the adversarial learning rate in the range [10-1, 100.5] in the range (0.5, 1.5), the number of steps in the min-phase
12

---

Under review as a conference paper at ICLR 2022
in the range [100.5, 102.5] and the number of whole adversarial phases in the range [100.5 102). We train the models for 5000 iterations to ensure convergence.
Table 4: Hyperparameter Search Space for DAT on Typical OOD Datasets.
Dataset
Radius
Step Size
CMNIST NICO
[10=],103] 1 [10-2,10-1] [10-1,10²]
[10 110-2,100 10']
1004,107
PACS
[10-?,10']
TerraInc
[10-0.5, 104.]
[10-2,10-]]
Table 5: Hyperparameter Search Space for (sample-wise) AT on Typical OOD Datasets.
Dataset
Radius e
Step Size a
CMNIST NICO
[10-1,10]
110-2, 10 [10-2,10-] 10-
[10-1,109] [10-2,10-1] [10-1,109]
PACS
110-3.10-
TerraInc
[10-2,10-7]
Table 6: Hyperparameter Search Space for UAT on Typical OOD Datasets.
Dataset
Radius e
Step Size a
CMNIST
[10-1,10* 10a 110-2,10-3]
[10-2, 10
NICO
[10-4, 10-9
PACS
[10-1,10* 10
[10-2 10
TerraIne
10
[10-2,10-]
The domain split results for ERM, UAT, and DAT are shown in Table 7 8 and 9
where the results
of ERM on CMNIST are from Gulrajani & Lopez- Paz (20T)) and all other results come from our experiments.
Table 7: Test accuracy of ERM, UAT, and DAT on CMNIST.
(a) Training domain vaidation.
Algorithm
0.1
0.2
0.9
Average
ERM
72.7 + 0.2
73.2 + 0.3
10.0 0.0
52.0 + 0.1
UAT
72.1 + 0.1
13.70.11
10.0 0.1
52.0 0.1
DAT
72.4 - 0.2
73.7
- 0.1
10.2 - 0.2
52.1 - 0.1
(b) Test domain vaidation (Oracle).
Algorithm
0.1
0.2
0.9
Average
ERM
72.3 + 0.6
73.1 0.3
30.0 0.3
58.5 0.3
UAT
75.3 + 6.4
71.9 0.7
29.0 19.00:::: 0.2
58.7 + 2.3
DAT
78.5 4.8
79.3 0.2
4
68.4 2.0
13

---

Under review as a conference paper at ICLR 2022
Table Test accuracy ERM, UAT, and DAT PACS.
(a) Training domain vaidation.
Algorithm
Artpaint
Cartoon
Photo
Sketch
Average
ERM UAT
80.5 0.8
74.2 0.5
94.7 0.5
72.9 = 2,1 75.5 2.1
80.6 + 0.6 80.7 0.4
79.9 = 0.6
74.7 0.8
92.6 = 0.4
DAT
80.0 + 0.3
77.6 + 0.8
92.6 + 0.9
77.6 + 0.5
82.0 0.1
(b) Test domain vaidation (Oracle).
Algorithm
Artpaint
Cartoon
Photo
Sketch
Average
ERM UAT DAT
79.7 1.0
76.9 + 0.3
94.2 + 0.4
78.3 = 1.5
82.3 0.4
80.4 0.1
75.0 0.4
93.5 - 0.5
79.3 + 0.4
82.0 + 0.6 $.2
0.7
93.9 0.6
78.1 0.4
Table 9: Test accuracy of ERM, UAT, and DAT on TerraInc.
(a) Training domain vaidation.
Algorithm
L100
L38
L43
L46
Average
ERM
53.2 + 1.4
31.9 0.3
50.2 + 0.9
33.6 + 0.3
42.2 + 0.4
UAT
47.2 + 3.3
36.9 1.6
50.3 - 0.3
32.8 + 0.3
41.8 + 1.2
DAT
5
15.1221
50.3
+ 0.3
31.7
0.6
42.7 - 0.7
(b) Test domain vaidation (Oracle).
Algorithm
L100
L38
L43
L46
Average
ERM
55.8 +
40.8 2.0
49.8 + 1.3
35.0 + 0.2
45.3 + 0.3
UAT
50.5 + 2.6
40.3 1.3+:..2 0.2
50.7 +: 0.3
34.3 0.5
14.0
DAT
$4.12.00 2.3
4 2.1
0.8
35.1 1.0
0.6
B ON SINGLE-DOMAIN DOMAIN GENERALIZATION
can be seen that our proposed DAT can also work with a single domain. In this case, DAT reduces to UAT special case. In this section, present deeper understanding the effectiveness of DAT on single-domain generalization, as well as the comparison between DAT and ensembled UAT. Specifically, in Section B.T we perform experiments under single-source domain generaliza- tion setting, which show that DAT is still effective under this scenario by removing the common background in the domain. In Section B.2 we compare DAT with the ensemble of UAT, the results suggest that DAT has extra benefits by training a single model on multiple domains.
B. SINGLE-SOURCE DOMAIN GENERALIZATION
To show that our method can also be applied to single-domain generalization scenarios, we conduct experiments with similar settings to Appendix A.2 on the four benchmark datasets, except that train on one of the domains and report its test accuracy on all other domains. For the NICO dataset, as it comes with validation domain, train the models validation domain for model selection, then report its accuracy on the test domain.
of the training domains, using the
We train all models using ERM/DAT for 5000 iterations ensure convergence and set the hyper- parameter searching space of DAT as shown in Table I0 shown in Appendix A.2
All other settings are the same as those
14

---

Under review as a conference paper at ICLR 2022
Table 10: Hyperparameter searching space for DAT on typical OOD datasets (single-source domain generalization)
Dataset
Radius e
Step Size a
CMNIST
[10-1, 100-2,10-1
[10 ",0=,110)
NICO
10-4,10-3
PACS
[10 [10-2,10-"]
[10-9,10 10-0
Terralnc
[10-0.5,10-7]
[10-2,10-1]
We list the domain domain-average average results in Table
Table 11: Average test accuracy of ERM, DAT on four representative tasks (single-source domain generalization)
Algorithm
CMNIST
NICO
PACS
TerraInc
Avg
ERM
45.8
63.2
59.8
27.3
49.0
DAT
46.0
64.4
59.9
28.1
49.6
We can see that our DAT enjoys superior performance on all four datasets compared to ERM, either under correlation shift diversity shift. Although the difference not as significant as in the multiple domain setting, it shows that our DAT works for both single-domain and generalization scenarios. particular, advantages are more significant with multiple domains, where the domain-wise perturbation mechanism is more effective.
The domain split results for ERM and DAT under single-source domain generalization setting are shown in Table 12a to 12h
B.2 COMPARISON WITH THE ENSEMBLE OF UAT
To show that models trained using DAT on trained single domains, train voting classifiers CMNIST and NICO using UAT. The models are trained separately on each domain and then perform an equal weight voting to get prediction results. The results shown in Table B
are not a trivial ensemble models
Table 13: Results of Ensemble UAT and DAT on CMNIST and NICO
Algorithm
CMNIST
NICO
Ensemble UAT
58.2 + 2.3
60.8 = 0.2
DAT
68.4 + 2.0
72.6 + 1.7
From the results, can see that invariance learned by DAT indeed performs much better than triv- ial ensemble of independent UAT models. We believe that training DAT on multiple domains can help extract the domain-invariant features through sharing the same model across domains while removing domain-vany varaiin features with domain-specific perturbations. Spurious background infor- mation from multiple domains can help the classifier to identify the truly In comparison, singlc-domain UAT only has access to a single domain and can only learn invariance of single domain, which leads to inferior performance.
features.
C PROOFS
We give proof of Remark first, then similar technique prove Proposition 1
15

---

Under review as a conference paper at ICLR 2022
Table 12: Test accuracy (single-source domain generalization)
(a) ERM on CMNIST
Training Domain
0.1
0.2
0.9
Avg
0.1
79.8 + 0.2
21.2
50.5
0.2
88.7 0.4
35.2
1.3
62.0
0.9
21.0 + 0.9
29.1 + 0.7
25.1
(b) DAT on CMNIST
Training Domain
0.1
0.2
0.9
Avg
0.1
80.0 + 0.1
27.9
4.7
54.0
0.2
90.0 + 0.1
32.4
+ 1.0
61.2
0.9
18.3
1.1
27.1 171111
22.7
(c) ERM on NICO
Training Domain
Test Accuracy
56.8 3.5
2
69.6 + 2.0
Avg
63.2
(d) DAT on NICO
Training Domain
Test Accuracy
61.7 + 0.9
2
67.1 + 0.3
Avg
64.4
(c) Test accuracy of ERM PACS (single-source domain generalization)
Training Domain
Artpaint
Cartoon
Photo
Sketch
Avg
Artpaint
64.9 = 0.7
94.2 + 0.1
61.5 + 4.1
73.5
Cartoon
61.9 2.7
76.6 + 1.6
69.5 : 1.1
69.3
Photo
66.9 + 0.3
26.9 0.1
35.5 :: 0.7
43.1
Sketch
47.3 0.1
65.7 = 0.9
46.6 0.8
53.2
(f) Test accuracy of DAT on PACS (single-source domain generalization)
Training Domain
Artpaint
Cartoon
Photo
Sketch
Avg
Artpaint
59.6 = 0.0
94.2 + 0.8
48.7 2.3
67.5
Cartoon
68.1 1.11:.11
83.9 + 1.0
69.1 1.3
73.7
Photo
64.5
27.6 5.8
30.9 + 4.5
41.0
Sketch
52.2 0.2
63.4 1.4
56.4
57.3
(g) Test accuracy of ERM on Terralnc (single-source domain generalization)
Training Domain
L100
L38
L43
L46
Avg
L100
24.9 4.1
26.8 0.5
27.1 4.5
26.3
L38
42.3
12.5 1.2
13.2 + 1.5
22.7
L43
34.2
31.9
0.9
30.1 0.5
32.1
L46
24.9 6.2
13.0 2.8
46.6 + 2.0
28.3
(h) DAT on Terraine
Training Domain
L100
L38
L43
L46
Avg
L100
23.3 1.4
24.3 + 0.7
16.7 1.2
21.4
L38
7.4
17.3 1.0
16.3
0.4
26.1
L43
7.4
32.0 - 7.6
32.9 1.5
33.4
L46
24.3 - 4.0
23.2 = 0.2
4..5
31.7
16

---

Under review as a conference paper at ICLR 2022
Remark 1 (Equivalence under Single-sample Environments) When the environments degener- ate into a single data point, we have the following relationship: If is sufficiently small. then for 3 4 as a deep network with any activation function, the penalty term IRMv1 (Eq. 4 each
sample and the square of the maximization term of Linearized version of DAT (L.AA,, obtained by first-order approximation of DAT)
PenaltyLDAT = (o (AT =dx)
(14)
on each sample with 82 = Fex only differ by a fixed multiple e². Which is formally stated as Penalty e² .PenaltyRMM-
(15)
Proof of Remark 1
Note that presume + is piece- wise linear. We represent the output logit of the given deep network as 3 ((x)= = 33" 4y. where 4 is the matrix related to sample x due to the fact of different activation patterns.
We first derive the form of PenaltyLDAT by first-order approximation of Eq.
E(3" ((r + 6c), - E(3 (()),)) ~ (V ())).)).6.)
(16)
Letting 5, Iex, we have that
PenaltyLDAT (v
(17)
The penalty term of IRMv1 each sample is as follows:
4 w=10 - log(o (w (413
d'w (v9 क
(())
aw (w/3 1
(18)
= || (1 a (y/
(xx)
= (1 - σ oyy ((x)))
x|
For LDAT, note that the gradient w.r.t x equal
V V (z)) -(1 - a (xx)))y)² 22
So the square of the penalty term of LDAT on each sample with perturbation tea is:
( log( ( (z))), tex)| e1 o (xx)))² || lx,l
(19)
which is identical to Eq. with difference of multiple e².
Proposition 1 Consider each De as the corresponding distribution of a particular training do- main e. For any & as a deep network with any activation function, the penalty of IRMv1, PeNaltyıRM (Eq. 4. could be expressed as the square of reweighted version of the penalty term of the above approximate target, DanaltyDaTEEA 70), on each environment with coefficients related to the distribution De,, which could be stated as follows:
PenaltyIRM |E, 2 and PenaltyDAT |ED,
(20)
where L, (yg T 2yy)) T....
Proof of Proposition 1 For IRMv1, from the proof of Remark I we know 1 (8 4). y) -(1 oyy8 p.r))y² d
(21)
So that PeNaltyIRM (suppose derivation and integration are commutable)
V Vele=noft (8 2))|| = ||Bp. (1 oly3 2xx))y² 2a
(22)
17

---

Under review as a conference paper at ICLR 2022
For DAT, on each environment
max ED, [<( Φ(x 5c), - (()T y))
~ max ED. [V ((x).
(23)
max (ED, V. 8(z).)) .5c)
l|b.1l
=E [ED
[ (z).
So PenaltyDAT is
ED. ( 5)] ||| = ED. (-11- ayB ( æz]1
(24)
So know PeRaltyIRM be regarded the square of reweighted version of PenaltyDAT with coefficient on each sample inside the expectation x.
18


Reviews:
[{"review_id": "e5DX3NqYEby", "reviewer": "Reviewer_Gexh", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "**Strengths**\n\n- The idea of performing universal adversarial training at domain level for domain generalization is new and interesting. It is reasonable to assume each domains will be biased towards specific nuisances that result in biased classifiers, and I believe that tackling those at domain level instead of dataset or sample level is promising. Results suggest the efficacy of this approach.\n\n- The paper is overall well written and pleasant to read.\n\n- The GradCAM analysis (Figure 3) is very effective, and supports the paper's claims. I would encourage the Authors to include more of those in the supplementary material - they are very informative. \n\n**Weaknesses**\n\n- *Experimental analysis.* The numbers in Table 1 are not from (Gulrajani and Lopez-Paz, ICLR 2021). Such work provides a fair way of reporting consistent, statistically significant results across the literature, and it has been widely accepted by the community. If there is any reason not to use the baselines from this work, it should be explained. Also, more difficult datasets are missing - the most important being DomainBed. Related to Table 1, some bold numbers are not really superior to baseline results in a statistically significant fashion - for example, on NICO and Terra Incognita overall superiority of the proposed method over ERM cannot be claimed.\n\n- *Missing baselines/related work.* (Shankar et al. ICLR 2018) and (Volpi et al. NeurIPS 2018), which are the two main works exploring adversarial training for domain generalization (multi-source and single source, respectively) are not cited. These are the two main references that address AT for DG, and given the nature of the proposed method they should be included in the experimental analysis.\n\n- *Relationship between DAR and IRM.* I cannot understand the connection provided in Section 3.3. While I see the similarity between the two regularizers (Sec. Eq. 10 and 8) - the two are fundamentally different: the DAT one penalizes large gradients wrt to the input, whereas the IRM one penalizes large gradients wrt the classifier parameters. I cannot understand how the two derivatives are compared in Eq. 11 and 13. Can the Authors comment more on this? On a different and more subjective note, I do not believe that an analysis based on a single-sample domain assumption if informative for the paper (Remark 1).\n\n**Clarity/writing:**\n\n- The description of correlation-shift and diversity-shift in my opinion is not clear: a figure and/or a concrete example would help.\n\n- A better reference for AT - when introduced - would be (Goodfellow et al. ICLR 2015), which actually propose it. (Madry et al., ICLR 2018) propose methods to do it more effectively.\n\n- (Gilmer et al., ICML 2019) explore the connection between AT and OOD robustness, opening several questions; (Taori et al., NeurIPS 2020) discuss the impact of AT to OOD robustness in a variety of conditions. These work should be at least mentioned.\n\n- When introducing DRO in the contenxt of AT/DG, (Sinha et al., ICLR 2018) and (Volpi et al., NeurIPS 2018) better fit as references in my opinion, since they indeed propose to use AT for DRO (the former for adversarial robustness, the latter for DG).\n\n- I am assuming that also standard data augmentation is performed, as suggested in (Gulrajani and Lopez-Paz, ICLR 2021). Does it happen after Step 1 in Algorithm 1? This should be clarified.", "summary_of_the_paper": "This paper focuses on domain generalization (DG). It proposes a method based on adversarial training (AT): the main idea is learning universal adversarial perturbations at domain level (domain adversarial perturbations, DAT), and rely on those within a standard AT routine. The relation between the proposed DAT and invariant risk minimization (IRM) is provided, and the method is empirically tested on standard domain generalization benchmarks.", "summary_of_the_review": "I think the idea of treating every domain independently while performing AT for DG is very interesting. It is indeed reasonable to assume that each domain will rely on different nuisances that are not relevant for the task at hand, and removing those at domain level seem to be indeed effective.\n\nYet, I'm not fully convinced by the experimental analysis and the connection with IRM (in order of importance, in my assessment). (Gulrajani and Lopez-Paz, ICLR 2021) provide clear guidelines to compare DG methods in a fair fashion, and this benchmark has been widely accepted in the community (cf. recent works on DG). Since this benchmark is embraced in this submission, I do not understand why Table 1 i) provides worse performing baselines and ii) does not include results related to all the benchmarks.\n\nI look forward reading the Author response and participating in the follow-up discussions.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "Not applicable"}, "extra_text": {}}, {"review_id": "dYyzVQ52n6", "reviewer": "Reviewer_HCbA", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n- The paper is well written and explores the challenging Domain Generalization settings.\n- The paper highlights a relationship between IRM and AT\n- Empirical results show that the method might be better than ERM for Domain Generalization settings.\n\nWeaknesses:\nNovelty.\n- DAT is a trivial adaptation of UAT to DG settings.\n- Furthermore, UAT is not compared to DAT in the experiments. \nEmpirical results.\n- The advantage of the proposed DAT algorithm on diversity shift tasks is minimal compared to ERM.\n- The aggregated performance improvements are mostly due to improvements in the CMNIST task. CMNIST is a synthetic digits dataset whose practical interest could be regarded as inferior compared to images datasets.\n- Lack of results on domain splits. These could have been useful to get an high level insight on which scenarios the method is working best.\n- Related to the above comment: there is no discussion on failure cases. Despite improving over ERM, it is hard to believe that the proposed method is improving in every split. A discussion on the potential downsides could have been as valuable as the method itself.", "summary_of_the_paper": "The paper explores the relationship between Invariant Risk Minimization and Adversarial Training and proposes Domain-wise Adversarial Training, an adaptation of UAT designed specifically as a data augmentation layer for Domain Generalization settings.\nExperiments on four benchmark datasets suggest that the proposed approach might be beneficial for DG when target domains suffer correlation/diversity shifts.", "summary_of_the_review": "Although the inquired relationship between IRM and AT is interesting, the proposed approach is only marginally novel, as it is a simple adaptation of UAT to Domain Generalization settings. UAT acts as data augmentation, so it is not surprising that it is beneficial in DG settings. \n\nFurthermore, I am not convinced by experimental results: there is only a limited insight on favorable scenarios, as domain split results are not presented, and improvements are mostly due do very good performance on a single dataset consisting of synthetic digits.\n\nStill I am looking forward for the authors' response, and I hope that they can address my concerns (see Weaknesses).", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "4q42lUrNS7-", "reviewer": "Reviewer_LGzX", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "# Strengths\n- The paper is (in my knowledge) one of the first to study the connections between methods for adversarial robustness and OOD generalization, whereas previous work has studied the connection between robustness vs in-domain accuracy, and OOD generalization vs in-domain accuracy.\n- The structure and writing is clear (apart from minor grammatical errors) and the main idea of the paper is well stated.\n\n# Weaknesses\n1. The theoretical derivations in Section 3 assume that multiple environments are available for training.  The proposed method (DAT) also relies on this assumption.  While this may be a useful assumption for settings in which multiple environments are indeed available (eg. PACS), it does not hold for benchmarks such as \"DIGITS\" (train on MNIST, test on 4 other datasets) where only a single environment is available (aka single-source domain generalization).  On the other hand, standard adversarial training makes no such assumption. It would be useful if the authors can shed light on whether the connection between IRM and DAT exists for single-source domain generalization. \n2. The introduction and abstract mentions domain-invariant features and distribution shift/OOD generalization.  But the paper only deals with the special case of \"multi-source\" or multi-environment domain generalization.  It is not clear whether DAT (and IRM) would also work for single-source domain generalization.  The theory and empirical results in this paper do not provide any insights into this.  I would recommend making this distinction clear. \n3. The presentation of the experiments and results could be improved substantially.  Critical details about the datasets, which environment/domains are used for training/testing are missing.  This makes it hard to interpret the results.  \n4. Details about other baselines from Table 1 are missing (what type of training do they use, do some of these fall under AT/IRM/ERM?). Why is RSC the best model under diversity-shift? What is the difference between RSC and DAT that could be the reason?\n5. There is little analysis of why DAT is better than IRM on some domains and worse on others.  While the visualizations in Figure 2 and 3 are useful, they are anecdotal and do not provide analysis at scale.\n\n# Questions\n- From Algorithm 1 it seems that N domains , N different values of $\\delta_e$ are updated and stored (one for each domain).  One could also think of adversarial training separately on each domain, thereby obtaining N different values of $\\theta$. These can be ensembled to get a prediction.  How does DAT compare with such an \"ensembling\" of AT applied separately to each domain?\n- From Table 1, it appears that sample-wise AT is worse than ERM for all 4 benchmarks\n    - On CMNIST:  AT < ERM < DAT < IRM\n    - On NICO:  IRM < AT < ERM < DAT\n    - On PACS:  AT < IRM < ERM < DAT\n    - On TerraInc:  IRM < ERM~=AT < DAT\n\n    This means that while the while the comparative relation between IRM and DAT is somewhat clear, that between IRM and AT is mixed.  \n    What is the insight here?  Why is IRM better than AT in some case, and worse in others?\n-  It is stated that colored backgrounds are more realistic than colored digits.  Why is it so?  Why is it more \"realistic\" to have spurious correlations in the background?  For instance, the SVHN digits dataset contains digits with both colored backgrounds and colored content (digits).  Perhaps this additional benchmark could be used to substantiate the statements that hypothesize why DAT < IRM for CMNIST.\n\n# Feedback\n- Footnote 1 is very important, and with the growing number of papers on adversarial robustness, ood generalization, domain shift, etc., it is prudent to point out conflicting/equivalent terminology, as is done by the authors here.\n- Page 1. Paragraph 1. \"carefully designed perturbations\" -- I would advise the authors to distinguish between \n    1. perturbations optimized for each image (i.e. using gradient descent like in Madry et al.) \n    2. universal adversarial perturbations (Moosavi-Dezfooli et al. CVPR 2017 https://arxiv.org/abs/1610.08401 among others) and \n    3. \"common corruptions/perturbations\" (Hendrycks et al. ICLR 2019 https://arxiv.org/abs/1903.12261)\nPerhaps it would be useful to state which of these are designed, and which of these are simply learnt.\n- To add to Strengths #1, although a principled study has not been done to connect robustness and OOD generalization, there are some papers that do use adversarial training (adversarial data augmentation) to improve OOD performance or some aspects of distribution shift. For example:\n    1. Volpi et al. NIPS 2018, https://arxiv.org/abs/1805.12018\n    2. Qiao et al. CVPR 2020, https://arxiv.org/abs/2003.13216 \n    3. Gokhale et al. AAAI 2021, https://arxiv.org/abs/2003.13216 \n- Section 3 uses $\\beta$, $\\phi$ for the classifier, while Algorithm 1 uses $\\theta$ -- please make this consistent.\n- It would be better to show the heatmaps from DAT in Figure 1 (similar to Figure 2).\n\n\n# Minor\n## Terminology\n- This is probably pedantic, but in many places the terminology \"diversity-shift task\" or \"correlation-shift task\" is used.  I believe that this should be changed to \"performance under diversity shift\" or \"image classification task under diversity shift\", since *shift is not a task*, but rather a situation for evaluating robustness/generalization.\n\n## Grammar / Typos\n- Page 1. \"are proposed\" --> \"have been proposed\", \"IRM attracts significant attention\" --> \"IRM has attracted signification attention\"\n- Page 1. Para 3. \"promising\" --> promise\n- many instances of subject-verb agreement errors. please run a grammar check when updating this version.\n\n# Review Summary\nThe paper introduces DAT -- a version of adversarial training specifically designed for training datasets containing multiple environments.  Connections between DAT, AT, IRM are derived formally.  While the motivation and theory behind the paper is sound, empirical results are not conclusive and the paper is lacking in terms of analysis and interpretation of results.  Additionally, it is not clear if DAT would also apply for broader cases of domain generalization where there may not be \"known\" environments (i.e. domain labels are not available) or only a single environment/domain is available for training.\n\nDuring discussions with authors, more empirical evidence was provided and most of my questions were addressed.  I am leaning towards acceptance.\n", "summary_of_the_paper": "The paper investigates whether adversarial training (AT) could be used for extracting domain-invariant features, and whether AT can benefit OOD generalization.  The paper first shows the relationship between AT and IRM (invariant risk minimization).  A new version of AT is proposed -- called \"Domain-wise Adversarial Training (DAT)\"; with IRM being a version of DAT.  Results suggest that DAT can outperform ERM under correlation-shift and diversity shift.", "summary_of_the_review": "Well motivated idea that derives connections between IRM and AT; experiments are found lacking.\nDuring discussions with authors, more empirical evidence was provided and most of my questions were addressed.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "0zgGQelquh", "reviewer": "Reviewer_Ywim", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n- The proposed method is novel and an interesting modification/mix of the existing per-sample adversarial training and universal adversarial training (UAT). \n- The connection between IRM and the proposed method is interesting, and the derivation/exposition of the connection is elegant\n- The paper is well written, and the method is well presented\n- The approach outperforms ERM and prior methods on several OOD benchmarks\n\nWeaknesses:\n- The authors claim that adversarial training can handle diversity shift well, but experiments in Table 1 do not support this (AT is worse than ERM in most benchmarks). It is also not easily decipherable if other adversarial methods listed in Table 1 could verify this claim (it might be good to indicate adversarial methods). \n- Given that DAT is a “mix” between AT and UAT, I was missing a comparison to UAT in Table 1\n- The comparison in Table 1 spans only a subset of the datasets used in either Ye et al. (2021) or (Gulrajani & Lopez-Paz, 2021). It would be good to know if the method performs less well on the other tasks or the rationale to limit the comparison to the chosen datasets. \n- I found the experiment in Section 4.2 sounded interesting, but I could not find any results other than Figure 2. Though having some visualization is nice, a quantitative evaluation would be important there.  \n- Although I found the connection to IRM interesting, I was missing insights into why/how the differences in both methods could explain the benefit of DAT. For example, Proposition 1 suggests that IRM is an instance-reweighed version of DAT. It is unclear what the implications of this are on the performance of DAT compared to IRM.", "summary_of_the_paper": "The paper tackles the problem of out-of-distribution (OOD) generalization of deep learning models with a novel adversarial training formulation (DAT) that introduces a shared adversarial perturbation per training domain. \nThe paper further establishes a connection between DAT, Invariant Risk Minimization (IRM), and standard adversarial training (AT). \nThe authors posit that DAT inherits the advantages of IRM (which is effective for correlation shift while it performs more poorly on diversity shift) and AT, which improves upon Empirical Risk Minimization (ERM) for diversity shift.\nExperiments on several OOD benchmark datasets show that DAT outperforms prior works and ERM on average. ", "summary_of_the_review": "The paper tackles a vital problem (OOD generalization) with a novel adversarial training approach. The paper also illustrates an interesting connection to Invariant Risk Minimization. The method is supported by good performance on four OOD benchmark datasets, where it outperforms both IRM and standard adversarial training. Additional insights into the benefits of DAT compared to IRM (given the similarity) and a more extensive quantitative evaluation would strengthen the paper. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper links OOD generalization with adversarial training and argues that adversarial training can help address the problem of OOD generalization. Based on all responses and reviews, there still are novelty concerns in this paper. In the meantime, this paper lacks theoretical justifications. More importantly, DAT only considers very limited situations regarding DG, which also reflects on its experimental results. In the following, I summarize the drawbacks of this paper for the possible revision in the future.

1. It seems not novel to link AT with OOD generalization since two reviewers show some references related to using AT to address DG.

2. From Eq. (9), DAT is based on perturbations rather than transformations. This means that DAT only considers very limited situations regarding DG. In the ordinary DG, source and target domains are from the same meta-distribution, which is clearly a more general case compared to the case considered in this paper. DAT-based AT might mislead the research direction of DG. It would be better to consider smart ways to generate adversarial examples, such as "Pixeldefend: Leveraging generative models to understand and defend against adversarial examples" (ICLR2018).

3. Eqs. (7), (8) and (10) are not rigours. It is not convincing to propose a method based on these formulas.

4. The method doesn't show substantial improvements compared to ERM in most tasks (CMNIST dominates the average), which implies the limitations of DAT (see 3).

5. There are no theoretical contributions regarding DG. This paper does not mention the key assumption behind the DAT. For example, DG can be a well-defined problem if source and target domains are from the same meta-distribution. However, this paper does not clarify what assumptions it assumes and does not show how DAT can address DG in theory.

Based on the above drawbacks, I recommend rejection for this paper.
Decision: Reject