Understanding the robustness-accuracy tradeoff by rethinking robust fairness 
Authors: Zihui Wu
Haichang Gao
Shudong Zhang
Yipeng Gao
Venue: ICLR 2022 Submitted (2022)
Keywords: Adversarial training
Adversarial robustness

Abstract: Although current adversarial training (AT) methods can effectively improve the robustness on adversarial examples, 
they usually lead to a decrease in accuracy, called the robustness-accuracy trade-off. In addition, researchers have recently discovered a robust fairness phenomenon in the AT model; that is, not all categories of the dataset have experienced a serious decline in accuracy with the introduction of AT methods. In this paper, we explore the relationship between the robustness-accuracy tradeoff and robust fairness for the first time.  Empirically, we have found that AT will cause a substantial increase in the inter-class similarity, which could be the root cause of these two phenomena. We argue that the label smoothing (LS) is more than a trick in AT. The smoothness learned from LS can help reduce the excessive inter-class similarity caused by AT, and also reduce the intra-class variance, thereby significantly improving accuracy.  Then, we explored the effect of another classic smoothing regularizer, namely, the maximum entropy (ME), and we have found ME can also help reduce both inter-class similarity and intra-class variance. Additionally, we revealed that TRADES actually implies the function of ME, 
which can explain why TRADES usually performs better than PGD-AT on robustness. Finally, we proposed the maximum entropy PGD-AT (ME-AT) and the maximum entropy TRADES (ME-TRADES), and experimental results show that our methods can significantly mitigate both tradeoff and robust fairness.

Under review as a conference paper at ICLR 2022
UNDERSTANDING THE ROBUSTNESS-ACCURACC TRADEOFF BY RETHINKING ROBUST FAIRNESS
Anonymous authors Paper under double-blind review
ABSTRACT
Although current adversarial training (AT) methods can effectively improve the robustness on adversarial examples, they usually lead decrease accuracy, called the robustness-accurag trade-off. In addition, researchers have recently discovered robust fairness phenomenon the AT' model; that is, not all cate- gories of the dataset have experienced serious decline in accuracy with the in- troduction AT methods. In this paper, we explore the relationship between the robustness-accuracy tradeoff and robust fairness for the first time. Empirically, we have found that AT will cause a substantial increase the inter-class similarity, which could be the root cause of these two phenomena. We argue that the label smoothing (LS) is more than a trick in AT. The smoothness learned from LS can help reduce the excessive inter-class similarity caused by AT, and also reduce the intra-class variance, thereby significantly improving accuracy. Then, we explored the effect of another classic smoothing regularizer, namely, the maximum entropy (ME), and we have found ME can also help reduce both inter-class similarity and intra-class variance. Additionally, we revealed that TRADES actually implies the function of ME, which can explain why TRADES usually performs better than PGD-AT on robustness. Finally, we proposed the maximum entropy PGD-AT (ME-AT) and the maximum entropy TRADES TRADES,,,,, and experimental results show that our methods can significantly mitigate both tradeoff and robust fairness.
INTRODUCTION
1.1 BACKGROUND
Deep neural networks (DNNs) have been proven be vulnerable to the adversarial attacks, as demonstrated in (Szegedy) Goodfellow et al., Kurakin et al. Carlini & Wagner). By adding crafted imperceptible perturbations to the input, attackers prediction. To defend against adversarial attacks, tens of methods have been proposed, but most of them later proved to be ineffective (Athalye et al. 2018). Among these many defense techniques, adversarial training (AT) (Madry et al.) (017) has been proven to be the most effective strategy against adversarial attacks.
easily fool the model to give incorrect
Although current AT algorithms can effectively improve model robustness, there are two confusing phenomena AT models. First, there can be an inevitable robustness-aacuracc tradeoff (Tsipras) et al. 2018) in AT models in which increasing robustness is always accompanied by an accuracy drop. Second, recently Xu al. (202T) found that AT tends to introduce severe disparities in accu- racy and robustness between different classes. For example,
shown in Figure Tb] in PGD-AT model (Madry et al. 2017), both the accuracy and robustness of the 3rd class cal are much lower than those of the 1st class car, while the two classes have similar accuracies in the standard training model (see Figure Ta). This phenomenon defined as the robust fairness according to the authors.
Additionally, as Xu al. (2021) mentioned, the robust fairness problem is closely related to the robustness- accuracy tradeoff, because the average accuracy drop in the bobustness-accuaaa tradeoff could mainly come from the classes that are hard to classify in AT. To verify this, we have measured the accuracy drop for each class, and calculated their percentage in the total accuracy drop, as shown in Figure Tc
We can see that only takes two classes (the cal and bird) to contribute almost half of

---

Under review as a conference paper at ICLR 2022
1.0
0.7
17.0%
0.6
0.5
OF
0.4-
337
bucc
0.2
522
houte
12
0.0
plane
bird
deer
6og
Ireg
hrurse
shie
trock
plane
bird
deer
dog
Ireg
hourse
5hip
rack
(a)
(b)
(c)
Figure 1: (a): Classwise natural/PGD-110 errors of standard training model. (b): Classwise natural/PGD-10 errors of PGD-AT model. (c): Contribution of each class in the total accuracy drop.
the accuracy drop, while the two classes have the lowest accuracy and robustness than other classes in AT. That is, these hard classified classes have a significantly greater impact on the decline in accuracy, and better understand the robustness-accuuracy tradeoff, should be determined why these classes are so difficult to classify in AT.
To explain the phenomenon, Xu al. (202T) argued that some classes are difficult classify in AT because they are intrinsically "harder" to classify than other classes, and AT tends to hurt both accuracy and robustmess of these "hard" classes. To verify this point of view, these authors studied the effect of AT on a binary classification task under mixture Gaussian distribution, and the "hard" class is the one with larger variance in their case. They showed that AT will push the decision boundary closer to the larger variance class and further worsen both the accuracy and robustness of the class.
However, although they showed that the class with a larger variance is more difficult to classify, there still remains a question; that is, is variance enough to describe the "hard" degree of a class? Imagine two Gaussian distributions both have high variance, but also extremely large difference of mean values, they should still be well classified. On the contrary, when the two Gaussian distributions both have low variance, but the mean values of them extremely similar, which makes the two distributions severely overlap, we cannot satisfactorily classify them instead. That is, the inter-class similarity is also an important factor affecting the model's accuracy. With this point in mind, have measured both inter-class similarity and intra-class variance in standard training, PGD-AT and TRADES models (Zhang et al. 2019) for each class the CIFAR10 test set, as shown in Figure
0.07
training
0.9
PGD-TT
simllarty
TRADES (1
0.05
Standard training
PGD AT
intra-dass
0.04
0.7-
TRADES = 6)
0.02
0.01
0.00
plane
bird
car
deer
dog
trog
hourse ship
truck
plane
car
bird
cat
doer
dog
frog
hourse ship
truck
(a) Inter-class similarity
(b) Intra-class variance
Figure 2: Measurement of the inter-class similarity and intra-class variance in standard training, PGD-AT and TRADES models.
The measurement is performed the penultimate layer feature space. For each class, we use the variance of features as the class's intra-class variance. To measure the inter-class similarity of each
2

---

Under review as a conference paper at ICLR 2022
class, first calculate the feature mean value vectors for all classes, and then the cosine simi- larity between the mean value vectors of the measured class and other classes. The largest cosine similarity is used the inter-class similarity of the measured class in this paper. It is somewhat surprising to see that both PGD-AT and TRADES models have lower variance than the standard training model in Figure 26 while they have worse accuracy instead. However, shown in Figure Za both PGD-AT and TRADES can lead to a higher inter-class similarity than standard training. In particular, we notice that the "hardest" class cal does not have the largest variance no matter in PGD-AT, TRADES or the standard training model, but has the largest inter-class similarity. These observations have challenged Xu et al.] (202T)'s theory that the "hard" classes are the large vari- ance classes and indicate that inter-class similarity does matter in AT, thus motivated us to study both robust fairness phenomenon and robustness-aceuracy tradeoff toward the increased inter-class similarity.
1.2 OUR CONTRIBUTIONS
Understand the robustness-accuracy tradcoff & robust fairness. To the best of our knowledge, are the first to study the relationship between the robustness-accuracy tradeoff and the robust fair- ness, and we find that the two phenomena could both come from the increased inter-class similarity caused by AT. More specifically, through our single AT and binary classification AT experiments in section we find that:
AT will cause a general increase in inter-class similarity for each class, which even causes feature overlap, and finally leads to the accuracy drop in the tradeoff.
The "hard" classes in AT are actually similar classes in standard training, and the increased inter-class similarity in AT makes them more similar and harder to be classified, which causes the robust fairness problem.
Re-investigate the effect of smoothing regularizer in AT. Label smoothing (LS) (Szegedy et al, 2016) has been used trick benchmark the robustness in AT by Pang al. (2020), however, we noticed that LS can not only help improve the robustness, but usually improve the accuracy too, which means reduction in the robustness- accuracy tradeoff. In this paper, we find LS can help alleviate the tradeoff because it helps reduce the large inter-class similarity in AT, and also provides lower intra-class variance. Then, we investigate the effect of the maximum entropy (ME) Pereyra et al. allaa((21)))) (217)) which is also classic smoothing regularizer, and we find ME can help reduce both inter-class similarity and intra-class variance too. In addition, we find that the state-of-the-an AT method TRADES can be seen special maximum entropy learning, which could explain why TRADES model have a lower intra-class variance than PGD-AT model in Figure and usually performs better than PGD-AT in terms of robustness. We proposed the maximum entropy PGD-AT (ME-AT) and the maximum entropy TRADES (ME-TRADES), and experimental results show that methods significantly mitigate both tradeoff and robust fairness.
RETHINKING ROBUST FAIRNESS TOWARD INTER-CLASS SIMILARITY
In Figure 2a
we have shown that AT models have higher inter-class similarity than the standard training model. In this section, we design two experiments to see how the high inter-class similarity in AT is related to both the robustness-accuraacy tradeoff and robust faimness phenomena.
2.1 SINGLE ADVERSARIAL TRAINING
AT causes a feature overlap. We design the single adversarial training (single AT) to see how AT affect one single class. In single AT, we only conduct adversarial training on one class while train- ing other classes normally. For better visualization, we adjust the penultimate layer of a ResNet- 18 model to output 2-D features. In Figure 3 we show the single AT results of the two most represen- tative classes: the "hardest" class cal and the "easiest" class car. The results of other classes and detailed settings are both provided in Appendix A. In Figure 3b when single adversarial train the 3rd class car, the features of the severely overlap with those of the 5th class dog, and the overlap- ping features make the class cat almost impossible to classify (only has 7.03 natural accuracy and PGD-10 robustness). This observation intuitively shows how the inter-class similarity increases in
3

---

Under review as a conference paper at ICLR 2022
1.0
1.0
0.8
0.8
0.6
Natural error
0.6
Natural error
PCD 30 error
PCD 10 error
0.4
0.4
0.2
0.2
0.0
plane
car
bid
car
deer
dog
trog
hourse
ship
truck
plane
car
bid
car
deer
dog
trog
hourse ship
truck
-20
-5
(a) Single adversarial train the 1st class car (b) Single adversarial train the 3rd class cut
Figure 3: Results of the single AT experiment. Top line: the classwise errors; Bottom line: the 2-D
feature representations.
AT, and proves that the accuracy drop part in the robustness-accuracy tradeoff could come from the increased inter-class similarity (the overlapping features).
The increase in inter-class similarity is general in AT. However, when single AT is carried out for
the 1st class car, the features of the class car can still be split well from other classes, and both the accuracy and PGD-10 robustness of the class car achieve a high level (98.4 and 72.2 respectively, see Figure 3a Does this mean that the "casy" classes can avoid an increase in inter-class similarity
in AT?
To check this, we measure the inter-class similarity in the single AT models, and for comparison, we also measured the inter-class similarity of a standard training 2-D features ResNet- 18 model. As shown in Figure each class in the blue line represents the inter-class similarity of the class in the corresponding single AT model (e.g., the point of the class car in the blue line represents the inter- class similarity of the class similarity of the standard training model. We can see that even the "casiest" class car in the single AT model can have a higher inter-class similarity than that in the standard training model. This observation turns out that the increase in inter-class similarity is general in AT for all classes
in the single car AT model), and the yellow line is the inter-class
2.2 BINARY CLASSIFICATION ADVERSARIAL TRAINING
"Hard" classes or similar classes? Since the increase in inter-class similarity general for all classes, we assume that some classes are difficult to classify in AT possibly because they are already similar standard training, and the increased inter-class similarity caused by AT makes them more similar and become the "hard" classes. To verify this assumption, we conduct the binary classifica- tion AT experiments. We set the class cat to binary classify with other classes in CIFARIO 10 dataset, and we both PGD-AT (Madry al. 2017) and TRADES (Zhang al. 2019 train our binary classification ResNet- 18 models (512-D features here).
We plot the natural error and PGD-10 error of the PGD-AT and TRADES trained binary classifi- cation models in Figure 5a and Figure 55b respectiivy. Classes in the horizontal axis represent the classes that binary classified with the class cat, and is sorted from small to large by their similarity
4

---

Under review as a conference paper at ICLR 2022
Satar
Rezz
PG3 enor
0.6-
0.6
Sendantyy Maaddrdd canny
0.95
0.4
0.90
Standtrr
0.2
0.55
0.1
0.1
track
house
pine
doer
hird
ship
buck
harse
Blano
trep
deer
dog
trap
nourse
track
(a) AT
TRADES
Figure 4: Inter-class similarity of Figure 5: (a) and (b) show the natural/PGDD-10 error of bi- standard training model and single nary classification PGD-AT and TRADES models respec- tively. Similarity with the class cat in standard training is also plotted the green line see the correlation.
AT models.
with the cat standard training. We find that both natural error and PGD-10 eπror in the binary classification PGD-AT and TRADES models highly positive correlated with the similarity in standard training. For example, the class car the least similar class of the cal in standard training, when binary classified car with the car, model can get both low natural error and PGD-10 error (4.6 and 11:0); However, when binary classified cat with the most similar class dog, the ResNet-18 model even failed to converge in PGD-AT (49.7 for both natural and PGD-10 error), and even model can converge in TRADES, it is also in both highest natural error and PGD-10 error (23.4 and 44.0). This observation indicates that the "hard" classes AT could actually be the similar classes in standard training.
2.3
UNDERSTANDING THE TRADEOFF & ROBUST FAIRNESS
To briefly summarize, through our single AT and binary classification AT experiments, we find the following:
AT will even cause feature overlap to the "hard" classes, which leads to severe accuracy drop.
The increase in inter-class similarity is general in AT for all classes.
"Hard" classes in AT may actually be similar classes in standard training for generally increased inter-class similarity.
These findings indicate that the increased inter-class similarity could be the root cause of both robustness-accuracy tradeoff and robust fairness problems, and indicate a new way to mitigate the tradeoff: To obtain better robustness and accuracy, the excessive inter-class similarity in AT should be reduced (while not increasing the intra-class variance). And in the next section, we show this way promising by the effect of smoothing regularizer.
Our explanation. Finally, we provide an intuitive explanation for why AT leads to higher inter- class similarity. The core object of AT is force adversarial examples under the same distribution as the well-classified clean examples. To achieve this object, TRADES directly minimizes the kl- divergence between adversarial and clean examples and minimizes the cross-entropy loss of clean examples to achieve high accuracy. In PGD-AT, this object is implicit. PGD-AT directly minimizes the cross-entropy loss of adversarial examples, and because adversarial examples can be seen as robust lower bound of clean examples, it actually forces both adversarial examples and clean exam- ples to the same one-hot label. However, forcing adversarial examples to fit the distribution of clean examples may also lead clean examples be closer to the distribution of adversarial exam- ples. While adversarial examples are naturally closer to other classes, the adoption of adversarial examples could pull classes closer, then resulting in higher inter-class similarity.
5

---

Under review as a conference paper at ICLR 2022
3 THE ROLE OF THE SMOOTHING REGULARIZER
Based findings in section 2 in this section, argue that LS is not only trick in AT. We find that smoothness learned from LS can significantly reduce both inter-class similarity and intra-class variance in AT, which is the remedy to current AT methods. Then, investigate the effect of the ME, which is also a classic smoothing regularizer, and we find TRADES can be seen as a special ME learning. Finally, proposed the ME-AT and ME-TRADES mitigate both robustness-accuracy tradeoff and robust fairness.
M
0.000
6:75
6.00
0015
0.00
STILL
0.20
of 1.00
(a) Similarity in PGD-AT (b) Variance in PGD-AT
(c) Similarity in TRADES (d) Variance in TRADES
Figure 6: LS and ME can help reduce both the inter-class similarity and intra-class variance in PGD- AT and TRADES.
3.1 LABEL SMOOTHING NOT ONLY TRICK IN AT
LS has been recently used as a trick to benchmark the robustmess by Pang et al. (2020). However, we noticed that LS usually help improve accuracy too, which means a reduction in the robustness- accuracy tradeoff. In this paper, we find LS can help mitigate the tradeoff for reasons. By visualizing the penultimate layer feature representations of standard models with/without LS in 2-D figure, Müller et al. (2019) showed that LS encourages the features of training examples from the same class group tighter clusters. That is, LS could help reduce the inter-class similarity and inrta-class variance in standard training. To see if LS has the same effect in AT, we measured the inter-class similarity and intra-class variance in the PGD-AT and TRADES models with/without LSS As shown in Figure 6
we find LS can indeed reduce both similarity and variance.
Therefore,
we argue that LS is more than trick in AT. Compared to standard training, LS is more significant in AT for reducing the excessive inter-class similarity of robust models. As result, in Table [ we can see that LSS can more significantly improve accuracy in both the PGD-AT and TRADES models than in the standard training model. We also measured the robustness under AutoAttack (AA) (Croce Hein 2020), which is currently the most effective adversarial attack, and we see that LS also increases AA accuracy in PGD-AT by 1.12.
Table I: LS (a= 0.1) helps improve more accuracy in PGD-AT and TRADES than in standard training (ST).
ST+LS
ST
Diff
PGD-AT+LS
PGD-AT
Diff
TRADES
TRADES
Diff'
Natural Accuracy AA
94.87
94.82
+0.05
84.00
83.35
+0.65
82.74
82.43 49.95
+0.31
0
0
48.76
47.64
+1.12
49.75
-0.2
However, we find that when adding LS into TRADES, the AA robustness becomes 0.2 lower than the original TRADES model, as shown in Table This could happen because LS will cause loss of information in the logits, and hence weaken the discriminative power of the trained models (Müller et al. 2019), which could hurt the performance of remi-supervised learning (knowledge distillation in Müller et al. (2019)ss case and TRADES here). This pitfall of LS motivates us to investigate the effect of another classic smoothing regularizer, namely, the ME.

---

Under review as a conference paper at ICLR 2022
3.2
UNDERSTANDING THE EFFECT OF MAXIMUM ENTROPY
3.2. PROPOSED METHOD
ME learning. Let us first take brief look at the ME learning. Let (o be the probability distri-
bution of input æ produced by DNN model. The entropy of this conditional distribution is given by:
H (po (x)) - (o();;; log pa();;
Dpo(a)
By adding the negative entropy term into the cross-entropy loss during training, the object of ME learning is defined as:
(0) CE y) - 3H (po(z)) ( (3 > 0)
where y represents the one-hot labels, and C'E' is the cross-entropy function:
CE y)
Σ yi Pog))
TRADES special ME learning. Then, we show that the sota AT method TRADES is also a ME learning. Let us recall that the objective function of TRADES is:
LTRADES( (0) = C2, y) + X (x))ll)))l
where x' is the adversarial example, and K L is the kl-divergence, which given by:
KL(po(=))llpooz)) = Σ pe (x); log po(x)());;
Σ (e(x), log log
- Hp (z)) Σ pa (x), log
And the TRADES objective function can be rewritten as:
(TRADES(() = CF - (po (x))
Σ Pe (2), log pe (ax';
maximum entropy learning
adversarial cross-catropy
We can see that the left part corresponds to ME learning, and the right part is a cross-entropy loss between the distribution of clean and adversarial examples. This finding reveals that TRADES is a special ME learning, as the most direct result, we can see that TRADES model have larger entropy than PGD-AT model on both clean and adversarial examples in Fig- ure 7 Then, we notice that even the entropy value of the TRADES model is still far from the limit entropy value in a 10-classification condition (approximately 2.3), which means that there should be enough space for the PGD-AT and TRADES models to receive a stronger ME regularization. Based on this fact, we proposed the maximum entropy PGD-AT (ME-AT) and maximum entropy TRADES IME-TRADES).
1.0
TRADDS (CRan1
TRADSS sudue
Ep0ch
Figure 7: Entropy in PGD-AT and TRADES of each epoch on CIFARIO set.
ME-AT & ME-TRADES. Here, we formulize the objective func- tion of ME-AT and ME- TRADES. For ME-AT, we maximize the entropy of adversarial example distribution and we have the object:
(ME-AT(0) CE(2', y) - 3H (po(x')) . (B > 0)
For ME-TRASES, we augment the ME hyperparameter of clean example distribution in TRADES, and the object is:
(ME-TRRAES(() CE(a, v) (A+ ()H())()))) > E po (a); log (a 0)
and for code simplicity, realize ME-TRADES in more concise way as: (ME-TRADES(O) = CE(æ, y) + X K L(pp (x)) (()(())))) - (p)
which only needs to add negative entropy term into the original TRADES code.

---

Under review as a conference paper at ICLR 2022
3.2.2 EXPERIMENT
Training setting. Our experiments are based on CIFARIO, which is the most popular dataset in AT. We perform the standard CIFARIO data augmentation: random 4 pixel crop followed by random horizontal flip. We train ResNet- 18 for 100 epochs using SGD with 0.9 momentum, and the batch size is 64. The initial learning rate is 1.1 and reduced to 0.01 and 0.001 at epochs 75 and 90, respectively. The weight decay 2 x 10-1, We use the 10-step PGD adversary training, and we set the perturbation size 0.03125 under the too norm and the step size is fixed to 0.008.
Test setting. To evaluate robustness, we use PGD-20, C&W-20 (Carlini & Wagner 2017 and AA (Croce & Hein 2020) to generate adversarial examples at 0.03125 under the &oo norm too. We report the test accuracy/robustness of the best checkpoint that achieves the highest robustness under PGD-20 on the test set.
Reduce inter-class similarity & intra-class variance. We first measure the inter-class similar- ity and intra-class variance of our ME-AT and ME-TRADES models. As shown in Figure 6 can see that ME can more effectively help reduce both similarity and variance compared with LS. While TRADES is also ME learning method, this effect of ME can explain why TRADES model have lower variance than PGD-AT model in Figure 2b Note that the inter-class similarity of the TRADES model is little higher than that in the PGD-AT model in Figure 2a because the adversarial regularization hyperparameter À 6 corresponds to a strong adversarial regularization that makes the similarity higher. To clear see the effect of in terms of inter-class similarity and intra-class vari- ance, we measured both inter-class similarity and intra-class variance at X = 1, 6, 12 in TRADES, and when A 1, TRADES is both lower similarity and variance than PGD-AT (see Figure in the Appendix).
Enable larger hyperparameter A. Then, we evaluate the performance of TRADES and our ME- TRADES, as shown in Table We find that ME-TRADES can adopt higher adversarial regulariza- tion hyperparameter than the original TRADES, and we can see that when 6, the robustness of TRADES reaches the maximum (49.95 AA accuracy). Then, the robustness decreases as the À increases. However, we find that ME-TRADES reaches the maximum robustness when À = 27, which is much larger than the maximum robustness parameter À = 6 in the original TRADES, and the maximum robust accuracy is also higher (50.61 AA accuracy). This could be caused by the effect of ME that effectively reduces the inter-class similarity and intra-class variance, which could improve the effective capacity of the DNN model and allow the model to receive a stronger adver- sarial regularization, then help achieve higher robustness. Therefore, this effect of ME may explain why TRADES usually performs better than PGD-AT on robustness.
Table 2: Evaluation results of TRADES and ME-TRADES
Method
Natural
PGD-20
C&W-20
AA
TRADES (A 6)
82.43
53.14
51.00
49.95
TRADES (A = 9)
79.61
53.49
50.76
49.83
TRADES (A- 12)
78.26
53.56
50.65
49.90
TRADES (A = 15)
77.01
53.15
50.13
49.33
ME-TRADES (3 1, À 15)
83.11
54.33
51.18
49.94
ME-TRA TRADES (3 1,
18)
82.08
54.36
51.11
50.04
ME-TRADES (3 1, A 24)
80.67
54.79
51.21
50.24
TRADES (3 1, A = -27)
80.49
54.76
51.50
50.61
Mitigate the rohustness-accuracy tradeoff. While the large model capacity has been shown cru- cial for reducing the bebustness-accuraee tradcoff (Madry al. (017). find that this possible improvement in effective capacity from ME can also help mitigate the tradeoff. We show the ME- AT results in Table 3 When the ME hyperparameter / 0.5. ME-AT performs better in terms of both robustness and accuracy than PGD-AT; therefore, ME can effectively mitigate the tradeoff.
Mitigate the robust fairness. In order to check whether ME-AT and ME-TRADES can mitigate the robust fairness problem, we follow Xu et al. (202T)'s 's setting that uses the worst class performance to measure the fairness, where higher worst class accuracy/robustness means better fairness. How-
8

---

Under review as a conference paper at ICLR 2022
Table 3: Evaluation results PGD-AT, PGD-AT+LS and ME-AT.
Method
Natural
PGD-20
CW-20
AA
PGD-AT
83.35
50.86
50.16
47.64
PGD-AT+LS(a = 0.1)
84.00
52.09
50.8
48.76
ME-AT(B 0.5)
84.34
52.31
50.43
48.16
ME-AT(3 = 1)
82.44
53.09
49.94
48.16
ever, we are not going to compare with the fair robust learning algorithm (FRL) proposed by Xu al. (2021). FRL is proposed to solve the fairness problem, which can significantly increase the worst class performance; however, it also causes worse average performance than the previous sota AT method TRADES. In contrast, in this paper, our ME-AT and ME-TRADES are first proposed to mitigate both robustness-accurayy tradeoff and robust faimesss, i.e., increase the worst class perfor- same time, which a more difficult task than only improving
mance and average performance the worst class performance. Therefore, it is not appropriate to compare FRL to our method. As shown in Table 4 both ME and LS can help increase the worst class accuracy and robustness when added to PGD-AT. Because TRADES already contains the ME, we see that TRADES performs better than PGD-AT with respect to fairness. We show the results of ME-TRADES when / = 1 and 15, 27, which correspond the largest average accuracy and robustness parameters, respectively. ME-TRADES can further improve the worst class accuracy (A 15) and robustness (A 27) compared to TRADES.
Table 4: Worst class natural accuracy & PGD-20,CW-20 and AA robustness.
Method
Natural
PGD-20
CW-20
AA
PGD-AT
55.9
18.7
17.2
13.7
PGD-AT+LS
63.9
25.3
23.6
20.4
ME-AT(3 0.5)
65.0
25.0
22.9
19.7
TRADES (A 6)
65.0
26.8
23.7
21.8
TRADES+LS (A 6)
64.4
25.7
22.4
20.8
ME-TRADES (3 1, 15)
65.6
25.7
22.5
21.1
ME-TRADES (B = 1, = 27)
63.0
29.0
24.4
23.0
Benchmark the AA leaderboard. To benchmark the robustness the AA leaderboard, we com- bine our method with the robust self-training (RST) (Carmon et al. 2019), which adds 500K pre- processed data into training and obtains value of 60.37 in the AA robustness at 8/ 8/255 CIFARIO. Training details are provided in Appendix A.3.
4 CONCLUSION
In this paper, we corroborate that AT will cause an increase in inter-class similarity, which could be the root of both the rohustness-accuracy tradeoff and robust fairness phenomena. We confirm that ME can help reduce the excessive inter-class similarity robust models, and also provides a lower intra-class variance, which the remedy of previous AT methods. Our work could provide new insight into understanding and mitigating both the robustness-accuren tradcoff and robust faimess.

---

Under review as a conference paper at ICLR 2022
REFERENCES
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of se- curity: Cireumventing defenses to adversarial examples. International conference on machine learning, pp. 274-283. PMLR, 2018.
N. Carlini and D. Wagner. Towards evaluating the robustness of neural networks. In 2017 icee symposium security and privacy (sp), 2017: IEEE, pp. 39-57.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pp. 39-57. IEEE, 2017.
Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, Percy Liang, and John C Duchi. Unlabeled data improves adversarial robustness. arXiv preprint OrXiv:/905.1377 2019.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustmess with an ensemble of diverse parameter-free attacks. International conference on machine learning, pp. 2206- 2216. PMLR, 2020.
Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A Wichmann, and Wieland Brendel. Imagenet-trained cnns biased towards texture; increasing shape bias im- proves accuracy and robustness. arXiv preprint arXiv: 122233 2018.
IJJ. Goodfellow, J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572
Sven Gowal, Chongli Qin, Jonathan Uesato. Timothy Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03593, 2020.
A. Kurakin, I. Goodfellow, and S. Bengio. Adversarial examples in the physical world. arXiv preprint arXiv:1607.0253:
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint /rXiv:/706.0000 170600683,,, 2017.
Rafael Müller, Simon Kornblith, and Geoffrey Hinton. When does label smoothing help? arXiv preprint arXiv:1906.02665 2019.
Hyeonseob Nam and Hyo-Eun Kim. Batch-instance normalization for adaptively style-invariant neural networks. arXiv preprint arXiv:1805.07925, 2018.
Tianyu Pang, Xiao Yang, Yinpeng Dong, Hang Su, and Jun Zhu. Bag of tricks for adversarial training. arXiv preprint arXiv:2010.00467, 2020.
Gabriel Pereyra, George Tucker, Jan Chorowski, Lukasz Kaiser, and Geoffrey Hinton. Regularizing neural networks by penalizing confident output distributions. arXiv preprint arXiv:1701.06544 2017.
Rahul Rade and Seyed-Mohsen Moosavi-Dezfooli. Helper-based adversarial training: Reducing excessive margin to achieve better accuracy vs. robustness trade-off. In ICML 2021 Workshop on Adversarial Machine Learning. 2021.
Sylvestre-Alvise Rebuffi, Sven Gowal, Dan Calian, Florian Stimberg, Olivia Wiles, and Tim- othy Mann. Fixing data augmentation to improve adversarial robustness. arXiv preprint arXiv:2103.01946, 2021.
Kaustubh Sridhar, Oleg Sokolsky, Insup Lee, and James Weimer. Robust learning via persistency of excitation. arXiv preprint arXiv:2106. 02078, 2021.
C. Szegedy. Intriguing properties of neural networks. arXiv preprint 131.v193...1199..
10

---

Under review as a conference paper at ICLR 2022
Christian Szegedy, Vincent Vanhoucke, Sergey loffe, Jon Shlens, and Zbigniew Wojna. Rethink- ing the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 2818-2826, 2016.
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. arXiv preprini
2018.
Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust gener- alization. arXiv preprint arXiv:2004. 058844, 2020.
Han Xu, Xiaorui Liu, Yaxin Li, Anil Jain, and Jiliang Tang. To be robust or to be fair: Towards fairness in adversarial training. In International Conference on Machine Learning, pp. 11492- 11501. PMLR, 2021.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. International Conference on Machine Learning, pp. 7472-7482. PMLR, 2019.

---

Under review as a conference paper at ICLR 2022
A APPENDIX
A.1 TRAINING DETAILS AND RESULTS OF SINGLE AT EXPERIMENTS
Training details of single AT. Our single AT experiments performed on the ResNet-18 model. A linear layer (512x2) was added before the layer in the ResNet-18 model to output 2-D features, and the weight size of the fe layer was adjusted as (2x 10) to output the logits. We set bias None for the fe layer, which means we can estimate the similarity
two classes only from their included angle in the 2-D feature representations figure. For the single adversarial trained class, we perform a PGD-AT (Madry et al. (017) at perturbation size 0.03122 under the &o norm, and for other classes we perform the standard training. The single AT results of the 1st class car and the 3rd class car has been shown Figure the results the remaining classes are provided in Figure S below.
30
NSS 10
/ 3.
8
(a) 0-th class plane
(b) 2-th class bird
(c) 4-th class deer
5-th class dog
Nover
Nowr
Newre
E4
6.2
60
11
2 0
(c) 6-th class frog
(f) 7-th class hourse
(g) 8-th class ship
(h) 9-th class truck
Figure 8: Results of single AT of the 0,2,4,,6,,,88,9 classes in CIFARIO test set. We can see the severe feature overlap also happens in 8c 8d
A.2 LARGER À CAUSES HIGHER INTER-CLASS SIMILARITY
In Figure 9 that with the adversarial regularization hyperparameter À increases, the inter-class similarity also increases. And because of the effect of ME that reducing the intra-class variance, also find the intra-class variance will decrease when the hyperparameter À increases.
12

---

Under review as a conference paper at ICLR 2022
0.06
PGD-AT
TRADES (A 122
Inter-class similartty
0.90
0.05
TRADES (A -1
0.04
0.85
0.03
0.80
0.02
TRADES (A =22
0.75
IA
0.01
TRADES (A =1)
0.00
plane
bird
cat
doer
dog
frag
hoursa
ship
truck
plane
bird
cat
deer
dog
frag
hourse
ship
truck
(a) Inter-class similarity
(b) Intra-class variance
Figure 9: Measurement of the inter-class similarity and intra-class variance of TRADES (A = 1,6, 12) and PGD-AT.
A.3 BENCHIMARK THE AA LEADERBOARD
A.3.1 ME-RST
Carmon et al. (2019) used the additional pre-processed 500K data to train robust models, which is the
RST procedure. To benchmark robustness in the AA (Croce & Hein 2020) leaderboard, combine the maximum entropy regularizer with the RST method (the ME-RST) To boost performance, we replaced the batch normalization (BN) layer the batch-instance normalization (BIN) layer (Nam & Kim 2018)in the WideResNeet-28- 10 model, reasons see A.3.2 We only change the À to 27 (which the highest robustness parameter in our ResNet-18 experiments) in the original RST settings and the ME hyperparameter / is set to be 1. Our results are tested at the perturbation size = 8/255 under the foo norm. We compare our method with the top-6 methods on the robustbench website which also perform on the -eetRes 10 model and use c 8/255 for testing robustness.
Evaluation results are shown Table 5
Table 5: AutoAttack performance on CIFARIO, using WideResNee-28-10 model under = 8/255.
Method/Paper
Natural Accuracy
AA
Gowal et al. (020
89.48
62.8
Rade & Moosavi- Moosavi-Deztool.
Deztooli
2021
88.16
60.97
Rebuffi et al.
2021
87.33
60.75
Wu al. 2020)
88.25
60.04
Sridhar et af. 2021
89,46
59.66
RST (Carmon al.
2019)
89,69
59.53
ME-RST ME-RST+BIN
88.51
59.96
89.11
60.37
A.3.2 ROBUST MODEL MAY NEED TO LEARN MORE SHAAPE FEATURES
Inspired by our findings in this paper, we pose an open question: How does DNNs recognize two classes as similar in standard training? Because if we know that, then we can design a more robust model architecture with low inter-class similarity. However, this question still a hard problem in deep learning, because it actually ask us to answer another question first: What kind of features does DNN models learned?
We noticed that previous work has studied this question. Geirhos et al. (2088) showed that DNNs could be biased towards the texture feaurr,, however loses the shape feature. This may explain why
'SST's httphhhhtppp///ttttboooo///rrrrr sup-adv
"hhe AA Raabhaant/ttprr/rrbbbtteeeehhhhn
13

---

Under review as a conference paper at ICLR 2022
the class dog and cat hard to classify in our binary experiment: dog and car have the similar texture feature (the hair). Therefore, robust models may need to pay more attention to the shape feature. To learn more shape feature, attempted to replace BN layer the BIN layer, which is proposed by Nam & Kim (2018) to balance the shape and texture features, and experimental results indicate that BIN can effectively help improve both accuracy and robustness in Table
14


Reviews:
[{"review_id": "cIw-I_mLx4", "reviewer": "Reviewer_EY7N", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The paper starts with an empirical observation that large inter-class similarity highly correlates with the drop in accuracy as well as the accuracy parity between different classes. This observation is quite natural, since if the features of two classes are class to each other, then it makes it harder to classify for any predictors based on these features, leading to dropped accuracy of these classes. Motivated by this empirical observation, the authors proposed to use label smoothing (LS) to decrease the inter-class similarity, in order to alleviate the robustness-accuracy tradeoff problem. \n\nBesides the label smoothing, the authors also argued that using the maximum entropy regularizer could help reduce the inter-class similarity, and then proposed two variants of existing works, i.e., adversarial training and TRADES, with the additional maximum entropy regularizer. \n\nOverall the paper is quite clear and easy to follow. However, the current manuscript does not have a related work section and indeed fails to discuss a line of works in the fairness literature. In particular, the problem studied in this work is closely related to the accuracy parity problem in the fairness literature, yet there is no discussion in this line of works in the related works. Some of them include [1-3] and the references therein.\n\n[1].    Demonstrating accuracy equity and predictive parity performance of the compas risk scales in broward county.\n\n[2].    Understanding and Mitigating Accuracy Disparity in Regression\n\n[3].    Fair regression: Quantitative definitions and reduction based algorithms. \n\nThe organization of the paper, however, could be improved. For example, Section 3 directly jumps to the discussion of label smoothing without a proper introduction on what is LS. The same also applies to the maximum entropy regularization as well.\n\nTechnically, although the empirical observation is fine, I am interested in understanding whether this phenomenon could generalize to other datasets, or is this specific to the one studied in this paper. To answer this question, it would be good to have some theoretical justification to link the relationship between robust accuracy and inter-class similarity. This is quite important, as it means the empirical observation so far is not just a coincidence but holds in general. \n\nI would suggest the authors soften the use of the word \"proven\" in the description of the related works in the first paragraph of the Introduction. Technically, none of the existing methods has been \"proven\" to be the best but verified empirically to be effective. To me, claiming these empirical results to be proven is quite misleading. \n\nOther questions:\n-   In Fig. 2, I would image the features from the penultimate layer to be a high-dimensional vector, so the corresponding measure should be a covariance matrix rather than a scalar variance. What's the specific measure used in Fig. 2(a)?\n\nMinor:\n-   In the caption of Fig. 1, better to explain what's PGD-10 error, since this is not a standard term. \n", "summary_of_the_paper": "Motivated by the empirical observations, the authors argue that there is a high correlation between the drop of robust accuracy, robust fairness and inter-class similarity. The authors then proposed to augment these two existing methods with the corresponding label smoothing and the maximum-entropy regularizer.\n", "summary_of_the_review": "Given the lack of technical contributions and the discussion to a closely related line of works in the fairness literature, I would vote for rejection.\n", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "a76mAzAMbiA", "reviewer": "Reviewer_VwP1", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n- The problem is well motivated, and the authors presented a very thorough analysis on the per-class accuracy and inter-class similarity on why AT could lead to a trade-off over accuracy and robustness. The reasoning train from section 1 through section 2 is interesting and well supported by experiments and analysis, and the method in section 3 is well motivated.\n\n- The empirical results are strong on CIFAR-10 and demonstrate a better accuracy-robustness trade-off compared to two defense baselines (AT and TRADES).\n\nWeakness: \n- Currently all the results/analysis are on CIFAR-10 only. More experiment on other datasets would be useful to show the hypothesis (AT hurts inter-class similarity) holds across multiple scenarios. \n\n- The authors should add more discussion on related works. A few works have shown that the improved adversarial robustness from label smoothing might be the effect of gradient-masking and thus LS could be volatile to other attacks. [1] Please see the discussion in: https://openreview.net/forum?id=BJlr0j0ctX; and [2] Fu et al. Label Smoothing and Adversarial Robustness. https://arxiv.org/pdf/2009.08233.pdf\n\nGiven the current paper claims more on the robustness-accuracy trade-off side, complete adversarial robustness might not be a goal, but it would be great if the authors can add more discussion on this front.\n\nMinor:\n- Figure 2 b, please pair the colors with class categories;\n- Section 3.2.1, please add the citation back for ME learning (as in Section 1.2)\n- Table 5 is informative and puts the results in perspective, consider moving it to main text.", "summary_of_the_paper": "This paper investigates why adversarial training can sometimes present a worse trade-off between robustness and accuracy, and found one root cause could be that AT causes a substantial increase in the inter-class similarity. The paper then proposes combining both AT and TRADES with two smoothing techniques, label-smoothing, and maximum entropy, and found the resulting methods yield a better trade-off over natural accuracy and robustness.", "summary_of_the_review": "This paper presents an interesting observation that adversarial training might decrease inter-class similarity, which might in turn hurt the robustness-accuracy trade-off. The proposed method that combines label smoothing, or maximum entropy, with both AT and TRADES, seems to improve the accuracy-tradeoff by quite a margin. \n\nOn the other hand, the authors should present more results on other datasets to show the results hold across scenarios. Also more discussion on related works would be useful to clarify the benefits of label smoothing in terms of adversarial robustness (it's known that LS improves accuracy).", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "Q0O48osAz5e", "reviewer": "Reviewer_94sP", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strength:\n1. The paper provides extensive experimental analysis (e.g., single adversarial training) for the potential reason of trade-off between robustness and accuracy and robust fairness. The paper concludes that high inter-class similarity might be the main cause.\n2. The paper investigates the insight behind why TRADES performs better than PGD-AT.\n3. The paper proposed new ME-based methods to further improve the adversarial robustness over baseline.\n\nWeakness:\n1. The improvement by ME is marginal compared with non-ME methods. Given that AA might not be the proxy of strongest adversarial attack, the true improvement might be smaller or even negative.\n2. Regarding writing, in Section 3.1 the method of LS is not introduced. For those who are not familiar with LS, it is hard to understand the section.\n3. The paper misses certain references which study the trade-off between robustness and accuracy, e.g., [1].\n[1] A Closer Look at Accuracy vs. Robustness, NeurIPS 2020", "summary_of_the_paper": "This paper investigates inter-class similarity and intra-class variance, and corroborates that AT will cause an increase in inter-class similarity, which could be the root of both the robustness-accuracy tradeoff and robust fairness phenomena. The authors first considers Label Smoothing (LS) as the regularizer, and concludes that LS will cause a loss of information in the logits, and hence weaken the discriminative power of the trained models. The authors then confirms that ME can help reduce the excessive inter-class similarity in robust models, and also provides a lower intra-class variance, which is the remedy of previous AT methods. Experiments partially support the conclusions of the paper.", "summary_of_the_review": "Overall, I think the paper is on borderline in its current version. The main weakness of the paper is its technical novelty. But on the other hand, the paper provides extensive experimental results and a (potentially) reasonable explanation for the big thing in adversarial robustness: trade-off between robustness and accuracy and robust fairness. Extra theoretical analysis in support of the empirical discovery will significantly improve the paper and weight my rate towards recommending full acceptance.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "2b9c0E_O5ro", "reviewer": "Reviewer_NCTP", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "<Strong points>\n\n* Improving the fairness of robust training is a timely problem that is being actively studied.\n* The empirical results on how adversarial training increases inter-class similarities, which reduces robust fairness, is convincing. \n* The experiments show that ME-AT and ME-TRADES indeed improves the robust-accuracy tradeoff and robust fairness.\n\n<Weak points>\n\n* Overall the paper uses too many pages on motivating the problem while missing critical content as explained in the following weak points. The explanation on why AT algorithms increase inter-class similarities goes on for 5 pages, but the content is often redundant and can be significantly reduced while being just as convincing. The remaining 4 pages seem too short for the rest of the material.\n* In the Introduction, the PGT-AT and TRADES techniques appear without much explanation. How do these techniques work and why are they the important ones to consider for fair robust training? Moreover, there is no related work section, and the authors should compare their techniques with the following recent fair robust training works:\n   * Zhang and Davidson, \"Towards Fair Deep Anomaly Detection\", FAccT 2021.\n   * Khani and Liang, \"Removing Spurious Features can Hurt Accuracy and Affect Groups Disproportionately\", FAccT 2021. \n* Section 3.1 is critical where it explains why LS prevents inter-class similarities from going up. However, the explanation is not convincing where it only shows a few experiments on one dataset that is not even well described (is it the dataset mentioned in the Introduction?). As LS is an important technique, it should be explained in the paper instead of just adding a citation. Most importantly, there needs to be some convincing analysis showing why LS reduces similarity and variance for any dataset in general. \n* The flow from Section 3.1 to 3.2 is not clear. If a few LS techniques work well empirically, why does that lead you to investigate ME? Do all LS techniques work well? Is there no LS technique that works better than ME? What if ME works well for different reasons? Among the ME methods, why only consider the TRADES method? If TRADES is already a special ME technique, how is ME-TRADES an improvement?\n* The experiments are not extensive enough where only the CIFAR-10 dataset is used. Instead, there must be at least two or three datasets to make sure the results are general. The same comment goes for the experiments in the Introduction. In addition, the authors do not compare their techniques with FRL by Xu et al. because it is said to solve an easier problem and is thus \"not appropriate\". I am not sure if I agree. FRL is also one of the SOTA methods and has the similar goal of improving robustness against adversarial data while adding constraints to reduce accuracy disparities between groups. IMHO the authors should definitely make an extensive comparison with FRL to emphasize the effectiveness of ME-TRADES.\n* In Section 3.2.2, please clearly define PGD-20 and the exact measure used to produce the Table 2 values.\n* The role of intra-class variance is not clear. The inter-class similarity seems to be the main cause of accuracy-robustness tradeoff and robust fairness in the paper. In addition, existing AT methods already decrease the intra-class variance compared to standard training. Hence it is unclear how important intra-class variance is.\n", "summary_of_the_paper": "This paper identifies how adversarial training (AT) algorithms for robustness may negatively affect the notion of robust fairness and proposes two methods ME-AT and ME-TRADES, which combine existing AT methods with a maximum entropy (ME) term, to improve the accuracy-robustness tradeoff and robustness fairness. Although AT algorithms improve model robustness, they also increase inter-class similarities, which make certain classes more difficult to classify, leading to unfair accuracies. The paper then shows that label smoothing (LS) mitigates this effect and in particular investigates the ME technique. The authors show that a method called TRADES outperforms another method called PGD-AT because it is a special version of ME. Experiments show that combining ME with these AT methods outperforms PGD-AT.", "summary_of_the_review": "While the paper solves a timely and important problem, it can also be improved by shortening its introduction to the problem, better explaining why LS works and why we should focus on ME and TRADES, citing and comparing with more related work, and making its evaluations more extensive.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper argues that adversarial training increases inter-class similarities, therby increasingly the misclassification of some classes and lowering accuracy parity across classes. It proposes to combine existing adversarial training methodologies, PGD-AT and TRADES, with a maximum entropy term to improve the classification fairness while remaining robust.

While they agree that the problem is timely and important, the reviewers identify the following issues that place the current iteration of the paper below the bar of acceptance: the comparison to other works on fair robust training and accuracy parity is incomplete; experimental evaluation is conducted only on CIFAR10, making the generalizability of the paper's claims about performance unclear; and the proposed methodology has low technical novelty.
Decision: Reject