Training-Free Robust Multimodal Learning via Sample-Wise Jacobian Regularization
Authors: Zhengqi Gao
Sucheng Ren
Zihui Xue
Siting Li
Hang Zhao
Venue: ICLR 2022 Submitted (2022)
Keywords: Jacobian Regularization
Robust Multimodal Learning

Abstract: Multimodal fusion emerges as an appealing technique to improve model performances on many tasks. Nevertheless, the robustness of such fusion methods is rarely involved in the present literature. In this paper, we are the first to propose a training-free robust late-fusion method by exploiting conditional independence assumption and Jacobian regularization. Our key is to minimize the Frobenius norm of a Jacobian matrix, where the resulting optimization problem is relaxed to a tractable Sylvester equation. Furthermore, we provide a theoretical error bound of our method and some insights about the function of the extra modality. Several numerical experiments on AV-MNIST, RAVDESS, and VGGsound demonstrate the efficacy of our method under both adversarial attacks and random corruptions.

Under review as a conference paper at ICLR 2022
TRAINING-FREE ROBUST MULTIMODAL LEARNING VIA SAMPLE-WISH JACOBIAN REGULARIZATION
Anonymous authors Paper under double-blind review
ABSTRACT
Multimodal fusion emerges as an appealing technique to improve model perfor- mances on many tasks. Nevertheless, the robustness of such fusion methods is rarely involved in the present literature. In this paper, we the first to propose a training-free robust late-fusion method by exploiting conditional independence assumption and Jacobian regularization. Our key is to minimize the Frobenius norm of a Jacobian matrix, where the resulting optimization problem is relaxed to tractable Sylvester equation. Furthermore, we provide theoretical error bound of our method and some insights about the function of the extra modality. Several numerical experiments AV-MNIST, RAVDESS, and VGGsound demonstrate the efficacy of our method under both adversarial attacks and random corruptions.
INTRODUCTION
Deep fusion models have recently drawn great attention of researchers in the context of multimodal learning (Vielzeuf et al.) 2018 Baltrušaitis et al. 2018: Pérez-Rúa et al., 2019 Wang et al., 20200] Xue al. 2021) as provides easy way increase model accuracy and robustness. For instance, RGB cameras and LiDARs are usually deployed simultaneously on an autonomous vehicle, and the resulting RGB images and point clouds referred as modalities, respectively. When RGB images are blurry at night, point clouds could provide complementary information and help to make decisions in vision tasks (Kim & Ghosh 2019). Over the past few years, numerous multimodal fusion methods have been proposed at different levels: early-, middle-, and late-fusion (Chen et al.) 202T]. In carly-fusion, input feature vectors from different modalities are concatenated and red into one single deep neural network (DNN), while in middle-fusion they go into DNNs independently and exchange information in feature space. Unlike the previous two cases, late-fusion is realized by merging distinct DNNs at their output layers via concatenation, element-wise summation, etc.
These three levels of fusion possess different pros and cons. For instance, fate-nu, the primary concern of our paper, is (i) privacy-friendly and (ii) convenient to deploy. Specifically, assume that a hospital wants to have an AI agent to judge whether a patient has certain disease or not (Sun) eet al. 2020). It has to divide the complete training feature (e.g., medical records, X-ray images) of every patient and deliver them to different Al companies, otherwise, the patients' identities will be exposed and their privacy are unprotected. This, in turn, directly rules out the possibility of applying early- or middle-fusion methods. On the other hand, the hospital could still exploit late- fusion technique to generate the ultimate AT agent after several unimodal DNNs are trained by Al companies. Moreover, unlike early- or middle-fusion many late-fusion methods could tolerate missing modality information (i.e., no need for paired data) and thus are convenient to deploy.
Although late-fusion is a mature topic in the literature, its performance under adversarial attacks (Madry et al. 2018 Tsipras et al. 2019) and random corruptions (Zheng et al. 2016 Kim & Ghosh] In this paper, we address the problem of robust late- fusion by uti- lizing Jacobian regularization (Varga et al. Dakubovizz Giryes 2018 Hoffman al. 2019
2019) is rather under-explore
Chan et al.] 2019) and conditional independence assumption (Sun et al.) 2020). The key is to min-
imize the Frobenius norm of Jacobian matrix so that the multimodal prediction is stabilized (see
Figure T] Our main contributions are as follows:
To the best of our knowledge, method. The involving optimization problem relaxed to a Sylvester equation (Jameson, 1968), and the solution is obtained with only little computational overhead.
the first to propose training free robust late-fusion

---

Under review as a conference paper at ICLR 2022
We provide theoretical error bound of proposed robust late-fusion method and an illustrative explanation about the function the extra modality via the TwoMoon example.
Thorough numerical experiments demonstrate that our method outperforms other late- fusion methods and is capable to handle both adversarial attacks and random corruptions.
MM
Late- Fasion
Prediction
Unimodal
Jucobian Regularization
JacoRRy
JacoRep
Modality
UM Logit
Late-F Fiskin
Unimodal Network B
Jacobian Regularization
MM Prediction
Modality
UM Logit
1.4
x;
UM
Logit
Figure 1: Illustration of the proposed robust late-fusion method. Before unimodal raw logit N and ZB are fused, the Jacobian regularization technique is applied. Roughly speaking, it will enforce the derivative of p with respect to 2A becomes smaller. Thus, when 24 is perturbed to z'A (due to random corruption or adversarial attack), the change of multimodal prediction l|p' - pll will be limited to some extent. For the illustration purpose, all variables here (e.g., p, ZA) are drawn in one-dimensional space.
2 PRELIMINARY
Network Robustness To verify the network robustness, two major kinds of perturbations are used, which in paper referred
(i) adversarial attacks such FGSM, PGD, or CW attack Goodffelow et al., 2014; Madry et al. 2018 Carlini & Wagner 2017) and (ii) random corruptions such Gaussian noise, missing entries or illumination change Zheng et 2016: Kim & Ghosh 2019). Correspondingly, many methods have been proposed to offset the negative effects of such perturbations. Adversarial training based on projected gradient descent (Madry al., 2018)) is one strong mechanism to defend against adversarial attacks, and the recent Free-m method (Shafahi al. 2019) is proposed as fast variant. Besides adversarial training, several regularization tech- niques are also proven to have such capability, such as Mixup (Zhang et al. (020). Jacobian regular- ization (Jakubovitz Giryes/ 2018). Alternatively, with regard to random corruptions. Mixup and Jacobian regularization are also effective in this case (Zhang al. 2018 Hoffman al. 2019). An- other powerful approach is stability training (Zheng et al.) 2016), where introduces an additional KL divergence term into the conventional classification loss that the trained DNNs stabilized.
Multimodal Learning DNNs trained by fusing data from different modalities have outperformed their unimodal counterparts in various applications, such as object detection (Chen et al. 2021 Kim
& Ghosh] 2019), semantic segmentation (Chen et al., 2020b) Feng et al.) 2020). audio recognition (Gemmeke al. 2017 Chen al.)
(020a). Based on where the information is exchanged between different modalities, multimodal fusion methods could be classified into three kinds: (i) carly-fusion
Wagner al. 2he6 Chen al.
202T) (ii) middle-fusion (Kim & Ghosh 2019 WWan al. 2020),
and (iii) late fusion (Chen et al.
2021 Liu et al. 2021). For instance, if the information is fused at
the end of DNNs (e.g., Figure
D such method belongs the late-fusion category.
Although vast efforts have been put into exploiting multimodal fusion methods to improve DNNs' accuracy on specific learning tasks, few works have explored network robustness in the multimodal context. Specifically, Mees et (2016), Valada et al. (2017), Kim et al. (2018) exploited gating networks to deal with random corruptions, adverse or changing environments. Afterwards, Kim & Ghosh (209)) proposed surrogate minimization scheme and a latent ensemble layer to handle single-source corruptions. However, all the aforementioned methods belong to middle-fusion and only random corruptions considered. On the other hand, we focus another important scenario: late-fusion, and besides corruptions, we further take adversarial attacks into account. To the best of knowledge, robust late-fusee fate-fusion is un-explored in the previous literature.
2

---

Under review as a conference paper at ICLR 2022
3 JACOBIAN REGULARIZATION IN TEST TIME
Consider a supervised K-class classification problem in the multimodal context. Suppose that fea- tures from two distinct modalities A (e.g., audio) and B (e.g., video) are provided in the form of DA {(xA y') JE= and DB = {x y y') JE= where XB) represents input features and y represents the true label. We train two unimodal networks separately, each corresponding to one modality, Given specific input feature X,, the first unimodal network calculate the class prediction
PA E R by:
PA 0 01 ( Wahs ba) 1 (WAAAXX)) ba)
where (.(-)) represents the Softmax function, 24 E RKK represents the raw logit, and h (xA) E I represents the feature being fed into the last layer Here Wa E RK*H and DA E RK are the learnable weight and bias of the last linear layer, respectively. Similarly, the second unimodal network provides the class prediction рв = (1 = (W + bB) = oi(W (xg( + bB).
Based on the conditional independence assumption (Kong & Schoenebeck 2018). the basic statisti- cal late-fusion method generates the final class prediction (Chen al. 2021):
PA @ PE, )- 02( 01 (ZA) @ (z((z)) freq
p 02
(2)
freq
where the division is performed in an clement-wise manner, O represents the clement-wise product, and 2-)()) represents linear normalization enforcing the summation of elements equal to one. Here freq E T contains the occurring frequencies of each class, calculated from the training dataset.
Our proposed approach builds upon (2. Specifically, we consider adding two K x K weight matrices (Wa, 3 ahead of [ZA, 2 respectively, right before they get activated. Consequently, the final multimodal prediction is re-calibrated as:
01 (2'A) (1) ) 02( 02( 0I (WWa O o1 (WozB) p' = 02(
freq
freq
Suppose that the data provided from modality A are perturbed at the input or feature level, while the data from modality B are clean. For matrix W,, could simply set it to identity matrix, implying that we didn't 't invoke the robust add-on for the second modality. To determine the value of W we first calculate the derivative of p' with respect to h4 (see Appendix A. A.1
0p' J'W. W [p'p'T Diag(p')), W Tha
(4)
Then we minimize the following regularized Jacobian loss with respect to W
min L min (1 J', W + +l -
(5)
where 0 < < 1 is a tunable byper-parameter. Minimizing the first term in the loss could make the change of p' limited to some extent when 1 is perturbed, while the second term in the loss guarantees numerical stability and the prediction in the perturbed case won't 't get too far from that of the clean case. For a specific multimodal input {x )R). once W, is determined, so are p' and J' via (3) and 44, respectively. Thus, 5) is well-determined and non-linear with respect to W..
We propose heuristic iterative method making the above optimization problem tractable in Algo- rithm I Our key is to decouple J' from W.. Namely, in step 5 of Algorithm 1 all terms are known except W.. a. and thus the relaxed loss is convex. After writing out all terms of observe that it is Sylvester equation (Jameson) 1968). It has a unique solution and the run time as large inverting K x K matrix and hence affordable. See Appendix A.2 for details.
a. we
First, in our implementation we find that one iteration could already yield sufficiently accurate result, thus all our numerical results are reported with fmax (i.c., p' = (1)), Second, if we know data from modality B are also perturbed, we could solve W, in similar manner. Third,
Remarks
holds because the last layer is usually implemented fully connected (FC) layer with Softmax activation in classification tasks.
3

---

Under review as a conference paper at ICLR 2022
Algorithm Iteratively solving regularized Jacobian loss
1: Given one specific input (xA,XB) Initialize iteration index f = 0.
2: Perform one forward pass, yielding the initial class prediction p!")
3: while / < mmx do
4: Calculate J(() = p ())0p))))))))))))))))))) (0)T (p ()))
5: Minimize (t) = (1 - 7) W. W All + -112 with respect to Wa.
6: Calculate ( based on Eq 3 with the optimal Wa-
7: Update t +
8: end while
9: Return p' (p)))
notice that our approach is invoked merely during inference (i.c., test time), but not the train time. Furthermore, demonstrate could be equally applied to many modalities. Finally, with moderate assumption, we can further prove that when the input is perturbed, the change of final prediction enhanced by method is limited to a certain amount. This has been summarized in Theorem [ (see Appendix (A.3) Some immediate corollary include: (i) when (0, E), the bound simplified to ElIlp" moore -p'll] S ( (2(1-7) 1/2 Tr E]] (ii) when the L2 norm of e is constrained smaller than 8 (usually assumed in
approach in the context of two modalities, while obviously, it
adversarial attacks), the bound simplified ||p Anoise
-p'll S 18
(
yk 2211-))) 1/2
Theorem If fA is I-Lipschitz continuous and XA is perturbed by e: x
XA + then the
Euclidean norm of our final prediction (i.e., / I p'll) at most changes 1V 2 7k
|||||
NECESSITY THE EXTRA MODALITY: BIASING EFFECT
In this sub-section, explain the principles behind approach. Let move step back and consider the unimodal case. In what follows, we will demonstrate that our approach might not work well in the unimodal context, which in turn justifies the necessity of the extra modality.
At first glance, our approach seems to be equally applicable in the unimodal context. Namely, suppose that only one unimodal network p σ (z) σ (Wh + b) is available, in test time and for each specific input we add weight matrix W before the raw logit z being fed into the Softmax activation, re-calibrating the final unimodal prediction as: p' = o1 (z') = σ1 W zz) Here Wz can be solved by analogy to (5). However, we observe that the introduction of W, usually won't change the final prediction.
TwoMoon example For an intuitive understanding, we consider the TwoMoon example used by Xue et al. (202T). In this example, all data points are scattered 2D space. The data located at the upper and lower leaf have true labels 0 and 1, and are colored by red and blue, respectively.
97.78%
97.75%
97.75%
97.78%
68
FA
85
54
97.00%
97.00%
97.00%
(a)
(b) 7
(0)
Figure 2: (Unimodal case) The lefimost figure reveals the results of training and testing on clean data. The heatmap in the background represents the value of [JW]]r- The remaining right three figures show the results of testing on data with Gaussian noise, and similarly, the heatmap in the background represents the value of [JW, a W For each figure, the test accuracy on clean and noisy data are reported at the left top and right bottom.
4

---

Under review as a conference paper at ICLR 2022
In the unimodal case, take both horizontal and vertical coordinates imput and train neural network with three FC layers. As shown in Figure 2 (a), the network perfectly fits to the clean data and achieves 97.75% accuracy
evaluate the trained network on noisy test data. Specifically, we deliberately choose ? = 1.0 in Figure 2 (b), that our approach is actually not invoked (since the solved W~ equals I). In this case, the accuracy drops to 97 97.00% on noisy data, while the heatmap in the background doesn't I change at all compared Figure 2 (a). In Figure 2 (c) and (d), we choose 7 0.5 and y 0.1, respectively. We observe that even though the color of the heatmap surely becomes lighter expected, the test accuracies of both cases are still 97.00%. More importantly, we find that this phenomenon is not coincident and that the prediction doesn't change for any input after adding W, in unimodal binary for
the clean test data. In the remaining three figures,
classification. See Appendix A.4 for rigorous mathematical proof. Moreover, in K-elass (K 2) classification problem, the final prediction might change if y is sufficiently small. For instance, given 2 = [1. 0, 2 and W I. if we choose = 0.5, then the final prediction will change from = [0.245, 0.090, 0.665] 2T to p' [0.270, 0.096, 0.635]", where the last entry remains to be the largest. However, we choose y 0.01, then the final prediction will become p' = [0.391, 0.219, 0.390]", and now the first entry is the largest. See Appendix A.5 for theoretical bound of in this high- dimensional case.
the multimodal case. We treat the horizontal coordinates as modality, and the vertical coordinates as the second modality. Two neural networks are trained, each corresponding to one modality. Then we fuse them based on the aforementioned statistical fusion method. As shown in Figure 3 in the multimodal context, when our method is invoked (y = 0.5 or 0.1), the color of the heatmap becomes lighter and the test accuracies on noisy data all increase compared the trivial statistical fusion (i.e., when y 1.0). On the other hand, the test accuracies on clean data almost remain still (or slightly increase alongside 7 4).
Now
98.00%
98, 60.%
75%
24
97.50%
20
98.75%
6x
26
0.1
0.
87.00%
88.00%
88.62
60
(-)
(c)
(d) 7
Figure 3: (Multimodal case) The leftmost column reveals the results of training and testing on clean data. For illustration purpose, we only perturb the Y-coordinates with Gaussian noise. The first and second row correspond to small and large noise, respectively. Heatmaps reveal the values of |JJ]|| in (a) and JJJWA W| in (b), (c), and (d). For each figure, the test accuracy clean and noisy data are reported at the left top and right bottom.
Lemma Statistical fusion is equivalent to concatenating the raw logits:
as(PA .BBB σ: 1 + 2g - In fnfreq)= oo I freq
2
In freq)
ZB
Biasing effect the extra modality As we have seen in the TwoMoon example, our proposed method behaves differently in the unimodal and multimodal context. To get better understanding of this subtle difference, we first summarize an equivalent form of statistical fusion in Lemma [ (see Appendix A. Now assume that the sample-wise Wa W is added, then the final multimodal prediction becomes o W Z + z freq). Alternatively, in the unimodal context, our method adds a sample-wise W. and the final prediction becomes ai (W, (W.z). Comparing these two expressions,

---

Under review as a conference paper at ICLR 2022
observe that the introduced Wa and Wa æ occur in the perturbed modality. However, in the multimodal case, the extra modality acts as a bias term inside the Softmax function 0i and plays a key role.
5 EXPERIMENTAL RESULTS
5.1 AV-MNIST
AV-MNIST (Pérez-Rúa al. 2019 Vielzeuf et al. 2018) is novel dataset created by pairing audio features to the original MNIST images. The first modality corresponds to MNIST images with size of 28 28 and 75% energy removed by principal component analysis (Pérez-Rúa
al., 2019). The second modality is made up of spectrograms with size of 112 x 112. These spectrograms are extracted from audio samples obtain by merging pronounced digits and random natural noise. Following Vielzeuf et al. (2018), we use LeNet5 (LeCun et al.) 1989) and 6-layer CNN to process image and audio modalities, respectively. To thoroughly verity the efficiency of our method, we design various types of perturbations: (i) random corruptions including Gaussian noise (wo), missing entries (W1), and biased noise (W2, W3), and (ii) adversarial attacks including FGSM (wa) and PGD attack (Ws, Wg). See Appendix for detailed definitions.
Baselines We limit our comparison to the range of late-fusion methods. To verify our method, we consider several methods which could improve network robustness, including (i) regular training, (ii) adversarial training (advT) by Madry et al. (2018). (iii) free-m training (freT) by [Shafahi et al. 2019), (iv) stability training (stabT) Zheng et al. 2016), and (v) Mixup (mixT) by /Zhang al. 2018). To the best of our knowledge, no previous robust late-fusion methods exist. Thus for comparison purpose, we slightly modify the confidence-bait (2021) and adopt it here, referred to as mean fusion with confidence-basee Combinations of different fusion methods and robust add-ons provide us with a few baselines. We emphasize that in our experiments, the train data are always free of noise. Following Kim & Ghosh (2019) our experiments are mainly conducted on the case when one modality perturbed.
weighted summation in Yu et al.
weighted summation.
Results Table reports the test accuracies of several models on AV-MNIST. Six unimodal net- works are trained on clean data. Then we fuse them with different fusion methods and different robust add-ons. We only invoke our Jacobian regularization for the perturbed audio modality, while keeping the image modality unchanged. First, in the case mean fusion, confidence-based weighted summation doesn't 't improve robustness. In the case of statistical fusion, we observe that our pro- posed Jacobian regularization method not only boosts the accuracy on noisy data but also on clean data. For instance, when method is invoked on the combination of model-0 and model-1, the test accuracy on clean data increases from 93.6% to 94.7%, and the test accuracy on data with Gaussian noise (e.g., 42g 1.0) increases from 80.4% 84.5%. Similar phenomena can be observed when our method is invoked on other combinations. Moreover, the number of green arrows is much larger than that of red arrows implying that our method is compatible with different robust techniques and applicable under different noises/attacks.
Comparing the last row in the second sub-section and the third row in the third sub-section, we find that with our proposed method enabled, even if the unimodal backbone model-1 is worse than model-2, the final multimodal accuracies (0, 1) with our method invoked are even larger than (0, 2) without our method invoked. Similar phenomena could usually be observed in other sub-sections. We argue that in this example, statistically fusing two regular unimodal baselines with our Jacobian regularization invoked surpasses robust unimodal baselines and their trivial fusion. Moreover, the highest accuracy in each column has been bolded. clear that the multimodal network with our method invoked usually achieves the best performance over all others.
Figure 4 further plots model accuracy versus magnitude of noise/attack. It displays a consistent trend that our method works well regardless of the magnitude of noise/attack. Furthermore, the larger the noise/attack is, the better our method performs. More numerical results (such as the impact of hypee-parameters, applying perturbation the image modality) are shown in Appendix B.2

---

Under review as a conference paper at ICLR 2022
Table 1: Accuracies of different models (%) are evaluated AV-MNIST when audio features perturbed. Mean accuracies are reported after repeatedly running 20 times. The value of is se- lected from (0.1, 0.5, 0.9). The green (f) red (4) arrow represents after applying our Jacobian regularization, the model accuracy increases or decreases compared to others with the same uni- modal backbones. The best aceuracy in one column is bolded. 'UM' and 'MM' represent 'uni- modal' and 'multimodal', respectively. 'MM(O, i)' represents multimodal network obtained by fusing the unimodal network indexed by '0" and '1'
UM /M
Model
Clean
wo = 1.0
W1 = 10
W4
0.03
0.001
0: Ing-regT
73.4
73.4
73.4
73.4
1: T
83.9
55.1
73.3
69.9
77.8
UM
2: A
84.4
59.2
72.0
81.9
83.3
Nets
3: Aud-fret T
82.1
55.6
71.9
80.8
81.6
4: Aud-staT
86.2
67.6
74.4
66.5
74.5
5: Aud mixT
87.6
61.3
74.9
74.9
78.3
Mean-w/o
80.3
86.4
89.8
92.7
MM (0. 1)
Mean-w/
90.5
73.7
83.6
82.0
88.2
Stat-w/o
93.6
80.4
86.6
89.9
92.7
Stat-w/ (ours)
94.7 (1)
84.5 (1)
89.1 (1)
92.2 (1)
94.1 (1)
Mean-w/o
78.3
82.7
91.9
92.5
MM
Mean-w/
86.0
72.7
77.5
85.7
86.9
(0, 2)
Stat-w/o
91.7
78.3
83.5
91.9
92.4
Stat-w/ (ours)
93.4
83.1 (1)
86.4
93.5 (1)
93.7 (1)
Mean-w/o
87.7
93.2
93.2
MM
Mean-w/
82.4
74.4
78.6
83.7
83.5
(0, 3)
Stat-w/o
93.0
80.9
87.7
93.2
93.2
Stat-w/
93)
82.3
88.1 (1)
92.7 (L)
92.9 (L)
Mean-w/o
93.0
84.9
83.5
88.8
MM
Mean-wi w/
90.9
78.1
81.8
74.6
81.3
(0, 4)
Stat-w/o
93.1
83.7
85.3
83.4
88.8
Stat-w/ (ours)
94.7
87.5 (1)
87,8
87.9 (1)
91.9 (1)
Mean-wil
95.2
85.9
89.7
91.1
92.5
MM (0, 5)
Mean-w w/
94.0
82.1
88.6
87.1
88.9
Stat-w/o
95.1
85.7
90.1
91.1
92.4
Stat-w/ (ours)
95.0 (L)
86.1 (1)
90.1 (L)
91.0 (1)
92.2 (L)
wlo JacoRag w/ JacoReg
88
Accurscy 1%)
Accuney (%)
Accuncy (%)
80
wio JacoReg JacoReg
JacoReg
JacoReg
0.0
0.5
1.0
2.0
20
0.020
0.025
0.030
0,035
0.040
We
Magnituide missing entries (1)
Magnitude
we
Figure 4: Accuracies of multimodal networks obtained by statistically fusing vanilla image net- work and audio network with 0.1. Mean and Std of 20 repeated experiments are shown by the solid lines and the shaded regions, respectively. Note that FGSM attack is rather deterministic, thus there is almost no variance when repeating experiments.
5.2 EMOTION RECOGNITION ON RAVDESS
2018 Xue et al. 2021). We similar network structure for both the image and audio modality: Three convolution layers, two max pooling layers, and three FC layers connect in sequential. Similar baselines and experimental settings adopted as those in AV-MNIST. Results reported in Table
We consider emotion recognition on RAVDESS (Livingstone & Russo

---

Under review as a conference paper at ICLR 2022
Results Still, in the case of mean fusion, confidence-basee weighted mean fusion usually doesn't t work except in few cases, while our proposed Jacobian regularization exhibits good compatibility with different trained models under various perturbations. The bold results imply that the multi- modal network with our Jacobian regularization invoked outperforms all other models except in FGSM attack (wa 0.03). Due page limits, extra results presented in Appendix B.3
Table 2: Accuracies of different models (%) are evaluated on RAVDESS when audio features are perturbed. Mean accuracies are reported after repeatedly running times.
UM/MM
Model
Clean
We 1.0
W1 6
W4 0.03
wh = 0.001
Img-regT
82.5
82.5
82.5
82.5
1: Aud-regT
71.9
54.2
59.3
31.5
29.9
UM
2: Aud-advT
78.6
43.1
71.9
53.3
62.3
Nets
3: Aud-freT
66.4
19.5
62.4
56.0
60.5
Aud-staT
71.8
58.3
59.8
25.9
29.6
Aud-mixT
74.6
54.5
66.9
15.7
19.2
Mean-w/o
89.8
82.8
86.7
57.0
63.6
MM (0, 1)
Mcan-w/
88.5
80.4
84.1
60.7
57.3
Stat-w/o
89.9
82.9
86.3
56.9
63.3
Stat-w/ (ours)
89.9 (1)
85.0 (1)
87.7 (1)
59.4 (1)
68.1 (1)
Mcan-w/o
90.8
76.9
89.5
87.3
90.6
MM
Mcan-w/
89.3
76.9
87.6
79.7
85.9
(0, 2)
Stat-w/o
90.8
77.1
89.6
87.2
90.5
Stat-w/ (ours)
91.4 (1)
79.9 (1)
90.2 (1)
88.6 (1)
90.6 (1)
Mcan-w/o
90.5
60.8
89.6
90.8
MM
Mcan-w/
86.9
64.0
86.6
82.2
85.7
(0, 3)
Stat-w/o
90.5
61.5
89.2
90.0
90.7
Stat-w/ (ours)
90.8 (1)
65.6 (1)
90)0
89.5
90.7 (1)
Mean-w/o
90.7
88.4
88.5
78.8
Mean-w/
89.2
85.4
85.5
68.9
69.3
(0, 4)
Stat-w/o
90.4
88.3
88.5
69.7
78.9
Stat-w/ (ours)
90.8 (t)
88.8 (1)
88.7 (1)
75.3 (1)
82.3 (1)
Mean-w/o
89.5
87.8
87.9
82.7
Mcan-w/
87.9
85.8
86.5
82.0
79.7
(0, 5)
Stat-w/o
89.4
87.7
87.9
81.6
82.5
Stat-w/ (ours)
86.6 (L)
86.7
86.0 (L)
82.9 (1)
83.7 (1)
5.3 VGGSOUND
We consider classification task real-world data VGGSound (Chen al. 2020a), where two modalities audio and video are available. To construct an affordable problem, our classification task only focuses on subset of all classes. Namely, we randomly choose 100 classes and our classification problem is constrained on them. Consequently, there are 53622 audio-video pairs for training and 4706 audio-video pairs for testing. For the audio modality, we apply short-time Fourier transform each raw waveform, generating a 313 x 513 spectrogram. We take 2D ResNet-18 (He al., 2016) process these spectrograms. For the video modality, we evenly sample 32 frames from each 10-second video resulting input feature size of 32 256 x 256. We take ResNet-18 network process the video input where 3D convolutions have been adopted to replace 2D convolutions.
Results We present the results mean fusion and statistical fusion with or without robust add-on in Table 3 Unlike the previous experiments, here we make audio modality clean and assume cor- suptions/attacks on the video modality. The results demonstrate that our method outperforms coun- terpart statistical fusion without Jacobian regularization in most cases. Furthermore, the bold results imply that our Jacobian regularization could enhance model robustness under various corruptions or attacks. More results (e.g., unknown corrupted modlity) presented in Appendix B.4
8

---

Under review as a conference paper at ICLR 2022
Table 3: Accuracies of different models (%) are evaluated VGGSound when video features perturbed. Mean accuracies are reported after repeatedly running 5 times.
UM/MM
Model
Clean
1.5
6
0.03
0.001
A
54.4
15.0
49.8
23.0
19.9
1: Img-regT
27.4
5.8
27.4
9.5
9.0
UM Nets
Img-advT
27.5
5.3
27.4
10.7
10.3
Img-freT
25.2
4.0
24.2
22.9
4: Img-staT
27.0
6.9
26.9
10.5
9.6
5: Img-mixT
27.2
8.4
27.1
7.3
7.2
Mean-w/o
57.7
45.8
57.7
35.0
25.7
MM
Mean-w/
53.9
48.6
53.9
37.9
20.5
(0,
Stat-w/o
58,5
46.0
58.4
35.3
26.0
Stat-w/ (ours)
60.1 (T)
51.2
60.0
39.7
28)5
Mean-w/o
58.8
45.0
58.8
37.2
26.9
MM
//
54.1
49.0
54.1
38.3
21.3
(0, 2)
Stat-w/o
59.4
45.4
59.4
37.3
27.2
Stat-w/ (ours)
61.1 (1)
50.1
61.1 (1)
(1)
29)7
Mean-w/o
57.9
51.5
57.9
57.8
57.7
MM
Rean-w/
55.2
53.6
55.2
55.0
55.2
(0. 3)
Stat-w/o
58.8
52.6
58.8
55.6
57.7
Stat-w/ (ours)
56.7 (L)
53.2 (L)
56.7
58.5 (1)
57.9 (1)
Mean-w/o
57.5
47.2
57.3
36.9
30.9
MM
Mean-w/
53.5
49.2
53.4
37.2
23.4
(0, 4)
Stat-w/o
58.2
47.5
58.1
37.4
31.0
Stat-w/ (ours)
59.8 (t)
51.9 (1)
59.7
41)
34)
Mean-w/o
57.8
55.3
57.8
53.9
53.5
MM (0, 5)
Mean-w/
55.6
54.7
55.6
54.3
49.5
Stat-w/o
59.1
56.4
59.0
54.5
54.3
Stat-w/ (ours)
57.1 (L)
55.9
57)0
(1)
55.4
DISCUSSION AND FUTURE WORK
In this paper, propose training free robust late-fusion method. Intuitively, method designs filter for each sample during inference (i.c., test time). Such filter is implemented by Jacobian reg- ularization, and after sample goes through it, the change of final multimodal prediction is limited to some amount under an input perturbation. The error bound analysis and series of experiments jus- tify the efficacy of our method both theoretically and numerically. The Twomoon example explains the biasing effect of the extra modality, rooted for the difference between unimodal and multimodal.
Our method opens up other directions for further exploration. In the unimodal context, under- stand that directly applying our method usually doesn't 't change the prediction. Thus, would be capable adjust the confidence of DNN? Another possibility is that besides W., deliberately add another bias term by and optimize both for unimodal robustness. Alternatively, in the multi- modal context, we might consider minimizing the derivative of the final prediction directly to the input feature. Moreover, is educational to compare it with consistency regularization. Last but not least, statistical fusion implicitly uses the assumption that train and test data come from the same distribution, so that we could calculate freq based on the train dataset and reuse it in inference time. When domain shift presents, this doesn't 't work and straightforward remedy might be make freq learnable parameter.
REFERENCES
Tadas Baltrušaitis, Chaitanya Ahuja, and Louis-Philippe Morency. Multimodal machine learning: A survey and taxonomy. IEEE Transactions Pattern Analysis and Machine Intelligence, 41(2): 423 4434 2018.
Richard H. Bartels and George Stewart. Solution of the matrix equation ax+ xb= c. Communica- fions of the ACM, 15(9):820 826, 1972.

---

Under review as a conference paper at ICLR 2022
Christopher M Bishop. Pattern Recognition and Machine Learning. springer, 2006.
Nicholas Carlini and David Wagner. Adversarial examples easily detected: Bypassing ten
detection methods. In Workshop on Artificial Intelligence and Security, pp. 3-14, 2017.
Alvin Chan, Yi Tay, Yew Soon Ong, and Jie Fu. Jacobian adversarially regularized networks for robustness. arXiv preprint 1rXiv:1912.10183. 2019.
Honglie Chen, Weidi Xie, Andrea Vedaldi, and Andrew Zisserman. Vggsound: large-scale audio- visual dataset. In ICASSP, pp. 721-725, 2020a.
Xiaokang Chen, Kwan- Yee Lin, Jingho Wang, Wayne Wu, Chen Qian, Hongsheng Li, and Gang Zeng. Bi-directional cross-modality feature propagation with separation-and-aggreaaii gate for rgb-d semantic segmentation. In ECCV, pp. 561-577, 2020b.
Yi-Ting Chen, Jinghao Shi, Christoph Mertz, Shu Kong, and Deva Ramanan. Multimodal object detection via bayesian fusion. arXiv preprint arXiv:2104.02900 2021.
Di Feng, Christian Haase-Schütz, Lars Rosenbaum, Heinz Hertlein, Claudius Glaeser, Fabian Timm, Werner Wiesbeck, and Klaus Dietmayer. Deep multi-modal object detection and semantic seg- mentation for autonomous driving: Datasets, methods, and challenges. IEEE Transactions on 2020.
Intelligent Transportation Systems,
Jort F Gemmeke, Daniel PW Ellis, Dylan Freedman, Aren Jansen, Wade Lawrence, R Channing Moore. Manoj Plakal, and Marvin Ritter. Audio set: An ontology and human-labelle dataset for audio events. In ICASSP, pp. 776-780, 2017.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572. 2014.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In CVPR, pp. 770-778, 2016.
Judy Hoffman, Daniel A Roberts, and Sho Yaida. Robust learning with jacobian regularization. arXiv preprint arXiv: 1908iv1908..2777 02729, 2019.
Roger A Horn and Charles R Johnson. Matrix analysis. Cambridge university press, 2012.
Daniel Jakubovitz and Raja Giryes. Improving dnn robustness to adversarial attacks using jacobian regularization. In ECCV, pp. 514-529, 2018.
Antony Jameson. Solution of the equation ax+xb=c by inversion of an m m"m or n matrix. SIAM Journal on Applied Mathematics, 16(5): 1020-103, 1968.
Jaekyum Kim, Junho Koh, Yecheol Kim, Jaehyung Choi, Youngbae Hwang, and Jun Won Choi. Robust deep multi-modal learning based on gated information fusion network. In ACCV, pp- 90-106, 2018.
Taewan Kim and Joydeep Ghosh. On single source robustness in deep fusion models. NeurlPS, pp- 2019.
Yuqing Kong and Grant Schoenebeck. Water from two rocks: Maximizing the mutual information. In ACM Conference on Economics and Computation, pp. 177-194, 2018.
Yann LeCun, Bernhard Boser. John S Denker, Donnie Henderson, Richard E Howard. Wayne Hub- bard, and Lawrence Jackel. Backpropagation applied to handwritten zip code recognition. Neural computation, 1(4):541-551 1989.
Xinwang Liu, Li Liu, Qing Liao, Siwei Wang, Yi Zhang. Wenxuan Tu, Chang Tang. Jiyuan Liu, and En Zhu. One pass late fusion multi-view clustering. In ICML, pp. 6850- 2021.
Steven R Livingstone and Frank A Russo. The ryerson audio-visual database of emotional speech and song (ravdess): A dynamic, multimodal set of facial and vocal expressions in north american english. PLOOS One, 13(5)ee016391,, 2018.
10

---

Under review as a conference paper at ICLR 2022
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018.
Charles H Martin and Michael W Mahoney. Implicit self-regularization in deep neural networks: Evidence from random matrix theory and implications for learning. Journal of Machine Learning Research, 22(165):1-73, 2021.
Oier Mees, Andreas Eitel, and Wolfram Burgard. Choosing smartly: Adaptive multimodal fusion for object detection in changing environments. In IROS, pp. 151-156, 2016.
Nicolas Papernot, Fartash Faghri, Nicholas Carlini, lan Goodfellow, Reuben Feinman, Alexey Ku- rakin, Cihang Xie, Yash Sharma, Tom Brown, Aurko Roy, et. Technical report the cleverhans v2. 1.0 adversarial examples library. arXiv preprint arXiv: 2016.
Pérez-Rúá Rúa, Valentin Vielzeuf, Stéphane Patcux, Moez Baccouche, and Frédéric Jurie. Mfas: Multimodal fusion architecture search. CVPR, pp. 6966-6975, 2019.
Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! In NeurlPS, pp. 3358- 3369, 2019.
Xinwei Sun, Yilun Xu, Peng Cao, Yuqing Kong, Lingjing Hu, Shanghang Zhang, and Yizhou Wang. Tegm: An information-theomr framework for supervise multi multi-modality learning. In ECCV, pp. 171-188, 2020.
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be odds with accuracy. In ICLR, 2019.
Abhinav Valada, Johan Vertens, Ankit Dhall, and Wolfram Burgard. Adapnet: Adaptive semantic segmentation in adverse environmental conditions. In ICRA, pp. 4644-4651, 2017.
Dániel Varga, Adrián Csiszárík, and Zsolt Zombori. Gradient regularization improves accuracy of discriminative models. arXiv preprint arXiv: 1712.0999, 2017.
Valentin Vielzeuf, Alexis Lechervy. Stéphane Pateux, and Frédéric Jurie. Centralnet: multilayer approach for multimodal fusion. In Workshop on ECCV, 2018.
Jörg Wagner, Volker Fischer, Michael Herman, and Sven Behnke. Multispectral pedestrian detec- tion using deep fusion convolutional neural networks. In The European Symposium Artificial Neurul Network, pp. 509-514, 2016.
Yikai Wang, Wenbing Huang, Fuchun Sun, Tingyang Xu, Yu Rong, and Junzhou Huang. Deep multimodal fusion by channel exchanging. NeurlPS, 2020.
Zihui Xue, Sucheng Ren, Zhengqi Gao, and Hang Zhao. Multimodal knowledge expansion. In ICCV, 2021.
Yue Yu, Simiao Zuo, Haoming Jiang, Wendi Ren, Tuo Zhao, and Chao Zhang. Fine-tuning pre- trained language model with weak supervision: A contrastive-regulaiized self-training approach. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pp. 1063-1077, 2021.
Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David I Lopez-Paz. mixup: Beyond empirical risk minimization. In ICLR, 2018.
Linjun Zhang, Zhun Deng, Kenji Kawaguchi, Amirata Ghorbani. and James Zou. How does mixup help with robustness and generalization? In ICLR, 2020.
Stephan Zheng, Yang Song, Thomas Leung, and Ian Goodfellow. Improving the robustness of deep neural networks via stability training. In CVPR, pp. 4480-4488, 2016.
11

---

Under review as a conference paper at ICLR 2022
A MISSING DEDUCTION
A.1 EQUIVALENT FORM AND DERIVATIVE STATISTICAL FUSION
In this subsection, we first prove Lemma I For conciseness, denote the k-th element P. as P.A.-- Similar notations are adopted for Ps. Z.A, ZB, and In freq. The k-th element of the left-hand side (I.H)) in Lemma can be simplified as:
exp(*A,)) exp(xB.)) /freqe
PARPBRA frequ Σラ= PA.PB../
Te exp(zg.)) ffreg
K Σ exp(=a,1)
==1
TA
Tu
exp(zA,N exp(2n.)) rreak
(6)
j=1 exp(2A.)) exp (xp(=2,*)//0 [reg,
exp(ZA, 2 In freqs)
5== exp(2A.) + 2B. Im freq,)
which is exactly the k-tth element of the right-hand side (RHS) in Lemma by definition. Note that in the first line of (6. we use the definition PA = 01 (zA). Pø = 0 (zB), and have introduced two normalization constants Ta = exp(2 A)lI and TB = cxp 2 I|1-
By analogy to the above deduction, an equivalent form of
B is p' = (W,z MolzA-W-zz-l freq).
Based on the chain rule and 2 = W Waha + ed, we have:
0p' Op' OZ J'W, w = [p'p' -T Diag(p')) W ThA Az Ah
where we have used the Jacobian matrix of Softmax function calculate J' (Bishop 2006). We emphasize that J' is symmetric.
A.2 SOLUTION OF REGULARIZED JACOBIAN LOss
Because Frobenius norm is convex and a weighted summation with positive coefficients preserves convexity, the relaxed (5) shown in Step 5 of Algorithm Dis convex function with respect to W.. This implies that any local minimum is also the global minimum. We calculate the derivative of the relaxed (5) with respect to W. and it to zero, yielding:
1) W. ( W + W.
(8)
AW + W.B
where for simplicity we have defined A -1/1 1) E RR and B = (W WT) -1 e RK*K
8h is known as Sylvester equation and it has been proven that A and B do not share any eigenvalues, then the Sylvester equation has an unique solution (Jameson 1968 Hom & Johnson 2012 Bartels & Stewart 1972). In our case, since A is positive semi-definit (PSD) and -B is negative semi-definite, the only possible overlapping eigenvalue is O. On one hand, is surely an eigenvalue of A since Ju = Ou, where is column vector with all elements equal to 1. On the other hand, it is argued that well-generalized neural network normally doesn't ' have singular weight matrices (Martin & Mahoney] (02T]) Thus, 0 is almost surely not the overlapping eigenvalue and unique solution of (8) is guaranteed. As demonstrated by Jameson ( (1688). the matrix equation () can be converted to invert K K matrix. As in a classification task, K won't be too large, run time of solving Sylvester equation is affordable in this context. Furthermore, as shown in the above equation, when 7 - 0, the matrix A will tend to infinity, leading to an ill-conditioned matrix equation. This, in turn, implies that the second term in the loss shown in Eq guarantees numerical stability.
A general Sylvester equation has the form: AX XB C, where {A, B, C} are all known and X is required to he solved.
12

---

Under review as a conference paper at ICLR 2022
A.3 PROOF OF THEOREM 1
In the last iteration / = mmx + 0o, noticing Wa satisfies
8
we have:
W. W Al Tr(J
W. W W (
Tr(J (mm))
W
1) "TrAWW B [W]]
(9)
1) TT - W.B)BB-Wa
'T/WW W.W.]
and:
W. IlI Wr W 2W. +1
(10)
Thus we have:
| (mma) Wa W Wall -
1 [[1 7)] W. WAlF ?
W. 1
2
{TTr(W= W.W.I Tr W 2W? +1]
(11)
Tr WaW"
2(1 -)
2(1 - Tr
2(1 - 7)
where we have taken advantage the fact that W. WT is positive semi-definite matrix, and thus its trace is no less than zero. Based on the first-order Taylor expansion, we have:
0p'
p /moise
p'
noise
hA)
Ah
Öp (tn+t))))
(12)
poise hA)
Th
2 (Imm) Wo W. Wh h4)
Thus have:
p Moise
p'll $ || (1ma) (mma)
W. W WalFe || hall
KK
-/|xx10isc x.1
V 2(1 -2)
(13)
TK
1 2(1 -7) |||||
where we have utilized the /-Lipschitz continuity of fA-
A.4 UNIMODAL 2D CASE
Consider illustrating example when K 2 (a.k.a. unimodal binary classification). In this case, the final prediction two dimensional: p = [P] P2] TT_ We denote the raw logit after adding the W matrix as z' Wzz, and its entries are denoted o and z/z Let us begin by explicitly writing out the first line of (8). After some simplification, we obtain:
[
K -K
K
P1
b
+
P2
I
(14)
P3
P4
P3
P4
where x = 1/7 1. Here we have explicitly written out the elements of WWT and merged some terms of J into PIp2(w?, wfz). P1P2(W2r wi + W12W22), and P1P2(W2) w22)-
13

---

Under review as a conference paper at ICLR 2022
The unknowns occur in Wa:
P1
(15)
P3
P1
After some algebra, we can solve all unknowns via the following block matrix inversion:
P1
P2
G
H
0
(16)
P3
H
G
0
P4
where for simplicity, we have defined:
+ aK
bk
bbc
G =
H
(17)
bks
+ CK
bb
CAS
Noticing that z' W we can prove that:
(ef z52) (=1 22) = x²² P1
P3
-(p1 p3)
(18)
P2
P4
(02 - P4)
It is easy to calculate the eigenvalue of the matrix in the middle is 0 and + P P2 P3. In other words, if we could prove P1 + P2 P3 is no less than zero, then the matrix in the middle is positive semi-definite, which implies order preserving property holds: If 21 >> then zj > 2/2 and vice versa. This order preserving property equivalent to say that adding the W matrix makes no sense in unimodal binary classification problem, since the predication won't 't change for any input.
Now let us prove Pt + P4 P2
pa 2 O. With a lot of algebra, we obtain:
P1
P1 + P4 - P2
Ps = [1
-1 11
P2
P3
P4
(19)
G H
0
=[1 -1 -1
H
G
0
2(a + 2b + c)N 2 4(ac B3 + 2(a + c)K +1
Based on the definitions of {a, b, c, d}. by using Cauchy inequality and completing square, we could prove: ac b² 2 0, + 2 0, + 2b + 0, and a 2b + O.
Treat K (0, oo) as variable. The derivative of [99 with respect to a fraction. Its denominator is always larger than zero, while the numerator is quadratic polynomial:
8(b2 - ac) (a + 26 + c) x² + 16(6 ac) 2 (a 2b + c)
(20)
20
Thus P1 + P1 P3 monotonically decreases when x increases in (0, oo). Its minimum value equals and attained when x op. Our proof completes.
A.5 UNIMODAL HIGH- DIMENSIONAL. CASE
Without loss of generality, consider the case when WWT I. We emphasize this is mild assumption. Because when W doesn't satisff this condition, we could perform SVD decomposition W UEV and convert the FC layer Wh + into three sequential linear layers: h - Vh - VVh + UEVh +b. b, where now the weight matrix in the last layer satisfies UU = II Under this assumption B (WWT)- I, (8) could be further simplified as:
W = I0 1) -
(n I)
(21)
14

---

Under review as a conference paper at ICLR 2022
where J' = J()) is known, and for simplicity, have denoted 1/7 1. From this expression, clear that the second term (5) guarantees numerical stability, since J not invertible define helper vector eij E TR& whose i-th and j-th entries equal and -1, respectively, and all other entries equal O.
and without the identity matrix (2Ip doesn't 't exist. Before moving
Then considering the relation of z' w, we have:
(2) 22 2,) (z' ex)))))effz2)
(22)
= zz eij e.jee W
This implies that if Ciy c W W/' order preserving property holds (i.e., if 2; 2j. then 2 2/). Since c;jo, W is asymmetrical, examining whether it is PSD requires us to focus on the summation of its transpose and itself. Namely, eije, W=1 is PSD if and only if the eigenvalues of ee W- + (eirei) w= are all no less than zero. Notice that W, and W are symmetric as shown
is positive semi-definite (PSD) matrix for arbitrary i * j. then the
21
we have
e e T W + (eie W- 1T e
W- e
- (KJ
+
I) + (KJ' + De,
(23)
=2e,,e + x(e + J Pejeee)))
For simplicity denote the set of и. which can make all eigenvalues of the aforementioned matrix non-negative as: Ti for > 0fAmin (2c,,e², + x(e,je,,JJ²2 J. 2 0}, where Aman (.) represents the minimum eigenvalue of matrix. Then necessary and sufficient condition for the der persevering property is x E NiysTis An immediate corollary is: if we want the final prediction
to change after adding Wz, then we must have & Niziiis
B EXPERIMENT DETAILS AND ABLATION STUDY
B. DEFINITION OF OMEGA
3
3
9
Figure 5: Image samples in AV-MNIST. Original images shown in the first column, and their counterparts perturbed by Gaussian noise ( (w 0.2) are shown in the second column. The third (W3 1) and last (wg 2) column show the images perturbed by bias noise.
Take AV-MNIST an example. We have defined the following types of perturbations.
Gaussian noise: Perturb every element x in the image (or audio) feature by Gaussian noise in the form of poiss = (1 + c)æ, where e ~ N(0, w.).
Missing entries: For the audio modality, we randomly select w1 consecutive columns (or rows) and all elements in there are set to O. This corresponds to missing time frames (or frequency components).
Bias noise: For the image modality, randomly select an image patch with size of we X wg, and every element x in there is perturbed by given amount: hoise = wg This corresponds change of illumination. (see Figure 5)
FGSM attack: We the Cleverhans libarary Papermot et al. 2016) implement FGSM attack on the input image/audio feature with To norm. The maximum overall norm variation is wi (e.g., wa 0.3).
15

---

Under review as a conference paper at ICLR 2022
PGD attack: Cleverhans is adopted to implement PGD attack the input image/audio feature with 1. norm. The maximum overall norm variation also equals wa, and that for each inner attack is ws (e.g., 45g 0.01), and the number of inner attacks is wg.
Unless explicitly mentioned, we is set to 20.
B.2 EXTRA RESULTS ON AV-MNIST
Impact of hyper-parameters Following Figure we plot model accuracy versus magnitude of
noise/attack with different gamma values in Figure 6 For comparison purpose, Figure re-drawn first row. As demonstrated in Figure 6 alongside the increasing of 7, the gap between the orange and blue lines becomes smaller. However, the orange lines consistently appear upon the blue lines, indicating that our method works in a wide range of gamma value and that tuning is relatively easy in our method. We emphasize that 1.0 is equivalent to trivial fusion.
95
95
95
wl JacoReg wi JacoReg
93
Accunay (%)
Accuracy (%)
81
89
Accuracy
91
74
86
89
67
w/o JacoReg
87
w/o JacoReg
JacoRog
w/ JacoReg
60
81
85 0.020
0,025
0.035
0.040
Stdl of Goussian moise Weo
Magnitaide of missing entries Wh
Magnitude of FGSM attack wa
wio IacoReg
JacoReg Jacokeg
88
92
JacoReg
Accurccy (96)
Accurccy (%6)
89
Accuracy
74
86
89
67
w/o Jacolee JacoReg
83
87-
85
0.0
0.5
1.0
1.5
2.0
0
10
15
20
0.020
0.025
0.030
0.035
0.040
Gaussian noise wa
Magnitaide of missing entries w1
Magninade FGSM attack We
w/o JacoReg w/ JacoReg
wio JacoReg
w/ IncoRey
Accuracy (%)
Accuracy (%)
81
Accuracy
86
w/o JacoReg
JacoReg
60
81
85
0.0
0.5
0.020
0.025
0.030
0.035
0.040
Std Goussian noise
Magnituide of missing entries
Magnitude of FGFS attack
Figure 6: Accuracies of multimodal networks obtained by statistically fusing a vanilla image net- work and audio network with 7 0.1 (the 1-st row), 7 0.5 (the 2-nd row), and y 0.9 (the 3-rd row). Mean and Std of 20 repeated experiments are shown by the solid lines and the shaded regions, respectively. Note that FGSM attack is deterministie, thus there is almost variance when repeating experiments.
Perturbation on the image modality Unlike in the main text. here consider perturbations on the image modality, while the audio modality is assumed clean. Consequently, we invoke our Jacobian regularization method for the image modality, while keep the audio modality unchanged. We have deliberately enlarged the magnitude of the noise/attack, and results are reported in Table
As shown in Table confidence-weightee summation still doesn't outperform purely mean fusion in all cases. Regards to statistical fusion, the second column demonstrates that this time our Jacobian regularization might lead to accuracy drop clean data. The phenomenon that robust network
16

---

Under review as a conference paper at ICLR 2022
is less accurate clean data might happen suggested by Tsipras et al. (2019). However, notice that such phenomenon doesn't occur in Table [ We believe that such difference might lie intrinsically in modality difference, and we will explore it in our future work.
Table 4: Accuracies of different models (%) are evaluated on AV-MNIST when image features are perturbed. Mean accuracies are reported after repeatedly running 20 times.
UM/MM
Model
Clean
wlp
2.5
w2.3
10,2
wa
0.07
we
0.008
O: Aud-regT
83.9
83.9
83.9
83.9
83.9
1: Img-regT
73.4
24.4
37.2
15.6
12.3
UM Nets
Img-advT
73.1
33.4
10.5
3: Img-
65.1
36.2
40.7
46.7
42.6
4: Img-staTT 74.2
29.5
49.0
19.4
14.1
5: Img-mixT 74.1
30.4
37.6
37.3
23.9
Mean-w/o 93.6
71.9
84.6
83.2
80.0
MM
Mean-w/
90.5
78.1
83.5
81.6
77.7
(0,
Stat-w/o
93.6
71.7
84.2
79.9
Stat-w/
91.3 (L)
75.2 (L)
86.4 (1)
85.4 (7)
83.3 (1)
Mean-w/o
93.9
83.6
85.4
89.9
88.4
MM (0,
Mean-w/
91.5
82.7
82.0
86.1
83.2
Stat-w/o
93.9
83.5
85.4
89.9
88.4
Stat-w/ (ours)
90.8 (L)
85)
86.9 (1)
88.1 (U)
87.6 (1)
Mean-w/o
91.4
87.1
88.1
88.8
88.6
MM
Mean-w/
88.3
85.6
85.7
85.9
85.5
(0.
Stat-w/o
91.4
87.1
88.2
88.8
88.6
Stat-w/ (ours)
90.9 (L)
87.0 (L)
88.2 (1)
88.6 (U)
88.3 (1)
Mean-w/o
93.7
77.8
89.0
85.1
82.0
MM (0,
Mean-w/
91.1
83.3
86.8
82.3
78.0
Stat-w/o
93.7
77.8
89.1
Stat w/ (ours)
91.3 (1)
79.9
89.3 (1)
86.4
84.6 (1)
Mean-w/o
92.6
85.7
86.5
87.2
81.2
MM
Mean-w/
90.1
84.5
84.4
84.3
80.0
(0.
Stat-w/o
92.6
85.7
86.7
Stat-w/ (ours)
92.2 (1)
85.7 (1)
86.9 (1)
87.1 (L)
84.6 (1)
Noise both modality We further consider the setting when both image and audio modality are perturbed by Gaussian noise in Table []] which differs ours from Kim & Ghosh (2019.
B.3 EXTRA RESULTS ON RAVDESS
Following Figure O also plot model accuracy versus magnitude of noise/attack with different gamma values in the emotion recognition experiment. The results are shown in Figure 7 The multimodal network with our Jacobian regularization invoked (i.e., the orange line) almost surpasses the network without that invoked (i.e., the blue line) in all cases.
Impact hyper-parameter
Perturbation on the image modality Here we consider perturbations on the image modality. Similarly, we have deliberately enlarged the magnitude of the noise/attack, and results are presented in Table 6 As demonstrated in the table, the mutimodal network enhanced by our method usually achieves the best accuracy among all models except in few cases. Also, our Jacobian regularization could usually improve model accuracy except in the clean case. We notice that in some extreme cases when the image modality is severely perturbed, the multimdoal network might be even worse than the regular unimodal audio network. This, in turn, implies that multimodal fusion is not always the winner, especially when large noise/attack presented.
B.4 EXTRA RESULTS ON VGGSOUND
Impact of hyper-parameters We also plot model accuracy versus magnitude of noise on video modality with different gamma values in the VGGSound experiment in Figure
Unknown Noise on Single Modality To capture another setting, here we consider that the video modality (or audio modality) is corrupted, and both modalities trained with robust add-ons in Ta-
17

---

Under review as a conference paper at ICLR 2022
Table 5: Accuracies of different models (%) are evaluated AV-MNIST when both modalities
perturbed by Gaussian noise. Mean accuracies are reported after repeatedly running 20 times.
UM/ UM/MM
Model
Clean
1.0
1.5
Wp
2.0
2.5
0: Img-regT
73.4
46.7
35.9
28.8
24.2
1: Aud-regT
83.9
55.0
34.8
25.0
20.4
UM
2: Img-staT
74.4
60.5
47.6
38.2
30.8
Nets
Aud-staT
85.1
70.4
51.8
37.6
28.9
4: Img-mixT
74.1
53.0
43.3
36.0
30.4
5: Aud-mixT
87.6
61.2
41.0
28.0
21.1
Mean-w/o
93.6
69.6
46.8
34.0
27.5
MM
Mean-w/
91.0
64.0
43.4
32.0
25.8
(0, 1)
Stat-w/o
93.6
69.5
46.6
33.8
27.1
Stat-w/
(3)
70.3
47.9 (T)
34
27.6 (1)
Mean-w/o
93.0
83.1
65.1
48.5
36.6
MM (2,
Mean-w/
90.6
78.5
60.8
46.0
36.0
Stat-w/o
93.1
83.0
65.5
48.3
36.8
Stat-w/ (ours)
93.6 (1)
84.4 (1)
66.7 (1)
49.2 (t)
36.9 (?)
Mean-w/o
95.5
75.4
55.1
40.3
31.6
MM (4,
Mean-w/
94.1
70.5
50.1
37.6
29.8
Stat-w/o
95.4
75.4
54.9
40.2
31.5
Stat-w/ (ours)
(J)
75.2 (1)
54.9
40.2())
31.6
Table Accuracies of different models (%) are evaluated on RAVDESS when image features are perturbed. Mean accuracies reported after repeatedly running 20 times.
UM/MM
Model
Clean
wp
4.0
W2.3
200,
-4
W4
0.07
Ws
0.008
0: Aud-regT
71.9
71.9
71.9
71.9
71.9
1: Img-regT
82.5
25.9
21.3
21.1
10.7
Img-advT
83.3
21.1
29.4
40.0
Nets
3: Img-freT
76.0
15.3
24.7
50.1
38.7
4: Img-staT
83.7
35.1
23.7
17.0
10.9
5: Img-mixt T
85.1
15.7
27.3
8.4
8.5
Mean-w/o
89.8
63.3
40.8
49.2
21.8
MM
Mean-w/
88.5
64.6
40.4
43.3
16.3
(0.
Stat-w/o
89.9
63.6
41.1
49.4
21.8
Stat-w/ (ours)
88.7 (L)
66.1
43)
54)
23.5 (t)
Mcan-w/o
89.2
51.8
62.0
78.2
74.0
MM
Mean-we w/
87.4
61.9
63.1
69.3
56.4
(0.
Stat-w/o
89.2
51.7
62.3
74.2
Stat-w/ (ours)
87.7 (L)
54.3 (1)
64.6
78.9
75.1
Mean-wil w/o
86.9
37.5
63.5
81.3
77.6
MM
Mean-w/
84.1
40.1
62.0
74.6
68.1
(0.
Stat-w/o
86.9
37.6
63.7
81.1
77.7
Stat-w/ (ours)
84.8 (L)
40)
(6.5(1)
80.6 (L)
78.6(1)
Mean-w/o
89.6
75.7
52.8
55.8
32.0
MM
Mean-w/
86.7
71.8
53.7
51.4
19.8
(0.
Stal-w/o
89.5
76.3
52.9
55.7
Stat-w/ (ours)
87.8 (L)
76.4 (1)
56.2
60.5 60.5
35.3 (1)
Mean-w/l w/o
83.0
73.1
72.0
66.5
53.8
MM
Mean-w/
82.4
69.5
69.9
66.3
33.2
(0.
Stat-w/o
82.9
73.1
72.1
66.5
54.0
Stat w/ (ours)
80.3 (L)
73.7
73.3 (1)
69.4 (1)
58.8 (1)
ble and 3 respectively. We emphasize that this setting is valid because in real-world applications, we sometimes do not know which modality is corrupted. As shown in these tables, the multimodal networks fused by method could usually achieve higher accuracies in most cases, except when
and
18

---

Under review as a conference paper at ICLR 2022
wro JacoReg
88
87
70
w/ JacoReg
Accuracy (9%)
Accurncy (%)
Accuracy (%)
81
84
65
74
83
wio JacoReg JacoRog
wi JacoReg JacoRog
78
60
50
0.0
0.5
1.0
1.5
2.0
75
10
15
20
0.020
0.025
0.030
0.035
0.040
Gaussian
(a)
Magnituide of missing entries (
Magnitude FGSM attuck We
95
90
75
w/o JacoReg w/ JacoReg
wro JacoReg
88
70
w/ JacoReg
Acguracy (%5
Acguracy (%)
Accuracy (%)
84
60
81
67-
wio JacoReg
55
JacoReg
60
50
75
0.0
0.5
2.0
5
0.020
0.025
0.030
0.035
0.040
Sid of Caussiaa noise We
Magnituide of missing entries
Magnitude of FGSM attack
95
75
JacoReg
JacoReg w: JscoReg
87
w/ JacoRag
Accuracy (%)
Accuncy (%)
Accuracy (%)
84
74
83
60
67-
wio JacoReg
55
wi IncoReg
60
75
0.030 0.040
Sid of Gaussian noise We
Magnituide of missing entries w))
Magnitude of FGSM attack W14
Figure 7: Accuracies of multimodal networks obtained by statistically fusing a vanilla image net- work and audio network with > 0.1 (the 1-st row), = 0.5 (the 2-nd row), and y 0.9 (the 3-rd row). Mean and Std of 20 repeated experiments are shown by the solid lines and the shaded regions, respectively. Note that FGSM attack is deterministic, thus there is almost no variance when repeating experiments.
both unimodal networks are learned with free-m training Moreover, the fact that our Jacobian regularized multimodal network with a corrupted modality still outperforms the unimodal network with clean data in all cases demonstrates the positive effect of an extra modality.
60
60
60
JacoR
Accurayy (96)
55
55
Accurscy (%))
-55
w/ Jacolteg
Accurscy
50
50
50
45
wio JacoReg
45
w/o JacoReg JaceRog
JacoRsg
40.0
0.5
1.0
1.5
2.0
4
0.5
1.0
1.5
2.0
48.0
0.5
1.0
1.5
2.0
Std of Gausssia noise
Stal Gaussian noise
Std Gaussian noise
Figure 8: Accuracies of multimodal networks obtained by statistically fusing a vanilla image net- work and audio network with 0.1 (the 1-st column), = 0.5 (the 2-nd column), and y = 0.99 (the 3-rd column). Mean and Std of 5 repeated experiments are shown by the solid lines and the shaded regions, respectively.
We neglect the cases when networks are tested on clean data, since it is possible that robust network is less accurate clean data as suggested by Tsipras et al. (2019).
19

---

Under review as a conference paper at ICLR 2022
Table 7: Accuracies of different models (%) are evaluated on VGGSound when video features are perturbed. Mean accuracies are reported after repeatedly running times.
UM/MM
Model
Clean
1.5
W1
6
W4
0.03
4/
0.001
Img-regT
27.4
5.78
27.4
1: T
54.4
15.0
49.8
23.0
19.9
2: Img-advT
27.5
5.3
27.4
10.7
10.3
3: Aud-advT
54.8
19.4
50.6
41.8
48.5
UM
Img-freT
22.2
4.0
22.2
19.4
20.9
Aud-freT
32.4
49.3
6: Img-staT
27.0
6.9
26.9
10.5
9.6
7: Aud-staT
55.2
18.8
50.0
22.4
20.1
8: Img- m
27.2
8.4
27.1
7.3
7.2
Aud-mixT
56.3
1.57
50.1
11.7
Mean-w/o
57.7
45.8
57.6
35.0
25.7
Mean-w/
53.9
48.6
53.8
37.9
(0, 1)
Stat-w/o
58.5
46.0
58.4
35.3
26.0
Stat-w/ (ours)
60.1 (1)
51.2 (1)
60.0 (1)
39.7(1)
28)5
Mean-w/o
59.1
45.2
59.9
36.6
26.9
Mean-w/
48.6
54.6
(2, 3)
Stat-w/o
59.6
45.4
59.6
37.1
27.1
Stat-w/ (ours)
61.0 (1)
50.0 (1)
61.0
40.9
29.7 (1)
Mean-w/o
54.6
42.2
52.5
54.5
54.6
Mean-w/
37.6
(4, 5)
Stat-w/o
56.4
43.7
54.4
56.3
56.4
Stat-w/ (ours)
45.1 (L)
38.6 (L)
43)9
44.3
44)
Mean-w/o
57.5
47.6
57.4
37.3
30.8
Mean-w/
49.4
23.0
(6. 7)
Stat-w/o
58.2
48.0
58.1
37.7
31.1
Stat-w/ (ours)
60.0(1)
52.2(1)
59.9
41.3
34.4
Mean-w/o
57.6
48.1
57.5
12.8
33.6
Mean-w/
57.8
52.2
57.8
50.9
33.6
(8, 9)
Stat-w/o
59.7
50.1
59.5
44.2
34.6
Stat-wo w/ (ours)
60.4 (1)
57.4 (1)
60.3
54.3
49.9
20

---

Under review as a conference paper at ICLR 2022
Table 8: Accuracies of different models (%) are evaluated on VGGSound when audio features are perturbed. Mean accuracies are reported after repeatedly running times.
UM / MM
Model
Clean
Wl
41
44 = 0.03
W/
0.001
I
27.4
5.78
27.4
9.5
9.0
1: Aud-regT
54.4
15.0
49.8
23.0
19.9
2: Img-adyT
27.5
5.3
27.4
10.7
10.3
3: Aud-advT
54.8
19.4
50.6
41.8
48.5
UM
4: Img-freT
22.2
4.0
22.2
19.4
20.9
Nets
Aud-freT
49.2
32.4
46.6
48.2
49.3
6: Img-staT 27.0
6.9
26.9
10.5
9.6
7: Aud-staT
55.2
18.8
50.0
22.1
20.1
8: Img-min mixT
27.2
8.4
27.1
7.3
7.2
Aud mixT
56.3
1.57
50.1
16.9
11.7
Mean-w/o
57.7
29.5
55.5
36.2
32.7
MM (0, 1)
Mean-w/
53.9
23.4
50.8
29.8
25.2
Stat-w/o
58.5
30.5
56.1
36.6
32.9
Stat-w/ (ours)
60.0(1)
31.3 (1)
52.6
38.9 (1)
35.5 (1)
Mean-w/o
59.1
37.5
56.7
53.4
55.9
MM (2, 3)
Mean-w/
54.8
29.7
52.0
43.7
48.5
Stat-w/o
59.6
38.0
57.1
54.2
56.5
Stat-w/ (ours)
55.4
38.5 (1)
53.2
56.3 (1)
57.9 (1)
Mean-w/o
54.6
39.2
54.6
54.6
54.6
MM (4, 5)
Mean-w/
51.4
45.4
51.3
51.5
Stat-w/o
56.5
39.2
58.8
55.8
55.4
Stat-w/ (ours)
46.2 (L)
35.5 (L)
57.3
(J)
47.3 (L)
Mean-w/o
57.5
36.2
55.7
36.7
35.2
MM (6. 7)
Mean-w/
53.3
36.3
52.0
28.5
37.1
Stat-w/o
58.2
35.7
55.0
36.9
31.0
Stat-w/ (ours)
(1)
27.7 (1)
50.2(1)
38.8 (1)
25.
Mean-w/o
57.5
4.1
51.5
21.1
31.2
MM (8, 9)
Mean-w/
57.8
3.5
53.2
17.8
26.9
Stat-w/o
53.8
3.6
56.6
21.2
32,6
Stat-w/ (ours)
59.6 (1)
5.9
52.7
(1)
33.3 (1)
21


Reviews:
[{"review_id": "eNjwwnLrxRR", "reviewer": "Reviewer_oUrr", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n\n- The Jacobian regularization methods is simple and straight forward. \n- The paper provide a theoretical error bound of the proposed robust late-fusion method.\n- The ablation of \\gamma on the necessity of extra modalities via the TwoMoon example is interesting.\n\nWeaknesses:\n\n- In the related work section, the paper claim (robust) late-fusion in multimodal learning is un-explored in the previous literature, However, this is not entirely true, some of the missing references includes [1][2].\n- The paper provide some experimental results, i.e. Multimodal classfication dataset AV-MNIST/VGGSound and Emotion Recogition dataset RAVDESS. However, this is not a extensive in multimodal learning. More real-world tasks and datasets should be considered, e.g. RGB-D Human Action Recognition dataset NTU-RGBD, multimodal classfication dataset Kinetics400/AudioSet.\n\nMore comments:\n\n- In their implementation, the author mentioned one iteration could already yield a sufficient accurate result (tmax = 1), I'm a little bit suprise on this, can you elaborate more on this? \n\n\n[1] MMTM: Multimodal Transfer Module for CNN Fusion, CVPR 2020\n[2] Deep Multimodal Fusion by Channel Exchanging, NeurIPS", "summary_of_the_paper": "The paper proposed a training-free robust multimodal learning late-fusion methods via sample-wise Jacobian regularization. The key idea of the work is to minimize the Frobenius norm of a Jacobian matrix, so that the multimodal prediction is stabilized. The paper demonstrate\nthe good efficacy on both adversarial attacks and random corruptions setting on multimoda datasets such as AV-MNIST/VGGSound/RAVDESS.\n", "summary_of_the_review": "The paper proposed a simple multimodal fusion methods based on Jacobian regularization, However, there are minor issue in related work, and experiments are not extensive, i.e. only valided on smaller Toy datasets.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "HPDioUk70I6", "reviewer": "Reviewer_dv5k", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n\n- The idea is interesting and well-motivated\n- The empirical results on various datasets are solid\n\nWeakness/major concerns:\n\n- To make eq(1) more rigorous, I would suggest to note the shape of $W_{A/B}$ and $h_A$. \n- in Eq(2) $freq$ contains the occuring frequencies of each class, calculated from the train dataset. Will it be directly applied to compute $p$ on test dataset? Looks like this approach only invoked at test time, so I think the answer is yes. Here $freq$ denotes the class prior which is crucial for computing $p$ accurately. I think when domain shift, more specifically label shift exsit between train and test dataset, it is inappropriate to estimate the test class prior from train dataset. Does the proposed method can handle this problem?\n- In eq(5), is the objective $\\min_{W_a} L$ or $\\min_{W_a,W_A} L$? According to the Algorithm 1, it minimizes over $W_a$. It would be better to clarify in the equation as well.\n- To me the error bound in Theorem 1 is very loose. Is it possible to compute the value exactly for some experiment settings, for instance biase noise? We can make some moderate assumptions, like set the Lipschitz constant to 1.\n- Is this the work pipline of the algorithm, at training time, we fuse $z_A$ and $z_B$ directly; at test time, we fuse $W_a z_A$ and $W_b z_B$ with optimized $W_a$? Do we have to solve the Sylvester equation for each mini-batch? I would appreicate if the authors can help me to get a better understanding  of their algorithm. \n- For AV-MNIST experiment, would it be more interesting to perturb the image modality? Intuitively, image modal provide more useful information than audio modality. But of course this is not necessary to be true. ", "summary_of_the_paper": "In this paper, the authors proposed a training-free late-fusion method for robust multimodal learning. They specifically considering its performance under adversarial attacks and random corruptions which usually confuse the model by introducing noise to the input data. To promote the multimodal prediction robust to attacks, they propose to minimize the Frobenius norm of Jacobian matrix so that the prediction becomes stable to the perturbation of inputs. They also provide a theoretical error bound of their method. The experimental results outperfom other late-fusion methods. ", "summary_of_the_review": "I would consider to raise my score, if the authors can address my concern.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "5vLBaGy_LYG", "reviewer": "Reviewer_BBZL", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "\n## Strength\n\n- This paper proposes to utilize Jacobian regularization to improve neural networks' robustness when one of the modality is corrupted. This method is intuitively sound and also provides rigorous guarantee by *Theorem 1* that the corruption can only models' final prediction to a certain amount.\n- To find the optimal $W_a$ matrix, this paper also proposes an efficient optimization algorithm.\n- In the experiments section, this paper's method could outperform baselines for most of the time.\n\n## Weakness\n\n- This paper makes the assumption that the corrupted modality is known. It would be appreciated if the authors could provide concrete examples about this scenario or references using similar assumption.\n- The authors state that their method is *training-free*. Actually, there involves some optimization operation to identify $W_a$. It would be good if the authors explicitly explain what their *trianing-free* means. If possible, some similar definition in other papers would be appreciated. (The authors state that their method is *the first to propose a training-free robust late-fusion method*. It would be important to check whether the authors' definition of *training-free* is consistent with other paper.)\n- The rows in *Table 1*, *Table 2*, and *Table 3* are not clear. It would be good if the authors could explicitly define *UM*, *MM*, *(0, k)* mean. \n\n## Questions and minor typos\n\n- In the explanation for *equation (5)*, the authors write *the second term in the loss guarantees numerical stability*. It would be good if the authors could explain what the *numerical stability* means here.\n- At the end of Section 4, the authors write *the extra modailty plays a key role*. The *key role* term is vague. Could the authors be explicit about what the role of the extra modality is?\n- In the second paragraph, the authors write *our method invoked even larter than (0,2)*. *larter* might be a typo. \n\n- In *equation (4)*, should $P'P^{',T}$ be $P'P^{'T}$ ?", "summary_of_the_paper": "This paper propses a late-fusion algorithm for multimodal learning. This algorithm serves to improve the robustness against adversarial attacks and random corruptions. Assuming that which modality is perturbed, this paper propses to leverage Jacobian regularization and conditional independence assumption to fuse predictions from different modalities. Moreover, this paper also provides rigorous error bounds on it error and explain the necessity of extra modality.\n\nIn summary, this paper's main contributions are as follows:\n\n- Propose a late-fusion algorithm based on Jacobian regularization and conditional independence;\n- Derive theoretical error bounds and demonstrate the biasing effect of the extra modality;\n- Conduct comprehensive evaluation on adversarial attacks and random corruptions and outperform baseline late-fusion algorithms.", "summary_of_the_review": "\nThis paper proposes a novel late-fusion algorithm based on Jacobian regularization and conditional independence assumption. It also provides theoretical guarantee on its performance. Further, this paper conducts comprehensive experiments to verify their method. However, there are still some concerns about it assumption and claims. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Meta-review: Three experts reviewed the paper and gave mixed reviews. Reviewer BBZL raised their score to 6 in the discussion phase. Reviewer dv5k was not fully convinced by the rebuttal and remained negative. Reviewer oUrr also remained negative. The reviewers were not excited by the proposed method in general and raised questions about both experiments and theoretical results. AC found clear merits in the paper, but the reviewers' comments suggested the work could be strengthened in both experiments and presentation. Hence, the decision is *not* to recommend acceptance at this time. The authors are encouraged to consider the reviewers' comments when revising the paper for submission elsewhere.
Decision: Reject