Switching One-Versus-the-Rest Loss to Increase Logit Margins for Adversarial Robustness
Authors: Sekitoshi Kanai
Shin'ya Yamaguchi
Masanori Yamada
Hiroshi Takahashi
Kentaro Ohno
Yasutoshi Ida
Venue: Submitted to ICLR 2023 (2023)
Keywords: Adversarial examples
Deep learning
Loss function
Adversarial training

Abstract: Adversarial training is a promising method to improve the robustness against adversarial attacks. To enhance its performance, recent methods impose high weights on the cross-entropy loss for important data points near the decision boundary. However, these importance-aware methods are vulnerable to sophisticated attacks, e.g., Auto-Attack. In this paper, we experimentally investigate the cause of their vulnerability via margins between logits for the true label and the other labels because they should be large enough to prevent the largest logit from being flipped by the attacks. Our experiments reveal that the histogram of the logit margins of naive adversarial training has two peaks. Thus, the levels of difficulty in increasing logit margins are roughly divided into two: difficult samples (small logit margins) and easy samples (large logit margins). On the other hand, only one peak near zero appears in the histogram of importance-aware methods, i.e., they reduce the logit margins of easy samples. To increase logit margins of difficult samples without reducing those of easy samples, we propose switching one-versus-the-rest loss (SOVR), which switches from cross-entropy to one-versus-the-rest loss (OVR) for difficult samples. We derive trajectories of logit margins for a simple problem and prove that OVR increases logit margins two times larger than the weighted cross-entropy loss. Thus, SOVR increases logit margins of difficult samples, unlike existing methods. We experimentally show that SOVR achieves better robustness against Auto-Attack than importance-aware methods.

Under review as a conference paper at ICLR 2023
SWITCHING ONE- SNN-VERSUS-THE-RES Loss TO INCREASE LOGIT MARGINS FOR ADVERSARIAL Ro- BUSTNESS
Anonymous authors Paper under double-blind review
ABSTRACT
Adversarial training is promising method to improve the robustness against ad- versarial attacks. To enhance its performance, recent methods impose high weights the cross-entropy loss for important data points However, these importance-aweee aware methods are vulnerable to sophisticated attacks, e.g., Atto-Attack. In this paper, experimentally investigate the cause of their vulnerability via margins between logits for the true label and the other labels because they should be large enough prevent the largest logit from being flipped by the attacks. Our experiments reveal that the histogram of the logit margins of naive adversarial training has two peaks. Thus, the levels of difficulty in increasing logit margins are roughly divided into two: difficult samples (small logit margins) and easy samples (large logit margins). On the other hand, only one peak near zero appears in the histogram of importance-awe aware methods, i.e.. they reduce the logit margins of easy samples. To increase logit margins of difficult samples without reducing those of easy samples, we propose switching one-versus-thee rest loss (SOVR), which switches from cross-entropy to one-versus-the theruustthe-rest loss (OVR) for difficult samples. We derive trajectories of logit margins for simple problem and prove that OVR increases logit margins two times larger than the weighted cross-entropy loss. Thus, SOVR increases logit margins of difficult samples, unlike existing methods. We experimentally show that SOVR achieves better robustness against Auto-Attack than importance-aware methods.
the decision boundary.
INTRODUCTION
For multi-class classification problems, deep neural networks have become the de facto standard method in this decade. They classify data point into the label that has the largest logit, which is input of a softmax function. However, the largest logit is easily flipped and deep neural networks can misclassify slightly perturbed data points, which are called adversarial examples (Szegedy al. 2013). Various methods have been presented to search the adversarial examples, and Auto-Attack (Croce &
Hein 2020) is one of the most successful methods at finding the worst-case attacks. For trustworthy deep learning applications, classifiers should be robust against the worst-case attacks. To improve the robustness, many defense methods have also been presented (Kurakin et al. 2016 Madry et al., 2018 Wang et al., 2020b] Cohen et al.] 2019). Among them, adversarial training is promising method. which empinically achieves good robustness (Carmon al. 2019 Kurakin et al. 2016 Madry et al.
2018). However, adversarial training is more difficult than standard training, e.g., it requires higher
sample complexity (Schmidt et al. 2018 Wang al., 2020a) and model capacity (Zhang al., 2021b)
To alleviate the difficulties, several methods focus on the difference in importance of data points (Wang et al.) 2020a Liu et al. [021] Zhang et al.] (021b). These studies hypothesize that data points closer to a decision boundary are more important for adversarial training (Wang et al. 2020a
Zhang et al. bb Liu et al. 2021). To focus on such data points, GAIRAT (Zhang et al. 202 lb
and MAIL (Liu et al. 2021 use weighted softmax cross-entropy loss, which controls weights on the losses the basis of the closeness to the boundary. As the measure of the closeness, GAIRAT uses
the least number of steps at which the iterative attacks make models misclassify the data point. On the
other hand, MAIL uses the measure based on the softmax outputs. However, these importance-aware

---

Under review as a conference paper at ICLR 2023
methods fail to improve the robustness against Auto-Attack, Thus, it is still unclear how to treat the difference in training data points in adversarial training for good robustness.
In this paper, experimentally investigate the cause of their vulnerability via margins between logits for the true label and the other labels because they should be large enough to prevent the largest logit from being flipped by the attacks. Our experiments show that the histogram of the logit margins of naïve adversarial training has two peaks, i.e., small and large logit margins. This indicates that the levels of difficulty in increasing the logit margins are roughly divided into two: difficult samples and easy samples. On the other hand, logit margins of importance-aware methods concentrate near zero, and thus, importance-awent -ware methods reduce the logit margins of easy samples. This implies that the weighted cross entropy used in importance-awe aware methods is not very effective in increasing logit margins. To increase the logit margins of difficult samples, we propose switching one- versus-the-rees loss (SOVR), which switches between cross-entropy and tee-versus-the-rest loss (OVR) for easy and difficult samples, instead of weighting cross-entropy. We prove that OVR is always greater than or equal to cross-entropy on any logits. Furthermore, margin losses minimizing OVR and cross-entropy by using gradient flow on a simple problem and reveal that OVR increases logit margins two times larger than weighted cross-entropy losses. Experiments demonstrate that SOVR increases logit margins more than the naive adversarial training and outperforms GAIRAT (Zhang et al. 2022b), MAIL (Liu et al. [202)) MART (Wang et al. [2020a] MMA (Ding et al. 2020), and EWAT (Kim et al.) 2021) in terms of robustness against Auto-Attack. In addition, we find that our method improves the performance of other recent methods (Wu et
theoretically derive the trajectories of logit
2020 Wang & Wang. 2022) that reduce generalization gap of adversarial training.
2
PRELIMINARIES
2.1
ADVERSARIAL TRAINING
Given N data points x,, IRd and class labels yn E [l,...., K), adversarial training (Madry al. 2018) attempts to solve the following minimax problem with respect to the model parameter 0 R"
ming CAT (0) ( = ming 1/4 En (c
x¹, = In + 8n = nn + mrg 18. (ce(=(2z +6,, 0).)))
(2)
where z(x, 0) (2 (xx 0 .).............................. 2x (x. 0) and 2, 0) is the k-th logit of the model, which is input of softmax: 0) - (m) e=;(m) lce is cross-entropy function, and ||p and are
Ip norm and the magnitude of perturbation 6, E ERd respectively. The inner maximization problem
is solved by projected gradient descent (PGD) (Kurakin et al. 2016 Madry al.) 2018). which updates the adversarial examples as
8, = II. (ō.-1 + rssign (Vo,,, 6x-1,) 0). 9)))
(3)
for K. steps where 7) is a step size. [ is a projection operation into the feasible region (8 | E Rd 1| I =). Note that we focus on p= oo since it is a common setting. For trustworthy deep learning, we should improve the true robustness: the robustness against the worst-case attacks in the feasible region. Thus, the evaluation of robustness should use crafted attacks, e.g., Auto-Attaed (Croce
& Hein 2020), since PGD often fails to find the adversarial examples misclassified by models.
2.2 IMPORTANCE-AWAR ADVERSARIAL TRAINING
GAIRAT (geometry aware instance reweighted adversarial training) Zhang et al. 2021b) and MAIL
(margin-aware instance reweighting learning) (Liu et al. 202T) regard data points closer the decision boundary of the model f as important samples and assign higher weights to the loss for them:
Eweight (0) = M LG (x(CE(=(0') O),)),
(4)
where w. 0 is weight normalized UT V wi
and Σ, wn = 1. GAIRAT determines
the weights through the wn, = 1+tanh[2+5 2 where Kn, is the least steps at which PGD succeeds at attacking models, and À is hyperparameter. On the other hand, MAIL uses Wn sigmoid(-> -Y(P,, -B)) where PM, = f (z',. ( maxt fx , 0). 3 and y are hyperparame- ters. MART (misclassification aware adversarial training) (Wang et al. 2020a) uses similar approach.
2

---

Under review as a conference paper at ICLR 2023
70
Robust
AT
2223
MMA
MAKI
GAIRAT
MAIL
SOVR
PGD-20
APGD
1-APGD
SQUARE
Figure 1: Robustness against PGD and components Auto-Attack on CIFARIO (Krizhevsky Hinton 2009) with PreActResNet18 (RN18). SOVR is our proposed method.
It regards misclassified samples as important samples and controls the difference between the loss on unimportant and important samples. MMA (max-margin adversarial training) (Ding al. (020) also adaptively changes the loss function and ε for each data point, and thus, MMA also has a similar effect to the above methods. We collectively call the above methods importance-awan methods.
2.3 VULNERABILITY OF IMPORTANCE-ANO METHODS TO AUTO-ATTACK
Hitaj et al. (2021) Croce & Hein (2020); Kim et (022)) have reported that the robust accuracies of GAIRAT, MART, and MMA are lower than naive adversarial training when using logit scaling attacks or Auto-Attack (Croce & Hein 2020). Since Auto-Attack searches adversarial examples
by using various attacks, it achieves larger success attack rate than using one attack, e.g., PGD. To clarify the vulnerabilities, we individually evaluate the robustness against the components of Auto-Attack and PGD
on CIFARIO 10 (Fig- D The training setup is the same in Section 6 and we add the results of our method (SOVR) as a reference. This figure shows that almost all importance-awaa methods improve the robustness against PGD and APGD compared with naive adversarial training (AT' (Madry et al. )) However, they do not improve the true robustness; i.e., their robust accuracies against the worst-case attack lower than that of AT. Since the reasons of this vulnerability have not been discussed well, we investigate them in the next section.
3 EVALUATION OF ROBUSTNESS VIA LOGIT MARGIN LOSS
We investigate the causes of the vulnerabilities of importance- aware methods by comparing histograms of logit margin losses. First, we explain that logit margin losses determine the robustness. Next, we experimentally reveal that logit margin losses of importance-awe their logit margins are smaller than AT. We use training data for empirical evaluation in this section because the goal of this section is to investigate the effect of importance-awaa methods, which modify the loss function based on training data points. Experimental setups are provided Appendix E.6
methods concentrate zero; ie..
3.1 POTENTIALLY MISCLASSIFIED DATA DETECTED BY LOGIT MARGIN LOSS
To investigate the robustness of models near each data point, we apply logit margin loss DDng et al. 2020 to the models trained by importance-aware methods. Logit margin loss is
(1M(2(00, 0), zk- (ax) Zy, (ax) maxksy zx (ax) Zyy 2y)("',,
(x'). Since the classifier infers the label of as 9 arg max; zx (æ), correctly classifies x' if f.M 5 O. Thus, the logit margin loss on a difficult sample in adversarial training takes value near zero. We refer to the absolute value of logit margin loss |LLMl as logit margin. In contrast to PM, of MAIL, fLM is not bounded since 2μ (x) can take an arbitrary value in R.
where k* arg (xx").
To explain the effect of logit margins, we assume that the Lipschitz constant of the k-th logit function is LE as (x)(x1) -2 (x2) < LA x 2211o0 In this case, we have the following inequality:
max (x') 2g (x') < max [2 (x) Zy (x) (L+ Ly)= < z (x) (x) (L+ (6)
where & = arg max, Lg. From the above, we define the potentially misclassified sample: Definition 3.1. If a data point æ satisfies 24- (x) - (x) > - -(L + LyyE, we call it a potentially misclassified sample.
3

---

Under review as a conference paper at ICLR 2023
1300
(a) ST
(b) AT
MMA
(d) MART
GAIRAT
(I) MAIL
Figure 2: Histogram of fLM for training data of CIFAR 10 with RN18 18 at the best (top) and the last (bottom) epoch. Best epoch is the epoch when models achieved the best robust accuracy against PGD by early stopping. ST denotes standard training. i.c., training on clean data. For standard training, we use LM on clean data æ, while we plot that on adversarial examples æ' for the other methods. Blue bins are the correctly classified data points, and red bins are misclassified samples.
By using the above definition, we can derive the following:
Proposition 3.2. If data points are not potentially misclassified samples, models are guaranteed to have the certified robustness on them as y arg max; 2x + 8) for any 8 satisfying ||0||> S
All proofs are provided in Appendix A We can estimate the true robustness of each method by counting the number of potentially misclassified samples. Definition and Proposition [3.2 indicate that large logit margins [fLM] small Lipschitz constants L₁ are necessary for the robustness. Thus, the logit margin loss can be the metric of robustness, and we evaluate it in Section 3.2. In Section 6.2.1 provide the estimated number of potentially misclassified samples for each method.
3.2 HISTOGRAMS OF LOGIT MARGIN LOSS
Since logit margin losses determine the number of potentially misclassified samples, we show the histogram of them for each method on CIFAR10 at the last epoch in Fig. Comparing AT (Fig. 2 with standard training (ST, Fig. 2(a).. AT has two peaks the histogram. This indicates that the levels of difficulty in increasing the margins in AT are roughly divided into two: difficult samples (right peak) and easy samples (left peak). Difficult samples correspond to the data close to the boundary; i.e., important samples. Next, comparing AT (Fig. 2 with importance aware methods (Figs. 2(c) ff) their logit margin losses &IM concentrate on zero, and their peaks are sharper than that of AT. This indicates that importance-awarc methods fail to increase the logit margins [fLM| for only difficult samples but also easy samples because the weights for easy samples are relatively small. Thus, it is necessary increase the small logit margins for difficult samples without reducing those of easy samples. Appendix F.] provides results under various settings, which show similar tendencies.
4 PROPOSED METHOD
we observe that (a) training samples are roughly divided into two types via logit margins; ditficult samples and easy samples, and (b) importance-aware methods reduce the logit margins on easy samples since they excessively focus difficult samples. From these observations, our method is based on two ideas: (i) we switch from cross-enter enssopy to an alternative loss for difficult samples by the criterion of the logit margin loss, and (ii) this alternative loss increases the logit margins of difficult samples more than weighted cross-entropy.
In Section 3.2
4.1 ONE-VERSUS THEEEERSU--THEEREREE LOSS (OVR)
The logit margin jag- (x) x,, (x)) should be large while keeping Lipschitz constants of logit functions small values. To this end, we need a loss function to penalize small logit margins. The logit margin loss can be intuitive candidate considers the pair of the largest logit zą- and the logit for the true label zy, and this is not sufficient for the robustness because k- and & in Eq. (6) not necessarily the same. Moreover, the logit margin loss does not have the desirable property for multi-class classification: infinite sample consistent
such loss function. However, the logit margin loss only
(ISC) (Zhang] 2004 Bartlett al. 2003 Lin 2002). To consider the logits for all classes and satisfy
4

---

Under review as a conference paper at ICLR 2023
ISC, our proposed method uses the one-versie vee--ersss-----ese loss (OVR):
(Z 0), y) (z))(2)) + E x(-=2(xx))
When Φ is differentiable non-negative convex function and satisfies d(2) < ((-2) for 0, OVR satisfies ISC (Zhang 2004). As such a function, we set ((z))=lo((11)) + =) and use the following loss:
(z 0) y) log( +e ()))) Σ log(L+ = - (,) Log log (og(1+))((m)) (8)
We provide the detailed reason for this selection of ((z) in Appendix D
4.2 BEHAVIOR LOGIT MARGIN LOSSES BY OVR AND CROSS-ENTRON
To show the effectiveness of OVR in increasing logit margins, we theoretically discuss the difference between OVR and cross-entropy. First, OVR has the following property compared with vross-entropy:
Theorem 4.1. we use OVR (Eq. & and saftmax as fx(x)) = -=+(m)) / Σ. e²1(m), we have
0 S (C v) S (ovn(z(x), y), V(x,y).
(9)
When =y(x) + +o0 and 2x(x) oc for k we have (=)R(=(x), v) ++ and (CB(2(x), +
Thus, OVR always larger than or equal to cross-entropy. and OVR and cross-entropy approach asympiotically to zero when L grows to infinity. In fact, we observed that (ovR(2, y) is about four times greater than fC (z, y) for random logits z ~O, I) and randomly selected y from (I....,10) Thus, we expect OVR to penalize the small logit margin more strongly than cross-entropy.
Besides this general result, we further investigate the effect of OVR logit margin losses by using a simple problem. To analyze the behavior of logit margins, we formulate the following problem:
ming (2.
(10)
where l, is set lOVR or lCE. E is logit vector for a data point æ, and assume that can directly move it in this problem. w E E is a weight of the loss, which appears in Eq. 44). To analyze the dynamics of training on Eq. (TO), use the following assumption.
Assumption 4.2. A logit vector follows the following gradient flow to solve Eq. (10)
dz V we, (z, v),
(11)
where is time step of training. We assume that z initialized zeros z at 0.
Equation [1b is continuous approximation of gradient descent -1 = - V/ in the limit as 77 0. a commonly used method to analyze the dynamics of training (Kunin et al.) 2021 Elkabetz & Cohen 2021
x wes and matches it
Under Assumption 4.2 we have the following lemmas about the logits in the training of Eq. 100
Lemma 4.3. If we OVR lovR (z, v) in Eq. (10,, the k-th logit zx(t) at time t is
zz (t) wt + 1 - ((ett++)
k= ==y.
(12)
--wt - 1 (e
otherwise,
where W is Lambert W function, which is a function satisfying x = W(xe") (Corless et al. 1996).
Lemma 4.4. If we use cross-entropy lcr(z, y) Eq. (10. the k--th logit (t) at time t
(t) wt + K
K-1w
W 1 K
w x-1)
k k= y, otherwise.
K
K-
(13)
K- wt K(R 1J W ( m x+T)
These lemmas give the trajectories of logit vectors in minimization of OVR and cross-entropy, respectively. By using the above lemmas, we derive the trajectory of the logit margin loss: Theorem 4.5. Logit margin losses for the logit vector OVR in the minimization of weighted OVR and logit vector z C in the minimization of weighted cross-entropy at time are
(VR --2w, 2 + 2W (e"tt11)
(14)
lI (E()) = -
--K- Wet
k-1 + W(
R
R wagt k-1),
(15)
R
5

---

Under review as a conference paper at ICLR 2023
CR(65:00 1c
(1-1000,
(Vic OVR (w:))
RK
CE (/1:00 w:3)
Logit Logit morgin lowe
Loga margin
10-
(K:10, ut (0:10.r:5)
Iha
OVR (w:1)
1008
250
303
750
1,00
1250
1800
1730
2000
100 Epoch
200
Time
(a) Minimization of Eq.
10
(b) CIFAR 10 (RNI8)
Figure 4: Histogram of L of SOVR the best (top) and the last (bottom) epoch.
Figure 3: Trajectories of LLM. CE denotes cross-entropy. In (a), RK denotes
4-th order Runge-Kutta method with the step size of 0.1. (b) is trajectory in
adversarial training CIFARIO, and its setup is provided in Appendix FS
where w1 and W2 E R are weights for OVR and cross-entropy, respectively. For large they are approximated by
(IM(2 R log( (W) 1)? (LM(2(((t)) log(K Kwyt tt 1- (K 11 log(K - 1)),
(16)
(17)
and we have lim (LM((CFJO (())) 2 for any fixed wi, w2, and K.
This theorem shows the difference in trajectories of logit margin losses between OVR and cross- entropy under Assumption 4.2 Regardless of the values weights wi and W2, cross-entropy does not increase the logit margins as large OVR for sufficiently large t. Thus, OVR increases the small logit margins more effectively than GAIRAT and MAIL, which use weighted cross-entropy (Eq.
Figure 3(a) plots the trajectory of logit margin losses &LM in the minimization of Eq. (10). This figure shows the solutions in Theorem (solid lines): we use Eqs. (14 and (15) unless overflow occurs due to exponential functions and use Eqs. (16) and (17) when occurs. It also plots numerical solutions of Eq. (IT) by using gradients and the Runge-Kun Kutta method as reference (dashed lines). In Fig. ([a] exactly match the numerical solutions of RK, and thus, logit margins follow Theo- rem 4.5 addition, Fig. ((a)ssowss shows that OVR decreases logit margin losses more than cross-entropy against regardless of K and w. Thus, using OVR is more suitable for increasing the logit margin on difficult data than previous weighting approaches like GAIRAT and MAIL. Figure 3(b) plots trajectories of fLM in adversarial training (Eq. (1) on CIFARIO. It shows that the logit margin [LMl]
Eqs.
(V
of OVR is about twice large as that of cross-entropy at the last epoch F 1.87 for 1),
like the case of Theorem 4.5 Thus, problem Eq. (TOp is simple but precise enough explain the 4v
difference in the logit margins between OVR and cross-entropy on real dataset. In fact, (La(goR)
the last epoch is in [1.5, 2] other datasets, including CIFAR 100 (K 100) (Appendix H3)
As above, we prove that OVR is more effective for increasing logit margins of difficult samples than weighting cross-entropy. In the next section, compose the objective functions switching between OVR and cross-entropy for difficult and easy samples.
4.3 PROPOSED OBJECTIVE FUNCTION: SOVR
Our proposed objective function is
(9) = 1. [(anwess (ce(2(x', (),y)) + +AE (ovn(z(a',0) (2)(((()),))) 0).,))
(18)
where S is a set where logit margin losses f.M are smaller than those in the set L, and we have [S]+| N. These sets correspond to easy and difficult samples in Fig. 2(b) In our method, we regard the top M % data points in minibatch of SGD as the samples in IL. X is a hyperparameter to balance the loss, and is an adversarial example generated by Eq. 2 The proposed algorithm is shown in Appendix B Since we do not additionally generate the adversarial examples for loVR, the overhead our method is negligible:
Ad b) where is minibatch size. In the same way to Section 3.2 evaluate the histograms of logit margin losses for SOVR CIFAR10 in Fig, 4 It shows that SOVR succeeds at increasing the left peak compared with AT (Fig ( This is because OVR strongly penalizes difficult samples in the right peak and moves them into the left peak.
(b ((loog 100

---

Under review as a conference paper at ICLR 2023
SONR
Geserdiratio Cop [S]
SOVR
Bobert 20.. [R]
SOVR
CE
19.0
CB
68.6
50
80
110
20
50
100
10
100
(S)
M7
(5)
(a) (
(b) Generalization Gap
(c) Robust Acc.
Figure 5: The effect of rate of applying OVR M. À is set 0.4. M 0 corresponds to the result of AT with cross-entropy. Generalization gap is gap between training robust accuracy and test robust accuracy against PGD (K==0) at the last epoch. Robust Acc. robust accuracy against Auto-Attack.
Though OVR increases logit margins as explained in Section 4.2 we found that OVR (M - 100) inferior to SOVR because OVR for easy samples can cause overfitting. Figure plots the effect of M in terms of fLM at the last epoch, generalization gap at the last epoch, and robust accuracy against Auto-Attack on CIFARIO.
shows that fL.M monotonically decreases, i.e., robustness improves, when increasing M. However, the generalization gap increases at the same time. Robust accuracy takes the largest value M M=40. 40. Thus, it is necessary to switch losses to focus on difficult (important) samples, like existing importance-awee of A in Appendix F.4 which shows the similar tendencies.
methods. We provide the evaluation of effects
4.4 EXTENSION FOR OTHER DEFENSE METHODS
Since SOVR only modifies the objective function, it can be used with the optimization algorithms for robustness, e.g., adversarial weight perturbation (AWP) (Wu et al. 2020) or self-ensemble adversarial training (SEAT) (Wang& & Wang 2022), which improve generalization performance in adversarial training. However, SOVR is difficult to use with TRADES (Zhang et al. 2019) because TRADES also modifies the objective function. To combine our method with TRADES, we propose TSOVR, which uses SOVR instead of cross-entropy for clean data:
LTSOVR (0)= = ,/4 [sovR + EE BT max 11,,, Il, (f(xn, 0). f(x, + t8 0))
(19)
LSOVR = (EEn)) (c 0). + E(wieeL (=vn 0).
(20)
where and By are hyperparameters. We evaluate the combinations of SOVR with TRADES, AWP (Wu et al. 2020). and SEAT (Wang & Wang 2022) in the experiments.
5 RELATED WORK
The difference importance of data points in adversarial training has been investigated in several stud- ies (Wang et al. 2020a| Zhang et al. 2020 (anyaa al. 2021 Dong et al. 2022 Zhang al. (2020)
investigated the effect difficult samples on natural generalization performance; i.c., generalizatin performance clean data, in adversarial training. They presented friendly adversarial training (FAT) that improves the robustness without compromising the natural generalization performance. Unlike FAT, SOVR focuses on the robust performance. [Sanyal et al. (2021) and Dong et al. (2022) have inves- tigated the effect of memorization in adversarial training: memorizing difficult samples hurts the gen- eralization performance of adversarial training. Whereas they focused on reducing generalization gap by regularization, our method reduces robust error on test data by reducing training robust error: i.c., mitigating underfitting more than overfitting. Cisse et al. (2017 )): Tsuzuku al. (2018) Zhang et al.] (2021a) used logit margins and Lipschitz constants to present certified defense methods. We present a similar result only to justify our evaluation using logit margin loss in Section
3 Though Padhy et al.) (2020) used OVR for OOD detection, they did not discuss the effect of OVR in logit margins.
Studies of (Hitaj et al. 2021 Croce& Hein 2020: Kim et al. 202 have reported the vulnerabilities of some importance -aaenncceewwareee aware methods to logit scaling attacks Auto- Attack but few studies discuss the causes. Kim et al. (02T)) have pointed out that the cause is high entropy in GAIRAT and MART and presented E EWAT (entropy-weighted adversaria training), which imposes higher weight the higher entropy. However, the logit margin is more related to robustness than entropy as discussed in Section Furthermore, weighted cross-entropy in EWAT is less effective than OVR as shown Theorem 4.5
7

---

Under review as a conference paper at ICLR 2023
Table Robust accuracy against Auto-Attack and clean accuracy on test datasets, Robust accuracies of SOVR is statistically significantly different.
Robust Accuracy against Auto-Attack (Lox,
8/255)
AT
MART
MMA
GAIRAT
MAIL
EWAT
SOVR
CIFARIO (RN18)
48.0:20.2
46,9+2..3
37.2+0.9
37.74 1
39.6:00.4
48.2+00.7
49.4 + 0.3
CIFARIO (WRN)
51.9==0.5
50.44+0.09
43.1+1
41.8=0.6
43.3+0.1
51.6+0.3
53.1
0.2
SVHN (RN18)
45.61104
46.910.33
41.011
37.620.6
41.240.3
47.6100
48.5
0.4
CIFARIO0 (RN18)
23.7+-0.3
23.9+0.1
18.4+0.2
19.8+0.5
16.7+0.3
23.52+00.6
24.3
0.2
Clean Accuracy
CIFARIO (RN18)
81.6.0.55
78.3.11
85.5 + 0.7
78.71 0.7
79.510.44
82.810.4
81.9.0.2
CIFARIO (WRN)
85.6+0.11
81.5+1
87.8 1
83.0+0.7
82.2+0.4
86.0+0.5
85.0+0.2
SVHN (RN18)
89.8+0.6
86.9:0.66
93.9 + 0.4
89.9=0.4
89.440.4
90.240.6
90.0
CIFARIO0 (RN18)
53.0.10.7
49.2.10.1
60.6 0.6
52.0.1..5
46.5.10.5
$4.2.11
52.110.8
6 EXPERIMENTS
6.1 SETUP
We conducted the experiments for evaluating SOVR. We first compare SOVR with Madry's AT Madry
et al. 2018). .MA (Ding et al.) 2020), MART (Wang et al.] 2020a). GAIRAT (Zhang et al. 2021b).
MAIL (Liu al. 2021), and EWAT (Kim [l.[[2021]
three datasets: CIFARIO, SVHN, and CIFAR 100 (Krihhvskyy & Hinton 2009 Netzer et al. 2011). Next, we evaluate the combination of SOVR with TRADES (Zhang al. 2019), AWP (Wu al. 2020). and SEAT (Wang & Wang
2022). Our experimental codes are based on source codes provided by (Wu et al. 2020 Wang et al.
2020a Ding al. 2020). We used PreActResNet-118 (RN18) (He al. 2016) for all datasets and
WideResNet-34-11 (WRN) (Zagoruyko & Komodakis, 2016) for CIFAR TO. We used PGD (KC 10.
7 = 2/255, = 8/255) in training. We used early stopping by evaluating test robust accuracies against PGD with I. 10. For AWP and SEAT, we use the original public codes (Wu et al. [020 Wang & Wang / p For AT+AWP and SOVR+AWP, we use the training setup that is used for TRADES+AWP in Wu et al. (2020) by changing losses because
found that it achieves better re- sult. We trained models three times and show the average and standard deviation of test accuracies. For hyperparameters in SOVR, we set (M, A) to (40, 0.4) for CIFAR 10 (RN18). (30, 0.4) for CIFARIO (WRN) and (50, 0.5) for CIFAR100, and (20, 0.2) for SVHN. We set (M, A) to (20, 0.8) for TSOVR and (100, 1.2) for ASP. We use Auto-Attack evaluate the robust accuracy test data. In Appendix D and F we provide the details of setups and additional results, e.g., evaluation using other various attacks. To determine the statistical significant difference, we use I-test with p-value of 0.05.
6.2 RESULTS
We list the robust accuracy against Auto-Attack all datasets in Tab. T In this table, SOVR outperforms the importance-awarr methods and AT in terms of the robustness against Auto-Attack. This is because SOVR increases the logit margins |LLl by using OVR. In fact, Fig, shows that SOVR increases the logit margins fLM for difficult samples. MART improved robustness on SVHN and CIFARI00. This might be because MART does not just impose weights on the loss. However, its improvement is less than SOVR. EWAT also achieves higher robust accuracies than AT on several datasets in Tab. П However, EWAT is not as robust as SOVR because EWAT employs weighted cross-entropy, which is less effective at increasing logit margins than OVR (Theorem 4.5) In Tab. SOVR slightly sacrifices clean accuracies under some settings. We provide the histograms of logit margin losses all datasets in Appendix F.I. which also show SOVR increases margins.
6.2.1 1
EMPIRICAL EVALUATION OF POTENTIALLY MISCLASSIFIED SAMPLES
As discussed in Section 3.1
we can evaluate the robustness near each data point via logit margins and Lipschitz constants of the class-wise logit functions. In this section, we estimate the number of potentially misclassified samples for each method. Since Lipschitz constants for deep neural networks
We could not reproduce the results reported in Wu et al. (2020); Wang & Wang 2022) even though we did modify their codes. This might be hecause report the averaged values for reproducibility.
8

---

Under review as a conference paper at ICLR 2023
AT 5I22
MMA
MART
GAIRAT
MAIL ESS
EWAT
SOVR
100
Raie 18g
70
0
C10 (RN18)
C10 (WRN)
CIFARI00
SVHN
lss-CCO (RN18)
text-C10 (WRN) (WRN)
Jest CIFACIFAOO00
SVINN
Figure 6: Rate of data satisfying Eq.
21
C10 and test- represent CIFARIO and test data, respectively.
Table Robust accuracy against Auto-Attack (Loc, 8 8/255) test dataset of CIFARIO. SEAT
uses WideResNer32-10 following Wang & Wang 2022)
AWP (WRN)
TRADES (WRN)
SEAT (WRN32-10)
AT+
SOVR+AWP
TRADES
TSOVR
TRADES+AWP
TSOVR+AWP
SEAT
+SOVR
Robust Ace.
55.0:1022
56.03:10.07
$2.920.3
53,3:0.1
55.610.4
56.400.2
54,9
55.5+0.3
Clean
87.8=0.1
86.920.4
84.210.7
83.120.2
84.900.5
84,9104
86.810.4
86.510.1
are difficult to compute due to the complexity, we compute the gradient norm of the logit function instead of Lipschitz constants. This is because the gradient norm satisfies sup... |I [V=**<>) (x) I11
Lx
for L3 such as (x1) - 2k (x:2) I Lx [ - x2lloc (Jordan & Dimakis 2020). and we have
Proposition 6.1. If a data point a. satisfies
2k- (2) - (x) > (max, ( + V2 (x))l)),
(21)
it is a potentially misclassified sample.
Thus, we can empirically estimate the number of potentially misclassified samples on each method by the gradient norms. Figure the rate of data points that satisfy Eq. (2T). which are potentially misclassified samples. Comparing Fig. 6 with Tab. [ when the methods have the large rate test data, they have low robust accuracies against Auto- Auto-Attack. This indicates that this rate is reasonable metric for estimating robustness though uses gradient norms instead of Lipschitz constants. Whereas most importance-awee aware methods have higher rates than AT due to small logit margins, SOVR has lower rate. This is because SOVR increases logit margins without increasing gradient norms by using OVR, which is more effective in increasing logit margins than weighted cross-entropy (Section 4.2). In Fig. [6] EWAT does not necessarily increase the rate because EWAT uses weighted cross-entropy. We discuss the reason the rate of AT gets close to SOVR on CIFARIO0 100 in Appendix F.10
6.2.2 EXTENSION FOR OTHER METHODS
To improve the robust accuracy on test data, our method mostly focuses on improving the robustness around training data points rather than regularization. Even so, SOVR can be used with recent regular- ization methods (Wu et al., 2020 Wang Wang 2022), which sometimes sacrifice the training accu- racy to reduce the generalization gap. We evaluated the combination of OVR and TRADES (TSOVR), SOVR and AWP, SOVR and SEAT. Table 2 lists the robust accuracy of the combinations against Auto-Attack and shows that SOVR improved the performance of other recent methods. Thus, SOVR and these methods complementarily improve the performance. Among AT, SOVR, TRADES, and TSOVR, SOVR achieved the best trade-off: SOVR achieved similar robust accuracies TRADES, while it achieved better clean accuracy (Appendix F.6 provides the detailed discussion about trade- off.). We compare them on other datasets in Appendix 19 TSOVR+AWP achieved the best robust accuracy, which is statistically significantly different from TRADES+AWP Note that whereas AWP and SEAT require the time and space complexity depending on model sizes, respectively, the overhead of SOVR depends on only batch-size, and thus, it is easy to use with other methods.
CONCLUSION
We investigated the reason importance-aware methods fail to improve the robustness against Auto- Attack. Our empirical results showed the reason to be that they reduce logit margins of easy samples besides those of difficult samples. From the observation, we proposed SOVR, which switches from cross-entropy to OVR by the criterion of the logit margin loss. We theoretically showed OVR increases logit margins more than cross- for simple problem and experimentally showed that SOVR increases the margins and improves the robustness.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of security: Circumventing defenses to adversarial examples. In Proc. ICML, pp. 274-283, 2018.
Peter I. Bartlett, Michael Jordan, and Jon McAuliffe. Convexity, classification, and risk bounds. 2003.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy (SP), pp. 39-57. JEEE, 2017.
Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C Duchi, and Percy Liang. Unlabeled data improves adversarial robustness. In Proc. NeurlPS, pp. 11190-11201, 11201, 2019.
Moustapha Cisse, Piotr Bojanowski, Edouard Grave, Yann Dauphin, and Nicolas Usunier. Parseval networks: Improving robustness to adversarial examples. In Proc. ICML, pp. 854-863, 2017.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In Proc. ICMI,, pp. 1310-1320, 2019.
Robert M Corless, Gaston H Gonnet, David EG Hare, David J Jeffrey, and Donald E Knuth. On the lambertw function. Advances in Computationaal mathematics, 5(1):329-33) -59,, 1996.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In Proc. ICML, 2020.
Gavin Weiguang Ding, Yash Sharma, Kry Yik Chau Lui, and Ruitong Huang. Mma training: Direct input space margin maximization through adversarial training. Proc. ICLR, 2020.
Yinpeng Dong, Ke Xu, Xiao Yang. Tianyu Pang. Zhijie Deng, Hang Su, and Jun Zhu. Exploring memorization adversarial training. In Proc. ICLR, 2022.
Omer Elkabetz and Nadav Cohen. Continuous vs. discrete optimization of deep neural networks. Proc. NeurlPS, 34:4947-4960, 2021.
Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and hamessiigg adversarial examples. arXiv preprint 1rXiv:1412.6572, 2014.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proc. CVPR, pp. 770-778, 2016.
Dorjan Hitaj, Giulio Pagnotta, Iacopo Masi, and Luigi V Mancini. Evaluating the robustness of geometry-aware instance-reweighted adversarial training, arXiv preprint arXiv:2103.01914, 2021.
Abdolhossein Hoorfar and Mchdi Hassani. Approximation of the lambert w function and hyperpower function. Research report collection, 10(2), 2007.
Matt Jordan and Alexandros G Dimakis. Exactly computing the local lipschitz constant of relu networks. Proc. NeurIPS, 33:7344-7353, 2020.
Minseon Kim, Jihoon Tack, Jinwoo Shin, and Sung Ju Hwang. Entropy weighted adversarial training. In ICML 202/ Workshop on Adversarial Machine Learning, 2021.
Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. Technical report, 2009.
Daniel Kunin, Javier Sagastuy-Brent -Brena, Surya Ganguli, Daniel LK Yamins, and Hidenori Tanaka. Neural mechanics: Symmetry and broken conservation laws in deep learning dynamics. In Proc. ICLR, 2021.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. arXiv preprint arXiv:1611.01236. 2016.
Yi Lin. Support vector machines and the bayes rule classification. Data Mining and Knowledge Discovery, 6(3):259-275, 2002.
10

---

Under review as a conference paper at ICLR 2023
Feng Liu, Bo Han, Tongliang Liu, Chen Gong, Gang Niu, Mingyuan Zhou, Masashi Sugiyama, et al. Probabilistic margins for instance reweighting in adversarial training. Proc. NeurIPS, 34, 2021.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In Proc. ICLR, 2018.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. In NIPS Workshop on Deep Learning and Unsupervised Feature Learning. 2011.
Shreyas Padhy, Zachary Nado, Jie Ren, Jeremiah Liu, Jasper Snoek, and Balaji Lakshminarayanan. Revisiting one-vs-all classifiers for predictive uncertainty and -itt---distrbbttion detection in neural networks. ICML Workshop on Uncertainty and Robustness in Deep Learning. 2020.
Amartya Sanyal, Puneet K. Dokania, Varun Kanade, and Philip Torr. How benign is benign overfit- ting? In Proc. ICLR, 2021.
Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. Adver- sarially robust generalization requires more data. Proc. NeurIPS, 31, 2018.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties neural networks. arXiv preprint arXiv:1312.6199 2013.
Yusuke Tsuzuku, Issei Sato, and Masashi Sugiyama. Lipschitz-margin training: Scalable certification of perturbation invariance for deep neural networks. In Proc. NewrIPS, pp. 6542-6351, 2018.
Jonathan Uesato, Brendan O' Donoghue, Pushmeet Kohli, and Aaron van den Oord. Adversarial risk and the dangers evaluating against weak attacks. Proc. ICML, volume 80, pp. 5025-5034. PMLR, 2018.
Hongjun Wang and Yisen Wang. Self-ensemble adversarial training for improved robustness. In Proc. ICLR, 2022.
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In Proc. ICLR, 2020a.
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In Proc. ICLR, 2020b.
Dongxian Wu, Shu tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust general- ization. In Proc. NeurIPS, 2020. URL htL.hhtss:///iii
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. arXiv preprint 4rXiv:1605.07146. 2016.
Bohang Zhang, Tianle Cai, Zhou Lu, Di He, and Liwei Wang. Towards certifying l-infinity robustness using neural networks with l-inf-dist neurons. In Proc. ICML, volume 139, pp. 22368-12379 2021a.
Hongyang Zhang. Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In Proc. ICML, volume 97, pp. 7472-7482. PMLR, 2019.
Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankan- halli. Attacks which do not kill training make adversarial learning stronger. 119:1 1278-1177-, 2020.
Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan Kankanhalli. Geometry-aware instance-reweighted adversarial training. In Proc. ICLR, 2021b.
Tong Zhang, Statistical analysis of some multi-categon large margin classification methods. Journal of Machine Learning Research, 5(Oct): (ectt):1222... 12111122221122 1251, 2004.

---

Under review as a conference paper at ICLR 2023
A PROOFS
A.1 THE PROOF OF PROPOSITION 3.2
Proof. From the definition of Lipschitz constants, we have
zu ( + 8) =x (x)) - La | 2011o00- LRE,
(22)
Thus, we have 2x + 5) Σ 24 (xx) + L&E if ( + 8) 2 2x (x) and ( + 8) 2 (x (x) L&3 xx + 6) I (x)). Therefore, the following inequalities hold for the not potentially misclassified samples:
max =x( + 8) 2x + 6) S zx (2r) + L - (zy(2z - Tyye) kz
S zか- (z) + LE xy(x) + Lyj
S 2k- (z) 2y (x) + (L + Ly)e,
(23)
where k = arg maxk 2x + 6). K arg maxk 2 (z), and k= arg max; Lg. From ze (x)
(x) S - [L D for not potentially misclassified samples and Eq. (23), we have maxkşy 2 (x
6) 2n x + 5) < 0, 45 [1] I E}. Thus, models are guaranteed to classify adversarial
examples of these data points accurately.
A.2 THE PROOF OF THEOREM
Proof. By using logit functions, feE can be written as
(x=(2(2000,)) -2y((x) + log Σx e*a(x)
(24)
when model uses a softmax function. Compared with OVR (ovR(z(z, -z + Σn log(1+=**(a)) the difference is only the second term. Thus, (=vR(=(( 0), y) ()))((((( 0).
can be written
(ovn(z(x,0),))
En log(1 + e*x) log
Σx et
(25)
= =log Is (1 c - log > c
(26)
Since a logarithm is strictly increasing function, we have lL + (+*+ - En et 20 log (1+ (*t) log EB 5 200
(27)
Since eh 2 O for any 2/ R. we have
(1 Σn e = Ex + R(eat) E =1+ R(e**))))))))))))))))()))
(28)
where R(e*)) is the second or higher order terms of e* and it takes positive value because e 2
Thus, the left hand side of Eq. (27) holds, and we have log [1, c* -log
log Σx e* > 0. Therefore, we have (ova(2(2 (2(x, 0).u) - (ce(2 0). 2 0: i.e., 0 S fCE(2(x 0), I (= 0), v)
since (CE(2(x, 0), v) O. Next, when (x) + -00 for + y, we have e*t - 0 and
lim (CE(=(0, 0).0) By +000, for legiy
lim -2y(>>) + log Σ ((l(w) -y log(e"*) 0. 2y +00, =2 0o for kz
(29)
On the other hand, when =y(x)) + too and zu (x)) + -00 for h: + y. we have log(1 + e+v) - Zn and log(1 + e + Thus, we have
lim (ovR(2( +000, Sk-+-00 oo for ke
lim -zy(2) + Σ log(1 + esu(at) -2y + Zy O, 400,
2y + oo for kzy
(30)
which completes the proof.
12

---

Under review as a conference paper at ICLR 2023
A.3 THE PROOF OF LEMMA 4.3
Proof. From the assumption, we consider the following ordinary differential equation (ODE):
dz @wfovn(z.v)
(31)
82k
The initial condition is =0) = 0. For the correct label y, the gradient of OVR is given by
òlovn(z,y)
e
-11
(32)
Ozy
e +1
Thus, ODE becomes
e¹v dt e+v +1 1 + e Jdzy wdt
dzy w(1
(33)
(34)
+ E wt +
(35)
ety eatte
(36)
where is a constant, which determined by the initial condition. We apply the Lambert W function (Corless et al. 1996) for both sides and use log (xx) log W ((x) for as
exv = ((
(37)
Ey = wt W(eetto).
(38)
From the assumption, we have (0) = 0, and thus, c satisfies the following equality;
W(e*)
(39)
From W(xe") we have and the logit of the correct label is given by
Ey wl + W (e
(40)
Next, we consider the logit of another label nμ for # y. Since the gradient for the logit of incorrect label is (6ov et
we have
dea #e
(41)
dt 1 E
(e- + 1)des wdt.
(42)
is solved the same way as Zy. and have
F wl ((wutt)).
(43)
for k * y. which completes the proof.
n
A.4 THE PROOF OF LEMMA 4.4
Proof. We first solve the ODE for the logit of the correct label zy. The gradient of cross-entropy is
Hcc((z.))
Ōky + Em 60m
(44)
Oz
From Eq. (44), we have the following ODE:
džy = w
Empy e.m
(45)
dt Empg =m + e
Since 0 0, have
2j for Vi,j # y. In addition, have Σ, dz,(t)
Σ, w.ten(..v) 02:
0 for VL. Thus, logits satisfy the following equality:
2y - 1)2k,
(46)
13

---

Under review as a conference paper at ICLR 2023
for k + y. From Eq. (46). Eq. 45 becomes
diy
(K 1)e 1
w
(47)
(K 1)e
x II*# + t
(K - 1 +
e
K
)dz = w(K - 1]dt
(48)
K
x
K
K --1 By +
e k
wt + c
(49)
K
K -
1
e E
K
F
1
ex K
utte
(50)
K -
K -
CK I W(
K
ex K
Iutto
(51)
K - 1
K K-1
K Fy log
K
(K (
1
e ex t
(52)
K
K 1-1 1
K-1
By wl +
e p wlto
(53)
K
K
K
where e is a constant, which is determined by the initial condition. From Assumption, we have
(0) K - K K
K
1
6-)= =0
(54)
K
W( K
(55)
Thus, we have c K-1 since W(re") = r. From Eqs. 46
and
53
we have
(t) = wt +
K
W
K C
C.
wi+ R-
(56)
K K
K
=x K
wt
+
W(
xx
K
wl
x-
for
k #
(57)
K(K
1)
K
K
which completes the proof.
A.5
THE PROOF OF THEOREM 4.5
From Lemmas and 4.4 we have
LVM(ZORR()) -2wi6 - 2 (e
(58)
K
(IM(2 CE (1)) = K 1 W21
K 1 + W( ex w2lt x ))
(59)
Since W(z) = log(z) - log(log(x)) + (1) for large r (Hoorfar & Hassani 2007), we have
(2M(=OVR(U)) ~ - 2w/ - 2 + 2(w) / + - log(w, l. + 1))
(60)
log(w1t t + 1)²
(61)
K
(LM(2 (E
K Wht K -
(62)
- log( K - 1) + K -
w2l +
(63)
K -
K
1
- log( logg(K - 1) +
Wzt +
(64)
K -
K - 1
=-log( log(Kwss (wyst + 1 (K - 1) log K -1))
(65)
14

---

Under review as a conference paper at ICLR 2023
Algorithm 1 Switching one-versus-the-rest by the criterion of a logit margin loss
1: Select the minibatch IB
2: for 2r E do
3: Generate adversarial examples at,, arg maN -xallx (CE(z(a', 0), Un) by PGD
4: (=M(= 0), yn) maxk7y. =x(x²,) Zy. (2/²)
5: end for
6: Select top
M IB| samples of (2r) Vn) in terms of (z 0), mn) and add them to IL
100
7: LSOVR B E (m (cx(z(2' 0).9) y) A (mmen lovn(z(a', v)
8: Update the parameter + VoCovR
From the above, we have
RVVR()
log(w1
0(1)
lim t-toc
lim t-to0 log( ( w2t + (K - 1) log(K - 1)) + O(1)'
(66)
(2 CF)
2 log t + 2 log(w; + +t 0(1)
lim 1000
(67)
log 1 + log u²2 + (1 (K log 1))) + 0(1)
2 +
2 log( + + + O(1)
lim
log
Tog!
(68)
(-000
1 +
log( Kug+t 211
log 111) +
0(1)
log t
Tog t
2,
(69)
which completes the proof.
A.6 THE PROOF OF PROPOSITION 6.1
Proof. Since have sup,
V (x))ll L for La-Lipschitz function such [xx(<))
24. (xx2) S La |a] - x21 p where 1/9 1/p = (Jordan & Dimakis 2020). the following inequality
holds if Z (x) (x) > (mmxx > (x) + =,,>\ll and p oc:
Zk. (x) (x) - -mmax V (I) + || x (x)
- -maxx
V पm (a:)]l sup V=zy(())l 2 -(4. + Ly)e,
(70)
because |/ Zx (x)]l < La for p Thus, we have z (x) - Zy (y(x) > -(4 + Ly)e on this
condition, which completes the proof.
B ALGORITHM
The proposed algorithm is shown in Algorithm 1 We first generate x' in Line 3 and compute the fLM for them in Line 4. In Line 6, we select the top M % samples in minibatch and add them to L. Finally, we compute the objective LSovR and its gradient generate the adversarial examples for loVR, the overhead of our method is O(IB) log Too [B)), which the computation cost of the heap sort for selecting L in Line 6. It is negligible in the whole computation since deep models have huge parameter-size compared with batch-size [B].
update O. Since we do not additionally
M.
C ADDITIONAL EXPLANATION ABOUT PREVIOUS METHODS
C.1 MART WWNG ET AL.
2020A)
MART (Wang et al., 2020a) uses similar approach to importance-aware methods. regards misclassified samples important samples and minimizes
(MART (a', 0) = (''(f(2''0).v)) + AKL(f(æ, 0), f(x' 0)) (1 fx(
(71)
where BCE(f 0), y) -lg (f ()) log (1-m11x4455 (x', 0)) and KL is Kullback-Leii Leibler divergence. MART controls the difference between the loss on unimportant and important samples via 1 - fy 0): MART tends to ignore the second term when the model is confident in the true label.
15

---

Under review as a conference paper at ICLR 2023
C.2 MMA DING ET AL. 2020
MMA Ding et al. 2020) attempts to maximize the distance between data points and the decision
boundary for robustness. MMA regards mins || subject (= + + 0), v) 0) as the distance. By using this distance, MMA minimizes the following loss:
(()) $ En= (ez(z(a,, um) EMMA(() Σ (m.))es* (c +7.0)= (c
vm) + (0)
(72)
(73)
δMмA - arg ( 1000))010000000 (z,,(2((r0)) 0) = log En e=x(x) Zy(
(74)
(75)
where S set of correctly classified data points, and S is a set of misclassified samples. H. is set of data points that have a smaller distance than threshold d as H. {(I,, yr.) ming. 116,.1l V dmax). J. Since MMA uses 5 whose magnitude ||0|| depends on data points as Eq. (74). we consider that has similar effects to the importance-aware methods. In MMA, Ding et al. (2020) use (sLM(=(x, 0). y) as approximated differentiable logit margin loss by changing max into differ- entiable function log Enyy (x) Comparing OVR with (= 0), v). we have the following:
(s,M( 0). v) S (z 0), v) - lOVR (v. v).
(76)
This is because we have (cE()()),,) 3) - (= 3) = log Σx ( log Σ A
log [1+ (+tetol))// /E e=a(=)) 2 0 and (cE(=(x), 3) (Z))( y) from Theorem 4.1 Thus,
we expect that OVR more strongly penalizes the small logit margins than fSLM (xx v). Note that
training algorithms of MMA is also different from those of the other importance-aware methods (Ding
et al. 2020
C.3
EWAT (KM ET AL. 2021
EWAT uses a weighted cross-entropy like GAIRAT and MAIL, but is added to cross-entropy as Lweiight (0) = Σw (1 + w.) (
(77)
where wn. 2 0 is a weight divided by batch-mean of the weight wn as W.
=
Σ B8
IB we
EWAT
my
determines the weights by using entropy as
Wn. = - Ek fa(a2 O)log(Sa(zr 0))
(78)
where fa (z,,. 0) is the k-th softmax output, and thus, can be regarded as the probability for the k-thh class label. EWAT is based on the observation that importance-aware methods tend to have high entropy, and it causes their vulnerability. Our theoretical results about logit margins and experiments seem to indicate that logit margin loss is more reasonable criterion evaluate the robustness and improve the robustness by using than entropy. Furthermore, Theorem shows that the weighted cross-entropy is less effective than OVR at increasing logit margins.
D SELECTION OF Φ IN OVA
D.1 INFINITE SAMPLE CONSISTENCY
Infinite-sampp consistency (ISC, also known as classification calibrated or Fisher consistent) is
a desirable property for multi-class classification problems (Zhang] 2004] Bartlett et al. 2003
Lin 2002). We first introduce ISC in this section. Let f(x) be a model and e be the classifier
arg max fu(a), The classification error f.,
Es (c(-)) = Ex
Ek Ek=1 Cpp(y = k|æ)
(79)
For clarity, we use the term "margin" only for the distance between logits of the true labels and of the label that has the largest logit except for the true label, not for the distance between data points and the decision houndary.
16

---

Under review as a conference paper at ICLR 2023
where aş is weight for the k-th label and is usually set one. The optimal classification rule called a Bayes rule is given by
C+ (+) maxke 0&p(y k)
(80)
Since Eq. 79 is difficult to minimize directly, we use surrogate loss function f. In classification problems, we obtain the model f() by the minimization of the empirical risk using & as
f()) arg fa) E (f(()))
(81)
On the other hand, the true risk using l is written by
E = E, W (p(12)) f(x))
(82)
W () = Ex qu (f.()k)
(83)
where p(-1z) = [p(1)=), pl K [z] and is a vector in the set Ag:
Ak = { E IR E 1, 2 0)
(84)
(gg, f) is the point-wise true loss of model f with the conditional probability By using the above, ISC is defined as the following definition:
Definition D.1. (Zhang 2004) We say that the formulation is safinite-sample consistent (ISC) set Ω C R with respect to Eq. (79h if the following condition holds:
For each k, E(. k) Ω + bounded below and continuous
Viq E Ag and f1...., K} such that a& < sup; ai4s we have
W (g) == inf W (g f) < inf ( f] E Ω Ja sup, fi}
(85)
This definition indicates that the optimal solution of (gg: ) leads to Bayes rule with respect to classification error Zhang (004): the minimizer of Eq. 82) becomes the minimizer of classification error E. (Eq. (9)). Thus, surrogate loss functions E, e.g., cross-entropy or OVR, should satisfy ISC minimize the classification error.
D.2 EVALUATION +
It is known that ISC is satisfied when á in Eq. 7 is differentiable non-negative convex function and satisfies ((2) < o( 2)) for O. Among common nonlinear functions used in deep neural networks, e and log(1 + =)* satisfy this condition. We first evaluated e- and observed that e causes numerical unstability. On the other hand, log(1 + + tends to be stable computation. This is because log(1 + e *) asymptotically closes max(-2a 2, 0). In addition, let the conditional probability p(y(z) for the class l given x be
1
pkk()) 1+ (m))
(86)
when we choose (6z) = log(1 (1 + e )) We have
lovR(z(x; (2. v) log(1 +e- (z(())
Σ
log( (2)()))
(87)
= -ooggpyy|z) + Enjty log(1 - p(k(z))
(88)
and we can regard models as K independent binary classifier (Padhy et al. 2020
E EXPERIMENTAL. SETUPS
We conducted the experiments for evaluating our proposed method. We first compared our method
with baseline methods; Madry's 's AT (Madry al. 2018)), MMA (Ding et al. 2020), MART (Wang et al., 2020a), GAIRAT (Zhang et al.) 2021b), MAIL (Liu et al. 20211, and EWAT (Kim et al. 2021 three datasets; CIFARTO, 10, SVHN, and CIFAR 100 (rizheesky & Hinton 2009 Netzer
17

---

Under review as a conference paper at ICLR 2023
et al. 2011 Next, we evaluated the combination of method with TRADES (Zhang al. 2019p. AWP (Wu et al. 2020). and SEAT WWang& & Wang 2022). Our experimental codes are based on source codes provided by Wu et al. (2020); Wang et al. (2020a); Ding et al. (2020). We used PreActResNet-18 (RN18) eH al. 2016) and WideResNer-34- 10 (WRN) (Zagoruyko & Komodakis 2016) following Wu et al. (2020). The T.oc norm of the perturbation
set to = 8/255, and all elements of x; + o; were clipped so that they were in [0.1]. We used early stopping by evaluating test robust accuracies against 20-step PGD. To evaluate TRADES, AWP, and SEAT, we used the original public code (Wu et al. 2020; Wang & Wang 2022). We trained models three times and show the average and standard deviation of test accuracies. We used Auto-Attack to evaluate the robust accuracy on test data. We used one GPU among NVIDIA @V100 and NVIDIA @ 100 for each training experiments. We trained models three times and show the average and standard deviation of test accuracies. For MART, we used mari_loss in the original code (Wang et al. 2020a as the loss function. À of MART was set to 6.0. For GAIRAT and MAIL, we also used the loss functions in the original codes Zhaag et al. 202 Liu et al. 2021 and thus, hyperparameters of their loss functions were based on them. of GAIRAT was set to do until the 50-th epoch and then set to 3.0. (7, of MAIL was set to (10, 0.5). For all settings, the size of minibatch set 128. The detailed setup for each dataset was as follows.
E. MMA
We trained models by using MMA based on the original code (Ding et al., 2020 6
Thus, the learning rate schedules and hyperparameters of PGD for MMA were different from those for other methods because the training algorithm of MMA different from the other methods. The step size of PGD in MMA was set to 2.5 in training by following Ding et al. (2020). For AN-PGD in MMA, the maximum perturbation length was 1.05 times the hinge threshold max = 1.05dmax. and dmax was set 0. 1255.. The learning rate of SGD set to 0.3 at the 0-th parameter update, 0.09 at the 20000-th parameter update, 0.03 at the 30000-th parameter update, and 0.009 at the 40000-th parameter update.
10
E.2 CIFARIO
For N8 the learning rate of SGD was divided by 10 at the 100-th and 150-th epoch except for EWAT, and the initial learning rate was set to 0.05 for SOVR and 0.1 for others. We tested the initial learning rate of 0.05 for the other methods and found that the setting of 0.1 achieved better robust accuracies against Auto-Attack than the setting of 0.05 when using ResNet18. For EWAT, we divided the learning rate of SGD at the 100-th and 105-th epoch following Kim et al. (2021) after found that the division at the 100-th and 150-th epoch was worse than the division at the 100-th and 105-th epoch. When using WideResNer34-10. at the 100-th and 150-th epoch. We used momentum of 0.9 and weight decay of 0.0005 and early stopping by evaluating test accuracies. We standardized datasets by using mean [0.4914, 0.4822, 0. 0.4465] and std = [0.2471, 0.2435, 0.2616] as the pre- processc (M, A) was tuned by grid search over M E [20..... 80, 100) and > E [0.2, ...2..... 0.8, 1.0) for RN18, and tuned by coarse tuning for WRN due to high computation cost.
set the initial learning rate to 0.1 and divided by 10
E.3 CIFARI00
We used N8t for CIFAR100. The learning rate of SGD was divided by 10 at the 100-th and 150-th epoch except for EWAT, and the initial learning rate was set to 0.1. Note that we found that the above setting is better than the initial learning rate of 0.05 for all methods. For EWAT, we divided the learning rate of SGD the 100-th and 105-th epoch following Kim et al. (202T) after we found that the division at the 100-th and 150-th epoch was worse than the 100-th and 105-th epoch. We randomly initialized the perturbation and up- dated it for 10 steps with a step size of 2/255 for PGD. We used momentum of 0.9 and weight decay of 0.0005 and early stopping by evaluating test accuracies. We standardized datasets by
the division
htt.:///.ee....t..o..........nnn Trainnngg httsss//githbbb.ccm///relllllll/
18

---

Under review as a conference paper at ICLR 2023
using mean (0.5070751192377))) 0.486548873314499000 10.2671342858792401, 0.25643846291 70883, 02276150471122564444 as the pre- pre-process. (M, was set to (0.5, 0.5) based on the coarse hyperparameter tuning.
and std
E.4 SVHN
We used PreActResNet188 for SVHN. The learning rate of SGD was divided by 10 at the 100-th and 150-th, and the initial learning rate was set to 0.05 for SOVR and 0.01 for others. We tested the initial learning rate of 0.05 for the other methods and found that the setting of 0.01 achieved better robust accuracies against Auto-Attack than the setting of 0.05. For EWAT, the learning rate of SGD was divided by 10 at the 100-th and 105-th epoch after found that this setting was better than the division at 100-th and 105-th epoch. The hyperparameters for PGD were based on (Wu et al. 2020 We randomly initialized the perturbation and updated for 10 steps with a step size of 1/255. For the preprocessing, we standardized data by using the mean of [0.5, 0.5, 0.5], and standard deviations of [0.5, 0.5, 0.5]. (M, X) set to (0.2,0.2) on the basis of the coarse hyperparameter tuning.
E.5 TRADES, AWP, AND SEAT
For experimental settings of TRADES and AWP, we followed Wu et al. (2020) and only changed the training loss into SOVR in the training procedure and in the algorithm for computing the perturbation of AWP for AWP, TSOVR, and TSOVR+AWP, We used the original codes of AWP (Wu et 2020 For AWP and AWP+SOVR, we found that models trained under the setup for TRADES+AWP in original codes, where the dataset is not standardized and AWP is applied after 10 epochs, achieves better robust accuracy than those trained under the setup for cross-entropy+ TRADES in original codes. Thus, we used the code for TRADES+AWP by changing the loss functions. By of TRADES and TSOVR were set to 6, and Y of AWP is set to 0.01 for AWP and AWP+SOVR, 7 of AWP was set to 0.005 for TRADES+AW2 and TSOVR+AWP. AWP is applied after the 10-th epoch. We used WideResNer33-10 following Wu et al. (2020). We used SGD with momentum of 0.9 and weight decay of 0.0005 for 200 epochs. The learning rate was set to 0.1 and was divided by 10 at the 100-th and 150-th epoch. For experimental settings of SEAT, we followed Wang & Wang (2022) and only changed the loss into SOVR in the original code (Wang & Wang 2022 We did not evaluate SEAT with CutMix in our experiments, but we fairly compare SEAT+SOV +SORR with SEAT under the same condition. We used SGD with momentum of 0.9 and weight decay of 7 x 10-4 for 120 epochs. The initial learning rate was set 0.1 till the 40-th epoch and then linearly reduced to 0.01 and 0.001 at the 60-th epoch and 120-th epoch, respectively. We used WideResNer32-100 following Wang Wang (022) for SEAT. (M, A) is tuned by grid search over M E [20..... ..... 80, 100] and X E 0.2, 0.8, 1.0 for SOVR+AWP, and (M, A) is tuned by grid 1.0, 1.2) for TSOVR. (M, X) is set to (0.5,0.5)
search over M e [20...., 80, 100] and À E
for SOVR+SEAT after coarse hyperparameter tuning.
F.6 EXPERIMENTAL SETUPS IN SECTION 3
For the experiments in Section the same as models used in Section 6. To obtain the histograms of logit margins, we used the models and computed logit margin loss adversarial examples of training data set for each data point at 200 epochs. Thus, the number of data points of CIFAR10 and CIFAR100 is 50,000, and that of SVHN is 73,257, We also provide the results of the models obtained by the early stopping in Fig. ??.
used the models obtained under the above settings, which
F ADDITIONAL RESULTS
HISTOGRAMS OF LOGIT MARGIN LOSSES
We show the additional histograms of logit margin losses in this section. First, Fig. plots the result of EWAT on training samples of CIFAR10 10 at the last epoch. Compared with SOVR, EWAT does not increase logit margins for difficult samples (right peak). Figures 8 plot the histograms when
f-wnsembl ensemble-AAdveeariaa
19

---

Under review as a conference paper at ICLR 2023
2000
1000
1000
-10
110
(a) Best epoch
(b) Last epoch
Figure 7: Histogram of logit margin losses of EWAT for training data on CIFAR1O.
4000
2000
10000
1000
1000
5000
0
10
(a) AT
(b) MMA
(c) MART
(d) GAIRAT
4
3060
3000
5000
2000
(c) MAIL
(f) EWAT
(g) SOVR
Figure 8: Histogram of logit margin losses for training samples of CIFARIO with WideResNNe33-100 at the last epoch. We plot those on adversarial data x' for the other methods. Blue bins are the data points that models correctly classify.
using WideResNet and other datasets. SOVR tends to increase the left peak under all conditions, and thus, decreases logit margin losses LLM, and thus, increases the logit margins [LLM]. Figure shows that AT does not have two peaks on SVHN. To investigate histograms on SVHN in detail, we additionally evaluate logit margin losses at the 100-th epoch in Fig. This figure shows that the histogram SVHN has two peaks the 100-th epoch, but they became one peak at the 200-th epoch (Fig. 10 This might cause the optimal (M, A) for SOVR to smaller than that for other datasets. Figure 12 plots the histograms of TRADES and shows that TRADES has two peaks but they are close to each other. This might because the objective functions for adversarial examples different. Table lists the average of logit margin losses. Since the distributions
and parameters of logit margin losses are long-tailed as shown in histograms, the difference in average values of logit margin losses among methods is small. Even so, SOVR tends have the lowest logit margin losses under almost all settings.
F.2 EVALUATION OF GRADIENT NORMS
Even though logit margins of importance-aware methods are very small, they are robust against PGD and some attacks (Fig. T.. To reveal the cause of this robustness, we additionally evaluate th gradient norms for loss and logit functions (Fig. 13 In this figure, the gradient norms of cross-
Table 3: Average logit margin losses for training dataset x' at the last epoch.
Dataset
AT
MART
MMA
GAIRAT
MAII.
FWAT
SOVR
CIFARIO (RN18)
-3.66=0.02
3..6-10.02
0.558=0.1
-0.258+ 0.02
-0.02934 0.02
2.251=00.07
4.34 0.02
CIEARIO (WRN)
-6.96-0.01
-5.6540.7
-2.73-0.6
0.7174 003
402014 0.11
-5.69+0.04
-8.66 0/14
CIFAR100
-2.11=0.22
-1.7641.01
2.0720.06
-0.68+1.02
0.684=0.1
-1.3620.02
-2.410.11
SYHN
-7.55=0.01
-8.0842
4.1110.04
-3.9110.01
-L17--0.03
-9.3240.04
-7.5940.1
20

---

Under review as a conference paper at ICLR 2023
1500
1200
2000
250
2000
1500
100
1030
(a) AT
(b) MMA
(c) MART
(d) GAIRAT
4
100
200
190
202
-10
-10
10
00 10
(c) MAIL
(f) EWAT
SOVR
Figure 9: Histogram of logit margin losses for training samples of CIFARI00 at the last epoch. We plot those adversarial data x' for the other methods. Blue bins are the data points that models correctly classify.
3000
1000
7700
200
2000
5000
2000
1000
2500
-00
10
-10
10
(a) AT
(b) MMA
(c) MART
(d) GAIRAT
2000
5000
2500
-10
(c) MAIL
(f) EWAT
(g) SOVR
Figure 10: Histogram of logit margin losses for training samples of SVHN the last epoch. We plot those on adversarial data x' for the other methods. Blue bins are the data points that models correctly classify.
3000
4000
10000
2000
2000
3600
1000
10
10
-0
10
-10
10
(a)
(b) MMA
(c) MART
(d) GAIRAT
2000
70X
33K
10
-0
10
10
(c) MAIL
(f) EWAT
SOVR
Figure 11: Histogram of logit margin losses for training samples of SVHN at the 100-th epoch. We plot those on adversarial data x' for the other methods. Blue bins are the data points that models correctly classify.
21

---

Under review as a conference paper at ICLR 2023
1000
1000
10
0
10
(a) Best epoch
(b) Last epoch
Figure 12: Histogram of logit margin losses on CIFARIO with WRN for TRADES.
150
AT
MAIL
MMA
EWAT
100
MART
SOVR
GAIRAT
50
0
Ceole, 1)ll [llllV...c. [V,ccl,,
[V k")l
k)ll
(2))()))
|| (x))ll max; | [
Figure 13: Average of gradient norms with respect to data points. l is randomly selected labels, and k* arg max (x)).
entropy //V (ar y)ll are relatively small values in all methods. This indicates that adversarial training essentially attempts to suppress the gradient norms for the cross-entropy. MMA has the largest gradient norms, and this the reason MMA is not robust against Auto-Attack except for SQUARE (Fig. [ which does not use gradient. GAIRAT and MAIL have the smallest and second smallest | e (x, 1)ll and this the reason they are robust against PGD despite the small logit On the other hand, max || = (æ))|1 of importance-awant
methods is larger than || , EE æ v)ll of them and that of AT. As a result, they can have larger rate of potentially misclassified samples (Fig. 6). Gradient norms of cross-entropy for the label that has the largest logit except for the true label [V= k*) I| are smaller than those for the randomly selected labels.
margins (Fig.
This implies k* * i, and we need to use the loss that depends on the logits for all classes rather than logit margin loss, which only cares z and Zz. Gradient norms of EWAT and SOVR are not significantly different from those of AT. Thus, SOVR can reduce the rate of potentially misclassified samples by large logit margins and not large gradient norm.
F.3 TRAJECTORIES OF LOGIT MARGIN LOSSES IN ADVERSARIAL TRAINING WITH OVR AND CROSS-EIS ENTSRPY
In this section, we evaluate the trajectories of logit margin losses in adversarial training on real data. Experimental setup is the same with that of Section eexcept for the learning rate on CIFAR1O, and
Logit mirgin fiM
margin losses ÊiM
Logit mirgin losse f1st
-5
-5
Logit Login
CE (K:10, w:
-2
CE (K:1000 w::1)
CE (K:10, w::1
-10-
CE (K:1
CE (K:100.ar:5)
CE (K:10,a:22)
OVR (w:1)
OVR (w:l)
OVR (w:l)
0
100
200
100 Epoch
200
100 Epoch
200
Epoch
(a) CIFAR 10 (WRN)
(b) CIFAR 100
(c) SVHN
Figure 14: Trajectories of logit margin losses fLM in adversarial training using cross-entropy and
OVR. RN18 is used CIFARION and SVHN.
22

---

Under review as a conference paper at ICLR 2023
CIFARIO (RNI8)
CIFARIO (WRN) CIFARTOO
SVHN
1.87
1.78
1.56
1.76
Table 4: ///n) CE) with w = 1.0 at the last epoch
CF
Booess Ace. 158
47.0
Generatzation
45.0
SOVR
SOVE
30
012
0.4
0.5
10
0.0
0.2
6.4
10.6
1.0
0.6 0.8
10
(a) LLM (z')
Vs A
(b) Generalization Gap Vs A
(c) Robust Acc. Vs
Figure 15: The effect of rate of applying OVR A. M is set to 40. Generalization gap is a gap between training robust accuracy and test robust accuracy against PGD (K=20) at the last epoch. Robust Ace. is robust accuracy against Auto-Attack. Dashed gray line corresponds to the results of AT using cross-entropy loss.
thus, we minimize the OVR and cross-entropy averaged over the dataset, unlike Eq. TO). While the learning rates are set to 0.1 for cross-entropy and 0.05 for SOVR in Section 6 on CIFAR1O, learning rate set to 0.05 on CIFARIO for both cross-entropy and OVR fairly compare their logit margin losses in this experiment. Since we could not obtain results on SVHN with the weight of 5= due to unstability, we used w= on SVHN. Fig. I4 plots the logit margin losses averaged over the dataset against epochs in adversarial training with OVR and cross-entropy
CIFAR 10, CIFAR100, and SVHN. Fig. 14 OVR decreases the logit margin losses more than cross-entropy on all dataset. We also evaluate fLM(2 (V) (xECE) the last epoch, which is expected to be about two from Theorem 4.5 Table 4 list (L ( (1 at the last epoch, and it is about two, and thus, logit margin losses in adversarial training follow Theorem 4.5 well even though assume a simple problem that only considers one data point and assumes that Togits are directly moved by the gradient for Theorem 4.5 Since the number of classes K of CIFAR is 100 and larger than other datasets, the logit margins of cross-entrops is larger than OVR at the beginning of training. This result corresponds to the case CE (K 100) in Fig. (aa and this phenomenon is also able to be explained by the simple problem Eq. 110). To the best of our knowledge, this is the first study that explicitly reveals the logit margin of minimization of cross-entropy depends on the number of classes. Though the logit margin loss of OVR in Theorem 4.5 does not depend K, the logit margins of OVR on CIFAR100 is smaller than those on CIFARIO and SVHN. This is because CIFAR 100 is more difficult dataset than CIFAR10 10 and SVHN: robust accuracies of CIFAR100 is about 25 % whereas those of CIFAR1O and SVHN are about 50 % Tab. [
F.4 EFFECTS OF HYPERPARAMETERR À
SOVR has hyperparameters (M, A). In this section, we evaluate the effects of X. Figure 15 plots LL on CIFAR10 with RNI8, generalization gap, and robust accuracy against Auto-Attack. We set M to 40. Note that À = 0 corresponds to that models are trained on only set of S, i.c.. AT only using the 60 percent of the data points in minibatch when M 40. First, (Lm())) is monotonically decreasing due to increases in X (Fig. 15(a). However, robust accuracies against Auto-Attack are not monotonically increasing against (Fig. 15(c). This because generalization gap increases (Fig. [5(b)). Thus, too high weights difficult samples causes overfitting, SOVR is always superior or comparable to AT terms of robustness against Auto-Atte Attack under all tested values of (0 < M < 100, 0 < X 1).
F.5 INDIVIDUALLY TEST OF AUTO-ATTACK
For importance- aware methods, evaluate the robust accuracies against all components of Auto- Attack in Section 2.3 In this section, we additionally evaluate EWAT by individually using Auto- Attack and discuss the results of SOVR. Figure plots the results, and SOVR is the most robust
23

---

Figure 17 plots the trade-off between clean accuracy and robust accuracy against Auto- Attack when using WideResNee33-110 (* uses WideResNNt322100 on CIFARIO. These re- sults are the same as those reported in Tabs ! and 2 Diagonal lines are lines satisfying Const through Under review as a conference paper at ICLR 2023
50
GAIRAT
EWAS
M14A
SOVE
Noloia Arc (94)
MART
CNN
POD-30
APOD
LARG
SQUARE
Figure 16: The robustness against PGD-20 and Auto-Attack on the test set of CIFARIO. We decompose the robust accuracy for Auto-Attack into robust accuracy in each phase.
against t-APG and t-FABand. In addition, it is more robust against SQUARE than AT and EWAT. Although the robust accuracy of SOVR against PGD-20 is lower than those of AT and EWAT, SOVR outperforms other methods in terms of the robustness against the worst-case attacks, which is the goal of this study.
F.6 TRADE-OFF BETWERN CLEAN ACCURACY AND ROBUST ACCURACY
SEAT-SOVI SOVE" WW
Robust Acc. Against Aute-Antn Attuck
S4
SUVE
TTRADES
CleanAcc. RobustAcc.
MART
SOVR or SOVR+AWP. SOVR achieved good trade-off: Robust Acc. + Clean Acc. of SOVR and SOVR+AWP are the hest value under each condition. If we require the most robust mod- els with sacrificing clean accuracies, TSOVR and TSOVR+AWP achieved the best robust ac- curacy against Auto-Attack. Therefor, SOVR and TSOVR are better objective function than TRADES and cross-entropy in terms of trade- off and robustness. Note that AWP and SEAT require large overheads compared with SOVR.
48
MAI.
MMA
42-
80
Clean
Acc.
Figure 17: Trade-off between clean accuracy and robust accuracy.
F.7 EVALUATION USING VARIOUS ATTACKS
We list robust accuracies against various attacks; FGSM (Goodfellow et al. 2014). 100-step PGD (Madry et al. 2018), 100-step PGD with CW loss (Madry al. 10018/Carliii & Wagner 2017) SPSA (Uesato et al. 2018 in Tab.5 5 Hyperparameters of SPSA are as follows: the number of steps is set to 100, the perturbation size is for each gradient estimation is set to 256. In this table, we repeat the clean accuracies and robust accuracies against Auto-Attack from the table in the main paper. In addition, we list the worst robust accuracies, which are the least robust accuracy among attacks in the table for each method. In this table, importance-avee awaree methods tend to fail improve the robustness against SPSA. Since SPSA does not directly use gradients, this result indicates that importance-awar methods improve the robustness by obfuscating gradients (Athalye et al. 2018). Against some attacks, MMA achieves the highest robust accuracy on several datasets. However, our goal is improving the true robustness, i.e., robust accuracies against the worst-case attacks in ö E {1]ō]| < 8/255). MMA does not improve the robustness against the worst-case attacks (the columns of Worst). We
0.001, learning rate is to 0.01, and the number of samples
that Auto-Attaci always achieves the least robust accuracies, and SOVR improves them: Robust accuracies against Auto-Attack of SOVR are 5.9-12.2 percent points greater than those of MMA.
24

---

Under review as a conference paper at ICLR 2023
Table 5: Robust Accuracy against various attacks (Loc E 8/255). CLN denotes accuracy on clean data, and AA denotes Auto-Attack. Worst represents the least robust accuracy among attacks table for each method.
Method
CLN
FGSM
PGD
CW
SPSA
AA
Worst
AT
81.620.5
57.620.1
52.520.4
50.01:0.
56.810..2
48.0=0.2
48.04:.22
MART
78,3:11
58.020.3
54,010.1
48.7:10.2
54.240,1
46.9:10.3
46.9:10.3
MMA
85.5 = 0.7
65.5 1 2
51.6::0.2
51.0+6..6
56,341
37.2:0.9
37.2440.
C10
GAIRAT
78.740..7
63.1+0.7
62.0 0.4
40.01::1
47.41:1
37.741
37.7
(RN18)
MAIL
79.54:..
57.810.1
54.9710088
42.14:.2
19.14:044
39.620.4
39.640.4
EWAT
82.8+0.4
57.7+0.4
52.3+0.44
50.41:0.7
56.81:0.2
48.2:10.7
48.2:40.7
SOVR
81,9+0.2
57.0+0.2
50,910,5
51.5 d: 0.2
57.7 = 0.2
49.4 1 0.3
49.4 : 0.3
AT
85.610..5
60.910.4
55.110.4
54.0:10.6
60.8:0.55
$1.920.5
51.9:0.5
MART
81.54
61.3:1066
57,2+0.2
52.1::0.3
57.84:0.6
50.44:10.09
50.44:10.09
MMA
87.8 1:
1
55.74+1
0.7
59.6422
43.1:0.6
43.140.6
C10
GAIRAT
83.0+0.77
64.1+005
62.9 + 0.4
44.4++0.7
52.14-0.5
41.840.6
41,8+0.66
(WRN)
MAIL
82.240.4
59.320.5
56.020.5
45.71:0.2
53.0:0.2
43.3#0.1
43.340.1
EWAT
86.0+0.5
60.61:0.4
54,510.1
53.8:10.3
60.7:10.4
51.6:10.3
51.6:10.3
SOVR
85.0+=1
60.8+0011
54,5+002
55.24-0.2
61.6 = 0.1
53.1 : 0.2
53.1 :: 0.2
AT
89.840.6
30.1
27.7+0.2
25.64:0.
29.34:.3
23.7.0.3
23.740.33
MART
86.9::0.6
25.4:10.3
28.5+:0.1
23.9:0.3
23,9:0.3
MMA
93.9 0.4
25.7+0.3
19.410.2
20.51:0.1
24.3100.3
18.4:0.2
18.4:0.2
C100
GAIRAT
89.9+0044
27,9
26.0+002
21.9++0.4
25.9++0,1
19,8+0055
19,8+0055
MAIL
89.41104
24.8120.08
23.29:10.66
18.340.5
21.900,5
16.7.0.3
16.7:0.33
EWAT
90.2+:0.6
30.07=00.88
27.4+0.3
25.3::0.2
29.34:0.1
23.52:10.06
23.52:10.06
SOVR
90.0:t1
30.210.2
27.41002
0.2
24.3 +
AT
53.0+0.7
61.1+0.5
50.6+-0.4
47.74+0.8
55.7++0.9
45.6++0.4
45.6+0..
MART
49.2+1..1
64.420.5
56.520.2
49.0+10.4
$6.69:20088
46.920.3
46,940.3
MMA
60.6 = 0.6
79.6 0.8
65.0 1
59.1 + 2
63.2 +:
41.0:10.3
41.0:0.3
SVHN GAIRAT
52.0+0.5
65.8+0.44
60.4+-0.6
40.6++0.7
48.8++0.6
37.6440.6
37.6-+0.6
MAIL
46.5++0.5
64.6+0.4
58,2+-0.3
44.1++0.7
52.3++0.5
41.2+0.3
41,240.3
EWAT
54.2#11
61.820.5
51.7:10.2
50.2::0.4
$7.410..
47.6220.4
47.6:1044
SOVR
52.11:0.8
65.34:2
50.7:00.2
52.5:10.2
60.7:10.4
48.5 + 0.4
48.5 + 0.4
AT MART MMA GAIRAT MAIL
AF
70
MART
KobeS ARC
66
GAIRAT
EWAA
SOVR
SONR
10
11/
10
112
10
18P
alpha
alphx
(a) CIFAR10 (RN18)
(b) CIFAR10 (WRN)
MART
MART
DONNR Noc
20
GAIRAT
GAIRAT
MAIL
SOVR
SOVR
16F
10
17
10
10
10
alpba
alghc
(c) SVHN
(d) CIFAR100
Figure 18: Robust Accuracy against logit scaling attack.
25

---

Under review as a conference paper at ICLR 2023
Table 6: Robust accuracy against Auto-Attack and clean accuracy for AT, SOVR, TRADES, and TSOVR.
Robust Accuracy against Auto-Attack (Lo., 6=
AT
SOVR
TRADES
TSOVR
CIFARIO (RN18)
48.0=0.22
49.4 0.3
48.8+0.3
49.8 0.1
CIFARIO (WRN)
51,9+t0.5
53.1=022
53.3 + 0.1
SVHN (RN18)
45.6+t0.4
48.5=0.4
49.4 0.3
49.87 = 0.02
CIFARIO0 (RN18)
23.7.+0.3
24.3=002
23.240.1
24.61 + 0.07
Clean Accuracy
CIFARIO (RN18)
81.6+00.5
81.9=0.2
82.5 + 1
81.4
CIFARIO (WRN)
85.6
85.0=0.2
84.2+0.7
83.1
SVHN (RN18)
89.8+0.6
90
88.7#1
88.5
I00 (RN18)
53.0
52.1=0.8
53.8 13.80.0
51.6:10.2
F.8 EVALUATION USING LOGIT SCALING ATTACK
In this section, we evaluate the robustness against the logit scaling attack (Hitaj et al. 2021). Hitaj jet al. (202T) reveals that GAIRAT tends to be vulnerable logit scaling attacks. The logit scaling attack multiplies logits by before applying softmax when generating PGD attacks. We set [0.1, 1.0, 10, 100]. Fig. plots robust accuracy against a. This figure shows that the robust accuracies of GAIRAT and MAIL tend decrease when increasing a. Though the robust accuracy of SOVR is the lowest on CIFAR 10 (RN18), it is higher than the robust accuracy against Auto-Attack. Thus, the logit scaling attack is not the worst-case attack. Since the robust accuracy of SOVR does not necessarily decrease when increasing a, the results seem to be caused by high robustness against PGD (Tab. 55 of other methods rather than vulnerability logit scaling of SOVR. Previous methods tend to be designed to increase the robustness against PGD since Auto-Attack is a relatively recent attack. On the other hand, SOVR designed increase the robustness against the worst-case attack, which is Auto-Attack for now.
F.9 COMPARISON WITH TRADES
Section gives the results of TRADES and TSOVR on CIFARIO with WRN. This section compares our methods with TRADES by using other datasets and RN18. For TSOVR, (M, X) is set to (80, 0.8) for CIFARIO (RN18), set to (50, 0.5) for CIFARI00, and set to (20, 0.8) for SVHN. Tab, 6 lists the robust accuracies against Auto-Attack and clean accuracies. We can see that TSOVR achieves the best robust accuracy against Auto-Attack.
F.10 DEPENDENCE OF THE NUMBER OF CLASSES
Figure 6 shows that the rate of AT gets close to SOVR on CIFAR100. This is because the number of classes of CIFAR 100 (K 100) is ten times larger than other datasets (K 10), and logit margins of cross- cross-entropy depend on the number of classes K (Eq. (17). Thus, this result is a piece of evidence that Theorem 4.5 exxlainn the difference of logit margins between OVR and cross-entropy. In certain finite time step t (not the limit), Eqs. (16) and (17) show that the difference between OVR and cross-entropy depends on the number of classes K. Even so, Fig. 14(b shows that the increase rate of logit margins of OVR is larger than that of cross-entropy against epochs. To achieve better performance, we can tune the Theorem 4.5 When using x= 0.6, SOVR achieves better robustness than À 0.5 CIFAR100 (Tab. 7). Cross-entropy also has the weight W/ in Eq. (17). and is automatically tuned GAIRAT, MAIL., and EWAT. However, this tuning does not achieve comparable performance SOVR.
X, which corresponds to W, in Eq. (16) of
26

---

Under review as a conference paper at ICLR 2023
Table 7: Robust accuracy against Auto-Attack on CIFARI00 tuning
Robust Accuracy against Auto-Attack (1op, 88255))
AT
SOVR (A=0.5)
SOVR (A=0.6)
CIFARIOO (RN18)
23.7+0.3
24.3=002
24.6 0.1
Clean Accuracy
CIFARIO0 (RN18)
53.0 + 0.7
52.1
51.9 + 0.6
3000
2000
2300
2000
97
ST
(b) AT
MMA
MART
(e) GAIRAT
(1) MAIL
2000
(g) EWAT
(h) SOVR
Figure 19: Histogram of probabilistic margin losses for training data of CIFARIO with PreActRes- Net18 at the last epoch. ST denotes standard training, i.e., training clean data. For standard training, we use PM on clean data æ, while we plot that on adversarial examples for the other methods. Blue bins correspond the correctly classified data points, and red bins are misclassified samples.
G HISTOGRAM OF PROBABILISTIC MARGIN LOSSES
While study focuses the logit margin loss, MAIL (Liu al. 2021 uses the probabilistic margin,
PM, fy, (a',, 0) max fa (ar 1 0):
(89)
evaluate the difficulty of data point. the same way as Fig. 2 Fig. 19 plots the histograms of probabilistic margins on CIFARIO with PreActResNet11., Since softmax output is bounded in [0, 1]. PM bounded in [-1,1]. As result, most correctly classified data points concentrate near -1. In addition, softmax uses exponential functions, distributions of PM are similar to the exponential distributions. Due these effects, histograms of PM make more difficult discover the fact that there are two types of data points (easy samples and difficult samples). Since softmax preserves the order logit, and a classifier infers the label by using the largest logit, the analysis by using PM can under-estimate the distribution of difficult samples. Thus, logit margin losses are more suitable to empirically analyze trained models. Since softmax preserves the order of logit, the probabilistic margin be used to determine L and S in SOVR.
27


Reviews:
[{"review_id": "iF03KT9sFfe", "reviewer": "Reviewer_HRBR", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a novel adversarial training approach, which can increase the logit margin without losing too much clean accuracy. The authors discover that the logit margin of traditional adversarial training has two peaks. Based on this, they designed a switching mechanism and a novel margin loss function (OVR) to improve traditional adversarial training, aiming to push the right peak to the left while maintaining the left peak. Experiments show superiority over baselines.", "summary_of_the_review": "The observation in the paper is interesting, but the experiment results are not convincing to support the claims.", "strength_and_weaknesses": "Pros:\n- The paper is well written and easy to follow: start from some observations, assumptions, theorems, and the design of their approach.\n- The finding about logit margin distribution is interesting. The corresponding analysis is also solid.\n- The experiments demonstrate the effectiveness of the proposed method.\n\nCons:\n- For Eq. 8, why did you choose log(1+e^-z)? The author should explain the rationale behind the choice.\n- In Table 2, if we add SOVR to Trades (TSOVR), the clean accuracy decreases. It is a contradiction to the author’s maintaining clean accuracy claim. AWP results show the same phenomenon, i.e., clean accuracy decreases while applying the proposed method. \n- The authors say: “SOVR achieved better trade-off: SOVR achieved similar robust accuracies to TRADES, while it achieved better clean accuracy” However, the clean acc are 84.2 for TRADES and 83.1 for TSOVR. In addition, I disagree with the “better trade-off” for this table.\n- What are the results if the proposed method encounters the logit scaling attack (Hitaj)? In addition, it is better if the author can show some potential attack ideas that can break the proposed defense. \n- Comparing Fig. 2(b) and Fig. 4, the peak shifting is a little weak. Is there any direction to improve this?\n- Observing Fig. 6, it seems that the proposed method did not work well if the number of classes increased. (Cifar-100 is much worse than Cifar-10.) It is better if the authors discuss this. Also, this is a potential limitation of the proposed method.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "_fTmLFMSxZO", "reviewer": "Reviewer_aV6p", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This work reveals that the adversarial examples used in adversarial training can be roughly divided into difficult examples and easy examples according to their logit margins. The proposed SOVR method aims to reduce the adversarial examples which have larger logit margins, then enhance the robustness of DNN models. ", "summary_of_the_review": "Confusing description and lack of convincing empirical results.", "strength_and_weaknesses": "I'm confused about \"On the other hand, logit margins of importance-aware methods concentrate near zero, and thus, importance-aware methods reduce the logit margins of easy samples. This implies that the weighted cross-entropy used in importance-aware methods is not very effective in increasing logit margins. To increase the logit margins of difficult samples, ...\". First, why the observation of \"importance-aware methods reduce the logit margins of easy samples\" can derive \"importance-aware methods is not effective in increasing logit margins\"? Second, why do you want to increase the logit margins of difficult samples? Do the large logit margins indicate the examples are well learned? And the proposed method is to minimize the logit margins of \"easy samples\" if I didn't misunderstand.\n\nAnd some questions about experiments are as follows:\n1. What about TRADES perform in Figure 2? Can the histogram of TRADES also be divided into two peaks?\n2. In Table 1, what about the results of TRADES?\n3. In Table 2, I'm afraid that the results can't convince me that the proposed method can increase the robustness. Compare with AT+AWP and TRADES, the robust accuracy increase while the clean accuracy drops. It is well known that adversarial training methods have a trade-off between clean and robust accuracy. The performance increase of compare with SEAT is marginal.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "OC9w9zk-Txd", "reviewer": "Reviewer_Fx8Y", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper studies the source of the worse performance (i.e. lower adversarial robustness) of importance-aware methods compared to standard adversarial training (and variations like TRADES). It is argued that importance-aware methods yield small logits margins for all points, while naive adversarial training shows large margins for a considerable portion of training points (easy points). This has the effect of reducing robustness on the easy examples. This motivates SOVR, which uses the cross-entropy loss on the easy points and the novel OVR loss on the difficult ones. In the experimental evaluation, SOVR outperforms importance-aware methods, and can be combined with regularization methods like TRADES and AWP.", "summary_of_the_review": "The paper presents an interesting analysis of importance-aware methods and a new training scheme to improve their results. A more thorough comparison to existing methods for robust classifiers would increase its relevance.", "strength_and_weaknesses": "Strengths\n- The analysis of the logits margins is interesting and suggests an explanation for the worse performance of importance-aware methods compared to standard adversarial training.\n\n- The proposed SOVR is a reasonable solution in light of the analysis of the behavior of the logits margins, and in the experimental evaluation is shown to be effective.\n\nWeaknesses\n- The histograms of the logits margin shown in the paper are mostly for model at the last epoch of training. In Fig. 8 in the appendix one can see that, when using the model selected by early stopping, the left peak for adversarial training is much less pronounced, suggesting that it is mainly due to overfitting. While there's still a difference in the distribution of the margins between naive adversarial training and the importance-aware methods, I think the plots for the models with early stopping should be reported in the main part to give a more complete picture of the phenomenon the paper analyzes.\n\n- While SOVR outperforms importance-aware methods, a comparison to other methods (see e.g. https://robustbench.github.io/) for obtaining robust models is missing. The only direct comparison to TRADES is with WRN on CIFAR-10, and the two methods achieve similar results. SOVR getting similar or better results than existing methods would significantly strengthen the paper.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "C4sdWX8b8F", "reviewer": "Reviewer_G3JG", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper first studies the relationship of logit margin loss $\\ell_{LM}$ and adversarial robustness and then proposes using one-versus-the-rest (OVR) loss to improve the logit margin loss.", "summary_of_the_review": "The paper is well-written. The concepts are deliberately empirically studied. However, in my opinion, the idea is incremental.\n\n-----------------------------------------------------------------------------------------------\nThanks the authors for addressing my concerns. I still believe that the idea is incremental and the theory needs to make strong assumptions. Therefore, I am keen on my current score.", "strength_and_weaknesses": "Strength\n- The paper is well-written.\n- The behavior of the logit margin loss and how OVR loss helps to improve logit margin loss is well-studied.\n\nWeaknesses\n- The idea is incremental because margin-based approaches and logit margin loss are natural and have been well studied before. Additionally, it is also well-known that OVR approach helps to boost the margin.\n- The proposed method only slightly outperforms the baselines.\n- The assumption in Eq. (4) is extremely infeasible and simple compared to real-world uses of the CE and logit margin losses.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject