Improving Adversarial Robustness by Putting More Regularizations on Less Robust Samples
Authors: Dongyoon Yang
Insung Kong
Yongdai Kim
Venue: Submitted to ICLR 2023 (2023)
Keywords: Adversarial Training
Adversarial Attack
Robust Learning

Abstract: 
Adversarial training, which is to enhance robustness against adversarial attacks, has received much attention because it is easy to generate human-imperceptible perturbations of data to deceive a given deep neural network. In this paper, we propose a new adversarial training algorithm that is theoretically well motivated and empirically superior to other existing algorithms. A novel feature of the proposed algorithm is to apply more regularization to data vulnerable to adversarial attacks than other existing regularization algorithms do. Theoretically, we show that our algorithm can be understood as an algorithm of minimizing a newly derived upper bound of the robust risk. Numerical experiments illustrate that our proposed algorithm improves the generalization (accuracy on examples) and robustness (accuracy on adversarial attacks) simultaneously to achieve the state-of-the-art performance.

Under review as a conference paper at ICLR 2023
IMPROVING ADVERSARIAL ROBUSTNESS BY PUTTING MORE REGULARIZATIONS ON LESS ROBUST SAMPLES
Anonymous authors Paper under double-blind review
ABSTRACT
Adversarial training, which is to enhance robustness against adversarial attacks, has received much attention because it is easy generate human-imperceptible perturbations of data to deceive given deep neural network. In this paper, we propose a new adversarial training algorithm that is theoretically well motivated and empirically superior to other existing algorithms. A novel feature of the proposed algorithm to apply more regularization to data vulnerable to adversarial attacks than other existing regularization algorithms do. Theoretically, we show that our algorithm can be understood as an algorithm of minimizing a newly derived upper bound of the robust risk. Numerical experiments illustrate that our proposed algorithm improves the generalization (accuracy on examples) and robustness (accuracy adversarial attacks) simultaneously to achieve the Sfate-of-the-ar performance.
INTRODUCTION
It is easy to generate caaman--mperceptbble perturbations that put prediction of a deep neural network (DNN) out. Such perturbed samples are called adversarial examples (Szegedy et al., 2014) and algorithms for generating adversarial examples are called adversarial attacks. is well known that adversarial attacks can greatly reduce the accuracy of DNNs, for example from about 96% accuracy on clean data to almost zero accuracy on adversarial examples (Madry et al., 2018). This vulnerability of DNNs can cause serious security problems when DNNs are applied to security critical applications (Kurakin et al., 2017; Jiang et al., 2019) such as medicine (Ma et al., 2020; Finlayson et al., 2019) and autonomous driving (Kurakin et al., 2017; Deng et al., 2020; Morgulis et al., 2019; Li et al., 2020).
Adversarial training, which is to enhance robustness against adversarial attacks, has received much attention. Various adversarial training algorithms can be categorized into types. The first one is to learn prediction models by minimizing the robust risk - the risk for adversarial examples. PGD-AT (Madry et al., 2018) is the first of its kinds and various modifications including Zhang et al. (2020); Ding et al. (2020); Zhang et al. (2021) have been proposed since then.
The second type of adversarial training algorithms is minimize the regularized risk which is the sum of the empirical risk for clean examples and a regularized term related to adversarial robustness. TRADES (Zhang et al., 2019) decomposes the robust risk into the sum of the natural and boundary risks, where the first one is the risk for clean examples and the second one is the remaining part, and replaces them to their upper bounds to have the regularized risk. HAT (Rade & Moosavi-Dezfolll 2022) modifies the regularization term of TRADES by adding an additional regularization term based on helper samples.
The aim of this paper is to develop a new adversarial training algorithm for DNNs, which is theoreti- cally well motivated and empirically superior to other existing competitors. Our algorithm modifies the regularization term of TRADES (Zhang et al., 2019) put more regularization on less robust samples. This new regularization term is motivated by an upper bound of the boundary risk.
Our proposed regularized term is similar to that used in MART (Wang et al., 2020). The two key differences are that (1) the objective function of MART consists of the sum of the robust risk and regularization term while ours consists of the sum of the natural risk and regularization term and (2) our algorithm regularizes less robust samples more but MART regularizes less accurate samples more. Note that algorithm is theoretically well motivated from upper bound of the robust risk

---

Under review as a conference paper at ICLR 2023
but such theoretical explanation of MART is available. In numerical studies, demonstrate that our algorithm outperforms MART as well as TRADES with large margins.
1.1 OUR CONTRIBUTIONS
We propose new adversarial training algorithm. Novel features of our algorithm compared other existing adversarial training algorithms are that it is theoretically well motivated and empirically superior. Our contributions can be summarized as follows:
We derive upper bound of the robust risk for multi-classification problems.
As a surrogate version of this upper bound, we propose new regularized risk.
We develop an adversarial training algorithm that learns a robust prediction model by minimizing the proposed regularized risk.
By analyzing benchmark data sets, show that proposed algorithm is superior to other competitors in view of the generalization (accuracy on clean examples) and robustness (ac- curacy on adversarial examples) simultaneously achieve the state-of-the-an performance.
We illustrate that our algorithm is helpful to improve the fairness of the prediction model in the sense that the error rates of each class become more similar compared to TRADES.
PRELIMINARIES
2.1 ROBUST POPULATION RISK
Let X' C IRd be the input space, y' (1,...,C ,C} be the set of output labels and So X' RC be the score function parameterized by the neural network parameters f (the vector of weights and biases) such that pe( (x) softmax (2))) is the vector of the conditional class probabilities. Let Fe((x) = arg max feaxxfe(eee (x) (x, = (x' E X': æ - x' ell S }} and L(-) be the indicator
function. Let capital letters X, Y denote random variables or vectors and small letters æ, y denote their realizations.
The robust population risk used in the adversarial training is defined
Reob (0) = (x
max 1 (Xa(X') Y),
(X.E)
where X and Y are random vector in A' and random variable in V respectively. Most adversarial training algorithms learn f by minimizing an empirical version of the above robust population risk. In turn, most empirical versions of (1) require to generate an adversarial example which is a surrogate version of
c adv arg max
(Fo((')) Fv}.
xe (ancc)
Any method generating an adversarial example called an adversarial attack.
2.2 ALGGRRITHMS FOR GENERATING ADVERSARIAL EXAMPLES
Existing adversarial attacks can be categorized into either the white-box attack (Goodfellow et al.. 2015; Madry et al.. 2018: Carlini & Wagner, 2017; Croce & Hein, 2020a) or the black-box attack (Papernot al., 2016; 2017: Chen al., 2017: Ilyas et al., 2018; Papernot al., 2018). For the white- box attack, the model structure and parameters are known to adversaries who use this information for generating adversarial examples, while outputs for given inputs are only available to adversaries for the black-box attack.
The most popular method for the white-box attack PGD (Projected Gradient Descent) (Madry et al., 2018). Let n)(=100 æ, y) be surrogate loss of (F'(x') ) # y} for given 0, æ. y. PGD finds the adversarial example by applying the gradient ascent algorithm to 77 to update x', and projecting to (w, e). That is, the update rule of PGD is
x (t+1) (I (o(()) + u uggu (2 3))
(2)
2

---

Under review as a conference paper at ICLR 2023
where > 0 is the step size, (m,e)) is the projection operator to (2, and x( We define aad as apd lim xx()) For the surrogate loss 7/, the cross entropy (Madry al., 2018) or
tutoo the KI. divergence (Zhang al., 2019) is used.
For the black-box attack, an adversary generates a dataset {æ; Ds b:;;1 where Os is an output of a given imput æ;, Then, the adversary trains substitute prediction model based on this data and generates adversarial examples from the substitute prediction model by PGD (Papernot et al., 2017).
2.3 REVIEW OF ADVERSARIAL TRAINING ALGORITHMS
We review some of the adversarial training algorithms which, we think, are related to proposed algorithm. Typically, adversarial training algorithms consist of the maximization and minimization steps. In the maximization step, generate adversarial examples for given 0, and in the minimization step, we fix the adversarial examples and update O. In the followings, we denote 2Ptd as the adversarial example corresponding to (æ;, y:) generated by PGD.
2.3.1 ALGORITIMMS MINIMIZING THE ROBUST RISK DIRECTLY
PGD-AT Madry al. (2018) proposes PGD-AT which updates @ by minimizing
(fo (270)) ).)),
1=1
where lee is the cross-entropy loss.
GAIR-AT Geometry Aware Instance Reweighted Adversarial Training (GAIR-AT) (Zhang et al., 2021) is modification of PGD-AT, where the weighted robust risk is minimized and more weights are given to samples closer the decision boundary. be more specific, the weighted empirical risk of GAIR-AT is given
Bi) (f) V.).
where ne( v.) = min (min((t: Fo (xx # y:}), for a prespecified maximum iteration T and (x; vs) = (1 + tanh(5(1 2n vi y:)/ /2))
There other similar modifications of PGA-AT including Max-Margin Adversarial (MMA) Training (Ding et al., 2020) and Friendly Adversarial Training (FAT) (Zhang et al., 2020).
2.3.2
ALGORIHTM MINIMIZING A REGULARIZED EMPIRICAL RISK
Robust risk, natural risk and boundary risk are defined by
Rish (0) ExX,r (3X' (, e) Fo(X') #Y},
Reat ( E(x,r) (X) # Y).
Ruay (0) E(x,r) (3X' (X,,)) (X + (X'X) Y].
Zhang al. (2019) shows
Rob Rear ( + Rody (0).
By treating Rea, (0) as the regularization term, various regularized risks for adversarial training have been proposed.
TRADES Zhang al. (2019) proposes the following regularized empirical risk which is surrogate version of the upper bound of the robust risk:
Σ (ca(fo(z;)) v.) + A (Il)p
3

---

Under review as a conference paper at ICLR 2023
HAT Helper based training (Rade & Moosavi-Deziee 2022) is variation of TRADES where an additional regularization term based on helper examples is added to the regularized risk. The role of helper examples is to restrain the decision boundary from having excessive margins. HAT minimizes the following regularized empirical risk:
Σ Pee (So (xt) + KT. (po (-1o4)) ( Thee (fo(a)) Form (2.
where pre is the parameter of pre-trained model only with clean examples, p.ptper = + 2(2 ).).
MART Misclassification Aware adveRsarial Training (MART) (Wang et al., 2020) minimizes
margin (So (2) ve) + A (= [a]__))[ -oo (x)l)))
where émargin (fo (x.""))) y;) log pe (yn (. log(1 max pe ())")) This objective function k
can be regarded as the regularized robust risk and thus MART can be considered as a hybrid algorithm of PGD-AT and TRADES.
ANTI-ROBUST WEIGHTED REGULARIZATION (ARoW)
In this section, develop new adversarial training algorithm called Anti-Robust Weighted Regularization (ARoW), which is an algorithm minimizing a regularized risk. We propose new regularized term which applies more regularization data vulnerable to adversarial attacks than other existing algorithms such as TRADES and HAT do. Our new regularized term is motivated by the upper bound of the robust risk derived in the following section.
3.1 UPPER BOUND OF THE ROBUST RISK
In this subsection, we provide upper bound of the robust risk for multi-classification problem which is stated the following theorem. The proof deferred to Appendix A.
Theorem 1. For given score function fe, let 2(-) be an any measurable mapping from X X satisfying
2(x)) E arg max (Fo(x) + Fo(x'))
for every x E X. Then, we have
Rob ( S (XY Fo(X)) + ( + Fo(:(X))) (po(Y|= < 1/2] (4)
The upper bound (4) consists of the two terms the first term is the natural risk itself and the second term is an upper bound of the boundary risk. This upper bound is motivated by the upper bound derived in TRADES (Zhang et al.. 2019). For binary classification problems, Zhang al. (2019)
shows that
Roob (0) S E
Ex Ex
(5)
where
2(x) E arg max & (fo(z))foozz)) at (a,6)
and (b(-) is an upper bound of (. < 0). Our upper bound (4) a modification of the upper bound (5) for multiclass problems where ob-) and fe in (5) are replaced by 1(- < 0) and Fe, respectively. A key difference, however, between (4) and (5) is the term {po(( (x))))) < 1/2) at the last part of (4) that is not in (5).
is interesting to see that the upper bound in Theorem becomes equal to the robust risk for binary classification problems. That is, the upper bound (4) is another formulation of the robust risk. However, this rephrased formula of the robust risk is useful since it provides a new learning algorithm when the indicator functions replaced by their surrogates
do.
4

---

Under review as a conference paper at ICLR 2023
Algorithm 1 ARoW Algorithm
Input network fe. training dataset D = ( M/) E Rd+1 ; 1,... n,. learning rate
hyperparameters (A, a)) of (6), number of epochs number of batch B, batch size K Output: adversarially robust network fe
1: for 1,... T do
2: for =1,-- ...
B do
3:
@edd + arg max ttbbk
(L(Po( (2.00 ar,b E IRd, k =.:=..... 1,..., K
o E (2....E))))
4:
0- 0
1) R VARAOO ((0,,,,, a), where RAROW is (6).
5: end for
6:
end for
7: Return fo
3.2 ALGORITHM
By replacing the indicator functions Theorem by their smooth proxies, we propose a new regularized risk and develop the corresponding adversarial learning algorithm called the Anti-Robus Weighted Regularization (ARoW) algorithm. The four indicator functions in (4) are replaced by
the adversarial example x(x) is replaced by ared obtained by the PGD algorithm with the KL divergence;
the term 1(Y * Fo is replaced by the label smooth cross-entropy (Müller et al., 2019) y log (=(+)))) for given a >> 0, where y! (1 a)uy + & lc.
gLS (fo(z))
Uy E R is the one-hot vector whose the y-th entry and 1 RCC the vector whose entries are all 1;
the term (XFo(X) + Fo(=(X))) is replaced by À KL(po [X] P XPed)) for À >>>> 0;
the term 1 (X)(()) < 1/2] is replaced by convex upper bound 2(1 Pe (Y (Ped));
to have the following regularized risk for ARoW, which is smooth surrogate of the upper bound (4), RAROW (0; (Tx; 21 1i
( 91) + 22- (L=(po((1::lll(((aaaa) -1 po (3r 1)
(6)
Here, we introduce the regularization parameter À >> O to control the rohustness of a trained prediction model adversarial attacks. That is, the regularized risk (6) can be considered smooth surrogate of the regularized robust risk of Reat (0) + XRbay(0).
We the label smoothing cross-entropy as surrogate for I(Y A FX)))) instead of the standard cross-entropy to estimate the conditional class probabilities pa (z) more accurately (Müller et al., 2019). The accurate estimation of (- [z) is important since used in the regularization term of ARoW. It is well known that DNNs trained by minimizing the cross-entrope are poorly calibrated (Guo et al., 2017), and so we use the label smoothing cross-entropy technique. We set 0.2 in our numerical studies for simplicity even if it can be tuned optimally.
The ARoW algorithm, which learns by minimizing RAROW (0; {(2,, vi) A), is summarized in Algorithm 1.
key difference of the regularized risks ARoW and TRADES is that Comparison to TRADES
TRADES does not have the term (1 Po (2ped)) at the last part of (6). That is, ARoW puts more
regularization to samples which are vulnerable to adversarial attacks (i.e. (yx apped) is small). Note that this term motivated by the tighter upper bound of the robust risk (4) and thus expected to lead better results. Numerical studies confirm that it really works.
Comparison to MART Although the objective function in MART (3) has no theoretical basis, it is similar with the objective function of ARoW. But, there two main differences. First, the
5

---

Under review as a conference paper at ICLR 2023
59
AutoAttack Accuracy
55.5
PGD20 Accuracy
57
56
TRADES
TRADES HAT
55
ARoW
AROW
54
85
86
87
88
89
Standard Accuracy
Standard Accuracy
Figure 1: Comparison of ARoW TRADES and HAT with varying A. The æ-axis and y-axis are the standard and robust accuracies, respectively. The robust accuracies in the left panel are against PGD20 20 while the robust accuracies in the right panel are against AutoAttack. We exclude the results of MART from the figures because its rboust and standard accuracies too low.
supervised loss term of ARoW the label smoothing loss with clean examples, whereas MART uses the margin cross entropy loss with adversarial examples. Second, regularization term in MART proportional to (1 ()))) while that ARoW is proportional to (1 po pp(y) @PPd))). In the numerical studies, we observe that ARoW outperforms MART with large margins. These would be partly because ARoW is theoretically well motivated.
EXPERIMENTS
In this section, we investigate the ARoW algorithm view of robustness and generalization by analyzing the three benchmark data sets CIFAR 10 (Krizhevsky, 2009). F-MINST (Xiao et al., 2017) and SVHN dataset (Netzer et al., 201 I). particular, we show that ARoW is superior to existing algorithms including TRADES (Zhang et al., 2019), HAT (Rade & Moosavi-Dezfolli, 2022) and MART (Wang et al., 2020) as well as PGD-AT (Madry et al., 2018) and GAIR-AT (Zhang et al., 2021) to achieve state-of-art performances. WideResNet-344 10 (WRN-34- 10) (Zagoruyko & Komodakis, 2016) and ResNet-18 18 (He et al., 2016) are used for CIFAR1O while ResNet- 18 (He et al., 2016) is used for F-MNIST and SVHN. Experimental details presented in Appendix B.
4.1 COMPARISON ARoW TRADES, HAT AND MART
We compare ARoW to the the regularization algorithms TRADES (Zhang et al., 2019), HAT (Rade Moosavi-Dezfolli, 2022) and MART (Wang et al., 2020) explained in Section 2.3.2. Table shows that ARoW outperforms the other regularization algorithms for various data sets and architectures in terms of both the standard and robust accuracies. The selected values of the hyper-paramen for the other algorithms are listed in Appendix B.2.
To investigate whether ARoW dominates its competitors uniformly with respect to the regularization parameter X, we compare the trade-off between the standard and robust accuracies of ARoW and other regularization algorithms when À varies. Figure draws the plots of the standard accuracies in the rraxis and the robust accuracies in the y-axis obtained by the corresponding algorithms with various values of X. For this experiment, we use CIFAR 10 and WideResNet-34- (WRN-34-10) architecture.
The trade-off between the standard and robust accuracies is well observed (i.e. a larger regularization parameter yields lower standard accuracy but higher robust accuracy). Moreover, we can clearly see that ARoW uniformly dominates TRADES and HAT (and MART) regardless of the choice of the regularization parameter and the methods for adversarial attack. Additional results for the trade-off are provided in Appendix F.I.
4.2 COMPARISON OF AROW TO PGD-AT AND GAIR-AT
We compare ARoW with PGD-AT (Madry et al., 2018) and GAIR-AT (Zhang et al., 2021) which are the algorithms minimizing the robust risk directly. Table 2 shows that ARoW outperforms PGD-AT and GAIR-AT in terms of the standard accuracy and the robust accuracy against to AutoAttack (Croce & Hein, 2020b). GAIR-AT'S is, however, better for 2G attack than ARoW. This would be mainly

---

Under review as a conference paper at ICLR 2023
Table 1: Comparison of ARow, TRADES, HAT and MART. We conduct the experiment three times with different seeds and present the averages of the accuracies with the standard errors in the brackets.
CIFARIO (WRN-34
34-10)
CIFARIO (ResNet-18)
Method
Stand
PGD
AA
Stand
PGD30
AA
TRADES
85, 85.86(0.09)
56.79(0.08)
(0.31(0.08)
(2.41(0.07)
52.68(0.22)
(9.63(0.25)
HAT
86.98(0.10)
56.81(0.17)
54.63(0.07)
83.05(0.03)
52.91(0.08)
49.60(0.02)
MART
84.69(0.18 18)
55.67(0.13)
50.95(0.09)
74.87(0:95)
53.68(0.30)
(9.64(
ARoW
87.65(0.02)
58.38(0.09)
55.15(0.14)
82.53(0.13)
55.08(0. 16)
51.33(0.18)
SVHN (ReeNNe-188)
FMNIST (ResNet-13) 18)
Method
Stand
PGD
AA
Stand
PGD
AA
TRADES
91.62(0.49)
58.75(0.19)
51.06(0.93)
91.92(0.44)
88,33(0.03)
88. 88,19(0.04)
HAT
91.72(0.12)
58.66(0.06)
92.10(0.11) 51.67(0.12)
88.09(0.16)
87.93(0.13)
MART
91.64(0.41)
60.57(0.27)
49.95(0.42)
92.14(0.05)
88.10(0.10)
87.88(0.14
ARoW
92.79(0.24)
61.14(0.74)
51.93(0.33)
92.26(0.05)
88.73(0.03)
88.54(0.04)
because of the gradient masking (Papernot et al., 2018; 2017) - PGD does not find an adversarial example well. See Appendix for details about gradient masking
Comparison of ARoW to PGD-AT and GAIR-AT. We conduct the experiment three times Table 2:
with different seeds and present the averages of the accuracies with the standard errors in the brackets.
CIFARIO (WRN-34-10)
CIFAR (ResNet- 18)
Method
Stand
PGD
AA
Stand
PGD
AA
PGD-AT
87.02(0.20)
17.50(0.12)
53.98(0.14)
82.42(0.05)
53.48(0.11)
49.30(0.07)
GAIR-AT
85.44(0.10) 87.65(0.02)
67.27(0.07)
46.41(0.07)
11.09(0.12)
64.89(0.04)
41.35(0.16)
ARoW
58.38(0.09)
55.15(0.14)
82.53(0.13)
55.08(0.16)
51.33(0.188
SVHN (ResNet-18)
FMNIST (ResNet-18)
Method
Stand
PGD
AA
Stand
PGD
AA
PGD-AT
92.75(0.04)
59.05(0.46)
47.66(0.52)
92.25(0.06)
87.43(0.03)
87.19(0.03)
GAIR-AT
91.95(0.40)
18.29(0.18)
38.26(0.48)
90.96(0.10)
87.25(0.01)
85.00(0.12)
ARoW
92.79(0.24)
61.14(0.74)
51.93(0.33)
92.26(0.05)
88.73(0.03)
88.54(0.04)
4.3
ANALYSIS WITH EXTRA DATA
For improving performance on CIFARIO, Carmon al. (2019) and Rebuffi et al. (2021) use extra unlabeled data sets with TRADES. Carmon et al. (2019) uses additional subset of 500K extracted from 80 Million Tiny Images (80M-TI) TI) and Rebuffi et al. (2021) uses a data set of 1M synthetic samples generated by denoising diffuusin probabilistic model (DDPM) (Ho et al., 2020) along with the SiL.U activation function and Exponential Moving Average (EMA). Further, Rade & Moosavi- Dezfolli (2022) shows that HAT achieves the SOTA performance for these extra data.
Table 3 compares ARoW with the exiting algorithms for extra data, which shows that ARoW achieves the state-of-the- performance when extra data are available even though the margins compared to HAT are not significant. Note that ARoW has ad advantages other than the high robust accuracies. For example, ARoW easy to implement compared to HAT since HAT requires a pre- rrettrined model and it needs additional memory. Moreover, as we will see in Section 4.5, ARoW improves the fairness compared to TRADE while HAT does not.
4.4 ABLATION STUDIES
We study the following three issues (i) the effect of label smoothing to ARoW, (ii) the role of the new regularization term in ARoW to improve robustness and (iii) modifications of ARoW by applying tools which improve existing adversarial training algorithms.
4.4.1 EFFECT OF LABEL SMOOTHING
Table 4 indicates that label smoothing is helpful not only for ARoW but also for TRADES. This would be partly because the regularization terms in ARoW and TRADES depend on the conditional
7

---

Under review as a conference paper at ICLR 2023
Table Comparison of ARoW other adversarial algorithms with extra data on CIFARIO.
Model
Extra data
Method
Stand
PGD
AutoAttack
Carmon al. (2019)
89.69
62.95
59.58
Rebuffi et al. (2021)
90.47
63.06
60.57
WRN-28-10
80M-T1(500K)
HАT
91.50
63.42
60.96
ARoW
91.57
64.64
60.91
Carmon et al. (2019)
87.07
56.86
53.16
Rebuffi et al. (2021)
87.67
59.20
56.24
80M-T)(500K)
HAT
88.98
59.29
56.40
ARoW
89.04
60.38
56.54
ResNet-18
Carmon et al. (2019)
82.61
56.16
52.82
Rebuffi al. (2021)
83.46
56.89
54.22
DDPM(LM)
HAT
86.09
58.61
55.44
ARoW
86.72
59.50
55.57
class probabilities and it is well known that label smoothing is helpful for the calibration of the conditional class probabilities (Pereyra et al., 2017).
Moreover, the results in Table imply that label smoothing is not main reason for ARoW to outperform TRADES. Even without label smoothing, ARoW is still superior to TRADES (even with label smoothing). Appendix F.2 presents the results of an additional experiment to assess the effect of label smoothing to the performance.
Table Comparison of TRADES and ARoW with/without label smoothing, With WRN-28-10 architecture and CIFARIO dataset, use À 6 for TRADES while use À 3 for ARoW.
Method
Standard
PGD
AutoAttack
TRADES w/o-LS
85.86(0.09)
56.79(0.08)
54.31(0.08)
TRADES WI-LS
86.33(0.08)
57.45(0.022
54.66(0.08)
ARoW w/o-LS
86.83(0.16)
58.34(0.09)
55.01
ARoW W/-LS
87.65(0.02)
58.38(0.09)
55.15(0.14)
4.4.2 ROLE OF THE NEW REGULARIZZTTIO TERM AROW
The regularization term of ARoW puts more regularization to less robust samples, and thus we expect that ARoW improves the robustness of less robust samples much. To confirm this conjecture, small experiment.
First, we divide the test data into four groups least robust, less robust, robust and highly robust according to the values of Paeao (y (edd (< 0.3, 0.3 0.5, 0.5 0.7 and > 0.7), where OPGD the parameter learned by PGD-AT (Madry et al., 2018)
Then, for each group, check how many samples become robust for ARoW and TRADES. respectively, whose results are presented in Table Note that ARoW improves the robustness of least robust samples most compared with TRADES. We believe that this improvement is due to the regularization term in ARoW that enforces more regularization on less robust samples.
Table 5: Role of the new regularization term in ARoW. # RobTRADES and RobARoW represent the number of samples which are only robust to TRADES but not to ARoW, or vice versa. Diff. and Rate of Impro. denote (# RobARoW # RObTRADES) and Diff. # RObTRADES)
Sample's 's Robustness
# RObTRADES
# RobaRow
Diff.
Rate of Impro. (%)
Least Robust
317
357
40
12.62
Less Robust
945
1008
63
6.67
Robust
969
1027
58
5.99
Highly Robust
3524
3529
0.142
'We use PGD-AT instead of standard non-robust training algorithm since all samples become least robust for non-robust prediction model.
8

---

Under review as a conference paper at ICLR 2023
4.4.3 MODIFICATIONS OF ARoW
There are many useful tools which improve existing adversarial training algorithms. Examples are Adversarial Weight Perturbation (AWP) (Wu et al., 2020) and Friendly Adversarial Training (FAT) (Zhang et al., 2020). AWP is a tool to find flat minimum of the objective function and FAT uses early-stopped PGD when generating adversarial examples in the training phase. Details about AWP and FAT are given in Appendix F.4.
We investigate how ARoW performs when it is modified by such tool. We consider the two modifications of ARoW ARRW-AWP and ARo W-FAT, where ARoW-AWP searches a flat minimum of the ARoW objective function and ARoW-FAT uses early-stopped PGD in the training phase of ARoW.
Table 6 compares ARoW-AWP and ARoW-FAT to TRDAES-AWP and TRADES-FAT. Both of AWP and FAT are helpful for ARoW and TRADES but ARoW still outperforms TRADES with large margins after modified by AWP FAT.
Table 6: Modifications of TRADES and ARoW. We use CIFAR10 dataset and ResNet-18 architec- ture. More details of hyerparameters are provided Appendix F.4.
AWP
FAT PGD 20
Method
Standard
PGD
AutoAttack
Standard
AutoAttack
TRADES
82. 10.)9
53.56(0.188 18)
49.56(0.23)
82.96(0.08)
52.76(0.22) 53.37(00.2))
49.83(0.28)
ARoW
84.98(0.11)
55.55(0.155)
50.64(0.18)
86.21(0.006
50.07(0.17)
4.5
IMPROVED FAIRNESS
Xu al. (2021) reports that TRADES (Zhang et al., 2019) increases the variation of the per-class accuracies (accuracy in each class) which is not desirable in view of fairesss. In turn, Xu et al. (2021) proposes the Bair-RobustLeamming (FRL) algorithm to alleviate this problem. Even if fairness becomes improved, the standard and robust accuracies of FRL are worse than TRADES.
In contrast, Table 7 shows that ARoW improves the fairness as well as the standard and robust accuracies compared to TRADES. This desirable property of ARoW can be partly understood as follows. The main idea ARoW is to impose more robust regularization to less robust samples. In turn, samples in less accurate classes tend to be more vulnerable to adversarial attacks. Thus, ARoW improves the robustness of samples in less accurate classes which results in improved robustness well improved generalization for such less accurate classes. The class-wise accuracies presented in Appendix G.
Table 7:
Class-wise accuracy disparity for CIFAR1O. We report the accuracy (ACC), the worst-class accuracy (WC-Acc) and the standard deviation of class-wise accuracies (SD) for each method.
Standard WC-Acc
PGD
Method
Acc
SD
Acc
WC-Acc
SD
TRADES
85,69
67.10
9.27
57.38
27.10
16.97
HAT
86.74
65.40
11.12
57.92
24.20
18.26
ARoW
87.58
74.51
7.11
59.32
31.05
15.67
CONCLUSION AND FUTURE WORKS
In this paper, we derived an upper bound of the robust risk and developed new algorithm for adversarial training called ARoW which minimizes surrogate version of the derived upper bound. A novel feature of ARoW is to impose more regularization on less robust samples than TRADES. The results of numerical experiments shows that ARoW improves the standard and robust accuracies simultancously to achieve state-of-the-an performances. In addition, ARoW enhances the faimess of the prediction model without hampering the accuracies.
When we developed a computable surrogate of the upper bound of the robust risk in Theorem 1, we replaced ( (X) * Fo(=(X)))) by (T(ppo-|X)) ||o (-(Xx_d)))) The KI. divergence, however, is

---

Under review as a conference paper at ICLR 2023
not upper bound of the 0-1 loss and thus surrogate is not upper bound of the robust risk. We employed the KL divergence surrogate to make the objective function of ARoW be similar to that of TRADES. It would be worth pursuing to devise alternative surrogate for the 0-1 loss to reduce the gap between the theory and algorithm.
We have seen in Section 4.5 that ARoW improves fairness well accuracies. The advantage of ARoW in view fairness is an unexpected by- by-product, and would be interesting to develop more principled way of enhancing the fairness further without hampering the accuracy.
REFERENCES
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: query- efficcentt black-box adversarial attack via random searchg. In ECCV, 2020.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. IEEE Symposium Security and Privacy, 2017.
Yair Carmon, Aditi Raghunathan, Schmidt Ludwig, John C Duchi, and Percy Liang. Unlabeled data improves adversarial robustness. In NeurIPS, 2019.
Pin- Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In ACM, 2017. doi: 10.11452318552.3144448 01778572.314044
URL http:// /xx doi. woi.orgg/0..14./
Tranlong Chen, Zhenyu Zhang, Sijia Liu, Shiyu Chang, and Zhangyang Wang. Robust overfitting may be mitigated by properly learned smoothening. In ICIR, 2021.
Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with fast adaptive boundary attack. In The European Conference on Computer Vision(ECCCV 2020a.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustmess with an ensemble of diverse parameter-free attacks, 2020b.
Yao Deng, Xi Zheng, Tianyi Zhang, Chen Chen, Guannan Lou, and Miryung Kim. An analysis of adversarial attacks and defenses autonomous driving models. IEEE International Conference on Pervasive Computing and Communications(PeCCCaaaa PeerCom), 2020.
Gavin Weiguang Ding, Yash Sharma, Kry Yik Chau Lui, and Ruitong Huang. Mma training: Direct input space margin maximization through adversarial training. In International Conference on Learning Represeetattaions((CLL))) 2020.
Samuel G. Finlayson, Hyung Won Chung, Isaac S. Kohane, and Andrew I.. Beam. Adversarial attacks against medical deep learning systems. In Science, 2019.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015.
Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q. Weinberger. On calibration of modern neural networks. In ICMI., 2017.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016.
Dorjan Hitaj, Giulio Pagnotta, Iacopo Masi, and Luigi V. Mancini. Evaluating the robustness of geometry-awan instance-reweightedd adversarial training. archive, 2021.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In NeurlPS, 2020.
Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. In ICML. 2018.
10

---

Under review as a conference paper at ICLR 2023
Pavel Izmailov, Dmitrii Podoprikhin, Timur Garipov, Dmitry Vetrov, and Andrew Gordon Wilson Averaging weights leads to wider optima and better generalization. Proceedings of the international conference on Uncertainty in Artificial Intelligence, 2018.
Linxi Jiang, Xingjun Ma, Shaoxiang Chen, James Bailey, and Yu-Gang Jiang. Black-box adversarial attacks on video recognition models. In ACM, 2019.
Alex Krizhevsky. Learning multiple layers of features from tiny images, 2009.
Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In ICLR, 2017.
Yujie Li, Xing Xu, Jinhui Xiao, Siyuan Li, and Heng Tao Shen. Adaptive square attack: Fooling autonomous cars with adversarial traffic signs. IEEE Internet of Things Journal, 2020.
Ilya Loshchilov and Frank Hutter. Sgdr: Stochastic gradient descent with warm restarts. In ICLR, 2017.
Xingjun Ma, Yuhao Niu, Lin Gu, Yisen Wang, Yitian Zhao, James Bailey, and Feng Lu. Understanding adversarial attacks on deep learning based medical image analysis systems. Pattern Recognition, 2020.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. ICLR, 2018.
Nir Morgulis, Alexander Kreines, Shachar Mendelowitz, and Yuval Weisglass. Fooling a real car with adversarial traffic signs. ArXiv, 2019.
Rafael Müllrr, Simon Kornblith, and Geoffrey E. Hinton. When does label smoothing help? In NeurlPS, 2019.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y. Ng. Reading digits in natural images with unsupervised feature learning. NIPS Workshop on Deep Learning and Unsupervised Feature Learning 2011, 2011.
Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv, 2016.
Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, 7. Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. In ACM, 2017.
Nicolas Papernot, Patrick McDaniel, Arunesh Sinha, and Michael Wellman. Towards the science of security and privacy in machine learning. 2018 IEEE European Symposium on Security and Privacy (Euro&&P), 2018.
Gabriel Pereyra, George Tucker, Jan Chorowski, Lukasz Kaiser, and Geoffrey E. Hinton. Regularizing neural networks by penalizing confident output distributions. In ICLR, 2017.
Rahul Rade and Seyed-Mohsen Moosavi-Dezfolli. Recuding excessive margin to achieve better accuracy vs. robustness trade-off. In ICLR, 2022.
Sylvestre-Alvis Rebuffi, Sven Gowal, Dan Andrei Calian, Florian Stimberg, Olivia Wiles, and Timothy A Mann. Data augmentation can improve robustness. In NeurlPS, 2021.
Leslie Rice, Ericg Wong, and J. Zico Kolter. Overfitting in adversarially robust deep learning. In ICML, 2020.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In ICLR, 2014.
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In International Conference on Learning Representatuions(((11))) 2020.
11

---

Under review as a conference paper at ICLR 2023
Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust general- ization. In NeurIPS, 2020.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. archive, 2017.
Han Xu, Xiaorui Liu, Yaxin Li, Anil Jain, and Jiliang Tang. To be robust to be fair: Towards fairness in adversarial training. In ICML, 2021.
Sangdoo Yun, Dongyoon Han, Scong Joon Oh, Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. Cutmix: Regularization strategy to train strong classifiers with localizable features. In CVPR, 2019.
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. Proceedings of the British Machine Vision Conference 2016, 2016.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. International Conference on Machine Learning (ICMI), 2019.
Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan S. Kankanhalli. Attacks which do not kill training make adversarial learning stronger. In ICML, 2020.
Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan S. Kankanhalli. Geometry-aware instance-reweiigteed adversarial training. In ICLR, 2021.
12

---

Under review as a conference paper at ICLR 2023
Appendices
A PROOF OF THEOREM
In this section, we prove Theorem 1. The following lemma provides the key inequality for the proof. Lemma For a given score function fo. let z(-) be an any measurable mapping from X to X satisfying
x(x) E arg max 1 (Fo(x)) # Fo(x')) at (.
for every x E X. Then, we have
1 (3x' E (2( Fo(x) + Fola'), Fo(x)) = (Fo(a())) + Fo(=(m)), Y * Fo(z(=)))
(A.1)
Proof. The inequality holds obviously 1 (Fo(z) + Fo(z(z)), + Fo(=(=)))
Hence,
suffices to show that 1 (3w's e Bp(x,E) Fe(x) Fo Fo YJ = 0 when either Fo(x) Fo or = Fo(=(x)).
Suppose Fe (x) Fo(z(x)). It trivially holds that 1 (Fe(x) # Fo()(=))) < 1 (F)( + Fo(x'))
since I (F) * Fo((())) = and the equality holds and only if Fx()(x)) Fo(x'). By the definition of z(x), the left side of (A.1) is 0 since (3xx E B,(x,)) Fo(x)) + Fo(('))} = 0, and hence the inequality holds.
for every x'
Suppose Y Fo(2(x)). (f Folx) Y and there exists x' in (2(x, E) such that Fo(x') + Fo(x). then we have Fo(x') * Y = Fo(x) = (=)))))) In turn, it implies (Fo(x) o Fo(z(x))) < 1 (F)( * Fa()))), which is contradiction to the definition of 2 Hence, the left side of (A.1) should be O, and we complete the proof of the inequality.
Theorem 1. For a given score function fe, let 2(-) be an any measurable mapping from X to X
satisfyyng
x(x) E arg max 1 (Fo(z) + Fo(x')). xe (..E)
for every x E X. Then, we have
(0) < E # Fo(X)) + ((x + Fo(2(X))))
(P < 1/2} (4)
Proof. Note that Reo (0) Rea (0) + Rody (0) where R ( Exx,r (Fo(X) * #Y} and
Rody (0) B(x,y) FEX (x, 5) Fe Fx + Fx Y}.
Since
Rady (0) E(XY) 1 (3X' E B, e): PX( #
=
< <Exr (Fo(X) # Fo(=(X)), # Fo(z(X))) (:: Lemma
E(x,r) (Fo(X) * Fo(2(X))) LYY * Fo(2(X))
< E (To(X) * Fo(=(X))) (()(((((X)) < <1/2),
the inequality (4) holds.
13

---

Under review as a conference paper at ICLR 2023
B DETAILED SETTINGS FOR THE EXPERIMENTS WITH BENCHMARK DATASETS
B.1 EXPERIMENTAL SETUP
For CIFARIO, SVHN and FMNIST datasets, input images are normalized into [0, 1J. Random crop and random horizontal flip with probability 0.5 used for CIFARIO while only random horizontal flip with probability 0.5 is applied for SVHN. For FMNIST, augmentation is not used.
For generating adversarial examples in the training phase, PGD10 with random initial, p oc, 8/255 and = 2/255 is used, where PGD" is the output of the PGD algorithm (2) with T iterations. For training prediction models, the SGD with momentum 0.9, weight decay 10-4, the initial learning rate of 0.1 and batch size of 128 is used and the learning rate is reduced by a factor of 10 60 and 90 epochs. Stochastic weighting average (SWA) (Izmailov et al., 2018) employed after 50-epochs for preventing from robust overfitting (Rice et al., 2020) Chen et al. (2021) does.
For evaluating the robustness in the test phase, PGD and AutoAttack are used for adversarial attacks, where AutoAttack consists of three white box attacks APGD and APGD-DIR in Croce & Hein (2020h) and FAB in Croce Hein (2020a) and one black box attack Square Attack (Andriushchenko al., 2020). To the best of our knowledge, AutoAttack is the strongest attack. The final model is set to be the best model against 2GD on the test data among those obtained until 120 epochs.
B.2 HYPERPARAMETER SETTING
Table Selected by byperparameters. Hyperparameters used in the numerical studies in Section 4.1
and Section 4.2.
Dataset
Model
Method
A Y
Weight Decay
SWA
TRADES
5e
HAT
0.25
5e
MART
2e
WRN-34-10
PGD-AT
5e
GAIR-AT
5e
ARoW
5e
0.2
CIFARIO
TRADES
5e
HAT
0.5
5e
MART
5e
ResNet-18
PGD-AT
5e
GAIR-AT
5e
ARoW
5e
0.2
TRADES
5e
HAT
0.5
5e
MART
5e
SVHN
ResNet-18
PGD-AT
5e
GAIR-AT
5e
X
ARoW
5c
0.2
X
TRADES
5e
X
HAT
0.15
5e
X
MART
5c
FMNIST
R8
PGD-AT
5e
X
GAIR-AT
5e -4
X
ARoW
5
0.2
Table 8 presents the hyperparameters used on our experiments. Most of the hyperparameters are set to be the ones used in the previous studies. The weight decay parameter is set to be 5e in most experiments, which is the well-known optimal value. Only for MART (Wang et al., 2020) with WRN34-10, we use weight decay 2e - as Wang et al. (2020) did since MART works poorly with 5e We use stochastic weight averaging (SWA) for CIFAR10 10 except MART. Note that SWA is not
14

---

Under review as a conference paper at ICLR 2023
used in the experiments of Wang al. (2020), and we confirm that SWA is not helpful for MART. Effects of SWA for all methods are provided in Appendix F.3.
C CHECKING THE GRADIENT MASKING
Table 9: Comparison of GAIR-AT and ARoW. We compare the robustness of GAIR-AT (Zhang ct al., 2021) and ARoW against the four attacks used in AutoAttack on CIFARIO. The results are based on WRN-34-10, We set À = 3 for ARoW.
Method
Standard
PGD
APGD
APGD-DLR
FAB
SQUARE
GAIR-AT
85.44(0.170)
67.27(0.07)
(3.14(0.16)
46.48(0.07)
49.35(0.05)
55.19(0.16
ARoW
87.65(0.02)
58.38(0.09)
56.07(0.14)
55.17(0.11) 56.69(0.17) 63.50(0.08)
Gradient masking (Papernot al., 2018; 2017) is the case that the gradient of the loss for given non-robust datum is almost zero (i.e. (Jo((()()))) y) Rs 0). In this case, PGD cannot generate an adversarial example. We check the ocuurence of gradient masking when prediction model is robust to the PGD attack but not robust to attacks such as FAB (Croce & Hein, 2020a), APGD-DLE (Croce& & Hein, 2020b) and SQUARE (Andriushchenko et al., 2020).
In Table 9, the robustness of GAIR-AT becomes worse much for the three attacks in AutoAttack except APGD (Croce Hein, 2020b) while the robustness of ARoW remains stable regardless of the adversarial attacks. Since APGD uses the gradient of the loss, this observation implies that the gradient masking occurs in GAIR-AT while does not in ARoW.
Better performance of GAIR-AT for PGD attack in Table 2 is not because GAIR-AT is robust to adversarial attacks but because adversarial examples obtained by PGD are close to clean samples. This claim is supported by the fact that GAIR-AT performs poorly for AutoAttack while it is still robust to other PGD-based adversarial attacks. Moreover, gradient masking for GAIR-AT is already reported by Hitaj et al. (2021).
D DETAILED SETTING FOR THE EXPERIMENTS WITH EXTRA DATA
Table 10: Selected hyperparameters. Hyperparameters used in the numerical studies in Section
4.3. We do not employ cutmix augmentation (Yun et al., 2019) as does in Rade & Moosavi-Dezfole (2022).
Model
Method
A
Weight Decay
a
EMA
SiLU
Carmon al. (2019)
6
5e
Rebuffi et al. (2021)
6
5e
WRN-28-10
HAT
0.25
5e
ARoW
3.5
5e
0.2
Carmon et al. (2019)
6
5e
Rebuffi et al. (2021)
6
5e
ResNet-18
HAT
0.25
ARoW
3.5
56-1
0.2
In Section 4.3, we presented the results of ARoW on CIFARIO with extra unlabeled data used in Carmon et al. (2019) and Rebuffi et al. (2021). In this section, provide experimental details.
Rebuffi et al. (2021) use the SiLU activation function and exponential model averaging (EMA) based on TRADES. For HAT (Rade & Moosavi-Dezfolli, 2022) and ARoW, we use the SiLU activation function and exponential model averaging (EMA) with weight decay factor 0.995 as is done in Rebuffi et al. (2021). The cosine annealing learning rate scheduler (Loshchilov & Hutter, 2017) is used with the batch size 512. The final model set to be the best model against PGD 10 on the test data among those obtained until 500 epochs.
15

---

Under review as a conference paper at ICLR 2023
E ADDITIONAL RESULTS WITH EXTRA DATA
E. RESULTS CIFAR 100
For additional experiments, analyzed CIFAR-100 in WRN-34-10 and found that ARoW still outperforms the other competitors.
Table 11: Comparison of ARoW to competitors on CIFAR100. We compare ARoW to PGD-AT, TRADES, HAT and MART on CIFAR100. We used WRN-28- 10 architecture.
Method
Stand
PGD
AutoAttack
PGD-AT
62.20
32.27
28.66
TRADES
62.23
33.45
29.07
HAT
60.42
33.75
29.42
MART
59.76
33.37
29.68
ARoW
62.38
34.74
30.42
E.2 ADDITIONAL RESULTS WITH EXTRA DATA
In the main manuscript, we use architecture of ResNet18, while Rade & Moosavi-Dezfolli (2022) PreAct-ResNett18 For better comparison, conduct additional experiment with extra data where the same architecture
is used. In addition, we set batch size to 1024 which used in Rade & Moosavi-Dezfolli (2022). Table 12 shows that ARoW outperforms HAT both standard (ccuracy(++0.29)) and robust accuracy(+0.111) against autoattack.
Table 12:
Performance with extra data (Carmon et al.) on CIFAR10. We brought the values in the paper as reported Rade & Moosavi-Dezfolli (2022).
Method Standard
AutoAttack
HAT
89.02
57.67
ARoW
89.31
57.78
F ABLATION STUDY
F.1 THE TRADE-OFF DUE TO THE CHOICR OF X
Table 13 presents the trade-off between the generalization and robustness accuracies of ARoW on CIFAR10 due the choice of X, where ResNet18 is used. The trade-off is obviously observed.
Table 13: Standard and robust accuracies of ARoW on CIFAR10 for varying X.
X
Standard
"CD
AutoAttack
TRADES(A 6)
82,41
52.68
49.63
ARoW() 2.5)
85.30
53.80
49.66
ARoW(A -3.0)
84.65
54.23
50.11
ARoW(A -3.5)
83.86
54.13
50.15
AROW(A =4.0)
83.73
54.20
50.55
ARoW(A 4.5)
82.97
54.69
50.83
AROW(A 5.0)
82.53
55,08
51.33
F.2 THE EFFECT LABEL SMOOTHING
Table 14 presents the standard and robust accuracies of ARoW CIFAR10 for various values of the smoothing parameter a in the label smoothing where the regularization parameter is fixed at 3 and ResNet18 is used.
16

---

Under review as a conference paper at ICLR 2023
Table 14: Standard and robust accuracies of ARoW on CIFARIO for varying a.
Standard
PGD
AutoAttack
0.05
83.54
53.10
49.88
0.10
84.10
53.29
49.75
0.15
84.36
53.56
49.67
0.20
84.52
53.68
49.96
0.25
84.48
53.53
49,93
0.30
84.55
53.53
49.89
0.35
84.66
54.19
50.03
0.40
84.65
54.23
50.11
F.3 EFFECT OF STOCHASTIC WEIGHT AVERAGING (SWA)
We compare the standard and robust accuracies the adversarial training algorithms with and without SWA whose results are summarized in Table 15. SWA improves the accuracies for all the algorithms except MART. Without SWA, ARoW is competitive to HAT, which is known to be the SOTA method. However, ARoW dominates HAT when SWA is applied.
Table 15: Effects of SWA on CIFARIO with WideResNet 34-10. We conduct the experiment three times with different seeds and present the averages of the accuracies with the standard errors in the brackets. "w/o' stands for 'without'.
Method TRADES
Standard
PGD
AutoAttack
85.86(0.09)
56.79(0.08)
54.31(0.08)
HAT
86.98(0.10) 56.81(0.17)
54.63(0.07)
SWA
MART
78.41(0.07) 56.04(0.09)
48.94(0.09)
PGD-AT
87.02(0.20)
57.50(0.12)
53.98(0.14)
ARoW
87.59(0.02)
58.61(0.09)
55.21(0.14)
TRADES
85.48(0.12)
56.06(0.08)
53.16(0.17)
HAT
87.53(0.02)
56.41(0.09)
53.38(0.10)
w/o-SWA
MART
84.69(0.18)
55.67(0.13)
50.95(0.09)
PGD-AT
86.88(0.09)
54.15(0.16)
51.35(0.14)
ARoW
87.60(0.02)
56.47(0.10)
52.95(0.06)
F.4
AWP AND FAT
F.4.1
ADVERSARIAL WEIGHT PERTURBATION (AWP)
For given objective function of the adversarial training. AWP (Wu et al., 2020) tries to find a flat minimum in the parameter space. Wu et al. (2020) proposes TRADES-AWP, which minimizes
Σ ((.)) + X (L(po+ (-(()")))))
min
max | 1I 0I 7I
where 0 is the weight vector of 1-th layer and is the weight perturbation size. Inspired by TRADES-AWE we propose AROW-AWP which minimizes
1 Σ 1=1
min
max
||
+ 2X KL(po+5(-1z)) |pets-- (1 pe (2pe))) })}
In our experiment, we set to be 0.005 which the value used in Wu et al. (2020) and do not use SWA did in original paper.
17

---

Under review as a conference paper at ICLR 2023
F.4.2 FRIENDLY ADVERSARIAL TRAINING (FAT)
Zhang al. (2020) suggests early-stopped PGD which uses data-adaptive iterations of PGD when an adversarial example is generated. TRADES-FAT, which uses the early-stopped PGD in TRADES, minimizes
Σ ( (1)
where 4 min [in (o(a # v: + K.T} Here, the maximum iterations of PGD.
We propose an adversarial training algorithm ARoW-FAT by combining ARoW and early-stopped PGD. ARoW-FAT minimizes the following regularized empirical risk:
(m Σ (fol.))) + 22 (o/ppo((a:)llo((11121 (()))) (1 (1- { ())
In the experiments, we set K to be 2, which is the value used in Zhang et al. (2020).
G IMPROVED FAIRNESS
Table 16:
Comparison of per-class robustness and generalization of TRADES and ARoW.
RObTRADES and RObARoW are the robust accuracies against PGD of TRADES and ARoW, respec- tively. StandTRADES and Stand ARoW the standard accuracies.
Class
RobTRADES
Roow
StandTRADES
Stand
O(Arpplane)
64.8
66.7
88.3
91.6
(Automobile)
77.5
77.5
93.7
95.3
2(Bird)
38.5
43.1
72.5
80.6
3(Cat)
26.1
30.2
65.9
75.1
4(Deer)
35.6
40.3
83.4
87.5
5(Dog)
48.6
47.2
76.0
79.3
6(Frog)
67.8
63.6
94.2
95.2
7(Horse)
69.7
69.3
91.0
92.7
8(Ship)
62.3
70.1
90.9
94.9
9(Truck) 75.3
76.3
93.5
93.5
In Table 16, present the per-class robust and standard accuracies of the prediction models trained by TRADES and ARoW. We can see that ARoW is highly effective for classes difficult to be classified such Bird, Cat, Deer and Dog. For such classes, ARoW improves much not only the standard accuracies but also the robust accuracies. For example, in the class "Cat', which is the most difficult class (the lowest standard accuarcy for TRADES and ARoW), the robustness and generalization are improved by 4.1 percentage point (26.13 1% - 30.2%) and 9.2 percentage point (65.9% - 75.1 (5.1%) by ARoW compared with TRADES, respectively. This desirable results would be mainly due to the new regularization term in ARoW. Usually, difficult classes are less robust to adversarial attacks. By putting more regularization on less robust classes, ARoW improves the accuracies of less robust classes more.
18


Reviews:
[{"review_id": "rOJDrGHZfe", "reviewer": "Reviewer_E21G", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper a new adversarial training method to improve the robustness of deep learning classifiers in the field of computer vision. To do so, the authors derived a new loss function, which is the surrogate of an upper bound of the robust risk. Specifically, they point out the differences and connections between the proposed method and previous adversarial training method. Experiments on three datasets (CIFAR10, F-MINIST, SVHN) show that the proposed method outperforms other baselines in terms of clean classification accuracy and robust accuracy. Ablation studies are done to show the effect of different parts of the loss function. They also show that the proposed method can be combined with other adversarial training techniques, such as extra data, to further improve the performance. Finally, experiments on CIFAR10 show that the proposed method is helpful to improve the fairness of the classifier compared to TRADES (which is an important baseline).", "summary_of_the_review": "Overall it's a good paper with with theoretical justification and experimental support. Though, there are some weakness in terms of novelty and the limitation of the datasets used, it is a paper above the margin.", "strength_and_weaknesses": "Strength:\n\n- Adversarial robustness is an important security issue in the field of deep learning. The proposed method pushes the SOTA performance of adversarial training to a new level.\n- The proposed loss function is derived with a theoretical support.\n- Extensive experiments show the empirical advantages of the proposed method from different aspects.\n\nWeakness:\n\n- The novelty of the method is ok, but it is similar to previous methods like MART. The author does point out the differences between the proposed method and other methods, so should not be a big problem.\n- It's good that for table 1 and table 2 the results are based on 3 runs with standard errors given, but for most results, the improvements seem marginal.\n- CIFAR10, F-MNIST, SVHN are all relatively small datasets. Does the method also perform well on larger dataset?\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "YcHNygUOr9q", "reviewer": "Reviewer_m348", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This work tries to develop an upper bound of the robust risk and design a new algorithm for\nadversarial training called ARoW which minimizes a surrogate version of the developed upper bound.", "summary_of_the_review": "I believe this paper is not good enough to publish in ICLR for the following reasons.  \n1. (main) Overclaim in theoretical part. Ref weakness 1, 2. I do not think it has sufficient theoretical contribution and its theorem can support the method.\n2. (secondary) Weak experiments.", "strength_and_weaknesses": "Strength:\n1. Well-written\n2. Claim both theoretical and empirical contributions\n\nWeakness:\n1. **(1)** I guess Equation A.1 should be '$=$' and Throem 1 (and the proof) should be '$=$' (rather than '$\\le$') for **binary classification problems**. Hence, Throem 1 is just another expression of 'R_rob = R_nat + R_bdy'. The second term in Theorm 1 is just another expression of boundary error rather than the upper bound of boundary error.     \n**(2)** For **multi-classification problems**, I guess Equation A.1 is still $=$ rather than $\\le$ as $x'$ includes $z(x)$. **Could authors clarify why use $\\le$ rather than $=$ here and what's the meaning of Lemma 2?**      \n**(3)** I also think the last line of last equation in Page 13 is $=$ (rather than $\\le$) for binary classification problems, and $\\le$ for **multi-classification problem** is meaningless, for me it seems like **loosing the equation and artificially creating a very loose bound** . I.e., use **($Y\\ne F(z(x))$ is the sufficient and unnecessary condition of $p(Y|z(x))<0.5$ for multi-classification problem)** to bound the equation. This is the only technical part in this theorem, could we call this a new theorem and claim this a theoretical contribution (theorem 1 is even a simple expansion equation for binary case)?  \n**(4) In conclusion, for me, Theorem 1 seems like an equation for binary classification problem and an artificially-created loose bound for multi-classification problem. That is,  \n$R_{bdy}=\\mathbb{E}[\\mathbb{1}(F(X)\\ne F(z(X)))\\mathbb{1}(Y\\ne F(z(X)))] \\le \\mathbb{E}[\\mathbb{1}(F(X)\\ne F(z(X))) \\mathbb{1} (p(Y|z(x))<0.5)]$, which uses a loose and simple bound to bound the original equation. In my opinion, the $\\le$ here is the only technical part in Theorem 1.   \nI cannot get the hidden meaning and theoretical contribution of this bound and think it is essentially meaningless. Could authors clarify what is the specific and profound meaning of Theorem 1?**    \n**Please point out my mistakes if I understand it incorrectly.**\n2. In Sec. 3.2, the term 1 {pθ(Y |z(X)) < 1/2} is replaced by its convex upper bound 2(1 − pθ(Y | \\hat X pgd)). This upper bound is loose, especially in a multi-classification problem (like CIFAR-10 in the experiments), this bound is meaningless as it is too loose.  \n**Thus, for me, the theoretical part in this manuscript seems like a created loose bound plus a created loose bound.**\n3. Weak experiments and only a little improvement, need more empirical resuts (e.g., CIFAR-100, compare with AWP-TRADES)  \n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "DWMKwb6PWc", "reviewer": "Reviewer_hmqr", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This work proposes a simple, effective, and theoretically inspired regularization to enhance the robustness of DNNs agains adversarial attacks.\nExtensive experimental results were carried out showing the effectiveness of the proposed approach in providing robustness enhancements. ", "summary_of_the_review": "There several aspects that I like about this work such as the theoretical motivation, the extensive experimental evaluation, and the writing.\nHowever, there are two concerns that  I hope to be addressed in the discussion period.", "strength_and_weaknesses": "This appear has several strengths:\n\n- The paper is is well motivated and the added regularizer is theoretically inspired.\n\n- The experimental analysis show the consistent improvement of the proposed method over previous art.\n\n- The paper is well-written. Further, the contributions of this work is placed properly within the literature.\n\n- The wide broad of the empirical results shown in this paper covers many interesting aspects such as combining the proposed approach with AWP, and increasing the fairness.\n\n\nThere are few weaknesses that I hope to be addressed during the discussion:\n\n- While the paper is generally well-written, there few parts that require small adjustments. For example,\nIn caption of figure 1: “ We exclude MART from the figures because its performance is too bad”\n\n- Generally, the robustness improvements that ARoW provide is marginal. Would the proposed method improve the state-of-the-art model from [A]?\n\n[A] Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples, 2021.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "-huIYeCaYsk", "reviewer": "Reviewer_cZx4", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper proposes a modification of TRADES, one of the most popular algorithms to obtain adversarially robust classifiers, to improve its performance: in particular, the regularization term to achieve robustness is weighted to penalize more the training examples which are less robust. In the experimental evaluation on several datasets, the proposed method, ARoW, is shown to achieve better robustness that existing methods, while preserving higher standard accuracy.", "summary_of_the_review": "The proposed method is reasonable and shows promising results. However, clarifications about the discrepancy of the results for some baselines to the original ones are needed, as well as adding the missing baseline.\n\n---\nUpdate after rebuttal\n\nGiven the additional results and clarifications provided during the rebuttal, I increase the initial score to 6.", "strength_and_weaknesses": "Strengths\n- The proposed modification of the TRADES loss, while small, is theoretically justified. The paper clearly presents the new scheme and its differences to existing algorithms.\n\n- The experimental results support ARoW in comparison to existing methods. Most of the relevant baselines are included, and several ablation studies are added to analyze the effect of different components of the training algorithm e.g. label smoothing.\n\n- The paper is well written, and it clearly presents the new method, the baselines and the experimental setup. The experiments include different architectures and datasets, and the case of using extra data for training.\n\nWeaknesses\n- The main concern is about the results reported for the baselines, especially for the case of additional data. For example, in Table 3, for the case of ResNet-18, HAT attains 56.40% and 55.44% of robust accuracy with the 500k extra images from 80M-TI and DDPM synthetic images respectively, while it is reported to get, for the same setups, 57.67% and 57.09% on [RobustBench](https://robustbench.github.io/index.html). Similarly, for WRN-28-10 with extra data, the model from [A] achieves 62.76%\tof robust accuracy, higher than any method in Table 3. Then, it is not clear whether the baselines are optimally tuned.\n\n- In general, the improvements over TRADES and HAT in terms of robustness are quite small, although consistent.\n\n[A] https://arxiv.org/abs/2010.03593", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject