Do Perceptually Aligned Gradients Imply Robustness?
Authors: Roy Ganz
Bahjat Kawar
Michael Elad
Venue: Submitted to ICLR 2023 (2023)
Keywords: Adversarial Robustness
Perceptually Aligned Gradients

Abstract: Deep learning-based networks have achieved unprecedented success in numerous tasks, among which image classification. Despite these remarkable achievements, recent studies have demonstrated that such classification networks are easily fooled by small malicious perturbations, also known as adversarial examples. This security weakness led to extensive research aimed at obtaining robust models. Beyond the clear robustness benefits of such models, it was also observed that their gradients with respect to the input align with human perception. Several works have identified Perceptually Aligned Gradients (PAG) as a byproduct of robust training, but none have considered it as a standalone phenomenon nor studied its own implications. In this work, we focus on this trait and test whether \emph{Perceptually Aligned Gradients imply Robustness}. To this end, we develop a novel objective to directly promote PAG in training classifiers and examine whether models with such gradients are more robust to adversarial attacks. We present both heuristic and principled ways for obtaining target PAGs, which our method aims to learn. Specifically, we harness recent findings in score-based generative modeling as a source for PAG. Extensive experiments on CIFAR-10 and STL validate that models trained with our method have improved robust performance, exposing the surprising bidirectional connection between PAG and robustness.

Under review as a conference paper at ICLR 2023
Do PERCEPTUALLY ALIGNED GRADIENTS IMPLY Ro- BUSTNESS?
Anonymous authors Paper under double-blind review
ABSTRACT
Deep learning- barning-baseed networks have achieved unprecedented success in numer- ous tasks, among which image classification. Despite these remarkable achieve- ments, recent studies have demonstrated that such classification networks are eas- ily fooled by small malicious perturbations, also known as adversarial examples. This security weakness led to extensive research aimed at obtaining robust mod- els. Beyond the clear robustness benefits of such models, it was also observed that their gradients with respect the input align with human perception. Several works have identified Perceptually Aligned Gradients (PAG) as a byproduct of ro- bust training, but none have considered it standalone phenomenon nor studied its own implications. In this work, we focus on this trait and test whether Percep- uullly Aligned Grudients imply Robustness. To this end, develop novel ob- jective to directly promote PAG in training classifiers and examine whether mod- els with such gradients are more robust adversarial attacks. We present both heuristic and principled ways for obtaining target PAGs, which our method aims to learn. Specifically, we harness recent findings in score-based generative mod- eling source for PAG. Extensive experiments on CIFAR- 10 and STL validate that models trained with our method have improved robust performance, exposing the surprising bidirectional connection between PAG and robustness.
INTRODUCTION
AlexNet (Krizhevsky et al. 2012). one of the first Deep Neural Networks (DNNs), has significantly
surpassed all the classic computer vision methods the ImageNet (Deng et al. 2009 classification
challenge (Russakovsky et al. 2015). Since then, the amount of interest and resources invested in the
deep learning (DL) field has skyrocketed. Nowadays, such models attain superhuman performance in classification (He et al. 2016 Dosovitskiy et al. 2021). However, although neural networks allegedly inspired by the human brain, unlike the human visual system, they are known to be highly sensitive to minor corruptions (Hosseini et al. [0117] Dodge & Karam 2017; Geirhos et al.) 2017
Temel et al., 2017: 2018; Temel & AlRegib 2018) and small malicious perturbations, known as
adversarial attacks (Szegedy al.]2014||Athen Athalye al. 2018 Biggio al.) 2013] Carlini & WWggner
2017b Goodfellow et al. 2015 Kurakin et al. 2017 Nguyen et al. (2155). With the introduction of such models to real-world applications that affect human lives, these issues raise significant safety concerns, and therefore, they have drawn substantial research attention.
The bulk of the works in the field of robustness adversarial attacks can be divided into two types
on the one hand, ones that propose robustification methods (Goodfellow et al., 2015) Madry et al.,
2018 Zhang et al. 2019 Wang al. 2020), and on the other hand, ones that construct stronger
and more challenging adversarial attacks (Goodfellow et al., 2015] Madry et al.) 2018 Carlini & Wagner 7a Tramèr et al. 2020 Croce Hein| 2020b). While there are numerous techniques for obtaining ad adversarially robust models (Lécuyer et al. 2019 Li al. 2019 Cohen et al. 2019b
Salman et al. 2019), the most effective one is Adversarial Training (AT) (Madry et al.) 2018). AT
proposes simple yet highly beneficial training scheme train the network to classify adversarial
examples correctly.
While exploring the properties of adversarially trained models, Tsipras et al, (2019) exposed fasci- nating characteristic of these models that does not exist in standard ones Perceptually Aligned Gra- dients (PAG). Generally, they discovered that such models are more aligned with human perception

---

Under review as a conference paper at ICLR 2023
than standard ones, in the sense that the loss gradients w.r.t the imput are meaningful and visually understood by humans. As a result, modifying an image to maximize a conditional probability of some class, estimated by model with PAG, yields class-related semantic visual features, as can be seen in Fig. This important discovery has led to a sequence of works that uncovered conditions in which PAG occurs. Aggarwal al. (2000) revealed that PAG also exists in adversarially trained models with small threat models, while Kaur et al. (2019) observed PAG in robust models trained without adversarial training. While it has been established that robust models lead to perceptually aligned gradients, more research is required to better understand this intriguing property.
In this work, while aiming shed some light on the PAG phenomenon, we pose the following reversed question Do Perceptually Aligned Gradients Imply Robustness? This is an interesting question, as tests the similarity between neural networks and human vision. Humans are capable of identifying the class-related semantic features and thus, can describe the modifications that need to be done to an image to change their predictions. That, in turn, makes the human visual system "robust", it is not affected by changes unrelated to the semantic features. With this insight, we hypothesize that since similar capabilities exist in classifiers with perceptually aligned gradients, they would be inherently more robust.
To methodologically test this question, we need to train networks that obtain perceptually aligned gradients without inheriting robust characteristics from robust models. However, PAG is known to be a byproduct of robust training, and there are currently no ways to promote this property directly and in isolation. Thus, to explore our research question, we develop novel PAG-inducing general objective that penalizes the input-gradient However, this process requires access to "ground-truth" perceptually aligned gradients, which are challenging to obtain. We explore both heuristic and principled sources for such gradients. Our heuristic sources stem from the rationale that such gradients should point towards the target class. In addition, we provide in this work second, principled approach towards creating such PAG vectors, relying on denoising score matching as used in generative models [Song & Ermon (209)). We propose to estimate the gradient of the classification task for each input image the difference between a conditional and unconditional score, both obtained by a pre-trained denoising network. This difference emerges from the Bayes rule, enabling theoretically justified distilled PAGs.
of the classifier without any form of robust training.
To validate our hypothesis, we first verify that our optimization goal indeed yields perceptually aligned gradients well as sufficiently high accuracy on clean images, then evaluate the robustness of the obtained models and compare them to models trained using standard training ("vanilla"). Our experiments strongly suggest that models with PAG are inherently more robust than their vanilla counterparts, revealing that directly promoting such a trait can imply robustness to adversarial at- tacks. Surprisingly, not only does our method yield models with non-trivial robustness, but it also exhibits comparable robustness performance to adversarial training without training on perturbed images. These findings can potentially pave the way for standard training methods (i.e., without performing adversarial training) for obtaining robust classifiers.
BACKGROUND
2.1 ADVERSARIAL EXAMPLES
R.M - CC where M is the data dimension and C' is the number of classes. Adversarial examples are instances designed by an adversary in order to
We consider a deep learning-based classifier fa
cause a false prediction by fo (Athalye et al. 2018 Biggio et al. 2013 Carlini & Wagner 2017b] Goodfellow et al., 2015 Kurakin et al. 2017 Nguyen et al. 2015) 5 Szegedy et 20144) In 2013,
Szegedy et al. (2014) discovered the existence of such samples and showed that it is possible to cause misclassification of an image with an imperceptible perturbation, which is obtained by maximizing the network's 's prediction error. Such samples are crafted by applying modifications from a threat model A to real natural images. Hypothetically, the "ideal" threat model should include all the possible label-preserving perturbations, i.e., all the modifications that can be done to an image that will not change a human observer's 's prediction. Unfortunately, it is impossible to rigorously define such A. and thus, simple relaxations of it are used, the most common of which are the & and the loo e-balls: A (o : |101lee(2.0)) S e).
2

---

Under review as a conference paper at ICLR 2023
More formally, given input sample its ground-truth label y and threat model A, valid adversarial example satisfies the following: X = x + s.t. 8 E A Ypred * y. where Upred is the prediction of the classifier &. The procedure of obtaining such examples is referred to as an adversarial attack. Such attacks can be either untargeted or targeted. Untargeted attacks generate & minimize po po(y|{) namely, cause misclassification without specific target class. In contrast, targeted attacks aim to craft X in a way that maximizes pa X) s.t. ğ o y, that is to say, fool the classifier to predict & as target class y.
While there are various techniques for generating adversarial examples (Goodfellow et al. 2015 Carlini & Wagner 2017al Dong et al.) (2018), we focus in this work on the Projected Gradient Descent (PGD) method (Madry et al. (2018). PGD is an iterative procedure for obtaining adversarial examples that operates as described Alg. 1 The operation Proje stands for projection operator onto A, and L()) is the classification loss, usually defined as the cross-entropy:
(er(z.y) log exp(zyy
Ziml exp(z:)
where 2y and z, are the classifier's logits for classes y and i, respectively.
Algorithm Projected Gradient Descent
Input: classifier fe, input x, ground class y. target class ÿ. threat model parameter e, step size a, number of iterations T
5p < 0
for 1. from 0 7 do
if ÿ is not None then
8 Proje( a VVCC(ff( +)), else
81+1 Proje + +V +6xx+ 6)).
end
end
Xade =x 8r
Output: Xado
2.2 ADVERSARIAL TRAINING
Adversarial training (AT) (Madry al. 2018) is a learning procedure that aims obtain adversar- ially robust classifiers. A classifter is considered adversarially robust if applying small adversarial perturbations its input does not change its label prediction (Goodfellow et al., 2015). Such classi- fiers can be obtained by solving the following optimization problem:
min 8
Σ
max SEA
(2)
(x.8)ED
Intuitively, the above optimization trains the classifier to accurately predict the class labels of its hardest perturbed images allowed by the threat model A. Ideally, L is the 0-1 loss, i.e. L(z, v) I(argmax(zz))
y) where I is the indicator function. Nevertheless, since the 0-1 loss is not differentiable, the cross-entropy loss, defined in Eq. (T). is used as surrogate. In prac- tice, solving this min-max optimization problem is challenging, and there are several ways to obtain an approximate solution. The most simple yet effective method is based on approximating the solu- tion of the manimiaaxiination via adversarial attacks, such as PGD (Madry et al. 2018). According to this strategy, the above optimization is performed iteratively by first fixing the classifier's 's param- eters 0 and optimizing the perturbation 5 for each example via PGD and then fixing á and updating 0. Repeating these steps results in a robust classifier. Since its introduction by Madry et al. (2018).
various improvements to adversarial training were proposed (Andriushchenko & Flammarion 2020
Huang et al.) 2020 Pang et al. 2020 Qin al. 2019 Xie et al.) 2019: Zhang 2019 Wang
ct al. 2020). yet in this work we will focus mainly on the basic AT scheme (Madry et al. (0018) for
its simplicity and generality.
3

---

Under review as a conference paper at ICLR 2023
2.3 PERCEPTUALLY ALIGNED GRADIENTS
Perceptually aligned gradients (PAG) [Engstrom et al. 2019 Etmann et al. 2019 Ross & Doshi- Velez 2018a Tsipras et al., 2019) phenomenon according which, classifier input-gradients are semantically aligned with human perception. This means, inter alia, that modifying an image to maximize a specific class probability should yield visual features that humans associate with the target class. Tsipras et al. (2019) discovered that PAG occurs in adversarially trained classifiers, but not "vanilla" models. The prevailing hypothesis is that the existence of PAG only in adversarially robust classifiers and not in regular ones indicates that features learned by such models are more aligned with human vision. PAG is a qualitative trait, and currently, no quantitative metrics for assessing it exist. Moreover, there is infinite number of equally good gradients aligned with human perception, i.e., there are countless perceptually meaningful directions in which one can modify an image to look more like certain target class. Thus, in this work, similar to (Tripras al.) 2019), we gauge PAG qualitatively by examining the visual modifications done while maximizing the conditional probability of some class, estimated by the tested classifier. In other words, we examine the effects of a large-e targeted adversarial attack and claim that a model has PAG if such process yields class-related semantic modifications, as demonstrated Fig.
PAG?
Dog
Frog
Ship
Vanilla
AT go
8
AT 2
Figure 1: Visual demonstration of large-e adversarial examples on "vanilla" and robust ResNet- trained on CIFAR-10 as method to determine whether model obtains PAG.
In recent years, PAG has drawn lot of research attention which can be divided into two main types an applicative study and a theoretical one. The applicative study aims to harness this phenomenon for various computer vision problems, such as image generation and translation (Santurkar al.,
2019), the improvement of state-of-the-art results in image generation (Ganz & Elad 202 l). and explainability (Elliott et al. 2021).
As for the theoretical study, several works aimed to better understand the conditions under which PAG occurs. Kaur et al. (2019) examined if PAG is an artifact of the adversarial training algorithm or a general property of robust classifiers. Additionally, it has been shown that PAG exists in ad- versarially robust models with a low max- max-perturre nux-perturbation bound (Aggarwal et al. (0200). To conclude, previous works discovered that training robust models leads to perceptually aligned gradients. In this work, we explore the opposite question Do perceptually aligned gradients imply robustness?
3 Do PERCEPTUALLY ALIGNED GRADIENTS IMPLY ROBUSTNESS?
As mentioned in Sec. 2.3 previous work has validated that robust training implies perceptually aligned gradients. More specifically, they observed that performing targeted PGD attacks on robust models yields visual modifications aligned with human perception. In contrast, in this work, we aim to delve into the opposite direction and test training a classifier to have perceptually aligned gradients will improve its adversarial robustness.
To this end, we propose to encourage the input- prautegradiett of classifier so to uphold PAG. Due the nature of our research question, need to isolate PAG from robust training and verify whether the former implies the latter. This raises a challenging question PAG is known to be a byproduct of robust training. How can one develop training procedure that encourages PAG without explicitly performing robust training of some sort? Note that a framework that attains PAG via robust training cannot answer our question, that would involve circular reasoning.
We answer this question by proposing a novel training objective consisting of two elements: the classic cross-entropy loss the model outputs and auxiliary loss on the model's gradiegs
4

---

Under review as a conference paper at ICLR 2023
We note that the input-gradients of the classifier, Vx,f(())y, where fo(x), is the y-th entry of the vector fo(x). can be trained, since they are differentiable w.r.t the classifier parameters 6. Thus, given labeled images (x, y) from a dataset D, assuming we have access ground-truti perceptually aligned gradients g(x, Yt), we could pose the following loss function:
Liotai (x, v) = LC (Jo(x). + + Σ Lons (VxJo(X)ve ((x,9)))
where LCE is the cross-entropy loss defined in Eq. [T. is tunable regularization hyperparameter, C' is the number of classes in the dataset, and Lcos is the cosine similarity loss defined as follows:
Leas (v, u)
(4)
max -1
where E is small positive value so as to avoid division by zero. Note that this loss considers the direction of the model's input-gradients without any requirement on their magnitude. This bodes well with the general goal of these gradients being aligned with human perception.
We emphasize that, contrast to robust training methods such as (Madry et al., 2018: Cohen et al.) 2019a), scheme does not feed the model with any perturbed images and only trains exam- ples originating from the training set. Morcover, while other works (Ross & Doshi-Velez 2018bb Jakubovitz & Giryes 2018) suggest that penalizing the input-grade gradients'' norm yields robustness, do not utilize this fact since we encourage gradient alignment rather than having a small norm. Thus, method is capable of promoting PAG without utilizing robust training.
After training a model to minimize the objective in Eq. 33. we aim to examine if promoting PAG in classifier increases adversarial robustness. First, to verify that the resulting model indeed upholds PAG, we perform targeted PGD on test set images and qualitatively assess the validity of the resulting visual modifications. Afterwards, we test the adversarial robustness of the said model and compare it with vanilla baselines. If it demonstrates favorable robustness accuracy, we will have promoted an affirmative answer to the titular research question of this work.
However, one major obstacle remains in the way of training this objective: so far, we have assumed the existence of "ground-truil truth" model input- gradientdd,,,,, an assumption that does not hold in practice. While we hypothesize that these gradients should point in the general direction of the target class images, there is no clear way of obtaining point-wise realizations of them. In the following sec- tion, we begin by presenting practical and simple methods for obtaining approximations for these gradients, which we then use for training PAG PAG-promoting classificrs. Next, we utilize score-basee generative models for obtaining theoretically justified such gradients as better source of PAG.
4 HOW ARE "GROUND TRUTH" PAGS OBTAINED?
In order to train a classifier for minimizing the objective in Eq. 33 a "ground truth" perceptually aligned gradient g(x, yt) needs to be provided for each training image D and for each target class y E (1.2..... C). Since a true such gradient is challenging to obtain, we instead explore few general pragmatic approaches for obtaining approximations for these PAGs, beginning with heuristic approaches then advancing to theoretically justified ones.
4.1 TARGET CLASS REPRESENTATIVES
As explained above, aim to explore "ground truth" gradients that promote PAG without relying on robust models. To this end, we adopt the following simple premise: the gradient g(x, y1) should point towards the general direction of images of the target class y/: Therefore, given a representative of the target class, ry we set the gradient to point away from the current image and towards the rep- resentative, i.e., g(x, 3t) = Ty. x. This general heuristic, visualized in Fig. can be manifested in various ways, of which we consider the following:
One Image (OI): Each representative should be chosen to reflect the visual features of its respective class. The simplest such choice that comes to mind is to choose ry, as an arbitrary training set image with label yt, and use it as a global destination of yt -trrttete gradients. This one image approach satisfies the abstract requirements and provides simplicity. but it introduces strong bias towards the arbitrarily chosen representative image, without considering the target class as a whole.
5

---

Under review as a conference paper at ICLR 2023
Class Mean (CM): In order reduce the bias towards single image, we set Ty. to be the mean of all the training images with label yt- This mean can be multiplied by a constant in order obtain image-like norm. However, the class mean approach suffers from a clear limitation: class' image distribution can be highly multimodal, possibly reducing its mean non--onnoonn non-informative image.
Class
Class
Representative r. g(xx)
Class 3
Nearest Neighbor (NN): As possibly better
Figure 2: An illustration of the heuristic creation trade-off, we examine a nearest neighbor ap- of perceptually meaningful gradients.
proach for each image x and each target class Y/ E (1,2...,C) C) we set the class representative F. (x) (now dependent on the image) be the image's NN amongst limited set of samples from class yt, using L2 distance in the pixel space. More formally, we define
r(x, x, We) = arg min
|| - |||,,
(5)
xED,, s.t. X
where Dy, is the set of sample images with class yt- In practice, sample Dy, to be small number of i.i.d. training set images with class y/.
4.2 SCORE- BASED GRADIENTS
Denoising diffusion probabilistic models (DDPMs) have recently emerged as an interesting gener- ative technique (Sohl-Dickstein al. 2015 Song & Ermon 2019 Ho et al. 2020). Such models are capable of generating phorealistic images by performing an iterative process that starts from Gaussian noise and follows the direction of the score function, defined Vx. log p(xx). Other works (Ho et al. 2022 Dhariwal Nichol, 2021) have proposed to provide the class information to such networks, enabling them model class-condition score function Vx, log p(x,ly). We pro- vide additional details regarding DDPMs in Appendix [
we further examine these score functions and using the Bayes rule, observe that the class-conditional score function can be factorized into
Xx, log p(e y) = Vx, logr(u/x;) Xx; logp(x:;,
(6)
leading to
logp((/x Xx, logp(x:()) Xx, logp(x:).
This equation brings forth principled way to estimate the correct gradients for the expression log x.), which classification networks aim to output. By training a diffusion model that can optionally accept class label (or act unconditional), we obtain an estimation for "ground-truth" classifier input- grauiigndsnnts by a simple subtraction of conditional and unconditional outputs of the network. As can be seen in Eq. (7). the output is subtraction of the unconditional score function from the class-conditioned one. To avoid the training of two separate diffusion models, we modify the model's i architecture to account for both the conditional and unconditional cases. In particular, for a C-classes dataset, we train single class-conditioned diffusion model with C + classes, where the additional class represents the unconditional case. Instances of this class are drawn with probability 1/C' and they originate uniformly from each of the C' classes. After training such model, we use its outputs to obtain gradients according Eq. (7).
EXPERIMENTAL RESULTS
In this section we empirically assess whether promoting PAG during classifier training improves its adversarial robustness at test time. We experiment using both synthetic and real datasets and present our findings in section 5.1 and sections 5.2 and 5.3 respectively.
5.1 TOY DATASET
To illustrate and better understand the proposed approach and its effects, experiment with synthetic 2-dimensional dataset and compare our nearest neighbor method with the vanilla training scheme that minimizes the cross-entropy loss. We train two-layer fully-connected classifier twice:

---

Under review as a conference paper at ICLR 2023
with nearest neighbor method and without it. We then examine the obtained accuracies and visualize the decision boundaries. While both methods reach a perfect accuracy over the test set, the obtained decision boundaries differ substantially,
be seen in Fig. The bascline train- ing method results in Fig. Das-Balyee yields dimpled manifolds as decision boundaries, as hypothesized by (Shamir et al.) 202T) the decision boundary of DNN is very close the data manifold, exposing the model to malicious perturbations. In contrast, in Fig. [bb the margin between the data samples and the decision boundary obtained using our approach is significantly larger than the baseline. This observation helps explain the following robustness result: our model achieves 75.5% accuracy on simple adversarial PGD attack, whereas the baseline model collapses 0.0%. The notion of "perceptually aligned" gradients admits a very clear meaning in the context of our 2-dimensional experiment faithfulness to the known data manifold. Therefore, our empirical findings strongly attest that PAG imply robustness in the synthetic use case (see Appendix F.T additional details).
(a) Vanilla Training Scheme
(b) Our Training Scheme
Figure 3: Visualization of the decision boundary on synthetic two-class dataset the points are the test samples, and the background color represents the predicted class. Figures Ba and 3b present the decision boundary of vanilla training method and ours, respectively.
5.2 CIFAR EXPERIMENTS
With the encouraging findings presented in Sec. 5.1 we now turn to conducting thorough exper- iments verify if indeed promoting PAG can lead to improved adversarial robustness on real dataset. We choose CIFAR-10 (Krihhessky et al. (014) as our main testing bed as it is the most common and studied dataset in the field of adversarial robustness. For methodologically answering our titular question, we train models to minimize Eq. (3) and follow a two-step evaluation proce- dure. First, we validate that models trained with our approach obtain PAG, and next, we test their adversarial robustness. As for examining if model has PAG, we qualitatively probe whether modi- fying an image to maximize a certain class probability, estimated by model, leads a meaningful semantic change. For evaluating the robustness, adopt AutoAttack (AA) (Croce & Hein 2020a) under Loo (e = 8/255) and the &g (E 0.5) attacks.
In all the conducted experiments, train a classifier using our proposed sources for ground-truth gradients- One Image (OI), Class Mean (CM), and Nearest Neighbor (NN) and the Score-Based Gradients (SBG). In addition,
train the same architectures using standard (Vanilla) and Adversar- ial Training (AT) (Madry et al. (208)) with la (e 0.5) and lac (e = 8/255) threat models. To con- trol for the effect of the architecture used and better establish our empirical findings, experiment with models from different architecture families ResNet- 18 (He et al. (016)) and ViT (Dosovitskiy al. 2021). We provide additional implementation and experimental details Appendix F.2 First, we show in Figure 4 that while vanilla models do not exhibit semantically meaningful changes, our approach does, as intended. Surprisingly. although our method is trained have aligned gradients to some ground truth ones only on the data points, the model generalizes to have meaningful gradients beyond these points.
We proceed by quantitatively evaluating the performance on clean and adversarial versions of the test set, and show our CIFAR-10 results in Tab. [ While the vanilla baseline utterly vulnerable to adversarial examples, all the tested PAG-inducing techniques improve the adversarial robustness substantially while maintaining competitive clean accuracies. This strongly suggests that promoting PAG improve the classifier's robustness in real image datasets. Moreover, not perform adversarial training, it is faster than AT by up to x6.14 (see Appendix G
method does
A closer inspection of the results indicates that method performs better in the L2 case the Lox one. We hypothesize that this stems from the Euclidean nature of the cosine similarity loss used to penalize the model gradients. Moreover, while both the beuristic-based and the theoretical-bant

---

Under review as a conference paper at ICLR 2023
Table 1: Accuracy on the CIFAR-10 dataset using the ResNet- 18 and ViT architectures.
Clean
AutoAttack L2
AutoAttack Loo
Method
RN-18
VIT
RN-18
ViT
RN-18
ViT
Vanilla
93.61%
80.51%
00.00%
00.87%
00.00%
00.01%
OI
79.46%
78.06%
46.63%
15.47%
13.50%
00.21%
CM
81.41%
78.98%
47.25%
13.73%
11.24%
00.17%
NN
80.65%
79.00%
42.12%
13.91%
07.51%
00.15%
SBG
78.56%
81.28%
55.399%
57.80%
23.99%%
22.85%
AT 700 82.49%
62.20%
56.37%
42.80%
37.59%
24.62%
AT & 86.79%
72.81%
60.82%
42.99%
19.63%
08.13%
"ground-truth" gradient sources substantially increase the adversarial robustness, the latter leads to significantly improved performance. It suggests that not only does PAG imply robustness, but there also a positive correlation between the two better sources for PAG lead to more robustness. To better study this effect, we use SBG with different values of À (i.e. PAG regularization) and show that better PAG indeed leads to more robust models, as can seen in Fig. 5 Interestingly, the robustification obtained by Score- Basee Gradients is comparable to AT, without training on adversarial perturbations, potentially setting the foundations for non-adversarial methods for robust training. In addition, SBG outperforms AT l on unseen attacks (foo) on both RN-18 and VIT, without training on adversarial perturbed images.
Other fascinating results the ones obtained on VIT, which is currently the best-performing vi- sion model in computer vision. However, despite their tremendous popularity, ViTs are relatively unstudied in the field of adversarial robustness, which still mainly focuses CNNs. Our findings show that off-the-shelf AT significantly less effective on ViTs and decreases clean accuracy sub- stantially. However, applying preserving the accuracy of natural images. Besides the improved quantitative performance, Figure in Appendix [E.2 shows that AT leads to inferior PAG compared to our method, which further attests to the strong bidirectional connection between PAG and adversarial robustness.
method to VIT improves the robustness compared to AT while
Finally, we report additional results on the CIFAR-100 dataset Tab, 3 for proving the method's scalability and validating the connection between PAG and robustness in a more diverse real-world dataset.
CIFAR-10
PAG?
STL
PAG?
Vanilla
Of
CM
3
NN
SBG
AT 2...
AT 22
Figure 4: Perceptually Aligned Gradients phenomenon demonstrated by models trained with vanilla training (top), our method (middle), and AT (bottom), using ResNet-18 on CIFAR- 10 and STL.
5.3 STL EXPERIMENTS
To better validate that our hypothesis holds in general, we test our approach on additional dataset STL (Coates et al. 201T), which contains images of higher resolution of 96 96 pixels. Besides its resolution, we choose STL mainly due to its relatively small size 5, 000 training and 8, 000 test images. While it known that low data regimes are Adversarial Training's Achilles' heel, as it requires more training data (Schmidt et al., 2018 Zhai et al.) 2019), we aim to investigate how our approach copes with such a challenging setup. We experiment with our different gradient sources using ResNet-18 and compare them to the standard and adversarial training baselines. As for the adversarial threat models, we use = 4/255 for L and = 0.5 for L2- We summarize
qualitative PAG results in Figure and our quantitative ones in Tab. 2 As can be seen in the
8

---

Under review as a conference paper at ICLR 2023
results, while AT struggles to obtain decent results, both heuristic and principled approaches significantly outperform in clean and adversarial accuracy, while SBG is substantially better.
5.4 ENHANCING ADVERSARIAL TRAINING VIA PAG
Our empirical findings show that encourag- ing non-robust models to have PAG robustifies them. Moreover, we aim check whether in- troducing our PAG-inducing objective into ad- versarial training (AT) can enhance its perfor- mance. Specifically, we apply it AT' l2 trained on CIFAR-10 10 using ResNet- and find out that interestingly, it improves its l2 and loc accu- racy from 60.82% and 19.63%, 61.73% and 23.52%, respectively. We provide additional details in Appendix [F.] These results indicate that approach operate both stan- dalone robustification method and as an auxil-
Table 2: Accuracy on STL using ResNet-
Method
Clean
AA L2
AA Loc
Vanilla
82.60%
00.00%
00.00%
OI
71.29%
57.91%
29.65%
CM
70.66%
58.90%
33.71%
NN
70.16%
60.02%
36.21%
SBG
74.79%
65.96%
43.53%
AT To 54.90%
46.33%
28.30%
AT l
54.99%
46.04%
23.33%
lary loss for boosting the performance of existing robust optimization methods.
Target Class
L₂
L 00
calt
deer
dog
frog
horse
ship
truck
plane
car
0
0.1
22.53
0.43
0.5
48.34
11.21
50.87
15.97
2
55.39
23.97
Figure 5: Demonstration of the positive correlation between PAG and robustness. Higher À indicates more perceptually aligned gradients.
CONCLUSIONS AND FUTURE WORK
While previous work demonstrates that ad- versarially robust models uphold the PAG property, in this work, investigate the reverse question Do Perceptually Aligned Gradients Imply Adversarial Robustness?
Table 3: Accuracy on CIFAR-100 using ResNet-
Method
Clean
AA L2
AA Loc
Vanilla
74.36%
00.00%
00.00%
We believe that answering this question sheds additional light on the connection between robust models and PAG. To empirically show that inducing PAG improves classifier robust- ness, we develop novel generic optimiza-
CM
58.89%
19.94%
02.78%
SBG
55.94%
29.25%
788.2%%
AT T--
52.92%
26.31%
14.63%
AT l2
58.05%
30.51%
08.03%
tion loss for promoting PAG without relying on robust models or adversarial training and test several manifestations of it. Our findings suggest that all the manifestations of our PAG-inducing method improve the adversarial robustness com- pared to vanilla model. Specifically, our Score-Based Gradients approach provides robustness on par with AT, which strongly suggests that PAG leads to robustness. Moreover, while AT requires large amount of data, approach outperforms it low-data regimes. In addition, score- based method shows better results than AT VIT. We hope this work will lay the foundations for developing non-adversarial methods for obtaining robust models in the future.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Gunjan Aggarwal, Abhishek Sinha, Nupur Kumari, and Mayank Kumar Singh. On the benefits of models with perceptually- gradients. ArXiv, 2020.
Motasem Alfarra, Juan C Pérez, Adel Bibi, Ali Thabet, Pablo Arbeláez, and Bernard Ghanem. Clustr: Clustering training for robustness. arXiv preprint arXiv:2006. 07682, 2020.
Tomer Amit, Bliya Nachmani, Tal Shaharabany, and Lior Wolf. diffusion probabilistic models. CoRR, 2021.
Segdiff: Image segmentation with
Maksym Andriushchenko and Nicolas Flammarion. Understanding and improving fast adversarial training. In Neural Information Processing Systems, NeurIPS, 2020.
Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In International Conference on Machine Learning, ICMI., 2018
Omri Avrahami, Dani Lischinski, and Ohad Fried. Blended diffusion for text-driven editing of natural images. In Conference on Computer Vision and Puttern Recognition, CVPR, 2022.
Battista Biggio, Igino Corona, Davide Maiorea, Blaine Nelson, Nedim Šmniić, Pavel Laskov, Gior- gio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. Lecture Notes in Computer Science, 2013.
Tsachi Blau, Roy Ganz, Bahjat Kawar, Alex M. Bronstein, and Michael Elad. Threat model-agnostic adversarial defense using diffusion models. CoRR, 2022.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In Symposium on Security and Privacy (SP), 2017a.
Nicholas Carlini and David A. Wagner. Adversarial examples are not easily detected: Bypassing ten detection methods. In ACM Workshop Artificial Intelligence and Security, AlSec CCS, 2017b.
Adam Coates, Andrew Ng. and Honglak Lee. An analysis single-layer networks in unsupervised feature learning. In International Conference Artificial Intelligence and Statistics, AlStar, 2011.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In International Conference on Machine Learning, ICML, 2019a.
Jeremy M. Cohen, Elan Rosenfeld, and J. Zico Kolter. Certified adversarial robustness via random- ized smoothing. In International Conference on Machine Learning, ICML, 2019b.
Francesco Croce and Mathhas Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International Conference on Machine Learning, ICML, 2020a.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustmess with an ensemble of diverse parameter-free attacks. In International Conference on Machine Learning, ICML, 2020b.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. Conference on Computer Vision and Pattern Recognition, CVPR, 2009.
Prafulla Dhariwal and Alexander Quinn Nichol. Diffusion models beat GANs image synthesis. In Neural Information Processing Systems, NeurIPS, 2021.
Samuel Dodge and Lina Karam. A study and comparison of human and deep learning recognition performance under visual distortions, 2017.
Yinpeng Dong, Fangzhou Liao, Tianyu Pang. Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boost- ing adversarial attacks with momentum. Conference on Computer Vision and Pattern Recog- nition, CVPR, 2018.
10

---

Under review as a conference paper at ICLR 2023
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszko- reit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on Learning Representations, ICLR, 2021.
Bradley Efron. Tweedie's formula and selection bias. Journal of the American Statistical Associa- tion, 2011.
Andrew Elliott, Stephen Law, and Chris Russell. Explaining classifiers using adversarial perturba- tions on the perceptual ball. In Conference on Computer Vision and Puttern Recognition, CVPR, 2021.
Logan Engstrom, Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Brandon Tran, and Aleksander Madry. Adversarial robustness as prior for learned representations. arXiv, 2019.
Christian Etmann, Sebastian Lunz, Peter Maass, and Carola Schoenlieb. On the connection between adversarial robustness and saliency map interpretabilityy In International Conference on Machine Learning. ICML, 2019.
Chris Finlay and Adam M Oberman. Scaleable input gradient regularization for adversarial robust- ness. Machine Learning with Applications, 2021.
Roy Ganz and Michael Elad. 2021.
Bigroc: Boosting image generation via a robust classifier. CoRR,
Robert Geirhos, David H. J. Janssen, Heiko H. Schütt,, Jonas Rauber, Matthias Bethge, and Felix A. Wichmann. Comparing deep neural networks against humans: object recognition when the signal gets weaker, 2017.
I. Goodfellow, J. Shlens, and C. Szegedy. Explaining and Harnessing Adversarial Examples. In International Conference on Learning Representations. ICLR, 2015.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Conference on Computer Vision and Pattern Recognition, CVPR, 2016.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In Neural Information Processing Systems, NeurlPS, 2020.
Jonathan Ho, Chitwan Saharia, William Chan, David Fleet, Mohammad Norouzi, and Tim Sali- mans. Cascaded diffusion models for high fidelity image generation. Journal of Machine Learning Research, JMLR, 2022.
Hossein Hosseini, Baicen Xiao, and Radha Poovendran. Google's cloud vision api is not robust to noise, 2017.
Lang Huang, Chao Zhang, and Hongyang Zhang. Self-adaptive training: beyond empirical risk minimization. In Hugo Larochelle, Marc' Aurelio Ranzato, Raia Hadsell, Maria-Florina Balcan, and Hsuan-Tien Lin (eds.), Neural Information Processing Systems, NeurIPS, 2020.
Daniel Jakubovitz and Raja Giryes. Improving dnn robustness to adversarial attacks using jacobian regularization. In European Conference on Computer Vision, ECCV, 2018.
Simran Kaur, Jeremy M. Cohen, and Zachary C. Lipton. Are perceptually-aligen gradients gen- eral property of robust classifiers? CoRR, 2019.
Bahjat Kawar, Gregory Vaksman, and Michael Elad. SNIPS:
Solving noisy inverse problems stochastically. Neural Information Processing Systems, NeurlPS, 2021.
Bahjat Kawar, Michael Elad, Stefano Ermon, and Jiaming Song. Denoising diffusion restoration models. In ICLR Workshop on Deep Generative Models for Highly Structured Data, 2022.
Alex Krizhevsky, Ilya Sutskever, and Geoffrey Hinton. Imagenet classification with deep convo- lutional neural networks. In Neural Information Processing Systems, NeurIPS, 2012.

---

Under review as a conference paper at ICLR 2023
Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton. The cifar-10 dataset. online: http:///ww. toronto. edu/kriz/cifar. html, 2014.
Alexey Kurakin, lan Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In International Conference on Learning Representations. ICLR 2017, Workshop Track Proceed- ings, 2017.
Mathias Lécuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified ro- bustness adversarial examples with differential privacy. In Symposium on Security and Privacy, SP, 2019.
Bai Li, Changyou Chen, Wenlin Wang, and Lawrence Carin, Certified adversarial robustness with additive noise. In Neural Information Processing Systems, NeurlPS, 2019.
Xihui Liu, Dong Huk Park, Samanch Azadi, Gong Zhang, Arman Chopikyan, Yuxiao Hu, Humphrey Shi, Anna Rohrbach, and Trevor Darrell. More control for free! image synthesis with semantic diffusion guidance. CoRR, 2021.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, ICLR. 2018.
K Miyasawa. An empirical Bayes estimator of the mean of a normal population. Bull. Inst. Internat. Statist., 1961.
Anh Mai Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In Conference on Computer Vision and Pattern Recognition, CVPR, 2015.
Alexander Quinn Nichol and Prafulla Dhariwal. Improved denoising diffusson probabilistic models. In Marina Meila and Tong Zhang (eds.), International Conference Machine Learning. ICML, 2021.
Weili Nie, Brandon Guo, Yujia Huang. Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. In International Conference on Machine Learning, ICML, 2022.
Tianyu Pang, Xiao Yang. Yinpeng Dong, Taufik Xu, Jun Zhu, and Hang Su. Boosting adversarial training with hypersphere embedding. In Neural Information Processing Systems, NeurIPS, 2020.
Chongli Qin, James Martens, Sven Gowal, Dilip Krishnan, Krishnamurthy Dvijotham, Alhussein Fawzi, Soham De, Robert Stanforth, and Pushmeet Kohli. Adversarial robustness through local linearization. In Neural Information Processing Systems, NeurlPS, 2019.
Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text- conditional image generation with CLIP latents. CoRR, 2022.
Andrew Ross and Finale Doshi-Veles Improving the adversarial robustness and interpretability of deep neural networks by regularizing their input gradients. In Conference on Artificial Intelli- gence, AAAI, 2018.
Andrew Slavin Ross and Finale Doshi-Veles. Improving the adversarial robustness and interpretabil- ity of deep neural networks by regularizing their input gradients. In Conference on Artificial Intelligence, AAAI, 2018a.
Andrew Slavin Ross and Finale Doshi-Velez. Improving the adversarial robustness and interpretabil- ity of deep neural networks by regularizing their input gradients. In Conference on Artificial Intelligence, AAAI, 2018b.
Daniel L Ruderman. The statistics of natural images. Network: Computation in Neural Systems, 1994.
12

---

Under review as a conference paper at ICLR 2023
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander C. Berg, and Li Fei-Fei. ImageNet Large Scale Visual Recognition Challenge. International Journal of Computer Vision, IJCV, 2015.
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Seyed Kam- yar Seyed Ghasemipour, Burcu Karagol Ayan, S. Sara Mahdavi, Rapha Gontijo Lopes, Tim Sali- mans, Jonathan Ho, David J. Fleet, and Mohammad Norouzi. Photorealistic text-to-image diffu- sion models with deep language understanding. CoRR, 2022.
Hadi Salman, Jerry Li, Ilya P. Razenshteyn, Pengchuan Zhang, Huan Zhang, Sébastien Bubeck, and Greg Yang. Provably robust deep learning via adversarially trained smoothed classifiers. In Neural Information Processing Systems, NeurlPS, 2019.
Shibani Santurkar, Dimitris Tsipras, Brandon Tran, Andrew Ilyas, Logan Engstrom, and Aleksander Madry. Image Synthesis with a Single (Robust) Classifier. 2019.
Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. Ad- versarially robust generalization requires more data. In Neural Information Processing Systems, NeurlPS. Curran Associates, Inc., 2018.
Adi Shamir, Odelia Melamed, and Oriel BenShmuel. The dimpled manifold model of adversarial examples in machine learning. CoRR, 2021.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv: 1556, 2014.
Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan. and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. In International Conference on Machine Learn- ing. ICML, 2015.
Yang Song and Stefano Ermon. Generative modeling by estimating gradients of the data distribution. In Neural Information Processing Systems, NeurlPS, 2019.
Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In Interna- tional Conference on Learning Representations, ICLR, 2021.
Charles M Stein. Estimation of the mean of multivariate normal distribution. The annals of Statistics, 1981.
C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus. Intriguing properties of neural networks. International Conference on Learning Representations, ICLR, 2014.
Dogancan Temel and Ghassan AlRegib. Traffic signs in the wild: Highlights from the IEEE video and image processing cup 2017 student competition [SP competitions). Signal Processing Mag- azine, 2018.
Dogancan Temel, Gukyeong Kwon, Mohit Prabhushankar, and Ghassan AlRegib. Cure-tsr: Chal- lenging unreal and real environments for traffic sign recognition. 2017.
Dogancan Temel, Jinsol Lee, and Ghassan Alregib. CURE-OR: challenging unreal and real environ- ments for object recognition. In International Conference on Machine Learning and Applications, ICMLA, 2018
Lucas Theis, Tim Salimans, Matthew D. Hoffman, and Fabian Mentzer. Lossy compression with gaussian diffusion. CoRR, 2022.
Ilya O Tolstikhin, Neil Houlsby, Alexander Kolesnikov, Lucas Beyer, Xiaohua Zhai Thomas Un- terthiner, Jessica Yung, Andreas Steiner, Daniel Keysers, Jakob Uszkoreit, et al. Mip-mixer: An all-mlp architecture for vision. Advances in Neural Information Processing Systems, 34:24261- 24272, 2021.
13

---

Under review as a conference paper at ICLR 2023
Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. In Neural Information Processing Systems, NeurlPS, 2020.
D. Tsipras, S. Santurkar, L. Engstrom, A. Turner, and A. Madry. Robustness May Be at Odds with Accuracy. In International Conference on Learning Representations, ICLR, 2019.
Arash Vahdat, Karsten Kreis, and Jan Kautz. Score-based generative modeling in latent space. In Neural Information Processing Systems, NeurlPS, 2021.
Yisen Wang, Difan Zou, Jinfeng Yi. James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. International Conference on Learning Representations, ICLR, 2020.
Cihang Xie, Yuxin Wu, Laurens der Maaten, Alan L.. Yuille, and Kaiming He. Feature denoising for improving adversarial robustness. In Conference on Computer Vision and Pattern Recognition, CVPR, 2019.
Runtian Zhai, Tianle Cai, He, Chen Dan, Kun He, John Hopcroft, and Liwei Wang. Adversar- ially robust generalization just requires more unlabeled data. CoRR, 2019.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference Machine Learning, ICML, 2019.
14

---

Under review as a conference paper at ICLR 2023
A RELATED WORK
Recent works have explored properties of input gradients that improve adversarial robustness. The authors Jakubovvtzz & Giryes (2018) demonstrate that regularizing the Frobenius norm of a classi- fier's Jacobian to be small improves robustness. Such method is equívalent to regularizing the norm of each such gradient to be small, similar to Ross & Doshi- Velez (2018); Finlay & Oberman (202T) This line of work attests that requiring small gradient norms, regardless of their direction, leads to robustness. Moreover, none of these works promotes nor exhibits perceptually aligned gradients. On the direction of the gradients, regardless of their size opposing the
Contrary, we penalize above methods. By showing that our approach leads to PAG and improved robustness, our method can be viewed an alternative input-gradient loss for improving robustness. Nevertheless, the main goal of our work is to better study PAG and its connection with adversarial robustness.
Another interesting work is ClusTR (Alfarra et al. 2020), which reveals intrinsic connection be- tween clustering and robustness. Moreover, the authors claim that clustering similar instances in the feature space encourages the network to learn semantically meaningful representations. Although related to our work, there are some main differences. First, as clustering is related to robustness, this approach cannot test our titular question. Moreover, ClusTR was not proven to have PAG or more semantical meaningful features, contrary to our work.
B DENOISING DIFFUSION PROBABILISTIC MODELS
Denoising diffusion probabilistic models (DDPMs) are a new fascinating generative approach (Sohl- Dickstein al. 2015 Song & Ermon 2019 Ho et al 2020). Such methods achieve state-of- off-the-art art results in image generation (Dhariwal & Nichol 2021 Song et al.] 2021: Vahdat et al. [2021). and were additionally deployed in several downstream tasks such as inverse problems (Kawar et al.
2021 2022), image compression (Theis et al. 2022), image segmentation (Amit et al. 2021) image editing (Liu al. 2021 Avrahami al.) 2022), text-to-image generation (Ramesh al. 2022
Saharia et al. 20222. among others.
The core idea of these models, which also known score-based generative models, is start from a random Gaussian noise image X7, and then iteratively denoise it into a photorealistic image Xg in a controlled manner, This process can also be interpreted as an annealed version of Langevin dynamics (Song& & Ermon 2019). where each iteration E (T, 1, 0} follows the direction of the score function, defined as Vx, log p(x,), with an additional noise for stochasticity. Each intermediate image can be considered a noisy version of a pristine image Xg, with a pre-defined noise level o, The score function can be estimated using a neural network trained for mean- -quan-- error denoising (Stein) 1981 Miyasawa 1961 Efron 2011). This estimation can also be generalized for denoising models conditioned on a class label y, obtaining Vx, (xgl(x)ly) (Ho et al. 2022).
While diffusion models have been recently used in the context of adversarial robustness (Nie et al.) 2022 Blau et al., 2022). these works were mostly focused on denoising an adversarially perturbed input to vanilla classifier. In contrast,
propose novel usage of diffusion model outputs guid- ance for training classifier gradients. Our method, in turn, enjoys the added benefit of significantly faster runtime, no iterative process is applied.
C ADDITIONAL ARCHITECTURES ABLATION
In this section, we provide the results of applying our method to additional architecture types. While we focus in Sec.55oo skip-connectionnbaseee
convolutional NN (ResNet-18) and an attention- based one (VIT), we turn to examine it on other types of architectures. Specifically, we apply it VGG (Simonyan & Zisserman 2014), a convolutional network without residual connection, and MLP Mixer (Tolstikhin et al. 2021) a top-performing dense architecture. We experiment with such architectures using the SBG approach on CIFAR- 10 and report the results in Tab. [4
For the MLP Mixer, we follow the CIFAR-10 adjusted implementation and train it for 100 epochs using batch size 128. We apply SBG and set 0.5. As for the VGG, we follow the
https://gi com/ omi hub777 MMM.-MM xeexxer-ee CIFAR
15

---

Under review as a conference paper at ICLR 2023
implementation for CIFAR-10 and train for 100 epochs using batch size of 64. Similarly to MLP Mixer, we use À = 0.5. Moreover, we do so for both VGG-11, VGG-13 and VGG-16 to further study the depth effect. These ablation studies show that the connection between PAG and robustness is general and architecture-indeeendea
Table 4: Accuracy on CIFAR-10 using VGG and MLP Mixer
Method
Arch.
Clean
AutoAttack L2
Vanilla
92.32%
00.20%
VGG-16
SBG
81.93%
42.03%
Vanīlla
92.47%
00.17%
VGG-13
SBG
82.05%
41.49%
Vanílla
90.82%
02.50%
VGG-11
SBG
79.22%
35.79%
Vanilla
72.05%
00.50%
MLP-Mixer
SBG
63.04%
35.97%
D TINY IMAGENET EXPERIMENTS
To further verify if indeed PAG implies robustness, apply our method to Tiny ImageNet, in addition to CIFAR-10, CIFAR- 100, and STL. This dataset contains 100,000 images of size 64 x 63 3 and 200 classes and is very diverse. In this section, report the results of encouraging PAG using Class Mean on a ResNet-18 (we set X = 2) and train for 50 epochs, and report the results in Tab. These empirical findings testify the connection between PAG and robustness in a more general content dataset and demonstrate our method's scalability.
Table Accuracy on Tiny ImageNet using ResNet-18
Method
Arch.
Clean
AutoAttack L2
Vanilla
61.19% 50.04%
02.37%
ResNet-18
SBG
19.21%
E VISUALIZATION
E. PAG GROUND-TRUTH VISUALIZATION
We provide visualization of our "ground-trute sources for Perceptually Aligned Gradients in Figure 6 In the top three rows, we show the results of the heuristic-basee methods. As these gradients derive from the subtraction of two images, a ghosting effect can be seen. However, in Score-Based Gradients, the modifications focus on the object, and features of the target class can be observed (i.e., horse features). The nature SBG resembles the one in Adversarial Training, as can be seen in the bottom row - focus on the object itself.
E.2 VIT ON CIFAR-10
We show a qualitative demonstration the Perceptually Aligned Gradients results on CIFAR- 10 using VIT in Figure 7 As can be seen, similar to ResNet's results, the vanilla model does not show PAG at all. The heuristic sources lead to some improvement, while our score-Based Gradients ap- proach leads better PAG than AT. That demonstrates the connection between PAG and robustness, as SBG shows better PAG and improved adversarial robustness.
16

---

Under review as a conference paper at ICLR 2023
Original
Airplane
Car
Bird
Cat
Deer
Dog
Frog
Horse
Ship
Truck
OI
CM
NN
SB
AT
Figure Visualization of PAG "ground-truth" gradients of different sources.
ViT
PAG?
Bird
Cat
Deer
Dog
Frog Horse
Ship
Truck
Plane
Car
X
Vanilla
Ol
CM
NN
SBG
AT L
AT L2
Figure 7: Visualization of PAG on CIFAR-10 dataset using VIT.
IMPLEMENTATION DETAILS
F.I TOY DATASET
Data: We experiment with our approach on 2-dimensional synthetic dataset to demonstrate its effects. To this end, we construct dataset consisting of 6,000 samples from two classes, where each class contains exactly 3,000 examples. Our samples, x = [x1, x2). reside on the straight line in the 2-dimensional space IR,, where each class y E {0, 1} follows Gaussian mixture distribution. Each class contains three modes, and each them contains 1000 samples drawn from Gaussian distribution (a) (cc, 1), 22 2 Z1, where is the mode center). The modes centers are set to be {-50, -00, 303 and {-30, 10, 50). This way, the cardinal manifold assumption according to which high-dimensional images reside lower-dimensional manifold
42 2r,
17

---

Under review as a conference paper at ICLR 2023
Ruderman (1994) holds. We generate balanced test set from the same distribution consisting of 600 samples and use it to evaluate performance.
Architecture and Training: We use 2-layer fully-connected network (2 - 32 + 2) with ReLU non-lincarity. We train it twice using the standard cross cross-cntrope entropy training and our proposed method with NN realization. We do for 100 epochs with batch size of 1 128, using Adam optimizer, learning rate of 0.01, and the same seed for both training processes.
Computational Resources: We use single Tesla V100 GPU.
Evaluation: As detailed in the paper, we test the performance of the models using standard and adversarial evaluation. For the standard one, draw 600 test samples from the same distribution as the train set and measure the accuracy. As for the adversarial one, we use an L---based 10-step PGD with e 15 and step size of 2. Note that this choice of guarantees in our settings that the allowed threat model is too small for actually changing a sample of a certain class to the other one, making it valid threat model.
F.2 REAL DATASETS
Data: As for our real datasets experiments, we use CIFAR- 10 and STL that contain images of size 32 x 32 and 96 96 3, respectively. For each realization, before the training procedure, we construct a dataset by computing C' targeted gradients for each training sample (C 10 for CIFAR-10 and STL) for reproducibility and consistency purposes.
To obtain our score-Based Gradients (SBG) we follow the implementation of (Nichol & Dhariwal 2021 for training a class-conditioned diffusion model for CIFAR-10 10 and STL datasets. We use their C CIFR-- architecture for CIFAR-10 10, and their ImageNet architecture for STL, adapting the image size by a simple bicubic interpolation. In particular, for a C'classes dataset, we train a single class-conditioned diffusion model with C' + 1 classes, where the additional class represents the absence of class information and thus models the unconditional score function. Instances of this class drawn with probability 1 I/C and they originate uniformly from each of the C classes. After training such model, we use it to distill gradients according to Eq. (
Training: For both datasets, we train ResNet-18 for 100 epochs, using SGD with learning rate of 0.01, a momentum of 0.9, and weight decay of 0.0001. In addition, we use the standard aug- mentations for these datasets random cropping with padding of and random horizontal flipping with probability of 0.5. We use a batch size of 64 for CIFAR-10 10 and 32 for STL. As for the ViT, we use a an implementation adjusted to CIFAR-IQ*) containing 6.3 million parameters. We present in Tab. the best choices of À - the coefficient of our PAG promoting auxiliary loss term in all the tested datasets and methods. The values of suggest that higher values should be applied for better gradient sources (e.g., SBG's ideal À is higher than the heuristic methods).
As for our baselines, we use the same training hyperparameters mentioned above. Regarding the AT, we use 7 steps PGD using step size of 1.5 f. and follow the base implementation presented in Zhang al. 2019 and extend it to 82.
Table 6: Values of the hyperparameter X.
CIFAR-10
STL
Method
RN-18
VIT
RN-18
One Image
0.5
0.1
0.25
Class Mean
0.4
0.1
0.2
Nearest Neighbor
0.4
0.1
0.4
SBG
2
2
1
Computational Resources: We use two NVIDIA RTX A4000 16GB GPUs for each experiment.
httea///gtthbb..com////ooogggg/n
18

---

Under review as a conference paper at ICLR 2023
Evaluation:
We the de-facto standard evaluation library of AutoAttack (Croce & Hein 2020a
We attach our anonymized code to the submission, and will publicly release it along with our trained models upon acceptance.
Code:
F.3 ENHANCING ADVERSARIAL. TRAINING VIA PAG
To test whether our approach is capable of further enhancing adversarial training, we apply it as an auxiliary loss. We use ResNet-18. train on CIFAR-10 using AT with 7-steps PGD and introduce our loss with À = 0.2. We conclude the results in Tab.
Table 7: Enhancing Adversarial Training via PAG
Method
Clean
AutoAttack L2
AutoAttack Loo
AT AT + PAG
86.79 85.54
60.82 61.73
19.63
23.52
G RUNTIME COMPARISON WITH ADVERSARIAL TRAINING
As our method does not compute adversarial example (an iterative process), it is faster than adver- sarial training. To quantify this, conduct runtime comparison using ResNet-18 18 and CIFAR-10 10 dataset and reveal that our method is faster than AT-PGD-7 and AT-PGD-20 by x2.13 and x6. 14, respectively.
httpe:///iitubb.cco/m//////c attack
19


Reviews:
[{"review_id": "wOT1mMnjnl", "reviewer": "Reviewer_gXjD", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "In this paper, the authors throw out a question about the usefulness of Perceptually Aligned Gradients (PAG) and give a positive answer by numerical evaluation.", "summary_of_the_review": "The problem this paper cares about is not very interesting. Even for this question, the answer could come from not only numerical experiments. Besides, the experiments are not sufficient. Overall, I tend to give negative score on this paper. ", "strength_and_weaknesses": "strength:\n+ it is interesting to see several attempt to design several approaches for the ground truth gradients for alignment. \n\nweakness:\n- PAG provides additional supervised information and I do not think people have too much doubt about this. Meanwhile this could be explained directly rather than numerical experiments. \n- In numerical experiments, the proposed methods do not show clear advantages over AT, expect for ViT model.  One question is about the performance of ViT, which seems quite weak, but in general ViT is believed to be more robust than CNN. \n- The lack of ImageNet makes the conclusion less convincing. Besides, additional structures should be considered. In my opinions, to support the conclusion, typical NN structures (skip or not, dense or not, wide, different depth) and AT schemes should be included. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "ftaczBdQYIg", "reviewer": "Reviewer_FuwE", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper aims to create image classification models which produce gradients which are “perceptually aligned” (in the sense of Tsipras et al.). The authors then essentially try to understand whether this alignment can imply robustness (i.e. the opposite of the claim first made in Tsipras et al.). The main difficulty is to produce a model with PAG (perceptually aligned gradients) without inheriting robust characteristics as a byproduct from the adversarial training (AT) process.\n\nThe authors propose a technique to induce PAG by adding a regularization term to the usual cross entropy loss of an image classification model. This term essentially forces the gradient of the model to point in the direction of the “ground truth” PAG via cosine similarity. \n\nThere are two ways in which these ground truth PAGs are obtained:\n1. Heuristic: The model is forced to point its gradients towards a general representative (r_t) of the target class (gradient = r_t - x). The representative can be chosen three ways: pick an arbitrary image from the class (OI), choose class mean (CM) or take the nearest neighbor image to x (NN).\n2. Score based: A pretrained diffusion model is used to obtain an estimation for “ground-truth” classifier input-gradients by a simple subtraction of conditional and unconditional outputs of the network .\n\nPAG is evaluated qualitatively via images of one class morphing to another class (See Fig 4). Experiments are performed on a toy 2d dataset, CIFAR-10 and STL with a ResNet model and a ViT. Results show strong robustness results (at least against L2 attacks) for all models/datasets.", "summary_of_the_review": "Overall, I think the paper makes a solid attempt at understanding a curious property of image classification models. I think the approach introduced by the authors is very interesting. However, there is a lack of analysis discussing the limitations of the technique being proposed which keeps me from recommending publication.", "strength_and_weaknesses": "Strengths:\n1. Creating models with PAG which are not a byproduct of robustifying a model has to my knowledge not been done and is a significant contribution of the paper.\n2. The main idea of the paper is extremely simple and the presentation is straightforward. The paper on the whole is well written and clear.\n3. Experiments in the paper support the authors claim that PAG can imply robustness (see concerns below).\n4. Results in the L2 attack case are very strong. The authors observe robustness better than AT in some cases without the additional overhead of robust training.\n\nWeaknesses:\n1. My main concern about the results in the paper center around the lack of quantification of PAGs. There is a huge difference in robustness against L2 and L-infinity attacks (shown in Table 1). It seems there is little robustness induced (especially in the heuristic L-infinity VIT case) in some settings even when there are PAGs (as shown in Fig 4). Therefore, it seems that even though PAG is present at least superficially, no corresponding robustness is observed. This goes against what the paper is trying to prove (that PAGs imply robustness). I’m not sure if this only shows up in one case (heuristic L-infinity VIT case) but there is some explanation needed.\n2. Related to the above point, since there is no quantitative measure of PAG, it is hard to understand whether there is a dose-response relationship between PAG and robustness. If there were a dose-response relationship, it could potentially explain my concern above (Pt 1) by saying that - the PAG for the heuristic L-infinity VIT case is weak so robustness is not very high. The authors already use cosine similarity in the loss which could potentially serve as a quantitative metric for the PAGs.\n3. I feel the paper is lacking analysis to definitively “prove” that PAGs imply robustness. For example, we have seen improving PAG improves robustness, but what happens if we purposely try to decrease PAG? (flip the sign on the regularization term). What happens if train a model using AT and add a regularization term to decrease PAG? (i.e. essentially increase robustness and decrease PAG simultaneously). Without additional analysis, I think the paper falls short in showing where and how the effect being claimed exists.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "cIta7MMf4w", "reviewer": "Reviewer_snWm", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "While previous work has established that adversarial robust models lead to perceptually-aligned gradients, this paper tries the answer if the reverse condition also holds that if a model has perceptually-aligned gradients, is it robust to adversarial examples? The answer given by this paper is yes. The crux of the approach is a new training scheme which explicitly optimizes for the alignment between current input gradients and perceptually-aligned gradients. The authors proposed several approaximations to achieve this gradient alignment. The proposed method is evaluated on CIFAR-10 and STL.", "summary_of_the_review": "The paper is clearly written. I like the question this paper is trying to answer. The proposed approach can be a principled way to directly induce perceptually-aligned gradients. For now i am leaning towards accept. ", "strength_and_weaknesses": "Strengths:\n1. This paper asks an interesting question: is perceptually-aligned gradients also a sufficient condition for adversarial robustness. While previous work has shown that it is necessary, none has looked into if the reverse also holds true. Trying to answer this question would help the community understand the importance of former (perceptually-aligned gradients) to the latter (adversarial robustness).\n2. The method proposed in section 3 is novel and can be a principled approach for future work as to how to induce percetually-aligned gradients during training.\n3. The experiments are solid and the conclusion drawn from the experiments that perceptually-aligned gradients do imply adversarial robustness is interesting. It could benefit future work in this direction to rethink the importance of perceptually-aligned gradients.\n\n\nWeaknesses:\n1. It would be nice to report the training time of the proposed approach compared to adversarial training. It seems that it would require less backward pass compared to full PGD with many steps as used in AT. Thus it would be nice to have a formal comparison of the statistics of time spent.\n2. I don’t quite follow the part about score-based gradients. So are you using the gradients computed from equation 7 as the new target g? It seems that you need two diffusion models, one being class-conditional and one being unconditional to estimate the two parts in the right hand side of equation 7.   \nI feel the first two paragraphs of section 4.2 can be moved into background or related work. It seems hard to follow which is exactly your contribution. I would elaborate more on how you obtain the gradients in equation 7. \n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "YMHEWcZOTV", "reviewer": "Reviewer_gfgX", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper studies the effect of encouraging the semantic space of a deep model to be perceptually aligned on the adversarial robustness of the model.\nThis paper is based on earlier observations that robustly trained models have interpretable feature space.\nThis work encourages the gradients the model to be perceptually aligned through four different approaches.\nExperimental results show that the obtained model, without training on adversarial examples, exhibits non-trivial robustness characteristics that could match the adversarially trained one.", "summary_of_the_review": "This work has several merits that I appreciate. However, the main concerns regarding this work are:\n(1) A systematic approach in quantifying the ''perceptuality'' of gradients of a given model.\n(2) Large scale experiments to demonstrate the effectiveness of the proposed approach.\n(3) Discussion on how related this work is with earlier works in the literature analyzing the complementary path (from semantics to robustness).\n", "strength_and_weaknesses": "Strengths:\n\n- The problem that this paper is analyzing is both important and interesting.\n\n- The study of the complementary path, from perceptually aligned gradients to adversarial robustness, is somewhat novel.\n\n- Approaches considered in this paper for encouraging the gradients to be perceptually aligned are intuitive.\n\n- Experimental results supports the claim of this work.\n\n- The paper is well-written and easy to follow.\n\nWeaknesses:\n\nDespite that there are several aspects of this work that I like and appreciate, there are several concerns that need to be addressed.\n\n1 - The main weakness of this work is the manual inspection of perceptually aligned gradients. Is there a way, based on the experimental results of this work, to quantify how aligned are the gradients of a given model? Conducting manual inspection might be misleading as it highly depends on the initialization.\n\n2- Since all proposed approaches in this work do not include adversarial examples in their training routine, it is necessary to have a runtime comparisons between each proposed method and conducting adversarial training (it would also be fair to include other variants of adversarial training such as Free AT [A] and Fast AT [B]).\n\n3- The experimental results is missing a large-scale real-world dataset such as ImageNet. \n\n4- Analyzing the effect of encouraging the feature space to be semantically interpretable on adversarial robustness has been explored before in [C] through deploying metric learning. It would be nice to include describe the main differences between both this work and previous approaches.\n\n5- While the proposed SBG matches the adversarial robustness of adversarially trained models, how would the performance be of we combine both approaches. For example, how would AT+SBG perform? The authors might want to explore more powerful variants of adversarial training such as AWP [D].\n\nI generally admire the efforts in this work. I am also happy to increase my score based on the discussion with authors.\n\n[A]: Adversarial Training for Free!, NeurIPS 2019\n\n[B]: Fast is Better than Free: Revisiting Adversarial Training, ICLR 2020\n\n[C]: Rethinking Clustering for Robustness, BMVC 2021\n\n[D]: Adversarial Weight Perturbation Helps Robust Generalization, NeurIPS 2020", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "20C85LgAbwr", "reviewer": "Reviewer_XeGZ", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The authors pose and attempt to answer a new question if the perceptual gradients of the model imply the robustness of the model to adversarial attacks. To answer that, they proposed a new method that trains the model to have input gradients that align with ground-truth input gradients. They introduced several methods to obtain ground truth gradients. In the experiments, they showed that using perceptual input gradients as a constraint alone is sufficient to achieve robustness comparable to adversarial training.", "summary_of_the_review": "The authors attempt to answer the question if perceptual gradients imply adversarial robustness. They proposed a novel training method that directly optimized the perceptual gradients. Using the proposed method, they showed that perceptual gradients indeed imply robustness.  The idea is novel and interesting. However, some of the claims might not be well supported and the authors should expand both theoretical and empirical analysis of the proposed approach.", "strength_and_weaknesses": "### Strengths\n\n- Poses and attempts to answer the question: do perceptual gradients imply adversarial robustness?\n- Novel model training called Perceptually Aligned Gradients that attains adversarial robustness without running an expensive adversarial attack, such as PGD-10, in the inner loop of the model training.\n\n### Weaknesses\n\n- The objective for optimizing alignment requires computing cosine similarity between all classes, which scales poorly for problems with many classes. The authors didn’t present results for problems with more than 10 classes.\n- The lack of a theoretical analysis of the proposed method. It is not clear why the proposed objective will guide the training toward a more robust model.\n- The comparison was made only with vanilla Madry adversarial training. The authors should include a comparison with more recent adversarial training methods, e.g. TRADES, FAT, Early Stopping PGD, etc.\n\n### Questions\n\n- How does the proposed method compare to Lipschitz regularization methods which require a small input gradient? Which approach is more suitable for robust training?\n- Could the authors include experimental comparison with denoising methods using diffusion models? Why the presented approach is more suitable for robust training?", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject