Interpolating Compressed Parameter Subspaces
Authors: Siddhartha Datta
Nigel Shadbolt
Venue: Submitted to ICLR 2023 (2023)

Abstract: Though distribution shifts have caused growing concern for machine learning scalability, solutions tend to specialize towards a specific type of distribution shift. Methods for label shift may not succeed against domain or task shift, and vice versa. We learn that constructing a Compressed Parameter Subspaces (CPS), a geometric structure representing distance-regularized parameters mapped to a set of train-time distributions, can maximize average accuracy over a broad range of distribution shifts concurrently. We show sampling parameters within a CPS can mitigate backdoor, adversarial, permutation, stylization and rotation perturbations. We also show training a hypernetwork representing a CPS can adapt to seen tasks as well as unseen interpolated tasks.

Under review as a conference paper at ICLR 2023
INTERPOLATING COMPRESSED PARAMETER SUBSPACES
Anonymous authors Paper under double-bling review
ABSTRACT
Though distribution shifts have caused growing concern for machine learning scalability, solutions tend to specialize towards specific type of distribution shift. Methods for label shift may not succeed against domain or task shift, and vice versa. We Iearn that constructing Compressed Parameter Subspaces (CPS), geometric structure representing distunce-regullarized parameters mapped to a set of train-time distributions, can maximize average accuracy over broad range of distribution shifts concurrently. We show sampling parameters within a CPS can mitigate backdoor, adversarial, permutation, stylization and rotation perturbations. We also show training a hypernetwork representing CPS can adapt to seen tasks well as unseen interpolated tasks.
INTRODUCTION
Suppose your model expecting distribution shift at test-time. Is it task shift? Domain shift? Rotations? What if it's an adversarial attack, or even a backdoor attack? Each strand of distribution shift research has provided robust and adaptive techniques against their respective types of shift, and achieved state-of of-thh-art results. In this work, we take a step towards method that can adapt to multiple types of distribution shift concurrently.
75
70
Clean Accuracy
55
50
Recent work on the geometry of the loss landscape, such as neural subspaces (Wortsman al. 2021
and mode connectivity (Fort Jastrzebski 2019
20
30
40
50
60
70
80
Draxler et al. 2019: Garipov et al.] (2018) discovered properties of robustness between multiple parame- ters. Departing from constructing subspaces w.r.t. single/unperturbed input distribution, we investigate the construction of subspces w.r.t. multiple perturbed distributions, and find improved mappability between shifted distributions and low-loss parameters con- tained in these subspaces.
Shifted Accuracy (Avg)
Figure 1: Shift-optimality We plot the trade- off frontier between methods performing across range of distribution shift types. For single test-time distributions (Table 1), Clean Accuracy is the accuracy w.r.f. Clean Test Set; Shifted Accuracy the average accuracy across different shifts (Backdoor/Adverraardd Attack, Random Permutations, Stylization, Rotation). For multiple test-time distributions (Table 2), Clean Accuracy is the average ac- curacy of the hypernetwork evaluated after each task; Shifted Accuracy is the average accuracy of the hypernetwork evaluated after the last task.
Contributions. We share a method to construct a compressed parameter subspace such that the likeli- hood of a parameter sampled from this subspace can be mapped to shifted input distribution is higher. We demonstrate a high average accuracy across distri- bution shifts in single and multiple test-time settings (Figure T]. We show improved robustness across per- turbation types. reduced catastrophic forgetting Aplit-CIFARION 0/100, and strong capacity for multi- task solutions and unseen/distant tasks.

---

Under review as a conference paper at ICLR 2023
1.0
1.0
- 1.0
8 - 1.0
8 1.0
& 0.5
8 0.5
1 0.5
0.8.0
0.0.0
0..00
0.5 %
1.0
0.5
1.0
%
of
0.0
0.2
04
96
0.8
1.
Figure 2: Change in parameter subspace dynamics: Landscape of unique lowest-loss parameters mapped interpolated inputs. Refer to Appendix A.3.3 for supplementary visualization.
PROBLEM: ADAPTATION TO DISTRIBUTION SHIFT
We first motivate problem of adapting to distribution shifts from literature. Then we formulate the different types of distribution shift into a generalized notation and problem setup.
2.1 RELATED WORK
Different aspects of distribution shift have been studied individually and methods of robust- ness/adaptation have been proposed. More recently, there work studying what happens when deep learning architectures encounter test-time inputs manifesting multiple types of distribution shifts.
Qi et al. (2021) and Datta (2022) combine adversarial attacks with stylization and domain shift Liu et al. 20211) combined ad adversarial perturbations with backdoor trigger perturbations to craft stealthy triggers to perform backdoor attacks. However, methods of robustness/adappation for single test-time distribution (e.g. adversarial/backdoor attacks) do not strongly overlap with that for multiple test-time distributions (e.g. domain adaptation, meta/continual learning). Hence, these methods generally require the distribution shift to be specified at train-time. For example, Weng et al. (2020) found trade-off between adversarial defenses optimized towards adversarial perturbations against backdoor defenses optimized towards backdoor perturbations, where the adoption of one defense worsened robustness to the other's s attack. Though data augmentation (Yun et al. 2019b; Borgnia al. 2020) and adversarial training (Goodfellow al. 2015 Geiping et [l.]]2021 mitigate adversarial attacks and backdoor attacks, they need to be trained on one of the perturbation types manifest robustness. To retain adversarial robustness in few-shot learning, Goldblum et al. (2020) and Wang et al. (202T) investigated methods of integrating adversarial training into MAML. As such, we are motivated to contribute method of adaptation/robussness that can multiple types of distribution shifts concurrently.
technique can
2.2 PRELIMINARIES
Let X, J. K. be denoted as the input space, coarse label space, and fine label space respectively. Coarse labels the oigeer-order labels of fine labels. A base learner function with parameters accepts inputs x to return predicted labels ý = f((;; x). 0 is computed such that it minimizes the loss between the ground-trut -trnth and predicted labels: [(0: y)
+ Σ!" (f y)
Definition 1. A distribution shift is the divergence between train-time distribution Xo, Yo and test-time distribution ý, where x, y is an interpolated distribution between Xo. and a target distribution x .fA such that x = EN axx² and ý = where i = arg max; Qi
Definition 1.1 A disjoint distribution shift is distribution shift of one target distribution [a,)]= 2 such that & a + (1 a)xo-
Definition 1.2 A joint distribution shift is distribution shift of multiple target distributions [a.)]>> such that & Σ, ax
For N distributions (xo + yo, x we sample interpolation coefficients a; ~ [0, 1] s.t. a; + x; and Σ, a; S N. In CPS training. N is the number of train-time distributions used in training the subspace; in task interpolation, N
XN + y containing (N 1) target distributions,
2

---

Under review as a conference paper at ICLR 2023
is the number of train/test-time distributions used in interpolating between task sets. Given set of valid interpolated imput distributions (manifesting disjoint/joint shifts) and their corresponding interpolation coefficients {(a+} + x), the primary objective of this work is to compute the set of parameters {0} that can be mapped to shifted distributions & + such that we minimize the cumulative loss Σ (0)-((a))) [(0: Σ [a, 9) (o.)
COMPRESSED PARAMETER SUBSPACES (CPS)
3.1 SUBSPACE CONSTRUCTION
The CPS is constructed by training multiple parameters in parallel, where each parameter trained different, shifted distribution. Parameter point-estimates can be interpolated between the trained parameters (which set the bounds of the subspace). In this section, we precisely define the method, subsequently explain why we expect low-loss parameters to reside this subspace that can be mapped to shifted distributions in the input space, then finally share the inference techniques used.
Algorithm 1: CPS: Train
Algorithm 2: CPS: Evaluate
trainSpace (S, (0. (D.)",,,4. B,
evalSpace x, {0.}*. N {a.]
Input :Model f. Parameters {0.}%, Train set (D.) Distance coefficient 88 Epochs
Input IIpuut 2, Trained parameters {0,}* In- terpolation coefficients
[0, 1] s.t.
> a, S N
Output:Traiie parameters {0:} }
Output Predicted output ù
Constant initialization {fii <- 0.)
- Σ a;;;;
Train each parameter against their indexed train set in parallel per epoch foreach epoch E E do
3 - fax
return
foreach 0,, D, E [0.) N. (D.) do
foreach batch x, E D, do
1 < fxx 0z) + E(O, y) + Scos(10,))
Backprop 0. w.r.t. L
return {0.}
The parameter space & E TRM is M-dimensional space where parameter point-estimates @ ④ are sampled and loaded into base learner function f(0: ) A parameter subspace 0 is a bounded subspace contained θ such that:
Definition 2.
0 = E0l0 5 s Σ S N. (min C(0;; (1,
Definition 2.1 A compressed parameter subspace is parameter subspace with the constraint that the distance between the set of end-point parameters should be minimized (Algorithm) 7 such that:
N 0= Σ agl 0 as 1,00 Σ
aos N, N, (min C(O,; X,, V.) min dist dist(((,))))
From Theorem 2, we show that the end-point parameters converge towards local region in the parameter space; as the average distance between any end-point and the centre of these points is lower upon loss convergence, this space is referred to as being compressed. From Theorem show that the end-point parameters (and subsequently interpolated parameters within the subspace) contain real-valued artifacts of opposing end-point parameters. Further, from Theorem 3, we show that an interpolated input set has a lower expected distance towards any interpolated (or end- and-point) parameter point-eun eettimttt in compressed space than uncompressed space. From these properties, we empirically validate that interpolated input sets in single and multiple test-time distributions can be mapped back interpolated parameters in the CPS.

---

Under review as a conference paper at ICLR 2023
Theorem 1. For N + parameters trained in parallel, any individual parameter 0, is a function of its mapped data X; + Y, as well as the remaining parameters {8,, Jee (and by extension, Xn + Yn). Hence, linearly-inteppolate parameter between 8, and {0, )"EN is function of [0,]"EN and
Proof sketch. Denoting C = Σn 8n computing [(0,) = [(0,, Xi) + dist(f;, (0, |n such that [(0,) = leads to the property that:
X. 4X,C + 4NY, + X²
2.V
This and subsequent results find that any end-point and interpolated parameter 0 will be a function of nested { J N Refer proof in Appendix A.I.
Theorem 2. For N + parameters trained in parallel, for an individual parameter 0; and another parameter fn where n E N. the change loss per iteration of SGD with respect to each parameter 8C(0;:x)) 3c(6,,Xx)) will both be in the same direction (i.e. identical signs), and will tend towards a 80, 60,
local region of the parameter space upon convergence of loss.
Proof sketch. By computing the incremental loss attributed to the distance regularization term upon convergence AL((;)) = 0, we find that:
X.) OC(Om; 1 (aC(OniX.)) ) a9,
(
(OC(0;:X.) X.)
'1
+
a0,
H0,.
a9;
Subsequently, we find the respective cumulative loss (and consequently distance between) 0, and in from iterations = 0 to E -:
E
aC(O..=ei
Σ
E-1 ([(rt,teei
a0,
D0n,tmc
to be lower when xc10;X,)
(c( 0 (i.e. active distance regularization) than when OC(O;X.). 86,
00,
ac(0..:x.) I O. Refer to proof in Appendix A.l.
Theorem 3. For N + parameters trained in parallel, the expected distance between the optimal parameter of an interpolated input & + A would be smaller with respect to sampled points in Distunce-regularizer subspace than wwwddtinneeregulaariiii
subspace.
Proof sketch. For the the ground-truth parameter of a sampled interpolated input distribution, in order for the loss to converge L(0) - 0, the product of the loss terms converges in the same direction
ac(o.X.) ac(d:X.) > 0. For iterations = to e = 1. the cumulative loss (and consequently a6 a6
distance) between the ground-truth parameter and parameter end-points
@C(0r=;;xi) + On
@C(0==e;xn)
(C(tn,tzei (0(,,,)e))s) 00,
E
2
0:
a0.e.
ab.=e
00 00n,tme
is closer in the distance-regulaarized space than non-distance-regularized space. Refer to proof in Appendix A.I.
Instead of single distribution with multiple random initializations, we begin with set of shifted dis- tributions {x1} N and a single constant (randomized) initialization. For a single test-time distribution (CIFAR10), we slice subsets of the train set and insert unique perturbations of given type (backdoor stylization rotation) into each subset. For multiple test-time distributions (CIFAR100), we use different task sets each distribution. Each model is a Ê-layer CNN trained with carly-stopping at loss 1.0 (to accommodate computational load for training, hence limiting accuracy). We load the N sets in parallel. At the end of each epoch, we compute the loss of each model's parameters with respect to their train time sets. We then compute the average cosine distance between each model's weight against all the other model's weights. We add this distance multiplied by distance coefficient
B = 1.0 to the total loss, and update each model's 's weights with respect to this total loss.
3.2 SUBSPACE INFERENCE
There sapacity-efficiers methods to query parameters from the CPS without explicitly/separately storing large subsets of the CPS. We list the following three classes of test-time inference with subspace.
4

---

Under review as a conference paper at ICLR 2023
3.2.1 UNBIASED SAMPLING
In this sampling scheme, we do not use any heuristics selecting parameters.
We can compute predictions y = f(0";; xx) given an input and the centre parameter point-estiman
N Σ 0 (the average of the end-point parameters).
We can compute mean prediction y = x Σ, f(0); x) given an input and an ensemble of M randomly- -samole parameter point-estimates in the subspace; we randomly sample M 1000 M
interpolation coefficients {a..i..Mx to return an ensemble set of parameter point estimates {0]}M {ag,} MxN {0,}".
3.2.2 GUIDED SAMPLING
Guided sampling makes use of heuristic in the selection of parameters to used for inference.
We can compute predictions y = f(0g-; x) given an input and a lowest-loss interpolated parameter point-estimate, where j = arg min L(0,; This specifically unique-task solution, where the interpolated parameter maps back to one task/distribution x + 0,-. For multi-task solution, an interpolated parameter is mapped back to set of ''' task/distributions {&,}" + 0z-,
where j == arg min Σi Xe; yt)- To identify this interpolated parameter that returns the lowest-loss (maximum-accurary) for a given test-time distribution, we can actively and iteratively sample parameters with respect to the centre of the subspace, linearly enumerate through interpolated parameters between the known boundary parameters. An example of scheme would be, given K-shots, we can sample parameters and use the parameter of lowest-loss for the task. This could also be extended to construct an ensemble. In this work, we search for the lowest-loss parameter show that compressed parameter subspace has higher likelihood of containing shift-optimal parameters.
We can compute predictions y = f0,,;; x) given an input and lowest-loss boundary parameter, where the latter is the parameter from set of N boundary end-point parameters that returns the lowest loss i" := arg minl,N L(0,; x) The boundary parameter may be used the task index is known. In this work, lowest-loss interpolated parameter is simply returning a boudary parameter or not.
the boundary parameter ablation, and to check if the
3.2.3 GENERALIZED FUNCTION
We can generalize represent the subspace implicitly with learning function. We evaluate CPS- regularization in hypernetworks, an existing continual learning strategy. In-line with Zenke et al. (2017) and yon Oswald et al. (2020), we adopt the Split CIFAR10/10 benchmark, where we train on CIFAR10 first, then train sequentially on the next 5 sets of 10-label CIFAR100 All tasks share the same 10 coarse labels.
hypernetwork (x. I) = (xx m m0mp: I)) a pair of learners. the base learner f :''' + y and meta learner m. I U such that for the conditioning input of input x (where X' + I). m.f produces the base learner parameters 0, = m00mm I). The function m m I) takes conditioning input to returns parameters 0, E θ for f. The meta learner parameters and each base learner parameters reside in their distinct parameter spaces 0mf E 2mmf and 0, Oy. The learner f takes an input x and returns an output ÿ = f(0,; that depends on both x and the task specifcc input I. T is number of tasks, t is index of specific task being evaluated (t" being current task), w is task regularizer. l mm is the hypernetwork parameters the current task's 's training timestep. 6t is the hypernetwork parameters before attempting to learn task I", and 20me is the candidate parameter change computed by the optimizer (Adam). We do not any separate conditioning input (i.e. task embeddings), and use the test-time input as the primary argument, i.e. I X.
Lmf = Li- (mf((mm)))))) Xx- x X,",,,.>> y
f(m.f(00m xx. X - f(mff(0m + A0ms xx); xx): Xe, w Σ
(I)
Σ
dist(Omp, 0mp.s)
t
5

---

Under review as a conference paper at ICLR 2023
Starting from random initialization, train the hypernetwork first CIFARIO (interpretable as re- re-initializing the network with pre-trained weights, which findings in Neyshabur et al. (2020) may indicate that subsequent task parameters may reside in shared low-loss basin), and store these parameters fm in parameter set (fmp..)² Then we train on a subsequent CIFAR 100 task with the Eqt. [loss function, where we compute loss w.r.t. the inputs and current timestep's 's parameters, change in loss w.r.t. previous task between using the proposed parameters and the parameters last updated at that task (stored in the parameter set; this is enumerated for all past tasks in sequence), and the distance between the current parameters and all prior parameters. Unlike our prior (multi-task) implementation, (i) we minimize the cosine distance between current task's parameters against prior parameters sequentially, not in parallel (i.e. the subspace end-points are sequentially fixed in the parameter space, we cannot dynamically move the subspace towards a different region), (ii) we do not gain visibility to all task parameters at once, and (iii) we are computing distance w.r.t. multi-task parameters (i.e. each task's parameters is applicable to its own and prior tasks).
4 METHODOLOGY
We summarize our data processing and baseline methods, with additional details in Appendix A.2.
Test-time distributions. We evaluate on CIFAR10 and CIFAR 100 (Krizhevsky) 2009) for single
(non-task-shift) and multiple test-time distributions (task-shift) respectively. For label shift w.r.t. train-time perturbations, we implement backdoor attacks with Handoom-BadNer (Datta & Shadbooi 2022), a variation of BadNet (Gu et al., 2019) to allow for multiple trigger patterns. For label shift w.r.t. test-time perturbations, implement adversarial attacks for targeted label shift with Projected Gradient Descent (Madry et al., 2018), and implement random permutations for untargeted label shift with Instance Normalization (Huang & Belongie, 2017). We rotate images in-line with RotateCIFAR 10. For task shift, where the tasks are pre-defined in the dataset with shared or non-shared label sets, we evaluate on both the end-point tasks as well as interpolated tasks.
(in-line with PermuteCIFAR1O) We implement stylization with Adaptive
Task interpolation. Interpolation is an existing data/task augmentation technique. MLTI (Yo et al. 2021] linearly interpolates the hidden state representations at the fth layer of a model when a set of tasks are passed through it. Mixup (Zhang al., 20176) linearly interpolates raw inputs and labels for data augmentation. We evaluate interpolated tasks by linearly interpolating a set of tasks: for a set of tasks {X] N where each task X is a set of inputs x (and the number of inputs per task is identical, i.e. { J we linearly-interpolate between indexed inputs across task set to return an interpolated task: = =. Σx agæiy. In this work, we only interpolate between task sets with identical labels (label-shared).
Baselines. We baseline with CutMix data augmentation Yunn et al., 2019a), adversarial training
with PGD (Goodfellow et al., 2015), and backdoor adversarial training (Geiping et al. (021). We additionally evaluate a subspace and ensembling method, Fast Geometric Ensembles (Garipov et al. 2018 In a continual learning setting, we evaluate with hypernetworks (von Oswald al. 2020).
EVALUATION
We summarize below the experiments evaluated (detailed configurations in Appendix A.2).
Change in parameter subspace dynamics: We plot the changes in loss and cosine distance for training CPS with 3 train-time distributions (Figure 2 Appendix A.3. / ). We linearly-interpllate between tasks and end-point parameters (Figure 2) We plot the individual tasks along interpolation coefficients {a:" JMM and unique lowest-loss parameters that can correspond to a task along interpo- lation coefficients {a{) NV We also render an alternative continuous cross-sections plot (Appendix A.3.3). The task end-points in these plots are: 3 tasks, 3 x same coarse label, train-time task set.
CPS vs single test-time distributions: We evaluate baselines and CPS trained on 3 subsets of perturbed CIFAR10 against a range of test-time perturbations (Table We evaluate the relationship between CPS, number of perturbed sets trained on, and model capacity (Appendix A.3.4).
CPS vs multiple test-time distributions: We evaluate the insertion of CPS resuragulai term in training hypernetorkss for continual learning (Table 3). We evaluate the improvement in mapping

---

Under review as a conference paper at ICLR 2023
low-loss parameters in CPS (Table 2). We evaluate CPS (varying for per-paaraettrizzttoon w.r.t. number of tasks and model capacity) against seen/unseen tasks (varying for additional perturbation types) (Appendix A.3.8). We also evaluate varying model width against train-time distribution label set diversity (Appendix A.3.6). We also evaluate varying model depth against varying distinct coarse label sets in train-time distributions (Appendix A.3.5). We also evaluate varying model depth against varying task label set diversity (different fine and coarse labels) (Appendix A.3.7).
5.1 SINGLE TEST- TIME DISTRIBUTION
(Observation 1) A purameter subspace can be found where the distance between end-point pa- rameters to the centre is reduced. The intended result from cosine distance minimization is not to converge cosine distance to 0 (c.g. using larger capacity model can result in lower cosine distance between parameters); the intended result is to minimize the distance between parameters compared to without regularization, and through this process find interplotable subspace in the parameter space. Comparing the distance w.r.t. opposing end- and-point parameters and the centre in Figure and Appendix 1.3.1, we find that the distances have comparatively converged when B 1 than / 0 for single test-time distributions, but the convergence in distance is not as apparent for multiple test-time distributions; the latter may suggest minimum distance (interference) is required between certain tasks particularly if there is limited transferable features between them.
From Figure and Appendix A.3.1, when training w.r.t. a single test-time distribution, we observe that the cosine distance (w.r.t. subspace centre) first increases substantially before decreasing and continuing to stay at low level. As opposed to SGD performing point-estimate optimization, this phenomenon can be interpreted as SGD performing subspace optimization, in-line with Theorem 2. Without distance regularization, the trajectory taken by SGD tends to depend more on the initialization point (Fort et al. 2020). In-line with Neyshabur et al. (2020), the parameters at peak cosine distance may be interpreted as a second, albeit unshared, pre-trained weight initialization that propagate parameters towards a same low-loss basin.
(Observation 2) Sampling parameter point-estimates in the CPS can attain a high average ro- bustness accuracy across different perturbations or shifts. Evaluated against the clean test-time distribution, we find that sampling point-estimates in the CPS can retain its accuracy across varying perturbation types (Table [] Appendix A.3.8). For single test-time distribution (CIFAR10) with varying perturbation types, we find that inference with the centre or ensemble can yield a higher average accuracy across perturbed test-time distributions than wide-spectrum and/or niche defenses, particularly CPS trained on backdoored subsets. We find that the increased low-loss parameter mappings to the input space enables robustness for multiple perturbation types, in-line with Theorem 3. Though outperforming on average, CPS underperforms data augmentation with respect to test-time stylization and rotation. Though a lowest-loss point-estimate can be found for most perturbation types, we note that a comparably-accures CPS trained on rotated sets can contain lowest-loss point-estimates for rotational perturbations, an averaging strategy (neither averaging the parameters to compute the centre, nor ensembling the predictions of 1000 parameters) does not work as well as other perturbation types. We achieve above-chance (CIFARIO 10%, CIFARI00 20%) performance that a lowest-loss parameter can be interpolated within the CPS for these cases. Other than a backdoor attack, training CPS on any perturbed type of subset can attain similar performance.
one cannot be found for test-time stylization. Though
stylization and rotation, and show
5.2 MULTIPLE TEST-TIME DISTRIBUTIONS
(Observation 3) Constructing a CPS can yield subspace containing low-loss parameters for corresponding inputs. Based on Table 2, compared to non-CPS, we observe that more points interpolated in the input space can be mapped to low-loss interpolated parameters the parameter space. We would expect a larger subspace to contain more low-loss parameters, yet counter-intuitively a subspace compressed w.r.t. opposing boundary parameters contains more mappable low-loss parameters (Theorem 3). We also note that the interpolated points perform better than reusing boundary parameters. This result is visualized in Appendix 3.3.3 (and Figure 2 more points in the input space can be mapped with higher accuracy, and fewer, sparser yet mnore-accurate points can be located in the parameter space that can map back to these inputs. In addition to these interpolated parameters that can be mapped back to shifted distributions, the average (ensemble) accuracy of the
7

---

Under review as a conference paper at ICLR 2023
Acc w.L., seen distributions
Ace w.E. unseen shift distributions
Cleun Test Set
Bockdoor Attack
Adversarial Attack
Rundom Permutations
Stylizution
Rotation
Augmentation
55.6
19.0 1 25,2
40.4
19.6 23.2
19.0
19.02.13
51.44 23.7
Adversarial Training
55.1
37
2 22.4
50.0
11.8: 22.4
10.0
= 19.9
10.3
23.3
Backdoor Adversarial Training
52.3
45.0 25,5
31.2
36.2 a2 21.0
37.6 12 21.5
30.2
100.2.200 20.5
Geomotric Ensembbling
55.1
18.7
18.6
56.3 +
56.3 15.8
47.7
+ 21.7
4.0
28.2
19.8
CPS (backdoor) ens. (incan)
55.3 +: 15.7
50.5
15.7
17.3 2.2
1112::200
23.5 3.6
28.2 19.1
intp. (max)
57.5 4: 15.5
57.5 15.5
60.5 4: 1.2
61.7 19.8
27.0 3.8
30.2 19.1
centre
51.5
50.3 19.1
2.2224 2.1
CPS (stylization)
ens. (mmun]
57.3 4: 18.3
20.8 1.4
50.4 0: 2.3
89.2 19.3
24.1 2.8
26.1 19.5
intp. (max)
19.7 + 18.2
22.7 + 1.6
00.7 1.8
60.1 + 19.4
27.4 3.4
29.1 19.2
centre
1.4
12.7
CPS (rotation)
cns. (mean)
19:2 + 1.8
25.3
9.2
18.1
1.2
19.2 11.0
13.1 1.5
26.9 + 19.3
inlp. (max)
59.6 + 17.2
36.2
2:
1.2
58.1 = 1.6
52.8 18.9
23.7
3.1
18.5
26.6
Table 1: CPS vs single test-time distributions: Baselines and CPS trained on 3 subsets of perturbed CIFARIO (backdoor / stylization / rotation) against varying shifts w.r.t. test-time distributions (mean + std w.rt. number of test-time samples): clean test set (out of 3), backdoor attack (out of 3), adversarial attack (out of 3), random permutations (out of 100), stylization (out of 100), and rotation (out of 100). Base model is 3-layer CNN. The backdoor attack evaluated w.r.. clean samples (higher accuracy is higher robustness), not w.r.t. poisoned labels.
Uniform interpo- lation (of inpuls)
Rest Accuracy
CIFARTO
Trained from scratch
67.7
70.9
67.1
61.7
61.4
70.9
Standard Hypernework
Oswald
CPS: 3 (independently-
boundary
47.2 = 14.1
Hypemerwork, evaluated after each task
6337
63.2
02.4
61.7
62.4
centre
28.5 4.1
trained)
cns. (mean)
29.2 6.8
Hypemetwork, evaluared after task
61.8
61.9
58.9
50.3
30.2
50.9
inip. (max)
38.2 7,8
CPS: 3 seen tasks of same coarse label, low-capacity intp. (max)
boundary
49.4 10.8
CPS-eeuularied
Hypernetwork
centre
33. 1 8.4
Hypemerwork, evaluated after each task Hypemetwork, evaluared after task
65.8
69.2
64.4
68.7
64.8
64.9
ens. (mean)
32.9 6.1
63.6
65.0
00.7
62.9
61.7
53.1 8.5
Table 2: CPS multiple test-time distri- butions: Between B = 0.0 and 3 1.0, with respect to a set of 50 interpolated tasks, we evaluate accuracy with respect to the lowest-loss boundary parameter, centre parameter, ensembling 1000 parameters and averaging their predictions, and search- ing for the lowest-loss interpolated param- eter (excluding boundary parameters).
Table CPS vs multiple test time distributions: Test set accuracy in continual learnign setting on CIFARIO and subsequent CIFAR splits of 10 classes. We evaluate /von Oswald et al. (2020)'s 's hypernetwork and our CPS-regularized hypernetwork, and compare between training each task individually, evaluating task right after learning a new task, and evaluating a task after learning all tasks.
parameter space is higher than / = 0.0. In-line with Observation 1, we find from Appendix A.3.8 that, compared to a clean test-time distribution, we retain comparable accuracy (centre / ensemble / interpolation) under different types of test-time perturbations.
To study improvements task adaptation and meta learner capacity, we evaluate additional CPS- regularization term to yon Oswald et al. (2020)'s 's hypernetwork to find reduced catastrophic forgetting across tasks (Table 3). Though lowest-loss parameters are sparser in the compressed subspace, the hypernetwork can map parameters to tasks within the bounds of the parameter end-points. Though this is counter-intuitive as would expect distant tasks to be located in distant subspaces in the input space, by forcing the parameters to be co-located in a single (yet interpolatable) subspace, we reduce the propensity for the hypernetwork to compute distant (5- 0.0) parameters with high-loss regions in between computed parameters.
(Observation 4) Subspace capacity supports unseen tasks of different fine labels and different coarse labels. From Appendix A.3.8, in addition to test set performance of seen tasks, we find that training a CPS on seen tasks of constant coarse label set can retain above-chance accuracy on unseen tasks of different fine labels as well as distinctly different coarse labels, supported by the high mean and low standard deviation. Semantic features may transfer across tasks of identical coarse labels, which explain the performance with respect to unseen tasks of shared coarse labels. The performance with respect to unseen tasks of unshared coarse labels could be interpreted as the CPS containing large enough sets of (random) parameters that fit this task without training, in-line with Ramanujan
8

---

Under review as a conference paper at ICLR 2023
baddeer
Ager
214
2-3
4.c
Ayen Gultee
0.90
1.00
Avent and sprr1
4.00
Lovennun in agen
Aped will
2000
2003
Caler all Orts
4.00
tatty
Optna Sate
Change in parameter subspace dynamics: Loss and cosine distance per epoch during training of CPS with train-time distributions (B 1.0).
Figure 3:
al. (0199) where cundomly-intiialinn network contains low-loss subnetworks. These phenomena indicate an extremely large and flexible capacity supported within the parameter subspace; it has an increased number of low-loss parameters for shifted and unseen test-time distributions of shared labels, but also contains random parameters that can arbitrarily fit random tasks.
(Observation 5) Sampled parameters can also be used multi-task solutions. To evaluate how well parameter point-estimates can operate as multi-task solutions, we consider over-paramettrizaton of the subspace with respect to (i) minimizing the number of train-time distributions (which, according to Theorem 1, would reduce capacity per coint-estimate allocated to an opposing end-point, and (ii) increasing model capacity (depth and/or width). Considering varying wver-paramtteriattion w.r.t. a single test-time distribution (Appendix A.3.4), though a larger capacity model can retain higher cente//eneemhe/ineppolaarr accuracy than a smaller capacity model, accuracy w.r.t. the test set of train- time distributions do not vary significantly when the number of train-tima distributions varies (i.e. a trained subspace can expand or change capacity to support more parameter end-points accordingly). Similarly in Appendix A.3.7, when we vary the number of non-shared fine and coarse label sets, though the centre/ensemble accuracy does not improve significantly, we find that the accuracy of the lowest-loss interpolatable parameter increases with an increase in model capacity.
In Appendix A.3.8, unique-task solutions outperform multi-task solutions. From Appendices A.3.5 and A.3.6, we find that increasing model capacity and decreasing -oa-lang--saring tasks increases performance for multi-task learning: an over pareametamteei subspace yields high accuracy when evaluated with the subspace centre ensemble. An increase in centre/ensemble accuracy indicates that a sampled point has a higher propensity of providing low-loss inference on a sampled input set. As the number of non-label-shared tasks increases, the general performance decreases; increasing the capacity helps mitigate this, though it only increases the ability to locate linearly-interpolan multi-takk task solution. When subspace is pver-parameterized for multi-task learning, though accuracy is increased for centre / ensemble/ / interpolation, it does not linearly minimize the gap between them.
6 CONCLUSION
We learn that sampling points in the parameter subspace can return lower-loss mapped parameters if the space was compressed during training, yield robust accuracy across various perturbation types, and reduces catastrophic forgetting when adapted into hypernetwork. We motivate further study into enforcing geometric structure to parameter subspace construction and methods test-time adaptation towards (joint) distribution shifts.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Devansh Arpit, Huan Wang, Yingbo Zhou, and Caiming Xiong. Ensemble of averages: Improving model selection and boosting performance in domain generalization, 2021.
Eitan Borgnia, Valeriia Cherepanova, Liam Fowl, Amin Ghiasi, Jonas Geiping, Micah Goldblum, Tom Goldstein, and Arjun Gupta. Strong data augmentation sanitizes poisoning and backdoor attacks without an accuracy tradeoff, 2020.
Junbum Cha, Sanghyuk Chun, Kyungjae Lee, Han-Cheol Cho, Seunghyun Park, Yunsung Lee, and Sungrae Park. Swad: Domain generalization by seeking flat minima, 2021.
Brian Cheung, Alex Terekhov, Yubei Chen, Pulkit Agrawal, and Bruno Olshausen. Superposition of many models into one, 2019.
Siddhartha Datta. Learnwwighh: Parameter adaptation against similar-domaie adversarial attacks. In International Conference on Computational Linguistics, 2022. URL https::/aaxt...orrgga. http:///ww..r/////////e./
07315
Siddhartha Datta and Nigel Shadbolt. Backdoors stuck at the frontdoor: Multi-agent backdoor attacks that backfire. In International Conference on Learning Representations Workshop: Gamification and Multiagent Solutions, 2022. UtL./tttss//aarsww..rrgg
12211
Felix Draxler, Kambis Veschgini, Manfred Salmhofer, and Fred Hamprecht. Essentially no barriers in neural network energy landscape, 2019.
Chelsea Finn, Pieter Abbeel, and Sergey Levine. Model-agnostic meta-learning for fast adaptation of deep networks, 2017.
Stanislav Fort and Stanislaw Jastrzebski. Large scale structure of neural network loss landscapes, 2019.
Stanislav Fort, Huiyi Hu, and Balaji Lakshminarayanan. Deep ensembles: A loss landscape perspec- tive, 2020.
Yaroslav Ganin, Evgeniya Ustinova, Hana Ajakan, Pascal Germain, Hugo Larochelle, François Laviolette, Mario March, and Victor Lempitsky. Domain-adversarial training of neural networks. Journal of Machine Learning Research, 17(59):1-33 2016a. httLL:::///iilrr.r//ppprrr//////
html
Yaroslav Ganin, Evgeniya Ustinova, Hana Ajakan, Pascal Germain, Hugo Larochelle, François Lavi- olette, Mario Marchand, and Victor Lempitsky. Domain-adversarial training of neural networks, 2016b.
Timur Garipov, Pavel Izmailov, Dmitrii Podoprikhin, Dmitry Vetrov, and Andrew Gordon Wilson. Loss surfaces, mode connectivity, and fast ensembling of dnns, 2018.
Jonas Geiping, Liam Fowl, Gowthami Somepalli, Micah Goldblum, Michael Moeller, and Tom Goldstein. What doesn't 't kill you makes you robust(er): Adversarial training against poisons and backdoors, 2021.
Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A. Wichmann, and Wieland Brendel. Imagenet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness. In International Conference on Learning Representations, 2019. URL htttss//ppprrreeeeeeee//etteeeep
Micah Goldblum, Liam Fowl, and Tom Goldstein. Adversarially robust few-shot learning: meta-learning approach. In Proceedingy of the 34th International Conference on Neural Infor- mation Processing Systems, NIPS*20, Red Hook, NY, USA, 2020. Curran Associates Inc. ISBN 9781713829546.
Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations, 2015, URL http://arxdv.org/
abs/ 0t//1412.40 6572
10

---

Under review as a conference paper at ICLR 2023
Tianyu Gu, Kang Liu, Brendan Gavatt,,,,t,,,,,,. and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 4724240-47244, 2019. doi: 10.1109/ACCESS. 2019.2909068.
Judy Hoffman, Eric Tzeng, Taesung Park, Jun-Yan Yan Zhu, Phillip Isola, Kate Saenko, Alexei A. Efros, and Trevor Darrell. Cycada: coccssconsistent adversarial domain adaptation, 2017.
Kyle Hsu, Sergey Levine, and Chelsea Finn. Unsupervised learning via meta-learning, 2019.
Sheng-Wor Huang, Che-Tsung Lin, Shu-Ping Chen, Yen- Yi Wu, Po-Hao Hsu, and Shang-Hoo Lai. Auggan: Cross domain adaptation with gan-based data augmentation. In Proceedings of the European Conference on Computer Vision (ECCV), September 2018.
Xun Huang and Serge Belongie. Arbitrary style transfer in real-time with adaptive instance normal- ization. In ICCV, 2017.
Siavash Khodadadeh, Ladislau Bölöni, and Mubarak Shah. Unsupervised meta-learning for few-shot image classification, 2019.
Alex Krizhevsky. Learning multiple layers of features from tiny images. 2009.
Guanxiong Liu, Issa Khalil, Abdallah Khreishah, and NhatHai Phan. A synergetic attack against neural network classifiers combining backdoor and adversarial examples, 2021.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference Learning Representations, 2018. URL httpss//oppeenreeeee net/ net/forum? wwwoorrmniidrrrrdee r21132AA
Behnam Neyshabur, Hanie Sedghi, and Chiyuan Zhang. What is being transferred in transfer learning?
In H. Larochelle, M. Ranzato, Hadsell, M. F. Balcan, and H. Lin (eds.), Advances in Neural Information Processing Systems, volume 33, pp. 512-523, Curran Associates, Inc., 2020. URL
neurips. http://c.....aaaa..../////////t.
Paper..df
Sinno Jialin Pan and Qiang Yang. A survey on transfer learning. IEEE Transactions on Knowledge and Data Engineering. 22(10):1345-135)) 2010. doi: 10. 10.1109/KKDE220991199
Xingehao Peng, Qinxun Bai, Xide Xia, Zijun Huang, Kate Saenko, and Bo Wang. Moment matching for multi-source domain adaptation, 2019.
Fanchao Qi, Yangyi Chen, Xurui Zhang, Mukai Li, Zhiyuan Liu, and Maosong Sun. Mind the style of text! adversarial and backdoor attacks based on text style transfer, 2021.
Vivek Ramanujan, Mitchell Wortsman, Aniruddha Kembhavi, Ali Farhadi, and Mohammad Rastegari. What's hidden in a randomly weighted neural network?, 2019. URL httpss//anadw.orr//b////111
13299
Jie Ren, Peter J. Liu, Emily Fertig, Jasper Snoek, Ryan Poplin, Mark A. DePristo, Joshua V. Dillon, and Balaji Lakshminarayanan. Likelihood Ratios for Distrib-Dtttiittioon Detection. Curran Associates Inc., Red Hook, NY, USA, 2019.
Chandramouli Shama Sastry and Sageev Oore. Detecting out-of-distributin examples with Gram matrices. In Hal Daumé III and Aarti Singh (eds.), Proceedings of the 37th International Conference Machine Learning, volume 119 of Proceedings of Machine Learning Research, pp. 8491-8501. PMLR, 13- Jul 2020. URL
Jasper Snoek, Oren Rippel, Kevin Swersky, Ryan Kiros, Nadathur Satish, Narayanan Sundaram, Md. Mostofa Ali Patwary, Prabhat Prabhat, and Ryan P. Adams. Scalable bayesian optimization using deep neural networks. In Proceedings of the 32nd International Conference on International Conference on Machine Learning- Volume 37, ICML' 15, pp. 2171 21800 JMLR.org, 2015.
Baochen Sun, Jiashi Feng, and Kate Saenko. Return of frustratingly easy domain adaptation, 2015.
Johannes von Oswald, Christian Henning, João Sacramento, and Benjamin F. Grewe. Continual learning with hypernetworks, 2020.
11

---

Under review as a conference paper at ICLR 2023
Ren Wang, Kaidi Xu, Sijia Liu, Pin- Yu Chen, Tsui- Wei Weng, Chuang Gan, and Meng Wang. On fast adversarial robustness adaptation in model-agnostie meta-learning. 2021.
Cheng-Hsin Weng, Yan-Ting Lee, and Shan-Hung (Brandon) Wu. On the trade-off between adversarial and backdoor robustness. In H. Larochelle, M. Ranzato, R. Hadsell, M. F. Bal- can, and H. Lin (eds.), Advances in Neural Information Processing Systems, volume 33, pp. 11973- 11983. Curran Associates, Inc., 2020. http:///w../ooooeee...eeee/e//// 0111655477001110022644666222222 parer.
Mitchell Wortsman, Maxwell Horton, Carlos Guestrin, Ali Farhadi, and Mohammad Rastegari. Learning neural network subspaces, 2021.
Huaxiu Yao, Linjun Zhang, and Chelsea Finn. Meta-learning with fewer tasks through task interpola- tion, 2021.
Sangdoo Yun, Dongyoon Han, Scong Joon Oh, Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. Cutmix: Regularization strategy to train strong classifiers with localizable features. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), October 2019a.
Sangdoo Yun, Dongyoon Han, Seong Joon Oh, Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. Cutmix: Regularization strategy to train strong classifiers with localizable features, 2019b.
Yi Zeng, Han Qiu, Gerard Memmi, and Meikang Qiu. A data augmentation-basee defense method against adversarial attacks in neural networks, 2020.
Friedemann Zenke, Ben Poole, and Surya Ganguli. Continual learning through synaptic intelligence. In Proceedings of the 34th International Conference on Machine Learning Volume 70, ICML'17, pp. 3987-3995. JMLR.org, 2017.
Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals. Understanding deep learning requires rethinking generalization, 2017a.
Hongjie Zhang, Ang Li, Jie Guo, and Yanwen Guo. Hybrid models for open set recognition, 2020.
Hongyi Zhang, Moustapha Cisse, Yann N. Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization, 2017b. URL
09412
Hongyi Zhang, Moustapha Cisse, Yann N. Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization, 2018
Qianyu Zhou, Qiqi Gu, Jiangmiao Pang, Zhengyang Feng, Guangliang Cheng, Xuequan Lu, Jianping Shi, and Lizhuang Ma. Self-adversarial disentangling for specific domain adaptation, 2021.
12

---

Under review as a conference paper at ICLR 2023
A
APPENDIX
A.1 SUPPORTING THEORY
Definition 1. A distribution shift is the divergence between a train-time distribution xo, Yo and a test-time distribution &, where 8, y is interpolated distribution between Xo, Yo and a target distribution xf yf such that & >x axxp and y = Yi where i arg max; Oxi-
Let N.Y. V. K. + be denoted as the input space, coarse label space, fine label space, and parameter space respectively, such that X' + J/, X' + K., K+ / higher-order labels of fine labels. f is base learner function that accepts inputs x, 0 to return predicted labels y - f(00; x). The model parameters 0 O are sampled from the parameter space, for example with an optimization procedure e.g. SGD, such that it minimizes the loss between the ground-truth and predicted labels: L(0;x.y)
- O. Coarse labels are the super-class
Σ, x (f(0:x)- y?
In-line with notation in Pan & Yang 2010), for a marginal (or feature) distribution P(x) and a conditional (or label) distribution P() X'). joint distribution shift is denoted a joint transformation in the
distributions. A covariate shift manifests as a change in the marginal distribution (()) under constant conditional distribution P()[X). A label shift manifests change in the conditional distribution P() under constant marginal distribution P(X). As elaborated in Section 2.1] deep neural networks may not perform well under this joint shift setting, and unifying robustness methods are limited. To simplify our language in discussion, we use a set of points sampled in space pertain distribution.
To retain generality in notation and implementation, we re-iterate the aforementioned formalism in terms of sampled points in their respective spaces. We sample mapped points in the input-label spaces as x, = {{I, y /condition ~ Y. We describe shift here with respect to a single target /
label in order to highlight changes in the input-label mappings; the notation extends to non-singular label sets. Suppose we sample a clean / source / train-time set of points, constrained by mapped target label y": Xo. Yo {{I, y y Y..
A distribution shift is the divergence between a train- time distribution Xo: Yo and test-time distri- bution &, y, where y is an interpolated distribution between Xo: Yo and a target distribution x x .y such that x = Σn ax and ý = yıli == arg max; dg.. For a set of distributions (xo + Xo. + y N + y containing (N - 1) target distributions, we sample in- terpolation coefficients og [0, 1] s.t. a; + X; and Σ ar S N. N is the number of distributions being used; in CPS training, it is the number of train-time distributions used in training the subspace: in task interpolation, it is the number of train/test-time distributions used in interpolating between task sets. A disjoint distribution shift is a distribution shift of only one target distribution {a: ) = such that & ax + (1 ax)xo. joint distribution shift is distribution shift of multiple target distributions {a, | /|> such that ΣN axxxA.
Each distinct target distribution is varied by the type of perturbation (e.g. label, domain, task) and the variation per type (e.g. multiple domains, multiple backdoor triggers). For clean test-time distribution where l|x xo 0 and y", no shift takes place. If x & manifests label shift (y * y", min| |x Xollp). then x y = {fz, yilv * y" V. If & manifests covariate shift (||x²² xolمp>> 0), such as domain shift, then x² .y² = [[{r.)]b = Yaamhg N,Y). where the sampled æ may not correspond to clearly-defined class (i.e. a random/ / ambiguuus class Yambg). If ÿ manifests task shift (unrestricted 1x Xo <olp>>>>>>>>> 0); for label-shared task shift (identical coarse labels y, non-identical fine labels k) x3 .y {(z.gHl y" k * ks' X, D. K); for non-label-shared task shift (non-identical coarse nor fine labels) x3 y3 (I. ly 7 V" * k* (.),K...
For interpolated input sets between Xo and x we would expect 0 < oD, ag < 1, unless we expect the shifted distribution to completely manifest the target distribution (e.g. rotated sets, end-point task sets) such that a; 1. The labels of the interpolated set is the label set with the larger corresponding a; In label shift, the perturbations are small enough that we retain the ground-truth labels. For label-shared task shift, the ground-truth (coarse) labels between the end-point tasks are identical. For non-label-shane task shift, we do not interpolate between non- con-identical label sets between the end-point tasks.
13

---

Under review as a conference paper at ICLR 2023
If we inteeppolle random input sets with random ambiguous label assignments, incur the risk of (i) the perturbed input set as being as being perceptually inconsistent with the assigned label, and (īi) the model overfitting towards random label assignments (Zhang al. 2017a). To mitigate these concerns and generate semantically-wee adopt existing perturbation generation methods that have also
(perceptually-inter innterpey-tterrreeeeed as belonging to
its assigned label) perturbations, been numan-evaluated as perceptually consistent. The use of these methods can be interpreted as the filtering of invalid points in the input space for the evaluation of mapping between X' and θ.
Test-time distributions can be decomposed into a weighted sum between known train-time distributions and computable interpolation coefficients.
Corollary 1.
We assume given test-time distribution & can be decomposed into a sum of parts := ΣN a, where N is the number of component distributions. For the component distributions {xq} JM if subset of the distributions exist in the set of train-time distributions, then the interpolation coefficient value per train-time distribution lies in 0 < ag S 1; if none of the distributions exist in the set of train-time distributions, then the interpolation coefficient value per train-time distribution is O.
For an input interpolated between a set of input end-point with interpolation coefficients {ax)a, the loss term per epoch can be decomposed into component/end-pote loss terms of equivalent interpolation coefficients {a,,)* N but the parameters may or may not be decomposed into component/end point parameters of {a:}".
Corollary 2.
The loss of an interpolated set with respect to a parameter updated till epoch e can be computed with respect to the weighted sum of the loss with respect to the boundary input points and interpolation coefficients for the interpolated input set.
@L(Or=e; (0rze EN (xxi - y) (0ize-)
ΣN 0:2; - y)
00
Ii=e- 0i=e-1
(0e=c y) (0f=e-18;8} yy)
Oime 0tme-1
(2)
@L(0r=eixs)
Σ 00:=c
Ozme is computed with respect the total loss at epoch e 1. 0p-e-1 updated with respect to multiple X; may not be identical to 0zme-1 updated with respect to a single set Xo- As a result, we cannot claim that interpolated input set must correspond to be satisfied with parameter composed of the weighted sum of the interpolation coefficients and end-point parameters 0" + Σ ag0,
Corollary 3. Training and inference with a single parameter point-estimant 0 may face trade-off loss w.r.t. X; and X if interference exists between X, and X,-
At a given epoch e, if 8C(8:X.) 8C(B.X..
(0 < O, then the decrease in loss w.r.t. one subset (either X;
09
or X,,) would result in the increase in loss of the other during training, and consequently the same during inference.
We also note few (non-exhaustive) assumptions criteria for interpreting the problem and evaluating the CPS.
Assumpiins/Constraints..
1. Each parameter point-estimate in the parameter space ② can be evaluated against more than one input distribution.
2. The input space and parameter space are continuous, and interpolated points can be sampled from both spaces.
3. A low-loss parameter point-estimatt for test-time distribution - & should be computable with minimal storage and time complexity.
4. We assume no task index or conditioning input or meta-data of the test-time distribution.
14

---

Under review as a conference paper at ICLR 2023
Theorem 1. For N 1 parameters trained in parallel, any individual parameter 0, is a function of its mapped data X; + Y, as well as the remaining parameters {8,, JaEN (and by extension, Xn + Y,). Hence, {0,)mER and (0,
parameter between 8, and { }=EN is function of
Proof. Suppose N + 1 parameters trained in parallel, and the number of dimensions of each parameter M = J0|. To simplify the analysis, we use the Euclidean norm distance, and make relevant approximations.
First, we decompose the loss w.r.t. 0i in order to obtain 0g in terms of X, Y,, and {0,)mEN such that (();) O. We denote C = 2n On. By the Cauchy-Schward incuality, apply the following term replacement: (Σx 0n)) (En 0n)² N Σn 02 = N Σn 02.
[(0,) [(0,, X,, Y.) + dist(O,, {0m) "ENN
N
(0.X: Ys) + Σ> (0 m m,,m)
(O.X, Yi) + Σ 10 20,0, + 6..)
Ca
(0.X, (1) + NO? 20,C +
(3)
N
C²
No + (X. - 20)0;
Y.)
N
0, 20 x, v (X, - 22)
4N 4N N Yi)
s.t. C(0.) =
2N
8, 2C X,
4X,C 4NY, + X
2N
Next, we compute the change in 0; w.r.t. change in C, and find that the C term is persistent (non- eliminated) and retained in the gradient calculation and optimization procedure of O:.
00, ac
1X, AX.C + ANY, + X
2
2N
2
(4)
2X,
+-- -11XX++NNX + X
N
In order for Eqt to remain valid, Eqt needs to be satisfied, which also shows that is dependent or contains artifacts from X; Y,.
4X.C + 4NY, + x² 2 0
4X;
(5)
C S 4NY, + X?
Further, suppose we linearly-interpolate a parameter within the bounded space of 9 (,, and the weighting per parameter is on + 0n such that > On S N + 1. We find that the interpolated parameter 0 has non-eliminated term C regardless of set a position in the bounded parameter space.
N
0 a,0;
Onn
On
(6)
88 OC
00
2 04
DC
N
On
15

---

Under review as a conference paper at ICLR 2023
Theorem 2. For + 1 parameters trained in paraltel, for an individual parameter 0₂ and another parameter 02 where n E N, the change in loss per iteration of SGD with respect to each parameter BC(0;:X)) 80(0,iX)) will both be in the same direction (i.e. identical signs), and will tend towards 80, 20,,
local region of the parameter space upon convergence of loss.
Proof. Suppose + parameters are trained in parallel, and the number of dimensions of each parameter M 10). We evaluate the incremental Ioss per iteration Ye EE, which is the distance regularization term.
N
M Σ
AC(O:).
Σ)
8m mn,m)²
(0:
-0,)²
ac(O.;Xi))
OC(On: Xmn)
2
0:
0n
(7)
00:
00,
[BL(fn) X.)
AC(0.; X.)
Σ (0. 0n) +
D0,
00.
@L((nn X
OC(0;;
(aC(0n; X.))
aC(0;; X.)
Σ
(0. 0..)² 2(0: 0..)
00..
00,
00,.
00:
Given that minimizing the last term can result in minimizing the loss min AC(O)). == min(O, ac(O,:Xm) 20(0,:X))) next show that the gradient update (change in loss per iteration of SGD 86, with respect each parameter) terms at iteration must be positive and share the same direction when loss converges to 0. For AL(O,) 2 O and Vn where n E N,
(O((0n:
(DL(0;;.1))
(c(O;;.))
(DC(Oe:Xn)
20
80,
00,
00..
(8)
OL(0; X²)
OC(0n; Xx)
1
(((00(00 Xn)
(aL(0; (()((:x())
)
00:
00..
00,
00,
For AL(0))e = O.
(c(
AC(O.; X.)
(L(Pn::n))
(
aac(o;; X.)
)
2
(9)
00:
30..
00,
00;
Hence.
(C(0;;))) 00.
OC(O..).)) must be positive, and the component terms must be the same direction
08.
(identical signs).
To further simplify analysis, we evaluate loss updates from iteration e = 0 to e = E 1 where loss converges iteration E. thus the component loss terms non-zero. The two loss terms are thus non-orthognnal, co-directional, and the angle between them is less than 90".
OL(0,;
OL(O.; X.)
(10)
00;
80,
Given that 0, and 0, are initialized at the same constant random initialization 0xe=0 = 0n,==o, the change each 9 from iterations e = 0 to e E 1 attributed to the difference in the summation of the gradient updates.
16

---

Under review as a conference paper at ICLR 2023
E-1
ÖL(Bi, Xt)
0: = 01
(11)
00,,==
E
eL(0n Xn)
On = O
(12)
30,,
We show next, that through enforcing distance regularization, we can exert tendency for the distance between the summation the loss term components to be smaller if they share the same direction, than if they were orthogonal or opposing directions.
WC(0,.cme; X.)
OC Xn)
80n,to0
(C(P
ec(Om:Xm] >0
89;
(13)
ac 10, Xi)
aC(On Xn.)
;0;
00n,t=e
(c( 59;
8cc0 X.) 50
Thus we show that 0g and O₂ are closer in distance in the parameter space. This can result in 0g and 6, sharing sub-matrices (intrinsic dimensions), and they may reside in the same or neighboring subspace.
Theorem 3. For N + 1 parameters trained in parallel, the expected distance between the optimal parameter of an interpolated input & + 0 would be smaller with respect to sampled points in distunce-regularizze subspace than aaa--distanc--egglariin
subspace.
Informally, we conclude from Theorems and 2 that, though non-linear and/or linear point-estimates may exist in non-compressed parameter subspace, compressed parameter subspace contains less interference attributed to changes in other dimensions; in other words, the CPS method reduces the dimensions of interpolation. Practically, this can manifest as most values in the weights matrix being relatively frozen constant (and only few values submatrix being changed), or the range per value in a weights matrix may narrower.
Proof. Suppose sample interpolated input & 0;xi an All trained parameters begin with a constant and equal initialization at = 0.
We would like to show here that any randomly interpolated input set of coefficients 0; on would be closer in distance to any parameter point-estimate interpolated between CPS- EPS-regularized parameter end-points with coefficients 7i Yn. compared to non-CPS-regun CPS-regularized.
First state the loss terms for ground-truth parameter ê corresponding to x. Recall from Theorem that the loss terms in the end-point parameters converge in the same direction (c(0,,).) (C(0=:X.)
00,
ae..
We find here a similarity to CPS, where order for the loss to converge C(0) - 0 the product of the loss terms for the ground-trute truth parameter also converges in the same direction (c();x.) ac(0:X.) 0.
a6
86
3L aL(0mme a;xi + (nxn)
0 =
(14)
E = ac(dm_))
(by Comollar 2)
00,ze
00.ze
Next, as the summation of loss per epoch indicates the region in the parameter space with respect to a constant initialization (as Theorem 2), we compute the distance in the summation of loss for compared the boundary end-point parameters of an uncompressed space. As the component
17

---

Under review as a conference paper at ICLR 2023
loss terms not regularized with respect to each other, their product may may not be greater than 0, i.c. their product is in the range [-1, 1].
aL(O x1)
+ aL(O Xn)
OC(Or,tmeis
alcme
00
00,,t=
0210,
0210ni80
- 1.1]
0L(O-eriXn) Xn)
+ On
a0,=e
00.=c
Dc(0ni)))
89
aL(bm-oii) xx)
aLiOr Xn)
OK
ckn
a0.=c
@C(On,1=ei xn)
+
n1
Ö0n.t=c
(C(Mnix))
-1-1,1]
00,,
1,1
594
09n
D9
(15)
Then, we evaluate the summation of loss for 0 against the boundary or end-point parameters of compressed space.
aL(0m=) x1)
aL(Oi=e)x. Xn)
@L(Or,t=e) X
+
00.mc
06.mc
00,,
8210 0c(0,2)) 09,
D9n
>0.
OC(0m=e; Xi)
aC(0==e; xn)
(0.(0 : Xn)
+ Onn
7/m
a0.-
00.-.
00n.tme
(6(6min))
2C10ainn) 50.
09
09
aL(Or=e) x1)
aL(Ormei Xn.)
OK
Cnn
00.mc
00:-c
OC10p, Xn)
aL(0..-rixi)
Ü0,tz 1/
00, ,t=
acce, 181).
0010 (80) >0.
90,
600
0c xi)
OC ( Xn.
2
Onn
(by Theorem 2)
00m=c
00:=c
aL(On,tzei Xn)
aC r= xi)
+
00
00n.cme
(c(()1))) 06,
(C()nixa) D6n
x1-1.11]
7
00,,
ac(enia)) 68
-1-1.11
06,
(16)
We find that ground-truth interpolated parameter is closer to compressed space than uncom- pressed space. This motivates our work that compressed subspace contains higher density of low-loss interpolated parameters than an uncompressed subspace.
A.2 EXPERIMENT CONFIGURATIONS
A.2.1 ADAPTATION METHODS
Data Augmentation (e.g.. CutMix (Yun al. 2019a or MixUp (Zhang et al. 2018) is common method to robustify models against domain shift (Huang et al. 2018). adversarial attacks ZZng et al.) 2020), and backdoor attacks (Borgnia et al.) 2020). We implement CutMix (Yun et al. (019a), where augmentation takes place per batch, and training completes in accordance with aforementioned early stopping. the case of CutMix, for example, instead of removing pixels and filling them with black grey pixels Gaussian noise, replace the removed regions with patch from another image, while the ground truth labels are mixed proportionally to the number of pixels of combined images. 50% of the defender's allocation of the dataset is assigned to augmentation.
18

---

Under review as a conference paper at ICLR 2023
Adversarial Training is method that increases model robustness by injecting adversarial examples into the training set. and commonly used against adversarial attacks (Goodfellow et al.] (2013). backdoor attacks (Geiping al. 202T,, and domain adaptation (Ganin et (0..)))))) We retain the same adversarial configurations as in the adversarial attack (PGD, e = 0.4). At each epoch, 50% of the defender's s allocation of the dataset is watprrsrrrriillppprrrrrt
Backdoor Adversarial Training (Geiping et al. 2021 extend the concept of adversarial training on defender-generatee backdoor examples to insert their own triggers existing labels. We implement backdoor adversarial training (Geiping et al., 202T). where the generation of backdoor perturbations through Random- Kandom-BadNet BadNet (Dataa & Shadbolt 2022)), where 50% of the defender's allocation of the dataset is assigned to backdoor perturbation, E = 0.4, and 20 different backdoor triggers used (i.c.
allocation of defender's 's dataset for each backdoor trigger pattern (1 0.5) x 0.8 20 )
Fast Geometric Ensembles (Garipov et al., 2018) train multiple networks to find their respective modes such that high-accuracy path is formed that connects the modes in the parameter space. The method collects parameters at different checkpoints, which can subsequently be used as an ensemble. We retain the same model configurations as the clean setting (3-layer CNN), train 5 ensembles on handomly-samples random initializations until the early-stopping condition.
CPS: Sampling
Inferencing w.r.t. the centre of the subspace is denoted as computing a prediction ÿ = ;
with respect to a given input and the centre parameter point-estimate 0 -> t. (the average of the end-point parameters). This form of inference has also been used in Wortsman et al. (2021).
Inferencing w.r.t. an ensemble in the subspace is denoted as computing a mean prediction 5 # Σ3 ((0):8) with respect to given input and M randomly-sampled parameter point- estimates in the subpace (we randomly sample M 1000 interpolation coefficients {ay, J M return an ensemble set of parameter point estimates (07) M = {a,,) JMNN J. For ensemble, we evaluate against the mean prediction. This förm of inference has also been used in Wortsman et al. (202I); Garipov et al. (2018): Fort al. (202)).
M
(lowest-loss) interpolated point-estimate in the subspace is denoted as computing a prediction ÿ = {0)-;
Inferencing w.r.t. the maximum-accurran
; x) with respect to a given input and the lowest-loss parameter point-estimate where j := arg minj--M [();; x, y); this is specifically unique-task solution, where a low-loss parameter maps back to one task/distribution x + 03.. For a multi-task solution, low-loss parameter is mapped back to set of T task/distributions {x+) - 0z-, where 5" := arg min Σ ((0); We linearly- space 50 segments per parameter end-poin pair (resulting in 50 point-estimates to evaluate). There is enough distance between parameter end-points such that the interpolated points are not close approximations of the end-point (further verifiable from Figure 2). Inferencing w.r.t. interpolated points has also been used in Neyshabur et al. (2020).
An additional baseline used in Table 2 is infereneing w.r.t. the lowest-loss boundary parameter in the subspace, denoted as computing a prediction ÿ = [B;.; x) with respect to a given input and lowest-loss boundary parameter, where the latter is the parameter from a set of N boundary or end- point parameters that returns the lowest loss i" == arg min [(0;; y) This baseline informs us whether the lowest-loss interpolated parameter can outperform an uninterpolated SGD-trained parameter. In Table 2 specifically, we do not include the boundary parameters in the interpolated parameters set (interpolation coefficients: [0.0. 1,001,1001110,,11.0000) mutually-exxlusivee and avoid the reuse of the boundary parameter as the lowest-loss interpolated parameter; for example, in case there is another point that can also achieve similar accuracy.
so as to ensure the 2 sets are
CPS: Hypernetworks A hypernetwork fxx, I) f(x; m my: I)) is a pair of learners, the base learner f X' + y and meta learner m.f- I +> θ₁, such that for the conditioning input I of input x (where X' + I), mf produces the base learner parameters Hn function m 1) takes a conditioning input / to returns parameters 0, E O for f. The meta learner parameters and base learner (of each respective distribution) parameters reside in their distinct parameter spaces 6mf E 2m and fj E θ₁. The learner f takes an input x and returns an output ÿ x()):x) that depends on both x and the task-specific input I. T is number of tasks, t is index of specific task being evaluated (t* being current task), w is task regularizer (from von Oswald et al. (2020) implementation). We retain all other implementation configurations, such as the use of Adam
mm 7). The
19

---

Under review as a conference paper at ICLR 2023
optimizer, setting task regularizer = 0.01. 0mg is the hypernetwork parameters at the current task's s training timestep, fn is the hypernetwork parameters before attempting to learn task t", and A0m² the candidate parameter change computed by the optimizer (Adam). Our base learner is the 6-layer CNN. Unlike von Oswald et al. (2020), we wish to retain the assumption of the rest of the paper where we do not require conditioning imputs; hence we do not use any separate conditioning input (i.e. task embeddings), and use the test-time input as the primary argument, i.e. I = X. As such, the lack of use of task embeddings is one of the primary changes to our hypernetworks baseline based on von Oswald et al. (2020). In terms of parameter storage, only the weights of the hypernetwork (and not individual weights of points in the CPS) would need to be stored. As we only adapt von Oswald al. 22200'ss hypernetwork implementation, we use this as our primary baseline, and recommend comparison to other baselines listed in von Oswald et al. (2020).
Starting from a random initialization, we train the hypernetwork first on CIFARIO (this can be interpreted as re-initializing the network with pre-trained weights, which based on findings in Neyshabur et al. (2020) may indicate that subsequent task parameters may reside in shared low-loss basin), and store these parameters fm in a parameter set {0mg.t]" Then we train on a subsequent CIFAR 100 task with the Eqt. loss function, where we compute loss w.r.t. the inputs and current timestep's s parameters, change in loss w.r.t. previous task between using the proposed parameters and the parameters last updated at that task (stored in the parameter set; this is enumerated for all past tasks in sequence), and the distance between the current parameters and all prior parameters. Unlike our prior (multi-task) implementation, (i) we minimize the cosine distance between a current task's parameters against prior parameters sequentially, not in parallel (i.e. the subspace end- and-ooints are sequentially fixed in the parameter space, we cannot dynamically move the subspace towards different region), (ii) we do not gain visibility to all task parameters at once, and (iii) we are computing distance w.r.t. multi-task parameters (i.e. each task's 's parameters is applicable to its own and prior tasks).
No conditioning inputs Adaptation without conditioning inputs is a more difficult scenario; though it used in adapt model parameters when the target distribution changes, is not commonly used when defenses). Detecting when the source distribution is constant (i.e. not used in adversarial/backdoor shift has occurred is major implementation hurdle in most work tackling domain shift and task shift. Conditioning inputs are not used w.r.t. a single test-time distribution (adversarial/backlor but are usually provided in meta/continual learning, or domain adaptation. Many implementations use support sets in domain adaptation (Ganin et al.] [0T6b;; Hoffman et al. [017] Peng et al., 2019 Sun cet al., 2015) and meta/continual learning (Finn et al. al. (017)) literature. The implementations assume a task/domain T, is sampled from task/domain distribution p(T) associated with dataset D,, from which we sample support set D;- = (X,, Y;") and a query set DV =
attacks),
where meta learner computes the optimal model parameters I with respect to Dj in order to predict accurately DJ. The support set distribution approximates the query set distribution here. Other than support/query sets, conditioning inputs can manifest as known/seen embeddings: [Ceung et al. (2019) learns set of parameters for each of the K tasks, where these parameters are stored in superposition with each other. The task-specific models are accessed using task-specific "context" information C₂ that dynamically "routes" an input towards specific model retrieved from this superposition. The context vectors C& are the headers for each task, and they are all orthogonal to each other, hence making no assumption of a metric that can connect or predict these vectors on new or unseen tasks. While there is work that aims to perform unsupervised domain adaptation (Ganin et al. 2016b Zhou et al. 2021), } domain generalization (Arpit et al.) 2021 Cha et al. (021) and unsupervised meta learning (Hsu ct al. 2019: Khodadadeh et al. 2211 9) without explicit conditioning inputs, there is a gap between their performance in an unsupervised setting compared to methods in supervised settings with conditioning inputs. To exemplify the difficulty of inference without conditioning inputs at test-time, we can refer to the gap between correctly detecting near-OOD (inputs that are near but not i.i.d to the input distribution) and far-OOD (inputs that are far from the input distribution) inputs as being outliers. For far-OOD, an AUROC close 99% attainable on CIFAR- 100 (in) vs SVHN (out) (aasrry& & Oore 2020). However, the AUROC for near-OOD is around 85% for CIFAR- (in) vs CIFAR-I0 (out) (Zhng et al. 2020 In other modalities, such as genomics, the AUROC of nea detection can fall to 66% (Ren et al. 2019). Thus, though removing the conditioning input assumption limits the maximum adaptation performance, it a practical and realistic assumption we retain in our evaluation.
20

---

Under review as a conference paper at ICLR 2023
A.2.2 DISTRIBUTION SHIFTS
Training regime Given that a large number of models are trained to evaluate this work (i.e. 3 models trained in parallel per CPS configuration across all results), except for Figure and and Appendix A.3.1 which were trained to the full 5000 epochs, all models trained in this work (including CPS and baselines) are early-stopped when training loss reaches 1.0 (test set accuracy ranging from 55-65%). Though further convergence is possible, we make note of this computational constraint, and recommend evaluating the results in the context of clean test set accuracy presented in tables/figures. All train-time procedures use seed of 1. All test-time procedures use a seed of 100. The exception to both is any use of Random-BadNet (backdoor perturbations used in CPS, backdoor attack, random permutations and labels), where the seed is the index of perturbation set starting from 1. The defender uses a train-test split of 80-20%. For backdoor attack settings, the attacker uses a traintime-runtime split of 80-20%; this means the attacker contributes 80% of their private dataset (of which p, 0.4 is poisoned) to the defender's 's dataset, and we evaluate the backdoor attack on the remaining 20% at test-time (of which 1.0 is poisoned). All experiments were performed with respect to the constraints of 1x NVIDIA GeForce RTX 3070.
Models In-line with work in loss landscape analysis (Fort et al. 2020), we opt to use the minimum model required to fit/generalize a model to a test set. In-line with the implementation of Snoek et al. (015) (to ensure the minimum CNN capcity to fit CIFAR 100 test sets), we train each CNN with a cross entropy loss function and SGD optimizer for the following depth and width variations: 3-layer [16, 16, 16]. 6-layer [16, 16, 16, 32, 32, 32], 9-layer [16, 16, 16, 32, 32, 32, 32, 32, 32], 6-layer-wide [256, 256, 256, 512, 512, 512].
Adversarial Attack We use the Projected Gradient Descent (PGD) attack (Madry et al. 2018). With this attack method, adversarial perturbation rate E, = 0.1. can sufficiently bring down the attack success rate comparable and similar to that of c = 1.0. Hence, we scale the perturbation against an upper limit 1.0 in our experiments, i.e. s, = 0.4 x Eg. We computes perturbations with respect to the gradients of the defender's model (a more pessimistic, white-box attack).
Backdoor Attack Random Permutations As we would like different trigger perturbations and target poison labels, such when sampling 100 non-identical random permutations/labels or constructing 3 backdoored sets for CPS training, we implement Lundom-BadNa (Datta & Shadbolt 2022), a variant of the baseline dirty-label backdoor attack algorithm, BadNet (Gu et al. 2019). Alike to BadNet and many existing backdoor implementations in literature, Random- Gandom-BadNer constructs static trigger. Instead of single square in the corner as in the case of BadNet, generates randomized pixels to return unique trigger patterns. Attackers need to specify a set of inputs mapped to target poisoned labels {X; Y y.poisea } E D; to specify the intended label classification, backdoor perturbation rate E to specify the proportion of input to be perturbed, and the poison rate
poisonn
P: [xclean P|x to specify the proportion of the private dataset to contain backdoored inputs, to return pooison = (X,, y-Poison Pt). In this work, the target poison labels are randomly-sampee the perturbation rate and poison rate are p, 6 = 0.4.
Stylization We use the Adaptive Instance Normalization (AdaIN) stylization method (Huang & Belongie, 2017), which is a standard method to stylize datasets such as stylized-ImageNe (Geirhos ct 2019)) Dataset stylization is considered as texture shift or domain shift in different literature. We randomly sample a distinct (non-repeating) style for each attacker. a is the degree of stylization to apply; 1.0 means 100% stylization, 0% means no stylization; we a 0.5. We follow the
implementation in Huang & Belongie (2117) (211)) and Geirhos et al.) (2019) and stylize CIFAR-10 with the
Paintings by Numbers style dataset. We adapt the method for our attack, by first randomly sampling a distinct set of styles for each attacker, and stylizing each attacker's sub-dataset before the insertion of backdoor or adversarial perturbations. This shift also contributes to the realistic scenario that different agents may have shifted datasets given heterogenous sources.
Rotation At train-time we rotate the N sets according to their respective index out of N: [90, 0, 270, 180, 45, 135, 61, 315 60, 315, 20, 75J. These rotation degrees were hand-picked and intended to be diverse and varied. With seed 3407, At test-time we randeely-sampled 100 seeded rotations: [20, 47, 77, 109, 304, 87, 304, 254, 146, 94, 98, 39, 306. 114, 267, 42, 231, 120, 40, 339, 352, 14, 264, 288, 203, 175, 308, 355, 324, 76, 213, 209, 167, 170, 234, 120, 87, 43, 300, 358, 29, 237, 107, 62, 84, 95, 9, 327, 203, 331, 1, 27, 59, 122, 52, 294, 64, 128, 263, 39, 141, 291, 25, 39, 176, 79, 104,
21

---

Under review as a conference paper at ICLR 2023
243, 265, 166, 270, 113, 23, 65, 297, 19, 196, 134, 119, 169, 42, 178, 250, 253, 276, 354, 291, 298, 20, O, 343, 263, 164, 246, 217, 184, 163, 98].
Task Interpolation We evaluate interpolated tasks by linearly interpolating set of tasks: for a set of tasks { where each task X is a set of inputs x (and the number of inputs per task is identical, i.c. {xr) MaMMMMy ),)) we linearly-interpolate between indexed inputs across task set to return an interpolated task: x=E; E.
M O.T...- In this work, we only interpolate between task sets with identical coarse labels (label-shared), We do not interpolate batches, meaning we do not take a subset of one batch in a task and merge it with another subset of another batch in task (i.e. all inputs are unperturbed, but each interpolated task contains distinct subsets of different task). We do not implement this setting, as we present results on multi-task solutions, which are evaluated on multiple unperturbed tasks with a single parameter point-estimate, thus an interpolated batch setting is already evaluatable.
We linearly-space the range [0,1] into 5 segments (returning 5 different tasks). We ignore the [0,0,0] case, as this results in a black image set, containing no identifiable task-specific features, and thus likely to return random labels- we leave this case out of our evaluation to filter out this noise. For each interpolated image, we clip the colour values per pixel in the range [0, 255]. We keep the [1,1,1] case as, even though it could be all white theoretically, it would only be all white if each and every pixel exceeded 255; in practice (for example, as shown in Appendix 1. pixels may contain colour channel values whose weighted sum per channel may still be less than 255.
We do not interpolate batches, meaning we do not take a subset of one batch in a task and merge it with another subset of another batch in task (i.e. all inputs are unperturbed, but each interpolated task contains distinct subsets of different task). We do not implement this setting, as we present results on multi-task solutions, which are evaluated on multiple unperturbed tasks with a single parameter point-estimate, thus an interpolated batch setting is already evaluatable.
OX
C22
Appendix A.2.1: Samples of interpolated images. The label of the variations of interpolated image across tasks is 4. The task end-points are: 3 tasks, 3 x same coarse label, train-time task set.
Single Test-time Distribution Dataset We use the CIFARIO dataset, which contains 10 classes, 60,0000 inputs, and colour channels (Krizhevsky 2009). For test-time perturbations, we evaluate on 100 different examples and tabulate the mean and standard deviation. For train-time perturbations (hackdoor), we insert single backdoor trigger into the defender set before CPS initiated.
Multiple Test-time Distributions Dataset We use CIFARIO 100 dataset, a common baseline for meta/continual learning settings (Krizhevsky 2009). Similar to CIFAR10 except in that it contains 100 classes containing 600 images each. There are 500 training images and 100 testing images per class. The 100 classes in the CIFARI00 are grouped into 20 superclasses. Each image comes with a "fine" label (the class to which it belongs) and a "coarse" label (the superclass to which belongs). There are at most tasks of the same coarse label (given there are 5 fine labels per class) per coarse label set. For 5-label-per-set tasks, there are at most 5 different coarse label sets available (for 10-label-per-see tasks, there are most 2). To evaluate the use of CPS-regularization in hypernetworks for continual learning, the dataset is used in-line with the Split-CIFARION 10000 setting as described in Zenke et al. (2017) and |von Oswald et al. 2020). N-label-set per task refers to the number of coarse labels contained/mapped in the task; label-lael--set per task means we have 5(10) coarse labels mapped within the task, while 2 x S(10)-label-set per task means we have 5(10) coarse labels mapped within the task but of 2 different fine label sets. (per task) is a distinction from different coarse labels (of the same set), where the former has a unique coarse label set assigned per task (no shared coarse labels across the tasks), while the latter has
coarse labels
22

---

Under review as a conference paper at ICLR 2023
different set of tasks that share coarse labels (but different fine labels). We provide a breakdown of the labels (both coarse and fine) used per task; each task (as a self self-contained training set/dataloader) is indicated by the square brackets [].
(Agpendix A.3.) Seen tasks tasks
label, train-time task [4 (oguatic mammals beaver), (fish aquariua fish), (lowers + orchide) (fond - containers). 0 (fruil and vegetables + appleo]] [30 (squatic mimmuls - delphin), 32 (fih- - faufish)), 62 (Bowers + poppes), (food - bomlss) 51 (fuit and vegotubles - mushroess]], [55 (equatic mammals -+ ofter), 67 (fish - may) 70 (fowers - rosss, 16ffood - bowls) 53 (friit and vegetables - omagges]]
(Appendis A.3.8) Unsee tasks (2 lasks, 2 X same course label but unseen line lbblk: [72 (aquatic mimmals - scal). 73 (fich - shurk), 82 (Bowers - unflower)) 28 food - caps), 57 (ruit and vegetables - pears]] 195 Exquatic mammals - whole), 91 (fis - trom)) 92 (flowrr -+ tulips), 61 peppers)
(food + plates), (fruit and vegetables
x same course label but unseen fine label. 2 X distinclly differen. course labely: [22 (household electrical devices - clock). 5 (houshhold - fumilure), 6 (insects - bec). 3 (large carnivores -+ bear). 12 clarge man-made outdour things bridgel.. 139 boousholld electrical devices computer keybourd), (houeholld - bed), Prinsects beedl)) 42 (large camivores leopardi, butterfly), (large cariivoms - lion). 37 (lage man-made outdoor things - house]]. [23 (large niteral outooor scenes - cloud), 15 (lago comiivores and herbivones -+ camel). 34 (medium sized mammals - fox). 26 (non insect invertebrates - crabi, 2 (peoole - bubyil. (27 (reptiles - crocodile), 36 (small mammall hamster), 47 (irees - maple) (ychicles
(Appendis A,3.8 Unsee lnks (5 unks. x 5-hbbllse set per tadk, 3
(lange man made ourdoor thing- + casile). Dousehold electrical devices lump), (household
chair), rinsects
bicycle), 41 (vehicles - lawn mower))
(Appendix A.3 6) 2 tasks, 2 x same coarse lahel: (4 caquatic mammals =y heaver's (fish - equarium fisht, 54 (fooerss - orchuds), 9 (food -> continers), O druit and vegotables -t apples),. [30 laguatic mammals- - dolphini, 32 (hih - flatish), 62 iflowes - poppies), 10 tfood - bottles. 51 (ruit and vegetables - mushrumms)
(Agpendix A.3.6) makss, 2 x different course label: [4 (aquatic nammals- - heaver), (fish -> aquerium fish), 54 (floerss - orchids), (food - contniners), (truit and vegotables -a apples]]. 122 (bousehold electrical devices - clock), 5 (bousehold - fumiture), 6 (insects - bes), 3 (large carniveess hear), (large mon-made oundoor things hwidge))
(Appendix A 3.5) 2 maks (2 x S-lahel-ser per talk 2 x same counse lahel per tnsk, O x distinctly different course lahel per tnsk): [4 (oquatic mommalss heawers, 30 loguatic meanmals -a dolptin), I (fish =a squarium fishi, 52 (fish -a flatfih)), 54 (fowers - occhidss, 62 (fowerrs poppies), 9 (food contuiners), (food beurles), (frit (squatic nammals - scal), 67 (fish - my) (fish shork), 7D (flowers - moess, (foowrrs - sntfowers)) 16 (food -a bowls), 28 (food - cupo) 53 (frik and vegetables - oranges), 57 (frit and vegetables - peins]
vegetables - apples), 51
and vegetables - mushroomo]. [55 (oquatic mammils
(2 5-label-stt per -> beswerr, (oguntic mommals dolptinn) (fish - squiiim fish), (fish - flutfishi, (fowers - orchids), (fowers - pappies), (foed - containees), 10 (food + bottle), (frit and vegetables - apples). 51 (fritt and vegetables - mushrioms)) [55 (oquatic mammals - octer). 72 (aquotic mammals seal), 67 (fish - my) 73 (lic- shirk). 70 (floerss- peans]]. [22 (bouschold electrical deviees clock). (housdhold electrical devizes - clock), 5 chousebold - fumiture), 20 (houschuld + furniuure), 6 finsects- - bee). 7 Ginsecss- + boe). 3 (lange cariivures - bear), 42 thegge carnivores - bear), 12 (bange man-made outdorr things - bridge), 17 (large man-mude outbor things - bridgei)
(Appendix A.5
same course lahel per tad, distinelly different label per task: [4 (oquatic mommals
82 (flowers - sunflowers) 16 (food - bowls), 28 (food -
cupe), 53 (frii vegatibles- reanges). (frait vegerables
(Apgendix A.3.) tasks x 5-dabel sot per tack. 2 same couns Jabel per task, x distinclly different course label per task:: [4 (aquatic mammals " beaver), 30 laquatic mammals - dolphint. I (fish - aquaiium fishl, 52 (lish - flatish), (flowers - occhids), 62 (Bowers - pogples), 9 (food - contuinees)) 10 (food + bottle), (fruit and vegetbles - apples), 51 (friit and vegetables - mushrooms). [55 (oquatic mammals - octer). 72 seall, 67 (fis oranges). (frait and vegetables - peans]] [22 thousehold electricul devices - clock), (housebold electrical devices -e clock), 5 (household - fumiture) 20 (houschold -e funiture), (insects -a boo), 7 (imeccts -y bee). 3 tlarge carmovores -y bear). 42 (large carnivoces - bear). 12 (large man made cundour things - bridge), (large mas made oundoar things - bridgei), [23 (large natural ourdoor scenes cloud), 33 (large natural ouldoer (medium- mamanals fox), (medium-sized mammals - porcupines, 26 (non-insect investeboutes -h crab), 45 (non-insset inventbrates -> lobster), 2 |peoplc - baby), 11 spoople - boy]]
(aquatic mammals
ifish shark. 70 (flewers
(flowess sunflowers). 16 (food bowist, 28 (food -
cups), (fruit and vegetables
forest) (5arge conivores and herbisores camell, 19 (lare unnivures and bertivores - catlle..
(Appendix 3 tads (1 5 S-abbll set per task, X course labell: (aquatic mummals beaver). I (fish aquarium fish), 54 (flowers- occhidss) (food containess), O (huit and vegetables applea).. (30 (oquatic mammals - dolphin), chish -a flatish) (flowrs - popplest. 10 tfood -n bottles. 51 (fruit and vegetables -y mushrocuss], I. 155 laquzzic mammals- - otter), 67 (fish my ray), 70 (fowers - roses), 161food howls) 53 (frait and vegetables oranges]]
(A (Appendix A.3.7) taoks (1 x S-lahel-set per tack, x some coarse lahet, x different coarse lnbel): (aquatic nammals - beaver), 1 (fish aquacium fish), 54 ifloers -9 orchids), (food -y containees), 0 (fruit and vegetables - applest). [30 taquitic mammals - dolphin), 32 (dish Burlish), 62 (flowers - poppies). 10 (food - bottles, 51 (Frii and vegetables - mushrweess]], [22 (bousehold electrical devices clock). 5 (honsehold furniture) (inseets bee), (luge conivares hear), 12 (luge mon-made oundoer things bridge))
(Appendis A.3.7) 3 tasks (1 X55 5-label-set per task 3 x distinctly different come labell: [4 Coguatic mammals- - beaver), I (fih + aquatium fish), 54 (flwers orchils) 9 (food - comsiners), (frii and vegetables spples). [22 (bouvehold electrica devices clock), 5 (hooschlld - furnium)) (lagge comiveers hear), (large man-trade outdoee things bridge)), (lagg natuml aidoor
clou)), (large ommivvrre and herbivgres- + camel) 34 (medium sized mammals- + fox). 26 (non insect invertebrutes + crub), 2 (people + boby)]
(insects-
(Appendix 5 todks (1 S-label-stt per task, 5 x coarse labell: (aguatic mammals beaver). I (lish aquatium fish), 54 (flowers oechids), (fodd containess) O (fril vegetables apples)] [30 (oquitic mammals delphin).
flatfss)) (fowers poppies). 10 (food- - bottles). 51 (friit and vegotables - mushroms)). [55 (squatic mammals- - olter), 67 (Bih - ray). 70 (lowers - roses), 1606oo - bowb), 53 (frit and vegetables + onnges)]. ]]. [72 Eaquaii mammuls + seall. 73 (lish - shank), 82 (llowes -+ sanllowrrs) 28 (food - cups). 57 druit and vegetables- peans). 195 (aquatic manmall while). 91 (ishh trout, 92 (flowers tulips), 61 (feod - platest, (frest and vegetables sweet peppers)]
(Appendis A.3.7) 5 tasks (1 x S S-Jabel-stt set per task 2 x same coarse label, 3 x distinctly different comme label): [4 (oquatic mammals - beaveri, I tish- squarium fishi (flowers orchids), (food -
truut and vegetables apples)), (oguasic mammals colphin), (fish poppies). 10 ffood bottles, 51 (Iuit and vegetables - mushroems]].. [22 (housebold electrical devices -+ clock), 5 (houschold =a furniture), 6 tinsects =a hee), 3 clage carnivoees o> bear). 12 clagge man-made ouidoor things =a bridge)). 123 clagg notural oundooe scenes -> cloud), 15 (large emniveres and herbiveres - camell, 34 (medium sized mammals - fox), 26 (9on inseet inveriebrates - crab). (people babyil. (27 Ireptile crocodile), 36 small mammals hamster), 47 (trees maple). 3 (vehicles - bicycle). 11 (vehicles 2 2- lawn mower))
flattishl, 62 (Bowers
(Appesdix A.3.7) 5 tusks (1 x S-label-srt per tnok. 2 x same cane label, 3 x diffcrent coanse ltbel of some ser): 14 (aquatic mammals- - heaver), 1 (fish -n equarium fishi, 54 fflowes orchids), 9 (lood -a continess) drua and vegetables - applesi). [30 (oquatic mammais - dolphin), 32 (fish popples), 10 food bottles, 51 (fuit and vegetables
flattishi, 62 (flowes (honseholl -> furnitur), cinsects -> boo). 3 (large carnivoess - hear), 12 (large man-made outdoor things - hridge]] 139 (honschold electrical devices =y clock), 20 thouschold -e fumiture), 7 (insects - bee). 42 tlage caraivores =e bear), 17 tlagg man- made outdoer things - bridge)l. (40) (honschold electrical devices - lamp), 25 (honsehold -a dhair), 14 (insects - Nutterly), 43 (large camivores - lion) 37 (large man-made outdoce things- house))
mushrooms), I. [22 (howsholld electiicl devices clockl,
23

---

Under review as a conference paper at ICLR 2023
A.3
SUPPORTING RESULTS
310
1.
04
tocoeeer
feer
0.30
catime Apri
Ngert ara Same Dytine Dulne
X00 301
1000
2013
3017
1901
0.00
2.01
Audd Eytna So
Pari Sata
3003
Appendix A.3.1: Change in parameter subspace dynamics: Loss and cosine distance per epoch during training of CPS with 3 train-time distributions (3 = 0.0). Perturbation type of train-time subsets are backdoor (column 1), stylization (column 2), rotation (column 3), and task (column 4).
JBM
g14
115
04
Aiii Somi A.3 and
sgyel and
Avet aomeer art Air catr
Eitee will Npr
200
2019
1033
2012
2200
nastin
Caree un date
lotme are Cant
5000
200
3050
2003
1000
Appendix A.3.2: Change in parameter subspace dynamics: Loss and cosine distance per epoch during training of CPS with train-time distributions (3 = 1.0). Perturbation type of train-time subsets are backdoor (column 1), stylization (column 2), rotation (column 3), and task (column 4).
24

---

Under review as a conference paper at ICLR 2023
0.8
0.6
5
0.6
0.6
0.6
0.4
0.4
0.2
0.2
1.0
0.2
0.2
0.0
0.6
0.0
0.6
0.2
0.4
6
0.4
0.6
0.8
1.0
0.0
0.2
0.0
o0
0.6
0.8
0.0
0.2
1.0
1.0
1.0
005.
8.0
0.5 &
4
à
&
à
4
4
0.0
A
0.0 A
A
0.0 A
1.0
0.0
0.5
1.0
0.0
0.5
1.0
ag
af
(a) 8 0.0
1.0
0.8
1.0
0.8
0.8
0.6 %
0.6
0.6 %
0.6
0.4
0.4
0.2
0.2
1.0
0.2
0.8
0.2
0.0
0.6
0.0
0.6
0.4
3-
0.4
0.4
0.6
0.0
0.2
0.0
oy
0.6
0.8
0.0
0.2
1.0 A
1.0
1.0
0.5
0.5
0.5
4
à
A
0.0
A
0.0
A
0.0
1.0
0.0
0.5
1.0
0.0
0.5
1.0
ag
ag
af
(b)
1.0
Appendix A.3.3: Change in parameter subypace dynamics: 3D plot of interpolated input space (left) and interpolated parameter space (right) for parameter spaces trained with 3 0.0 (a) and / 1.0 (b). The gross-sectional diagrams reflect the corresponding points 2D. All colours correspond to the color bar in the figure. We only plot the first-instance (i.e. there may be multiple) lowest-loss/ / maximum-accume mappable parameter in the parameter subspace for each interpolated task.
25

---

Under review as a conference paper at ICLR 2023
CNN
6-lacer CNN
10
2174 1:
004 133
163
18:2 13:11
BOY 2.2
12
CPS (badedoor)
cta (rxea)
31.2
15.7
01.2
144
13.
(badidorr)
coa. (1228)
19.3
12.8
48.8 2.
0227
11.
CPS (eylicotin
ers. (rees)
3.4
573
163
28.6 8- 2.0
338-443 43
CPS (PSliinnial
res (1008))
70. 1.3
315+35 96.9
47.1
tep. (m34)
06.0 50.9
56
18.9
tep. (#x3)
13.1
CPS (sotation)
15.52:1
2
ootation)
0.3
172
1.
005500
45.3 2.5
53.4-
405
$15887
Appendix A.3.4: CPS vs single test-time distributions: The relationship between the type of trained perturbations (backdoor stylization/ rotation), number of perturbed sets, and model capacity.
crene adde par ouk-d diblact diflie
26.3 12.
3.44.0
Tiaker bilictod por wad
395:246
30
308311
035. 19.0)
323
crate viel por sok, dolladdyy Oifie
186-36
16
1.5
2517
30 1:0:1:4.
201222
145. B8g4)
59.7 1.0
885-9445
085=7.
3tadaat par 1ak.
26.7
14
11
Appendix A.3.5: CPS us multiple test-time dis-
145. h1g
574 3-1
83:-2-45
217
tributions: Model depth against distinct coarse label sets.
didirely differe Velll
1455 (1g1
21:3
114
0310
30:22:2
b-Jayer CNN
ure oxre Whrl
1021 1800
0338
36-3
30:22:2
67.7 21.7
10
1:36
11
6:1 13.
some
ens. (mcan)
centre
24.2 + 5.6
17.5
43.2 2.2
37.9 4.6
defteme cone Shel
31263-4 18
1955 (860)
031
3044
61.6 15-1
55.8 M-.
21
2
(max)
62.1 + 97.9
82.7 + 3.5
1951 (S6e)
31. 05
13.7
-9.7-133
1133
0061 13
different
cns. (mean)
30.9 10.8
31.0
+: 11.4
Appendix A.3.7: CPS vs multiple test-time distri-
supp (mun)
62.9 1: 37.1
60.8 + 39.2
butions: Varying model depth against varying task label set diversity (different fine labels, dif- ferent coarse labels).
Appendix A.3.6: CPS multiple test-time dis- tributions: Tasks (sameldifferen coarse labels) against model width.
CPS: 3 taks sane
CPS 1866, 3
CPS kalls sate CRS) kiiis same COROE label b-layr-rkk coRCe label b-layc--rak
coane labal b-kger CNN.
comoE label 6-boxr CNN,
State oudor (3 todo, K2MM coanee lahel trat--inec Balk
212
35.8
Usocee tall bolo sunc DAtW lahe.
(raza)
00.5 810
31
Unaonn wad Takks Slabotio per
13 03
tack sane coand usvon
cn (rana)
14
25.3
differr labed)
Sees talo (3 talo same coare labe.
taae tall
(rsus)
310
02.6 B.
3037 2.
RETE10
Uvoce 1 bolo, sane oars labe
cD. (caza)
1331
(R1 m0
1631 103
06.4
Uiaare wad Takks Sialatie per tack sane cound uscen Los
15
103
cn (raza)
3.3
2
difieer lanel)
05.31
2033 03
Secs talo (3 tallo vanw course labd,
(rsus)
2033411
61.61.
26.7
02.3
2004 1.3
30.5
Unocee (2 solos same doons lahel
(iasa)
C9977
20.
141 TBC
113
1511 103
Unaarn pox Take Kigtaton par
183 TBC
011 103
tokk sanc coune
cD (rama)
18
difiver lanel)
060
Secs talo (3 Iallo SEEK course labd,
(raus)
55.35 11.0
01011 6.1
2:0:200
25.6 W.C
20.5:5
8E7 003
Urove ( sxios sare doreo label
(uans)
10111
181 mTC
1517 103
90.3
Unaarn sar Tale Sigkoran par
191 115
2211
10 103
tork sane conne
(rans)
26.3-m
difiver lanel)
310.100
10.3
Sees talo (3 malo, SERKC counse labd,
cm (rass)
33 333-6.3
3917 5.1
26 1:00
07:3 W.C
20.3 c
-0.5 0/9
123.
Thove (7 Excss care torno ta
(tans))
C9977
18:3 112
91.5
10.9 103
Umaan Gas TREE Sigtoran par
C9977
102 112
21. 2-3
15: 103
sane svene lobel sason labe))
Livi
281-2 333
Appendix A.3.8: CPS vs multiple test-time distributions: Evaluating seen/unseen tasks (varying perturbation types) with CPS of varying over-parameterizatio (number of tasks and model width).
26


Reviews:
[{"review_id": "oCdM_njqpfP", "reviewer": "Reviewer_haBW", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes to learn multiple parameters (with a cosine distance regularization to emphasize the diversity of the learned parameters). During a testing period, one can use the interpolated parameter to increase model robustness. The authors also prove a couple of important theorems that i) a compressed parameter subspace can be learned and ii) the interpolated parameter is a good selection. An extensive set of experimental results are introduced.", "summary_of_the_review": "I think this paper has value since it introduces a new approach to having a robust parameter set. But I have several concerns below:\n\n- Q1) During training, N times larger resources are needed.\n- Q2) The cosine distance regularization may fail to find the compressed parameter subspace.\n- Q3) It is unclear whether or not more advanced optimizers do not break the theorems (due to the momentum of Adam).\n- Q4) Why didn't you compare with other ensemble-based baselines? Since your method also internally build an ensemble of models, it is fair to compare with them.\n- Q5) CIFAR-10/100 are too restrictive environments. Do you have more results in other datasets/tasks?\n- Q6) Why don't we train sequentially to have a better-compressed parameter subspace? Is training in parallel really the best?", "strength_and_weaknesses": "- S1) A new method robust to distribution shifts\n- S2) A theoretical framework to have a robust parameter\n- S3) A simple algorithmic design\n\n- W1) During training, N times larger resources are needed.\n- W2) The cosine distance regularization may fail to find the compressed parameter subspace.\n- W3) It is unclear whether or not more advanced optimizers do not break the theorems.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "_7DyE3Sr8Oy", "reviewer": "Reviewer_jM1a", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This work propose a method to tackle the train-test inconsistent problem, e.g. distribution/domain/task shift exists at test time. The method tries to find a way to linearly combine multi models (obtained from some samples interpolated via train and test data) so that it can adapt to seen tasks as well as unseen interpolated tasks. It’s not a real domain generalization method because the shift in test data need to be known during training.", "summary_of_the_review": "The work needs to be polished more seriously, a lot of mistakes in equations make it difficult to understand the main idea. I think it’s not ready for publishing.", "strength_and_weaknesses": "strength：The work propose to tackle multiple types of distribution shift concurrently, and on some cases the performance is better than augmentation, which may declose a new way for enhance the robustness of a model.\n\nWeakness: the method is not real domain generalization because the shift in test data need to be known during training. The method is complicated, because it needs to train a model for every interpolation type with a specific {alpha}. Typos, especially in equations, makes it difficult to follow the main idea. The performance is much lower than augmentation in some cases. The relationship of this work to \"parameter subspaces\" in the title is not clear.\n\nsome concerns are listed,\n1.It looks more like a model level information combination method rather than the title claimed “compressed”.\n2.Legends in Figure 1 is too small. \n3.The definition 1 is confusing, it says that x^ is a interpolation between x0 and x_i^det, but the equation contains only  x_i^det, the definition of i is more confusing.\n4.Symbol N has two different meaning is not a wise choice.\n5.Bottom of page2, Where does x_i come from?\n6.Page 6 on task interpolation, the equation for x^ , is it true that alpha is only related to index i? why?\n7.Table1, Why the performance of CPS sometimes are better than augmentation and sometimes much worse than augmentation? Especially for the stylization and rotation cases. For CPS with rotation, the performance on clean test set is destroyed seriously, why? \n\n8.What about CPS when comparing to some domain generalization or domain adaptation methods?\n\nTypos:\n1.Page2 “ that can multiple types of”\n2.Algorithm 1, there are two D_i s in row10, what’s the difference?\n3.Algorithm 1, how to compute the loss “cos()” in row 13?\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "G92kzT7zLXy", "reviewer": "Reviewer_326H", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper presents a new finding in subspace by constructing a Compressed Parameter Subspaces (CPS). It is found that a\ngeometric structure representing distance-regularized parameters mapped to a set of train-time distributions can maximize average accuracy over a broad range of distribution shifts.", "summary_of_the_review": "This paper investigates the interesting filed of subspace and CPS. There are some technical concerns and experiment results are not convincing.", "strength_and_weaknesses": "Strength\n\n+ The study of subspace structure gains more insight to various critical aspects of deep learning.\n\nWeaknesses\n\n- Theorem 2 and its proof in A.1 is confusing. With (9), does it mean ∂L(θi; Xi)/∂θi = ∂L(θn; Xn)/∂θn? θi and θn are trained with different train set from {Di}N, why will SGD update them always in the same direction?\n- The main contribution and focus of this paper is \"Departing from constructing subspaces w.r.t. a single/unperturbed input distribution, we investigate the construction of subspces w.r.t. multiple perturbed distributions\". However, the results in Table 1 show underperforming accuracies comparing with models trained with single input distributions. For example, CPS (backdoor) performs better than Backdoor Adversarial Training, but worse in  Stylization and Rotation. CPS (stylization) and CPS (rotation) perform much worse in Backdoor Attack. The effectiveness of CPS is questionable and inconclusive based on the experiment results.\n-\"strong capacity for multitask solutions and unseen/distant tasks\" is not fully supported by experiment results as Adversarial Attack and Random Permutations get better accuracies, but Stylization and Rotation are worse.\n-β is the key parameter to CPS. However, it is not studies sufficiently in the paper. The experiments only include β=0 and β=1.0.\n- N + 1 parameters have to be trained, which is computationally expensive even with parallel training.\n- Please make the texts in Figure 1 larger.\n- Please fix \"that can multiple types of distribution shifts concurrently\"", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject