Efficient local linearity regularization to overcome catastrophic overfitting
Authors: Elias Abad Rocamora
Fanghui Liu
Grigorios Chrysos
Pablo M. Olmos
Volkan Cevher
Venue: ICLR 2024 poster (2024)
Keywords: Fast Adversarial Training
Catastrophic Overfitting
Local Linearity
Primary area: general machine learning (i.e., none of the above)
TL;DR: We propose a local-linearity based regularization term to efficiently avoid Catastrophic Overfitting in single-step Adversarial Training, even for large $\epsilon$ and long training schedules.

Abstract: Catastrophic overfitting (CO) in single-step adversarial training (AT) results in abrupt drops in the adversarial test accuracy (even down to $0$%). For models trained with multi-step AT, it has been observed that the loss function behaves locally linearly with respect to the input, this is however lost in single-step AT. To address CO in single-step AT, several methods have been proposed to enforce local linearity of the loss via regularization. However, these regularization terms considerably slow down training due to *Double Backpropagation*. Instead, in this work, we introduce a regularization term, called ELLE, to mitigate CO *effectively* and *efficiently* in classical AT evaluations, as well as some more difficult regimes, e.g., large adversarial perturbations and long training schedules. Our regularization term can be theoretically linked to curvature of the loss function and is computationally cheaper than previous methods by avoiding *Double Backpropagation*. Our thorough experimental validation demonstrates that our work does not suffer from CO, even in challenging settings where previous works suffer from it. We also notice that adapting our regularization parameter during training (ELLE-A) greatly improves the performance, specially in large $\epsilon$ setups. Our implementation is available in https://github.com/LIONS-EPFL/ELLE.

Published as a conference paper at ICLR 2024
EFFICIENT LOCAL LINEARITY REGULARIZATION TO OVERCOME CATASTROPHIC OVERFITTING
Elias Abad Rocamora" "aangnu Liu Grigorios G. Chrysos Pablo M. Olmos', Volkan Cevher
'LIONS- École Polytechnique Fédérale de Lausanne, University of Warwick University of Misconsin-Madison, *Universidad Carlos III de Madrid
ABSTRACT
Catastrophic overfitting (CO) in single-step adversarial training (AT) results in abrupt drops in the adversarial test accuracy (even down to 0%). For models trained with multi-step AT, it has been observed that the loss function behaves locally linearly with respect to the input, this is however lost in single-step AT. To address CO in single-step AT, several methods have been proposed to enforce local linearity of the loss via regularization. However, these regularization terms considerably slow down training due Double Backpropagation. Instead, in this work, we introduce regularization term, called ELLE, to mitigate CO effectively and efficiently in classical AT evaluations, as well as some more difficult regimes, e.g., large adversarial perturbations and long training schedules. Our regularization term can be theoretically linked to curvature of the loss function and is compu- tationally cheaper than previous methods by avoiding Double Backpropagation. Our thorough experimental validation demonstrates that our work does not suffer from CO, even in challenging settings where previous works suffer from it. We also notice that adapting our regularization parameter during training (ELLE-A) greatly improves the performance, specially in large setups. Our implementation is available htttt:://///. /gtthbbttthbbh/hh com/ com/LIONS LIONS- (FFL/ELLE
INTRODUCTION
Adversarial Training (AT) (Madry al. 2018) and TRADES (Zang et al.) (019) have emerged as prominent training methods for training robust architectures. However, these training mechanisms involve solving an inner optimization problem per training step, often requiring an order magni- tude more time per iteration in comparison to standard training (Xu et al.) 2023). To address the computational overhead per iteration, the solution of the inner maximization problem in single step is commonly utilized. While this approach offers efficiency gains, it is also known to be unstable
(Tamer et al. 2018 Shafahi et al. 2019 Wong et al. 2020 de Jorge et al. 2022).
Indeed, the single-step AT approach results in the so-called Catastrophic Overfitting (CO) as the adversarial perturbation size e increases (Wong et al., 2020 (Andriushchenko and Flammarion (220))
CO is characterized by a sharp decline (even down to 0%) multi-step test adversarial accuracy and a corresponding spike (up to 100%) in single-step train adversarial accuracy.
An important property of adversarially robust models is local linearity of the loss with respect the input (Ross and Doshi Velez 22018] Simon-Gabried et al.) 2019 Moosavi-Dezfooll et al. 2011) Qin
al. 2019 Andriushchenko and Flammarion (2020) Singll al. |021 Srinivas al. [022 Li and
Spratling 2023). Explicitly enforcing local linearity has been shown to allow reducing the number of steps needed to solve the inner maximization problem, while avoiding CO and gradient obfuscation
QQin et al. 2019 Andriushchenko and Flammarion, (020).. Nevertheless, all existing methods incur a x3 runtime due to Double Backpropagation (Etmann) 2019) Given this time-consuming operation to avoid CO, a natural question arises:
Can we efficiently overcome catastrophic overfitting when enforcing local linearity of the loss?
"Partially done at Universidad Carlos III de Madrid, correspondance: e elias www.drocamooaaeppllcccom Partially done LIONS-EPPT.

---

Published as a conference paper at ICLR 2024
16
Method
AA
Clean
AA
Clean
04
LLR
42.18 1 (0.20)
75.02 1 (0.09)
16.92 1.992.1100 (0:20)
42.81 (9.62)
T100
CURE
13.60 + (0.17)
77.74 (0.11)
18.25 4 (0.45)
52. (0.04)
GradAlign
44.66 = (0.21)
80.50
(0.07)
17.46 (1.71)
44.35 + (16.32)
ELLE
42.78 1 (0.95)
80.13 1. (0.32)
18.28 1: (0.17)
59.73 = (0.16)
ELLB-2 A
10.32 # (0.04)
79.81 (0.10)
18.03 2 (0.15)
59:21 (1:23)
AT PGD-10
46.95 1 (0.11)
79.11 1: (0.08)
24.77
(0.26)
59.64 (0.46)
CURE
(a) Runtime comparison
(b) CIFARIO
Comparison against single-step methods enforcing local linearity. We train with method ELLE and its adaptive regularization variant ELLE-A. The multi-step AT PGD-10 results included for comparison. We measure (a) the average total runtime and FGSM training as the fast but 0% AA accuracy baseline. (b) The clean and AutoAttack accuracies. We mark the best method and the runner-up in bold and underlined respectively. Our methods, ELLE and ELLE-A, attain the best or comparable AA accuracy while employing less than 50% of the time of previous methods.
Figure 1:
In this work, we answer this question affirmatively. In particular, propose Efficient Local Linearity Enforcement (ELLE), a plug-in regularization term that encourages local linearity, which is able to obtain state-of-the-art adversarial accuracy while avoiding CO. Our algorithm is based on key property of locally linear functions. Let Ba, 2hh E X' C Id with X' a convex set, the function R is locally linear X if and only if:
h: Rdd
h((1 aa) Ia + a xb) ) = (1 a)) h(xa)) + a h(xz)) Va [0,1], Va,, Ty X.
(I)
Our method is based on enforcing Eq. ① for the loss function L, uniformly in the convex set {x : || -0,,=,l... 2: S }} around training points 2;.
Our main contribution is the proposition of novel single-step AT training paradigm ELLE based on the principle of the local linearity of the loss. Our regularization term does not require differentiating gradients and avoids Double Backpropagation, representing a much more efficient alternative the existing methods, see Fig. la Besides, we theoretically analyze the relationship between the local, linear approximation error ELLE and the curvature of the loss. This allows detecting the appearance of CO when the local, linear approximation error suddenly increases and avoid CO when regularizing this measure. We evaluate ELLE on popular benchmarks CIFARIO/100, SVHN and ImageNet. In particular, for the PreActResNet188 architecture, N-FGSM increases its AutoAttack accuracy from 21.18% to 26.35%, see Table
22/255 when adding our regularization term,
A side-benefit of our method is that ELLE can overcome CO for short and long training schedules (see Sec. 4) and small and large e, whereas other single-step AT methods suffer from CO for long schedules and/or large We denote this phenomenon as Delayed CO. see Sec. 4.1 Moreover, find that adapting our regularization parameter to the local linearity of the network during training (ELLE-A) and combining with other methods GAT (Sriramanan al. 2020) N-FGSM (de Jorge
ct al. 2022) helps avoiding CO and improves their performance, specially for large e, see Sec. 4.5
Notation: We use the shorthand [n] == 21, n) for a positive integer n. We use bold capital (lowercase) letters, e.g., X (x)) for representing matrices (vectors). The j column of matrix X is given by æ.y. The element in the 7th row and 7th column is given by Zıj, similarly, the 7th element of a vector æ is given by Ti. The loc. and lp norms of vector x E Rd for S p oo are given by: 1/p
respectively. Lastly, denote the closed ball centered at æ, of radius e in the E, norm as B B[x, pl = {z: : || =1|p S {c..
||0||oo maxie(d [ and ||=||, (IL lx()))
BACKGROUND AND RELATED WORK
In Sec. 2.1 we summarize the challenges of making Robust Training computationally efficient and in
Sec. 2.2 cover the efforts towards addressing them. We assume dataset (2 1 sampled from unknown distribution D in the space [0, 1]d [o], where is the number of classes.
2

---

Published as a conference paper at ICLR 2024
2.1 COMPUTATIONALLY EFFICIENT ROBUST TRAINING
In order make AT computationally efficient, several approaches have been proposed. In Free AT (Shafahi et al. 2019). the network parameters and adversarial perturbation á are simultaneously updated for several steps within the same batch. In Fast AT (Wong al. 2020). single step FGSM attack (Goodfellow et al., 2015) is performed at a randomly sampled point æ + with n Unif( -n, E). These methods alleviate the cost of solving the inner maximization problem and considerably speed up training.
2.2 CATASTROPHIC OVERFITTING (CO)
The speed up in single-step AT emerges cost. As initially found by Wong et al. (2020) for standard FGSM training, and later reported by Andriushchenko and Flammarion (2020) in Free AT and Fast AT. Adversarial test accuracy dramatically drops (even sometimes) within a few epochs. This phenomenon is known as Catastrophic Overfitiing (CO). Several efforts have been made towards understanding CO (Li al., 22020 Andriushhhenko and Flammarion, 2020) Kim et al.) 2021 Ortiz-Jimenez et al., 2023; He et al.] (003)) with a sudden change in the local linearity of the loss with respect to the input as the most common explanation. In the following, we summarize the methods aiming at avoiding CO:
Regularization based. Andriushchenko and Flammarion (2020) propose GradAlign: penalizing gradient missalignment to avoid CO. QQn et al. (2019) propose LLR: regularizing the worst case of the first order Taylor approximation along any direction || 00 I e. However, the computation of the gradient of the regularization terms in Grad Align and LLR with respect to the model parameters involves Double Backpropagation (Etmann 2019). which leads to a 3x per-epoch training time in comparison to FGSM training. More recently, [Sriramanan et al. (2020) propose GAT, new regularization term and attack hased on penalizing the difference between logits at the training point and random sample. |Sriramanan al. (202I) introduce a regularization term penalizing the nuclear norm of the logits within the batch. Nevertheless, GAT and NuAT still suffer from CO under larger (de Jorge al. 2022).
Noise based. Tramer et al. (2018) add random noise prior to the gradient computation in FGSM training. WWng
(2020) revisit FGSM training and show that adding random uniform noise the input before the FGSM attack makes single step AT plausible (Fast AT). Nevertheless, it was later shown that for larger adversarial perturbations (c), Fast AT suffers from CO (Andriushchenko and Flammarion] 2020). In the same direction, de Jorge et al. (2022) find doing data augmentation by adding random noise ||>] l.x < 2 e makes FGSM training feasible. We find N-FGSM suffers from CO for large and/or long training schedules, see Figs. 3ndd 4
202T) perform adversarial attacks in the latent space. Tsiligkaridis and Roberts (2022) propose using Frank- Wolfe optimization for AT and link the distortion of the loss landscape with the lg norm of the adversarial perturbations. [i et al. (2022) tackle CO by constraining the subspace given by the principal components of AT trained weights. /Zhang ett al.] (2022b) reformulate the AT problem as a Bilevel Optimization problem and propose single- step approach solve it. Golgooni al. (2023) propose setting zero the adversarial perturbation coordinates that fall bellow threshold, however de Jorge et al. (2022) show this leads to a performance degradation for large c.
Other. Park and Lee
network weights
METHOD
In this section, we firstly introduce regularization term and training algorithm, ELLE(-A), which efficiently enforces local linearity of the loss function to avoid CO. Sequentially, we elucidate the benefits of our algorithm when compared to previous methods.
3.1 ALGORITIIM DESCRIPTION
Motivated by Eq. ( our regularization term is designed to enforce local lincarity, which can be described by the local, linear approximation error:
3

---

Published as a conference paper at ICLR 2024
Algorithm 1 ELLE (ELLE-A) adversarial training. Pseudo-code in teal is only run for ELLE-A and a represent the mean and standard deviation respectively.
1: Inputs: epochs # batches M, radius e, regularization parameter À and decay rate 7.
2: err list I], Amaa A. =0
3: for = ".....TT. T do
4: for i ,...., do
M
5:
#FosMM = x + sign (Vo:L(f((z')
Standard FGSM attack
6:
sy oi ~ x² + Unif (l-)
Random samples
7:
Unif 1[)
8:
Fe = (1 11-0) a)) x + a zi
D Linear (convex) combination of at and ag Emn ((fo( (x=))²))) y²) (1- (1-a)- ((fo(z)). - a [(fo(z)).))))
9:
10:
if Emm > flen list) + 2 o list) then À Amax
11:
else = 7
12:
err list = err Jist + [inn]
e VeL(fo(#AcMM): y") + Aio
Compute parameter gradients
14:
0 optimizer(0.. Vo)
Standard parameters update, (e.g. SGD)
Definition 1 (local, linear approximation error). Let h Id -> R2, the local, linear approximation error of h at B[z, e, p) for S S oc is given by:
Egin xc p.c)
[] a) va (a..0) 1b) (1 a) h(xxa) a h(x)))l2) (2)
(nt. Un-lf (0.
Our goal is to minimize Eq. Our algorithm, ELLE, and its adaptive regularization variant, ELLE-A, are described in Algorithm [ ELLE(-A) combine single step FGSM attack with regularization term consisting single (æa, Lb, -samle for Eq. (2) with h as the Cross-Entropy loss, see line 9 in Algorithm Furthermore, the geometric intuition behind our proposed local, linear approximation error is presented below.
Adaptive local linerarity regularization (ELLE- A): In the initial 15 epochs in Fig. the network trained with ELLE reports x 10 smaller Egn than the one trained with FGSM. Nevertheless, in these early stages FGSM training has not suffered from CO yet. This suggests regularization not needed all the time across epochs. In order
less invasive regularization scheme, we propose adapt across steps. ELLE-A adapts the value of the regularization parameter X in order to perform a less invasive regularization,
teal color in Algorithm Since CO appears when the loss suddenly becomes non-locally-linear (see Fig. [an Andriushchenko and Flammarion (2020)), we propose initializing À = 0 and increasing to À Amax every time an unusual value of Ejin is encountered, this adaptive strategy is depicted in teal in Algorithm
3.2 THEORETICAL UNDERSTANDING
The local, linear approximation error can be linked with second order directional derivatives when evaluating smooth-enough functions. To this end, we define the second order directional derivative.
Definition (Second order directional derivative ()(()()))), Let h E (RR))) be a twice differen- tiable mapping, the second order directional derivative of the 8th output h2 along direction v at input given by:
(ha(()))) = V (x))v.
In the case of three times differentiable classifiers, we have the following connection of our regular- ization term with the second order directional derivatives, with the proof deferred to Appx. C
Proposition 1. Let h E C (RR)) be three times differentiable mapping. Let E (h, x, P, c) and D2 (z)( be defined as in Definitions and and (b)())()))) E To be the vector containing
4

---

Published as a conference paper at ICLR 2024
the second order directional derivatives along direction for every outpur coordinate of h. Then, the following relationship follows:
(II--=2-" Da 2, (1(h(aa)) + O(I m0ll")
(h, (TP,))
E
(4)
(n (0.1
where Be = (1 - Ca a Th.
D2_-20 Remark 1. More accurale approximations of D wg and their corresponding local, linear ap- proximation error definitions can be obtained by utilizing more than 3 points. Nevertheless, in our experiments we observe that 3 points are enough to overcome CO. An analysis with more than 3 points is available in Appx.
Proposition builds a connection between our regularization term / local, linear approximation error and second order directional derivatives, i.e., curvature. Even though curvature is not defined for popular classifiers living in C such as ReLU NNs, other popular architectures such as Transformers or NNs with smooth activations living in C indeed have curvature and our method will be implicitly enforcing low-curvature for them. Moreover, for C classifiers, it might not be computationally feasible compute D3 - (h,(3re) whereas our regularization term is efficiently computed. In Sec. 3.3 3.3 we compare our method with other methods directly enforcing local lincarity. We perform similar analysis with the LLR regularization term (Qin et al. 2219) Appx. C
however LLR is much more expensive regularization term shown in Fig. We further analyze other possible regularization terms in Appendices B. and B.14
3.3 COMPARISON WITH EXPLICIT LOCAL-LINEARITY ENFORCING ALGORITHMS
Relating local linearity with robustness, Simon-Gabriel
2001 : Ross and Doshi Velez (2018)
propose penalizing the gradient norm at the training sample, i.e introducing the regularization term
V |V
(z)) y) Similarly. Moosavi-Dezfoool et al. (2019) propose CURE: the regularization
x v) V Vaoaa ÖFGSM), w)ll Similarly to analysis in Proposition Moosavi-Deztool et al. 2019) relate their regularization term to Finite Differences approximation of curvature. The regularization term in GradAlign is given by:
term
[
1 cos V ((f((())))) VaC(fo( + n). v),, ~~ Unif[ cc
(5)
where cos [1,
u uvv
is the cosine similarity. Sriramanan et al. 2020) propose GAT: regu-
Vu' Vuuuuue u.u larizing [z)) fo + m)l with n ~ Bern([ccc]] where Bern denoted as the Bernoulli Sriramanan et al. (2021) introduce NuAT: regularizing [[fo(x)) fo(æ + n))...
distribution.
Bern([-e,e]1) The GAT and NuAT regularization terms can be thought of enforcing the network to locally constant, a specific case of local linearity. Qin et al. (2019) propose LLR:: solv- max [C(fe(( + 6),)) ((fe(x), 8
ing 7(e, x))
Vv Cx x v)]. obtaining ÖLLR and
||6 1181...ee
regularize (y x) VeL(ff(( y). Proposition 3 similar result in Proposition iis proven for LLR. We argue all of these methods either involve differentiating input gradients (V.T.) with respect to the network parameters and therefore suffer from Double Backpropagation or donnot avoid CO. Our method, ELLE and ELLE-A, do not suffer from this computational inefficiency and can as well avoid CO, being therefore a more efficient alternative.
EXPERIMENTS
In this section, we conduct thorough validation of the proposed method: ELLE(-A). We introduce the experimental setup in Sec. 4.. Firstly, we demonstrate the effectiveness Ein in detecting and controlling CO in Sec. 4.2 Next, we compare the performance of ELLE(-A) and related methods enforcing local linearity in Sec. 4.3. In Sec. 4.4 we compare against single-step methods in CIFAR10/100 and SVHN over multiple and training schedules. In Sec. 4.5 we analyze the performance of other single-step methods when adding our regularization term. Lastly, in Sec. 4.6 analyze the performance of our method in the ImageNet dataset.
5

---

Published as a conference paper at ICLR 2024
BLLEA
08
PCD-20
107
Mosiligmmee
10:4
02-
10
60
00"1
Epoch
Epoch
Epoch
(a) Test accuracy
(b) Eq. (log-scale)
Definition
| log-scale)
Figure 2: Effectiveness of our local-linearity metric for detecting and controlling CO. We train with AT PGD-I0, single step FGSM attacks and our method without (ELLE) and with (ELLE- A) adapting Ả at e = 8/ 8/255 in CIFAR10. We track: (a) the clean and PGD-20 test accuracies, (b) the GradAlign regularization term and (c) our regularization term, PGD-10 able to produce locally linear models, see (b), (c). Our regularization term accurately detects when CO appears and when regularized, able to avoid CO. ELLE A is able to attain a higher robustness than ELLE.
4.1 EXPERIMENTAL SETUP
We train the architectures Nr (PRN), ResNet50 (He et al. 2016) and WideResNNet28-11 (WRN) (Zagoruyko and Komodakis 2016 in CIFARIO/100 (Krizhevsky) 2009). SVHN (Netzer et al. 2011) and ImageNet (Deng et al. 2009). For CIFAR1O and SVHN, we train and test with values up to 26/255 and 12 255 respectively, as suggested by Yang al. (2020) for the minimum Test-Train separation. For CIFARI 100 and ImageNet we train up to e
26/255 and e 8/255
respectively. We the SGD optimizer with momentum 0.9 and weight decay 5 10-1
We are interested in which values and training schedules lead to CO. We coin the term Delayed CO.
Observation (Delayed Catastrophic Overfitting). training method suffers from Delayed CO if one of the following phenomenons is obxerved:
(Perturbation-vie wise) With the same scheduler. CO is avoided for a perturbation size e,. but not for a bigger one 62 >> 61-
(Duration-wiss With the same perturbation size c, CO avoided for an scheduler of L1 epochs, but not for an scheduler of L2 > L1 epochs.
Our observation provides name to the previously observed behavior in methods like FGSM AT, Free AT, Fast AT, GAT or NuAT (Andriushchenko and Flammarion 2020 Li al. 2020 Kim et al.)
2 de Jorge et al. 2022). To assess the appearance of Delayed CO, we distinguish between two
main training schedules:
Short: From Ändriushchenko and Flammarion (2020), with 30 and 15 epochs for CIFAR 10/100 and SVHN respectively, batch size of 128 and cyclic learning rate schedule with a maximum learning rate of 0.2.
Long: From Rice et al. (2020), with 200 epochs, batch size of 128, a constant learning rate of 0.1 for CIFARIO/100 and 0.01 for SVHN, decayed by a factor of 10 at epochs 100 and 150.
For ImageNet, we use the 15-epoch schedule in Wong et al. (2020). The À selection for our method and its variants is done with a simple grid-search and its deferred to Appx. B We evaluate the adversarial accuracy with PGD-20 and AutoAttack (AA) (Croce and Hein 2020a) the Eo norm. To avoid unnecessary overhead, we remove the 1/255 factor in e in our tables and figures. In our tables, we highlight red the experiments where CO appeared for at least one run and mark the best method and the runner-up in bold and underlined respectively. ImageNet experiments were conducted a single machine with an NVIDIA 100 SXM4 80GB GPU. For the rest of experiments used single machine with an NVIDIA 1000 SXM4 40 GB GPU.
4.2 LOCAL, LINEAR APPROXIMATION ERROR DETECTS AND CONTROLS CO
We firstly analyze the effectiveness using Definition I as a regularization term for controlling CO. To do so, two questions should be answered: Does the local linear approximation suddenly

---

Published as a conference paper at ICLR 2024
increase when CO appears? Does CO disappear when regularizing the local, linear approximation error? In the following we answer both questions affirmatively.
We train PRN CIFARIO with the Short schedule and FGSM attacks at 8/255, setup where CO appears (Wong et al. 2020). We put AT PGD-10 10 results as a reference. Additionally, we train with our method, ELLE, and its adaptive variant, ELLE-A with À 5, 000. We compare the value of Eqs. (2) and (5) and the clean and PGD-20 test accuracies per epoch. As expected and originally analyzed by Andriushchenko and Flammarion 2020). AT PGD-10 maintains low local curvature of the loss during training.
CO detection and avoidance with ELLE: In Fig. 2 observe that for FGSM training, our local, linear approximation eπror correlates with the gradient misalignment (Eq. ) spikes and the PGD-20 test accuracy drops. This verifies that the local, linear approximation error good CO detector. Additionally, when training with ELLE and ELLE-A, both the gradient misalignment and the local, linear approximation error remain close to zero, i.e., the network remains locally linear. Moreover, PGD-20 test accuracy follows stable growth across epochs.
4.3 COMPARISON AGAINST METHODS ENFORCING LOCAL LINEARITY
In this section we compare ELLE(-A) against Grad CURE and LLR. To avoid the expensive computation of y in LLR, regularize (C(fo(æ x + 6), y) (a)) y) 8 (=.((f(()))))) and randomly sample
Unif (I-c, similar approach as in GradAlign and our method (Algorithm D. We train PRN on CIFARIO with the Short schedule e = 8/255 and measure the clean accuracy, AA accuracy and total training time.
Faster local linearity regularization: In Fig. Ia| we observe ELLE(-A) adds very little overhead to FGSM training, i.c.. in total 5.06 min with FGSM v.s. 6.29 min with ELLE(-A) and is considerably faster than other methods enforeing local linearity such as GradAlign, with 15.89 min. In Appx. B.7 the runtime of the forward and backward passes is analyzed separately, showing the increased backward time in LLR, CURE and GradAlign due to Double Backpropagation. In Fig. Tb we can firstly observe that our adaptive regularization variant (ELLE A) greatly increases the performance when compared to ELLE at e = 8/255, e.g., 42.78% v.s. 44.32% AA accuracy. This performance boost can also be observed in Fig. 2 ELLE and ELLE-A match the performance of other methods at e = 8/ 8/255, e.g. 44.66% and 44.32% for GradAlign and ELLE-A respectively and for = 16/255, e.g. 18.25% and 18.28% for CURE and ELLE respectively.
4.4 COMPARISON AGAINST SINGLE-STEP METHODS
Next, we analyze the performance of ELLE in comparison to state-of-the-art single-step AT al- gorithms. We train PRN networks with N-FGSM, GradAlign. SLAT (Park and Lee 2021). Fast BAT, LLR, ELLE-A and ELLE-A jointly with the data augmentation scheme in N FGSM, i.e., N-FGSM+ELLE-A A. The expensive but reliable AT PGD-10 (Madry et al., 2018 is plotted as a reference in the short schedule. We use the Short schedule and the Long schedule. We use the recommended hyperparameters for each method. We average the performance over 3 random seeds.
Short schedule benchmark: In Fig. we can observe SLAT suffers from CO for 2 4/255 and é 2 10/255 for SVHN and CIFAR 10 respectively. GradAlign attains sub-optimal performance for >> 16 in CIFARIO and behaves erratically in CIFARI00. Only the methods involving our regularization term are able to overcome CO for all c and datasets. Note that N-FGSM suffers from CO for e > 18/255 in CIFAR100. Further, N-FGSM+ELLE consistently attains the best performance. It should be possible to attain similar performance to ELLE(-A) with GradAlign, but, we could not find a hyperparameter selection attaining matching ELLE-A for large c. This tuning difficulty was also reported by de Jorge et al. (2022). We report additional results showing the sensibility of GradAlign to hyperparameter changes in Appx. B.3 Overall, our regularization term contributes to closing the performance gap between single-step methods and the multi-step reference AT PGD-10.
Long schedule benchmark: In Figs. 4a and 4b N-FGSM is affected from CO for large c, i.e., 2 8/255 and 2 255 for SVHN and CIFAR10 10 respectively. Fast-BAT is also affected by CO for all e in CIFARIO except E {1, 10) /255. Contrarily, ELLE does not suffer from CO in any setup. Additionally, when adding our regularization term N-FGSM (N-FGSM+ELLLE-)) CO is
7

---

Published as a conference paper at ICLR 2024
Table 1: ImageNet results: We report the PGD-50-10 and clean test accuracies. ELLE-2 helps
avoiding CO and when combined with N-FGSM provides the best performance at 8/255.
2
8
Method
PGD-50-10
Clean
PGD-50-10
Clean
FGSM
42.61 + (0.13)
63.66 (0.07)
5.23 + (4.15)
48.85 (4.70)
N-FGSM
44.54 (0.30)
61.11 (0.17)
13.32 = (1.21)
43.29 + (1.41)
ELLE-A
41.49 (0.39)
=
12.40 - (1.78)
42,40 (6.36)
N-FGSM+ELLE-A
42.20 + (0.52)
58.95 + (0.43)
14.58 + (1.10)
38.04 + (3.31)
avoided for all e in both SVHN and CIFARIO. We identify ELLE-A attains a lower final PGD-20 accuracy than ELLE due robust overfitting. To complete the analysis, we train WRN architecture in CIFAR10 with E {8/28 (8/255, 16/255, 26/255) /25), observing that the Long schedule, N-FGSM suffered from CO for 26/255 while ELLE remained resistant, see Fig. 4c
4.5 REGULARIZING OTHER SINGLE-STEPP METHODS
In this section we study the performance of N-FGSM and GAT (Sriramanan et al. 2020) when combined with ELLE-A. We train PRN and WRN architectures in the CIRFARIO dataset (16, 20/226/2555 255 and report the clean and AA accuracies. In Fig. 5 we observe the performance of GAT and N-FGSM is matched appeared. Noticeably, the performance increased from 20.54% to 21 28% with WRN and N-FGSM 16/255 and from 10.96% to 12.03% with PRN and N-FGSM at 26/255. Interestingly, there was one case where simply changing the architecture from PRN to WRN made CO appear, ie.. N-FGSM c 26/255. This suggests architecture might play role in the appearance of CO. Nevertheless, when adding ELLE-2 A, CO was avoided in every setup. This favours the addition of ELLE-A regularization when the appearance CO is unsure or performance in large e crucial.
increased in every setup, specially in the cases where CO
4.6 IMAGENET RESULTS
We train ResNe150 with the training setup of Wong et al. (2020) with the only difference that as de Jorge 2022). we consider a maximum image resolution of 288 288. We compare the PGD-50- 10 adversarial accuracy when training with FGSM, N-FGSM and ELLE-A
In Table D we observe that FGSM suffers from CO for e 8/255, while ELLE-A does not suffer from CO for any e. Moreover, our method improves the performance at = 8/255 when in combination with N-FGSM, i.e., from 13.32% to 14.58% PGD-50-16 10 accuracy.
0.2
ai0ba1 Aac
POD 20 Ave
PGD Aot.
2
10
(a) SVHN
(b) CIFARIO
(c) CIFARI00
Figure Catastrophic Overfitting in the Short schedule: Comparison our method against single-step methods and AT PGD-10 10 on (a) SVHN, (b) CIFAR10 and (c) CIFAR 100. ELLE-A. and N-FGSM+ELLE are the only single-step methods avoiding CO while attaining high performance for all and datasets.
8

---

Published as a conference paper at ICLR 2024
N-KSSM
Past BAT
BLLE
BULBS
N-KGMMHLLEA
0.5
PGD 20 Ave.
N-FGSM
ELLE
41.86 (0.02)
39.41 + (0.33)
16
13.75 1 (1.15)
18.82 (1.84)
0.2
26
0.00 (0.00)
14.25 (1.74)
0.0
0.0
10
12
20 22 26
(a) SVHN
(b) CIFARIO
(c) WRN in CIFARIO
Figure 4: Catastrophic Overfitting in the Long schedule: We report the PGD-20 adversarial accuracy for the PRN architecture in (a) SVHN and (b) CIFARIO. In (c) we report the PGD-20 adversarial accuracy for the WRN architecture trained in CIFARIO with the Long schedule. N-FGSM suffers from CO in both SVHN and CIFAR1O datasets for > 6/255 and > 16/255 respectively. ELLE remains resistant to CO in all setups.
5 CONCLUSION
We propose a cost-effective regularization term that can prevent catastrophic overfitting (CO) in single-step adversarial training (AT) by enforcing local linearity. We establish relationship between our regularization term and second-order directional derivatives, demonstrating that the proposed regularization implicitly smooths the loss landscape. Our regularization term can detect CO and more efficient in avoiding CO than GradAlign and other methods enforcing local linearity. We conduct thorough evaluation of our method with large adversarial perturbations, long training schedules and in combination with other single-step methods. Our regularization term is a simple plug-in useful when the appearance of CO is unsure and to improve the performance in large
The main limitation of our method is the need to run a forward pass on three extra points per training sample, resulting in additional memory usage. Previous methods enforeing local linearity only need one extra point per training sample but incurr in a x3 runtime (Simon-Gabriel al. 2019 Ross and Velez 2018 Moosavi-Dezzoolli al., 2019] Qin et al., (019). Our method is considerably faster overall as we observe in Fig. [ We leave the search of more memory efficient methods for enforeing local linearity as future work.
Limitations:
Future directions: Our method is able to overcome CO and greatly improve the performance in large scenarios, see Fig. 3 Large values have been sparsely utilized before and generalization is attained (Andriushchenko and Flammarion 2020 de Jorge et al., (022). However, whether classifier should be robust for a certain image and (large) perturbation budget e unknown and requires human in- tervention. AAddepali et al. (2022) find attacking images with low contrast with large e can lead in a flip in the oracle's prediction. Yang et al. (2020) provide upper bounds up to which 100% adversarial accu- racy is theoretically achievable, nevertheless, these bounds might not be realistic for a human oracle. In Appx. [. [p]] we display large e attacks and find no perturbation clearly changes the human oracle predic- tion. We believe though that studying the upper bounds is needed for advancing the CO and AT fields.
N-PGSM
GAT
Method
Model|
AA
Clean
AA
Clean
0.201
GAT
0.54 + (0.53)
78.02
[0.25)
0:01
(0.00)
84.35
(0.34)
GAT+ELLE-A
(4.63)
65.71
12.18)
(2.79)
0.15
N-FOSM
20.59 (0.21)
61:24 (0:26)
10:96 + (0.26)
37
(0.32)
N- F-SSM-ELLE-A
20.48 + (0.57)
61.21 = (0.14)
12.03 (1.02)
26.77
(3.25)
UG0 20
00.00
AT PGD-1O
24.77 (0.26)
59.64
(0.46)
14.42
(0.00)
34.90
(0.61)
Bastin
GAT
0.95 2: (0.09)
84.09
(0.10)
0:00
(0.00)
89.01
(0.28)
HELEAA
GALEELLE-A
17.30 +: (1.20)
64.27
(3.56)
6.74 4 (2.08)
42.04 = (10.5)
N-HGSM
(1:24)
X-FOSM+ELLE-A
21.28 = (0.07)
64.25 = (0.20)
12.22 (0.25)
33.50 = (0.14)
Eppoc
AT PGD-10
26.77 + (0.28) 64.97 = (0.00) 14.61 + (0.10)
36.30
(0.62)
(a) CIFAR1O Short schedule
(b) WRN in CIFARIO at
255
26
Figure 5: Combining N-FGSM and GAT with ELLE SLLE--A A: (a) AutoAttack (AA) and Clean accuracy for PRN and WRN trained with e E {16, 26) /55 (b) Evolution of PGD-20 test accuracy during training of WRN, ELLE-A helps GAT and N-FGSM overcome CO and improve their performance.
9

---

Published as a conference paper at ICLR 2024
ACKNOWLEDGEMENTS
Authors acknowledge the constructive feedback of reviewers and the work of ICLR'24 program and area chairs. We thank Zulip for their project organization tool. ARO Research was sponsored by the Army Research Office and was accomplished under Grant Number N911NF-244 1---24---0044 1-0048. Hasler AI - This work was supported by Hasler Foundation Program: Hasler Responsible AI (project number 21043) SNF project Deep Optimisation This work was supported by the Swiss National Science Foundation (SNSF) under grant number 200021 200021_20500 1_205011. I. Fanghui Liu is supported by the Alan Turing Institute under the UK-Italy Trustworthy AI Visiting Researcher Programme. Pablo M. Olmos acknowledges the support by the Spanish government MCIN/AEI/10, 13039/50 10001 1033/ FEDER, UE, under grant PID2021- 11200-1IBI0O and by Comunidad de Madrid under grants
IND2022/TIC-23550 and ELLIS Unit Madrid.
REPRODUCIBILITY STATEMENT
In the course of this project, we strictly employ publicly available benchmarks, ensuring the repro- ducibility our experiments. We report the pseudo-code of our implementation Algorithm []] Furthermore, we furnish extensive details regarding the hyperparameters utilized in our investigation and endeavor to provide comprehensive insights into all the techniques employed. Our implementa- tion is publicly available in https: :/g: thub.
ETHICS STATEMENT
Authors acknowledge that they have read and adhere the code of ethics.
BROADER IMPACT
The robustness of neural networks to (worst-case) attacks is of crucial interest to the community. Given that neural networks are increasingly deployed in real- woaldworld applications, avoiding attacks important. At the same time, obtaining robust classifiers at this point very costly, since cheap alternatives suffer from catastrophic overfitting (CO). Therefore, we do believe that ELLE can have a positive impact machine learning. Concretely, the improvement we show through avoiding CO contributes to the development of more reliable and trustworthy Machine Learning systems. Additionally, the efficiency of our method reduces the computational requirements for training robust models, making them more accessible to wider range of researchers and practitioners. We hope this can help democratize the entrance barrier to the area and foster further advances AT. However, we encourage the community analyze further the potential negative impacts from such methods on robustness.
REFERENCES
Sravanti Addepalli, Samyak Jain, Gaurang Sriramanan, and R. Venkatesh Babu. Scaling adversarial training to large perturbation bounds. In Shai Avidan, Gabriel Brostow, Moustapha Cissé, Gio- vanni Maria Farinella, and Tal Hassner, editors, European Conference Computer Vision (ECCV), 2022.
Maksym Andriushchenko and Nicolas Flammarion. Understanding and improving fast adversarial training. Advances in neural information processing systems (NeurIPS), 2020.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustmess with an ensemble of diverse parameter-free attacks. In International Conference on Machine Learning (ICMI., 2020a.
Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with fast adaptive boundary attack. In International Conference on Machine Learning (ICML), 2020b.
https://zul ip..cmpccooommmmmooooo
10

---

Published as a conference paper at ICLR 2024
Pau de Jorge, Adel Bibi, Riccardo Volpi, Amartya Sanyal, Philip Torr, Grégory Rogez, and Puncet K. Dokania. Make some noise: Reliable and efficient single-step adversarial training. In Advances in neural information processing systems (NeurIPSS, 2022.
Deng. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei. ImageNet: Large-Scure Scale Hierarchical
Image Database. In Conference on Computer Vision and Pattern Recognition (CVPR), 2009.
Ruediger Ehlers. Formal verification of piece-wise linear feed-forward neural networks. In Interna- tional Symposium on Automated Technology for Verification and Analysis (ATVA), 2017.
Christian Etmann. A closer look at double backpropagation, 2019.
Zeinab Golgooni, Mehrdad Saberi, Masih Eskandar, and Mohammad Hossein Rohban. Zerograd: Costless conscious remedies for catastrophic overfitting in the fgsm adversarial training. Intelligent Systems with Applications, 2023.
Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Yoshua Bengio and Yann LeCun, editors, International Conference on Learning Representations (ICLR), 2015.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Conference on Computer Vision and Pattern Recognition (CVPR), 2016.
Zhengbao He, Tao Li, Sizhe Chen, and Xiaolin Huang. Investigating catastrophic overfitting in fast adversarial training: A self-fitting perspective. arXiv, 2023.
Hoki Kim, Woojin Lee, and Jaewook Lee. Understanding catastrophic overfitting in single-step adversarial training. AAAI Conference on Artificial Intelligence, 2021.
Alex Krizhevsky. Learning multiple layers of features from tiny images. 2009.
S. Lee, H. Lee, and S. Yoon. Adversarial vertex mixup: Toward better adversarially robust general- ization. In Conference on Computer Vision and Pattern Recognition (CVPR), 2020.
Randall Le Finite difference methods for ordinary and partial differential equations: steady- state and time-dependent problems. SIAM, 2007.
Bai Li, Shiqi Wang, Suman Jana, and Lawrence Carin. Towards understanding fast adversarial training, arXiv, 2020.
Lin Li and Michael Spratling. Understanding and combating robust overfitting via input loss landscape analysis and regularization. Pattern Recognition, 2023.
Tao Li, Yingwen Wu, Sizhe Chen, Kun Fang, and Xiaolin Huang. Subspace adversarial training. In Conference on Computer Vision and Pattern Recognition (CVPR), 2022.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference Learning Representations (ICLR), 2018.
Scyed-Mohsen Moosavi-Dezfoodl Alhussein Fawzi, Jonathan Uesato, and Pascal Frossard. Robust- ness via eurvature regularization, and vice versa. In Conference on Computer Vision and Pattern Recognition (CVPR), 2019.
Yurii Nesterov and Vladimir Spokoiny. Random gradient-free free minimization of convex functions. Foundations of Computational Mathematics, 17:527-566, 2017.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y. Ng. Reading digits in natural images with unsupervised feature learning. In NIPS Workshop on Deep Learning and Unsupervised Feature Learning 201 2011.
Guillermo Ortiz-Jimenez, Pau de Jorge, Amartya Sanyal, Adel Bibi, Puneet K. Dokania, Pascal Frossard, Grégory Rogez, and Philip Torr. Catastrophic overfitting can be induced with discrimina- tive non-robust features. Transactions on Machine Learning Research (TMLR), 2023.

---

Published as a conference paper at ICLR 2024
Geon Yeong Park and Sang Wan Lee. Reliably fast adversarial training via latent adversarial perturbation. In International Conference on Computer Vision (ICCV), 2021.
Chongli Qin, James Martens, Sven Gowal, Dilip Krishnan, Krishnamurthy Dvijotham, Albussein Fawzi, Soham De, Robert Stanforth, and Pushmeet Kohli. Adversarial robustness through local linearization. Advances in neural information processing systems (NeurIPS), 2019.
Rahul Rade and Seyed-Mohsen Moosavi-Dezfooli. Reducing excessive margin to achieve better accuracy vs. robustness trade-off. In International Conference on Learning Representations (ICLR), 2022.
Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in adversarially robust deep learning. In International Conference Machine Learning (ICML), 2020.
Andrew Ross and Finale Doshi-Velez. Improving the adversarial robustness and interpretability of deep neural networks by regularizing their input gradients. In AAAI Conference on Artificial Intelligence, 2018.
Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! Advances in neural information processing systems (NeurIPS), 2019.
Carl-Johann Simon-Gabriel, Yann Ollivier, Leon Bottou, Bernhard Schölkopf, and David Lopez-Paz. First-order adversarial vulnerability of neural networks and input dimension. In International Conference on Machine Learning (ICML), 2019.
Vasu Singla, Sahil Singla, Soheil Feizi, and David Jacobs. Low curvature activations reduce overfitting in adversarial training. In International Conference Computer Vision (ICCV), 2021.
Suraj Srinivas, Kyle Matoba, Himabindu Lakkaraju, and François Fleuret. Efficient training of low-curvature neural networks. In Advances in neural information processing systems (NeurIPS), 2022.
Gaurang Sriramanan, Sravanti Addepalli, Arya Baburaj, et al. Guided adversarial attack for evaluating and enhancing adversarial defenses. Advances in neural information processing systems (NeurIPS), 2020.
Gaurang Sriramanan, Sravanti Addepalli, Arya Baburaj, et al. Towards efficient and effective adversarial training. Advances in neural information processing systems (NeurIPS), 2021.
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Bonch, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and defenses. International Conference on Learning Representations, 2018.
Theodoros Tsiligkaridis and Jay Roberts. Understanding and increasing efficiency of frank- wolfe adversarial training. In Conference on Computer Vision and Pattern Recognition (CVPR), 2022.
Eric Wong, Leslie Rice, and J Zico Kolter. Fast is better than free: Revisiting adversarial training. International Conference on Learning Representations (ICLR), 2020.
Yuancheng Xu, Yanchao Sun, Micah Goldblum, Tom Goldstein, and Furong Huang. Exploring and exploiting decision boundary dynamics for adversarial robustness. In International Conference on Learning Representations (ICLR), 2023.
Yao-Yuan Yang, Cyrus Rashtchian, Hongyang Zhang, Russ R Salakhutdinov, and Kamalika Chaud- huri. A closer look at accuracy vs. robustness. In Advances in neural information processing systems (NeurIPS), 2020.
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. arXiv, 2016.
Hongyang Zhang. Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference Machine Learning (ICMI.), 2019.
12

---

Published as a conference paper at ICLR 2024
Huan Zhang, Shiqi Wang, Kaidi Xu, Linyi Li, Bo Li, Suman Jana, Cho-Jui Hsieh, and J Zico Kolter. General cutting planes for bound-propasee propagation based neural network verification. Advances in neural information processing systems (NeurIPSS, 2022a.
Yihua Zhang, Guanhua Zhang, Prashant Khanduri, Mingyi Hong, Shiyu Chang, and Sijia Liu. Revisiting and advancing fast adversarial training through the lens of bi-level optimization. In International Conference on Machine Learning (ICML), 2022b.
13

---

Published as a conference paper at ICLR 2024
CONTENTS OF THE APPENDIX
In Appx. we briefly introduce the objectives of robust training and relevant works in the area. We introduce additional experiments in Appx. B Finally, in Appx. [lwe include our proofs and additional theoretical connections.
A ROBUST TRAINING
In standard training, we minimize the Cross-Entropy loss evaluated at our training samples, i.e., solving min E [ (fo(()))))) y)), where 0 are the parameters of our classifier f and D is the
(=.
distribution of our training data. In contrast, in AT (Madry et al. 2018), we minimize the worst case of the loss under bounded adversarial perturbations:
min E max (ffo( (m.g)
(AT)
where 1 S. p 00. AT has notably withstood the test of time, proving to be resistant powerful adversarial attacks (Croce and Hein 2020b). Since its appearance, several other robust training methods have been proposed such TRADES (Zhang al.) (019) DyART (Xu al. 2023)
Additionally, several concerns regarding AT (and other robust training methods) have been pointed
out, such as its excessive increase in the separation margin (Rade and Moosavi-Dezfooli computational inefficiency (Shatahi et al. 2019).
2022 or its
B ADDITIONAL EXPERIMENTAL VALIDATION
We visualize attacks towards our networks in Appx. B. The hyperparameter selection for our methods for all experiments in the main paper included in Appx. B.2 We study possible variations
of our methods in Appx. B.3 We include variations of the Long scheduler Appendices and [ B.6
Models from Fig. 3 are evaluated with Attokt in Appx. B.9 Various ablation studies available
in Appendices B.8 1.10 and B.11
B.1 VISUALIZATION OF LARGE-E ATTACKS
Previous works sparsely consider training with large e for CIFARIO but donnot visualize such attacks (Andriushchenko and Flammarion| 2020 de Jorge et al., 2022 Addepalli et al. (2022) analyze adversarial attacks and defences under large and argue at oracle prediction for low contrast images. For ImageNet, Qin et al. (2019) consider
255 is possible to swith the
16/255 and
visualize single image arguing it is difficult to recognize the object after the attack. We visualize PGD-50 and FGSM attacks in 9 randomly sampled images from the test sets of CIFAR10/100 and ImageNet at e 26/ 255, = 26/255
255 and e = 16/ 6/5 respectively.
In Fig. 6
observe the images after the adversarial attacks present visible perturbations, but donnot clearly change the oracle prediction. As argued by Addepalli et al. (2022) and in Sec. [3] the ability of the attacker flip the oracle prediction might vary from image image and needs to be further studied in the future. Nevertheless, we have strong reasons to believe a high robustness can still be attained for large e, specially for the higher resolution ImageNet.
B.2 À SELECTION
In this section, we study how to select the appropriate regularization parameter for ELLE(-A) under different schedulers and datasets. We evaluate the PGD-20 adversarial accuracy in a 1024-image validation sample extracted from the training set of each dataset.
ELLE: We test the value for the regularization term in our vanilla method (ELLE) in CIFARIO and SVHN. We train PRN in the Short schedule with a wide range of À values for all values, i.e.:
ASVIN E {2 10 2 103 10 10", -103
ACIFARIO E {102,10' 103. 10 10
14

---

Published as a conference paper at ICLR 2024
ImageNet at 16/255
Original
FGSM
PGD-50
CIFARIO 10 at 26/255
Original
FGSM
PGD-50
CIFAR100 at 26/255
Original
FGSM
PGD-50
Figure 6: Adversarial perturbations for CIFARI0/100 at 26/255 and ImageNet 16/ 16/255 with FGSM and PGD-50 attacks. Original image displayed as reference. Perturbations are visible but donnot clearly affect the human prediction, specially for high resolution images in ImageNet.
15

---

Published as a conference paper at ICLR 2024
300
P00-20 Acc
30,000
300
000
0.25
30
(a) ASvHN
(b) ACTFARIO
Figure 7: Grid search for in SVHN and CIFARIO datasets with ELLE, ELLE suffers from CO for ÁSvIN (200; 2, 000; 10, 000} and ACHARIO {100; 1, 0003.
Note that we choose values of ÁSVIN double of those of ACIFARIO: we follow the results of An- driushchenko and Flammarion (2020)) in which this proportionality is observed. In Figs. 7a and 7b
we find that for smaller values, CO still appears, c.g., ASVHN E {200; 2, 000; 10, 000} and ACIFARIO E {100; 1, 0000. When À is sufficiently large, CO is avoided but there is performance degradation, this is clearly observed for ÄSvhN = 200, 000 and ACHFRIOO = 100, 000, where CO is not observed but PGD-20 20 accuracy is decreased for smaller To avoid expensive grid search, simply use 0C = 5, 000 since provides a good performance for all values of in CIFARIO. In the Long schedule, make sure CO is avoided and avoid an expensive grid search, we reutilize the largest values with good performance from the Short schedule, i.c., ASVHN 20, 000 and ACIFARIO 10, 000.
ELLE-A: A:: In the case of adaptive X, we tune the value of Amax in Algorithm [ We take ad- vantage of the results from Fig. 7 and interpolate between parameters close to the best per- forming ones in ELLE. In particular we test ASVHN {5, 000; 10, 000; 15, 000; 20, 000} and ACTFAIIO E {1, 000; 2, 000; 000; 4, 000; 0000. We observe that for λSVHN > 5, 000, all methods behave similarly except for 2 10/255, where larger λSVHN improved the performance. Similarly, for ACIFARIO 2 1, 000, the performance almost the same for all e, therefore, we take the ACIFARIO with the lowest average standard deviation across i.c., ACIFARIO with an average standard deviation of 0.008. Similarly as for ELLE, for CIFARI00 we simply 4, 000 and for the Long schedule, we ASVINN 20, 000 and ACHARIO = 10, 000. For ImageNet we choose À = 10,000.
000
ACIFAR1OO ACIFRRO
Combination with other methods: Based on previous results for ELLE and ELLE-A, for the results in Sec. |.5 we use À = 4, 000 for N-FGSM in both PRN and WRN. For GAT, a larger regularization was required, we used X 10, 000 and X 50, 000 for PRN-18 and WRN respectively. For N- F in the SVHN dataset we use = 5, 000 and for CIFAR 100, X = 4, 000. In the case of N-GSM-LLLL -A on ImageNet, we choose À = 20, 000 for e {2, /255 and À 100, 000 for e = 16/255. A higher performance could be attained by further fine tuning the regularization parameter.
General guideline: Based on our experiments, we observe that values of À in the range [4, 000; 20, 000) tend avoid CO and provide the best performance for all datasets.
B.3 ABLATION STUDIES
We test the effectiveness of using other local linearity metries:
Two triplets: ELLE(-A) estimates the expectation in Definition] 1 with single (æ,, Dy, a) triplet sample, we test how approximating the expectation with two samples affects the metric.
a = 0.5: In Definition] is sampled uniformly from the [0, 1] interval. We analyze the effect of fixing a 0.5.
O'axx: We test the effect of choosing
Omaa arg max (f)o( -)){((((ma))))) a
- ((fo) v2)?
16

---

Published as a conference paper at ICLR 2024
2.5
3,000
2,000
POD-20 Are
3,000
POD-20
4,000
0,000
D00
DC0
022
10
(a) ASvHN
(b) ACTFARIO
Figure 8: Grid search for À in SVHN and CIFARIO datasets with ELIE-A. ELLE-A suffers from CO for ÀSvIN = 5, 000 and ACIFRIO 1, 000. We select ASVIIN 20, 000 and AChFAROO 4, 000 for the rest of our experiments.
i.c. the value that maximizes the local, linear approximation error for a given (æas 2b6-
sample. We obtain Omax with a PGD-10 procedure with a step-size of 0.1.
We analyze the value of these metrics when training with FGSM in CIFARIO with e 8/255. This way can observe behavior the metries both before and after CO.
Local linearity metries: In Fig. 88 we can observe all the proposed metrics behave similarly before and after CO appears, only differing by constant magnitude across all epochs. This immediately discards the use of the two memory expensive triplets and the expensive to compute Qmax- We argue using a 0.5 is a feasible approach and similar results would be obtained by appropriately changing the regularization parameter A.
B.4 ADDITIONAL ELLE-2 RESULTS
In this section, we analyze in depth the mechanics of ELLE-A, terms of the evolution along time, and the influence of its hyperparameter Amax-
Evolution of X: In Algorithm| | we increase to Amax when Ein > mean(err _istt + 2- str list). We track the value of Etin Ciin mean list) + 2 std(err_list) and À accross training steps for WRN trained on CIFAR at = (8, 16, /255 with the Short schedule and with ELLE- A and N-FGSM+ELLE A. Also,
In Fig. 9 we observe is increased more frequently as increases. Additionally, when using N-FGSM data augmentation, this frequency is reduced. This suggests adaptive À scheme correctly captures when local linearity is suddenly increasing and accordingly corrects it.
B.5 ADDITIONAL LONG SCHEDULE RESULTS
the Long-cos scheduler of Xu et al. (002)), which is also 200 epochs long, but has different scheduling and batch size of 256. We include visual comparison of Short, Long and Long-cos schedules in Fig. IO] Since the Long-cos cos is used in state-of-the-att AT methods such as DyArt, we are interested analyzing the appearance CO in this scenario.
Additional scheduler details: In addition the schedulers used in Sec.
CO in the Long schedule: In Fig. 11 we can observe the training curves for GradAlign, N-FGSM, ELLE, ELLE-A and N-FGSM+ELLE-2 when trained with the Long schedule with e 18/255. The evolution of the local linearity (Fig. Tbb and the PGD-20 test accuracy (Fig. Taa denote that N-FGSM clearly suffers from CO this setup, while GradAlign and ELLE((A) do not. Similarly as in Fig. for FGSM training, the network becomes highly non-linear and PGD-20 test accuracy drops to zero for N-FGSM from the 29th epoch onwards. When combining N-FGSM with our regularization term (N-FGSMMELLEE-)), CO is avoided.
CO in the Long-cos schedule; We train PRN with GradAlign, N-FGSM and ELLE on CIFAR10 with the Long-cos schedule and report the average PGD-20 accuracy over three runs. In Fig. [ observe N-FGSM suffers from Robust Overfitting for E [8/255. 16/2665 255). which is consistent with the observations of de Jorge al. (2022) for long schedules. For 16 16/255, N-FGSM exhibits
17

---

Published as a conference paper at ICLR 2024
21008
400
300
300
11009-
11001S
301
300.
210NG-
EJcaC
10000
1000
3.00
0.00
1.30
5000
1030
15000
01
.1.0
8000
5000
1000
13000
(a) (L)ELLE- ELLE-AAte = 8/255
(b) N-FGSM+ELLE a 8/255
300
300
2.005
E2C3
-00-1
300-5
21000
E4012
20.00
42.0
500
3.03
30003
12.00
22.30
0.000
2100
2001
20.00
12000
(c) at 16/255
(d) N-FFGMHHELEEAAEE at 16/255
1.0000
1003
3.000
L103
1.002
100
0000
300
11000
58.0
(e) AILLE-Aate 26/255
(f) N-FGSM+ELLE a 26/255
Figure 9: Evolution of ELLE-A and N-FGSM+ELLE during training for {8, 16, 225/ The condition to increase to Amax, i..., Ein > Cin. is met more frequently as e increases. Introducing N-FGSM data augmentation reduces the amount of times the condition is met, suggesting that data augmentation helps enforcing local linearity but it is not enough.
0.10
SVHEN
Leaming rate
SVHN
Leannng rate
Learnin
0.3
0.06
8.06
0.0
0.00
0.00
10
20
30
0
100
200
10c
2.0
Epoch
Epoch
Epoch
(a) Short
(b) Long
(c) Long-cos
Figure 10: Scheduler comparison: Learning rate per epoch for the three schedules considered in this work. Note that in (a) the Short schedule for the SVHN dataset is only 15 epochs long.
CO, leading to low mean and high variance PGD-20 accuracy. In contrast, ELLE consistently avoids catastrophic overfitting for all values. Our analysis of GradAlign reveals that this method shows an erratic behavior, with catastrophic overfitting observed for some values, such as 8/255, c 16/255, and = 18/255. Additionally, GradAlign converges to random classifier for e = 24/255 and e 26/255. Our findings provide valuable insights into the behavior of these adversarial attack methods and highlight the importance of carefully analyzing the sensitivity to values. Additionally, in Fig. 12 we observe the evolution of the test accuracies and local linearity during training for 18 18/255 255. Similarly to Fig. 11 GradAlign and ELLE remain resistant to CO and are able to control local lincarity. On the contrary, N- N-FGSM suffers from CO from the 150th epoch, where the network becomes highly non-linear and PGD-20 accuracy drops to 0.
18

---

Published as a conference paper at ICLR 2024
appess am
PCD 20
Time R
AT PGB-10 N-KSS
RGSM
ELLE-
(a) Evolution of test accuracy
(b) Evolution of local linearity
(c) Runtime comparison
Figure 11: Delayed CO (a)-(b): CO in Long training schedule, CIFARIO and 18 18/255. We track: (a) the clean and PGD-20 test accuracies and (b) our regularization term. GradAlign and ELLE, which explicitly enforce local linearity, do suffer from CO. N-FGSM presents CO the 30th epoch, where the local linear approximation error spikes and the PGD-20 test accuracy drops to O. Efficient local linearity regularization (c): Average runtime per training step for various methods. ELLE is capable of enforcing local linearity while adding little overhead to standard FGSM training. On the contrary, GradAlign has heavy overhead due double buckpropagation.
Clean
PGD-20
GradAlign
N-GGSM
ELLE
0.8
10
0.6
approx.
10-1
Agc.
10-3
10-7
10-4
100
130
200
Epoch
Epoch
(a) Evolution accuracy
Evolution of local linearity
Figure 12: Delayed CO (a)-(b): CO in Long-cos training schedule and 18 255.. We track (a) clean and PGD-20 test accuracies (a) GradAlign (Andriuscchenko and Flammarion (0020) and ELLE, which explicitly enforce local linearity, do not suffer from CO. N-FGSM (de Jorge et al. 2022) presents CO the 150th epoch, where the local linear approximation error spikes and the PGD-20 20 test accuracy drops to 0.
CIFARIO in the Long-cos schedule
0.8
ELLE
PGD-20 Apc.
0.6
N-FGSM
GradAlign
0.4
4
6
10
12
14
16
18
20
22
24
26
Figure 13: Delayed CO in the Long-cos scheduler: We report the PGD-20 accuracy for ELLE, N-FGSM and GradAign for {2/255, .. 26/255) 255). GradAlign does not avoid CO with the default regularization parameters with the Long-cas scheduler. N-FGSM suffers from CO for 16/255. ELLE remains resistant to CO.
19

---

Published as a conference paper at ICLR 2024
PGD-20 20 accuracy
Local linear approx. error
10"
ELLE
0.2
local approx.
N-PGSM
0.1
10-4
0.0
200
400
600
800
1000
200
400
800
800
1000
epoch
epoch
(a) c 18/255
PGD-20 20 accuracy
Local linear approx. error
0.2
local lin. approx. etr.
10
10-2
Apc.
0.1
10
0.0
200
400
1000
200
1000
epoch
epoch
(b) 22/255
PGD-2 20 accuracy
Local linear approx. error
0.2
local li. approx. eIr
10
10-2
Agc.
0.1
10-3
200
400
600
800
1000
200
400
1000
epoch
epoch
(c)
26/255
Figure 14: 1000-epoch long schedule: CIFARIO PGD-20 test accuracy and local linear approx- imation error evolution along 1000 epochs with the Long-cos schedule for ELLE and N-FGSM for e E (18/255, 22/255, 26/255) ((a), (b), and (c) respectively). N-FGSM presents CO in all scenarios, while ELLE only presents robust overfitting.
B.6 1000-EPOCH LONG SCHEDULES
To demonstrate our method is capable of avoiding CO for even longer schedules, mance of ELLE and N-FGSM for E {18/255, 22/255, 26/ }55 when training the PreActResNet architecture with the cosine schedule, a maximum learning rate of 0.02 and 1000 epochs in CIFAR1O.
the perfor-
In Fig. 14 we can observe that N-FGSM presents chaotic behavior, where PGD-20 test accuracy suddently lost and gained within few epochs. On the contrary, ELLE follows an homogeneous trend with no CO.
B.7 RUNTIME COMPARISON
In order to better understand the computational advantages of using ELLE, we compare the average runtime per training step of AT PGD-10, FGSM, N-FGSM, LLR, CURE, GradAlign and ELLE(-A). We report the runtime of the forward pass, of the backward pass and the total runtime per step. The PRN and WRN architectures trained for epochs with batch size of 128 for this experiment.
20

---

Published as a conference paper at ICLR 2024
Forward
Backward
Total
Tine
AT PCTD> N-RISM
CURE LLR
A.LE
AT PODD-00 N-FIIMM
CLRE
FILE
AT N-FUSM
CURE
FILE
FOSM
Orddllgn ELLE
PGSM
LLR
Gradllign ELLGA
FGSM
LLR
GrodAlign ELLE A
Runtime comparison for PRN
Backward
016
0.44
0.2
PG N-FGSM
CURE
ELLE
AT PGD-10 N-FOSM
CURE
BLLE
PGID- N-PGSM CURE
POSM
GradAlign
GrodAlign
GridAtinn
(b) Runtime comparison for WRN
Figure 15: Forward, backward and total runtime average per training step for the PRN (a) and WRN (b) architectures. FGSM, N-FGSM and ELLE(-A) A) attain similar total runtimes in both scenarios. LLR, CURE and GradAlign have a considerably larger backward runtime than the rest. This is due to double backpropagation. ELLE(-A) avoids double backpropagation and obtains similar backward runtimes to FGSM.
Two main insights can be drawn from Fig. T5 i) ELLE adds very little overhead FGSM training and ii) LLR. CURE and GradAlign add expensive overhead in the backward pass due to Double Backpropagation. ELLE, while based on enforcing local lincarity as LLR, CURE and GradAlign, is considerably more efficient.
B.8 GRADALIGN ABLATION
In this section we perform additional studies the effect of the À regularization parameter in GradAlign. We train PRN architectures with the Short schedule in CIFARIO with e 26/255 and AGradAlign E {0.25, 0.5, 1, 8, 16) with three different random seeds. We report the performance of ELLE as baseline.
GradAlign is highly sensible to ACradAlign In Fig. 16a we find only for AGradAlign CO is avoided and the network does not converge to a constant classifier. Additionally, a suboptimal performance obtained comparison to ELLE, i.e. 15.90% v.s. 17.80%. This shows the difficulty of choosing
GradAlign-
GradAlign regularization term is unstable: In Figs, [6b 16d we report the PGD-20 test accuracy, the local, linear approximation enror and the gradient missalignment (Eq. (5) respectively for AGradAlign Since AGradAlign is so large, we have that the network converges to constant classifier with 10% accuracy. Neverthcless, we find that the regularization term in GradAlign is inconsistent with this fact. As the model constant, it is also linear and we should have that the gradient missalignment close to O. Nevertheless this metric converges to 1 during training. Alternatively, the local, linear approximation error is consistent with the convergence to a constant classifier and goes to O.
In conclusion, together with the findings in Appx. B.7 and Sec. consistent, efficient and easier tune method than GradAlign.
We find that ELLE is a more
21

---

Published as a conference paper at ICLR 2024
0.15
PGD-20 Acc.
GradAlign
0.00
ELLE
0.25
0.5
2
16
A
(a) AGiadAlige ablation
10-1
HoLE HOLE2 HOLE3
Grad. missafigmmee
PCD 20.00.
10
t0
Local
10
Epoch
Epoch
Epoch
(b) PGD-20 Acc.
(c) Local, linear approx. error
(d) Gradient missalignment
Figure 16: GradAlign ablations: (a): PGD-20 accuracy for different AGrdAAigg values. Only
AGrdAliign 1 avoids CO and convergence to constant classifier. (b)-(d): evolution of PGD-20 accuracy, local, linear approximzation error and gradient missalignment for runs with AGrdAAign
Gradient missalignment is an unstable metric for close-to-constant classifiers, spiking to when the local, linear approximation error is close O.
B.9 EVALUATION WITH STRONGER ATTACKS
In order to accurately asess the robustness of a model, robustness verification methods should be em- ployed (Ehlers) (017). However, state-of-the-arr robustness verification methods are computationally expensive and donnot scale well to large or large models (Zhang et al.) (022a)). Alternatively, common practice evaluating the resistance strong adversarial attacks such as PGD-50- 10 or the attack ensemble AutoAttack (AA) (Croce and Hein 2020a).
In this section we confirm our findings from Sec. 4.4 specifically from Fig. 3 by evaluating the AA accuracy of those models. In Table we observe that the methods involving our regularization term, ie.. ELLE, ELLE-A A and N-FGSM+ELLLE while GradAlign and N-FGSM suffer from CO, specially in CIFARIOU Remarkably, adding regularization term to N-FGSM, helps N-FGSM avaid CO and improves its performance by +5.17% in SVHN, +1.07% in CIFARIO and 20% in CIFAR 100 for the largest
are stable and donnot suffer from CO in any setup,
B.10 REGULARIZING WITHOUT ATTACKS
In this ablation study, motivated by Deosavi-Dezfooli et al. (2019) we test the performance of our methods when not performing adversarial attacks during training, only enforcing local lin- earity. We evaluate the performance of PRN when trained with the Long schedule on SVHN with standard training, ELLE, and FLLE without attacks. We report the PGD-20 accuracy at (2/255, 8/255, 12/255] over single run with each method.
Fig. 17 we observe standard training obtains 0% adversarial accuracy for > 2/255. Interestingly, regularizer ELLE, we attain non-trivial robustness. Nevertheless, performance is notably far from the ELLE baseline, e.g.. 5.07% v.s. 32.17% at = 12/255. This result is aligned with the findings of Dezfooli et al. (2019): enforcing local linearity uniformly is not enough and the adversarial direction information, e.g., V, C(f (x y)) needs to be incorporated during training.
when simply plugging
22

---

Published as a conference paper at ICLR 2024
Table AutoAttack (AA) accuracy for PRN in SVHN, CIFARIO and CIFARIO0 for the models in
Fig. 3
SVHN
ELLE
ELLE-A
GradAlign
N-FGSM
N-FGSM+ELLE-A
AT PGD-10
88.05 (U.12)
87.66
(0.16)
86,39 + (U.10)
88.12 (0.16)
88.24 (0.16)
88.44 (0.14)
(0.16)
72.13 (0.22)
71.50 (0.01)
74.27 1 (0.27)
74.75 (0.21)
76.71 (0.27)
57.70
(0.27)
56.19 (0.15)
56.34 + (0.25)
(0.23)
60.05 (0.08)
64.47 (0.48)
8
41.77
(0.23)
42.55 + (0.18)
27.92 (19.63)
46.45 + (0.20)
46.70 (0.14)
53.00 (0.31)
10
30.35 = (0.26)
30.96 + (0.07)
30.21 = (0.50)
33.28 = (0.30)
35.33 = (0.28)
42.60 = (0.09)
12
22.20
(0.08)
19.97 1 (0.53)
21.20 1 (0.26)
21.18 1 (0.33)
26.35 1 (0.23)
32.98 (0.58)
CIFARIO
BLTR-A
GradAlign
N-FGSM
N-FGSM+RT
AT PGD-10
2
78.77 1 (0.16)
78.71 (0.04)
78.94 (0.12)
79.05 1 (0.08)
78.64 1 (0.24)
78.85 (0.16)
65.70 (0.12)
65.61 (0.17)
65.89 = (0.25)
66.00 (0.06)
65.83 (0.06)
66.55 (0.22)
53.80 - (U.18)
53.97 (U.12)
54.20 (0.05)
54.26 (0.18)
54.17 (U.30)
55.62 (U.37)
42.78 (0.95)
44.32 (0.04)
44.66 (0.21)
4
45.05 (0.26)
46.95
10
33.79 (0.41)
35.55 (0.03)
36.10
37.00 (0.20)
37.16 (0.16)
39.54 (0.35)
12
27.13
(1.30)
28.171
1
30.56 (0.12)
30.61 (0.34)
33.55 (0.50)
14
21.75 + (0.49)
(0.46)
22.53
25.22 (0.41)
24.86+
28.62 (0.45)
16
18.28 = (0.17)
18.03 (0.15)
=
20.59 (0.21)
20.48 (0.57)
24.77 (0.26)
18
14.55 = (0.26)
14.75 (0.44)
13.12 (0.40)
16.63 = (0.44)
16.36 (0.27)
21.30 (0.12)
20
13.01 + (0.09)
14.80 (0.21)
11.57 - (1.57)
13.30 1 (0.33)
12.88 1 (0.62)
13.55 (7.11)
22
13.82 (0.17)
13.58 (0.07)
9.96 (0.04)
11.39 (0.48)
14.15 (0.31)
16.26 (0.73)
24
12.85
(0.28)
12.99 (0.30)
11.32 (1.33)
11.09 - (0.82)
13.15 = (0.27)
15.44 = (0.00)
26
(0.41)
25
(0.34)
10.00 (0.00)
10.96 (0.26)
12.03 (1.02)
14.42 (0.00)
CIFAR 100
ELLE
ELLE-A
GradAlign
N-FGSM
N-FGSM+FLLE
AT PGD-10
47.82 10.37)
48.01 1001100 (0.10)
48.40 1 (0.18)
48.53 1 (0.33)
47.99 (0.25)
47.83 1 (0.50)
34.79 (0.19)
35.68 (0.17)
35.85 + (0.20)
36.07 + (0.36)
35.90 (0.12)
35.87 + (0.45)
26.43 1043=0000 (0.27)
27.44 (0.35)
27.61 (0.29)
27.67 (0.36)
27.54 (0.31)
27.84 (0.62)
20.01 1011:00111 (0.11)
21.04 (0.28)
13.67 1 (9.69)
21.45 (0.24)
1 (0.10)
22.05 (0.60)
10
13.88 3 (0.21)
16.39 (0.04)
0.00 (0.00)
17.20 (0.13)
17.24
17.72 (0.64)
12
13.01 + (0.15)
13.29 (0.26)
13.23 + (0.40)
14.06 + (0.17)
13.96 + (0.21)
14.70 (0.41)
14
10.67 + (0.02)
10.88 = (0.15)
11.11 (0.30)
11.78 = (0.16)
11.55 (0.15)
12.62 1: (0.23)
16
8.94 (0.12)
8.93 (0.23)
3.72 1 (3.84)
9.98 (0.16)
9.78 (0.15)
10.86 (0.10)
18
7.63 (0.07)
7.33 (0.10)
1.00 + (0.00)
8.30
8.51
9.49 = (0.17)
20
6.44 (0.01)
6.11 (0.16)
1.00 (0.00)
(3.20)
6.99 (0.05)
8,39 = (0.14)
22
5.27 (0.32)
5.26 (0.20)
(2.00)
3.69 (2.65)
7.54 (0.05)
7.50 00.02)
24
4.37 (0.06)
139 (0.28)
0.93 - (0.10)
1.55 (2.18)
5.10 (0.21)
6.68 00.11)
26
3.64 1 (0.14)
2.87 (0.25)
1.00 1 (0.00)
1.17 (1.65)
4.37 1 (0.14)
6.09 (0.04)
1/ 17
0.
vh
PGD-AA
atlack
Standbrdl miningg
Epodds
(a) c 2/255
(b) 8/255
(c) 12/255
Figure 17: No attack ablation: We report the SVHN PGD-20 accuracy for ELLE, ELLE regulariza- tion without attacks and standard training at (a) 2/255, (b) 8/255 and (c) e = 12/255. The legend is shared across plots. Simply enforcing local linearity with our regularization method is not sufficient to attain the optimal adversarial accuracy.
23

---

Published as a conference paper at ICLR 2024
10f
306
Local lin. approx.
00-2
Tho inglete
P00-20 Ace
5,000
1,000
01-1
10
20
Epoch
(a) Mean of local linearity metric (b) ELLE-2p variant CIFARIO
Figure 18: ELLE variants:. (a) Mean value of the modifications of our local linearity metric during FGSM training at c 8/255. All of the variants differ by a constant factor, favoring the the use of the cheapest approaches. (b) ELLE-2p variant results. This variant with less point than ELLE in the forward pass is also able to overcome CO. However, no guarantees enforcing local linearity are present.
B.11 ELLE-2P: REGULARIZING WITH LESS MEMORY
In this section we reuse FFGSM instead of the random sample H, in Algorithm 1 This allows using less memory by only forwarding 3 points instead of per point in the batch. Instead of randomly sampling points a. and æs in IB| [x, e, oo], we sample H, x Unif e[-), and Unif([O, 1J) and compute
a) + #FGSM Finally, our new regularization term becomes:
Fii L (x:),
a) L (fo(aa)) v)
L (FFCsM) v.1l
(6)
We test the performance of this variant when training PRN architectures in CIFARIO for e up to 26/255 (as in Sec. 4.4). We notice lower values of À were needed for this variant and test the performance with {100; 000; 5, 000), we report the PGD-20 adversarial accuracy over runs.
In Fig. 18b we observe ELLE-2p overcomes CO for À E {1, 000; 5, 0000. Nevertheless, the formulation in Eq. (6) does not strictly enforce local linearity, i.e., there are other class of functions that also satisfy Ejin = O. We provide example of function with zero error which is non-linear in following.
Example (Non locally linear function with Ein = 0). We consider the following continuous function f (R2)):
(W), x) (w0, x))
if (v, x) 2
f(x)
if (v, x))
(-1) W2
-11
0
where wi
and v -11
We consider the set S = [0,
-3/2)
1/2
Then, v=(((r)) = wi (=+). therefore, we have #FGSM =
and the point
1/2
1/2 sign (V (V=((x)))
knowing this, it is easy to check that Eq. (6) zero. For both cases our function linear and Eq. (6) is zero in both regions and then is
(v, a)) 0 and (v, x) zero in the whole set S.
B. ADDITIONAL LLR EXPERIMENTS
As proven Propositions D and 3 both the L.R and ELLE regularization terms approximate second order directional derivatives. Leaving aside the computational advantages of ELLE(-A) -A) displayed in Fig. D and Appx. B.7, we would like to analyze the difference in robustness between LLR and ELLE A). We LLR with X (200, 500, 1, 100, 2, 2000 5, 000) and report the validation
PGD-20 accuracy.
In Fig. 19 observe similar behavior to ELLE in Fig. 7b For small values of À and big c, CO still appears. When increasing X, CO is avoided but performance degraded. We select the best performing À for each value for the L.R evaluation in Fig.
24

---

Published as a conference paper at ICLR 2024
SNI
POD-30 Atc
PGD A0/
10001
PGD ANC.
700
2,000
5,000
3,000
2,000
01
(a) SVHN
(b) CIFARIO
(c) CIFAR100
Figure 19: Validation PGD-20 accuracy with LLR in SVHN and CIFARI0/100 for different values.
Table 3: Combination of ELLE-- with single-step variants of TRADES and AdvMixUp in CIFAR1O. Both Up and TRADES suffer from CO for e > 2/255. CO avoided when ELLE-A plugged in.
16
26
Cennn
AA
Clean
Clean
Up-inuue
(0.25)
(0.1)
(6:00)
86.19 (0.00)
10:00)
(0:16)
AdOMIUUp -
(0.27)
12:33 (0.1))
(0.44)
(0.70)
TRADES single
(0.07)
(6000)
10.000
(0.21)
TRADUS andle-BLLB-)
(0.43)
17:00 (1.98)
50.00
(050)
(281)
(0.52)
(4.00)
B.13 COMBINING ELLE- A WITH ADDITIONAL METHODS
To further showease the benefits of combining our regularization term, we analyze the performance of single-step variants of AdvMixUp (Lee et al., 2020) and TRADES (Zhang al. (219)) when combination with ELLE A. We train PRN CIFARIO at {2, 8, 16, 26 We use the standard hyperparameters for Apx and TRADES, for ELLE-A and X = 5, 000 for Ap and 10, 000 for TRADES.
the standard 0.99
In Table 3
observe both the single-step variants of AdvMixUp and TRADES suffer from CO for 2/255. Alternatively, CO is avoided when ELLE-A is plugged into the training. In Fig. 20 the performance drop during training the single-step variants of AdvMixUp and TRADES is displayed at 8/255. When ELLE- A is plugged into the training, the PGD-20 accuracy steadily increases during training.
B.14 ALTERNATIVE SOLUTIONS: APPROXIMATING GRADALIGN WITH FINITE DIFERENCES
A naive solution to Double Backpropagation is approximating the gradient terms in Eq. 5 with Finite Differences approximations (Le Veque 2007 Let e; be the 7th vector of the canonical basis
AdwMiiSUpsiigle
TRADDSS-ingl
PGD 20 Avc.
0.3
0.2
Raseline
0.0
10
Epoch
Figure 20: Training evolution with the single-step variants of TRADES and AdvMixUp in CIFARIO
at E = 8/255. Only when in combination with ELLE-A. A, both methods can obtain final non-zero adversarial accuracy.
25

---

Published as a conference paper at ICLR 2024
and E RR. We approximate the gradient of the loss function ((fe()). C² (R*) with the classical finite differences approximation:
V (fo(z), [ffo( -
Sadly, this approximation involves d - 1 function evaluations. In total, we would need 2(d + 1) new evaluations, e-g., 6, 146 for EVHN/CIFAR1//I the regularization term in a single image a single iteration of the training process. Nesteroy and Spokoiny (2017) study gradient approximations via single sample of multivariate Gaussian distribution in the convex optimization setup. This efficient approximation is given by:
497, 666 for ImageNet, just to estimate
gar, u, o) = L (fo(( + ou). v) C (ff((x), u Val (fol + oe))), u N(0, Ia).
Plugging this approximation into Eq. we get:
Eq. 2 sign [C (fo(æ + ou). VCC ov). [(Sol + m)) T
where u, NO, Ia), 77 Uni
We notice this approximation is non-smooth due to the sign(-) operator. This results in the gradient of this term w.r.t. 0 being zero almost everywhere. Therefore straightforward employ Eq. (8) as regularization term. Moreover, this approximation would need 4 extra function evaluations, more than our proposed method.
26

---

Published as a conference paper at ICLR 2024
C PROOFS AND ADDITIONAL LOCAL LINEARITY METRICS
In this section we include our proof of Proposition 1 Additionaly, we elaborate on how different local, linear approximation error definitions could be proposed with more points and how this reflects on their approximation of the second order derivative. Lastly, similar proof is included for relating the local linearity definition in Qin et (2019) is available in Proposition
Proof of Proposition This relationship can be obtained by means of the Taylor series expansion of h2 around I. = (1 a) Da + a Zb-
Firstly, note that va and as be expressed as: (1 - a.) (æa 2b))
N. = Ie (at 1b),
Now, for i E [o], by means of the Taylor expansion of he at ae we have:
h.(wo)) hx(w)) +a (xa xb) V Vxht(
a
(xa
xz) V2 V h, h (xx) xb)
2
3
d
d
d
(x
+
( 2b);(Ea 20)a(es - xx)1
6
j=1
+0 00 xbll(00
(9)
(,(2,) = h,
(1 a) (Ia xb) T [ahh(((0
a)²
+
(xa xb) T Vaz (xc) - x6)
2
(1 - a)
d
d
(Ia - 2b)s(Ea ax)a(E - Ib)i aZ
6
j=1
1=1
+ +0 -
(110--20)) - xbll xb11
By operating the inner term in Definition substituting Eq.
( when applicable and noticing
(xa - 2x) ha xx) D m.) he ha(x)) we obtain:
hx(1)))
-(1 a): h1(2)))
-a(1 -a)
-a- h;(0)))
D2
(2.-2n) he(e))
2
a(1 a)(1 2a)
d
(a rt);(Fa - ob)a(Fa 2b)) dz
+ 0 (1 xxll(a)))
- <x(1 - a)
2 (ia.-1n) he( + +0 xbb 180)
D2
=
(10)
where in the last equality used that (Ia mblj < ||a xolloc Vj [d] and that because h; E (RR) we have E Ed
Ed 1= dny
c.. Lastly, by substituting Eq. (10) into
Definition the proof is concluded. k=
Different local, linear approximation error definitions arise easily when noticing Definition is
simply Finite Differences (FD) approximation (Le (007)) of the second derivative of g(a),
h,( + a (x) x.)). Therefore, shown in Chapter 1.5 of (Le (Le (007) can obtain high order approximation the th derivative provided any set of non-overlapping points 2 Ø2, " 2m with 2 + 1. Here, we provide example with 5 equispaced points.
27

---

Published as a conference paper at ICLR 2024
Definition 3 (5-point local, linear approximation enror). Let h iE R - RR, let the points:
3x + Wbb
Da + Lb
La + 3xx
the 5-point local, linear approximation enror of h at B 222 e, pl for S S 2o is given by:
1
4
h(zx)) ? (((xa) + 4 h((z))
1
ELie (h, c.
E
h(wa)
h h(
Dn ty (22. an.Um]((U.1))
12
(11)
In the fashion of Proposition D we have the following relationsip.
Proposition 2. Let E (IR4) be six times differentiable mapping, let Ein x, p,e) E) and
(x) be defined as Definitions and and (hx(())) R" be the vector containing the second order directional derivatives along direction v for every output coordinate of h, the following relationship follows:
[
D² -a, (M((aa)) + O(1 mmll(a) = 25
ELin (h, 2.P.
Ho 2n Unift B( (ni
(12)
where Fg = } Da kb.
Proof of Proposition This relationship can be obtained by means of the Taylor series expansion of h4 around zz. In this proof, we will use the shorthand Σ Ej.-. m.. p=1 Σラ= Em== "EE
Firstly, we notice that we can express any point linear combination of and and a., V.a:
2
Fa Fd
(xa xbb
2
36 = xd
(xa xbb)
5
K = xt
+
5
(xaa xbb
x. Fd
(Ia
Dbb)
Now, For i E [o]. by means of the Taylor expansion of h, at xd we have:
hi(x.)
hi(wa))
(at æn) Vaha(aua
(a.. xn)" va (aad(a 2s)
50"
+ 750
8
Σ
(za - mn);(xn m0)a(ea - 2x)) 02,
(wa)
1
Σ
=a))(a)(aa (20)))a0-236((2.. 22)6(20 20))(20 2m)m Da
15000
J.k.Imm11
+ 32
8 (e(an))
(Na mo) - =os z0)i(ro commitss - ab)n p
375000
64
Σ
(#a-asl)(ee - 2o)a(ro mo)i(ur ae)aaes ao)nnra mo)o yu an
11250000
j.c.l.mp.
0 ||50 sol? %x
(13)
28

---

Published as a conference paper at ICLR 2024
(mrs) ho(mna)
(urn nn) (anl(
4
+
(dta
Vin"" - mn)
30
(tra)
Σ
(no (x) 26)6(1a m0)) 0r
750
J.A.-11
16
Σ
(ua Tb)ssa) volulre - modelcee momm 0 (hhliaa)) marrraa
15000
32
8 (2llaa))
(Na rels volalra wo)elre volmlan so) degaaamntn
375000
64
(h.(ae)
(Eo zsllaa volalaa soliloo salmaa moln(s, zolo Bn 20
11250000
+ [|x =0ll(a)
(14)
(m...) Na(ona) + 5 (mr. mn) (anl(
(at, mn) (i mn)
50
(ara)
Σ
(ra 25) (na m0)a(aa =b)1 20
750
J.
Σ
(Na - 2o) - mo)ales - mo)e(ro mo)m Dry
15000
8 Ph((aa)
(Na vols(ra rolato molile mommlra somn Dep
375000
j.l.mmmm
phalma)
(ra - molylaa aodela. andilas aamala aa)nlr, andy on Ba
11250000
||
(15)
(x...) = h;(2.a)) (ax. - xx) Vahu(an))
(Ir, mn) Va (rr mn)
50
(mma
Σ (an 2x) mo)a - mx)) azzzz0
8 (xna)))))
(Na -b))() 2o)a(es ma)e(zo 2m)m Oe Baraaam
15000
8 (a(a)))
(Nta - ob)y molalro soli(te mommmls - mbmm a
375000
m.
Σ
(sa mo) solaluee mo)e(uo solalra ao)alus mo)o ohe dr
11250000
f.A.L.mm.oo
1.00 (1LC.
=oll)0))
(16)
29

---

Published as a conference paper at ICLR 2024
By operating the inner term in Definition
substituting Eqs. (33) to (16)
when applicable and
noticing (Ia - xb) (z ma)
Dim 100-- m. (2()) we obtain:
h(ma)) ((x))) - (((aa)))) + 4 h((a.)) h(ass)
D (o)- (z((
25
(2
Σ
- mu),(( _ zola mol(sn - - aa)mnts - molat. mblr 20
11250000
m.
0 (| mmll(22)
D (m) + (11e0 - =olla)
25
(17)
where in the last equality we used that (I. Ibli I | xolloo Vj [d] and that because
ha E (R()) we have Ej, 2.j.I.mm..pp 02j0g818m8ndt Definition the proof is concluded.
(m)))
< co. Lastly, by substituting Eq. (10) into
Notice that in the proofs of Propositions and 2 we require as many degrees of differentiabillty as
the lowest order of accuracy of the FD formula, i.e, the highest order Taylor series term that cannot
be cancelled. Regardless of this requirement for the proof, both Definitions and 3 can be applied to any mapping I RRd + RR. Lastly, we prove a relationship between the regularization term Qin et al. (2019).
Proposition 3. Ler h E (R())) be tree times differentiable mapping,
let g( xb)) = h(xx)
((xs))) (ara mb) (((o)))) and D2 (h((rr) be defined Definition follows:
2
the following relationship
1 D? ( ho((r)) O (1122 2
g( 0b)
2'6
(18)
I and 2 this relationship can be obtained by means of the Taylor series expansion of h around æs. We have:
Proof of Proposition Similarly to the proof of Propositions
h(xx) = 1e(x))) + (Io Ts))T (ar(((x)) + 2 (xt xx.) 22 h2xs) xx)
1
02h(ar))
(aa xb)) ro)a(FFa xx6) 0r
(19)
6
j=1 1=1
+ 0
||ata 2001
Plugging Eq. 199 into g we have:
g( 2b)) (ara 2b6) 2 12 h(x))( xx) + +0 (1.z a0l1)0)
(20)
and the proof finalized.
30


Reviews:
[{"review_id": "BqLOzCpG6E", "reviewer": "Reviewer_4XDh", "summary": "In this paper, the authors investigate the issue of catastrophic overfitting and propose an efficient and effective solution in the form of a local linear regularizer. The introduced algorithm not only mitigates catastrophic overfitting but also circumvents the double backpropagation problem. It performs well in challenging scenarios, such as dealing with large adversarial perturbations and long training schedules, especially when pursuing Fast-AT. Experimental results demonstrate that the proposed method achieves good results while effectively addressing catastrophic overfitting.", "questions": "Please check the problems mentioned in the Weaknesses part.", "limitations": "", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The proposed regularization scheme as well as the analysis are reasonable, and the introduced local linear approximation scheme is very simple.\n2. The experiments show that the proposed ELLE can work well under large adversarial perturbations and long training schedules.", "weaknesses": "1. The definition of Equation 1 is excessively simplistic, lacking any explanation or validation. It's important to note that the majority of deep models and training losses do not conform to linear mappings, which leads me to question this particular configuration. Also, the authors claim that ''CO appears when the loss suddenly becomes non-linear, ...'' (on page 4) I find this description somewhat confusing. Since the loss function usually remains constant throughout the training process, how does this transition from linear to non-linear occur in the loss?\n\n1. The proposed local linear approximation error is similar to the mixup, which has been studied in adversrial training [a]. But, the comparison and analysis are missing.\n\n1. According to the results shown in Figure 4, I found that ELLE-A is not better than ELLE, but I cannot find any clear explanation.\n\n1. The proposed method does not work well under short training schedule and small adversarial perturbation. The authors have not provided a satisfactory explanation or analysis for this issue. Since the defensive performance obtained from long training schedule and short training schedule is comparable, why should we necessarily opt for the longer training schedule? Moreover, large perturbations imply that the noise becomes more pronounced, which contradicts real-world scenarios. \n\n1. In the review process, I attempted to use mathematical tools to show that the regularization introduced in this paper can be used for the approximate estimation of LLR. That is, \n\n   $L(f_\\theta(x+\\delta),y)-L(f_\\theta(x),y)-\\delta^T\\nabla_xL(f_\\theta(x),y)\\approx L(f_\\theta(x_c),y)-(1-\\alpha)L(f_\\theta(x_a),y)-\\alpha L(f_\\theta(x_b),y)$.\n\n   So, I think ELLE is an effective approximation for LLR. And it's better to compare LLR and ELLE in the all experiments. BTW, the authors only report some results in Figure 1, when considering methods enforcing local linearity. But, I cannot find any comparison in the experiments. I think this lack of comparison to be unfair. \n\n[a] Adversarial Vertex Mixup: Toward Better Adversarially Robust Generalization. CVPR 2020.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "HnjssdnSna", "reviewer": "Reviewer_vQnz", "summary": "The paper proposes a new regularization techinque which address the catasterophic overfitting of AT approaches.\nThe new requalrization term is combined with FGSM AT method to improve the robustness of the model during training.", "questions": "The main question is that how the proposed method is compared with SOTA adversarial attack algorithms and how this method can be combined with other AT algorithm than FGSM and whether it would be effective in the sence or not.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The method addresses a significant challenge in the field of adversarial training with a fairly simple yet effective approach. \nI appreciate the theoretical analysis provided in the paper and the level of details shared by the authors.", "weaknesses": "I understand the paper mainly focuses on the theoretical aspect of the proposed algorithm. \nHowever, there are some aspects missing which make it difficult to understand how practical the proposed method is.\n \n1- There are several SOTA AT methods currently being used which have demonstrated significant improvement in this area. It would be benficial to have other SOTA adversarial attacks evaluation in the paper as well to show how this approach helps against other SOTA  attacks as well.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "gsFTjWJSF2", "reviewer": "Reviewer_e1KG", "summary": "This paper aims to mitigate the catastrophic overfitting (CO) phenomenon in adversarial training by enforcing local linearity in the underlying model. Their proposed solution (ELLE) is a computationally efficient approach to enforce local linearity without using double backpropagation, which is time-intensive. Instead, this approach enforces local linearity using multiple forward passes, which is memory-intensive, and hence trading off time for space. Experiments show that their proposed approach is faster than the alternatives, and is successful at mitigating CO.", "questions": "- The authors claim in Section 3.3 that the GAT and NuAT methods are not relevant since they attempt to make models locally constant as opposed to locally linear. But surely, local constancy is a special case of local linearity, and thus it is not inconceivable to compare the two methods on equal grounds, like you do for LLR and GradAlign?\n\n\n- The authors are encouraged to comment on the highlighted weaknesses of the paper.", "limitations": "", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 1, "strengths": "- This paper proposes a simple but effective strategy to enforce local linearity that does not incur double backpropagation costs. Their theoretical results also show that their method implicitly reduces a quantity related to the Hessian, which is expected.\n\n- The paper has a nice study on the CO problem in the experiments section, especially where it defines “perturbation-wise” and “duration-wise” CO, and has nice figures demonstrating CO and its avoidance with the provided method.", "weaknesses": "**Not conceptually novel, fails to discuss simpler solutions**\n\nThe main idea presented is not conceptually novel. Local linearity has been presented as a solution to catastrophic overfitting several times in the literature (which the paper also discusses). The only novelty is regularizing for linearity using an objective that does not involve gradients. I am unsure how novel or interesting this part itself is – for instance, one can just as well use any other local linearity regularizer (for example, LLR or GradAlign), and replace the gradient terms therein using finite differences. This would eliminate the need for the “double backpropagation” as well and meet their desiderata. The paper needs to discuss why these simple solutions are undesirable if at all they are. \n\n**Misses key references**\n\nThe paper misses a couple of key references (see [1,2]), which aim to achieve the same objective as this given paper. It would be great if the authors could comment on how their method compares with the approaches presented in these works.\n\n[1] Singla et al., Low Curvature Activations Reduce Overfitting in Adversarial Training, 2021  \n[2] Srinivas et al., Efficient Training of Low-Curvature Neural Networks, 2022\n\n**Experiments ignore a canonical adversarial defense: PGD**\n\nWhile the experimental section nicely demonstrates CO and the effect of its method, it **fails to present comparisons** with the canonical method of PGD [Madry et al., 2018]. While speed comparisons are made with PGD in Figure 1, there do not appear to be accuracy comparisons (AA, Clean accuracy) or comparisons with regard to the ability of PGD to locally linearize the model or usage of the proposed method (ELLE) with PGD. This notable omission of PGD significantly weakens the paper. Rather, the paper focuses primarily on improving FGSM-based defenses (although it also discusses improving GAT and N-FGSM in the experiments), which is a significantly weaker defense than PGD", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)