Revisiting Instance-Reweighted Adversarial Training
Authors: Hiroki Adachi
Tsubasa Hirakawa
Takayoshi Yamashita
Hironobu Fujiyoshi
Venue: Submitted to ICLR 2023 (2023)
Keywords: Adversarial training
Adversarial robustness
Instance-reweighted

Abstract: Instance-reweighted adversarial training (IRAT) is a type of adversarial training that assigns large weights to high-importance examples and then minimizes the weighted loss. The importance often uses the margins between decision boundaries and each example. In particular, IRAT can alleviate robust overfitting and obtain excellent robustness by computing margins with an estimated probability. However, previous works implicitly dealt with binary classification even in the multi-class cases, because they computed margins with only the true class and the most confusing class. The computed margins can become equal even with different true probability examples, because of the complex decision boundaries in multi-class classification. In this paper, first, we clarify the above problem with a specific example. Then, we propose \textit{margin reweighting}, which can transform the previous margins into appropriate representations for multi-class classification by leveraging the relations between the most confusing class and other classes. Experimental results on the CIFAR-10/100 datasets demonstrate that the proposed method is effective in boosting the robustness against several attacks as compared to the previous methods.

Under review as a conference paper at ICLR 2023
REVISITING INSTANCE-RRWEIGHTDD ADVERSARIAL TRAINING
Anonymous authors Paper under double-blind review
ABSTRACT
Instance-reweighteed adversarial training (IRAT) is type of adversarial training that assigns large weights to high-importance examples and then minimizes the weighted loss. The importance often uses the margins between decision bound- aries and each example. In particular, IRAT can alleviate robust overfitting and obtain excellent robustness by computing margins with an estimated probability. However, previous works implicitly dealt with binary classification even in the multi-class cases, because they computed margins with only the true class and the most confusing class. The computed margins can become equal even with dif- ferent true probability examples, because of the complex decision boundaries in multi-class classification. In this paper, first, we clarify the above problem with specific example. Then, we propose margin reweighting, which can transform the previous margins into appropriate representations for multi-class classification by leveraging the relations between the most confusing class and other classes. Ex- perimental results the CIFAR-100/00 datasets demonstrate that the proposed method effective in boosting the robustness against several attacks as compared the previous methods.
INTRODUCTION
While convolutional neural networks (CNNs) achieve excellent performance on various tasks, they are vulnerable adversarial examples (Szegedy et al. 2014] Goodfellow et al.) 2015) with mali- cious, perturbed samples. Such perturbation is threat against CNN-based AI systems (e.g., those for autonomous driving or medical diagnosis) because is imperceptible to humans. Thus, there are various effective approaches to mitigate the negative impact of perturbation (Papernot et al., 2016]] Samangouei et al. 2018 Xu et al.] 2018, Madry et al. 2018). Among them, adversarial training (AT) (Madry et al. 2018 well known as attractive defense strategy because of its clarity and efficacy.
Instead of using benign examples, AT trains adversarial examples generated by projected gradient descent (PGD) (Madry et al. 2018). Although AT can achieve excellent robustness, it can also exhibit performance degradation for benign examples robust overfitting (Zhang al. 2019 Rice ct al. 2020). rrweighe adversarial training (IRAT) (Zeng et al.) 2021 Kim et al.) 2021
Zhang et al. 2021 Wang al. 2021] Gao et al. 2 is an effective method among the many
approaches developed to overcome these issues.
IRAT computes the margins between the decision boundaries and each example as the importance, which is transformed into weights with nonlinear increasing function. Then, it minimizes the weighted classification loss by assigning these weights to each example. Geometry-aware instance- reweighted adversarial training (GAIRAT) AT', proposed by (Zhang et al. (02T), decides the importance for each example by the least PGD steps (L.PS). GAIRAT represents the margin in an input space, because the LPS is the number of steps to cause adversarial example to cross decision boundaries, starting from a benign example. Smaller- margin examples are closer to the decision boundaries and assigned larger weights. Although GAIRAT achieves better robustness than standard AT, it is vulnerable against attacks other than PGD because defines the importance in terms of the LPS.
Meanwhile, margin- aware instance reweighting learning (MAIL) (Wang et al., 2021 1 successfully overcomes the weakness of GAIRAT by defining the importance with estimated probabilities. Specifically, it transforms the difference between two probabilities, i.e., between the true class and

---

Under review as a conference paper at ICLR 2023
the most confusing class, to weight with nonlinear increasing function. Weighted minimax risk (WMMR) (Zeng et al., (021] uses the same approach. The difference between these methods the use of different weighting functions, and MAIL achieves better performance than WMMR. Unlike GAIRAT with its discrete representation for weights, MAIL alleviates robust overfitting by using continuous weights. However, MAIL and WMMR have problem in that the importance cannot be adequately represented in multi-class classification, because only the most confusing class and the true class are considered. As shown in Fig. [T), assume that this issue occurs in previous approaches for instances that have the same margin. Intuitively, among examples that have the same margin, such as 2 and Z2, the importance should large closer to the intersection of the decision boundaries of multiple classes, but previous methods neglect this representation.
In this paper, to resolve this issue, we reveal the problem with the previous margin computation through a specific example. Then, as illustrated in Fig. [c), we propose margin reweighting, which enables us to transform the previous margins to an appropriate representation by considering classes other than the most confusing class and the true class, Although there is straightforward approach for this, which arises from computing the margins between the true class and other classes (i.e., by using multi-class margin), it is hard to design weighting function aggregate the multi-class margin to a single weight. Thus, we propose a novel metric: the ratio the top2 in the incorrect rate (i.e., the sum of all probabilities except the true class). Assuming that each class probability well represents relationship to the center of a class, this metric can identify whether examples are close the intersections of multi-class boundaries. Therefore, we do not have design a special weighting function, and we can get appropriate representations just by multiplying this measure by the previous margins. We performed experiments and demonstrated that the proposed method can boost the performance of the previous methods for certain attacks. In summary, our work makes the following contributions:
We clarify that the previous approach of computing the margin by using predicted probabil- ities is insufficient. Specifically, we show case in which the same margins are computed for certain examples even though both the true and most confusing class probabilities are different.
We propose margin reweighting, which enables transformation of the previous margins into appropriate ones by leveraging a relation between the most confusing class probability and the incorrect rate.
We experimentally show that our approach is effective for boosting the robustness against adversarial attacks.
2
PRELIMINARIES AND RELATED WORKS
In this section, we give overview of standard training and adversarial training (AT), and then describe related works on instance-reweighted adversarial training (IRAT).
2.1 STANDARD TRAINING vs. ADVERSARIAL TRAINING
Standard training: Let D = (æ,, y be a training dataset where æ; E Rexhxw an input example and y; a ground truth label. standard training, a deep neural net f: Rexhxw + R parameterized by 0 minimizes the loss ((fo(
min E mr >DD ( (2:)) v.),,
(1)
where K is the number of classes, and the loss function E(-) uses the cross-entropy loss.
Adversarial training: AT (Madry et al., 2018) aims to obtain a model with robustness against adversarial attacks by training on computed adversarial examples. Actually, the field except for image classification, this framework uses before deep learning became popular (Dalvi et al. 2004 Lowd & Meek 2005). Unlike standard training. AT consists of two processes, inner maximization and outer minimization. First, the inner maximization computes a perturbation ó; so to maximize the loss within a radius e centered on x, Then, the outer minimization updates the weight parameters @ minimize the loss with adversarial examples à; æ; ö, obtained by the inner maximization.
2

---

Under review as a conference paper at ICLR 2023
X2
X2
margin = =<--
margin
A+0
LAO
LAO p(x))
margin(x,) = (x)gin(X2)
margin(x;) > margin(x;))
p(T))
Before assigning weights each sample
(b) After assigming weights each sample with MAIL WMMR
(c) After ussigning weights to each sample with our method
Differences between both previous methods (i.e., MAIL and WMMR) and our method. The size of each shape in (b) and (c) indicates the amount of weight, and the solid and dashed lines represent the decision boundaries before and after updates, respectively. Each shape represents a different class. (b) The previous methods assign equal weights to equal margins because they only use the difference between probabilities of the true class and the most confusing class. However, we should define larger weight for æt than for ø2, because at is close the intersection of multiple class boundaries. Thus, (c) our method can transform the margins for and 22 to appropriate forms in multi-class classification.
Figure 1:
The following equation represents these processes:
min E (e.
max ((oalx 8.). |1
where p = 1, o0); we use p = oo in this paper.
The inner maximization often computes adversarial examples via multi-step attack (e.g., PGD (Madry et al. 2018) with step size a <):
a. (((+1) =I [Bo (a!
sign (V
where Blx,")) ( E X a x; loc I E) in the input space X, and Il is projection
function that brings outliers into Blx,")
Although it is not hard to obtain robustness with AT, it has drawbacks of degrading the classification
performance on benign examples and causing robust overfitting. Among various approaches to
overcome these issues (Cai al. 2018 Zhang al.)
2019
Uesato al.
2019 Zhang & Wang
2019 Wu et al., 2020) Wang et al.
2020; Zhang et al.
2020: Cheng et al. 2022
Ding et al. 2020
Song et 2021 Cui et al. 2021 Yu al. 2022), deal with IRAT (Zeng et al. 2021
Kim al.
2021
Zhang et al. 2021 Wang et al. 2021
Gao et al.) 2021)
2.2
INSAANCE-REWEIGHTEH ADVERSARIAL TRAINING
IRAT form of adversarial training that defines weights based on the importance computed for each example and then minimizes the weighted loss. There are various IRAT approaches with different computations of importance.
Geometry-aware instance-reweighted adversarial training (GAIRAT) (Zhang et al.) 2021) deter- mines the importance of each example by using the least PGD steps (LPS). The LPS indicates the number of steps to cause adversarial example to cross decision boundaries, starting from a benign instance. While GAIRAT can achieve excellent performance against PGD attack, it is vulnerable to other strong attacks because the importance depends the PGD attack of the inner maximization. To overcome this weakness, Gao et al.) (202I) proposed to consider other attacks, such Carlini-Wagner (CW) (Carlini & Wagner 2017) AutoAAtack (AA) (Croce & Hein 2020

---

Under review as a conference paper at ICLR 2023
in the inner maximization; however, this approach is costly. Meanwhile, entropy-weighted adver- sarial training (EWAT) (Kim et al. (2021) improves the robustmess against CW (Carlimi Wagner, 2017) and AutoAttack (AA) (Croce & Hein 2020) by assigning entropy to the input as a weight for each example.
In contrast to EWAT, weighted minimax risk (WMMR) (Zeng al.) 2021 and margin-aware in- stance reweighting learning (MAIL) (Wang et al. 2021) define margins for each example using the true class and the most confusing class probabilities, via the following equation:
m( y:) arg / Py Py. (I:),
(4)
where Ps, (æ:) indicates the true class probability, as p(æ;) is the predicted distribution. Note that these approaches use different weighting functions: sigmoid for MAIL, exponential for WMMR. MAIL resolves the weakness of GAIRAT and achieves better performance.
In this paper, aim to define the margin with Eq. (4) in the MAIL and WMMR. However, those methods do not give appropriate margins in multi-class classification, because they ignore relations other than those between the true class and the most confusing class. Hence, in the next section, seek to address this problem.
3 PROPOSED METHOD: MARGIN REWEIGHTING
In this section, first, we reveal the weakness of the previous IRAT methods in multi-class classifi- cation. Specifically, show that Eq. 4 may obtain the same margins with certain examples even though the probabilities of the true class and the most confusing class are different. Next, we propose novel metric represent relations between the most confusing class and other classes. Finally, we introduce weighting functions to incorporate our proposed method into the previous methods.
Definition (top2 probability). Let (I;; ys) ~ D the input data and let p(æ,) E [0, 1] be the posterior distribution for I,, Then, the top2 probability is defined as P2(x;) = arg maXkęy Pk (z:).
Remark:
Strictly speaking, the top2 probability is the the highest when Py, (2x)) < p2(2x,) In this paper, however, we call the top2 probability even in this situation.
3.1 WEAKNESS OF PREVIOUS IRAT METHODS
Correct samples Incomeet samp es
Although the previous IRAT methods with class probabilities achieve excellent performance, they do not account for classes other than the most confus- ing class. Except in easy cases, some samples typ- ically lie the intersections of multi-class de- cision boundaries. Thus, we can easily expect in- sufficient representations for WMMR and MAIL in multi-class classification.
A42-
Margin
For the margin calculated by Eq f and training dataset D = ((D,,)))= there exist samples that satisfy
Lemma 1.
m m( v1) m( w;).
(5)
Confidence
By applying Lemma we examine the margins computed by Eq.4 First, examples that have high confidence in terms of either the true class or the top2 probability are represented far from other classes. In other words, these examples are located around the center of either the true class or the top2 class. In this case, Eq. 5 does not hold true between high- and low-confidence examples, as illustrated in Fig. 2 Therefore, it is not a problem to de- fine the margins with Eq.(4). On the other hand, low-confidence examples in both the true class and the top2 probability may be around the multi-class decision boundaries. Thus, these examples satisfy (5. not only for examples with both probabilities nearly equal but also for examples with
Figure 2: Correlation between the true class probabilities Py: (3:.) and the margins com- puted by Eq. [4] for ResNet-18 with standard adversarial training on the CIFAR-10 dataset. The orange and blue dots represent incorrect and correct samples, respectively.
4

---

Under review as a conference paper at ICLR 2023
different probabilities (e.g.. Py: (2;) < Pg, (zz)). For instance, shown in Fig. we can obtain approximately equal margins for examples within [0.2, 0.6]. This represents the situation where æ; is closer to the intersection of multiple class boundaries and has higher attack risk than zj- Hence, we argue that is inappropriate to make the margins equal for these examples. Although we would expect improved robustness if we could carefully distinguish these margins, neither WMMR nor MAIL accounts for them.
3.2
QUANTIHICATION OF IMPORTANCE FOR MARGINS
The margin determination described above is insufficient when we recall that Lemma 1 holds for different probabilities among certain examples. A straightforward, intuitive approach to resolve this issue is compute the margins between the true class and other classes with Eq. 4 However, that approach is hard to implement because it requires careful design of the weighting function to transform the multi-class margins to the appropriate weights.
Definition 2 (Incorrect rate). Let (æt, Ye) ~ D be the input data and let pv, (xx) E [o, 1] be the correct class probability. Then, the incorrect rate is defined as
Py. (2:)
1 1- Pv: (x:)
Σ keyy Ph (ax.)
(6)
Hence, we propose a metric that quantifies the relations between the most confusing class and other classes by using the top2 probability and the incorrect rate. Assuming that Lemma [ holds for examples with different confidence, we can derive the following inequality for the ratio of the top2 probability to the incorrect rate.
Proposition 1. For input data (2 and (z). let m (2;, Ms) m(xj. H1)), Py, (2x)) > Pys (2z))
and Pu; (a²z) > K. Then, the the following inequality for the ratio the top2 probability to the incorrect
rate holds for each sample:
o(x v6) > o(z5,,9)), where o(x, v) p2(x)) (x)
Py (x)
The margins computed with (q.44) represent only the relation to decision boundaries whether examples successfully classify. Meanwhile, for the examples with the same margin, Proposition shows that they can further distinguish by using the ratio of the top2 probability included in the incorrect rate. According to MAIL and WMMR (i.e., that Eq. 44 implies the margin between the ex- amples and the decision boundaries), we can determine that examples with a low ratio are distributed around the intersection of multiple classes. Thus, we expect that we can resolve our problem by ap- plying the ratio of the top2 probability to the margin computed by Eq.
K-1 Pv. (x:)) be the range of P2(x:); then, the upper and lower bounds obtained directly by using o(x; vi) are defined as follows:
Next, discuss the range of the ratio o(x, 31).. Let Prop2 (
(a, (ar,)
sup Pa ( inf o(x, yi) K- P2(x.) = Pv, (m.) (2()))
o( Vi) = p2(x.) = Py, (2:),
(8)
K-I
According to Eq. direct use of the top2 ratio is contrary to our motivation, because we confirm that o( y4) approaches the upper/lower bound when P2 (zx) is large/small. Hence, we obtain the appropriate range by inverting the top2 ratio with an arbitrary coefficient 7 e N. However, we cannot say that the representation is appropriate, because 7 = 1 gives the following upper and lower bounds:
p2( = Pa. (z.) K
sup (T- o(2 v1)) = 1 k-1 Pa ( inf (r o( 91)) pa(
p2(0.)) pv. (z.)).
Equation 9 implies that examples with P2(x:) R py (x) (i.e., significantly misclassified adversarial examples) are no longer involved in the updating the parameters.
Hence, we define weights for the margins computed by Eq. with the following equation: s s(x;, V:) = - o(2;, v:), s.t. N22, where N2g denotes the set of natural numbers greater than or equal to 2.
(10)
5

---

Under review as a conference paper at ICLR 2023
P(X))
P(x) (1 - M)
P(K)
p(z)) (1 -M)
Probability
Probubillity
Class indices
Class indices
Class indioes
Class indices
(a) Low-confidence example, cxx, 0.7083
(b) High-confidence example, (x), 0.0143
Figure 3: Cosine similarity computed with Eq. [1 for the predicted distributions of two examples
with (a) low and (b) high confidence. The red bar represents the true class in each example.
3.3 REPRESENTATION THE IMPORTANCE FOR THE INCORRECT RATE
As described above, we can represent whether examples are close to the intersection of multiple classes, but Eq. T0p is insufficient yet. Specifically, for both examples around the boundaries and successfully classified examples with high confidence, the top2 ratio may be equal if the incorrect class probabilities are uniformly equal. Because these examples require the definition of different weights, this implies that the importance of the incorrect rate is also different. Therefore, we repre- sent the importance of the incorrect rate by leveraging the predicted probability distributions via the following equation for the cosine similarity:
< p(xx)),
c( M1)
(11)
|p( la 1l'(x:))l
Here, p(æ;;) E [0, 1]K denotes the predicted probability distribution of x;, p' (ax) denotes the distri- bution with elimination of the true class and computation using a binary mask, which has values of except for the true class:
K (==))=p(zz) (1- (1, s.t. Σx= (x())) <.
(12)
As shown Fig. 3(.. the similarity tends to be large for an example with low confidence. Mean- while, shown in Fig. b). it tends to be small for an example with high confidence. We found that this trend obtained almost the same results on all validation examples, and we thus confirmed that the similarity is correlated to the incorrect rate (see Fig. 4 in the appendixes). Hence, can assign appropriate weights to the margins computed with Eq.(4) by applying Eq. 12 to Eq (TO). For these reasons, we transform Eq.I0) an appropriate representation with
(x;; yi) = s s( 9:) c( y:).
(13)
3.4 INCORPORATION OF OUR APPROACH IN PREVIOUS IRAT METHODS
Above, showed that the previous methods insufficient, and we proposed margin reweighting to transform the margins computed by (q.4 to adequate representations with the top2 ratio. Here, describe how to incorporate the proposed method into MAIL and WMMR.
First, we multiply the top2 ratio computed by Eq. (13 and the margins given by Eq
m y:) mx y.) s'(x V.).
(14)
Then, we apply Eq. 14 to transform the margins to boost the importance of examples around the intersections of mllti-class decision boundaries of multiple classes from weights functions of the previous methods:
WWMMK
exp(-mi(x,, vx)),,
(15)
WMAIL sigmoid(-7> (m 9:) + +))).
(16)
Here, 3 and y are hyperparameters, and in the experiment described below, we used the constants of the previous methods. Therefore, only need to determine in the proposed method.
In addition, we omit the WMMR constant by replacing with the proposed method, because
simply multiplies the margins computed by Eq.44) We also warm up the model with for

---

Under review as a conference paper at ICLR 2023
all examples during the initial training. In other words, the training within set number of epochs is standard AT. This technique uses GAIRAT or MAIL, which aims to avoid inappropriate weight representations during the initial training. The training procedure incorporating the proposed method is detailed in Algorithm[ in the appendixes.
EXPERIMENTS
This section demonstrates the performance obtained by incorporating the proposed method into WMMR and MAIL. In our experiment, we used the CIFAR-10/100 (Krizhevsky & Hinton, (2009) dataset evaluate the standard accuracy for benign data and the adversarial robustness against sev- eral attacks. First, we describe the training settings and the details of how we evaluate the adversarial robustness in Section Then, we report the quantitative evaluation results in Section 4.2 and dis- cuss the hyperparameters and the necessity of the similarity computation in Section 4.3
4.1 EXPERIMENTAL DETAILS
We used standard AT ("Standard")) (Madry et al. 2018), WMMR, and MAIL as comparison meth- ods. The evaluation results here consist of the average and standard deviation for five models trained with different random seeds. We also show the seghhst-performacce model during training ("Best model") and at the end of training ("Last model"). The results for other methods and best models are shown in the appendixes to conserve space. For fair evaluation, the training settings with WRN34-10 on the CIFAR-10 dataset were integrated according to (Pang et al. 2021).
Training Settings: We used R8sNet-18 (He et al.] 2016) and WideResNet34-10 10 (WRN34-
10) (Zagoruyko & Komodakis 2016) as base networks. We trained models during 120 epochs by using batch size of 128 and SGD with momentum of 0.9. The initial learning rates for each network were 0.01 (ResNet- and 0.1 (WRN34-10), and they were multiplied by 1/10 at {75, 90, 100} epochs. The weight decays Finally, for all methods, we used PGD with a perturbation tolerance = 8/255, a step size a = e/4, and N 10 steps for PGD).
set to 3.5 x 10-1 (ResNet-18) and 0.5 x 10-4 (WRN34-10),
Hyperparameters: MAIL used B = 0.5 and 7 = 10 for all models and datasets, while WMMR used 2. These constants were the same both with and without the proposed method. The proposed method used - = 2 on both the CIFAR-I0 and 100 datasets for WRN34-10, and - = 2 on CIFAR-10 and 3 on CIFAR-100 for ResNet-18. The amount of warmup was 75 epochs, after which we activated the weighted loss minimization.
Adversarial Robustness: We evaluated not only the standard accuracy for benign examples ("Clean")) but also the adversarial robustness against PGD-K with K 100 (PGD-100). PGD- 100 with the loss function of CW, AutoPGD with the cross-entropy (APGD-CE) (Croce & Hein 2020), and AutoAttack (AA) (Croce & Hein 2020p. As described in (Wang et al.] (021). we eval- uated the performance for white-box attacks because black-box attacks are assumed to be easy to defend.
4.2 RESULTS
Tables I andd list the results on CIFAR-10 10 and on CIFAR- 100, respectively.
CIFAR-10: The results for ResNet-18, in the upper block of Table [ showed improved adversar- ial robustness against PGD-100 and APGD-CE by incorporating the proposed method into MAIL (i.e., "Ours+MAll."". Moreover, the "Clean" result showed somewhat improved performance. The results for incorporation into WMMR exhibited the same trend. Next, the results for WRN34-10, in the bottom block, showed better adversarial robustness against all attacks with the proposed method incorporated into WMMR (i.e., "Ours+ WMMR". In particular, the average robust accuracy against AA improved by 0.13, and the standard deviation for five models was significantly small. Mean- while, "Ours+MAIL" showed comparable classification accuracy for benign examples, and it sig- nificantly improved the adversarial robustness against attacks in the PGD family, such as PGD-100 and APGD-CE.
7

---

Under review as a conference paper at ICLR 2023
Table 1: Performance of each method's "Laast model" CIFAR-10 (%). The upper block is for ResNet-18 18, and the bottom block is for WRN34-10. The best-performing method in each case in shown in bold, and indicates improved performance by incorporating the proposed method.
Clean
PGD-100
CW-PGD
APGD-CE
AÄ
Standard
85.69:10.15
48.86=+0.22
49.26:10.20
48.3440.23
46.38==026
WMMR
85.71=0.177
49.60=0.41
48.31=:0.36
48.99:10.38
45.23=0.37
MAIL
82.53+10.30
56.66++0.17
47.71+40.26
55.75-10.13
45.22-+0.31
Ours WMMR
85.65++0.13
50.31+0..51
47.94+0.11
49.59++0.29
44.79++0118
Ours + MAIL
82.66=001101
57.96-0.131
47.24
56.95:10.191
44.78=0029
Standard
87.8910.17
48.11
49.33
10.66
46.82-10388
WMMR
88.03:10.12
49.331:041
49.95-1.33
48.88-10.3
47.37-1038
MAIL
86.40:10.13
59.30=10221
51.82:10.22
58.5710.26
49.29-10.14
Ours+ WMMR
87.99:0.14
49.39=0.191
49.97=0.221
48.96::0.181
47.50=0.177
Ours+MAIL
86.48=00241
60.56:10.421
51.55++0.30
59.64:10451
48.92=00.0
Table 2: Performance of each model's "Last model" on CIFAR-I00 (%). The upper block for ResNet-18 18, and the bottom block is for WRN34-10. The best-performing method in each case is shown in bold, and indicates improved performance by incorporating the proposed method.
Clean
PGI)-100
CW-PGI
APGD-CE
AA
Standard
60.10110.22
28.65:1022
27.89:00.17
28.12::0.18 18
25.01=0.133
WMMR
60.42+:.22
28.1440.16
26.66:+0.18
15.47+0..1
23.59=0.14
MAIL
56.77=t0.19
31.23+1008
25.68++0226
30.45+10.99
22.99-10.09
Ours WMMR
60.50-10.181
28.24110.121
26.96110.201
27.58:t0.141
23.86+10.151
Ours + MAIL
0..50
3..23:10.16
25.30
30.46.10.17
22.61-10.10
Standard
6.36
24.82+0.12
20.80
24.5
23.70
WMMR
63.32+0.12
25.87+0.22
26.29+0.20
25.45
23.81+0.19
MAIL
62.561:.21
34.2940.08
29.31:10.19
33.58-10.09
26.50-10.16
Ours+ WMMR
63.76-10.091
25.45
26.51
25.14
23.94
Ourl+MAIL
63.19:0.211
34.32+00.11
28.944+0.18
33.4740.18
26.18=0014
Next, as seen the upper of Table 2 for ResNet-18, "Ours+MAIL" improved the accuracy for benign examples by 0.73, and the robustness against PGD-100 and APGD-CE was comparable. Meanwhile, "Ours+ WMMR achieved excellent performance not only in the "Clean" case but also for all attacks "Ours+ WMMR" improved the accuracy for benign examples by 0.44. In addition, improved the adversarial robustness against both CW-PGD and AA. although the robustness against the PGD family slightly degenerated. In addition, "Ours+MAIL" improved the "Clean" case by 0.63, and the robustness against PGD-100 was comparable. Overall, these results showed that the proposed method was effective in improving the accuracy for benign examples, and that it obtained compara- ble better adversarial robustness on the CIFAR-100 dataset.
CIFAR-100:
0.10. For WRN34-10,
in the bottom block of the table,
To conserve space, the results for the "Best model" with each dataset and base network are given in Appendix H In a nutshell, those results exhibited the same trend as the results given above for the "Last model".
4.3 ABLATION STUDY
Here, we consider the effect on performance when we eliminated the similarity of Eq.(11) (1)pe or used different values of the hyperparameter
We obtained the average and standard deviation for WRN34-10 with five models having different random seeds and the settings described in Section
First, Table lists the results of performance comparison with CIFAR-10. in the left block, showed that a large т significantly increased the robustness against APGD-CE. Meanwhile, increased 7 degraded the performance in the "Clean" and CW-PGD cases. In addition, a large т increased the classical PGD robustness but degraded the AA robustness (see Appendix
{2,3, 4). The results on
8

---

Under review as a conference paper at ICLR 2023
Table 3: Ablation study for r. The left and right blocks for CIFAR-10/100, respectively.
CIFAR-10
CIFAR- 100
Clean
CW-PGD
APGD-CE
Clean
CW-PGD
APGD-CE
8..48:10.24
51.5510.30 50.65:1.35
63.1910.21 59.6410.45
28.94=0.18
33.47:10.18
7 3
06.39-0.14
60.77:10.48
63.4410.22
32.65:0.17 27.79=0.25
4
86.37=0.25
50,4910.50
62.0910.447
63.62-1..29
26.87=00223
31.38:1.119
As seen in the right block of Table the results on CIFAR-I00 showed that a large increased the accuracy for benign examples but degraded the robustness against adversarial attacks. In particular, the robustness deteriorated by over 1.0 on CIFAR-10 and 2.0 on CIFAR-100 Thus, 7 was an appropriate choice for WRN34-10 10 on both datasets. The results for ResNet- 18 are listed in Table in Appendix E
Next, Table lists the results ("Clean". CW-PGD, and APGD-CE) when the similarity of (T) was eliminated from the proposed method. While the
Table 4: Ablation study for the "Last model" CIFAR-I0 for the similarity of Eq. sim.: similarity.
"Clean" and CW-PGD results deteriorated, the ro- bustness against APGD-CE slightly improved. As seen in Table Appendix E. the robustness against PGD was comparable with the similarity eliminated, but the robustness against AA did not decrease. Al- though classical PGD is strong attack, evaluation of the model performance for only PGD) links overestimation of robustness. Therefore, for the pro- posed method, is appropriate use the similarity because of the comparable robustness against PGD despite improved the performance for CW-PGD or AA.
w/ sim.
w/o sim.
Clean CW-PGD APGD-CE 59.64=0045
86.48-1022 01.55:1..0
86,40:00.09
51.07:1.23
0,.91+0.42
5 DISCUSSION AND LIMITATIONS
Surprisingly, standard AT achieved the best robustness against AA and CW-PGD in small-capacity network such as R8sNet-11. This result implies that MAIL vulnerable to strong attacks when the network does not have enough capacity. Therefore, our approach may increase MAIL's innate vul- nerability exchange for dramatically improving its robustness against the PGD attack. Meanwhile, WMMR with the proposed method showed improved performance for almost all the attacks, includ- ing AA or CW-PGD, as compared with the original method, despite simply multiplying Eq. [3 by the margins. Instead of using constant coefficient, the margins of each instance during training. These results show the necessity of transforming the margins to appropriate representations, because the margins transformed by approach directly contribute to training without the constant coefficient.
approach apply different coefficients to
Regarding the results on each dataset, the performance improvement CIFAR-100 limited in comparison to the improvement on CIFAR-10. Intuitively, our method should be an important role in far more classes with complex decision boundaries. Our method still just indirectly deals with the relations among multiple classes, Hence, inherent consideration of the multi-class margins may make networks robust on CIFAR-100 or larger-scale datasets, and we leave this as future work.
CONCLUSION
In this paper, we have revealed a weakness of previous IRAT methods, and we have proposed a novel metric to resolve this weakness. Unlike the previous methods, which define weights by considering only two probabilities, our approach successfully boosts the performance by incorporating the ratio of the top2 probability the incorrect rate into the previous methods. However, the robustness im- provement was limited on the CIFAR-100 dataset as compared with CIFAR-10 10. Image classification in the real world assumes more complex data and far more classes than in CIFAR-10/100 Hence, we will aim to improve the performance on large-scale datasets by carefully designing the weighting function.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Qi-Zhi Cai, Chang Liu, and Dawn Song. Curriculum adversarial training. In International Joint Conference on Artificial Intelligence, pp. 3740-3747, 2018.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy, pp. 39-57, 2017.
Minhao Cheng, Qi Lei, Pin-Yu Yu Chen, Inderjit Dhillon, and Cho-Jui Hsieh. Cat: Customized ad- versarial training for improved robustness. In International Joint Conference on Artificial Intelli- gence, 2022.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter- free attacks. In International Conference on Machine Learning. volume 119, pp. 2206-22161 2020.
Jiequan Cui, Shu Liu, Liwei Wang, and Jiaya Jia. Learnable boundary guided adversarial training. In IEEE/CVF International Conference on Computer Vision, pp. 15721-15730, 2021.
Nilesh Dalvi, Pedro Domingos, Mausam, Sumit Sanghai, and Deepak Verma. Adversarial classifi- cation. In ACM SIGKDD international conference on Knowledge discovery and data mining, pp- 99-108, 2004.
Gavin Weiguang Ding, Yash Sharma, Kry Yik Chau Lui, and Ruitong Huang. Mma training: Direct input space margin maximization through adversarial training. In International Conference on Learning Representations, pp. 1-28, 2020.
Ruize Gao, Feng Liu, Kaiwen Zhou, Gang Niu, Bo Han, and James Cheng. Local reweighting for adversarial training. arXiv preprint, 2021.
Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations, pp. 1-11, 2015.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. JEEE Conference on Computer Vision and Pattern Recognition, pp. 770-778, 2016.
Minseon Kim, Jihoon Tack, Jinwoo Shin, and Sung Ju Hwang. Entropy weighted adversarial train- ing. In International Conference on Machine Learning Workshop, 2021.
Alex Krizhevsky and Geoffery Hinton. Learning multiple layers of features from tiny images. Tech- nical report, University of Toronto, 2009.
Daniel Lowd and Christopher Meek. Adversarial learning. In ACM SIGKDD international confer- ence on Knowledge discovery and data mining, pp. 641-647, 2005.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference Learning Representations, pp. 1-23, 2018.
Tianyu Pang, Xiao Yang, Yinpeng Dong, Hang Su, and Jun Zhu. Bag of tricks for adversarial training. In International Conference on Learning Representations, pp. 1-21, 2021.
Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as defense to adversarial perturbations against deep neural networks. In IEEE Symposium on Security and Privacy, pp. 582-597, 2016.
Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in adversarially robust deep learning. In International Conference on Machine Learning, volume 119, pp. 8093-8104, 2020.
Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-gai gan: Protecting classifiers against adversarial attacks using generative models. In International Conference on Learning Represen- fations, pp. 1-17, 2018.
10

---

Under review as a conference paper at ICLR 2023
Chuanbiao Song. Yanbo Fan, Yichen Yang, Baoyuan Wu, Yiming Li, Zhifeng Li, and Kun He. Regional adversarial training for better robust generalization. arXiv preprint arXiv: 2109.00678, 2021.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfel- low, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, pp. 1-10, 2014.
Jonathan Uesato, Jean-Baptiste Alayrac, Po-Sen Huang, Robert Stanforth, Alhussein Fawzi, and Pushmeet Kohli. Are labels required for improving adversarial robustness? In Advances in Neural Information Processing Systems, pp. 12214-12223, 2019.
Qizhou Wang, Feng Liu, Bo Han, Tongliang Liu, Chen Gong, Gang Niu, Mingyuan Zhou, and Masashi Sugiyama. Probabilistic margins for instance reweighting in adversarial training. In Advances in Neural Information Processing Systems, pp. 1-12, 2021.
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In International Conference on Learning Representations, pp. 1-14, 2020.
Dongxian Wu, Shu tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust general- ization. In Advances in Neural Information Processing Systems, pp. 2958-2969, 2020.
Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. In Network and Distributed System Security Symposium, 2018
Chaojian Yu, Bo Han, Mingming Gong, Li Shen, Shiming Ge, Bo Du, and Tongliang Liu. Ro- bust weight perturbation for adversarial training. In International Joint Conferences on Artificial Intelligence, pp. 3688-3694, 2022.
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In British Machine Vision Conference, pp. 87.1 1-..12., 2016.
Huimin Zeng, Chen Zhu, Tom Goldstein, and Furong Huang. Are adversarial examples created equal? a learnable weighted minimax risk for robustness under non-uniform attacks. In AAAI Conference on Artificial Intelligence, volume 35, pp. 10815-10823, 2021.
Haichao Zhang and Jianyu Wang. Defense against adversarial attacks using feature scattering-based adversarial training. In Advances in Neural Information Processing Systems, volume 32, pp- 1829-1839, 2019.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning, volume 97, pp. 7472-7482, 2019.
Jingfeng Zhang. Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankan- halli. Attacks which do not kill training make adversarial learning stronger. In International Conference on Machine Learning, volume 119, pp. 11278-11287. 2020.
Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan Kankanhalli. Geometry-aware instance-reweighted adversarial training. International Conference on Lear- ing Representations, pp. 1-29, 2021.
11

---

Under review as a conference paper at ICLR 2023
A PROOF OF LEMMA I
Lemma 1. For the margin calculated by Eq. (4) and training set D {(0) (1)) there exist
samples that satisfy
m(x,, yc) =
(17)
Proof:
We divide the training dataset D {zt, Ms j= into the set of successfully classified samples, St {( Vi) E D arg max p(x,) }. and the set of misclassified samples, S == { Ui) E D arg max p(x;;) * yt). First, S+ and S Lemmm Tobviously holds when Py; (xx; = Pu, (my) Next, we prove that Lemma Jalo holds for different probabilities, i.e., for Py, (#x) * Pyş (m.) Because all samples, including those in S and S+, absolutely satisfy Py, (xx)) p2 (2a) and Py: (æ;) p2(2:),
Lemma I must hold to satisfy the following equation:
lpy. (2:)) Py, (zz,) |p2(x;) p2(2)))
(18)
Thus, equal or approximately equal margins exist despite different true class and top2 probabilities.
B PROOF OF PROPOSITION 1
Proposition 1. For input data (æ,, We) and (1), let m (x v.) m(.),,35). Pys (xx)) > Pys (zz))
and Py, (ar,) > 1 K. Then, the following inequality for the ratio of the top2 probability to the incorrect rate holds for each sample:
P2(
o( v.) o(I3,18)) where o(x, v)
(19)
Py
Supposing that Lemma 1 holds under Pv; (a:) >> Pv; (I:z) for each true class probability in the input data (mi, y:) and (a Mj the following inequality obviously holds for the top2 probabili- ties:
Proof:
P2(x,) > P2(x)))
(20)
Hence, the incorrect rate for all data satisfies
Py. (xx) < py, (2z))
(21)
Because guarantee that the top2 probability does not overshoot the incorrect rate in any case, the following inequality holds:
P2(2))
p2(xx,)
(22)
pg. (x,)
Py, (xx))
Thus, we obtain o( vi) ol v,) by using o(z,y)
Pa(=)
py(
C TRAINING PROCESS FOR PROPOSED ADVERSARIAL TRAINING
Algorithm|] [ gives the training procedure for AT incorporating the proposed method. We activate the assigned weights for the loss after Ω epochs because the initial model is inappropriate for weighting. Hence, we use w = 1 (i.e., line 15) with less than epochs. Moreover, the computed weights are multiplied by the coefficient M instead of being directly applied to the loss. Despite the multiplica- tion of M by the weights in (Wang et al. 2021), Wang et al. (202T) do not discuss the necessity of this process. The experiments in this paper used M 3.
12

---

Under review as a conference paper at ICLR 2023
Algorithm Adversarial training incorporating our approach
Require: Training dataset batch size n,, training epochs T, learning rate 77, model parameter 0,
amount of warm-up Ω
Require: Function deriving adversarial perturbation
Require: Hyperparameters 3,
1: for = l,...., do
2: for { 1, ,,...
D do
3: 2; f- A(x, ysi
4:
s( y1) <p(e)),-'<t.)
o( 34
5:
c(2;; y/) [p(x=)]l2= (xt,
6:
s'(x,, 34) = s(æ;, 41) c(2 91)
7:
m( Ms) = m( yo) s Si yi)
8:
I Ω then
9:
if MAIL then
wi sigmoid(7 else WMMR then W; ex)(-m(@;,))) M
v6) + 3)) M
11:
13:
end if
else
15: W/ =1
end if
17: model update:
18: 0,+1 - O 17 1 Ei=1 Vows (ā.).)))
19: end for
20:
end for
21:
return model parameter 0
Incomeet 2212
92
85
19
similarity
Figure 4: Similarity computed by Eq. vs. incorrect rate for WRN34-10 trained with stan- dard AT on CIF The two measures have extremely large correlation, with correlation coefficient of 0.98 computed by Eq 23)
D CORRELATION BETWEEN INCORRECT RATE AND SIMILARITY
our experiment, we computed the correlation between two measures WRN34-10 trained by standard AT with the following equation:
Σn (Py, (x:) - vt) c') (c(x), 4:)
(23)
E (p.. (z.) - 1/12 1 (
c/)²
13

---

Under review as a conference paper at ICLR 2023
Table 5: Performance comparison results for the best models CIFAR-10. The upper and lower blocks are for ResNet-18 and WRN34-10, respectively. The bold results indicate the best- performing method in each case, and the underlined results indicate successful robustness improve- ment by introducing the proposed method.
Clean
FGSM
PGD-100
CW-PGD
APGD-CE
AA
Standard GAIRAT
83.84-10.171
57.71
50,98:10.21
50.50-10.31
50.55:1..22
13.86:10.13
ResNet-18
83.63=0.066
61.13=0.35
56.62=00:46
37.72=00.6
53.37=:0.47
34.76::0.66
EWAT
83.97:0.522
57.41=0.51
50.56=00.1
50.5110.50
50.14:0.34
48.03:10.48
WMMR
83.74=10.23
58.05=00.16
52.33+:.211
49.1240.12
51.70:10.25
46.57=:.12
MAII.
82.37-+0.23
60.41+00.08
56.99+00.00
47.90+t0.19
56.07+0.23
45.444-0.18
Ours + WMMR
83.87+0027
58.37-00.17
52.91+0.116
48.52+00.4
52.17+0.116
46.04-+0224
Ours MAIL.
82.66+00.09
61.74+0.25
58.36+0.30
47.43+0.23
57.24+00.0
44.82++0.36
Standard
86.67:10.1
61.33-0.115
54.1711:23
54.05
53.79.1.22
51.73310.32
WRN34-10
GAIRAT
85.74+0.90
63.50-0.38
60.45+0.18
45.85+2.48
57.29+0085
43.1242.42
EWAT
85.93+0046
60.98+0.62
54.17=0.24
54.27+40119
53.79+0.255
51.91+0.16
WMMR
86.57=0.18
61.30=0.23
55.16=0.37
52.76+0.39
54.64+0.35
50.36+00.3
MAIL
86.28110.12
63.60-1.02
59.77-10.11
$1.9111.29
58.9311..26
49.47-10.33
Ours WMMR
86.9110.311
61.36
55.00
53.27110.08
54.49
50.73110.12
Ours + MAIL
86.45110.19
64.66 10144
L0.25
51.8710.17
60.08
49.26.10.22
Table 6: Performance comparison results for the best models CIFAR-100. The upper and lower blocks are for ResNet-18 and WRN34-10, respectively. The bold results indicate the best- performing method in each case, and the underlined results indicate successful robustness improve- ment by introducing the proposed method.
Clean
FGSM
PGD-100
CW-PGD
APGD-CE
AA
Standard
07.48+0.50
33.09:0.116
29.51
27.76
28.71
0..16
GAIRAT
56.91+0.29
32.66+0.006
29.16#0.10
27.30+0..09
28.6140.13
24.69 10
ResNet-18
EWAT
57.75.10.32
32.8711.400
29.3510.19
27.2011.117
28.88110.18
25.03
WMMR
57.82-10.45
32.5110.255
29.03.10.16
26.84.10.20
28.34.10.21
24.02.10.27
MAIL
56.65-10.18
33.4911.155
31.36.10.07
25.72.10.18
30.62-10.09
23.02-10.17
Ours + WMMR
18.07=1..35
32,82+00.49
28.9440009
27.03+10.28
28.30-20.13
24.19::0.04
Ours MAIL
07.59=00.12
33.47+0.11
31.25
24.80
30,44:0.117
22.06
Standard
62.21110.19
35.58
31.43+0.31
30.51
31.00+L0.27
0..96
WRN34-10
GAIRAT
61.83+0063
35.4910.20
31.4810.15
30.4411.119
31.00+:..14
27.85
EWAT
62.18:0.28
34.6010.27
29.79::..2
29.0711.38
29.39:::28
26.75+10.30
WMMR
62.08:10.16
34.6440.23
30.9910.112
29.0910.11
30.5010.17
20.21
MAIL
62.36:10.21
37.2610.112
34.6411.112
29.42-10.13
33.9411.114
26.67
Ours WMMR
62.51+00.64
35.30+0..00
31.15+0.22
29.91+0.22
30.73+.0.31
27.22++0.35
Ours MAII.
63.00-0..11
37.12+0.24
34.56+0..18
29.07+-0116
33.78++0.19
06.38+H022
where n is the number of samples, p' Σi Pg. and c' = - c(
As shown in Fig. 4 there is a visual correlation between the two measures visually. Quantitatively, we observed a strong correlation with 0.98. Therefore, we can mitigate inappropriate behavior of the top2 ratio for correct samples with high confidence by relying on the similarity.
E ADDITIONAL RESULTS
This section describes experimental results that are omitted from the main paper to conserve space. The experimental settings were the same as those described in Section 4.1 Additionally, we added GAIRAT and EWAT as comparison methods and FGSM
attack.
Tables and Jande Glist the adversarial robustness and classification accuracy for the best model results of each method on CIFAR-10/100 respectively. The best model in the experiment was the checkpoint that achieved the best robustness against PGD-20 with the validation data. In terms of adversarial robustness, improved the performance for the standard accuracy and certain attacks by 0.32-0.58 (for ResNet-188 18) and 0.06-0.51 (for WRN34- 10) with "Ours+ WMMR". "Ours+MAIL" improved the performance for the standard accuracy and certain attacks by 1.17-1.37 (for ResNet-18) and 1.06-
14

---

Under review as a conference paper at ICLR 2023
Table Ablation study for the similarity of (T.(TT)
CIFAR-10. The upper and lower blocks
for the last and best models, respectively.
sim.: similarity.
Clean
FGSM
PGD-100
CW-PGD
APGD-CE
AA
w/ sim.
8..48:10.24
64.52:10.20
60.56:0042
0,35510,30
59.64:1.45
48.92:10.00
Last
w/o sim.
06.40110.09
64.52:10.28
60.8810.36
51.07:0.233
59,9110442
48.73:10.23
w/ sim.
86.45.10.19
64.66:10.14
61.05:0.25
5187710117
60.0810.21
49.26:10.22
Best
sim.
86.27:10117
64.88.10.22
61.35:10.17
51.45:0.21
60.3910.17
48.77:10.26
Table 8: Ablation study for the hyper-parameter 7 with ResNet-18, for the last model. The upper and lower blocks are for CIFAR-I0 and CIFAR-100, respectively,
Clean
FGSM
PGD-100
CW-PGD
APGD-CE
AA
2
82.66=0.10
61.46=0.20
57.96=0.13
47.24:0.116
56.95=0.119
44.78=0.29
CIFAR-10
3
82.78:10.16
61.52:10.47
57.81=0049
47.07=10.18
56.71+10488
44.54-10.30
7
82.35-+0.32
63.66.+0.19
60.64-
4..54
59.30-+0.20
42.64-+0.39
= 2
56,80=0.26
33.43=:0.14
31.14=0.18
25.81=0.113
30.36:00114
23.09=10.16
CIFAR-100
3
57.50+-0.23
33.47+0.11
0112
25.30++0.99
30.46+0.17
22.61+0.100
57.78+00.16
33.38+0008
30.93+0.05
24.68+0.111
30.15+00006
21.83+00.05
1.28 (for WRN34-10), Surprisingly, while the WRN34-10 results for GAIRAT were comparable or better than those for MAIL, "Ours+MAIL" outperformed GAIRAT.
Focusing on the results for CIFAR-100 in Table 6 we see that "Ouis+MAIL." had comparable or degraded performance relative to MAIL against certain attacks. Meanwhile, "Ours+MAIl." im- proved the "Clean" case by 0.94 (ResNet-18) and 0.64 (WRN34-10). "Ours+WMMR" improved the performance against many attacks and outperformed the "Clean" accuracy. The WRN34-10 re- sults showed improved robustness against all attacks; in particular, "Ours+WMME" improved the robustness by 0.82 at best against CW-PGD and AA.
Table 7 lists the performance results for the best and last models with and without the similarity on CIFAR-10. As described in Section 4.3 use of the similarity not only improved the robustness against CW-PGD and AA but also improved the "Clean" accuracy. The same results obtained for the best model.
Table 8 lists the results for ResNet-18 trained with different values, i..., {2, 3, 43. With in- creasing т, while the robustness against CW-PGD and AA significantly deteriorated, the robustness against PGD and FGSM was dramatically improved on CIFAR-10. On CIFAR-100, a large T im- proved the "Clean" accuracy, while the PGD and FGSM results were comparable. Meanwhile, the robustness against CW-PGD and AA deteriorated on both datasets. From these results, we deter- mined the best values as 2 for CIFAR-10 and 7 = 3 for CIFAR-100.
15


Reviews:
[{"review_id": "glh6g1Rsunp", "reviewer": "Reviewer_tft5", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposed a novel method for adversarial training called marginal reweighting. Previous instance-weighted adversarial training method does not take other classes into account for multiple classes classification. The key challenge is to quantify the importance of margins. This paper uses cosine similarity to represent the importance of the incorrect rate by leveraging the predicted probability distributions. And it takes all other classes into account and it could be incorporated into IRAT methods. It conducts experiments on CIFAR datasets and ablation studies to show the effectiveness of the proposed method.", "summary_of_the_review": "I would like to see more convincing results on larger datasets or more valuable experimental settings like problems with more classes. We would like to increase the scores if more convincing experiments are provided.\n", "strength_and_weaknesses": "Pros:\n1.\tThe idea is novel and it solves a challenge of traditional instance-weighted adversarial training for multi-class classification problems.\n2.\tThe presentation of the paper is clear and the method is easy to follow.\n\nCons:\nThe problem with this paper is that experiments are not so convincing. \n1. I think results on CIFAR-10 and CIFAR-100 datasets show that there is only marginal improvement in some cases. This might show that the challenge is not so significant for multi-class classification problems. \n2. Only about half of the methods improve performance when combined with the proposed method. For the strongest AA attack, the proposed method seems only achieve minor improvement. And it seems to be difficult to explain why others do not work. \n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "Not applicable"}, "extra_text": {}}, {"review_id": "TO29H5cusUu", "reviewer": "Reviewer_UgLM", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper finds that previous methods, which computed margins using the true class and the most confusing class, are insufficient for handling the instance reweighting in the multi-class cases. The authors argue that instances close to the intersection of the decision boundaries should be more important, so they should have a larger margin weight. Therefore, the authors propose an improved margin reweighting method and verify the effectiveness on multiple datasets and network structures.", "summary_of_the_review": "My main concern is that the proposed method cannot substantially improve the adversarial robustness of the network.", "strength_and_weaknesses": "+The method is well organized and extensive evidence is provided to support the proposed method.\n\n+The experiments are sufficient, including multiple benchmark datasets and different network structures.\n\n-The motivation is somewhat unclear. What is the main difference between the proposed margin reweighting method and the baseline? Why do instances closer to the intersection of the decision boundaries require larger weight values? How does the instance close to the intersection of the decision boundaries with a large weight value improve robustness?\n\n-The experimental results are pessimistic. AA is currently the most reliable robustness evaluation method. The proposed method has no improvement in AA, but it has declined compared to baselines. Therefore, I am concerned that the method proposed in this paper has no substantial robustness improvement.\n\n-There are some vague statements, such as:\n“Although GAIRAT achieves better robustness than standard AT, it is vulnerable against attacks other than PGD because it defines the importance in terms of the LPS.”\nFirst, AA is currently the most reliable robustness evaluation method, and the robustness of GAIRAT is much lower than that of standard AT. Second, CE loss is invariant to shifts of the logits but not to rescaling [1,2]. Is the robustness of GAIRAT significantly reduced due to the amplitude of its scaling? I am not quite sure what “defines the importance in terms of the LPS” means.\n\n[1] Hitaj, Dorjan, et al. \"Evaluating the robustness of geometry-aware instance-reweighted adversarial training.\" arXiv preprint arXiv:2103.01914 (2021).\n\n[2] Croce, Francesco, and Matthias Hein. \"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks.\" International conference on machine learning. PMLR, 2020.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "1: The contributions are neither significant nor novel."}, "extra_text": {}}, {"review_id": "76JZBpnHvT", "reviewer": "Reviewer_QLpw", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper aims to address the problem of robust overfitting in the adversarial training, where the robust model overfits to the adversarial examples. Prior works address this by assigning different weight to different instances according to their importance. However, this has not been well extended to multi-class classification scenario, where the instance could be closed to the intersection of multiple class boundaries. In this work, larger weight is assigned to these examples and better suit for multi-class classification. However, the experiment does not demonstrate the effectiveness of the proposed method.", "summary_of_the_review": "The main concern of this work is the performance. There is little evidence that the proposed method is improving over the prior works.", "strength_and_weaknesses": "Strength \n(1).\tFigure 1 is a good illustration of the overall idea of the paper.\n(2).\tThe motivation of this work is interesting.\n(3).\tThe variance of the results is reported in the table.\n\nWeaknesses \n(1).\tThe gain of the proposed method is very minor, as shown in Table 1 and Table 2. Take the bottom block of Table 1 for example. When comparing WMMR with Ours+WMMR, we can see that the proposed method is almost the same as the prior work (some of them is even worse). This conclusion also holds both Cifar10 and Cifar100 dataset (Table 1 and Table 2). This conclude that the proposed method is not working. The author is suggested to provide more convincing results to support the effectiveness of the proposed method.\n(2).\tTable 3 shows completely different trend when \\tau increases from 2 to 4. For APGD-CE, the accuracy of Cifar10 improves when \\tau increases, while the accuracy of Cifar100 degrades when \\tau increases. This shows that the conclusion is inconsistent between 2 datasets. The author does not provide explanation to this circumstance.\n(3).\tTable 4 shows that there is no much difference with or without the similarity of Eq.(11) and it seems that the difference is coming from the variance \n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "0XngSSbINtH", "reviewer": "Reviewer_mrgM", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes instance-reweighted adversarial training (IRAT) which weighs the instances based on the suggested standard in the adversarial loss term. This paper suggests the margin-based standard which weighs more when the instance is near the decision boundary. While the previous margin-based instance-reweighted adversarial training approaches are already proposed, previous works have limitations to represent multi-class margins with suggested margin formulation. Therefore, the current paper proposes a modified margin equation that considers the multi-class.", "summary_of_the_review": "This paper suggests the modified margin-based reweighting scheme for adversarial training which shows a lack of novelty.\nFurther, in the results, it is difficult to find the effectiveness of the proposed methods.\nOverall, I recommend rejecting this paper.", "strength_and_weaknesses": "**Strength**\n- This paper tackles the limitation of previously suggested margin-based adversarial training which did not consider the multi-class margins.\n- The paper is easy to understand, clear, and well-written.\n\n**Weakness**\n- It is quite difficult to understand what is the motivation for using cosine similarity weights on top of equation 10. Especially, it is unclear why the suggested weight equation could be a better standard for instance reweighted adversarial training.\n- Based on the performance, I am not sure it is adequate to claim that the suggested weight equation helps to improve the robustness against AutoAttack. In ResNet18 and CIFAR10/CIFAR100, reweighting does not show any effectiveness. In larger architecture, the proposed method could not improve the previous margin based reweighting both in CIFAR10 and CIFAR100.\n- If the margin equation is the limitation to representing the multi-class margins, it seems better to use entropy as a standard.\n\n**Minor**\n- There is no explanation for M in equation 12.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "Not applicable"}, "extra_text": {}}]

Author rebuttal:

Decision: Reject