DAFA: Distance-Aware Fair Adversarial Training
Authors: Hyungyu Lee
Saehyung Lee
Hyemi Jang
Junsung Park
Ho Bae
Sungroh Yoon
Venue: ICLR 2024 poster (2024)
Keywords: adversarial robustness
robust fairness
adversarial examples
adversarial training
Primary area: unsupervised, self-supervised, semi-supervised, and supervised representation learning
TL;DR: We propose a method to improve robust fairness taking into account the similarities between classes.

Abstract: The disparity in accuracy between classes in standard training is amplified during adversarial training, a phenomenon termed the robust fairness problem. Existing methodologies aimed to enhance robust fairness by sacrificing the model's performance on easier classes in order to improve its performance on harder ones. However, we observe that under adversarial attacks, the majority of the model's predictions for samples from the worst class are biased towards classes similar to the worst class, rather than towards the easy classes. Through theoretical and empirical analysis, we demonstrate that robust fairness deteriorates as the distance between classes decreases. Motivated by these insights, we introduce the Distance-Aware Fair Adversarial Training (DAFA) methodology, which addresses robust fairness by taking into account the similarities between classes. Specifically, our method assigns distinct adversarial margins and loss weights to each class and adjusts them to encourage a trade-off in robustness among similar classes. Experimental results across various datasets demonstrate that our method not only maintains average robust accuracy but also significantly improves the worst robust accuracy, indicating a marked improvement in robust fairness compared to existing methods.

Published as a conference paper at ICLR 2024
DAFA: DISTANCE-AWARS FAIR ADVERSARIAL TRAINING
Hyungyu Lee", Saehyung Lee', Hyemi Jang', Junsung Park Ho Bae2",and and Sungroh !.3
Electrical and Computer Engineering, Seoul National University
Department of Cyher Security, Fwha Womans University
'Interdisciplinary Program in Artificial Intelligence, Scoul National University
rucy748snu.c ac. ac.kr
halo8218@ ac.kr wkca195110snu. ac kr acycon8snu.ac.
jerzyray8snu.ac.K
hobae@ewha www.haaacc..... kr
ABSTRACT
The disparity in accuracy between classes in standard training amplified during adversarial training, phenomenon termed the robust fairness problem. Existing methodologies aimed to enhance robust fairness by sacrificing the model's per- formance on easier classes in order to improve its performance However, we observe that under adversarial attacks, the majority of the model's pre- dictions for samples from the worst class biased towards classes similar to the worst class, rather than towards the easy classes. Through theoretical and empirical analysis, we demonstrate that robust fairness deteriorates the distance between classes decreases. Motivated by these insights, we introduce the Distance-Aware Fair Adversarial training (DAFA) methodology, which addresses robust fairness by taking into account the similarities between classes. Specifically, our method assigns distinct loss weights and adversarial margins to each class and adjusts them to encourage results across various datasets demonstrate that our method not only maintains average robust accuracy but also significantly improves the worst robust accuracy, indicating marked improvement in robust fairness compared to existing methods.
harder ones.
offe in robustness among similar classes. Experimental
INTRODUCTION
Recent studies have revealed the issue of accuracy imbalance among classes (He & Garcia 2009). This imbalance becomes even more pronounced during adversarial training, which utilizes ad versarial
examples (Szegedy et al. 2013) to enhance the robustness of the model (Madry al. (017). This phenomenon is commonly referred to as "robust fairness problem" (Xu et al. 2021). Existing research has introduced methods inspired by long-tailed (LTT classification studies (He Garcia 2009 Zhang al. 2023) to mitigate the challenge of achieving robust fairness. LT classification tasks tackle the problem of accuracy imbalance among classes, stemming from classifier bias toward classes with a substantial number of samples (head classes) within the LT dataset. The methods proposed for LT classification mainly apply opposing strategies to head classes and tail classes ttasses-hhsse classes within LT datasets that have a limited number of samples. For instance, methods proposed by [ao et al.] (2019) Khan et al. (2019); Menon et al. (2020) deliberately reduce the model output for head classes while augmenting the output for tail classes by adding constants. These approaches typically lead to improved accuracy for tail classes at the expense of reduced accuracy for head classes.
Benz al. 1222 noted similarities between the faimess issue in LT classification and that in adversarial training. They corresponded the head and tail classes in LT classification with the easy and hard classes in adversarial training, respectively. Employing a similar approach, they addressed robust fairness by compromising the model's 's relatively higher robustness on easy classes to bolster the robustness on hard classes. Subsequent studies (Wei et al. 2023 Li Liu 2023) also addressed
robust fairness by applying stronger regularization to the learning of easy classes compared to that of hard classes.
Corresponding authors

---

Published as a conference paper at ICLR 2024
Hard
Easy
Change (%0
on on
Prev.
Ant.
Accuracyta
Prediction(S)
Avg. Worst
(Cat)
s0-
25
Cat
Deer
Bird
Dog
Horse
Frog
Plane
Truck
Ship
Car
x
Similar ()++)
Dissimilar (
Ours
(Cat)
Figure 1: The figure illustrates the performance improvement for the worst class (cat) when training the robust classifier (Zhang et al. 2019) on the CIFAR-I0 10 dataset (Krizhevsky et al. 2009). by varying the training intensity for different class sets. While the previous approach (Xu et al. 2021 limits the training of each class proportional to class wise accuracy, our method considers inter-class similarity. Our approach intensifies the training constraints on animal classes, which are neighbors to the cat class, compared to previous methods, while relaxing constraints non-animal classes.
However, in this study, we find that while the fairness issue in LT classification is caused by biases towards head classes, the fairness issue in adversarial training is caused by biases towards similar classes. Fig. contrasts the outcomes using conventional robust fairness improvement techniques versus our method. The figure, at its center, depicts the accuracy of each class (red) on the CIFAR-10 R- dataset alongside the prediction of the worst class samples, "cat" (blue). The prediction the cat class highlights significantly higher likelihood of misclassification towards similar classes, such as the dog class, compared to dissimilar classes. In light of these findings, our strategy addresses robust fairness from the perspective of "inter-class similarity" Existing methods majorly constrain the learning of casy (non-animal) classes to boost the worst robust accuracy. In contrast, our method restricts the learning of similar (animal) classes more than previous methods while imposing fewer constraints on the learning of dissimilar (non-animal) classes. The results in Fig. indicate that our method notably enhances the worst class's performance while maintaining average performance compared to the previous method. This underscores the idea that in adversarial training, performance- diminishing factors for hard classes are attributed similar classes. Therefore, limiting the learning of these neighboring classes can serve an effective means to improve robust fairness.
In our study, we conduct thorough investigation into robust fairness, considering inter-class similarity, We theoretically and empirically demonstrate that robust fairness deteriorates by similar classes. Building on these analyses, we introduce the Distance-Aware Fair Adversarial training (DAFA) method, which integrates inter-class similarities to mitigate fairness concerns in robustness. Our proposed method quantifies the similarity between classes in a dataset by utilizing the model output prediction probability. By constraining the learning of classes close hard classes, it efficiently and substantially enhances the performance of the worst class while preserving average accuracy. Experiments across multiple datasets validate that our approach effectively boosts the worst robust accuracy. To summarize, our contributions are:
We conduct both theoretical and empirical analyses of robust fairness, taking into account inter-class similarity. Our findings reveal that in adversarial training, robust fairness deterio- rates by their neighboring classes.
We introduce novel approach to improve robust fairness, termed Distance-Awart Fair Adversarial training (DAFA). In DAFA, to enhance the robustness of hard classes, the method allocates appropriate learning weights and adversarial margins for each class based inter-class distances during the training process.
Through experiments various datasets and model architectures, method demon- strates significant enhancement in worst and average robust accuracy compared to existing approaches. Our code is available at https://gituhb.co//nny/////////
2

---

Published as a conference paper at ICLR 2024
"Car
"Animal"
"Cat"
80
70
"Non-animal"
70
60
60
50
Dog
Ship
(a)
(b)
Figure 2: (a) and (b) depict the results from distinct 5-class classification tasks. (a) presents the robust accuracy of the robust classifier trained on the cat class alongside other animal classes from CIFAR- 10, while (b) illustrates the robust accuracy of the robust classifier trained on the cat class in conjunction with non-animal classes in CIFAR-10.
PRELIMINARY
Adversarial training, as described in Madry et al. (2017), uses adversarial examples within the training dataset improve robustness. An alternative approach adversarial training is the TRADES method (Zhang et al. 2019). This method modulates the balance between model robustness and clean accuracy by segregating the training loss into the loss from clean examples and KL divergence term to foster robustness. Consider a dataset denoted by D = {( 3/)]== Here, æ, E Rd is clean data, and each yi from the class set indicates its corresponding label. The equation of the TRADES method can be expressed as the subsequent optimization framework:
min CCE(fo())).))+ max (L(fo(z;) 8.))). |Se
Here, & denotes the parameters of the model f. The cross-entropy loss function is represented by LCg. KL(-) represents KL divergence, and 3 is a parameter that adjusts the ratio between the clean example loss and the KI. divergence term. Additionally, is termed the adversarial margin. This margin sets the maximum allowable limit for adversarial perturbations. Regarding adversarial attacks, the fast gradient sign method (FGSM) stands as prevalent technique for producing adversarial samples (Goodfellow et al. 2014). Projected gradient descent (PGD) can be seen as an extended iteration of FGSM (Madry 2017). Adaptive auto attack (A") is an efficient and reliable attack mechanism that incorporates adaptive initialization and statistics based discarding strategy (Liu et al. 2022). Primarily, we use the TRADES methodology and 3 as our adversarial training and evaluation methods, respectively.
3 ANALYSIS
In classification tasks, the difficulty of each class be gauged by the variance between samples within the class or its similarity to other classes, i.e., the inter-class distance. Specifically, a class with substantial variance among samples poses challenges for the classifier, as necessitates the recognition of a broad spectrum of variations within that class. Previous studies utilized a class's 's variance for theoretical modeling of the robust fairness issue (Xu et al.) 202T Ma et al. 2022 Wei et al., 2023). These studies demonstrated that the accuracy disparity arising from differences in class variance is more pronounced adversarial settings compared to standard settings.
On the other hand, concerning inter-class distance, we can posit that class is harder to train and infer it closely resembles other classes. Fig 2a shows the results of classification task that includes the "cat" class alongside four other animal e classes, which are close or similar to the cat class, all under the same superclass: animal. Conversely, Fig 2iggbetstsents results with the cat class among four distinct non-animal classes. Notably, while the cat data remains consistent across tasks, its accuracy is lowest when grouped with similar animal classes and highest with dissimilar non-animal classes. These observations suggest that class's 's difficulty its proximity or similarity to other classes in the dataset. Consequently, the similarity between classes, which is measured by inter-class distance, plays a pivotal role in determining the difficulty of class.
vary, making it either the easiest hardest, based on
3

---

Published as a conference paper at ICLR 2024
3.1 THEORETICAL ANALYSIS
In this section, we conduct a theoretical analysis of robust faimess from the perspective of inter-class distance. Intuitively, a class is hard to learn and exhibits lower performance when is close to other classes than when it is distant. Based on this intuition, we aim to demonstrate that robust fairness deteriorates when classes are in close proximity.
A binary classification task We define a binary classification task using Gaussian mixture data, which similar to the binary classification task presented by Xu et al. (021)): D: Ma et al. (2022). Specifically, we introduce binary classification model given by [(æ=) sign( w + b). This model represents mapping function f X - y from input space to the output space y Here, the input-output pair (a, y) belongs to Fd x {=1}, with sign denoting the sign function. We define an input data distribution D as follows:
ify= = +1 (N(-ap, I), if y = -1
(N(
y u.G."
{-1,+1), p= (1,7. m).
RR
(2)
Here, E IRd denotes the identity matrix. We assume that each class's distribution has different
mean and variance, and this variability is controlled by > and cr 2 1. The class y +1 with relatively large variance exhibits higher difficulty and is therefore a harder class than y = -1. Here, we initially observe the performance variation of the hard class y +1 the distance between the two classes changes.
We define the standard error of model f as Reai (f) = Pr. (f(x) + v) and the standard error for specific class y E ) as Rnat (J'y). The robust error, with a constraint ||||| < (where is the adversarial margin), is represented as Rro = Pr. + 8) # y). The robust error for class y E y is denoted by Rras(fly) Let fnat = arg min Rnat and frob = arg min Ryob- Given these definitions, the aforementioned binary classification task conforms the following theorem:
Theorem Let O < < 1) and A = 2y > O. Given a data distribution D as described in equation 8-
2 Fnat and frob exhibit the following standard and robust errors, respectively:
Rnotl + 1) = Pr. (N(0.1) < -A
1+a
7)
+1
1
A
+
2
+
2 2log
(3)
2
2
0²
Reossfrobl + 1) Pr. (((0))) -A( 1 -c)++p
A
+
-c)²=
2 log
7
2
Consequenily, both Ruar (Snatl + 1) and Ryob (robs + 1) decrease monotonically with respect to a.
A detailed proof of Theorem can be found in Appendix C.I Theorem suggests that increases, indicating an increasing distance between the two classes, the error of the class y = decreases under both standard and adversarial settings. Furthermore, illustrate that the disparity in robust accuracy between the two classes also reduces when the distance between them increases.
Theorem 2. Let D (R(()) be the disparity in errors for the two classes within dataset D as evaluated by a classifier f. Then ((R(f)) is
D(R(S) R( 1) R()1-1) 1)
= Pr. ( - v (2g2(a) h(o) 1)) -Ag(a) + ( (())))))))))))))))))()))))))(( +
A
Mg) o²
(5)
where A = dy (()0) = 202 _ and in a standard setting g(a: = - while in an adversarial 0-
g²-1
setting, g(ar) 1 1 Then, the disparity between these two errors decreuses monotonically
with the increase of a.
Theorem 2 demonstrates that both in standard and adversarial settings, the accuracy disparity is more significant for closer classes compared to distant ones. A proof Theorem 2 is provided in Appendix
4

---

Published as a conference paper at ICLR 2024
Plane
Car
Acc. difference (%)
Standard Robust
Cal.
2.5
Accuracy (%6]
90
-0
Dog
70
Horse
Prog
1.5
Clean acc. (af Bird)
truck
50
Robust acc. (of Bird)
Pione
Car
Bird
Deer
Dogg
Horse
Frag
5nip
Track
Horse
Truck
Deer
Horse
Truck
Class (vs. Bird)
Class (v5. Bird)
(a)
(b)
(C)
Figure 3: (a) displays the class distances between classes in CIFAR-10 represented in the TRADES model. (b) and (c) depict the results from binary classification tasks on CIFAR-10' 10's bird class paired with three distinct classes: deer, horse, and truck. Specifically, (b) presents the performance for the bird class, while (c) displays the accuracy disparity for each respective classifier.
3.2 EMPIRICAL VERIFICATION
Empirical verification of theoretical analysis We undertake empirical verification based preliminary theoretical findings. We select three pairs of classes with varying distances between them from the CIFAR-10 10 dataset. Fig. Ba displays the distances between classes in the robust classifier. Based on this, we conduct binary classification tasks for the bird class, which is the hard class, against three other easy classes, ordered by distance: deer, horse, and truck. Initially, the performance of the bird class in the standard and robust classifiers to validate the assertion from Theorem [ that as the distance between two classes increases, the performance of the hard class increases. In Fig. 3b we observe that as the distance to the bird class increases, both performances improve, result that aligns with Theorem [ Secondly, corresponding to Theorem 2 that distant classes exhibit smaller accuracy disparity. The results in Fig. [3 highlight that as the distance to the bird class increases, accuracy disparity decreases. Thus, we confirm that the theorems presented earlier are empirically verified. Further details are provided in Appendices D.2 and C.2
compare
we validate
Class-wise distance The thcoretical and empirical analyses presented above indicate that class becomes challenging to learn when it is close to other classes. Intuitively, this suggests that in multi-classification task, the more a class's average distance from other classes decreases, the harder it becomes. Motivated by this observation, between the average distance to other classes and class difficulty. aiming to determine the extent to which this average distance reflects class difficulty in an adversarial setting. For simplicity, we will refer to the average distance of class to other classes as the "class-wise distance'.
conduct experiments examine the correlation
Fig. presents the correlation between class-wise accuracy and distance. The figure demonstrates a significant correlation between the two metrics. Hence, the class-wise distance aptly reflects the difficulty of a class; a smaller value of class-wise distance tends to correlate with lower class accuracy. Additionally. we explore the relationship between class difficulty and another potential indicator: variance. Fig. 44b] illustrates the correlation between class-wise accuracy and variance. Unlike class-wise distance, there doesn't 't appear to be correlation between class-wise accuracy and variance. This observation suggests that in an adversarial setting, the distance of a class plays a more crucial role in determining its difficulty than its variance. Previous studies emphasize the link between class-wise accuracy and variance, but our observations underscore the importance class-wise distance. Therefore, aim address robust fairness through the lens of inter-class distance.
4
METHOD
In this section, based on the above analysis, we explore approaches to enhance the performance of hard classes, aiming to reduce robust accuracy disparity. Through a simple illustration, we demonstrate that, to elevate the performance of hard class, it is more effective to shift the decision boundary between the hard class and its neighboring classes rather than between the hard class and distant classes. Subsequently, adjacent classes in adversarial training. A empirical verification confirms the efficacy of this method. Drawing upon these insights, propose novel methodology improve robust faimesss.
identify approach that effectively shifts the decision boundary for
5

---

Published as a conference paper at ICLR 2024
Class wise accuracy
2.9
80
Class wise accuracy
Accuracy (%)
Class-wise distance
Accuracy (%)
wlas variance
Distance
Variance
60
2.6
60
40
2.3
40
4.5
2.0
20
3.5
Plane
Car
Bird
Cat
Deer
Dog
Horse
Frog
Ship
Truck
Plane
Car
Bird
Cat
Deer
Dog
Horse
Frog
Ship
Truck
Class
Class
(b)
Figure 4: (a) illustrates the test robust accuracy and the average distance from each class to the other classes in the TRADES models for CIFAR-10. (b) displays the test robust accuracy and variance for each class in the TRADES models applied to CIFAR-10 (See Appendix D.2 for further details).
4.1 CONSIDERATION OF CLASS- WISE DISTANCE
Illustration example Our theoretical analyses in Section 3.1 demonstrate that robust fairness is exacerbated by similar classes. From this insight, we present an example illustrating that improving hard class's performance is more effectively achieved by moving the decision boundary (DB) between the hard class and its neighboring class than that between the hard class and a distant class. Fig. []shows a mixture of three Gaussian distributions with identical variance. Here, we consider the distributions from left to right as classes C, A, and B respectively. Class A, positioned between classes and C, is the hardest class. The figure displays the effect of moving the DBs, DB AB and DB AC away from class A's center. We will compare moving DB AB and moving AB to determine which is more efficient in enhancing the performance of class A. The shaded areas in the figure represent how much each DB needs to be shifted to achieve same performance gain for class A.
Comparatively, to achieve an equivalent performance enhancement, the shift required for DB AC is notably larger than for DB B. Moreover, considering potential performance drops in either class B or C from adjusting the DB, shifting the closer DB of class B appears more efficient for average accuracy than adjusting that of class C. This example consistently supports our intuition that an efficient strategy to mitigate accuracy disparity in cualticclassifiaation task is to distance the DB between neighboring classes. This approach demonstrates its efficiency terms of average accuracy, even though there might be change in the worst class. Furthermore, in various subsequent experiments, we observe net increase in performance.
Our approaches To distance the DB from the center the hard class A an adversarial setting, employ two strategies: adjusting loss weights and adversarial margins, e. Firstly, by assigning greater weight to the loss of the hard class, the learning process naturally leans towards improving the performance of this class, subsequently pushing the DB away from the center of the hard class. Secondly, in terms of the adversarial margin, as it increases, the model is trained to predict a broader range of input distributions as belonging to the specified class. Allocating a larger adversarial margin to the hard class than adjacent classes pushes the DB away from the hard class's 's center by the margin difference. Thus, assigning a larger adversarial margin the hard class can be leveraged as an approach to distance the DB between it and neighboring classes.
We conduct experiments with different adversarial margins across classes verify that assigning a larger margin to a specific class, compared to its neighboring class, shifts the DB and improves the class performance. Fig-5) shows the results of three robust classifiers trained on a binary classification task distinguishing between the bird and cat classes from CIFAR-10 10. Although each model has different adversarial margins during training, they are tested with consistent reveal that models with identical values perform similarly. However, when trained with varying values, both the clean and robust accuracy metrics highlight superior performance for the class with the larger margin. This suggests that to boost class's performance, it's beneficial allocate the hard class a larger adversarial margin. Further details on Fig, and theoretical analysis the adversarial margin's 's impact are available in Appendices D.2 and
6. The findings

---

Published as a conference paper at ICLR 2024
AB
DBAB
Rare 6, Fex
Clean atc. Robust acc. [c 6]
100
Kars B,
C
A
B
Accurary (%)
Eas Rest
90
80
70
60
Bird
Cat
Figure 6: Illustration example of classification of three gaus- sian distributions with varying means. The shaded areas in the figure are of equal size.
Figure 5: Results of binary classifi-
cation tasks between bird and cat.
4.2 DISTANCE-AWARE FAIR ADVERSARIAL TRAINING
Building on the aforementioned approaches, we introduce the Distance-Aware Fair Adversarial Training (DAFA) methodology, which incorporates class-wise distance to bolster robust faimess. We will establish a framework to assign loss weights and adversarial margins to each class based on inter-class similarities. Initially, we employ the class-wise softmax output probability as measure of these similarities. The average class-wise softmax output probability across all class data can encapsulate inter-class distance relationships (Hinton al. 2015). Hence, close classes tend to show higher probability values, whereas unrelated ones would have lower probability values. For brevity, we refer to the average class-wise softmax output probability as 'class-wise probability' This wise probability is denoted as (j), where stands for the true class and j for the predicted class. Here, p; (i) signifies the probability being correctly classified, representing the difficulty of the class. Utilizing the class-wise probability, we formulate strategy to allocate weights that prioritize the hard class in both the loss and adversarial margin. Each class weight in the dataset is denoted as Wy, where y E {1...., C} and C is the number of classes in the dataset. We devise new weight allocation approach: we reduce the weight of the easier class by a specific amount and simultaneously increase the weight of the harder class by the same magnitude.
Specifically, considering two classes i and j. we begin by comparing p;( and p,()). Once we determine which class is relatively easier, decide the amount of weight to subtract from the easier class and add to the weight of the harder class. In this context, taking into account the similarity between the classes, we determine the change in weight based on the similarity values between class i and j. i.c. Pi( or P3(( (i). Here, we determine the magnitude of weight change using the hard class as reference. That is, when class i is harder than j. we subtract pr(j) from W, and add pı(j) to W,. Taking into account the opposite scenario as well, the formula for computing the weight is as follows:
WW - W: + p(( W, < W3 - pj(
WW + W; (i)
if p(()) < P,().
if if > p,()). (6)
W + W3 + Pz)
Applying the above formula to general classification task, the weight for class is computed as follows:
W; W.o Σ ((p((() <pp(())<;;11} p.()) (p.(0) > p,()) (,())
j
1 1.) denotes an indicator function. WAo signifies the initial weight of class We set the initial weight for all classes to 1. Furthermore, when nearby classes are all at similar distance from the hard class, we observe that drawing more weight from the relatively easier classes among them leads to better outcomes. Based on these observations, we determine the weights for each class as follows:
W; 1 Σ (()(1)) < pr(5) p.(i),((i) 1(p(() pハ(i) ())))
Here, X is the hyperparameter that controls the scale of the change in W.. Eq. g results from multiplying the class difficulty p, or (i) with the changing weights pi( and py (i). Finally, incorporating the weights calculated according to Eq. R with the two approaches losss weight and adversarial margin- we propose the following adversarial training loss by rewriting Eq. [
C(x, y: W,)) = W,Ccr(fo(z)) v) 3 max (L fo(x +)).
(9)
7

---

Published as a conference paper at ICLR 2024
Table 1:
Performance of the models for improving robust fairness methods. The best results among robust fairness methods are indicated in bold.
(a) CIFAR-10
Clean
Robust
Method
Average
Worst
Poot
Average
Worst
Prob
TRADES
82.04 + 0.10
65.70 + 1.32
0.00
49.80 + 0.18
21,31 + 1.19
0.00
TRADES FRL
82.97 + 0.30
71.94 1 0.97
0.11
44.68 0.27
25.84
1.09
0.11
TRADES CFA
79.81 + 0.15
65.18 + 0.16
-0.04
50.78 + 0.05
27.62 + 0.04
0.32
TRADES BAT
87.16 = 0.07
74.02 + 1.38
0.19
45.89 + 0.20
17.82 + 1.09
-0.24
TRADES WAT
80.97 = 0.29
70.57 + 1.54
0.06
46.30 0.27
28.55
1.30
0.27
TRADES DAFA
81.63 = 0.20
67.90 + 1.25
0.03
49.05 0.14
30.53 + 1.04
0.42
(b) CIFAR-100
Clean
Robust
Method
Average
Worst
Pnat
Average
Worst
Prob
TRADES
58.34 0.38
16.80 + 1.05
0.00
25.60 + 0.14
1.33 + 0.94
0.00
TRADES FRL
57.59 + 0.34
18.73 + 1.84
0.10
24.93 + 0.29
1.80 + 0.54
0.33
TRADES CFA
57.74 1.31
15.00 + 1.55
-0.12
23.49
+ 0.30
1.67 + 1.25
0.17
TRADES + BAT
62.80 + 0.17
22.40
+ 2.15
0.41
23.42 + 0.08
0.20 + 0.40
-0.93
TRADES + WAT
53.56 + 0.43
17.07
+ 2.29
-0.07
22.65
+ 0.28
1.87 0.19
0.29
TRADES + DAFA
58.07 + 0.05
18.67 + 0.47
0.11
25.08 + 0.10
2.33 + 0.47
0.73
(c) STL-10
Clean
Robust
Method
Average
Worst
Prott
Average
Worst
Prob
TRADES
61.13 1 0.57
39.29 1 1.71
0.00
31.36
0.51
7.73 1 0.99
0.00
TRADES FRL
56.75 + 0.37
31.26 + 1.41
-0.28
28.99 0.39
7.94 + 0.49
-0.05
TRADES CFA
60.70 + 0.57
38.53 + 0.95
-0.03
31.88 + 0.14
7.69
1 0.27
0.01
TRADES BAT
59.06 + 1.29
36.75
+ 2.44
-0.10
23.37 1: 0.98
3.22 + 1.00
-0.84
TRADES WAT
52.92 + 1.80
30.82
+ 1.44
-0.35
26.98
0.25
6.72 0.75
-0.27
TRADES DAFA
60.50 + 0.57
42.23 + 2.26
0.06
29.98 + 0.46
10.73 + 1.31
0.34
In Eq. 9 the weights we compute are multiplied with both the cross-entropy loss and the adversarial margin. Although we could multiply the weights to the KI. divergence term to promote enhanced robustness for the worst class, a previous study (Wei et al. (023) indicates that using large 3 for the worst class can impair average clean accuracy without improving its robustness-we observe results that align with this finding. During the process of DAFA, similar to carlier methods (Xu et al. 2021 Wei et al. 2023). we apply our approach after an initial warm-up phase. Detailed algorithms of our methodology be found in Appendix
EXPERIMENT
Implementation details We conducted experiments on CIFAR-10. CIFAR- 100 (Krizhevsky et al. 2009), and STL-10 (Coates et al.) 2011) } using TRADES (Zhang et al. 2019) as our baseline adversarial training algorithm and ResNet18 (He et al.] 2016b) for the model architecture. For our method, the warm-up epoch was set to т 70 and the hyperparameter À was set to À = for CIFAR- 10 and À 1.5 for CIFAR-100 and STL-10 due to the notably low performance of hard classes. Robustness was evaluated using the adaptive auto attack (A3) (Liu et al., 2022). Since class-wiss accuracy tends to vary more than average accuracy, and showcased the mean accuracy from the final five epochs-effectivvee effectively averaging over models. To ensure fair comparison in our comparative experiments with existing methods, employed the
each test three times with distinct seeds
8

---

Published as a conference paper at ICLR 2024
original code from each approach. More specifics can be found in Appendix D.I Additionally, the results of experiments comparing each method both in each method's 's setting and the same setting are provided in the Appendix F
Improvement in robust fairness performance We compared the TRADES baseline model with five different robust fairness improvement methodologies: FRL (Xu et al., 202T), CFA (Wei et al., 2023), BAT (Sun et al. 2023). and WAT (Li & Liu, (203). as well as our own approach. Both average and worst performances for clean accuracy and robust aceuracy were measured. Additionally, to assess the change in worst accuracy performance against the change in average accuracy performance of the bascline model, we adopted the evaluation metric o proposed by [i & Liu (2023) (refer to Appendix D.Ip. A higher value of indicates superior method performance.
As summarized in Table la for the CIFAR-I0 dataset, most robust faimess improvement method- ologies demonstrate enhancement in the worst class's robust accuracy when compared to the baseline model. Yet, the existing methods reveal a trade-off: a significant increase in the worst class's s robust accuracy often comes at the cost of noticeable decline in the average robust accuracy, and vice versa. In contrast, our methodology improves the worst class's robust accuracy by over 9%p while maintaining the average robust accuracy close to that of the baseline model. Additionally, conducted experiments incorporating exponential moving average (EMA) Izmailov et al. (2018) into our method, following the approach of the previous method (CFA) that utilized a variant of EMA. As shown in Table 11b when EMA is employed, our method demonstrates robust average accuracy comparable the existing method while significantly increasing robust worst accuracy.
From Tables lb and [c] it's evident that for datasets where worst robust accuracy is notably low, most existing methodologies struggle enhance it. However, similar to the results on the CIFAR- dataset, our approach successfully elevates the worst robust accuracy while preserving the average robust accuracy. Moreover, terms of clean accuracy, conventional methods lead to a marked decrease in average clean accuracy. In contrast, our approach preserves clean accuracy performance comparable to the baseline. These results underscore the efficiency of our approach in significantly enhancing the performance of the worst class without detrimentally affecting the performance of other classes compared to conventional methods. By comparing the Prob results across all three datasets, we can confirm that our method considerably improves robust fairness compared to existing techniques.
Through DAFA, we conducted experiments to ascertain whether the two class- wiiee parameters applied to the loss LCE and adversarial margin e, effectively im- prove robust fairness. Table 2 presents the re- sults of individually applying each class-wise parameter as well as applying both concurrently. The results indicate that both class-wise param- eters effective in enhancing the worst class accuracy. When combined, the improvement is roughly equal to the sum of the enhancements obtained from each parameter individually. Ad- ditionally, we have verified that DAFA performs well when applied standard adversarial training (PGD) (Madry et al.] (2017) or other architectures. Results and analyses of various ablation studies, including the warm-up epoch and the hyperparameter X, can found Appendix F
Effectiveness of DAFA
Table 2: Performance comparison of our methods when applied only to the loss and when applied only to the adversarial margin.
Robust
Method
Average
Worst
TRADES DAFACcE
49.80 + 0.18
21.31 + 1.19 28.10 + 1.26
49.41 + 0.15
DAFA, DAFA
49.51 = 0.15
23.64
+ 0.85
49.05 + 0.14
30.53 + 1.04
CONCLUSION
In this study, we analyze robust fairness from the perspective of inter-class similarity. We conduct both theoretical and empirical analyses using class distance, uncovering the interrelationship between class-wise accuracy and class distance. We demonstrate that to enhance the performance of the hard class, classes that are closer in distance should be given more consideration than distant classes. Building upon these findings, we introduce Distance Aware Fair Adversarial training (DAFA), which considers inter-class similarities improve robust faimesss Our methodology displays superior average robust accuracy and worst robust accuracy performance across various datasets and model architectures when compared to existing methods.
9

---

Published as a conference paper at ICLR 2024
7 ACKNOWLEDGEMENT
This work was supported by the National Research Foundation of Korea (NRF) grants funded by the Korea government (Ministry of Science and ICT, MSIT) 0192RIA3B107722 and 2022R I ASA708390811) Institute of Information & Communications Technology Planning & Evalu- ation (ITTP) grants funded by the Korea government (MSIT) (2021-0-01 343: Artificial Intelligence Graduate School Program (Seoul National University) and 2022-0-00959), Al Convergence Innova- tion Human Resources Development (EWU) (RS- 000--2222000156500 and the BK21 FOUR program of the Education and Research Program for Future ICT Pioneers, Scoul National University in 2023.
REFERENCES
Philipp Benz, Chaoning Zhang, Adil Karjauv, and In So Kweon. Robustness may be at odds with fairness: An empirical study on class-wise accuracy. In NeurIPS 2020 Workshop on Pre-registraation in Machine Learning, pp. 325-342. PMLR, 2021.
Kaidi Cao, Colin Wei, Adrien Gaidon, Nikos Arechiga, and Tengyu Ma. Learning imbalanced datasets with dasel-distributton aware margin loss. Advances in neural information processing systems, 32, 2019.
Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C Duchi, and Percy S Liang. Unlabeled data improves adversarial robustness, In Advances Neural Information Processing Systems, pp- 11190-11201 2019.
Adam Coates, Andrew Ng. and Honglak Lee. An analysis of single-layer networks in unsupervised feature learning. Proceedings of the fourteenth international conference on artificial intelligence and statistics, pp. 215-223. JMLR Workshop and Conference Proceedings, 2011.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter- free attacks. arXiv preprint vrXiv:2003.0169) 2020.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv: 2014.
Sven Gowal, Sylvestre-Alvise Rebuffi, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy& A Mann. Improving robustness using generated data. Advances in Neural Information Processing Systems,
2021.
Haibo He and Edwardo A Garcia. Learning from imbalanced data. IEEE Transactions on knowledge and data engineering, 2169):1263-1284, 2009.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual net- works. In Computer Vision-ECCC 2016: 14th European Conference, Amsterdam, The Netherlands, October 11-14, 2016, Proceedings, Part IV 14, pp. 630-645. Springer, 2016a.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pallern recognition, pp. 770-778, 2016b.
Geoffrey Hinton, Oriol Vinyals, Jeff Dean, et al. Distilling the knowledge in a neural network. arXiv preprint arXiv: 1tt::.:0000.5333 2(7), 2015.
Yuzheng Hu, Fan Wu, Hongyang Zhang, and Han Zhao. Understanding the impact of adversarial robustness on accuracy disparity. In International Conference on Machine Learning, pp. 13679- 13709. PMLR, 2023.
Pavel Izmailov, Dmitrii Podoprikhin, Timur Garipov, Dmitry Vetrov, and Andrew Gordon Wilson, Av- craging weights leads to wider optima and better generalization. arXiv preprint arXiv:1803.05400) 2018.
Salman Khan, Munawar Hayat, Syed Waqas Zamir, Jianbing Shen, and Ling Shao. Striking the right balance with uncertainty. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 103-112, 2019.
10

---

Published as a conference paper at ICLR 2024
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. Technical report, Citeseer, 2009.
Sachyung Lee and Hyungyu Lee. Inducing data amplification using auxiliary datasets in adversarial training. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pp. 4551-4560, 2023.
Saehyung Lee, Hyungyu Lee, and Sungroh Yoon. Adversarial vertex mixup: Toward better adversari- ally robust generalization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 272-281, 2020.
Sachyung Lee, Changhwa Park. Hyungyu Lee, Jihun Yi, Jonghyun Lee, and Sungroh Yoon. Re-
data. In International Confer- moving undesirable feature contributions using pttttp:://opereevieee net/ forum?ic
ence on Learning Representations, 2021. URL htt.hhtpps...
e eIYYL6fpbkA,
Boqi Li and Weiwei Liu. Wat: improve the worst-class robustness in adversarial training. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pp. 14982-14990, 2023.
Lin Li and Michael Spratling. Data augmentation alone can improve adversarial training. arXiv preprint 1xXiv:2301.09879 2023.
Ye Liu, Yaya Cheng, Lianli Gao, Xianglong Liu, Qilong Zhang, and Jingkuan Song. Practical evaluation of adversarial robustness via adaptive auto attack. arXiv preprint 455554 2022.
Xinsong Ma, Zekai Wang, and Weiwei Liu. On the tradeoff between robustness and fairness. Advances in Neural Information Processing Systemx, 35:26230-26241, 2022.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint (00.:0/770660... 2017.
Aditya Krishna Menon, Sadcep Jayasumana, Ankit Singh Rawat, Himanshu Jain, Andreas Veit, and Sanjiv Kumar. Long-tail learning via logit adjustment. arXiv preprint arXiv:2007.07314, 2020.
Tianyu Pang, Xiao Yang. Yinpeng Dong, Hang Su, and Jun Zhu. Bag of tricks for adversarial training. In International Conference on Learning Representations, 2021. URL htttps://operreviit net iiterrummixxxxxxxtete.
Sylvestre-Alvise Rebuffi, Sven Gowal, Dan Andrei Calian, Florian Stimberg, Olivia Wiles, and Timothy A Mann. Data augmentation can improve robustness. Advances in Neural Information Processing Systems, 34:29935-29948, 2021.
Chunyu Sun, Chenye Xu, Chengyuan Yao, Siyuan Liang, Yichao Wu, Ding Liang, Xianglong Liu, and Aishan Liu. Improving robust fariness via balance adversarial training. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pp. 15161-15169, 2023.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow. and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv: 1t...1/9299999 2013.
Qi Tian, Kun Kuang, Kelu Jiang, Fei Wu, and Yisen Wang. Analysis and applications of class-wise robustness in adversarial training. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, pp. 1561-1570, 2021.
Antonio Torralba, Rob Fergus, and William T Freeman. 80 million tiny images: A large data set for nonparametric object and scene recognition. IEEE transactions on pattern analysis and machine intelligence, 30(1 1):1958-1970, 2008
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be odds with accuracy. arXiv preprint /805. 2018
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma. and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In International Conference on Learning Representations, 2019.
11

---

Published as a conference paper at ICLR 2024
Zeming Wei, Yifei Wang, Yiwen Guo, and Yisen Wang. Cfa: Class-wiss wise calibrated fair adversarial training. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 8193-8201, 2023.
Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust general- ization. Advances in Neural Information Processing Systems, 33:2958-29666 2020.
Han Xu, Xiaorui Liu, Yaxin Li, Anil Jain, and Jiliang Tang. To be robust or be fair: Towards fairness in adversarial training. In International Conference on Machine Learning, pp. 11492- 11501. PMLR, 2021.
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. arXiv preprint 1rXiv:1605.07144 2016.
Hongyang Zhang. Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In Kamalika Chaudhuri and Ruslan Salakhutdinov (eds.), Proceedings of the 36th International Conference Machine Learning, volume 97 of Proceedings of Machine Learning Research, pp. 7472-7482, Long Beach, California, USA, 09-15 Jun 2019. PMLR. nttps: /ttp:://gttae //ggggttuuu. com htt.:///wwoooggo/o/oooo...o TRADES
mlr mll.... wtt.://s..........////111.
zhang1 html
Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankan- halli. Attacks which do not kill training make adversarial learning stronger. In International conference on machine learning, pp. 11278 1287. PMLR, 2020.
Yifan Zhang, Bingyi Kang. Bryan Hooi, Shuicheng Yan, and Jiashi Feng. Deep long-tailed learning: A survey. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2023.
A THE ALGORITHMS OF DAFA
Algorithm Training procedure of DAFA
Algorithm 2 DAFAcomp
Require: Dataset D, model parameter O, batch size n, warm-up epoch т, train- ing epoch K, learning rate a, class-wise probability p
Require: Number of class C, Classwwise probability p. Scale parameter À
1: W +- 1
1: nominal adversarial training:
for i 1 C do
2: for 1 to r do
3: for j = 1 to C' do
3:
W: ~ D f Brarg ming L(x; + 8,, Vi)
4: if ffi==a j then
4:
5:
continue
5: p + 8,,4.) v.)
else if p;) < Pi( then
6: end for
7:
W; +- W, + Ap:(j) .p;(i)
7: compute parameter weights:
else p.)) > py(s) then
8: W + DAFAAcoopp to K do
9: W. + W, (p, ((())
9: fort=
10: end if
1 ~ D 11: 0 < arg ming L(x; 8i, v:: Wy.)
10:
11: end for
12: end for
12: end for
13: return W
return f(:0)
During model training via adversarial training, the method is applied post warm-up training phase. Additionally, since we determine the weight values using the softmax output probability results of adversarial examples computed during training, there is additional inference required for the computation of these weight values. In this context, to determine the weight value for each class using Eq. 8 at every epoch, a computational cost of (C22) is incurred, where C represents the number of classes. Recognizing this, we compute the training parameters solely once, following the warm-up training. As result, methodology be integrated with minimal additional overhead.
12

---

Published as a conference paper at ICLR 2024
B RELATED WORK
Adversarial robustness Adversarial training uses adversarial examples to train the model robust
to adversarial examples (aadry al. 2017). For a dataset D {( U/ ] J==1- where æ; Rd is clean data and each yi from the class set indicates its label, the equation of adversarial training can be expressed as the subsequent optimization framework:
min
max (oE(fol2; + 6.).81). |66.15
(10)
Here, 0 denotes the parameters of the model f. and the loss function represented by C. Additionally, is termed the adversarial margin. This margin sets the maximum allowable limit for adversarial perturbations. An alternative approach to adversarial training is the TRADES method (Zhang et al.) 2019). In addition, various methodologies have been proposed to defend against adversarial attacks. encompassing approaches that leverage different adversarial training algorithms (Wang et al. 2019) eu al. 2020 Zhang et al. 2020), methodologies that enhance robustness performance through the utilization of additional data (Lee et al., 2021 Carmon et al. 2019 Lee & Lee 2023 Gowal et al.
202Ip. and methodologies employing data augmentation (Rebuffi et al. 2021 Li & Spratling/ 2023)
For the attacks, as mentioned in the main paper, the fast gradient sign method (FGSM) stands as a prevalent technique for producing adversarial samples (Goodfellow et al. (014).. PGD can be seen as
an extended iteration of FGSM (Madry et al., 2017). Auto/ttack (Croce & Hein 2020 and adaptive
auto attack (A²) (Liu et al. 2022) are efficient and reliable attacks. We employed A to assess the robust accuracy of various models.
Robust fairness Benz (2021) posited that the issue robust fairness resembles the accuracy disparity problem arising from class imbalances when training on LT distribution datasets. Based on this premise, they applied solutions designed for handling LT distributions to address robust fairness. As result, while the performance of relatively easier classes decreased, the performance of more challenging classes improved. Tian et al. (202T) highlighted the robust fairness issue and, through experiments across various datasets and algorithms, observed that this issue commonly manifests in adversarial settings. Xu et al. (202T) perceived the robust fairness issue as emerging from differences in class wise difficulty and theoretically amalyzed it by equating it to variance differences in class-wise distribution. Building on this analysis, they introduced regularization methodology proportional to class-wise training performance, enhancing the accuracy of the worst-perorrming class. Ma et al. (202)) revealed a trade-off between robust fairness and robust average accuracy, noting that this trade-off intensifies the training adversarial margin increases.
Wei et al. (2023) identified that datasets have class-specific optimal regularization parameters or values for adversarial training. Utilizing both training and validation performances, they proposed method that adaptively allocates appropriate regularization to each class during the learning process, thereby improving robust fairness, Hu al. (2023) conducted a theoretical examination of accuracy disparity in robustness from a data imbalance perspective and, through experiments on various datasets, demonstrated the relationship between data imbalance ratio and robust accuracy disparity. Li & Liu (2023) suggested methodology that uses validation set to evaluate the model and update the loss weights for each class, subsequently enhancing the performance of the perts-performing class. Sun et al. (2023) divided robust fairness into source class faimess and target class fairness. By proposing a traiming method that balances both, they successfully reduced the performance disparities between classes.
C THEORETICAL ANALYSIS
C.1 PROOF OF THE THEOREMS
In this section, we provide proof for the theorems and corollaries presented in our main paper. We begin by detailing the proof for the newly defined distribution, D':
[N(T,, if +1 (N(-71,1)) if = -1
y u.0.5 {-1. +1}, == (n. n. ...)) ..).
(11)
13

---

Published as a conference paper at ICLR 2024
Here, denotes an identity matrix with dimension of d, and o² represents the variance of the distribution for the class y/ = +1, where o² > 1. 7 is constrained to be greater than zero. We initiate with lemma to determine the weight vector of an optimal linear model for binary classification under the data distribution 'D'.
Lemma 1. Given the data distribution D' as defined in equation 11 if an optimal classifier f minimizes the standard error for binary classification, then the classifier will have the optimal weight
vector w = 78
Vil
For the classification task discussed in Section 3.1 the weight of the classifier adheres to the condition |w 1. We establish Lemma following the approach used in Xu et al. (2021): Tsipras et al. 20018)
Proof. Given a weight vector w = (W), U2.... ..., wa). we aim to prove that the optimal weight satisfies 11 W2
wy. Let's assume, for the sake of contradiction, that the optimal weight Wd. Hence, for some i * j and
of classifier f doesn't 't meet the condition W1 = We = i E (1,2,-. ..., d}, let's say w; wi- This implies that the optimal classifier f has particular standard error corresponding to the optimal weight w.
Reat (f(+)+++))+mmmm (fl-1) Pr. Σ WwW.mnnnnHHHHHHHWW/mneH/reyhyhe <)
+ Pr.
Σ k
wxN(->m, +) w.W w,N 1) (12)
Now, consider new classifier f', which has the same weight vector as classifier f but with replaced by wy. The resulting standard error for this new classifier f' can then be described as follows:
Rmat
= Pr.( Σ k
wnN()nn ow..
+ Pr.
0). (13)
kysiky
Given that Pr. Pr.(w,,N(7)) 1) > 0) < Pr. Pr.(w,,N(7r 1) > 0), the standard error for each class under the new classifier is lower than that of f. This contradicts our initial assumption that the weight of the classifier f is optimal. Therefore, the optimal weight must satisfy wi ... Wg. Since we've constrained [ lll
follows that ( Va val
Next, we will prove the following lemma.
Lemma 2. The optimal standard error for the binary classification task in Lemma 7 is identical to the optimal standard error for the binary classification task of the distribution obtained by translating D'.
Proof. Let Ç represent the magnitude of the translation. Then, the standard error for binary classifica- tion of the translated distribution is as follows:
d
Ryas (gl + 1) + Rnae(g) - 1) = Pr. Σ w ( <0)
+ Pr. Σ
W (14)
14

---

Published as a conference paper at ICLR 2024
Let w' = (w1, woy...,''' represent the weight parameters and let b' be the bias parameter of the classifier for the given classification task. Assuming that ||w'l) 2 = 1 as previously mentioned, the equation can be reformulated as:
d Σ E + D' <0)
Rnl + 1) + Rnae 1) Pr.
Σ w (n/N(s,,
d + Pr. Σ w + Σ w + >)) (15)
Given that the equation above matches the standard error of the binary classification for the data distribution D' when b' is replaced as 6' b- Eí w&C, can be deduced that the optimal standard error for binary classification of the translated distribution of D' is identical to that for D'. O
To establish Theorem ! we leverage the aforementioned lemmas.
Theorem 1. Let O < c < n and = 2yde 0²-1 > O. Given data distribution DD as described in equation 2 Snat and Frob exhibit the following standard and robust errors, respectively:
Reat (Snatl 1) Pr. (N < -A( < 1 + a 1) + V A
1 +
2
7)
2
0²² 02-1
2 2og 07
(16)
RraasSroul + 1) = Pr. (r.( < 1+a - o) +
A
+
a
-))²+
2log o
2
0²
(17)
Consequently, both Reaa (fratl + 1) and Rrob + 1) decrease monotonically with respect to a.
Proof. In light of Lemma
2 the distribution D for binary classification can be translated by an
amount of 2-1 17 as follows:
SN p2,²1), if +1 W 2
y ua0r (11, μ (1 7. n........... .n).
1-- n. 1), y (18)
Based on Lemmal 1 the optimal classifier Snat for standard error has the optimal parameters, with
w = v Va Va ). Consequently, the standard errors of frat for = +1 and = 1 can be
expressed as:
Rmat (fratl + +1) = Pr. Σ
wiN(
1 1+a
2 7. 0 +b+00) (r.(
Vd 111 b 1
2 7)
(19)
Rnat(fratl 1) Pr.
Σ
wiN(
1 1 7, 1)+b00) PP.. <-v
1 1+
17) + +b..
(20)
We aim to minimize the combined error of the two aforementioned terms to optimize the classifier fnat
with respect to the parameter b. To do this, we follow the approach used in (Xu al. 202T), which
identifies the point where à 35 (Rmat (Srarl + 1) + Rnarl 1)) = 0. Given that the cumulative
distribution function of the normal distribution is expressed as (r. 1) < 2) = Si exp( dtt,
the derivative of the combined error concerning b is as follows:
- exp
1
Vd.
1 + a
2 -
))²) (-2) + exp
(-2--va)
1
Vol
1 +
1) + b)) = 0, (21)
2
2
x Texp
(-1
Vīl
+ 1)) +b)²) exp
5
(-
Vd
1
1))
5)
b
(22)
2
a
2
log log
1
vdl
1 +
a
+ 1))
-
1
Vd
1 +
b 22
(23)
2
2
2
2
15

---

Published as a conference paper at ICLR 2024
Then, the point where (Rnal
0 06
+ 1) Rnaa(fraal
1)) 0 is given
0² +1 b
1ta
4
1 + a
2 2 o (24)
0² Vdl
2 1)
(02
(02
1)3 2 71² +
-d(
o²
By employing the optimal parameter b, the standard error of the optimal classifier fnat can be reformulated.
1 Ruat (fnce + + Pr. (1 < -A
2 1)) + +V( ((
+ a
n) +
2log (25)
2
02
Here, A is defined
= 2y Our objective is then demonstrate Theorem 1: Rnar (Jnat))at) +1) 0²-1.
monotonically decreases with a. Leveraging the property >> 1, it follows that 2
0 and
d=-1
A > 0. The derivative of Eq. 25 with respect to a is:
i (nacl 1) exp(- da
2
A
(4)
L+e
3 2 l x
(26)
2
v(z) 1+a
(2)
S <expl- - -+1
A
1) +
(27)
2
2
( (1ta
A
) <0.
= exp( - +11
7
(28)
2
2
Here, 2+1 = -A( + (=) 1+ao 11)
2log -²- I Given that the derivative of Rnae(Jnat) + 1)
+
with respect to a is less than zero, Rnat (Snot] 1) monotonically decreases as increases.
Next, we aim to demonstrate that Ryob (rrss) + 1) monotonically decreases with respect to a. Following the proof approach for Rmot (Smatl + 1) and referencing Lemma the distribution 'D for binary classification can be shifted by an amount of = as follows:
[N L+e 2 p 02021), if== +1
3.0.P (11,+1), 4= (q.))..,)))
(29)
(- if -y=-1
Here, e satisfies 0 < e < 17. Given that the classification task can be aligned with the task outlined in Eq. 11 by adjusting the mean of the distributions to _ μ e, the optimal parameter wrob is chosen and the value of brob is determined follows:
wab
Vil
1 1 a
4 (02 Vi 1)2
+ a
2 a
Drab
vdl
e) - -0
dl
- +)²
(30)
0 -
2
2
0²
Using the optimal parameter wrob and brob, the robust error of the optimal classifier frob for class y +1 expressed as follows:
1+ Rrobl +1) Pr. (Nr(o <-
1+a n n-
1
1 +
-)
2log (31)
we deduce that ae Consequently, Ryob (frosl +T decreases monotonically with respect to a.
Since the derivative of Eq. 31 matches that of Eq. 25
a (Rrob(Sros) + 1)) < 0.
We subsequently prove Theorem 2 by leveraging the error computed in Theorem 1
16

---

Published as a conference paper at ICLR 2024
Theorem 2. Let (R(()) be the disparity in errors for the two classes within dataset 'D as evaluated by a classifier f. Then D (R())) is
D(R(f)) R( + 1] R(f -1
A = Pr.
< Aggaa) + V V h(()) o²
g(a) (0()) v (A))((a) h(0) <
(32)
where g(a:) 1 A
2y and h(o) 20 tog a²-1 d=
Then, the disparity between these two
errors decreases monotonically with the increase of a.
Proof. Based on the proof of Theorem given as:
1 the robust error of the robust model for class = -1 is
[Sobl - 1) = Pr. Pr. (V((0)
A 411a 1 2 11 1-
6) k) -1 A2
+ 2
-)) x)²
20 log
(33)
Given that log O, the robust error for class y +1 exceeds that for class y implying o2-1 (roo(frobl + +1) > Roos (frobl - 1). Consequently, the discrepancy in robust errors between the classes for the robust model can be formulated as:
Roob + 1) Rrob -raolfroll
Pr. ( (A2 + h(0) < + V V p(a)) h(()) o² ) (34)
g())
2n log We aim to demonstrate that the 0f_ derivative of the aforementioned function with respect to a is less than zero. This implies that the discrepancy between class errors decreases monotonically with respect to a. Then, the derivative, da (Rros(Frob) + 1) Roos 1)), can be expressed as:
where g(a) - -, = 2yde 2=-1" and h(o)
=
exp(-
2+1
A
7
(2))((a)
exp(
2-1
A
!1
A A²g(a)
2
2
((A)² ())))) (()
2
0
V (a) h(())
2
(2) g(a)
A
"1
A²g(a)
< exp(
A
+
2
(AA) (2)((())) +
h(a) o²
2
v (a)g((a) + h(o))
expp(- -
221 (-A-
(
? (1 (1+ (A2g>(a) + h(())
!
A
a
g((a)
+ AA'g²(a) + th(a)
Ag(a)
2
= =exp( -xp( 22
( - A (1+ +
Ag(a)
<0, (35)
(a) + M()
where 2+1 = - = (2) (a) + M(G) o² and --1 (A'g")) h(o)). We leverage
the property that =2, < = given a > 1, and the property that the derivative of 2 with respect to is less than zero, which is demonstrated in Theorem [ Hence,
increases, the discrepancy in robust errors between the two classes in the robust model diminishes monotonically. For the standard error of the standard model, since 0 < 1), substituting g(a) = _ " for g(a) 1+a n) in 2 the proof of Theorem doesn't 't alter the outcome the error's 's derivative with respect to a. Hence,
increases, the diserepancy in standard errors between the two classes in the standard model diminishes monotonically.
17

---

Published as a conference paper at ICLR 2024
C.2 ANALYSIS ON THE ROBUST FAIRNESS PROBLEM
In Sections 3.1 and 3.2 we demonstrate that robust fairness deteriorates as the distance between classes becomes closer. In this context, we examine the correlation between inter-class distance and the robust fairness issue, which is the phenomenon that accuracy disparity amplifies when transitioning from a standard to an adversarial setting, From the results of Fig [c] we can observe that as the distance between classes increases, the difference between the results of standard and robust settings also decreases. This suggests that the robust fairness issue also can be exacerbated by similar classes. To investigate this theoretically, we will prove the following corollary. drawing on the proof from Theorem 2 Let's denote for as the optimal classifier when a in equation 2 is set to 0r, The following corollary establishes the relationship between the robust faimess problem and the distance between classes.
Corollary 1. When given two different classification tasks with different alpha values of an and 02 (where On < (1)) and (a) > o, the following inequality holds:
D(Rros(f7oo) - ((Rnae < D ((Rrob(fros)) - D (R (frat)
(36)
Proof. We aim to prove that, given the difference in the value of g(a) by (representing the input distribution difference between a standard setting and an adversarial setting). the difference in the output of function D increases as a decreases. In other words, the above inequality implies that as a decreases, the slope of the function D becomes steeper. We demonstrated in Theorem 2 that the function D is decreasing function with respect to a. Therefore, if function D is proven to be a convex function, then the inequality holds true. We assume that the dimension of the input notably surpasses the variance of the class y +1, and that, the distance between the centers of the two distributions remains sufficiently vast to ensure learning in an adversarial setting, satisfying dg² (a) >> a both in standard and adversaria settings. Then, the second derivative of function D with respect to a, Baz (D(g(a))) is as follows:
2
2 -exp))-xp((- 2 -x)) )- -eppp-eexppp-ppppp
221
exp(- (1-2+1) +exp(
(=
(37)
where 2+1 = Ag(aa + y ( 2 (a( + h(a)
g 2-1 Ag(a) +A'g*(a++M00 241
02+1
da
8 and === da We will now demonstrate that equation 37 has a value greater than zero. First, =411 and 2", are given as follows:
and =ا = -//01 *41
8²=1
dar
(2) g())
(4)
MO) 02
111
7
0,
(38)
(A)2 g((a) M()
2
((2)² g + Ma) 3
4
A9g(0)
( 2 2ba)
172
2"
-
<
0.
(39)
v (ag + h(())
2
((A)
2 92 (a) + hlo))
4
22 -222) ())()) and eep <2 (2"")) ) > 0. Next, in order to prove that
Consequently, exp(
exp( - (-41()
2
exp( - ) (-2-1)1))) (-2_)) > 0 we first calculate (2+1241) 2
considering that dg >0
2 (2+1241) Ag(a) + A
(2((a) - V (2gg(()) + h(0)
1
(a))(a)
11
0 / A2 (a) M())
A
Ag(a) + 22)(a) 1 2A (aa) + M(a) (A) + l((o)
2A2
)(o) (
A
= Ag(aa) + (2)(a)
V AApy²(a)
1 1 h(o) x(o+1)((-11)dd6) (1)o(( idg² - 1) - -2 + 1) log o > 0.
= Ag(aa)
a Ag(a)
(40)
18

---

Published as a conference paper at ICLR 2024
Calculating z-12'11 yields the same value 241241- Taking into account Theorem where it's established 2-1 < 0, #41 0, and =21 > 241- the expression of the equation, exp(
- (-)((=)))22 exp( --2 "2 givenby.
2 ( (-2+1)(+411) -exp((
2 ) (-2+124) +2-12 2 ) exp(
exp(
2
"
expl 271 (1)((21111))) ( ( A + Agg(a))
12 g()
>0.
2 2
(A(g((a)+((o)))
(A2g²(()) + 1(())
(41)
As result, the following inequality satisfied.
82 daz (D(g(a))) = exp( - _ (-2+1) + exxp(
( -
exp( -
--2 exp( -
-
(x"1) > 0. (42)
This indicates that the function D is convex function with respect a. Consequently, equation 36 proven.
C.3 THEORETICAL ANALYSIS ON ADVERSARIAL MARGIN
In this section, we conduct theoretical analyses on the characteristics that emerge when different values of the adversarial margin, c, are allocated to distinct classes during adversarial training.
A binary classification task for adversarial margin e The setup of the binary classification task similar to that of Section 3.1 However, the two classes in this task have identical variances and the value of a is set to a = 1.
(W 1), if +1 (W(,,, 1), if y
y v.a.r
(-1,+1), 1 (1 1. m)),
(43)
Here, we assume that adversarial attacks, created with different margins for each class under the adversarial setting, are applied. Specifically, the upper bound of the attack margin for class y (denoted as e-1) is assumed to be smaller than the upper bound of the attack margin for class +1 (denoted as 441). In these conditions, the following theorem holds:
Theorem 3. Let 0 E-1 E+1 TJ. Then, the adversarial training of the classifier f will increase the standard error for class +1 while decreasing the standard error for class y = -1.
Rnai (fraal - 1) < Rroo(froll 1), Reat (frael + 1) > Rnet (frobl + 1).
(44)
Proof. Based Lemma 1 when w 1| 1, the optimal parameters for the standard classifier given by aa va" )/) Because the distributions in the task have identical variances, the optimal parameter b set to b = 0. As result, the standard error of the standard classifier for the class y -1 is equivalent to that for the class attacks cause the centroid of each class to move closer to the centroid of its counterpart. Per Lemma for datasets affected by such class shifts, the decision boundary is defined by the mean of the centroids of the two classes. Given that 61- < 0. the decision boundary lies nearer the centroid of the class = -1. Consequently, Rmat (robl 1) yields a value less than Rua (nat + 1), while class y -1 exhibits the opposite outcome.
+1. In adversarial settings, however, adversarial
19

---

Published as a conference paper at ICLR 2024
Theorem implies that in adversarial training, when each class is trained with distinct adversarial margin, the class subjected to an attack with a relatively higher upper bound for the adversarial margin will be trained to reduce its standard error.
Let's denote the robust error under an adversarial attack with an upper bound of e for the test set as RTob.e. and let's denote frab.e the classifier trained with an adversarial margin of applied equally to both classes y = +1 and y = 1. In this context, the robust classifier trained with different attack margins E and 1 adheres to the following corollary:
Corollary 2. Let the upper bounds of adversarial margins for the above classification task satisfy 0<EL <E41 < T,, and let the upper bound of adversarial margin for the test adversarial attack satisfy 0 < c < 77. and be applied uniformly across both classes. Then, it satisfies
Rrob,e(frod - 1) Ryob,e (frobeel 1) > (frol + 1) R (e (Frbbel + 1).
(45)
Because the optimal parameter of frob.e is the same as that for fnat. Corollary can be proven using the same method as Theorem 3 This corollary indicates that during adversarial training. classes trained with a larger value of can exhibit a smaller increase in error compared to those trained with a lesser value of e. This conclusion is supported both by the aforementioned theoretical analysis and the empirical evidence shown in Fig. [5] Assigning a higher adversarial margin to the harder class, in comparison to other classes, helps improve robust fairness.
D ADDITIONAL IMPLEMENTATION AND EXPERIMENTAL DETAILS
D.I IMPLEMENTATION DETAILS
Datasets The CIFAR-10 dataset (Krizhessky et al. 2009) contains 50,000 training images and 10,000 test images, spanning 10 classes. Similarly, CIFAR- 100 (Krizhevsky et al., 2009) comprises 50,000 training images and 10,000 test images distributed across 100 classes. Both CIFAR-10 and CIFAR- have image dimensions of 32 32 pixels. These datasets are subsets of the 80 million tiny images dataset (Torralba et al. 2008). which aggregates images retrieved from seven distinct image search engines. The STL- 10 dataset (Coates et al., [011] provides 5,000 training images and 8,000 test images across 10 classes, with each image having dimensions of 96 x 96 pixels. For our experiments, we resized the STI-10 dataset images to 64 x 64 pixels during model training. More details on these datasets are available at wtt.t::::///ttt. /ttppp:://ppperwww www.rrswwtthhccc.... t.coode..e.... com da datasets
Implementation details on experiments We performed experiments on the CIFAR-10, CIFAR- 100 (Krizhevsky al., 2009), and STL-10 (Coates et al., 2011) datasets. As the baseline adversarial training algorithm, we employed TRADES (Zhang et al. 2019). Our models utilized the ResNet 8 architecture (He et al. 2016b). We set the learning rates 0.1, implementing a decay at the 100th and 105th epochs out of a total of 10 epochs, using a decay factor of 0. 1 as recommended by Pang al. (2021). For optimization, we utilized stochastic gradient descent with a weight decay factor of 5e-4 and momentum set to 0.9. The upper bounds for adversarial perturbation were determined at 0.031 = 8). The step size for generating adversarial examples for each model was set to one-fourth of the lx bound of the respective model, over a span of 10 steps. To assess the robustness of the models, we employed the adaptive auto attack (A²) method (Liu et al. (0022) for rigorous evaluation. Furthermore, we adopted the evaluation metric p as proposed by Li & Liu (2023), which is defined as follows:
p p(f,D.A)= Acc (A)l)) (A(S)) (A)(AAx)) - Acc(A())) Acc(A(())
(46)
Acc (A())
Acc(-) represents average accuracy, while A.cwe(+) denotes the worst-class accuracy. A(f) sym- bolizes the model ff trained using the baseline algorithm, and (f) indicates the model f trained employing a different algorithm that utilizes strategy A. This metric allows us to evaluate whether the employed algorithm enhances the worst accuracy performance while maintaining average accu- racy performance relative to the baseline algorithm. A higher value of suggests superior method performance. Experiments were executed three times using three distinct seeds, with the results reflecting the average value across the final five epochs. To assess the performance of other methods, made use of the original code for each respective methodology. For each methodology's 's specific
20

---

Published as a conference paper at ICLR 2024
hyperparameters, utilized the hyperparameters from the original code for the CIFAR-10 dataset. For other datasets, we conducted experiments with various hyperparameter settings, including those from the original code. FRL (Xu et al. 2021) involves 40 epochs of fine-tuning after pretraining. WAT utilizes the 15-90-1001 LR scheduling identical to the settings of TRADES (Zhang et al. 2019). and )023) and BAT adopt the 100-150-200 LR scheduling following the settings of PGD (Madry et al. 2. As the performance difference between ResNet18 (He et al.] 2016b) and PreActResNet18 (He et al. 2016a) is not significant, we proceeded with the comparison as is. We measured the average performance of the five checkpoints after the second LR decay for CFA, BAT, and WAT. For FRL. using the pretrained model provided by the official code GitHub / tub. www. harmm/aanxuulu fa ir_rousst),, we conducted model training with 40 epochs of fine-tuning using PreActResNet1 8 architecture. We reported the results that showed the highest worst robust accuracy. Our experiments were carried out on single RTX 8000 GPU equipped with CUDAI and CuDNN7.6.5.
both CFA (Wei et al.
D.2 EXPERIMENTAL DETAILS
Experimental details of Fig. In Fig. the central portion illustrates the class-wise accuracy of the TRADES model (hhang et al. 2019) accompanied by the prediction outcomes of the cat class, using test data from the CIFAR-10 dataset. We assessed the performance across classes utilizing A (Liu et al. 2022). The results depict the accuracy variations of each model in comparison to the TRADES model. Performance results for the previous method were derived from the FRL method Xu et al. 2021).
Specifically, the red and blue arrows next "Hard," "Easy." "Similar," and "Dissimilar" in Fig. represent the facilitation or restriction of learning for the respective classes or class sets. When pointing upwards, it indicates the facilitation of learning for the associated class, whereas pointing downwards signifies a restriction of the learning for that class. The arrow size corresponds to the degree of facilitation or restriction. The color of the arrows is simply for differentiation, and the roles of the arrows are the same. The arrow for the class "cat"" points upwards, denoting the facilitation of learning. This is because the cat is considered the worst class, and to improve robust faimesss learning for the cat class is promoted by restricting the learning of other classes. The conventional approach ("Hard" and "Easy") restricts hard classes less (small arrows) and easy classes more (large arrows) with reference to class- wise accuracy (red bar). In contrast, our proposed method, considering the relative difficulty between classes and incorporating class-wise similarity with reference to the prediction of the cat class (blue bar), introduces new blue arrows alongside the existing red arrows. Similar classes to the cat receive additional downward blue arrows beyond the small red arrows, as they are more restricted compared the conventional difficulty- based approach. Conversely, dissimilar classes to the cat receive additional upward blue arrows beyond the red arrows, as they are less restricted compared the conventional approach.
Experimental details of Fig. 2 In Fig, 2 we trained distinet models using the TRADES method. One model was trained on five classes from CIFAR-10 (cat, horse, deer, dog, bird), while the other was trained on another set of five classes (cat, plane, ship, truck, car). For evaluation, we assessed the performance of each class using A (Liu et al. (2022). All other implementation details were kept consistent with the previously described experiments.
Experimental details of Fig. 3 In the results presented in Fig. 3a we quantified the distance between classes using models trained Via TRADES (Zhang et al. 2019), Thi distance was determined using the feature output of the TRADES model, specifically leveraging the penultimate layer's 's output as the feature representation. We designated the median feature of each class as its distribution's 's center and computed distances between these central features. our analyses for Figs. Tigs.Bh and 3c we identified the bird class as the hard class due to its consistently lower accuracy in most CIFAR-10 binary classification tasks, especially when paired with the three other classes: deer, horse, and truck. These three classes exhibit nearly identical accuracies when paired with each other in a binary classification, suggesting that their difficulties or variances are also almost equivalent. All models were trained using the TRADES methodology. Standard classifiers were assessed using clean samples, while robust classifiers underwent evaluation via the PGD attack (Madry et al. 2017). which employed an adversarial margin of = 8, step number of 20, and step size of 0.765.
21

---

Published as a conference paper at ICLR 2024
accuracy, variance, and distance using models trained with TRADES Zhang et al. 2019). The class class-wise wise accuracy was determined by evaluating the performance of each class using A Liu et al. 2022). Both the class-wis, variance and distance were assessed through the feature output of the TRADES model, where we utilized the output of the penultimate layer the feature output. Given trained model, the variance and distance of the distribution for each class can be defined as follows: Let ( represent the feature output of the trained model, No be the number of data class e, and Ti,e be the i-th data of class Then, the central feature of class e, denoted as Mee- given by 1ec No IN g(ti,)) Subsequently, the variance is defined as o² Ne Σi No (g(zx,c) - pe) For two different classes, e1 and c2. the distance is defined as Distance(c) (c1, c2) Me Meg 22- Using these definitions, we can approximately measure the variance within each class and the distance between classes that the model has learned.
Experimental details of Fig. 4 We measured
displays the results of three models trained on binary classification task to distinguish between the bird and cat classes from CIFAR-I0 using the TRADES methodology. Each model was trained with the adversarial margins depicted in the figure, and robust accuracy evaluation was performed using the projected gradient ascent attack (Madry et al. (017] The evaluation attack has an adversarial margin of 6, a step number of 20, and step size of 0.57375.
Experimental details of Fig. Fig. 5
E ABLATION STUDIES
Table 3: Performance DAFA across various architectures on the CIFAR-10 dataset. The best results are indicated in bold.
Clean
Robust
Arch.
Method
Average
Worst
Average
Worst
TRADES
81.93 + 0.17
66.41 + 1.12
49.55 + 0.15
21.50 + 1.51
DAFA
81.98 + 0.23
69.03 + 1.27
49.10 + 0.18
28.49 + 1.25
PRN18
+ DAFA,
81.93 = 0.31
66.71 + 1.26
49.38 + 0.19
23.65 + 1.19
+ DAFA
81.56 = 0.30
67.66 + 1.19
48.72 0.25
30.89 1.32
TRADES
85.70 = 0.13
71.97 0.90
53.95 0.12
26.24 0.85
+ DAFACCE
85.62 + 0.19
73.11 + 0.89
53.30 0.26
30.31 + 1.30
WRN28
+ DAFA,
85.14 = 0.18
71.79 + 1.10
53.49
0.25
28.81 + 1.27
+ DAFA
84.94 = 0.22
70.91 = 0.98
52.99 + 0.21
34.24 1.03
Ablation study on other architectures Table illustrates the effectiveness of our methodology when applied different model architectures: PreActResNet18 (PRN18) (He et al. 2016b) and WideResNer28 (WRN28) (Zagoruyko & Komodakis, 2016). The results indicate that the application of our methodology consistently enhances the worst robust accuracy compared to the baseline models, thereby reducing accuracy disparity. Both class-wiss components in the TRADES model, the cross-entropy loss Log and adversarial margin e, addressed through DAFA, demonstrate efficacy in improving robust fairness. Their combined application showcases the most significant effect.
Table Performance of DAFA for varying warm-up epoch on the CIFAR-10 dataset.
Clean
Robust
Warm-up
Average
Worst
Average
Worst
10
81.94 +: 0.24
68.83 + 1.36
48.92 + 0.26
29.59 + 1.30
30
81.73 + 0.18
67.97 + 1.07
48.77 0.29
29.32 + 1.23
50
81.52 + 0.37
67.67 + 1.23
48.89 + 0.21
30.58 + 0.74
70
81.63 0.14
67.90
1.25
49.05 0.14
30.53 - 1.04
90
81.58
0.26
67.95
0.94
49.06 0.13
30.48 + 0.97
22

---

Published as a conference paper at ICLR 2024
Ablation study hyperparameter of DAFA T the performance when the up epoch of DAFA is altered. The table suggests that, for warm-up epochs of 50 or more, the performance remains largely consistent. When calculating the class-wist weight W for applying DAFA at lower epochs, the improvement in worst robust accuracy is relatively modest. However, the results still reflect significant boost in worst robust accuracy with minimal average accuracy degradation compared to existing methods.
Table 5: Performance of DAFA for varying À on the CIFAR-10 dataset.
Clean
Robust
A
Average
Worst
Average
Worst
0.5
82.13 + 0.20
69.07 + 1.00
49.52 + 0.26
26.07 + 1.26
1.0
81.63 0.14
67.90 1.25
49.05 0.14
30.53 + 1.04
1.5
80.87 + 0.21
64.51 + 1.39
48.36 + 0.14
32.00
+ 0.92
2.0
79.80 0.29
62.16 1.87
47.39
0.23
29.27 + 1.64
Table 5 presents the performance when altering the hyperparameter DAFA, As the value of increases, the variation in class- wise weight W also enlarges, leading to significant performance shifts. At all values of x, an enhancement in worst robust accuracy is observed, with the results at A 1.5 showing stronger mitigation effect the fairness issue than the results at X 1.0.
Cat
Bird
1.3
Plane
1.2
Car -000
0.05
Depr
TRADES + DAFA
Weight m,
Cat
60
1.1
40
1.0
Horse
Dog
54
0.00
Dog
Plane
Frog
0.9
Ship
-0.05
0.8
Plange
Car Bird
Cal
Deer
Dog
Horse
frod
Ship
Truck
Truck
Pane
Car
Dird
Cat
Deer
Deg
Homse
Frog
Ship
Truck
Horse
Truck
Frog
Ship
(a)
(c)
Figure 7: (a) illustrates the weight W for each class on the CIFAR- 10 dataset, computed using the DAFA methodology. (b) presents the matrix showing the variations in weight W that was reduced for each class through the application of DAFA. (c) presents a comparison of the class-wise accuracy for the CIFAR- 10 dataset using the TRADES model, both before and after the application of DAFA.
Detailed results of DAFA Fig. depicts the class-wise weights W determined after applying DAFA to the TRADES methodology on the CIFAR-10 dataset. Observing the figure, it's sss evident that hard classes tend to exhibit higher values compared their similar classes. Fig. 7b illustattees matrix that reveals the values of weight shifts W between each class pair when applying DAFA to the TRADES methodology. In essence, the weight W shifts between similar classes are notably larger compared to the shifts between dissimilar class pairs. Fig. [r]sentstss the class robust accuracy for the TRADES model and model trained by applying DAFA to the former. From the figure, it's clear that our approach enhances the performance of hard classes, thereby mitigating fairness issues in adversarial trianing.
Application of DAFA to other adversarial training algorithms In addition to the TRADES method, we conducted experiments applying DAFA to various adversarial training algorithms. Table 6 preesents the results of applying DAFA to standard adversarial training using Projected Gradient Descent (PGD) (Madry al. 2017). The results demonstrate that applying DAFA to the PGD model effectively enhances worst robust accuracy while maintaining average robust accuracy. However, when DAFA is applied solely to the cross-entropy loss LCg, outperforms results that employ both LoE and the adversarial margin c. Furthermore, applying DAFA only to results in lower worst robust accuracy than the baseline.
23

---

Published as a conference paper at ICLR 2024
already demonstrated that, within an adversarial setting, when training with different val- ues of a class trained with larger exhibits higher worst robust accuracy. However, since we observed the opposite outcome for the PGD model, we empirically
In Appendix C.5
Exee 6, Feat 6
Clean acc. Robust acc. (E - 6)
100
Eteo 8, feal -
Creoy 4, Feot
Accuracy (96
90
re-examine the effect of on the PGD model through simple experiment. Fig. X presents the results of the empirical verification carried out on the PGD model, akin to what was performed for the TRADES model in Fig. 5 As in the experiment of Fig. S each model was trained with distinct adversarial margins for each class, yer all were tested using a consistent adversarial margin of = 6. The results clearly indicate that, similar to the findings in Fig. 5 both clean and robust accuracy met- rics showcase superior performance for the class trained with the relatively larger This outcome is consistent with our assertion that to enhance the performance of a hard class, it should be allocated a larger value of e. Consequently, while our theoretical insights apply both the TRADES model and the binary classification PGD model, they do not apply to the multi-class classification PGD model.
80
70
60
Bird
Cat
Class
Figure 8: The results from an experiment the PGD (Madry et al. 2017
model,
mirroring the conditions of Fig. 5
Table 6: Performance results of applying DAFA to PGD on the CIFAR-10 dataset.
Clean
Robust
Method
Average
Worst
Average
Worst
PGD
84.66 + 0.13
64.55 + 1.41
48.65 + 0.14
18.27 + 1.35
PGD DAFACCR
84.68 + 0.23
69.11 = 1.39
48.53 = 0.26
25.45 : 1.31
PGD + DAFA,
83.12 + 0.18
54.91 = 1.53
48.94 = 0.09
15,24 = 0.90
PGD + DAFA
83.93 0.21
67.40 + 1.35
48.02 + 0.28
21.83 + 1.39
plausible explanation for the observed phenomenon the presence or absence of learning from the clean data distribution. While the PGD model learns solely from adversarial examples, the TRADES model utilizes both clean and adversarial examples. Intuitively, the reason for the disparity between the results of the binary classification PGD model and the multi-class classification PGD model might be attributed the number of opposing classes. the binary classification PGD model, there's only one opposing class; hence, even if it learns only from adversarial examples, it can still maintain the vicinity around the center of the clean data distribution. However, in the multi-class classification PGD model, with multiple opposing classes, solely learning from adversarial examples might result in the vicinity around the center of the clean data distribution being encroached upon by a third class. Indeed, looking the clean accuracy of DAFA, for the worst class in Table 6 can confirm significant performance drop compared to the baseline model.
To validate the observations diseussed above, we conducted experiments applying methodology wherein the PGD model also learns around the center of the clean data distribution. Adversarial Vertex Mixup (AVmixup) (Lee et al. 2020) is an adversarial training approach that, instead of using adversarial examples, employs a randomly sampled data point from the linear interpolation of a clean data æ and its corresponding adversarial example x + 6, denoted as x + aδ, where 0 S a S 1. The label uses the one-hot label without applying mixup, ensuring that the distribution from the center of the clean data to the adversarial example learned. As shown in Table when applying DAFA to the PGD model trained through AV AVmixup, the worst robust accuracy improves by 2%p compared to the baseline model. In conclusion, for models like TRADES that incorporate clean data into their training, assigning a larger value of to the hard class is viable method to enhance the worst accuracy. However, in cases without such training, applying a large value of e to the hard classes may not yield the desired results.
Additionally, we explored the application of our approach to another adversarial training algorithm, adversarial weight perturbation (AWP) (Wu et al. 2020). The setting is the same as that of TRADES for ResNet18. The results in Table g demonstrate that applying our method to AWP significantly improves robust worst accuracy.
24

---

Published as a conference paper at ICLR 2024
Table 7: Performance results of applying DAFA, to PGD with the AVmixup Lee al. 2020
approach on the CIFAR-IO dataset.
Clean
Robust
Method
Average
Worst
Average
Worst
PGD AVmixxp
89.56 + 0.18
77.63 + 1.54
41.64 + 0.39
14.47 + 1.13
PGD AVmixup DAFA,
89.03 + 0.17
74.59 = 1.44
41.82 + 0.18
16.37 + 1.23
Table 8: Performance results of applying DAFA to AWP
Wu et al.
2020 on the CIFAR-10 dataset.
Clean
Robust
Method
Average
Worst
Average
Worst
AWP
81.33 + 0.02
64.30 + 1.10
49.97 + 0.18
20.65 + 0.45
AWP + DAFA
80.12 0.07
66.74 + 1.35
49.42 + 0.16
28.26 + 1.25
Utilizing other types of class-wise similarity for DAFA Our method focuses on enhancing robust fairness by calculating class weights using class-wise similarity. Thus, framework is not limited to prediction probability but can accommodate various types of class-wise similarity. Therefore, leveraging other class-wise similarities such embedding similarity in method is also feasible. To verify this, we employed the penultimate layer output as embedding vectors (e.g. 512-size vector for ResNet18) 18). The cosine similarity between vectors for each class is computed, normalized, and subsequently applied to the DAFA framework. Let e; represent the mean embedding vector of class i. The similarity between class and class can be expressed the normalized value of the cosine similarity between the two classes. In other words, if we denote (i( as the similarity between class è and class j. then pi(j) e₁ E,/Z, where ExE(1....c)) E, Gj. We applied the computed (r))) to 8q.Zin Section 4.2 and proceeded with the experiments. We chose X = 0.1 since the variance of similanity values calculated using embeddings is not significant. Table TableI9demoot demonstrates that utilizing embedding similarity yields outcomes similar to the conventional results obtained using prediction probability. It is observed that embedding similarity also demonstrates effectiveness in improving robust fairness, as indicated by the results.
Theoretically, the value of W can be negative when using hard examples reference. This occurs in the most extreme case, where in Eq. represents the easiest class, and all other classes j are almost certain to be classified as class i, resulting in min W; R Wi 9 for 10-class classification. The maximum value of W: is achieved when class is the most challenging class, with (i) 0 and To address this, we scale W for each dataset using the value in Eq. 7 ensuring that W is adjusted. Furthermore,
ES 1, yielding max W; W.o
apply clipping ensure W remains greater than (W = maximum (W, W, K') where K >> O). In our experiments, we selected À values of 1.0 for the CIFAR-IO dataset and 1.5 for the CIFAR-100 and STL-10 datasets, resulting in W values around 1.0.
Additionally, we conducted experiments verify the effectiveness of our method when referencing easy classes instead of hard classes. For our approach in Section 4.2 we restrict the learning of easy classes and promote the learning of hard classes using hard classes as a reference. However, irrespective of which class between i and is relatively easy or hard, if i and j form a similar class pair, the probability of class being classified as j and the probability of class being classified as both yield high values. Conversely, if they are dissimilar, both probabilities are low. Therefore, instead of using Pa (j) with hard classes as a reference, we can use P3 (i) with easy classes as a reference. Then, Pj (1) (p, P5 ()). The experiment results when referencing easy classes instead of hard classes are illustrated in Table Experimental results indicate that clean, average robust, and worst robust accuracy are all similar to the original results.
Eq. 7 Section 4.2 is modified as W; + fz (p)
Ablation study on hyperparameter of TRADES with DAFA We conducted experiments by varying the value of 3 of the TRADES method and applying our method. We compared the enhanced robust fairness with the baseline TRADES model. Table 10 shows the results when the value of
25

---

Published as a conference paper at ICLR 2024
Table 9: Performance results of utilizing other class-wise similarities for DAFA on the CIFAR-10
dataset.
Clean
Robust
Method
Average
Worst
Average
Worst
TRADES TRADES DAFA
82.04 0.10
65.70 + 1.32
49.80 + 0.18
21.31 + 1.19
81.63 = 0.08
67.90 + 1.25
49.05 + 0.14
30.53 + 1.04
TRADES DAFA (embedding)
81.87 = 0.12
69.80 + 1.35
48.92 + 0.08
29.60 = 1.27
TRADES DAFA (easy ref.)
81.71 = 0.08
67.28 + 1.48
49.08 + 0.21
30.22 = 0.82
varies (1.0, 3.0, 6.0, and 9.0). Although as the overall robust performance of the baseline models decreases, the robust performance of the models with DAFA also decreases, we can observe that, in all settings, the clean/average robust accuracy performance is maintained close to the baseline, while significantly improving the worst robust accuracy.
Table 10: Performance of DAFA for varying the value of for TRADES on the CIFAR-10 dataset.
Clean
Robust
Method
Average
Worst
Average
Worst
TRADES (8 1.0)
87.78 + 0.22
74.70 + 1.49
43.70 + 0.29
16.00 + 1.15
TRADES (B = 1.0) + DAFA
87.43 + 0.23
75.22 + 1.15
43.12 + 0.25
20.62 + 1.14
TRADES (B =3.0)
85.03 0.19
70.60 + 1.57
48.64 0.35
21.10 = 1.46
TRADES (B = =3.0) + DAFA
84.58 + 0.14
71.34 1.37
47.68 0.16
27.44 = 1.80
TRADES (B =6.0)
82.04 0.10
65.70
49.80
21.31 1 1.19
TRADES (5 = DAFA
DAFA
81.63 + 0.08
6.25
49.05 0.14
30.53 + 1.04
TRADES (B 9.0)
79.94 0.13
63.00
49.85 0.24
20.86
+ 1.38
TRADES (8 9.0) + DAFA
79.49 + 0.10
2.07
48.86
29.80 + 1.54
F ADDITIONAL COMPARISON STUDIES
Comparison study with other methods in each method's setting As explained in Appendix D we conducted ablation studies comparing our methodology in each setting, given the different compared. For the FRL setting, due to the low
experimental setups for each methodology performance of the pretrained model, after 10 epochs of fine-tuning, we compute class weight and apply our method for the remaining 30 epochs. We measure the average performance of the last five checkpoints. Upon examining the results in Tables [1 12 and [3 we observe that our method demonstrates average robust accuracy and clean accuracy comparable to the baseline algorithm in all settings. Simultaneously, it exhibits high level of worst robust accuracy compared to existing methods.
Comparison study with other methods in the same (our) setting Instead of comparing the performance each method conducted each setting, we conducted ablation studies comparing our methodology with other existing methods in the same setting. To assess the performance of other methods, we made use of the original code for each respective methodology. For each methodology specific hyperparameters, we utilized the hyperparameters from the original code for the CIFAR-10 dataset. For other datasets, we conducted experiments with various hyperparameter settings, including those from the original code. We reported the results that showed the highest worst robust accuracy. However, we standardized default hyperparameters following the setting of Pang et al. (2021) as explained in D.I such as adversarial margin, learning rate scheduling, model structure, and other relevant parameters. From Table 14, our method demonstrates average robust accuracy and clean accuracy comparable to the baseline algorithm in all datasets. Moreover, our method exhibits superior worst robust accuracy compared to existing methods.
26

---

Published as a conference paper at ICLR 2024
Table 11: Comparison of the performance of the models for improving robust fairness methods in the setting of each method on the CIFAR- 10 dataset: CFA (Wei et al. 2023), FRL (Xu al., (002T).
BAT (Sun et al. [203)) and WAT (Li & Liu 2023). The best results among robust fairness methods are indicated in bold.
(a) CFA
Clean
Robust
Method
Average
Worst
Pnat
Average
Worst
Prob
TRADES
84.08 + 0.14
67.22 2.22
48.91
0.18
20.42 = 1.69
EMA
83.97 = 0.15
66.90 0.17
-0.01
50.62 0.10
22.16 = 0.41
0.12
CCM + CCR
81.72 + 0.26
65.84
2.07
-0.05
49.82
0.22
22.58 = 0.12
CCM + CCR + EMA
81.68 0.17
66.20
0.22
-0.08
51.01 0.05
23.16
0.18
CCM + CCR + FAWA
79.81 0.15
65.18 = 0.16
-0.08
50.78 0.05
27.62 = 0.04
0.39
DAFA
82.85 + 0.05
68.48
0.68
0.00
48.36 + 0.18
29.68
+ 0.77
0.44
DAFA EMA
83.19 0.02
70.40
0.07
0.04
50.63 + 0.03
29.95 0.11
0.50
DAFA + FAWA
82.93 + 0.17
67.72 0.54
-0.01
50.06 0.11
30.48
0.52
FRL
Clean
Robust
Method
Average
Worst
Pnot
Average
Worst
Prob
TRADES
81.90 0.17
65.20 1 0.66
48.80 1 0.11 20.50
1.49
+ FRL
82.97
0.30
71.94 1 0.97
0.12
44.68 1 0.27
25.84
1.09
0.18
+ DAFA
80.85
0.44
63.18 1 1.63
-0.04
48.02 1 0.03
29.14
0,55
0.41
(c) BAT
Clean
Robust
Method
Average
Worst
Prost
Average
Worst
Prob
TRADES
83.50 + 0.24
66.22 = 1.44
49.53 + 0.26
20.93 + 1.09
+ BAT
87.16 + 0.07
74.02 +:2 1.38
0.16
45.89 48.59 + 0.22
+ 0.20
17.82 + 1.09
-0.22 0.40
+ DAFA
82.65 + 0.25
67.94 = 1.54
0.02
29.64 + 1.25
(d) WAT
Clean
Robust
Method
Average
Worst
Pnat
Average
Worst
Prob
TRADES
82.30 + 0.21
65.62
1.22
48.87 + 0.20
21.52 + 1.09
WAT
80.97 + 0.29
70.57
1.54
0.06
46.30 + 0.27 49.03
28.55 + 1.30
0.27 0.39
DAFA
82.31 + 0.32
68.11
1.05
0.04
0.20
29.93 + 1.38
27

---

Published as a conference paper at ICLR 2024
Table 12: Comparison the performance the models for improving robust fairness methods in the
setting of each method on the CIFAR- 100 dataset: CFA (Wei et al. 2023). FRL (Xu et al. (202T),
BAT (Sun et al. 2023), and WAT [Li & Liu 2023). The best results among robust fairness methods are indicated in bold.
(a) CFA
Clean
Robust
Method
Average
Worst
Pnat
Average
Worst
Prob
TRADES
56.50 + 0.34
18.20 +: 1.56
24.67 +: 0.13
1.07 + 0.85
EMA
59.14 0.13
17.07
+ 0.39
-0.02
26.80 + 0.12
1.73 + 0.93
0.71
CCM CCR
57.25 + 0.69
19.60
+ 1.97
0.09
24.18 + 0.56
1.20 + 0.75
0.10
CCM CCR EMA
59.50 0.17
22.40
1.29
0.28
26.48
0.13
1.53 + 0.09
0.64
CCM CCR FAWA
57.74
15.00
1.55
-0.15
23.49
1.67
1.25
0.51
DAFA
56.13 0.21
17.20
+ 1.56
-0.06
24.25
= 0.17
1.87 4 0.62
0.73
DAFA + EMA
58.74 0.19
17.07 = 1.06
-0.02
26.42 = 0.10
2.20 + 0.65
1.13
(b) FRL
Clean
Robust
Method
Average
Worst
Poat
Average
Worst
Proh
TRADES
57.47 + 0.15
19.00 + 1.67
25.50 + 0.11
2.00 + 0.40
FRL DAFA
57.59 + 0.34
18.73 + 1.84
-0.01
24.93 + 0.29
1.80 = 0.54
-0.12
57.07 + 0.18
20.20 = 1.25
0.06
24.98 + 0.11
2.60
0.49
0.28
(c) BAT
Clean
Robust
Method
Average
Worst
Pont
Average
Worst
Prob
TRADES
56.51 +. 0.27
16.40
0.49
24.98 +: 0.09
1.00 + 0.00
BAT
62.80 = 0.17
22.40
2.15
0.48
23.42 + 0.08
0.20 - 0.40
-0.86
DAFA
56.64 + 0.35
20.20 2.48
0.23
24.16 + 0.17
2.00 + 0.63
0.97
(d) WAT
Clean
Robust
Method
Average
Worst
Prot
Average
Worst
Prob
TRADES
57.96 + 20.40
1.20
25.41 0.08
1.50 + 0.50
WAT
53.56 + 0.43
17.07
2.29
-0.24
22.65
0.28
1.87
0.19
0.14
+ DAFA
58.28 +
21.30 1.27
0.05
24.70 0.12
2.30 0.78
0.51
28

---

Published as a conference paper at ICLR 2024
Table 13: Comparison of the performance the models for improving robust fairness methods in the setting of each method on the STL-10 dataset: CFA (Wei et al. 2023). FRL (Xu et al.) (022))
BAT (Sun et al. 2023), and WAT [Li & Liu 2023). The best results among robust fairness methods are indicated in bold.
(a) CFA
Clean
Robust
Method
Average
Worst
Pnat
Average
Worst
Prob
TRADES
61.95 + 0.31
38.62 + 1.22
28.36 + 0.95
5.51 + 0.51
EMA
62.28 + 0.25
39.43
0.56
0.03
31.75
0.86
6.97 + 0.68
0.38
CCM + CCR
60.74 + 0.42
37.02 + 1.69
-0.06
31.24 + 0.27
6.82 + 0.65
0.34
CCM + CCR EMA
60.75 + 0.54
38.53
0.97
-0.02
31.83 0.14
7.63 + 0.23
0.51
CCM + CCR + FAWA
60.70 + 0.57
38.53
0.95
-0.02
31.88
0.14
7.69 0.27
0.52
DAFA
61.37 + 1,25
43.29
1.46
0.11
28.07 1.00
7.93 - 0.59
0.43
DAFA EMA
61.10 + 1.02
42.84 1.48
0.10
30.52 + 0.36
11.02 = 0.55
1.08
(b) FRL
Clean
Robust
Method
Average
Worst
Pnot
Average
Worst
Proh
TRADES
61.52 + 0.27
39.28 + 1.47
30.68 + 0.21
6.95 + 0.45
+ FRL
56.75 + 0.37
31.26 + 1.41
-0.28
28.99 + 0.39
7.94 = 0.49
0.09
+ DAFA
61.00 + 0.20
44.29 + 1.72
0.12
29.77 + 0.15
9.24 0.53
0.30
(c) BAT
Clean
Robust
Method
Average
Worst
Pont
Average
Worst
Proh
TRADES
62.13 1. 0.27
38.70 +. 0.98
30.07 +: 0.28
5.95 +: 0.41
BAT
59.06 + 1.29 61.13 0.34
36.75 = 2.44
-0.10
23.37 + 0.98 28.73 + 0.37
3.22
1.00
-0.68
DAFA
43.55 + 1.72
0.11
8.96
0.85
0.46
(d) WAT
Clean
Robust
Method
Average
Worst
Peat
Average
Worst
Prob
TRADES
58.01 0.16
36.45 + 1.15
29.75 + 0.25
5.13 + 0.47
WAT
52.92 1.80
30.82 + 1.44
-0.24
26.98 + 0.25
6.72 0.75
0.22
DAFA
57.14 0.53
39.61 + 1.66
0.07
27.92 + 0.30
10.35 0.68
0.96
29

---

Published as a conference paper at ICLR 2024
Table 14: Performance of the models for improving robust faimess methods in the same setting Pang al. 202T). The best results among robust fairness methods are indicated in bold.
(a) CIFAR-10
Clean
Robust
Method
Average
Worst
Prut
Average
Worst
Prob
TRADES
82.04 + 0.10
65.70 + 1.32
0.00
49.80 0.18
21.31
1.19
0.00
TRADES FRI
80.72 + 0.46
71.33 + 1.38
0.06
47.62
0.63
26.47
1.54
0.19
TRADES CFA
76.79 + 0.58
59.98 + 0.99
-0.15
48.32
0.49
27.04
0.44
0.24
TRADES BAT
86.68 + 0.25
72.04 + 1.88
0.15
45.94
0.74
17.59
1.83
-0.19
TRADES WAT
80.38 + 0.36
68.88
+ 2.40
0.03
46.95 + 0.33
28.84 + 1.34
0.30
TRADES DAFA
81.63 + 0.20
67.90 +: 1.25
0.03
49.05 0.14
30.53 1 1.04
0.42
(b) CIFAR-100
Clean
Robust
Method
Average
Worst
Pnat
Average
Worst
Prob
TRADES
58.34 + 0.38
16,80 + 1.0S
0.00
25.60 +: 0.14
1.33 + 0.94
0.00
TRADES FRL.
56.43 1 0.44
17.67
+ 0.47
0.02
24.44 1 0.16
1.33 0.94
-0.04
TRADES CFA
58.66 1 0.26
20.13
1 1.59
0.20
24.73 1 0.15
1.07 1 0.77
-0.23
TRADES BAT
66.14 = 0.18
27.93
+ 1.61
0.80
22.79
= 0.21
0.13 0.34
-1.01
TRADES WAT
56.37 = 0.32
23.27
1.91
0.35
23.72
0.24
1.93
0.44
0.38
TRADES DAFA
58.07 0.05
18.67 + 0.47
0.11
25.08 = 0.10
2.33 0.47
0.73
(c) STL-10
Clean
Robust
Method
Average
Worst
Pnat
Average
Worst
Prob
TRADES
61.13 + 0.57
39.29
1.71
0.00
31.36
0.51
+ 0.99
0.00
TRADES FRL
58.29 + 0.44
40.50 + 2.38
-0.02
28.28
0.34
8.48 1 0.64
0.00
TRADES CFA
59.59 + 0.60
39.86
-0.01
31.36
0.22
7.93 1 0.21
0.03
TRADES BAT
59.94 + 0.30
37.81 + 1.84
-0.06
24.02
0.26
3.59 + 1.03
-0.77
TRADES WAT
56.85 + 1.10
35.08 + 3.45
-0.18
28.49 + 0.96
7.89 + 1.64
-0.07
TRADES DAFA
60.50 1 0.57
42.23 1 2.26
0.06
29.98
0.46
10.73
1.31
0.34
30


Reviews:
[{"review_id": "mCB1DA64cl", "reviewer": "Reviewer_nK3C", "summary": "In this paper, the author introduced a class-distanced method aimed at enhancing fairness in Adversarial Training. To be more specific, the methods designs the robust sample loss weights and adversarial margins based on the class similarities to penalize more for hard similar classes. The author argue that the error of hard samples are mainly caused by falsely predicted as other similar classes, rather than disimilar classes. To verify this, the author first show that for the hard class, the accuracy is much improved dramatically if it trained with classes that not similar to it. Then the author derive theoretical analysis quantitively shows that the robust errors for each class, and predict error between different classes is monotonically decreasingly correlated with the gap between different classes. The large the class gap, the smaller the predictions error. Further more,  in section 4.1, the author present \"an example illustrating that improving\na hard class’s performance is more effectively achieved by moving the decision boundary (DB)\nbetween the hard class and its neighboring class than that between the hard class and a distant class\". Then empirical studies on several datasets verifies the effectiveness of the proposed methods.", "questions": "1) What's the \"red\" and \"blue\" arrows in Figure 1 represents?\n2) Are all the figures when it comes to measure the class similarities using the average class soft max probabilities you described in section 4.2 when you proposing your methods?\n3) Please proofread the paper and simplify the sentences for better comprehension such as \"Allocating a larger adversarial margin to the hard class than to adjacent classes has the effect of pushing the DB away from the hard class’s center by an amount corresponding to the difference in their adversarial margins.\"", "limitations": "", "rating": 5, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "Please refer the summary.\nMoreover, the method proposed by the author is agnostic and is empirically validated by combining it with Trades framework and an PGD to demonstrate its advantages.", "weaknesses": "The paper is well written. But\n\n 1) It rambling too much until the Page 6. \n\n2) The author only mentioned  once that  it used class prediction probability to measure the class similarities. \"Our proposed method quantifies the similarity between classes in a dataset by utilizing the model output prediction probability. \" When it comes to class similarity, the first idea that came to my mind is embedding similarities between different classes. It is confusing.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "hKgyGmMAmX", "reviewer": "Reviewer_n9NT", "summary": "This paper focuses on the robust fairness problem, they empirically find that  the majority of the model’s predictions for samples from the worst class are biased towards classes similar to the worst class. Inspired by this, they show a theoretical result that a class is hard to learn and exhibits lower performance when it is close to other classes. They then propose a novel method, it use class-wise probability to measure the difficulty of the class. Based on this, they computing the weights which is used to reweight the loss and adjust the margin. Empirically, they show the proposed method outperforms other baselines in three different datasets.", "questions": "1. What is the theoretical and empirical range of $\\mathcal{W}$? A clarification of the possible values for $\\mathcal{W}$ is necessary.\n2. Does the proposed method require more time for experimentation compared to other baselines? \n3. What distinguishes the proposed method from other baselines, considering that these methods also adjust weights? Can the authors elaborate on the differences in the weight curves between the proposed method and the baselines?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The authors use experiments to show that the misclassified samples from worst class are biased towards classes similar to the worst class, and they provide a theoretical analysis on this.\n2. They propose a novel method, adjusting the weights and margins based on the class-wise probability, which is used to measure the difficulty of the class.\n3. The authors show experiments on three widely used datasets to show the superiority of the proposed method.", "weaknesses": "1. The update rule for $\\mathcal{W}$ may result in negative values in some cases. For instance, when the performance of a class consistently remains the best, this issue arises. The authors do not address this problem or discuss its implications. If $\\mathcal{W}$ becomes negative, it would lead to negative robust radii ($\\mathcal{W}_y\\epsilon$), which is unreasonable.\n2. The update process for $\\mathcal{W}$ appears to be time-inefficient, particularly when dealing with datasets that contain a large number of classes. It is suggested that the authors provide information on the time costs of the proposed method compared to other baselines.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "deMYqs1WLi", "reviewer": "Reviewer_73vn", "summary": "This paper aims to mitigate the class-wise fairness issue in adversarial training (AT) by proposing a DAFA framework, which first theoretically and empirically investigates the impact of the distance between classes on worst-class robustness and then proposes dynamically adjusting the weights and margins deployed in AT for better robust fairness.", "questions": "1. Page 5, Section 3. Why is class-wise distance defined as the average distance of a class to other classes? In my opinion, for classification tasks, the distance between a class and its closest one plays the most important role in determining the decision boundary, and the influences of classes that are far away are negligible.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The motivation of this paper is clear. Figure 1-3 illustrates what similar and dissimilar classes are and how they affect class-wise performance.\n2. The claims of the influence of class-wise distance on their robustness are supported by both theoretical analysis and empirical verification.\n3. This paper further refines the state-of-the-art understanding of class-wise accuracy and robustness. As CFA [4] shows, different classes should use specific training configurations in AT to strengthen class-wise performance, the proposed DAFA further takes the interaction of classes into consideration and highlights the role of similarity between classes.", "weaknesses": "1. My major concern with this work is the unfair comparison with baselines in terms of experiment settings. Here, I take CFA [4] as an example, and please also check other baselines.\n    - CFA includes a Fairness-Aware Weight-Average (FAWA) strategy to mitigate the fluctuating effect of worst-class robustness. Weight average requires more epochs to converge after learning rate decay, and in the original paper of CFA, the learning rate decays at the 100th and 150th epoch in a 200-epoch training. Therefore, the learning rate schedule in your setting significantly decreases the performance of CFA.\n    \n    I suggest using the original settings of different baselines to ensure fair comparisons. I will change my rating based on how this issue is addressed.\n    \n2. Page 1. The research thread of the robust fairness problem seems to be confusing. Based on my expertise in robust fairness research, the main thread [1-5] on this problem focuses more on how to adjust objective functions and configurations in AT, and the long-tailed classification is a minor perspective. I suggest revising the introduction of this paper by focusing on more related work [1-5].\n3. Page 4. Some of the Theorems seem to be very close to previous work [1, 3]. I suggest clarifying which theorems are a re-deduction of previous results and which are proposed new ones.\n4. There may be a mismatch between the motivation and the proposed method. It seems that the schedule in equation (6)-(9) still pays more attention to easy or hard, though class-wise similarity is involved. I suggest adding theoretical analysis on how these configurations improve class-wise robustness.\n\n### Minor Comments\n\n   \n- Page 2: Typo\n> limiting the learning of these neighboring classes can serve as an effective means to improve robust fairness.\n- Page 2, Section 2: I suggest adding the optimization objective of adversarial training (AT), which is a more primary method than TRADES.\n- Page 3, Section 3: It may benefit from introducing what variance is in this context more detailedly and formally.\n- Page 3, Section 3: Misuse of \"On the other hand\". \"In addition\" is suggested.\n- Page 4. I suggest putting the details on how to calculate class-wise distance in Section 3 rather than the appendix to improve readability.\n- Page 6, Section 4:\n> we employ two strategies: adjusting loss weights and adversarial margins\n   \n    is very similar to the CCM and CCR strategies proposed in [4]. A reference is required here.\n    \n\n[1] To be robust or to be fair: Towards fairness in adversarial training. ICML\n\n[2] Analysis and applications of class-wise robustness in adversarial training.KDD\n\n[3] On the tradeoff between robustness and fairness. NeurIPS\n\n[4] CFA: Class-wise calibrated fair adversarial training. CVPR\n\n[5] WAT: improve the worst-class robustness in adversarial training. AAAI", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "LdL9Wfxq4t", "reviewer": "Reviewer_Wxgz", "summary": "This research addresses the \"robust fairness problem\" in adversarial training, where there's a significant difference in model accuracy between classes. Current methods sacrifice performance on easier classes to improve harder ones. However, the study observes that the model's predictions for the worst class often favor similar classes instead of the easy ones under adversarial attacks. As the distance between classes decreases, robust fairness deteriorates. To mitigate this, the Distance-Aware Fair Adversarial training (DAFA) approach is introduced. It assigns distinct loss weights and adversarial margins to each class and adjusts them to balance robustness among similar classes. Experiments show that DAFA not only maintains average robust accuracy but also significantly enhances fairness, especially for the worst-performing class, compared to existing methods.", "questions": "See Weakness", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper is easy to follow\n\n2. The motivation is clear", "weaknesses": "1. Experiments on the sensitivity of trade-off hyperparameter $\\beta$ is missing. \n\n2. The experiments only based on TRADES are very limited.\n\n3.  Several baselines are missing. For example, Group-DRO [1]\n\n[1] Sagawa, Shiori, et al. \"Distributionally Robust Neural Networks.\" International Conference on Learning Representations. 2019.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)