Training Robust Ensembles Requires Rethinking Lipschitz Continuity
Authors: Ali Ebrahimpour-Boroojeny
Hari Sundaram
Varun Chandrasekaran
Venue: ICLR 2025 Poster (2025)
Keywords: robustness
lipschitzness
ensembles
convolutions
transferability
black-box attacks
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: We show that although a lower Lipschitz constant increases the robustness of a single model, it is not beneficial in training robust ensembles. We introduce LOTOS, a new training paradigm for ensembles, which counteracts this adverse effect.

Abstract: Transferability of adversarial examples is a well-known property that endangers all classification models, even those that are only accessible through black-box queries. Prior work has shown that an ensemble of models is more resilient to transferability: the probability that an adversarial example is effective against most models of the ensemble is low. Thus, most ongoing research focuses on improving ensemble diversity. Another line of prior work has shown that Lipschitz continuity of the models can make models more robust since it limits how a model's output changes with small input perturbations. {\em In this paper, we study the effect of Lipschitz continuity on transferability rates.} We show that although a lower Lipschitz constant increases the robustness of a single model, it is not as beneficial in training robust ensembles as it increases the transferability rate of adversarial examples across models in the ensemble. Therefore, we introduce LOTOS, a new training paradigm for ensembles, which counteracts this adverse effect. It does so by promoting orthogonality among the top-$k$ sub-spaces of the transformations of the corresponding affine layers of any pair of models in the ensemble. We theoretically show that $k$ does not need to be large for convolutional layers, which makes the computational overhead negligible. Through various experiments, we show LOTOS increases the robust accuracy of ensembles of ResNet-18 models by $6$ percentage points (p.p) against black-box attacks on CIFAR-10. It is also capable of combining with the robustness of prior state-of-the-art methods for training robust ensembles to enhance their robust accuracy by $10.7$ p.p.

Published as a conference paper at ICLR 2025
TRAINING ROBUST ENSEMBLES REQUIRES RETHINK- ING LIPSCHITZ CONTINUITY
Ali Ebrahimpour Borvojeny
Hari Sundaram UTCC hs 1 @ 11 1llinois s edu
Varun Chandrasekaran UICC varunce i 1lliiniis edu
UTUC
ae20gillinois:
ABSTRACT
Transferability of adversarial examples is a well-known property that endangers all classification models, even those that are only accessible through black-box queries. Prior work has shown that an ensemble of models is more resilient to transferability: the probability that an adversarial example is effective against most models of the ensemble is low. Thus, most ongoing research focuses on improving ensemble diversity. Another line of prior work has shown that Lipschitz continuity of the models can make models more robust since it limits how model's output changes with small input perturbations. In this paper, we study the effect of Lipschitz continuity on transferability rates. We show that although lower Lipschitz constant increases the robustness single model, it is not as beneficial in training robust ensembles examples across models in the ensemble. Therefore, we introduce LOTOS, a new training paradigm for ensembles, which counteracts this adverse effect. It does so by promoting orthogonality among the top-k sub-spaces of the transformations of the corresponding affine layers of any pair of models in the ensemble. We theoretically show that & does not need to be large for convolutional layers, which makes the computational overhead negligible. Through various experiments, we show LOTOS increases the robust accuracy of ensembles of ResNet- 18 models by 6 percentage points (p-p) against black-box attacks on CIFAR-10. 10. also capable of combining with the robustness of prior state-of-the-arr methods for training robust ensembles to enhance their robust accuracy by 10.7 p.p. The code is publicly available at https:/githbb.com/AAi///oo0
increases the transferability rate of adversarial
INTRODUCTION
Deep learning models are very brittle to input changes: Szegedy al. (2013) were the first carefully craft "adversarial" perturbations that result in incorrect classification outcomes. Subsequent research showed that these adversarial examples "transfer" models with different hyper-parameters, and even different hypothesis classes (Papernot et al. 2016a Liu et al. 2016). This transfcrability property was used design black-box attacks against models for which only query access available (Papernot et al., 2017). In these attacks, the adversary trains local model that is "similar" to the victim (black-box) model and uses that to find transfcrable adversarial examples (Xiao et al., 2018). To increase the rate of transfer success, common strategy is to choose those inputs that are adversarial to an "ensemble" of models (Liu et al., 2016 Chen et al. 2023); fooling an ensemble may result in fooling potentially unseen model.
Research has also been carried out on understanding and improving model resilience to such at- tacks (Dong et al. 2019). Adversarial robustness is the innate ability of the model to correctly 2017). One way of increasing this robustness is utilizing a
classifyyadverseee adversarial examples (Madry et al.
of models Yang al.
2020
2021 This has also been considered as mitigation
to the transferability problem (Pang et al.
2019 Kariyappa & Qureshi 2019 Yang et al. 2020 2021
Sitawarin et al. 2023); by increasing the diversity among models of the ensemble, the subspace of the ad adversarial examples that are effective against most of the models within the ensemble shrinks.
In terms of the parameters and decision boundaries.

---

Published as a conference paper at ICLR 2025
While empirical evidence is promising, most of these ensemble robustness methods either com- putationally expensive or come at a considerable cost to the accuracy of the models and the overall ensemble. In another vein of research, Lipschitz continuity
also shown to be important for Beachiinoou--oooojjeee
robustness (Szegedy et al. 2013 Parnia et al. 2018 [Boroojeny et al. 2024 et al. 2025). Since the model's Lipschitz continuity controls how the predictions change for small changes in the input, it is intuitive that bounding it will improve robustness. It is important to note that neural networks are a composition of multiple layers and therefore the existing works in this area obtain an upper-bound on the overall Lipschitz constant of the network by bounding each layer independently (Szegedy et al. [013]] Sedghi et al., 2018 Senderovich et al., 2022 Delattre et al., 2023 Boroojeny et al. 2024).
In our work, we investigate the effect of Lipschitz continuity on the transferability of adversarial examples. We observe that while decreasing the Lipschitz, constant makes each model of the ensemble individually more robust, it makes them less diverse and consequently increases the transferability rate among them which in turn hinders the overall ensemble robustness ($ Figure D. To resolve this adverse effect, we introduce our novel training paradigm, Layer- wise Orthogonalization for Training rObust enSembles (LOTOS), which orthogonalizes the corresponding affine layers of the models with respect to one another. This increases the diversity of the trained models. LOTOS can be combined with any prior method of training diverse ensembles to further boost their robustness.
Through extensive experiments and ablation studies, we show that LOTOS effectively decreases the transferability rate among the models of ensemble, which leads to higher robustness against black- box attacks and non-adversarial noise, As we will show, LOTOS is highly efficient for convolutional layers and is very fast compared prior methods. We also show that it is an effective method for training robust ensembles of heterogeneous architectures, where other state-of-the-an (SOTA) methods are not applicable. Finally, we investigate how LOTOS is able to improve the results of the prior SOTA methods when they are combined. In short, the main contributions of this work are:
Lipschitz continuity is not as effective for ensemble robustness. To the best of our knowledge, we the first to study the adverse effect of Lipschitz continuity on the transferability rate of adversarial examples ($ 3.. Prior works study individual model and ensemble robustness separately which does not reveal the issues that the former might cause when used in the form of ensemble. We show the presence of a trade-off between single model robustness and ensemble robustness as the Lipschitz constant of the individual models changes through empirical analysis. This shows the necessity of special treatment when training ensembles to alleviate this trade-off while benefiting the proven effectiveness of Lipschitz continuity in the robustness of individual models.
A new ensemble training method for robustness. We introduce LOTOS, novel ensemble train- ing method to address the aforementioned trf Prior work diversifies the models in the ensemble using either the final outputs (Kariyappa & Qureshi 2019 Pang al.) 2019), distilled features (Yang) ct al. 2020). latent representations (Huang et al. 2023). or the vectorized form of all the param- eters (Yang et al. 2021). LOTOS considers the corresponding affine layers of the models and orthogonalizes them with respect to one another using a novel component in the loss function. Addi- tionally, we theoretically and empirically show that method is highly efficient for convolutional layers ($ D.. We demonstrate that LOTOS improves ensemble robustness against black- box attacks at nominal increase in robust accuracy (in some cases). Also, can be combined with prior SOTA in training robust models and ensembles to further boost their robustness 5$
2 RELATED WORK
To increase the diversity of the models in the ensemble, Kariyappa & Qureshi 2019) proposed misalignment of the gradient vectors with respect the inputs. The intuition behind this idea is how several earlier works generate adversarial examples Goodfellow et al. (2014); Kurakin et al. (018); Papernot et al. (2016b): these methods use the gradient direction with respect to given input to find the direction that increases the loss function the most. By moving small amount toward that direction, examples that are similar to the original example but are misclassified by the model are found. In their paper, Kariyappa & Qureshi (2019) hypothesize that when this gradient direction is the same for various models of the ensemble, the common subspace of their adversarial examples will be larger because the loss function behaves similarly around the original data. They use cosine similarity to capture this similarity in the direction; by incorporating that for pairs of models in the loss function, they diversify the models in the ensemble to make it more robust.
2

---

Published as a conference paper at ICLR 2025
Pang et al. (2019) propose regularizer increase the diversity in ensemble by increasing the entropy in non-maximal predictions. Yang et al. (2020) use an adversarial training objective to increase the diversity of the ensemble by making the non-robust features more diverse. Yang et al. (2021) suggest that not only does the misalignment of the gradient vectors of the loss with respect to the inputs matters, but also the Lipschitz constant of the gradients (not parameters) of the loss with respect to the inputs has to decrease and propose a heuristic method to achieve this, which outperforms the prior methods. Zhang et al. (2022) propose method based on margin-boosting to diversify the models of an ensemble which did not achieve better results than the prior state- of-the-art methods (Yang et al. 2020 202I). More recent works try to enhance the robustness of the existing methods by incorporating adversarial training against variety of publicly available models (Sitawarin al., 2023) or enhance their time complexity by using faster (but weaker) attacks
for data augmentation and enforcing diversity in the latent space (Huang et al. 2023).
There a different line of work on the orthogonality of the affine layers of the deep learning models which focuses on making the transformation of single layer orthogonal (i.e., its rows and columns become orthonormal vectors). This helps to preserve the gradient norm of the layer and has been shown to improve the stability and robustness of the models (Trockman & Kolter 2021 Singla & Feizi 2021] Xu et al., 2022] (Singla et al. 2021 Prach & Lampert 2022; Hu et al.) (023). This notion of orthogonality is different from what we consider in this work; we wish make the transformation of "corresponding layers" from different models orthogonal with respect to each other.
MOTIVATION
After introducing the notations, we define the notion of transferability rate ($ 3.1 and continue with introducing our conjecture about the effect of Lipschitz continuity on transferability rate ($ 3.2).
Notation. Given the domain of inputs X' and m classes y f1.2..... ........,7.. ..). we consider a multi-class classifier F X' + y' and its corresponding prediction function f(x) which outputs the probabilities corresponding to each class (e.g., the outputs of the softmax layer in neural network). The loss function for model JF is denoted l X x y R,; it uses the predicted scores from f(x) to compute the loss given the true label y (e.g., cross-entropy loss). The population loss for model F. which we may also refer to risk, is defined deep neural networks, we refer to a specific layer using superscripts (c.g., f() for the i-th layer of deep network). A funtion (z) is L-Lipschitz if (z) - f(x')(l)))) [a²')l2 I L|| - a'1l2, Vx, E X. For a matrix A, the spectral norm is defined as ||A||2 supz50 T
Ry(xx, (z. y) = Ez[Es(x,, v)l. When the models are
|A Any affine layer (e.g., dense layer, convolutional layer) with transformation matrix ||/A|la-Lipsshtzz When we say layer i (with transformation matrix A) has been clipped to a value C, this means we ensure ||||| = C.
3.1 DEFINITIONS
We begin with the definition of an adversarial attack and then formally define the transferability rate (Trate) of adversarial examples.
Definition 3.1 (Attack Algorithm). For a given input/output pair (z, E X x V, a model F, and a positive value e, a targetted attack algorithm A (z) x x 8r minimizes f=(x ōg 9t) such that ||01122 S An untargeted attack A(z) maximizes f + v,,
Definition 3.2 (Transferability Rate). For an untargeted adversarial algorithm Ay and input space X, we define the transferability rate (Trate) of A5(x) from F to another classifier g, as the following conditional probability:
(Ay, = P(aNEExy (z)Ar(z)) yyl F(z) = G(x) = = 4v) (I)
For the transferability of targeted attack algorithm A and target class ys this definition is:
(A F,9) = PRiwwexx (9(44) = v. F(x) = ((x) - = = -v
(2)
3

---

Published as a conference paper at ICLR 2025
0.92
0.88
0.35
0.91
0.30
Itarsterabiiity
0.86
0.84
0630
0.50
0.25
0.82
0.20
0.89
0.80
Epoctrx
Spachs
Spmrts
Figure 1: Accuracy Robust Accuracy vs. Transferability: Changes in the average accuracy and robust accuracy of individual ResNet-18 models, along with the average transferability rate between any pair of the models in each ensemble as the layer-wise clipping value (spectral norm) changes. As the plots show, although the robustness of individuul models increases with decreasing the clipping value, the transferability rate among the models increases, which might forfeit the benefits of the clipping in the robustness of the whole ensemble.
Note that Yang et al. T)2Th have similar definitions of transferability except they joint probabilities instead of conditional probabilities. Using the conditional probability, we can better isolate the are interested in. By using the joint probability, the Trate will depend on the accuracy of the two models and also the performance of the attack algorithm on the source model F. This will not allow us to have an accurate comparison of the T Trate between different settings.
"transferability" property
Prior work has shown that there is a trade-off between the accuracy of two models and the Trate of adversarial examples between them (Yang et al. 202T); as the two models become more accurate, their decision boundaries become more similar; this increases the probability that adversarial example generated for one of the models transfers to the other model because of the similarity their margins around the source sample. In the following section, by making parallel to this trade-off, we introduce our conjecture on the trade-off between the Lipschitzness the models and their T Trate-
3.2
OUR CONJECTURE: LIPSCHITZ CONTINUITY INFLUENCES TRANSFERABILITY
Prior works (Szegeyy et al. 2013 Farnia et al. 2018 Boroojeny et al. 2024) highlight the impor- tance of Lipschitzness on the robustness of a model against adversarial examples. To enforce the Lipschitzness of the deep neural networks, these works enforce the Lipschitzness layer: since the Lipschitz constant of the composition activation functions, etc.) is upper bounded by the multiplication of their Lipschitz constants, this leads to bound on the Lipschitzness of the whole model. In this work, we follow the same procedure control the upper bound on the Lipschitz constant of a model. For this, we use FastClip (Boroojeny et al. 2024) which is the current SOTA method for controlling the spectral norm of dense layers and convolutional layers. We use the chosen spectral norm for each individual layer to represent these models in the figures and tables. For example, C = 1 shows that the spectral norm of all the dense layers and convolutional layers have been clipped to 1, which makes each of them I-Lipschitz. For many architectures such as ResNet- 88 (He et al.) 2016). and DLA (Yu et al. 2018) this effectively controls the Lipschitz constant of the model because the other constituent components (c.g., ReLU activation, max-pont max--oooingg softmax) are 1-Lipschitz (Goodfellow et al. 2014). For details controlling the effect of batch norm layers, see Appendix B.2
each individual all the components of the model (layers,
The prior works have shown that by decreasing the value of the Lipschitz constant L for model, adversarial attacks achieve a lower success rate. This confirms that decreasing the Lipschitz constant for model makes it more robust input perturbations. However, the situation is complicated in an ensemble. While a lower Lipschitz constant promotes robustness for each of the models (of an ensemble), we conjecture that it will increase the Trate by making the classification boundaries of the models more similar. We formalize this intuition below:
Proposition 3.3. Assume X 0, 1]d and ||8 < For two models F and G, if the loss function on both for any E y is L-Lipschitz with respect to the inputs, we have the following inequality:
[R<(A<<s),)) Rg(Ar(s), v)1 < 2Le (R Rg(a,y))
The proof for the proposition can be found in Appendix A.I In Proposition 3.3 we study the Trate of an adversarial example generated by A5 model G by using the difference in the population loss of
4

---

Published as a conference paper at ICLR 2025
the two models these adversarial examples proxy; the lower this difference is, the more likely that the two models will perform similarly on these adversarial examples. To verify this conjecture empirically, in Figure D we show how Trate changes among three ResNet- 18 (He et al. 2016) models without batch norm layers as the layer-wise Lipschitz, constant (which governs the upper-bound on the Lipschitz constant of the model as mentioned earlier) changes. Figure in Appendix [B.3 shows the same behavior for the ResNet-18 8 models with batch norm layers. For more details see $ For further discussions on the evidence of this phenomenon in prior theoretical works, see Appendix
Main Takeaway: According Proposition 3.3 decreasing (Lipschitz constant), might be an indicator of higher similarity in the risk of the two models on the adversarial examples, which might imply higher Trate- Therefore, although a lower Lipschitz constant could contribute to the robustness of single model, it might increase the Trate among the models of an ensemble which might hinder the expected benefits of the Lipschitzness.
LAYER- WISE ORTHOGONALIZATION FOR TRAINING ROBUST ENSEMBLES
When clipping the spectral norm of the layers, we are reducing the capacity of the parameters that can be used during the optimization (Neyshabur et al. 2017 17 Bartlett et al. 2017); it more likely that the parameters of the two models become "more similar" when optimized over these constrained spaces. Therefore, to control the Lipschitz constant of each model make them more "individually" robust, and avoid sacrificing the "ensemble robustness", we need to utilize other modifications to enforce the diversity of their decision boundaries on the adversarially perturbed samples.
The method that we introduce to enforce the diversity based on promoting the orthogonality of the sub-spaces of the corresponding layers of the models that correspond to their top singular vectors. Since the top singular vectors govern the major part of the transformation by each layer, this orthogonality promotes the difference in the outputs of the corresponding layers from different models.
Our Intuition:
Affine layers transform the input space such that the sub-space spanned by the top singular vectors will have the most amount of change in the output space for perturbed input. When the adversary is choosing a perturbation to add to the input, a natural choice would be to choose the direction along the top singular vectors: with the same amount of perturbation, the adversary will get the highest amount of change in the output space for a perturbed input along this direction. Based on this analogy, we consider any two corresponding affine layers f(i), ( from a pair of the models F and g in the ensemble, whose linear transformations
represented by matrices A and B, with the singular value decompositions A = Σi= d.u,y?" and B Σ ofulofT, respectively. We define notion of similarity based on the top-k sub-spaces:
5 (F()) maamal) = Σ ( mal) (v - mal)), (3)
where (a) wo'ss 's are arbitrary weights which are non-increasing with i to emphasize "more importance" for the singular vectors corresponding to top singular values, and (b) mal refers the maximum allowed length of the output of each layer when it is given the singular vectors of the other layer as the input (see Appendix [B.4 for its effect in practice). Observe that when mal is set to O, the value of Sx(f.g .g) is 0 if the transformations of f and g are orthogonal in their top-k sub-space (i.e., (1/)l22 ||Au/lla | Frnnee 2/ 0).
Utilizing this insight, we introduce our technique, Layer-wise Orthogonalization for Training Robust Ensembles (LOTOS). LOTOS promotes the orthogonality among these sub-spaces which leads to different behaviors when perturbing the clean samples along specific direction. We add this similarity for each pair of corresponding affine layers (dense and convolutional layers) in each pair of models within the ensemble and add them to the cross-entropy loss. More specifically, given ensemble of N models F,, (I,...,NN N} with M layers that would be incorporated in the
5

---

Published as a conference paper at ICLR 2025
orthogonalization process, the new loss becomes:
N-1
N
Lariin 1 N
Σ (cr(F((2).v)) + ( -
. , ma1)
(4)
k
1=1
where ( y) is the cross-entropy loss of (z) given its output and the ground-truth label y. À controls the effect of the ortogoonalzzation loss and could be adjusted.
4.1 EFFICIENCY OF LOTOS
Time Complexity:
Note that the number of summands in the orthogonalization loss is O(N
The computation of 5 uses the computed singular vectors of cach layer by FastClip (Brroojeny al. 2024). which is fast and accurate practice, and feeds them to the corresponding layer of the other models (see Equation (3): therefore, it is as if each model has an extra batch of size N to process at each iteration, which relatively small when N small. Appendix [3.]] we compare the empirical running time per epoch for ensembles of three models. Although this increase in running time small, our experiments ($ 55) show that performing the orthogonalization for only the first layer would be effective for training robust ensembles (i.c., M 1). Therefore, the increase in the training time becomes negligible compared to when the clipping model is used without LOTOS.
For the orthogonalization to be effective in Equation it is necessary to increase the value of k (dimension of orthogonal sub-spaces) because the layers of the DNNs are transformations between high dimensional representations. Therefore, only orthogonalizing the sub-space corresponding to the few top singular values does not guarantee that there is no strong correlation among the remaining top singular vectors (which might correspond high singular values in each of the models). However, increasing k decreases the computational efficiency, in both compution of the singular vectors (Boroojeny al. 2024) and computation of the orthogonalization loss in Equation
Highly Efficient for Convolutional Layers:
Fortunately, specific properties of the convolutional layers, which the most common affine layers in DNNs, allow an effective orthogonalization even with very small values of k. In Theorem 4.1 we prove even & 1 can be effective orthogonalization with respect to the remaining singular vectors for convolutional layers.
Theorem 4.1. Given two convolutional layers, M1 and M2 with a single input and output channel and circular padding for which f is the vectorized form of the filter with a length of and considering n to be the length of the vectorized input, if | ||2 S 6, then:
| S 1
where is the corresponding linear transformation of M1 and vi is singular vector of M2 corre- sponding to its p-th largest singular value.
The proof can be found Appendix A.2 As Theorem 4.1 shows, by orthogonalization of the linear transformation of the convolutional layer Mi (i.e., A) and only the first singular vector of Mz (i.e., 21) so that || ||2 & e, the size of the output of Mj when applied to the remaining singular vectors of M2 (i.e., ||Aur (2) will be upper bounded as shown in Equation (5). This upper-bound depends on the ratio of the ranking of the corresponding singular value to the input size (i.e., 2), which gets smaller for the top singular vectors that have a higher contribution to the transformations. It also depends the size of the kernel (T') which is usually small in models used in practice (e.g., 3 in 2D convolutional layers). Finally, it also depends on the & norm of the filter values, which can be controlled simply by using weight decay when optimizing the parameters during training. We verify this efficiency of LOTOS when applied to convolutional layers in our experiments.
5 RESULTS
We wish to answer the following questions: (1) Does decreasing the Lipschitz constant the models of ensemble increase the Trate between them?; (2) does L.OTOS decrease the Trate among the

---

Published as a conference paper at ICLR 2025
models of ensemble, and does this decrease in the Trate among the models of the ensemble lead to a lower success rate in black-box attacks from other source models?; (3) what are the effects of varying the ensemble size and the number of orthogonalized singular vectors (k) on the performance of LOTOS?; (4) is LOTOS still effective when the models of the ensemble are different?; (5) can we combine LOTOS with the prior work on training robust ensembles to provide additional enhancements to robustness?; (6) can LOTOS be combined with common methods used for increasing the robustness of the models, such as adversarial training?; and (7) is LOTOS effective for non-adversarial noise?
As a quick summary, our results show that: (1) decreasing the Lipschitz constant of the models of an ensemble, although make them individually more robust, increases the Trate among them ($ 5.I); (2) LOTOS is indeed effective at reducing the Trate between the models of an ensemble which leads to more robust accuracy against black-box attacks ($ 5.2): (3) when using LOTOS, increasing the ensemble size leads to much higher improvement in the robust accuracy ($ 5.3.1 and changing the number singular values has negligible impact on the transferability ($ (.3.3.2) : (4) LOTOS effective even when the ensemble is heterogeneous ($ 5.4): ; (5) LOTOS in conjunction with TRS (Yang et al., 202T) or DVERGE (Yang et al. 2020), two of the SOTA methods in training robust ensembles, yields better performance than either isolation ($ 5.5) (6) LOTOS can be used together with adversarial training to boost the robustness of the ensemble (Appendix B.8) and (7) by effective diversification of the clipped models, LOTOS enhances robustness against non-adversarial noise.
Attacks: We use both black-box attacks and white-box attacks in our experiments. The white-box attack is used to evaluate the rate of adversarial examples between the models in the ensemble; for each ordered pair of the models in the ensemble, the former is used as the source model to generate the adversarial examples and then the Trate of the generated adversarial examples is evaluated on the latter (target model) using Definition 3.2 The average of this value for all the ordered pairs of the models is considered the Trate of the ensemble. A low Trate between the models of the ensemble does not necessarily imply a more robust ensemble. So to evaluate the robustness of ensembles against adversarial attacks, we also use black-box attacks. In the black-box attacks, an independently trained source (surrogate) model (of the same type as the models in the ensemble) is used to generate the adversarial examples; we then measure the robust accuracy of the ensembles against these adversarial examples. For further details on the setup of experiments, please refer to Appendix [..]] We also evaluate the robustness against white-box attacks on the whole ensemble (see Appendix B. 10.4).
5.1 ROBUSTNESS VS. TRANSFERABILITY
In this section, we evaluate our conjecture from which was motivated by Proposition 3.3 For this, we compare the ensemble of three ResNet-18 models trained without any modification (represented as Orig) to ensembles of models in which all the layers of each model is C-Lipschitz (by controlling the spectral norm). We vary this Lipschitz constant to see how it affects the robustness and transferability. The chosen Lipschitz constant for each ensemble is used to represent that in results: for example, C = 1.0 shows that the affine layers of the models in the ensemble are all clipped to 1.0. The clipping of the layers was achieved using FastClip (Boroojeny et al. 2024).
Figure I shows the results when the batch norm layers are removed. The first two subfigures show the changes in the average accuracy and robust accuracy of individual ResNet-18 models. The rightmost plot shows the average Trate between any pair of the models in each ensemble as the layer-wise clipping value (spectral norm) changes. As the figure shows, although the robustness of individual models increases with decreasing the clipping value, the Trate among the models increases. Figure 5 in Appendix [B.3] shows the same behavior for models with batch norm layers (see Appendix B.2 for more details on evaluating these two cases separately).
5.2 EFFICACY OF LOTOS
We first evaluate the effectiveness of LOTOS in decreasing the Trate among the clipped models using the white-box attack. For this, we first use ensembles of three ResNet-18 models and follow the setting explained in Appendix B. Figure 2 shows the results for 3 different methods of training ensembles (Orig, i...g.c C = 1, and LOTOS). The Jeft-most subfigure shows the average test accuracy of the individual models in each ensemble and the middle subfigure shows the average robust accuracy of the individual models in the ensemble. The middle plot shows, as expected, that the individual models in both C 1 and LOTOS ensembles are much more robust than the ones in the Orig
7

---

Published as a conference paper at ICLR 2025
0.92
0.35
0.91
0.30
Tradsombiiliyyy
0.90
0.25
0.7-
0.20-
0.6
00
100
Fpacte
Epochs
Epocchs
Figure 2: Reducing transferability while maintaining the benefits of Lipschitzness. The average accuracy (left-most plot) and average robust accuracy (middle plot) of the individual models in an ensemble of three ResNet-18 models, along with the Trate of adversarial examples between the models of the ensemble (see Appendix B.I). LOTOS keeps the robust accuracy of individual models in the ensemble much higher than those increases, it becomes a much lower transferability (=z 20%) and the difference increases ma decreases (right-most plot). These benefits come at a slight cost to the average accuracy of the individual models (left-most plot).
of the Or ensemble and as
similar the models in C' = 1. LOTOS leads to
ensembles because of their Lipschitzness property; however, the individual models in LOTOS are not as robust as the ones in C' = because in LOTOS we are enforcing orthogonalization in addition to the Lipschitzness property. Because of this trade-off, the plot shows, by increasing the value of mal (from to 0.8) the robustness of the individual models becomes more similar to the ones in C = 1 ensembles. As the right-most subfigure shows. the Trate between the models in ensembles trained with LOTOS is much lower than C = 1 and Or g, and the ma value decreases (the orthogonalization becomes more striet) the Trate decreases. Figures (A (Appendix [B7)) 4nd[4show similar effectiveness in reducing the Trate for ensembles that consist of other models (ResNet- 18, ResNet-34, and DLA). See $ $5.4[for more details on those figures. Also in Appendix [B.4 we show how LOTOS effectively performs the orthogonalization of one layer with respect to the corresponding layer in other models of the ensemble while maintaining the target spectral norm.
So far, observed that LOTOS leads to noticeable decrease in the transferability at slight cost in test accuracy and robust accuracy of individual models; to make sure that the former overpowers the latter and derives more robust ensembles, we evaluate the robustness of the ensembles against black- box attacks using independently trained surrogate models (see Appendix [.] for details). We perform this experiment for both ResNet-18 and DLA models and use both CIFAR-10 and CIFAR- for the analysis. The results are presented in Table As the table shows, for each choice of the model architecture and dataset, we train ensembles with either of the methods (i.e., Oriq, LOTOS) and compute their test accuracy and robust accuracy. As the table shows, LOTOS achieves higher robust accuracy all cases with slight cost to the test accuracy in some cases. As Table 5 in Appendix [B.6.3] shows, this difference is even more prominent when the batch norm layers are removed because the clipping algorithms are less accurate (see Appendix B.2.
and
CIFAR-10
C-FAR-100
ORIG
= 1.0
LOTOS
CRIG
C= 1.0
LOTCS
ENSEMBLES OF RESNET-18 MODELS
TEST Acc
95.3 + 0.06
94.7 + 0.24
94.6 + 0.19 77.2 0.17
76.6 + 0.01
76.6 + 0.10
ROBUST ACC
30.3 + 1.63
35.2 + 0.72
36.3 + 0.88
15.2 + 0.15
18.9 0.40
20.2 + 0.47
ENSEMOLES OF DLA MODELS
TEST Acc
95.4 + 0.12
95.2 + 0.05
95.05 + 0.09
77.1 + 0.09
78.8 1 0.31
78.3 + 0.38
ROBUST Acc
26.7 : 0.58
32.8 + 1.28
34.5 + 0.63 16.5 0.78
19.4 0.32
21.0 + 0.39
Table 1: Robust accuracy against black-box attacks in ensembles of ResNet-18 18 models and ensembles of DLA models trained on CIFAR-10 and CIFAR-100 The surrogate models original models and clipped models trained with multiple random seeds. The target models are ensembles of three models from each architecture choice that are trained using either of the three training methods.
combination of both
5.3 ABLATION STUDIES
In this section, we explore the effect of when orthogonalizing the top-k sub-spaces of the con- volutional layers. We also investigate the effectiveness of LOTOS the ensemble size increases.
8

---

Published as a conference paper at ICLR 2025
=
N = 9
IMPROVEMENT
0.70
0.60
OR16
1.11
17.0 : 1.35
3.7%
0.58
0.65
C=1
26.4 0.57
27.5 : 0.95
4.2%
0.5-
LOTOs
32.2 0.99
45.1 +: 2.28
40.1%
60
120
100
125
1100
Table Robust accuracy against black-box at- tacks in ensembles with different sizes. The target models are ensembles in three different cases; original models (Orig), clipped ones (C' 1), and trained with LOTOS. As the table shows LOTCS has the high- est robust accuracy each ensemble size and it has the highest rate of improvement when the number of models in the ensemble increases from 3 to 9. Note that the robust accuracy the single Orig model and single C model are 16.1 0.887 and 26.2-20.52.
Figure 3: (Left) Effect of k. As the plot shows, the transferability slightly decreases (up to 1%) as k gets larger up
point (here k 15) and then starts to increase (k = 20). (Right) First layer might be enough! Comparing the effect of applying LOTOS to only the first layer rather than all the convolutional layers. The similarity of the results motivates the effec- tiveness LOTOS for heterogeneous models where it can only applied to the first layers.
In Appendix B.6 we also present additional ablation studies; we evaluate the importance of using the singular vectors in Equation (3) by comparing the transferability when they are replaced with random vectors (Appendix [.6.1 We also evaluate the effect of mal value on the transferability (Appendix B.6.2) and the effect of Lipsehitz constant on the strength of the surrogate model in black-box attacks (Appendix B.6.3 For an ablation study on attack methods see Appendix (..endiiBB.I0)
5.3.1 INCREASING ENSEMBLE SIZE
To verify the effectiveness of LOTOS as the ensemble size increases, we evaluate the improvement in the robust accuracy of the ensembles against black-box attacks (see Appendix B. for details) when the number of models in the ensemble increase by factors of 3. Table 2 shows the results of this experiment for ensembles of ResNet-18 18 models on CIFAR- 10 dataset; the improvement in the robust accuracy when the ensemble size increases is relatively small for the Ori and C = 1 ensembles. However, when LOTOS is used train the ensemble, there is huge improvement in the robustness of the ensemble as the size increases which is due to the increased diversity of the models by orthogonalizing them with respect to one another. The lack of noticeable improvement in the C' = 1 ensembles highlights the fact that making each model individually robust does not necessarily improve the robustness of the ensemble.
5.3.2 DIMENSION OF ORTHOGGNAL SUB-SPACES (k)
To further evaluate the theoretical observation from Theorem 4.1 for general convolutional layers, we use white-box attacks to measure the Trate among the models in ensemble of three ResNet- models when different values of l are used for orthogonalization of the top-k subspace (see Equa- tion (3)) As Figure 3 (Left) shows, with increasing & there is slight improvement in the Trate but is still less than one percentage point (compared to k = 1) even when k = 15. For 2 20, we noticed degradation in the training of the models and the Trates which might be due over-constraining the models. Given the computational efficiency and the negligible difference in the transferability, we found k be enough and used it in our other experiments.
5.4 HETEROGENEOUS ENSEMBLES
Although the original formulation of LOTOS relies on the similarity of the architecture which allows the layer-wise orthogonalization with respect to other models, when considering different architectures, the first affine transformation of each model is applied to the input data, and therefore has still the same vector space for right singular vectors. Therefore, LOTOS can still be utilized to orthogonalize the first layers on different models. Also, as Figure (Right) shows, applying LOTOS to only the first layers would still effectively decrease the transferability among the ResNet-18 models in an ensemble of three models trained on CIFAR-10 10. In this experiment, we consider ensembles of one ResNet- 18, one ResNet-34, and one DLA model CIFAR-10 10 and report the average accuracy and robust accuracy of individual models, along with the average transferability among them using white- box attacks. As Figure shows, LOTOS is effective in reducing the transferability of different models

---

Published as a conference paper at ICLR 2025
0.916
0.15
0.47
0.944
0.14
Tisrsforabiiity
0.40
0.942
0.43
0.45
0.940
0.42
0.44
0.338
0.11
0.43
0.936
Fpochs
Epoc
Spirts
Figure 4: Investigating the effect of LOTOS the average accuracy and robust accuracy of each of the models of heterogeneous ensembles of DLA, ResNet-18, and ResNet-34 models, along with presenting the average transferability among any pair of the models in the ensemble as the training proceeds. As the plots show, LOTOS leads to lower transferability among the models while maintaining the benefits of controlling the Lipschitz constant the robustness of individual models.
by orthogonalizing only their first convolutional layers, as that would lead to different behaviors on the perturbations of the input. Figure D Appendix B.7 shows results for similar experiment for these models when their batch norm layers are removed. As expected (see Appendix B.. for details), the improvement in the Trate is much higher without batch normalization layers.
5.5 IMPROVING PRIOR METHODS
In this section, we are interested observing the effectiveness of LOTOS when combined with prior SOTA methods for ensemble robustness. Table 3 shows the results for the ensembles trained with TRS (Yang et al., 202T) only (TRS), trained with TRS with clipped models (TRS + C 1), and trained with both TRS and LOTOS (TRS LOTOS). As the results show, for both datasets and both model architectures, the robust accuracy of the combined methods is the highest value. This comes at slight decrease in accuracy (more noticeable for CIFAR- (0F),.100). Gao al. (2022) showed that DVERGE (Yang et al., 2020 more effective than TRS against more elaborate attacks that are specifically designed for ensembles. Hence, also evaluate the combination of LOTOS with TRS and DVERGE against these attacks to further verify the effectiveness of LOTOS (see Appendix B.9).
CIFAR-10 TRS == 1
CIFAR-100
TRS
TRS LOTOSS
TRS
TRS +C=
TRS LOTCS
ENSEMBLES RESNET-18 MODELS
TEST ACC
94.4 0.05
0.17
92.7 0.09
73.28 0.46
0.29
67.23 1.22
ROBUST Acc
30.8 1 0.65
35.9 1 1.35
41.5 1: 1.04
12.3 1: 0.53
16.3 1 0.57
20.7 1 0.99
ENSEMBLES OF DLA MODELS
TEST Acc
94.72 0.06
92.79 1 0.13
0..18
72.6 1 0.54
63.3 1 1.20
66.8 1: 1.26
ROBUST
31.2 0.80
32.9
0.77
35.3 0.39
23.2 0.41
2.36
24.3 1.67
Table 3: Robust accuracy against black-box attacks in ensembles of ResNet-18 and ensembles of DLA models trained with TRS. We use ensembles of three models three different cases; trained with TRS only, trained with TRS while clipping the models, and trained with both TRS and LOTOS. As the results show, using TRS and LOTOS achieves a robust accuracy that is higher than when either of these methods is used.
6 CONCLUSIONS
We showed there is a trade-off between the robustness of individual models in the ensemble and the transferability rate of adversarial examples among them the Lipschitz constant of the models changes. This trade-off prevents the expected boost the robustness of the ensembles of models when they are Lipschitz continuous. Motivated by this observation, we proposed LOTOS that decreases the transferability rate by orthogonalizing the top sub-space of the corresponding layers of different models with respect one another. We performed thorough ablation study on the components of our method and showed the effectiveness of LOTOS in boosting the robustness of ensembles. We discuss some of the limitations of our proposed method in Appendix C.2
10

---

Published as a conference paper at ICLR 2025
7 ACKNOWLEDGMENT
This work used Delta computing resources at National Center for Supercomputing Applications through allocation CIS240316 from the Advanced Cyberinfrastructure Coordination Ecosystem: Services & Support (ACCESS) program Boerner et al. (023), which is supported by U.S. National Science Foundation grants #2138259, #2138286, #2138307, #2137603, and #2138296. This paper was generously supported by NSF award IIS 232261.

---

Published as a conference paper at ICLR 2025
REFERENCES
Taiga Abe, E Kelly Buchanan, Geoff Pleiss, and John P Cunningham. Pathologies of predictive diversity in deep ensembles. arXiv preprint arXiv:2302. 00704, 2023.
Peter L Bartlett, Dylan J Foster, and Matus J Telgarsky. Spectrally-normalized margin bounds for neural networks. Advances in neural information processing systems, 30, 2017.
Philipp Benz, Chaoning Zhang, Adil Karjauv, and In So Kweon. Revisiting batch normalization for improving corruption robustness. In Proceedings of the IEEE/CVF winter conference on applications of computer vision, pp. 494-503, 2021.
Timothy J. Boerner, Stephen Deems, Thomas R. Furlani, Shelley L. Knuth, and John Towns. Access: Advancing innovation: Nsf's advanced cyberinfrastructure coordination ecosystem: Services & support. In Practice and Experience in Advanced Research Computing 2023: Computing for the Common Good, PEARC '23, pp. 173- 176, New York, NY. USA, 2023. Association for Computing Machinery. ISBN 9781450399852. doi: 10.1145/3569951 35995555. URL
3597555
Ali Ebrahimpour Boroojeny, Matus Telgarsky, and Hari Sundaram. Spectrum extraction and clipping for implicitly linear layers, In International Conference Artificial Intelligence and Statistics, pp. 2971-2979, PMLR, 2024.
Huanran Chen, Yichi Zhang, Yinpeng Dong, Xiao Yang, Hang Su, and Jun Zhu. Rethinking model ensemble in transfer-based adversarial attacks. arXiv preprint arXiv:2303.09105, 2023.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-fres attacks. In International conference on machine learning, pp. 2206-2216.
PMLR, 2020.
Blaise Delattre, Quentin Barthélemy, Alexandre Araujo, and Alexandre Allauzen. Efficient bound of lipschitz constant for convolutional layers by gram iteration. In International Conference on Machine Learning, pp. 7513-7532. PMLR, 2023.
Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by cunslation-invariaan attacks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 4312 42214, 2019.
Ali Brrahimpoou-Borooojee Hari Sundaram, and Varun Chandrasekaran. Amun: Adversarial machine unlearning. arXiv preprint arXiv:2503.00917, 2025.
Farzan Farnia, Jesse M Zhang, and David Tse. Generalizable adversarial training via spectral normalization. arXiv preprint arXiv: 1,07577, 2018.
Xitong Gao, Cheng-Zhone Xu, et al. Mora: Improving ensemble robustness evaluation with model reweighing attack. Advances in Neural Information Processing Systems, 0-226555-26666 2022.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv: arXiv:1412.635 1412.657, 2014.
Henry Gouk, Eibe Frank, Bernhard Pfahringer, and Michael J Cree. Regularisation of neural networks by enforcing lipschitz. continuity. Machine Learning, 110:393-46, 2021.
Robert M Gray et al. Toeplitz and circulant matrices: A review. Foundations and Trends@ in Communications and Information Theory, 2(3):155 11339355-239, 2006.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016.
Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness common corruptions and perturbations. arXiv preprint arXiv://033 119990...22...1 2019.
Kai Hu, Klas Leino, Zifan Wang, and Matt Fredrikson. A recipe for improved certifiable robustness: Capacity and data. arXiv preprint 13.0v22310.02513, 2023.
12

---

Published as a conference paper at ICLR 2025
Lifeng Huang, Qiong Huang, Peichao Qiu, Shuxin Wei, and Chengying Gao. Fasten: Fast ensemble learning for improved adversarial robustness. IEEE Transactions on Information Forensics and Security, 2023.
Sanjay Kariyappa and Moinuddin Qureshi. Improving adversarial robustness of ensembles with diversity training. arXiv preprint arXiv:/901.09990 2019.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Alexey Kurakin, lan J Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial intelligence safety and security, pp. 99-112. Chapman and Hall/CRC, 2018.
Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black-box attacks. In International Conference on Learning Representations, 2016.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv: vrxiv:1706.00088 2017.
Takeru Miyato, Toshiki Kataoka, Masanori Koyama, and Yuichi Yoshida. Spectral normalization for generative adversarial networks. arXiv preprini arXiv:1802.05957. 2018.
Behnam Neyshabur, Srinadh Bhojanapalli, David McAllester, and Nati Srebro. Exploring generaliza- tion in deep learning. Advances in neural information processing systems, 30, 2017.
Tianyu Pang, Kun Xu, Chao Du, Ning Chen, and Jun Zhu. Improving adversarial robustness via promoting ensemble diversity, In International Conference on Machine Learning, pp. 4970-4979. PMLR, 2019.
Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv:1605.077 2016a.
Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, 7. Berkay Celik, and Ananthram Swami. The limitations of deep learming in adversarial settings. In 2016 IEEE European symposium on security and privacy (EuroS&P), P, pp. 372-387. IEEE, 2016b.
Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. In Proceedings of the ACM Asia conference on computer and communications security, pp. 506-519, 2017.
Sheng Peng, Weilin Xu, Cory Cornelius, Kevin Li, Rahul Duggal, Duen Horng Chau, and Jason Martin. Robarch: Designing robust architectures against adversarial attacks. arXiv preprint TrX1::2301.03110, 2023.
Bernd Prach and Christoph H Lampert. Almost-orthogonal layers for efficient general-purpor lipschitz networks. In European Conference on Computer Vision, pp. 350-365. Springer, 2022.
Hanie Sedghi, Vineet Gupta, and Philip M Long. The singular values of convolutional layers. arXiv preprint arXiv: 100.00000 2018.
Alexandra Senderovich, Ekaterina Bulatova, Anton Obukhov, and Maxim Rakhuba. Towards practical control of singular values of convolutional layers. Advances in Neural Information Processing Systems, 11110988-19930 2022.
Sahil Singla and Soheil Feizi. Skew orthogonal convolutions. In International Conference on Machine Learning, pp. 9756-9766. PMLR, 2021.
Sahil Singla, Surbhi Singla, and Soheil Feizi. Improved deterministic robustness on cifar- 10 and c00r arXiv preprint arXiv: 200i:
102.000..0000 04062, 2021.
Chawin Sitawarin, Jaewon Chang, David Huang, Wesson Altoyan, and David Wagner. Defending against transfer attacks from public models. In The Twelfth International Conference on Learning Representations, 2023.
13

---

Published as a conference paper at ICLR 2025
Christian Szegedy, Wojeiech Zaremba, llya Sutskever, Joan Bruna, Dumitru Erhan, lan Goodfellow, and Rob Fergus. Intriguing properties neural networks. arXiv preprint arXiv:1312.6199, 2013.
Asher Trockman and J Zico Kolter. Orthogonalizing convolutional layers with the cayley transform. arXiv preprint arXiv:2104.07167 2021.
Yilin Wang and Farzan Farnia. On the role of generalization in transferability of adversarial examples. In Uncertainty in Artificial Intelligence, pp. 2259-2270. PMLR, 2023.
Chaowei Xiao, Bo Li, Jun-Yan Zhu, Warren He, Mingyan Liu, and Dawn Song. Generating adversarial examples with adversarial networks. arXiv preprint arXiv:1801.02611 2018.
Cihang Xie and Alan Yuille. Intriguing properties of adversarial training at scale. arXiv preprint arXiv: 03787, 2019.
Xiaojun Xu, Linyi Li, and Bo Li. Lot: Layer-wise orthogonal training on improving certified robustness. Advances in Neural Information Processing Systems, 35:18904-18899 2022.
Huanrui Yang. Jingyang Zhang, Hongliang Dong, Nathan Inkawhich, Andrew Gardner, Andrew Touchet, Wesley Wilkes, Heath Berry, and Hai Li. Dverge: diversifying vulnerabilities for enhanced robust generation of ensembles. Advances in Neural Information Processing Systems, 33:5505-5515, 2020.
Zhuolin Yang, Linyi Li, Xiaojun Xu, Shiliang Zuo, Qian Chen, Pan Zhou, Benjamin Rubinstein, Ce Zhang, and Bo Li. Trs: Transferability reduced ensemble via promoting gradient diversity and model smoothness. Advances in Neural Information Processing Systems, 34:17642-17655 2021.
Wei Yao, Zeliang Zhang, Huayi Tang, and Yong Liu. Understanding model ensemble in transferable adversarial attack. arXiv preprint arXiv:2410.0065 068511, 2024.
Fisher Yu, Dequan Wang, Evan Shelhamer, and Trevor Darrell. Deep layer aggregation. In Pro- ceedings of the IEEE conference computer vision and pattern recognition, pp. 2403-2412, 2018.
Dinghuai Zhang, Hongyang Zhang, Aaron Courville, Yoshua Bengio. Pradeep Ravikumar, and Arun Sai Suggala. Building robust ensembles via margin boosting, International Conference on Machine Learning, pp. 26669-26692. PMLR, 2022.
14

---

Published as a conference paper at ICLR 2025
APPENDIX
A PROOFS
A.1 PROOF FOR PROPOSITION 3.3
Proof.
(=(A(z),)) v) Rg(A(x))))
-), = (Ax(()))) - (o(((x),, v)
- ( + lo(2 6z y))
(e0 - (g v)) + 22.1222122
Exl(e=(I,8) fg( + 2
(x(x,y) - (g( v) + 2L d(x,
21c + Rz(æ, u) Rg( ().
We can get a similar inequality starting from Rg(A(r)) - (F(A(x)), to derive the desired inequality.
A.2 PROOF FOR THEOREM
To prove this theorem, first prove Lemma A.1 that derives upper-bound for the difference of the squared values of the largest singular value and any other singular value a convolutional layer with 1 input and output channel and circular padding. The main intuition behind the proof of Lemma A. that the singular values convolutional layers depend only on the real parts the first few powers of roots of unity (Boroojeny al. 2024). This causes correlation between the magnitude of the singular values that correspond to the neighboring roots of unity on the real axis.
Lemma A.1. For a convolutional layer with 1 input and output channel and circular padding, if the length of the vectorized input is n, then:
of - -
where is the vectorized form of the convolutional filter with a length T.
Proof. The rank of the affine transformation of convolutional layer is input dimention x min Cin, Cour) (Sedghi et al.) 2018), which in the setting of this lemma is equal to n. Boroo
jeny et al. 2024) showed that if the vectorized form of the kernel is given by f [Jo, fi,..., -r...,, then we have the following equation for singular values of this convolutional layer:
8 =0 + Σ
j,,,,,.....
(6)
where c are defined as:
f0 + + P2 = foft + fif2 + ... fr-2fr-1.
foft-1.
and w = (xpp(2r/n) is the basic n-th root of unity. The order of syS (in terms of their magnitude)
are unknown apriori and depend on the filter values. Let assume that 01 = 8, corresponds to the largest singular value. Next, consider arbitrary st and derive the upperbound for 8) s?:
15

---

Published as a conference paper at ICLR 2025
T-1 s) - s cg +
T-1
T-1 (aixi =2 Σ c: (3l(wxx)) M(.xii)).
Σ R.( - cD 2
Σ
Now, we need bound the terms the summation, We use the fact that w = exp(22mi/n) cos 22 n + sin 22/// /n and therefore R(w*) = cos 22 /n:
2 x
İ i
Mwixi) Riw S [8(())x)) - M(wdxi))
1cos
-os
n
n
(j t)
(t j).l
(t j)
= 1ssin
sin
S 2|sin
n
n2
< | ja
where the last two last inequalities are due to sin(xr) S and sin(x) S x, respectively. By using this incquality we can write:
T 1
T-1
|t - j|zi
-
2
Ci (M(w)xt) -R(w)x)) 5 Σ
2c
==1
2=1
|1 j|
11 |11
T-1
C: axiss
Σ
max;
n
n
11 jIm
2(T 1)T
max; Ct-
n
It is easy to show that max; G; = co; for example, for we can write 2(cn ()) = -E=000
f++1)² 2 0 = cu 2 For G, i > similar justification can be made by only considering the terms that appear in the summands of c and using the fact that for the other terms their squared value, which is non-negative, appears in Co. Therefore:
TI T T2
83
8
2
- j|-
7
Now considering the set of indices I = + 1...,, j + [p/2]], we know that 8t, I E I falls within co 2 p/n radius of 8j (which singular values within this radius (including σ1). Hence, op (the p-th largest singular value) should be within this radius as well, and this completes the proof.
assumed represent σ1). Therefore, there are least [I| p
Note that the bound holds for any arbitrary pair of singular values and can be stated more general form, mentioned in Corollary A.2
Corollary A.2. For the setting of Lemma A. with sorted singular values 01, o....., the following inequality holds:
of - < T 1.j+pE [l.
Now, using Corollary layers, orthogonalization of only the singular vector corresponding to their largest singular values has a similar orthogonalization effect for the remaining singular vectors and this effect increases for the top singular vectors.
A.2
we can easily prove Theorem 4.1 and show that for two convolutional
16

---

Published as a conference paper at ICLR 2025
Proof. (Theorem Since M1 and M2 are convolutional layers with circular padding and one input channel and output channel, their linear transformation can be represented by circulant matrices of rank (dimension of the input). A, and A2 (Goodfellow et al.] 2014). Singular vector matrix of any circulant matrix is equal to the Fourier matrix of size n, and the singular vector corresponding singular value 8, from unordered list of singular values in Lemma ca can be ...... ....,,iXe ("= (Gray et al. (006)) Theorem 3.1). Therefore, the singular vectors of A2 (i.e., v/s) are simply a different ordering of the singular vectors of A1 (i.c., 145), Hence, each || equal to some singular value s, of A₁. Assuming that ||Areíllz = 8, and || = 8j+i-1, by making ||A ll2 I and, using Corollary A.2 we concolude the inequality of interest.
V written as ]. [w>xo, _.fx)......
B EXPERIMENTS
In this section, we first provide more details on the setting of our experiments (Appendix B.1 and explain how we control for the effect of batch norm layers in our experiments (Appendix B Then we provide more results on the verification of the trade-off between robustness of individual models and transferability rate among them as the Lipschitz constant changes (Appendix [B3). We show how LOTOS effectively performs the orthogonalization among the layers of the models in an ensemble in Appendix B.4 and present the results on three other ablations studies on our proposed we provide more results on heterogeneous ensembles, and in Appendix B.8 we will investigate the effectiveness of LOTOS in increasing the robustness of the ensembles when combined with adversarial training of individual models. In Appendix [B.9 we provide more experiments to further showcase how LOTOS can be combined with other ensemble robustness methods drastically improve their robustness. In Appendix 10 we provide the results of a set of extensive experiments to further evaluate the robustness of our proposed method against different attacks with various settings. Finally, in Appendix [I.1 we investigate the advantages of LOTOS in increasing the robustness of model ensembles against non-adversaiial noise.
method in Appendix B.6 In Appendix [B.7
B. SETUP
In this section, we elaborate on the setup of our experiments.
Compute Infrastructure: We used NVIDIA A40 GPUs for our experiments except for the experi- ments in $ 5.3 that involved training with TRS method where we used NVIDIA A100 GPUs. Using 32GB of RAM was enough for performing our experiments.
Datasets and Models: In all the experiments for evaluating the efficacy of our model, either in isolation or in combination with prior methods, we use both CIFAR-10 and CIFAR-100 datasets (Krizhevsky al.) 2009). The models we use in these experiments consist of ResNet- 18 (He et 2016),, ResNet-34 (in experiment on heterogeneous ensembles), and DLA (Yu et al.) 1 For more exploratory ablation studies (e.g., effect of the parameter k: and ensemble size) we limit the experiments to ResNet- 88 models on CIFAR-10.
Attack Details: We use both black-box attacks and white-box attacks in experiments.
o The white-box attack is used to evaluate the transferability rate of adversarial examples between the models in the ensemble; for each ordered pair of the models in the ensemble, the first one is used as the source model to generate the adversarial examples and then the transferability rate of the generated adversarial examples is evaluated on the second model (target model) using Definition 3.2 The final transfcrability rate for the ensemble is the average of the transfcrability rate for all the ordered pairs of the models. To make the results more accurate, we repeat this for 3 different ensembles trained from scratch with different random seeds, and report the average values. The attack performed on the source models is PGD-50 with ||e]|oo S 0.04, unless stated otherwise. We also evaluate the robustness of ensembles against white-box attacks where all the constituent models are provided to the adversary and report the results Appendix 10.4 and Appendix B.99
For the black-box attacks, an independently trained source (surrogate) model (of the same type as the models in the ensemble) is used to generate the adversarial examples; we then measure the robust
According https///gthhihhcom//uuuuihhhhhhh they achieve superior results on CIFAR-10.
17

---

Published as a conference paper at ICLR 2025
accuracy of the ensembles against these adversarial examples i..., robust accuracy is the accuracy on the adversarial samples for which the model correctly predict the original versions. We use both the original models and their clipped version as the surrogate models to generate adversarial examples. To make the results more accurate, we train 3 source models with different random seeds (for each of the two types of surrogate models) and 3 ensembles with different random seeds and compute the average of the robust accuracies over the 18 different cases of choosing a source model and target ensemble. For both white-box attacks and black-box attacks we use PGD-50 (Madry et al. 2017) attack with ||<|| Σ 0.04 to generate the adversarial examples unless stated otherwise. For these attacks we compute Trate according to Definition 3.2 and report Trate as the robust accuracy against generated adversarial examples for transferability attack.
B.2 BATCH NORMALIZATION LAYERS
Controlling the Lipschitz constant of the models is more complicated the presence of batch norm layers. For analyzing the properties of the Lipschitz models, some prior works ignore the batch norm layers (Miyato et al. 2018) and some remove them from the models (Sedghi et al.) 2018). Some other works modify the parameters of the batch norm directly ensure Lipschitzness (Gouk et al.. | Senderovich et al. 2022 Delattre et al. (023)) Boroojeny et al. (2024) show that batch norm layers show compensating behavior when the spectral norm of it preceding convolutional layer is controlled so ignoring them does not help with bounding the Lipschit constant of the model. They also show that modifying the parameters directly leads to poor training and test accuracy. They instead propose an approximate method for controlling the Lipschitz constant of the composition of the convolutional and batch norm layers which works better practice but still are not exact and as accurate. Therefore, for analyzing the true effect of the Lipschitz constant on transferability rate and ablation studies we perform the experiments on models without their batch norm layers, in addition to performing the same experiments the efficacy of our method in increasing the robustness of ensembles of the original models (including their batch norm layers) when using the approximate methods for controlling the Lipschitz constant in the presence of batch norm layers.
B.3 ROBUSTNESS VS. TRANSFERABILITY (CONT.)
0.14
0.94
0.13
0.800
recurery
soburtrers
0.12
0.775
0.93
0.11
0.750
0.92
0.10
0.725
0.91
0.09
0.700
120
140
160
180
200
140
160
180
200
120
140
160
180
200
Epochs
Spochs
Epochs
Figure 5: Accuracy vs. Robust Accuracy vs. Transferability: Changes in the average accuracy and robust accuracy of individual ResNet-18 models (with batch norm layers), along with the average transferability rate between any pair of the models in each ensemble as the layer-wise clipping value changes. As the plots show, although the robustness of individual models increases with decrcasing the clipping value, the Trate among the models increases, which might forfeit the benefits of the clipping the robustness of the whole ensemble.
We use the same setting as in $15.1 for this section, but keep the batch normalization layers in the ResNet-18 18 models intact. In Figure we observed that LOTOS effectively decreased the transferability rate for models without batch norm layers. In Figure 5 we also see that when the batch norm layers are present, LOTOS is still effective; however, the improvement might not be much as what was observed without batch norm layers. As mentioned earlier, the reason for this lower effectiveness is that the clipping methods for controlling the Lipschitz constant of the models with batch norm layers are less accurate and not as effective. That leads to less accurate computation of the singular vectors in Equation (3). Also, batch norm layers are known adversly affect the robustness of models (Xie) & Yuille 2019 Benz et al. (02T) and prior work has pointed out their compensation behavior when controlling the spectral norm of their preceding convolutional layer (Boroojeny al. 2024).
18

---

Published as a conference paper at ICLR 2025
255
0.45
0.45
2.0
0.40
1.54
D.
0.35
0.30
0.30
0.25
200
100
100
100
Sparths
Epocha
Specits
0.50
Spectelhorm
0.4
Wodel 212
0.15
Modeo 51
0.40
100
200
100
200
100
200
0
100
200
Duccles
Epochn
Spachs
2.00
0.5
0.5
1.75
Hodel 1
C.4-
model221
0.4
Medel 211
0.4
1550
0.3
125
1.00
0,2
0.2
0
100
200
100
200
100
200
100
200
Epachrs
Spocho
Spachs
Spachts
Figure 6: Each row represents the results for specific layer from the three ResNet-18 18 models in ensemble trained with LOTOS with C' and mal 0.5. The leftmost subfigure shows the spectral norm of that layer for each model which is enforeed be 1-Lipschitz. The next three subplots show the size of the outputs of that layer from each model when applicd to the largest singular vectors of the corresponding layer from the other models; LOTOS effectively keeps these values below the chosen value for mal.
B.4 EFFICACY OF LOTOS (CONT.)
As mentioned previously, the goal of the orthogonalization loss of LOTOS in Equation (4) is to keep the size of the output of layer from each of the models in the ensemble when applied to the largest singular vector of the corresponding layer from the other models below the chosen ma value. This goal has to be achieved while enforcing the spectral norm of each layer to the target clipping value. In this section, we look at some of the layers of the ResNet-18 18 models in an ensemble that is trained with LCTOS CIFAR-10. to see how the aforementioned values change during the training of the model. We randomly choose three of the layers from different parts of the models and evaluate them in the course training for two different chosen values for mal. Figure @ecuree@shaee shows the results when = 1.0 and mai = 0.5. Each row shows the results for one specific layer from the three models. The leftmost subfigure shows the spectral norm of that layer for each of the models. As the figure shows, the clipping method effectively enforces the spectral norm to be almost 1 and therefore makes that layer 1-Lipschitz. The next three subfigures, each show the output of that layer from one of the three models when applied to the largest singular vectors of the corresponding layer from the other two models. As the plots show, these values are effectively controlled be less than the chosen ma value.
Figure ( shows the results for the same three layers when the ensemble is trained with mal 0.01. As the plots show the spectral norm is effectively controlled to be almost 1, while the output of the layers on the largest singular vectors of the other layers is made much smaller than in the previous case. However, note that for some of these layers, this size might increase up 0.1, which is larger than the ma value and the reason is the specific structure of the convolutional layers which does not allow them accept arbitrary spectrums as noticed by prior work (Boroojeny al. 2024).
19

---

Published as a conference paper at ICLR 2025
0.10
0.08
9om
1.75
0..03
Nold 2
0.00
Model 36
0.06
1.50
0.02
0.04
1.25
0.01
0.02
0.02
1.00
0.00
200
200
Tpachs
Esschs
Rpocha
0.10-
0.3
0.3
Speccra
Medel1
0.2
0.2
0.2
0.02-
0.0
0.0
0
100
200
100
206
100
200
100
200
Spastts
Spacta
fpocts
Epscts
0.15
1.6--
0.10
Hodel
0.33
1.4-
0.05 -1
0.1-
1.0-
100
200
1000
200
100
200
100
200
Spactrs
Spuchs
Spacits
Figure 7: Each row represents the results for specific layer from the three ResNet-18 models in ensemble trained with LOTOS with C. 1 and ma 0.01. The leftmost subfigure shows the spectral norm of that layer for each model which is enforeed be 1-Lipschitz. The next three subplots show the size of the outputs of that layer from each model when applicd to the largest singular vectors of the corresponding layer from the other models; LOTOS effectively makes these values much smaller but because the limitations of convolutional layers, they might not become smaller than the mal value in some cases.
B.5 RUNNING TIME
In $ we saw that the computation of orthogonalization loss in LOTOS is the same as running each model on N --1 additional batch. Table Table&showws shows comparison between the training times of ensembles three ResNet-18 18 or DLA models on an NVIDÍA A40 GPU. We report the time per epoch for training ensembles without clipping, with clipping, and with LOTOS. For the latter two versions, we also report the increased factor in time compared to the training time of the regular ensembles. These times are shown in three groups: 1. when additional robustification method is used, 2. when TRS (Yang et al., 202I) l is also used for training the ensembles, and 3. when Adversarial Training (Adv) (Madry al. (017) is used in training of each individual model in the ensemble. As the table shows the time increase caused by the orthogonalization loss in LOT OSTOS (see Equation ( is negligible while being very effective diversification among the models and decreasing the transferability rate among them.
Ckto
C=
1.0T0S
TRS
TRS
TRS TOTOS
Anw
ABV + (==1
AnV LOTTS
RESNET-18
33.2
74.9 xa.3
79.3 xa.4
158.2
224.4 x1.4
227.3 x1.4
312.6
479.2 x1.5
485.2 x1.5
DLA
63.1
135.4
x2.6
165.4 x2.6
326.2 2
466.1 x1.4
477.4
758.6.2
942.5 x1.2
949.2
Table 4: Time (in seconds) per epoch for training ensembles of three ResNet- 18 models using either of the methods investigated in this paper. These values are computed on an NVIDIA A40 GPU. As the table shows the orthogonalization loss used in LOTOS makes negligible change in the computation time of the ensembles with clipped models (C 1).
20

---

Published as a conference paper at ICLR 2025
Transferabllity
0.8
mal-0.5 LOTOS mal-d.a
LOTOS mal=1.0
0.7-
Rand mal-2.5
Rand mal-2.8
Rand maie1.0
0.6
60
80
100
120
Epochs
Figure 8: Do random vectors work? We random vectors in Equation
3 instead of the largest singular the plot shows the ensembles
vectors verify the effect of orthogonalization on decreasing the transferability.. that use random vectors rather than the largest singular vectors of the layers of other models perform similarly to the clipped model without LOTOS (C = 1.0). It still shows slight improvement because using different random vectors still provides some diversity among the models but not much as using the top singular vectors.
B.6 ADDITIONAL ABLATION RESULTS
In this section we present the results on three other ablations studies (in addition to the ablation studies presented in $ (5.) on our proposed method: First, we show the importance of using singular vectors of the other layers in Equation (3) by comparing the results when they are replaced by random vectors (Appendix] [B6. I}. We then investigate the effect of changing ma value Equation 44 in the transferability rate (Appendix (B.6.2). Finally, we investigate the effect of changing the clipping value the source model black-box attacks (Appendix B.6.3)
B.6.1 LARGEST SINGULAR VECTOR VS. RANDOM VECTORS
LOTOS orthogonalizes the corresponding layers of the models by penalizing the size of the output of each layer when gets the largest singular vectors the corresponding layers in the other models as its inputs. To show that the decrease in the transferability rate presented in $ [.2 is indeed the result of orthogonalization of the subspaces spanned by the top singular vectors, we perform an experiment in which we use randomly chosen vectors in Equation (3) instead. As Figure g shows, using the transferability rate when random vectors are used similar to the clipped model without LOTOS. The of random vectors for the models still causes slight decrease in the transferability rate it introduces new random diffcrences in the training of the models, but not as much as using the top singular vectors which leads to orthogonalization of the models with respect one another.
B.6.2 EFFECT OF MAL
In Equation ( by decreasing the maximum allowed length (mal) for the size of the output of layer when top singular vectors of the other layers are given as input, enforce a higher degree of orthogonalization, and therefore expect to see a more decrease the transferability rate among the models. As Figure (Right) and Figure show, that is indeed the case. However, based our experiments, decreasing mal to very low values, decreases the robustness and accuracy individual models. We found the value of 0.8 to be good trade-off between the two for increasing the robustness of ensembles and used that for our experiments.
B.6.3 CHANGING THE LIPSCHITZ CONSTANT OF THE SURROGATE MODEL
In this experiment, we evaluate the effect of Lipschitz constant of theh surrogate model on the effectiveness its adversarial examples on the target ensembles in a black-box attack. We clip the spectral norm of each layer of each of the source models to specific value and evaluate the average robust accuracy of each of the three models. We try different layer-wise clipping values (0.8, 1.0, 1.2, and 1.5) and for each setting compute the average of the robust accuracy over multiple random seeds. As the table shows the adversarial examples generated on the clipped models are more effective in block-box attacks, but still LOTOS has the highes robust accuracy compared others.
21

---

Published as a conference paper at ICLR 2025
ORIG
C' = 1.0
LOPOs
ORIG
19.3 1.34
39.0 0.85
43.8 1.30
C 0.8
15.7 1.03
12.9 0.64
18.5 0.79
C 1.0
13.6 0.89
13.9 0.30
20.5 0.69
C 1.2
13.2 0.96
15.9 0.69
22.9 0.91
1.5
13.1 1 0.65
19.8 = 0.29
27.1 0.66
Table 5: Robust accuracy against black-box attacks. The source models either original models clipped models with different layer-wise clipping value for the spectral norm. The target models ensembles of three ResNet-18 models on CIFAR-10 for three different cases; original models (Orig g), clipped ones (C = 1.0), and trained with LOTOS. As the table shows attacks using clipped models are stronger but still 1.OTOS achieves the highest robust accuracy.
B.7 HETEROGENEOUS ENSEMBLES (CONT.)
We perform similar experiment the one in $ with models without batch norm layers. Since the DLA models cannot be trained without batch norm layers, as observed by prior work (Boroojeny eet al., 2024). we consider ensembles of one ResNet-18 and one ResNet-34 models on CIFAR-10 and report the average accuracy and robust accuracy of individual models, along with the average trans- ferability among them using white-box attacks. As Figure shows, LOTOS is effective in reducing the transferubility of different models by orthogonalizing only their first convolutional layers, as that would lead different behaviors on the perturbations of the input. As expected, the improvement in the transferability rate is much higher without batch normalization layers (see Appendix B.2).
0.80
0.30
Rchusrioss
Tranferraiity
0.75
Acurery
oeg
0.91
0.25
0.70-
0.65
0.90
0.20
0.60
60
80
100
120
60
80
100
120
60
80
100
120
Figure 9: Investigating the effect of LOTOS on the average accuracy and robust accuracy of each of the models of heterogeneous ensembles of ResNet-18 and ResNet-34 models (without batch norm layers), along with presenting the average transferability among any pair of the models in the ensemble the training proceeds. As the plots show, LOTOS leads to much lower transferability among the models while maintaining the benefits of controlling the Lipschitz constant on the robustness of individual models.
B.8 LOTOS AND ADVERSARIAL. TRAINING
Adversarial training is the most common method for increasing the robustness of individual models in practice. This method finds new set of adversarial examples for the training at each iteration of the training algorithm and combines that with the original training data to feed it to the training method for the next iteration. Iterative training of the model on the adversarial examples, which are perturbed versions of the original training samples, makes them less sussptible to the adversarial examples. this section, we verify that our proposed training paradaigm not only does not interfere with the robustness of the ensembles of models that are adversarialy trained, but also improves the robustness of the ensemble. For this we train ensembles of ResNet-15 18 and ensembles of DLA models on 10 dataset, and incorporate adversarial training for each model within the ensemble. We repeat this procedure for three settings: 1. no further modification (Orig), 2. clipping each model to 1.0 (C 1.0), and 3. using LOTOS. We evaluate the robust accuracy of these ensembles against blackbox attacks and summarize the results in Table As the table shows, the ensembles trained with LOTOS achieve higher robust accuracy while achiving similar test accuracy.
22

---

Published as a conference paper at ICLR 2025
ADV TRAIN
ADV TRAIN + C
ADV TRAIN LOTOS
ENSEMBLES OF RESNET- 18 MODELS
TEST ACC
93.1 = 0.00
92.5 + 0.16
92.7 + 0.09
ROBUST ACC
60.1 = 0.93
60.9 = 1.49
61.7 = 1.04
ENSEMBLES OF DLA MODELS
TEST Acc
90.8 = 0.09
93.7 0.24
93.9 - 0.22
ROBUST ACC
59.6 = 0.93
61.2 + 1.32
62.7 + 1.34
Table 6: Robust accuracy against black-box attacks in ensembles ResNet-18 and ensembles of DLA models trained with adversarial training We use ensembles of three models for three different cases; trained with adversarial training only, trained with adversarial training while clipping the models, and trained with both adversarial training and LOTOS. As the results show, using both adversarial training and LOTOS achieves robust accuracy that higher than when either these methods are used.
B.9 IMPROVING PRIOR METHODS (CONT.)
In this section, we evaluate the effectiveness of LOTOS in enhancing the robustness of two SOTA methods, DVERGE (Yang et al. 2020) and TRS Yang al., 202T). For this purpose, we evaluate the robustness of different ensembles against MORA (Gao al. (022), which is specifically designed for model ensembles and has been shown to be more effective in bypassing the gradient obfuscation introduced by the defense methods (Gao et al. (022). To evaluate the robustness of ensembles in the worst-case scenario, we choose white-box attacks against these ensembles and use the recommended setting by Gao et al. (2022). For this experiment,
ensembles of ResNet-18 18 models trained on CIFAR- 10, and for each ensemble robustness method, we use the recommended settings by their authors. As the results in Table 7 show, incorporating LOTOS improves the robust accuracy of TRS and DVERGE ensembles by 4.2 and 9.5 percentage points.
We also performed this evaluation for ensembles that are trained only with LOTOS (without TRS and DVERGE), and achieved robust accuracy of 16.8 + 0.51 against MORA attack. This robust accuracy is higher than TRS but does reach the robust accuracy of DVERGE alone. However, it is important to note that LOTOS increases the training time of ensembles of ResNet- 18 models only by 2.4 times per epoch (see Appendix [B5) whereas DVERGE increases the training time by factor of 14.3 because of all the different techniques they use in their algorithm. If we only add adversarial training to LOTOS, which leads to almost the same (a factor of 14.6) increase in the training time (see Appendix B,8) for fair comparison, then the robust accuracy against MORA becomes 49.5% (=1.4 which 29.8 percentage point higher than DVERGE alone. Note that for all the experiments in this section and section 5.5 did not perform any hyper- papammee tuning and used all methods with the default parameters.
ORIG
ORIG+ C =
CRIG + LOTOS
TRS
10.3 + 0.33
13.2 + 1.12
14.5 + 0.81
DVERGE
19.7 4: 2.34
26.8 + 0.75
29.2 1: 0.56
Table 7: Boosting robust accuracy of other ensemble robustness methods. The robust accuracy of ensembles three ResNet-18 models on CIFAR-10 two SOTA ensemble robustness methods against MORA white-box attack in three different cases; original models (Crig), clipped ones (C' = 1.0), and trained in combination with LOTOS. As the table shows LOTOS effectively boosts the robustness of other ensemble robustness methods.
B.10 OTHER RESULTS
In this section, perform more experiments further explore the effectiveness of LOTOS in different settings, including different attack methods, various norm bounds and attack sizes, and white-box attacks. We also evaluate the effectiveness of LOTOS in enhancing the robustness of ensembles of larger models. Finally, we evaluate the effectiveness our proposed method in improving the ensemble robustness against various non-adversarial noise. For all the experiments
23

---

Published as a conference paper at ICLR 2025
in this section, ensembles of ResNet- models (without batch norm layers) trained CIFAR-10.
1.10.1 CHANGING THE NORM AND RADIUS
In this section, compare the results when the attack norm is changed in black-box attacks using PGD-50. We first compare the results for Loo (used in the main experiments), f2, and & norms all with an upper-bound of 0.04, and report the results Table The results show the consistent advantage of LOTOS in enhancing the robustness of the ensembles.
foc
82
ORIC
16.4 + 1.11
20.4 1.00
20.2 +: 0.98
C' 1
26.4 0.57
17.9 1.20
17.9 + 1.12
LOTOs
32.2 0.99
22.2 1.79
22.1 + 2.14
Table 8: Robust accuracy against black-box attacks with different norms. The target models ensembles of three ResNet-18 models CIFAR-10 for three different cases; original models (Orig), clipped ones (C 1.0), and trained with LOTOS. As table shows LCTOS achieves the highest robust accuracy.
We also evaluate the results when the attack size changes for black-box attacks using PGD-50 with so norm bound and report the results in Table g As the results show, the benefit using LOTOS becomes even more clear when the radius of the attack gets larger and the attack becomes stronger.
0.02
= 0.04
0.08
ORIG
22.9 1.04
16.4 1.11
8.2 0.63
C=1 1
28.2 = 1.03
26.4 0.57
20.7 + 0.50
LOTOS
33.1 = 1.14
32.2 + 0.99
28.1 + 1.63
Table 9:
Robust accuracy against black-box attacks with different radii. The target models ensembles of three ResNet-18 models on CIFAR-10 for three different cases; original models (Ori g), clipped ones (C' 1.0), and trained with LOTOS. As the table shows LOTOS achieves the highest robust accuracy.
B.10.2 OTHER BLACK- ATTACKS
In this section, we replace PGD-50 with other attack methods to generate the adversarial examples on the surrogate models and evaluate the robust accuracy of target models on the generated examples. For this purpose, we use AutoAttack (Croce & Hein| 2020) and MORA (Gao et al.) 2022) attack methods, which are stronger white-box box attacks against the surrogate models (see Appendix 10.4...
The results are shown in Table I0 As the results show, although AutoAttack and MORA are stronger attacks in the white-box setting, the adversarial examples they generate for the surrogate models do not generalize to the target ensemble. This is an interesting observation that suggests overfitting the adversarial examples to the surrogate models and needs further exploration in future work. Still, we can see that LOTOS effectively achieves higher robust accuracy against different attacks by diversifying the models within the ensemble and reducing the transferability rate among them.
1.10 LARGER MODELS
To evaluate the effectiveness of LOTOS on more robust models, we evaluated the robustness of ensembles of Re models, which are shown to be more robust than the models used in our experiments |Pegg et al.] (202)). We compared the robust accuracy of ensembles of these models against black-box attacks on CIFAR-10. As the results in Table show, LOTOS still effectively achieves a higher robust accuracy by increasing the diversity of the Lipschitz continuous models.
B.10.4 WHITE-BOX ATTACKS
In this section, we evaluate the robust accuracy of the ensembles against white-box attacks. For these attacks, all the parameters of the models within the ensemble are available to the adversary. Although
24

---

Published as a conference paper at ICLR 2025
PGD-50
AUTOATTACK
MORA
ORIG
16.4 + 1.11
16.3 0.69
30.0 = 0.52
C=
26.4 1 0.57
30.0 1 0.39
34.9 1 1.07
LOTOS
32.2 0.99
33.7 0.76
40.1 + 0.83
Table 10: Robust accuracy against black-box attacks with different attack methods. Different attack algorithms used to generate adversarial examples the surrogate ResNet- model ensembles. The target models are ensembles of three ResNet- 18 models on CIFAR- 10 three different cases; original models (Orig), clipped ones (C 1.0), trained with LOTOS. As table shows LCTOS achieves the highest robust. accuracy for all three types of attacks.
RESNET-18
RESNET-50
ORIG
16.4 1.11
27.0 + 1.03
C'
26.4 0.57 0.57
23.7 + 1.29
LOTOS
32.2 1 0.99
34.8 1 1.59
Table 11: Robust accuracy against black-box attacks with different model sizes and robustness levels. The target models are ensembles of three ResNet-18 and ResNet-50 models on CIFAR-10 for three diffcrent cases; original models (Orig) g), clipped ones (C 1.0), and trained with LOTOS. As the table shows LOTOS effcctively boosts the robustness for both model ensembles with different robustness levels.
white-box attacks are considered impractical and unrealistic in most scenarios (Sitawarin et al. 2023 still they be used evaluation for the worst-case scenario. Other than the PGD-50 attacks used for transferability attacks, we use AutoAttack (Croce & Hein 2020), which shown to stronger white-box attack, and MORA (Gao et al. 2022), which is specifically designed for model ensembles. As the results in Table T2 shows, LOTOS effectively enhances the robust accuracy of ensembles against white-box attacks.
PGD-50
AUTOATTACK
MORA
ORTG
21.5 + 0.51
18.9
18.2 0.48
C =
37.4 4: 0.37
0.41
31.0 + 0.51
LOTOS
39.9 + 0.71
32.4 0.43
Table 12: Robust accuracy against different white-box attacks. The target models are ensembles of three ResNet-18 18 models on CIFAR-10 10 for three different cases: original models (Crig), clipped ones (C' = 1.0), and trained with LOTOS. As the table shows LOTOS achieves the highest robust accuracy against different attack methods.
B.11 NON-ADVERSARIAL NOISE
In this section, we evaluate the benefits of LOTOS in robustness against various non non-ad aneesrrrrra noise types. For this purpose, we use the benchmark introduced by Hendrycks & Dietterich (2019) for CIFAR-10 and report the results in table 13 As the results show, the ensemble of Lipschitz continuous models (C 1), is more robust than the original models by preventing the small noises from drastic changes in the output of the models. However, LOTOS achieves even better robustness by further diversifying these models and preventing different models in the ensemble from failing for the same noise the inputs.
Imprise
Fog
Spatler
Speckle
Org 1070s
36.1
A38
78.2
Table 13: Accuracy against non-adversarial noise. Accuracy of different ensembles of ResNet-18 models in the presence different noise types on CIFAR-10. LOTOS effectively achieves higher robustness in most cases and also on average.
25

---

Published as a conference paper at ICLR 2025
C FURTHER DISCUSSIONS
In this section, we expand our discussions on the evidence of the trade-off of robustness and transferability due the Lipschitz continuity in prior theoretical works. We then mention the limitations of our proposed solution (LOTOS), to this trade-off.
C.I RELEVANT THEORETICAL OBSERVATIONS
In this section, we investigate other theoretical results from prior work that further approve our observations regarding the trade-off of the robustness of single models and transferability rate due to Lipschitz continuity. Theoretical results by Yao et al. (002)), show there is a trade-off between complexity and diversity for transferability rate of adversarial examples. On the other hand, enforcing Lipschitz continuity works as a regularizer to decrease the complexity (Bartlett et al., 2017). So based the trade-off established by Yao et al. al. (2024), this decrease in the complexity by Lipschitz continuity leads to reduced diversity among the ensemble models, which in turn reduces the transferability rate. That is why we need an additional modification, such as LOTOS, further boost the diversity despite the reduced complexity caused by Lipschitz continuity. Also, the diversity term defined by Yao et al. (2024) can effectively be increased by LOTOS as it directly enforces the differences in the outputs for various perturbations in the inputs.
Wang & Farnia (2023) show that adversarial examples generated by models with controlled operator norm generalize better, which matches our observations (e.g.. Figure and T) and motivates the necessity of further training strategies, such as LOTOS, to counteract this improved generalization which potentially leads to higher transferability rates. The lower-bounds on the probability of transfcrability in Wang Farnia (203) (similarly in Yang et al. (2021) )) show the connection with the smoothness of the model in terms of the Lipschitz continuity of the gradients (not Lipschitz continuity of the outputs which is a milder assumption). Finally, Finally,AAbe Abe et al. (2023) motivates avoiding the extension of basic intuitions and observations for simple models to neural networks when they are used in the form of an ensemble, as it might not lead to the expected benefits one expects from an ensemble of models. This aligns with our observations (e.g., Table 2 and further motivates full understanding of the robustness techniques that are designed for individual neural network models before using them in ensembles because they only might not help in the ensemble settings but may also worsen the results in some cases (Gao et al. 2022).
C.2 LIMITATIONS OF LOTOS
Although we showed the negligible computational overhead of our model, we should mention that it is only limited by the speed of the underlying method used for controlling the spectral norm of affine layers, which has become practical using recent methods (Boroojeny et al., 2024). Another limitation of our method is that it is affected by the degradation of the clipping methods in the models with batch normalization layers. Finally, we should mention that although LOTOS was shown to be effective in practice, might not be as efficient for other affine layers and we leave the exploration of more efficient variants for other layers to future work.
discussed in Section 4.1 is highly efficient for convolutional layers, but
26


Reviews:
[{"review_id": "DkunFrrs2A", "reviewer": "Reviewer_oLSw", "summary": "This paper makes 3 contributions to the field of robust ensemble training: \n\n1. It identifies a trade-off in neural network ensembles: while decreasing the Lipschitz constant of individual models improves their robustness, it unfortunately also increases the transferability of adversarial examples between models in the ensemble, potentially undermining the ensemble's overall robustness. \n\n2. It introduces LOTOS (Layer-wise Orthogonalization for Training rObust enSembles), a new training method that promotes orthogonality between corresponding layers of different models in an ensemble. LOTOS is computationally efficient and pretty architecturally agnostic. \n\n3. Through experiments on CIFAR-10 and CIFAR-100, the authors demonstrate that LOTOS improves ensemble robustness against black-box attacks by 6 percentage points, and when combined with existing robust ensemble methods, enhances their performance by up to 10.7 percentage points.", "questions": "I addressed the questions in the Weaknesses section.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "Overall I'm a fan of establishing (through published literature) empirical observations of interesting deep learning phenomena. This is an example of such a thing. The fact that we can both a) make an individual model more robust via Lipschitz constant changes, but at the same time b) make an ensemble of such models more similar in a way that reduces the overall robustness of the ensemble, is a very curious piece of empirical evidence.\n\nI think the evaluation is pretty strong and despite some obvious additions (that I mention later) I think it is sufficient to establish this as a phenomenon that might be real and that should be investigated further.", "weaknesses": "There are a few weakness that I believe could be relatively easily addressed.\n\n### Limitation 1: Testing only against a single type of adversarial attack\nAs far as I understand it, the authors only test the robustness against one type of an adversarial attack -- the PGD-50 = Projected Gradient Descent with 50 iterations. I think it is important to 1) add more types of attacks (including black box ones), and 2) possibly look at some standard attack suites such as RobustBench (https://github.com/RobustBench/robustbench)\n\n### Limitation 2: Adversarial robustness vs other kinds of robustness\nWhat about other kinds of robustness such as robustness to noise, sheer, etc. Do you see similar phenomena to what you describe under adversarial attacks?\n\n### Limitation 3: Attack strength norms and their effect on the phenomenon and LOTOS\nI would be very curious what the effect of the attack norm (L_infty vs L_2 etc) and attack size (8/255, ...) is on the observed phenomenon and the efficacy of LOTOS. I can imagine that different attack size norms might lead to different qualitative tradeoffs. Could you please be more specific with what exactly you do and how does this relate to your theory & experiments?\n\n### Limitation 4: Weak models?\nThe results and improvements you present are (I think) pretty non-robust to begin with. Am I wrong about this? How do robust model perform under the same attack? If the model you are using does not have a high robustness to begin with, I believe this might lead to misleading results on what helps and what doesn't. This is because many things tend to help when we're not close to the maximum robustness, but might not generalize. **Addressing this is crucial for me to raise your score.**", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ZJnnDtvj1k", "reviewer": "Reviewer_uLeN", "summary": "This paper finds that while Lipschitz continuity improves individual model robustness, it unexpectedly raises adversarial transferability in model ensembles. To counter this, the authors introduce LOTOS to boost ensemble robustness by promoting orthogonality between models.", "questions": "- Could you compare your methods with other ensemble defenses, especially with DVERGE?\n- Could you consider stronger attacks such as AutoAttack [b] and MORA [a] which specifically target ensemble models?\n\n[a]: Yu et al., MORA: Improving Ensemble Robustness Evaluation with Model-Reweighing Attack. NeurIPS 2022. https://arxiv.org/abs/2211.08008\n[b]: Croce et al., Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. ICML 2020. https://arxiv.org/abs/2003.01690", "limitations": "", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "This paper links decreasing Lipschitz continuity with increasing transferrability. This is an interesting point of exploration.", "weaknesses": "- What are the white-box attacks that you used in this paper? Some attacks may not be reliable in assessing ensemble robustness.\n- The method appears to be an improvement upon TRS. However, TRS was shown to have an overestimated robustness [a], and it is not well-explained why the LOTOS loss is an improvement.\n- It is not clear to me why DVERGE was not considered in the baseline comparisons, as it is known to be an effective robust baseline for ensemble defenses.\n- Section 4 is poorly written. I am having trouble understanding your method. For eq. (3):\n  - Where is $w_i$ introduced?\n  - Why does this equation measure similarity?\n  - What are $A$ and $B$ matrices, are they model parameters?\n  - Also given that $A$ and $B$ are trainable, do you backprop through the SVD of them?\n- For eq. (4): There is no $k$ in the LHS.\n- Theorem 4.1:\n  - \"In Theorem 4.1, we prove even k = 1 can be effective in orthogonalization with respect to the remaining singular vectors for convolutional layers.\" It is not clear to me how it is proven for $k = 1$.\n  - Why circular padding?\n  - It is not clear to me how this theorem links with eq. (4).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "sZMiDLPfr7", "reviewer": "Reviewer_Au68", "summary": "The paper analyzes the relationship between model Lipschitzness and the transferability of adversarial examples. Under the setting of TRS model ensemble, decreasing the model's Lipschitz constant improves standalone robustness but also increases transferability, which hurts ensemble robustness. To this end, the authors propose \"LOTOS\", which promotes the orthogonality of the singular vectors corresponding to the largest singular values of the transformation matrices of the layers of the ensemble candidate models. LOTOS can decrease transferability while only having a slight effect on individual robustness, thereby improving the ensemble robustness. Furthermore, LOTOS can work with heterogeneous model architectures in conjunction with adversarial training.", "questions": "- The experiments in the paper focuses on ResNet and DLA. Do you think the method will extend to other popular architectures such as vision transformer, which operates differently and can be shallower?\n- Line 215 (using the difference in the population loss of the two models on these adversarial examples as a proxy) -- How good is this approximation? If we use some alternative loss functions other than cross-entropy, is there any chance for this approximation become exact?\n- In Equation (3), how would we determine $w_i$? Why do we need this weight, because intuitively we could perhaps just use the singular values here?\n- Line 260 ($\\\\| \\sum_{i=1}^d \\sigma_i u_i v_i^\\top v_i' \\\\|_2 = 0$). Here we only try to make the singular vectors orthogonal for each $i$, but the singular vectors for different $i$'s are not accounted. Would it possible to have the case where, for example, the first singular vector of $f^{(j)}$ is orthogonal to the first singular vector of $g^{(j)}$, but highly similar to the second singular vector of $g^{(j)}$? In this case, is the transferability between $f$ and $g$ still low?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "The paper analyzes an interesting problem, and uses the conclusions to propose a method that seems to work.", "weaknesses": "First of all, I would like to disclose that I am not an expert on black-box attacks or diversity-promoting robust ensembles. I am more familiar with the literature about the white-box scenario.\n\n- The proposed method seems promising in the black-box setting, but how about the white-box case? I think this question is important because it will disentangle robustness from attack difficulty.\n- What would happen if the \"source model\" in the black-box transfer attack is a LOTOS model itself (trained separately from the target model)?\n- All definitions in this paper seem to build on the $\\ell_2$ norm. Is the analyses and the proposed method only applicable to $\\ell_2$ attacks? How about other attack budgets?\n- Just to clarify, are all models in the ensemble trained simultaneously, or can they be trained sequentially? Asking for clarification here because the proposed loss function for each model depends on the weights of all other models.\n- Line 285 says \"for the orthogonalization to be effective in Equation (4), it is necessary to increase the value of $k$ (dimension of orthogonal sub-spaces)\". Then, Line 294 says \"$k = 1$ can be effective in orthogonalization with respect to the remaining singular vectors for convolutional layers.\" Are these not contradictory?\n- In Theorem 4, the right-hand-side of Equation 5 has two terms under the square root. Which one is dominant? $\\epsilon^2$ or the other terms?\n- Line 333: typo \"ensebmels\".", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "qy5FZrmvuB", "reviewer": "Reviewer_HKeX", "summary": "The paper studies how Lipschitz continuity affects the transferability of adversarial examples in model ensembles. It finds that while lower Lipschitz constants improve individual model robustness, they increase transferability in ensembles. To address this, the authors propose LOTOS, a training method that promotes subspace orthogonality between models, enhancing ensemble robustness. Experiments show that LOTOS improves the robust accuracy of ResNet-18 ensembles and boosts the performance of existing robust ensemble methods.", "questions": "- What is the definition of $\\Re$ in the appendix (page 14)?\n- Typos: line 333: \"ensebmels\"\n- Do you think the method in this paper requires significant work on hyperparameter tuning?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "- It's interesting to observe the trade-off between the robustness of individual models and the transferability of adversarial examples when changing Lipschitz constant. It highlights the importance of addressing the trade-off, an issue that has been overlooked in prior research.\n- The proposed LOTOS method is presented as a solution that uniquely focuses on orthogonalizing affine layers, setting it apart from existing methods that target different aspects of model diversity. To my best knowledge, such contribution is also novel.\n- The empirical results are shown clearly and shed light on so much understanding of the proposed solution.", "weaknesses": "- **The soundness of the claim in this paper**: The authors suggest that \"although a lower Lipschitz constant increases the robustness of a single model, it is not as beneficial in training robust ensembles as it increases the transferability rate of adversarial examples across models in the ensemble.\" While I believe that the first part is sound, I want to challenge the statement \"a lower Lipschitz constant is not as beneficial in training robust ensembles as it increases the transferability rate of adversarial examples across models in the ensemble\". There are too many aspects that may influence the result, for instance, the generalization of the models (because a lower Lipschitz constant may make the models more difficult to train). In other words, on a broad view, it's not just a trade-off between two aspects mentioned in this paper. I encourage the authors to incorporate deeper understanding of this issue (see below).\n- **Missing related work and discussion**: As far as I know, there may be some papers that is relevant to yours. For example, some theoretical works [1,2,3] discuss the smoothness & Lipschitz constant in transferability of adversarial examples (see the bounds therein), which may be somehow relevant to Lipschitz continuity emphasized in this paper. Some of them may not discuss the model ensemble issue. However, these insights on individual models is theoretically connected with the analysis in this paper. Furthermore, the vulnerability-diversity decomposition [4] also sheds light on the relationship among transferability, single model robustness and diversity, which may be in line with your claim \"We observe that while decreasing the Lipschitz constant makes each model of the ensemble individually more robust, it makes them less diverse and consequently increases the transferability rate among them which in turn hinders the overall ensemble robustness\". In addition, the model ensemble literature [5] also suggests the trade-off between diversity and individual model performance. Therefore, maybe you could give a brief discussion of them to help us better understand your theoretical insights. You are also encouraged to choose to discuss other work that I haven't mentioned but is relevant to your paper.\n- **Experiments**: Based on the above, I encourage the authors to incoporate more experiments. Since the model generalization / optimization process may also change the trade-off mentioned in this paper, you may add more experiments regarding more algorithms to show the soundness and consistency of your claim. However, in the current version, the experimental parts only consider their own method as well as TRS [1].\n\nIf the author's answers address my concerns, I will consider raising the score.\n\n[1] Yang Z, Li L, Xu X, et al. Trs: Transferability reduced ensemble via promoting gradient diversity and model smoothness[J]. Advances in Neural Information Processing Systems, 2021, 34: 17642-17655.\n\n[2] Zhang Y, Hu S, Zhang L Y, et al. Why does little robustness help? a further step towards understanding adversarial transferability[C]//2024 IEEE Symposium on Security and Privacy (SP). IEEE, 2024: 3365-3384.\n\n[3] Wang Y, Farnia F. On the role of generalization in transferability of adversarial examples[C]//Uncertainty in Artificial Intelligence. PMLR, 2023: 2259-2270.\n\n[4] Yao W, Zhang Z, Tang H, et al. Understanding Model Ensemble in Transferable Adversarial Attack[J]. arXiv preprint arXiv:2410.06851, 2024.\n\n[5] Abe T, Buchanan E K, Pleiss G, et al. Pathologies of predictive diversity in deep ensembles[J]. arXiv preprint arXiv:2302.00704, 2023.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)