Enhancing Robust Fairness via Confusional Spectral Regularization
Authors: Gaojie Jin
Sihao Wu
Jiaxu Liu
Tianjin Huang
Ronghui Mu
Venue: ICLR 2025 Poster (2025)
Keywords: Adversarial robustness
Worst-class robust accuracy
Robust fairness
PAC-Bayes
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Recent research has highlighted a critical issue known as ``robust fairness", where robust accuracy varies significantly across different classes, undermining the reliability of deep neural networks (DNNs). 
A common approach to address this has been to dynamically reweight classes during training, giving more weight to those with lower empirical robust performance. 
However, we find there is a divergence of class-wise robust performance between training set and testing set, which limits the effectiveness of these explicit reweighting methods, indicating the need for a principled alternative.
In this work, we derive a robust generalization bound for the worst-class robust error within the PAC-Bayesian framework, accounting for unknown data distributions. 
Our analysis shows that the worst-class robust error is influenced by two main factors: the spectral norm of the empirical robust confusion matrix and the information embedded in the model and training set. 
While the latter has been extensively studied, we propose a novel regularization technique targeting the spectral norm of the robust confusion matrix to improve worst-class robust accuracy and enhance robust fairness.
We validate our approach through comprehensive experiments on various datasets and models, demonstrating its effectiveness in enhancing robust fairness.

Published as a conference paper at ICLR 2025
ENHANCING ROBUST FAIRNESS VIA CONFUSIONAL SPECTRAL REGULARIZATION
Gaojie ! Sihao W Jiaxu Liu', Tianjin Huang", and Ronghui Mu?
1 'The Key Laboratory of System Software (Chinese Academy of Sciences) and State Key Laboratory of Computer Science, Institute of Software, Chinese Academy of Sciences, Beijing, China
DDeparmeett of Computer Science, University of Exeter, Exeter, UK Department Computer Science, University Liverpool, Liverpool, UK Corresponding to: gaojic. jinjic.jin.kimee @immkmmmll.ccomm gmail.com
ABSTRACT
Recent research has highlighted critical issue known as "robust faimesss" where robust accuracy varies significantly across different classes, undermining the reli- ability of deep neural networks (DNNs). A common approach to address this has been to dynamically reweight classes during training, giving more weight to those with lower empirical robust performance. However, find there is divergence class-wise robust performance between training set and testing set, which limits the effecctivnness of these explicit reweighting methods, indicating the need for principled alternative. In this work, we derive a robust generalization bound for the worst-class robust error within the PAC- Bayessay framework, accounting for unknown data distributions. Our analysis shows that the worst-class robust error is influenced by two main factors: the spectral norm of the empirical robust confu- sion matrix and the information embedded in the model and training set. While the latter has been extensively studied, we propose novel regularization technique targeting the spectral norm of the robust confusion matrix to improve worst-class robust accuracy and enhance robust fairness. We validate our approach through comprehensive experiments on various datasets and models, demonstrating its ef- fectiveness in enhancing robust fairness.
INTRODUCTION
Deep neural networks, spanning a diverse array of domains and applications, have shown impressive abilities to learn from training data and generalize effectively new, unseen data. However, recent studies have uncovered a notable weakness in these DNNs their vulnerability to subtle, often undetectable "adversarial attacks" (Biggio al., 2013; Szegedy et al., 2013). It has been discovered that even slight perturbations to the input, typically imperceptible to humans, can drastically mislead the networks, resulting significant prediction errors (Goodfellow et al., 2015; Wu al., 2020a). Adversarial training is widely acknowledged as a potent defense against adversarial attacks (Athalye al., 2018). Building on this, numerous studies have further developed and refined this approach to bolster robustness, contributing significant advancements in the field (Wu et al., 2020b; Lee et al., 2020: Cui et al., 2021; Jin et al., 2022a; Zhang et al., 2019; 2023).
In traditional machine learning, the definition of faimess (Agarwal et al., 2018; Hashimoto et al., 2018) may differ from the concept of robust fairness that we aim address in this work, which focuses on mitigating faimess issues in the context of adversarial attacks (i.e., improving worst-class robust accuracy). The complex interplay between robustness and fairness, as highlighted by Xu al. (2021), shows that the robust accuracy of model can significantly differ across various categories or classes. For example, a traffic detection system that achieves impressive overall robust accuracy in detecting road objects. Despite its general success, the system could exhibit high robustness for certain categories like inanimate objects, yet be less robust when identifying critical categories, such "humans". Such unevenness in robustness, where some categories less protected, poses risk

---

Published as a conference paper at ICLR 2025
Generalization Bound Confusion Matrix Gibbs Classiflers (Thm. 2.1)
Generalization Bound
Robust Generalization
Robust Genorallzation Bound for Worst-dass Robust Error (Prop. 3.1)
over Deterministic
Bound of Confusion
First
Classtfiers
Second Step (1)
Matrix
Second Stop (II
Step
(Lems. 3.2 and 3.3)
[Lem. 3.4)
Illustration of the theoretical framework: worst-class robust generalization bound. Under this framework, a standard generalization bound over confusion matrix is extended to a robust gen- eralization bound for the worst-class robust error.
Figure I:
to both drivers and pedestrians. Therefore, is crucial to establish uniformly high and fair model performance against adversarial attacks.
Several works have proposed enhancing model robust faimess through explicit reweighting strate- gies during adversarial training, where classes are reweighted based on their robust performance over the training set (Xu et al., 2021; Li & Liu, 2023; Zhang et al., 2024). However, our analysis reveals that the robust class- wise performance over training does not consistently align with that of testing set. As shown in Fig. 2 (left), the class exhibiting the worst robust performance on the training set may not be the same the one the testing set. Furthermore, Fig. (right) demon- strates that these explicit reweighting approaches, e.g., FRI. (Xu et al., 2021) and FAAL (Zhang al., 2024), actually exacerbate the training-test divergence, consequently limiting their ability to optimize worst-class robust accuracy. This misalignment between training and test robust perfor- mance across classes, combined with the absence of rigorous theoretical foundations, motivates our development of principled alternative to improve worst-class robust performance. As shown in Fig. 2 (right), our developed method maintains significantly lower training-ted divergence (higher training-test correlation) compared to explicit reweighting approaches. Note that our method is not primarily designed to address the training-test divergence, which may be inherent to the dataset, but rather to avoid explicit reweighting that can exacerbate this divergence and limit effectiveness.
In this work, we derive a robust generalization bound for the worst-class robust error within the PAC-Bayesian framework.
The PAC- Bayesian approach, introduced by McAllester (1999), is designed to provide probably approx- imately correct (PAC) guarantees to "Bayesian- like" learning algorithms (e.g., Gibbs classi- fier defined on a posterior distribution). As il- lustrated in Fig. I, our first step is to transfer the bound Morvant et al. (2012) for a Gibbs classifier to bound the spectral norm of the con- fusion matrix for a deterministic classifier. We analytically extend this bound by incorporat- ing the structural information of a determinis- tic model. This process is similar to that of Neyshabur et al. (2017b), but with a key dif- ference: we establish chain derivation over confusion matrices to construct the bound, Sec- ondly, leveraging the local perturbation bound approach from Xiao et al. (2023), we adapt the generalization bound over confusion matrices to the robust setting, accounting for adversarial perturbations. Through the relation of & matrix norm and spectral norm, we finally provide PAC- -ay-Bayn bound for the worst-class robust error.
Figure 2: Left: Class-wise AA (Auto Attack) ac- curacy of the adversarially trained WedeResNet- 28- 10 model on CIFAR-10. The star points are the worst-class AA accuracy on training set and test- ing set. Right: The covariance (blue) and Kendall rank correlation (orange) of class-wiss AA curacy between training set and testing set for normal adversarially trained WRN-28-10 model, reweighting methods (FRL. and FAAL) fine-tuned models, and our method fine-tuned model.
This bound unveils that the worst-class robust error constrained by two key components: the spectral norm of the empirical robust confusion matrix and the information encapsulated within the model's s architecture and training set. While the latter component has been extensively studied and leveraged to improve generalization or robust generalization (Yoshida & Miyato, 2017; Farnia et al., 2019), we propose a complementary approach to tackle this challenge. That is, we introduce regularization technique that directly targets the spectral norm of the empirical robust confusion matrix, with the aim of improving worst-class robust accuracy and further enhancing robust fairness across different classes. To validate the effécttveness of our proposed method to improve worst-class performance, we conduct extensive experiments on various datasets. Our empirical evaluations demonstrate the superior performance of approach in improving worst-class robust accuracy,
2

---

Published as a conference paper at ICLR 2025
ensuring more equitable and reliable model predictions under adversarial conditions, for the most vulnerable classes. To summarize, the contributions of this work are as follows:
By extending the principled concepts of PAC- PAC-Bayesian generalization analysis to the do- main of robust fairness, we develop robust generalization framework that enables to bound the worst-class robust error, as detailed in Sec. 3. To the best of our knowledge, this work represents the first endeavor to develop the worst-class robust error across different classes.
PAC-Bayesian framework characterize
As by-product, leveraging the insights gleaned from our theoretical results, we propose an effective and principled method enhance robust fairness by introducing spectral regularization term the confusion matrix. Empirically, extensive experiments on CIFAR- 10/100 00 and Tiny-ImageNet datasets have been conducted to demonstrate the effectiveness of our method. (Sec.
PRELIMINARIES
Basic setting. Consider an input set Xy defined as 23 fx Rd Eا=1² B²} and label set D' {l..... .dy. dy}. Let S {(x1, yy...... (Xm, Bmm) } represent training dataset comprising m samples independently and identically drawn from an underlying, fixed but unknown distribution D on X' x y. We define fw X' - y' as the learning function parameterized by weights w, where w are real-valued weights for functions mapping XB to V. We call the set of classifiers (or the set of classifier weights), i.c., H. as the hypotheses. Let f: x XB y E. be the loss function used in the training.
The function fw structured as an n-layer neural network, each layer equipped with h hidden units and utilizing the ReLU activation function Φ(-). The weight matrices for the entire model and I-th layer are denoted by W and W, (capital letters), respectively, with and w, representing their vectorized forms (lowercase letters, i.e., w vec(W)) The operation of the function through (W "W--.... (
where f (x) = Wix and subsequent layers are defined recursively as fw (x) = Wid( (((()((11((x)) (x)). For simplicity, bias are integrated into the weight matrices. We denote [W]l2 as the spectral norm of W, represents the largest singular value. Additionally, [| is the Frobenius norm of the weight matrix and ||w/|p is the lp norm of the weight vector, respectively.
the layers is formulated as (x) ow
We define the empirical and the true confusion matrices of fw by respectively C = (ci))ssisdd such that
and c.-²
i= j else, (1)
&ly
Eqm m 1 my
2 max fwr (i') 11 =) egit"
i = else,
V(i,)),
P (xx))=((f((x(()
max (x)(F j)
igfs"
where my is the number of samples with label in the training set S. In previous works such as Neyshabur et al. (2017b); Farnia et (2019), the PAC-Bayesian generalization analysis for a DNN is conducted on the margin loss. Following the margin setting, we consider any positive margin y in this work and define the empirical margin confusion matrix C/w, (c7)) )ssusd, as, V(i,)).
i=
Ei 1 (x, 7 + (x (x,, = j) (arg max fw (x') clse,
{4v,
where 1/a < b] = if b, else [aa < = 0.
Remark Following Neyshabur et al. (2017b), ? is an auxiliary variable that aids in the develop- ment of the theory, setting 0 corresponds to the normal empirical confusion matrix in (1). Note that q only exists in the confusion matrix over training data S, ensuring that the classifier operates independently of the label over unseen data D.
3

---

Published as a conference paper at ICLR 2025
PAC-Bayes. PAC-Bayes (McAllester, 1999; 2003) offers a tight upper bound on the generalization ability of a stochastic classifier called the Gibbs classifier (Laviolette Marchand, 2005), which is defined posterior distribution Q over H. This framework also provides generalization guar- antee for the Q-weighted majority vote classifier, which is associated with this Gibbs classifier and assigns labels input instances based on the most probable output from the Gibbs classifier (La- casse et al., 2006; Germain et al., 2015; Jin et al., 2020; 2022b). The bound is primarily determined by the Kullback-Leibler divergence (KL) between the posterior distribution Q and the prior distribu- tion P of weights (classifiers), Within this setting, we define the Gibbs classifiers over the posterior Q of the type fw+u (Neyshabur et al., 2017b), where is a random variable potentially influenced by the training data and w is the deterministic weights. In this case, we can define the true and the empirical (margin) confusion matrices of Gibbs classifier sw+u respectively by
cH = EnCCott; C3 = EnCsutu C = EuCs. C.CCi
Morvant et al. (2012) proposes PAC-Bayesian bound for the generalization risk of the Gibbs clas- sifier using the confusion matrix of multi-class labels, a framework we also adopt in this work.
Theorem 2.1 (Morvant et al. (2012)) Consider training dataset S with m samples drawn from "......dyy.
distribution D on XB x y with y = (1..... dg Given a learning algorithm (e.g., a classifier) with prior and posterior distributions P and Q (i.e., w u) on the weights respectively, for any 8 O, 5 over the draw of training data, we have that
with probability
Mmmin Sdy [DKL(Q]IP) + In (mmmin) )}
8dy
1C -C- - c/
V
where mmin represents the minimal number of examples from S which belong to the same class.
Adversarial setting. Given the classifier fw and the input data with label y, we consider the corresponding adversarial example as
x' arg max (Xfw(x'),
(4)
Ix-x''II
where e is the ép norm adversarial radius. Under this adversarial setting, we let the corresponding adversarial training set and data distribution for fw be S' and D', and adversarial confusion matrices
for fw be Cfr, C5 C.S,,,. We provide more related work about adversarial training and fairness- aware adversarial learning in App. A.
Problem definition. For a classifier fw. the worst-class robust error is defined as
max j (x' "")=
P
(max fw (x'[ii 2 fw (x) y j).
iØj
Look at the definition in (1), one could find the sum of j-th column of Ci represents the expected error for class j, which can be expressed as:
E(err (x' ('' ifj
P (max fw (x [1] 2 fw (x 1bl j).
Since the & matrix norm represents the maximum column sum of absolute elements, it naturally corresponds to the worst-class error, allowing us to express it as |[C// i.e..
Iicf || max
Σ ((chrr Dag-
In this work, we will theoretically explore how to bound |ICF || in Sec. 3, and empirically study how to enhance |cfx || in Sec. 4.
WORST-CLASS ROBUST ERROR AND CONFUSIONAL SPECTRAL NORM
In this section, derive robust generalization bound for the worst-class robust error of feed- forward neural networks with ReLU activations, leveraging the PAC-Bayesian framework. The transition from Thm. 2.1 to theoretical results involves two key steps.
4

---

Published as a conference paper at ICLR 2025
The first step is to analytically extend the PAC-Bayesian generalization bound of confusion matrices for a Gibbs classifier to a deterministic classifier. In previous works, such as Langford Caruana (2002); Neyshabur et al. (2017a); Dziugaite & Roy (2017), leveraging PAC-Bayesian bounds to analyze the generalization behavior of neural networks focuses on evaluating the KL divergence, the perturbation error f(fw+u(x), v) (x), y), the numerical value of the bound. Notably, through restricting (x) - fw (x), Neyshabur et al. (2017b); Farnia et al. (2019) utilize the PAC-Bayesian framework to derive margin-basee bounds that are constructed by weight norms. Following these works, we adopt the margin operator with the restriction of network output. Through the eigendecomposition of the confusion matrix and the adoption of Perron- Frobeniu theorem, we establish the bound between ||C] ll2 and |C
Secondly, we adapt the generalization bound from the clean setting an adversarial context. The key idea is that the local perturbation bound in an adversarial environment can be estimated by the local perturbation bound of the clean setting, aligning with the approach in Xiao et al. (2023). The robust generalization bound retains the tightness of the standard version while incorporating an additional term e that represents the perturbation radius. By leveraging the connection of & matrix norm and spectral norm, shift the bound from the overall robust accuracy to the worst-class robust accuracy. These critical steps yield the bound in Prop. 3.1. The proof is given in Sec. 3.1.
Remark 2 (Difference with previous work) Building upon the key ideas introduced by Morvant al. (2012); Neyshabur el al. (2017b); Xiao al. (2023), we employ chain derivation over con- fusion matrices to adapt previous PAC- ACC-Bayeiian results to our robust generalization bound. To the best of our knowledge. this work establishes the first PAC-Bayesian robust generalization bound to characterize the worst-class performance. By extending the PAC-Bo AaC-Bayesian framework to account for worst-class adversarial robustness, our approach provides valuable insights into the fundamen- tal factors governing worst-class adversarial accuracy, paving the way for more effective strategies to enhance the robust fairness performance.
Proposition 3.1 Consider a training set S with m samples drawn from a distribution 'D over XB X n, h, e 0, let the base classifier fw Xn y be an n-layer feedforward network with h units each layer and ReLU activation function. Consider S' and D'' as the adversarial training and adversarial data distribution for Iw respectively, within the Eg norm radius e. Then, for any 5, y > O, with probability at least 1 - 8, we have
Y. For any B,n,
(v
ddd
IC
" ,
1 ('(ww) +
(5)
(mmin 8dy)'²
Worst-class error
Empirical spectral norm
Model and training set dependence
where dy is the number of classes, Mmii represents the minimal number of examples from S which
belong to the same class, ('(w) = (B + e)+ e)>nnhim(nh) I[ 2| E positive constant which depends on da.
[Wil and v is
Will
Proof. See Sec. 3.1.
Remark The above proposition establishes a robust generalization bound for the worst-class adversarial performance of the model, comprising two key components. The first component is the spectral norm of the empirical confusion matrix over adversarial data, while the second component model-dependent and training data-dependent term. The latter has been extensively studied in the previous research, with various techniques proposed to improve generalization and robust generalization, such as weight spectral norm normalization (Yoshida & Miyato, 2017; Farnia al., 2019). In this work, from another point of the bound, we focus our attention on the spectral norm of the confusion matrix, investigating its potential enhance the worst-class adversarial performance.
3.1 SKETCH OF PROOF
Building upon the PAC- MAC-Bayesian framework established in Thm. 2.1, which bounds the gap between expected confusion matrix and empirical confusion matrix for Gibbs classifiers, our initial step is to formulate generalization bound tailored to deterministic classifiers. By leveraging the sharpness
5

---

Published as a conference paper at ICLR 2025
limit discussed in Neyshabur et al. (2017b) and employing chain derivation of spectral norms, we have analytically derived a margin-batt based generalization bound for deterministic classifiers, as detailed in the following.
Lemma 3.2 Given Thm. 2.1, let Sw : NB + be any classifier with weights w. Let P be any prior distribution on the weights that independent of the training data, Q (i.e., + u) be the posterior distribution on weights. Then, for any 0,7 >> O, and any (posterior) random perturbation u s.t. fw Sw(x))os
Fu (maxx (fw+u(x))
2 ) 2 with probability least 6, we have
dy
33mmm
||c/ 12 S S.7 122 4 mmmin 8d,
DKL(W ( +ul In 46
(6)
Proof. See App.
Although the above lemma establishes a connection between the expected and empirical confusion matrices of deterministic classifier fw. the bound depends on the KL divergence between the posterior and prior distributions. Neyshabur et al. 7b); Farnia et al. (2019) employ the PAC- Bayesian framework sharpness limit, i.e., restricting the quantity (x) Sw (x). Following their research, we will also replace the KL divergence term in the bound with an expression involving the weight norms.
derive margin-based bound that depends on the weight norms through
The primary challenge lies in computing the KL divergence within the sharpness limit (or random perturbation limit), as shown in Lem. 3.2. To tackle this, we employ a two-pronged approach from Neyshabur al. (2017b). Firstly, leverage pred-determined grid method to judiciously select the prior distribution P of weights (classifiers). Secondly, let u (N(0, (Neyshabur et al., 2017b), by carefully accounting for both the sharpness limit and the Lipschitz property of the model, we derive an upper bound on the randomness of posterior distribution by the weight matrices. This strategic formulation allows us effectively bound the KL divergence between and P. crucial step in obtaining the following generalization bound.
Lemma 3.3 Given Lem, 3.2, for any B, n, O, let the base classifier fw XB + y be an n-layer feedforward network with units each layer and ReLU activation function. Then, for any 8, >> 0, with probability at least we have
(1
11cf/ 112 S 1C15,112
(mmin 8dy)7² (ffw)) 5
dy
mmmmmn
where & (fw) (n II /WIEE
Proof. See App. C.
The above lemma derives a generalization guarantee by restricting the variation in the output of the network, effectively bounding the sharpness of the model through weight matrices. Building upon this foundation, we leverage a key insight from Xiao et al. (2023), specifically, that the local perturbation bounds of scalar value functions hold for both clean and adversarial settings. Capital- izing on this idea, we proceed to bound the spectral norm of the confusion matrix under adversarial perturbations to the input data. By synergistically combining the sharpness based analysis with the adversarial perturbation framework, in the following, we establish a connection between model weights and adversarial confusion matrices. Consider the adversarial example x' defined in (4) for a speccific classifier fw. and the corresponding adversarial training set S' and adversarial data distribution D' for Sw. we have the following lemma.
let the base classifier fw XB y be n- n-layer feedforward network with h units each layer and ReLU activation function. Consider S and D' as the adversarial training set and adversarial data distribution for fw respectively, within the lg norm radius c. Then, for any 5, > O, with probability at least 1 - 5, we have
Lemma 3.4 Given Lem. 3.3, for any B, h,
I|C- 112 $ ||C5y +0 (1
dy
('
7.77mm
(8)
(Mmin 8d,
5
where (f(w) = (B (B+ lm [[ |W Σ
w
Tw

---

Published as a conference paper at ICLR 2025
Proof. See App. D.
The above lemma establishes a connection between the spectral norm of the expected confusion matrix, ||C/2 l|2, and the spectral norm of the empirical margin confusion matrix, ||cÍ"" ll2, in the adversarial setting. This connection is bridged through the information encapsulated the training data and the model weights. Our objective, however, extends beyond this result we aim to derive an upper bound on the worst-class adversarial performance of the model, as characterized by the & norm of the expected confusion matrix under adversarial perturbations, i.e., ||C_5 IlI.
By leveraging the well-established relationship between the & norm and spectral norm of matrices, we can translate the spectral norm bound obtained in the lemma into a bound on the l norm, which directly governs the worst-class adversarial error of the model. Specifically, for a general confusion matrix E IR xd,, we have the following inequality: I|C/// |l I vilCC= l12. where is a constant that depends on the number of classes dy and is upper bounded by /dy. To validate the tightness of this bound, conducted extensive numerical study involving 1,000,000 experiments on randomly generated confusion matrices for dy = 10, where the maximum of v is 1.16 and the average value is 1.06. It demonstrates that the value of can be sufficiently small (i.e., close to 1), enabling the term / v/Icc/y 2l to provide tight upper bound on the & norm |Cf/ 1l1. This numerical analysis reinforces the practical utility of our theoretical result, ensuring that the derived bound on the worst-class adversarial error informative under PAC-Bayesian framework. Synthesizing these theoretical results and leveraging the established relationships between matrix norms, we derive our main result (Prop. 3.1) that provides a robust generalization bound for the worst-class adversarial performance of DNNs.
4 EMPIRICAL RESULTS
4.1 SPECTRAL REGULARIZATION OF CONFUSION MATRIX
Prop. 3.1 provides theoretical perspective that identifies the spectral norm of the empirical confu- sion matrix key factor bounding the worst-class robust generalization performance. Motivated by this insight, we explore strategies to regularize this spectral term to enhance robust fairness across different classes. However, directly optimizing ||C&",, ll2 by computing the gradient with re- spect to the model weights presents significant challenges. As shown (9), this difficulty arises from the discrete nature of the elements in C/ which are binary {0, }} error indicators. Here (Cg),) represents the element at i-th row, j-th column. The dinediffereet nature of these dis- crete elements precludes the straightforward application of gradient- gradient-based optimization techniques. Consequently, we are limited to employing computationally expensive methods to estimate discrete gradients, which can significantly hinder the efficiency of the regularizer. Note that in (9), for no- tional convenience, we use the notations including Ô to represent the (discrete) gradient in practical algorithm, even though C may not be theoretically differentiable.
a alccy 1 112
allc 11a a(chy pi
alC
alIc 1 aichy DlCss.)es )os a( ))s Ow
a(C5",)
(9)
Ow
Ow
Expensive
Expensive
Cheap
Cheap
Cheap
Approvimate
To address the problem, as shown in the right-hand of (9), we introduce an alternative confusion matrix C5" with differentiable elements. This matrix D is structurally similar to Cty .- main- taining zero diagonal elements. However, we replace the binary {0, 1} errors in the off- positions (i.j) with the average KL divergence, i.c., Vi j.
1 Σ (RI((W((x)) 7(1 y))ly)) mj (x' (X,,))S))
(C
(10)
where is the one-hot vector of y. S (x) E S' [x()') S 7 + Jw (x')(i), = j. arg max, fw (x') [i') = i}. and m, is the number of samples with label j in the training set.
In the high side of (9), we observe that the general direction of ((ckr,)1//((C5) be readily approximated, as the descent direction of non-diagonal elements in C closely aligns
can

---

Published as a conference paper at ICLR 2025
Table 1: Evaluation of different fine-tuning methods CIFAR-10 with WRN-34-10. We report the
average accuracy and the worst-class accuracy under standard &o norm Auto Attack, with baseline models of TRADES and TRADES-AWP.
Fine-Tuning
Fine-Tuning
TRADES
TRADES-AWP
Method
Epochs
(%)
Worst (%)
(%)
Worst (%)
TRADES/AWP
52.51
23,20
56.18
25.80
+ ORL-RWRMo.05
49.97
35,40
46.50
27.70
FRL-RWRMo.07
51.30
34.60
46.53
28.60
+ FAALAr
50.91
35.30
49.87
30.60)
+ FAALAWP
2
52.45
35.40
53.93
37.00
+ Oursy=0.0
2
53.46
36.30
54.65
37.00
+ Oursy=a.1
2
53.38
35.60
54.49
37.60
Table 2: Evaluation our fine-tuning method on different pre-trained models with DDPM generated data, over CIFAR-I0 dataset and Tiny-ImageNet dataset. Our fine-tuning method is adopted on the DDPM generated training set (IM/50M) within 2 epochs.
PreTrained Model
Clean
AA
Dataset
Architocture
Fine- Tuning Method
Average (%)
Worst (%)
Average (%)
Worst (%)
Pang al. (2022)
88.61
75.40
61.04
33.80
WRN-28-10 (IM)
Oursy=00
88.56
77.30
61.06
36.30
CIFAR-10 80o
Oursy=0.1
88.24
78.50
60.53
37.80
Pang et al. (2022)
89.01
75.40
63.34
35.10
WRN-70-16 (IM)
Oursy=0.0
89.23
79.10
62.98
38.60
Ours,-o.1
88.67
80.20
62.74
39,30
Wang el al. (2023)
95.16
88.90
83.63
64.50
WRN-28-10 (50M)
Ours
95.02
89.30
83.60
66.90
CIFAR-10 f2
Ours,-003 0.1
94.87
90.70
83.21
67.80
Wang ct al. (2023)
95.54
89.30
84.86
67.00
WRN-70-16 (50M)
Oursy=no0
95.39
89.90
85.06
68.80
Ours,=0.1
94.98
91.30
84.20
69.70
Wang et al. (2023)
65.19
26.00
31.30
0.00
Imag-lmageNet
WRN-28-10 (50M)
Oursy=0.0
65.12
30.00
31.34
2.00
Oursy-o.1
32.00
with that of - That is, sign aic )4y
1, where sign(-) denotes the sign function. This
approximation strategy is well-established in machine learning; for instance, in classification tasks, while we cannot directly optimize classification error (accuracy). we optimize cross-entropy loss or KI. divergence to improve accuracy based on the assumption that their optimization directions approximately coincide.
Based on this insight, we design regularization term (fww S',7) as follows:
Ov (Sw: S',7)
aiccy .122 aicly
alcl S(,s)) a(ch gi 8w
Σ
x sign
x
(11)
Ow
O(
Incorporating this regularizer, we define the adversarial training objective function as:
J
((f((x')))) (f (x(
(12)
where S' is the adversarial training set for the classifier fw as defined in (4), a E (0,+00) is a hyper-parameter which balances the first adversarial training term and the second regularizer. This formulation allows us to effectively regularize the spectral norm of the confusion matrix, enabling gradient-bard baaddd optimization to enhance robust faimess. In the following experiments, normally set the default values of a as 0.3, y as 0.0 and 0.1. We provide sensitivity analysis for hyper- parameters in App. E.
8

---

Published as a conference paper at ICLR 2025
Table 3: Training from scratch with different methods CIFAR-10 10 and CIFAR-100 datasets using Preact-ResNet18 model with Loo norm attack.
AT'
CIFAR-I 10
CIFAR-100
Method
Clean (%)
Worst (%)
AA (8)
Worst (56)
Clean (%-
Worst (%)
AA (
Worst (%)
PGD-AT
82.72
55.80
47.38
12.90
54.63
19.00
22.78
1.00
TRADES
82.54
66.10
49.05
20.70
54.57
19.00
23.57
1.00
CFAxT
50.10
24.40
55.12
22.00
CFATRADRS
80,36
66.20
50.10
26.50
55.57
23,00
24.56
2.00
WATTRADES
80.37
66.000
46.16
30.70
53.99
19.00
22.89
3.00
FAALAT
82.20
62.90
49.10
33.70
56.84
16.00
21.85
3.00
FAALTRADES
81.62
68,90
48.48
33.60
55.87
21.00
23.57
3,00
Ours,=u0.
83.51
68.90
49.92
33.80
$7.37
24.00
25.17
82.86
69.70
49.73
34.90
56.91
24.00
24.88
4,00
4.2 EXPERIMENTS
In this section, discuss the fine-tuning per- formance and the adversarial training perfor- mance of our method using the average accu- racy and the worst-class accuracy under Au- toAttack (AA) and clean settings. AutoAt- tack (Croce & Hein, 2020b) is one of the most powerful attack methods, includes three white-box attacks (APGI-CE (Croce & Hein, 2020b), APGD-DLR (Croce & Hein, 2020b), and FAB (Croce & Hein, 2020a)) and one black-box attack (Square Attack (An- driushchenko al., 2020)). We conduct experi- ments on the CIFAR-10, CIFAR- 100, and Tiny- ImageNet datasets, which widely used for evaluating adversarial training methods. The perturbation budget is norm attacks and = 128/255 for Eg norm at- tacks.'
Convision Vatrices Uinder
Mishod
Figure 3: In both confusion matrices, the hori- zontal axis represents the true labels, while the vertical axis represents the predicted labels. The left figure shows the AA results of WRN-34- 10 model trained using the TRADES method on CIFAR- 10, whereas the right figure demonstrates the AA results of WRN-34-10 model trained us- ing our method with 7 = 0.1.
8/255 for foc
FRL (Xu et al., 2021) and FAAL (Zhang et al., 2024) are the existing
techniques from recent literature that perform tne-ttning on pre-trained model to improve robust faimesss. FRL proposes two strategies based on TRADES (Zhang et al., 2019) for enhancing robust fairness: reweight (RW) and remargin (RM). Follow- ing Zhang et al. (2024), in our experiments, we apply the best versions of FRI from their pa- per: FRL-RWRM with тI = 72 = 0.05 and FRL-RWRM with π = 72 0.07, where т and 72 the fairness constraint parameters for reweight and remargin, respectively. The results of FRL are reproduced using their public code, where the target models are fine-tuned for 80 epochs, and the best results presented. FAAL proposes ing (AT) and AWP (Wu et al., 2020b). We provide their best results which are fine- tenet on the TRADES pre-trained WideResNet.3A4 34-100 (WRN-34 34-10) (Zagoruyko & Komodakis, 2016) model and the TRADES-AWP pre-trained WRN-34-10 model in Tab. for CIFAR-10 with & attack. For method, we the value of as 0.3, 7 0.0/0.1, and the learning rate is 0.01. As shown in Tab. I, compared to FRL and FAAL, our method maintains higher average clean and robust accura- cies while achieving better worst-class clean and robust accuracies.
versions based vanilla adversarial train-
Denoising Diffusion Probabilistic Model (DDPM) (Ho et al., 2020) is an advanced deep learning model primarily used for generating high-quality, diverse samples such as images or audio. The model learns to generate data by reversing process that gradually adds noise to the data. Recently, Pang et al. (2022); Wang et al. (2023) have used DDPM-generated data to enhance adversarial train- ing and achieved stunning results CIFAR and Tiny-ImageNet datasets. Following their work, we fine-tune their models on CIFAR-10 under fo attack, which pre-trained using 1M extra data; on
httpp:://gi thw.. 1exkee CONF IONA SPECTRAI REGUI T

---

Published as a conference paper at ICLR 2025
Table 4: Evaluation of different fine-tuning methods CIFAR-10 with WRN-34-10. We report the average accuracy and the worst-class accuracy under standard Eo norm PGD-20/CW-20 attack, with baseline models of TRADES and TRADES-AWP.
Finc-Tuning
TRADES
TRADES-AWP
Method
PGD-20 (%)
Worst (%)
(W)20
Worst (%)
PGD-20
Worst (%)
CW-20 (%)
Worst (96
TRADES/AWP
55,32
27.10
$3.92
24.80
59.20
28.80
57.14
26.50
+ 07
53.76
39.20
52.92
36.80
48.63
30.90
49.77
31.50
+ IAALAT
53.46
39.80
52.72
38.20
52.54
35.00
51.70
34,40
FAAL,AP
56.07
43.30
54.16
38,601
57.14
43.40
55.34
40.10
Ours,=00
59.06
56.79
+ Oursy-o.L
57.66
44.10
55.97
38.90
58.87
44.50
56.44
41.80
Table 5: Training from scratch with different methods on CIFAR-10 using Preact-ResNet18 model with standard &2 norm attack.
Method
Clean (%)
Worst (56)
PGD-20 (%)
Worst (96)
CW-20 (%)
Woest (9)
AA (%)
Worst (%)
PGD-AT
88.83
74.90
68.83
43,50
43.20
67.99
42.60
FAALxT
87.61
76.30
66.57
46,80
66.31
46.80
65.45
44,20
FAALTRAEES
65.21
64.25
Ours,-o0
89.57
78,80
70.36
49.10
69.98
48.90
69.51
47.50
Ours,-o.1
78.70
69.32
CIFAR-10 under l2 attack, which is pre-trained using 50M extra data; and on Tiny-ImageNee under Lo attack, which is pre-trained using 50M extra data. Our fine-tuning setting is the same as in the previous experiment. As shown in Tab. 2, after fine-tuning within 2 epochs, our method signifi- cantly improves worst-class clean and robust accuracies while maintaining the average accuracy or only experiencing small decline in average accuracy.
We also investigate the advancements achieved by training the model from ground up using our method. We compare methods with two common adversarial training methods, PGD-AT and TRADES, and three recent state-of-the-an techniques: CFA (Wei et al., 2023), WAT (Li & Liu, 2023), and FAAL,, which have been recently proposed mitigate robust fairness issues. Note that our method builds upon the TRADES adversarial training framework here. We adversarially trained Preact-ResNet-I1 models (He et al., 2016) for 200 epochs using SGD with a momentum of 0.9, batch size of 128, weight decay of 5 x 10 and an initial learning rate of 0.1, which is reduced by factor of 10 at the 100th and 150th epochs. Following Zhang et (2024), we report the best results under Auto Attack for both average accuracy and worst-class accuracy in Tab. 3. Furthermore, as shown in Fig. 3, the confusion matrix generated by WRN-34-10 10 model trained with our method (right) exhibits more fair (uniform) distribution compared with the one generated by TRADES (left). Here we adopt the confusion matrix defined in (1), where the diagonal elements are O.
Additionally, we extend our evaluation to include fine-tuning experiments under both standard foo norm PGD-20 attack and CW-20 attack (Carlini & Wagner, 2017). As demonstrated in Tab. 4, our method maintains superior worst-class performance across these different attack types. Furthermore, we evaluate models trained from scratch under & norm attacks. The results Tab. show that for CIFAR-10 10 with Preact- Resttt18 architecture, method achieves the best performance in both average and worst-class robust accuracy under standard E attacks.
5 CONCLUSION
This work addresses an oversight in the robust fairness literature by arguing that the spectral norm of the confusion matrix over training data needs be systematically considered. Through theoretical study (updating the PAC-Bayesian framework), algorithmic development (efficient regularization of the confusional spectral norm), and extensive experiments, we demonstrate that the consideration of the spectral norm of the confusion matrix can improve the worst-class robust performance and robust fairness over not only the vanilla adversarial training framework but also the ffate-of-the-an adversarially trained models.
10

---

Published as a conference paper at ICLR 2025
REFERENCES
Alckh Agarwal, Alina Beygelzimer, Miroslav Dudik, John Langford, and Hanna Wallach. A reduc- tions approach fair classification. In International conference on machine learning, 2018.
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square at- tack: query-efficieet black-box adversarial attack via random search. In ECCV, 2020.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of security: Circumventing defenses to adversarial examples. In ICMI, 2018.
Afonso S Bandeira and March T Boedihardjo. The spectral norm of gaussian matrices with corre- lated entries. arXiv preprint arXiv: 1200022004.0266,, 2021.
Peter L Bartlett, Dylan J Foster, and Matus J Telgarsky. Spectrally-normalized margin bounds for neural networks. Advances neural information processing systems, 30, 2017.
Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Smdić, Pavel Laskov, Gior- gio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. ECML PKDD, 2013.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium security and privacy (sp), pp. 39-57. IEEE, 2017.
Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with fast adaptive boundary attack. In ICML, 2020a.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-fiee free attacks. In ICML, 2020b.
Jiequan Cui, Shu Liu, Liwei Wang, and Jiaya Jia. Learnable boundary guided adversarial training. In ICCV, 2021.
Jiequan Cui, Beier Zhu, Xin Wen, Xiaojuan Qi, Bei Yu, and Hanwang Zhang. Classes are not equal: An empirical study image recognition fairness. In CVPR, 2024.
Yin Cui, Menglin Jia, Tsung- Yi Lin, Yang Song. and Serge Belongie. Class-balanced loss based on effective number of samples. In CVPR, 2019.
Gintare Karolina Dziugaite and Daniel M Roy. Computing nonvacuous generalization bounds for deep (stochastic) neural networks with many more parameters than training data. arXiv preprint arXiv: /703. 1008, 2017.
Logan Engstrom, Andrew Ilyas, and Anish Athalye. Evaluating and understanding the robustness of adversarial logit pairing. arXiv preprint arXiv:1807.10272. 2018.
Farzan Farnia, Jesse M Zhang, and David Tse. Generalizable adversarial training via spectral nor- malization. In ICLR, 2019.
Georg Frobenius, Ferdinand Georg Frobenius, Ferdinand Georg Frobenius, Ferdinand Georg Frobe- nius, and Germany Mathematician. Über matrizen aus nicht negativen elementen. 1912.
Pascal Germain, Alexandre Lacasse, Francois Laviolette, Mario Marchand, and FrannFrancis Roy. Risk bounds for the majority vote: From pac-bayesian analysis learning algorithm. arXiv preprint arXiv:1503.083 2015.
Ian J. Goodfellow. Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015.
Tatsunori Hashimoto, Megha Srivastava, Hongseok Namkoong, and Percy Liang. Fairness without demographics in repeated loss minimization. In ICML, 2018.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In CVPR, 2016.
11

---

Published as a conference paper at ICLR 2025
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-688 6851, 2020.
Tianjin Huang, Yulong Pei, Vlado Menkovski, and Mykola Pechenizkiy, On generalization of graph autoencoders with adversarial training. In ECML PKDD, 2021.
Tianjin Huang, Shiwei Liu, Tianlong Chen, Meng Fang, Li Shen, Vlado Menkovski, Lu Yin, Yu- long Pei, and Mykola Pechenizkiy. Enhancing adversarial training via reweighting optimization trajectory. In ECML, 2023.
Yiding Jiang, Behnam Neyshabur, Hossein Mobahi, Dilip Krishnan, and Samy Bengio. Fantastic generalization measures and where to find them. International Conference Learning Repre- sentations, 2020.
Gaojie Jin, Xinping Yi. Liang Zhang, Lijun Zhang, Sven Schewe, and Xiaowei Huang. How does weight correlation affect the generalisation ability of deep neural networks. NeurIPS, 2020.
Gaojie Jin, Xinping Yi, Wei Huang, Sven Schewe, and Xiaowei Huang. Enhancing adversarial training with second-order statistics of weights. In CVPR, 2022a.
Gaojie Jin, Xinping Yi, Pengfei Yang, Lijun Zhang, Sven Schewe, and Xiaowei Huang. Weight expansion: A new perspective on dropout and generalization. arXiv preprint arXiv:2201.09209 2022b.
Harini Kannan, Alexey Kurakin, and Ian Goodfellow. Adversarial logit pairing. arXiv preprint arXiv:1803.06333, 2018.
Alexandre Lacasse, François Laviolette, Mario Marchand, Paseal Germain, and Nicolas Usunier. Pac-bayes bounds for the risk of the majority vote and the variance of the gibbs classifier. Ad- vances in Neural information processing systems, 19, 2006.
John Langford and Rich Caruana. (not) bounding the true emro. Advances in Neural Information Processing Systems, 2:809-8 1009-816.90 2002.
François Laviolette and Mario Marchand. Pac-bayes risk bounds for sample-compressed gibbs classifiers. In Proceedings of the 22nd international conference on Machine learning, 2005.
Saehyung Lee, Hyungyu Lee, and Sungroh Yoon. Adversarial vertex mixup: Toward better adver-
sarially robust generalization. In CVPR, 2020.
Boqi Li and Weiwei Liu. Wat: improve the worst-class robustness in adversarial training. In Pro- ceedings of the AAAI Conference on Artificial Intelligence, 2023.
Tao Lin, Lijia Yu, Gaojie Jin, Renjue Li, Peng Wu, and Lijun Zhang. Out-of-bounding-box triggers: A stealthy approach to cheat object detectors. In ECCV, 2024.
Evan Z Liu, Behzad Haghgoo, Annie S Chen, Aditi Raghunathan, Pang Wei Koh, Shiori Sagawa, Percy Liang, and Chelsea Finn. Just train twice: Improving group robustness without training group information. In International Conference on Machine Learning, pp. 6781-6792. PMLR, 2021.
Ziwei Liu, Zhongqi Miao, Xiaohang Zhan, Jiayun Wang, Boqing Gong, and Stella X Yu. Large- scale long-tailed recognition in open world. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pp. 2537-2546, 2019.
Xinsong Ma, Zekai Wang, and Weiwei Liu. On the tradcoff between robustness and fairness. Ad- vances in Neural Information Processing Systems, 35:26230-26241, 2022.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICIR, 2018.
David McAllester. Simplified pac-bayesian margin bounds. In Learning Theory and Kernel Ma- chines: 16th Annual Conference on Learning Theory and 7th Kernel Workshop, COLT/Kemnel 2003, Washington, DC, USA, August 24-27, 2003. Proceedings, pp. 203-215. Springer, 2003.
12

---

Published as a conference paper at ICLR 2025
David A McAllester. Pac-bayesian model averaging. In Proceedings of the twelfth annual confer- ence on Computational learning theory, pp. 164-170, 1999.
Adilya Krishna Menon, Sadeep Jayasumana, Ankit Singh Rawat, Himanshu Jain, Andreas Veit, and Sanjiv Kumar. Long-tail learning via logit adjustment. In ICLR, 2021.
Emilie Morvant, Sokol Koço, and Liva Ralaivola, Pac- bacesaa generalization bound on confusion matrix for multi-class classification. In JCML, 2012.
Junhyun Nam, Hyuntak Cha, Sungsoo Ahn, Jacho Lee, and Jinwoo Shin. Learning from failure: De-biasing classifier from biased classifier. Advances Neural Information Processing Systems, 33:20673-2066 20684, 2020.
Behnam Neyshabur, Srinadh Bhojanapalli, David McAllester, and Nathan Srebro. Exploring gener- alization in deep learning. arXiv preprint arXiv:1706..89477. 20177,
Behnam Neyshabur, Srinadh Bhojanapalli, and Nathan Srebro. A pac-bayesian approach to spectrally-normalized margin bounds for neural networks. arXiv preprint urXiv: 2017b.
Tianyu Pang, Min Lin, Xiao Yang, Jun Zhu, and Shuicheng Yan. Robustness and accuracy could be reconcilable by (proper) definition. In International Conference on Machine Learning, 2022.
Chunyu Sun, Chenye Xu, Chengyuan Yao, Siyuan Liang, Yichao Wu, Ding Liang, Xianglong Liu, and Aishan Liu. Improving robust fariness via balance adversarial training. In AAAI, 2023.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint 13Xiv: 2013.
Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan. Better diffusion models further improve adversarial training. In ICML, 2023.
Zeming Wei, Yifei Wang, Yiwen Guo, and Yisen Wang. Cfa: Class-wise calibrated fair adversarial training. In CVPR, 2023.
Dongxian Wu, Yisen Wang, Shu-Tao Xia, James Bailey, and Xingjun Ma. Skip connections matter: On the transferability of adversarial examples generated with resnets. arXiv preprint arXiv:2002.05990, 2020a.
Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust gener- alization. In NewrIPS, 2020b.
Jiancong Xiao, Ruoyu Sun, and Zhi-Quan Luo. Pac-bayesian ppectrally-normalizee bounds for adversarially robust generalization. Advances in Neural Information Processing Systems, 2023.
Han Xu, Xiaorui Liu, Yaxin Li, Anil Jain, and Jiliang Tang. To be robust or to be fair: Towards fairness in adversarial training. In ICMI., 2021.
Yuichi Yoshida and Takeru Miyato. Spectral norm regularization for improving the generalizability of deep learning. arXiv preprint arXiv:1705.10%. 2017.
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In BMVC, 2016.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML, 2019.
Liang Zhang, Nathaniel Xu, Pengfei Yang, Gaojie Jin, Cheng-Chao Huang, and Lijun Zhang. Traj- pac: Towards robustness verification of pedestrian trajectory prediction models. ICCV, 2023.
Linjun Zhang, Zhun Deng, Kenji Kawaguchi, Amirata Ghorbani, and James Zou. How does mixup help with robustness and generalization? arXiv preprint 2rX1v:2010.04819, 2020.
Yanghao Zhang, Tianle Zhang, Ronghui Mu, Xiaowei Huang, and Wenjie Ruan. Towards fairness- aware adversarial learning. arXiv preprint 17X1v 2024.
13

---

Published as a conference paper at ICLR 2025
A RELATED WORK
Adversarial training (Engstrom et al., 2018; Kannan et al., 2018; Zhang et al., 2020; Lee et al., 2020; Huang et al., 2023; 2021) is one of the most effective methods against adversarial attacks (Lin et al., 2024), normally, it can be formulated as a minimax optimization problem (Madry et al., 2018)
min E
{
[<([(x'',,)]
(13)
w
(x' (X's))~ss)
where x' is adversarial example causing the largest loss for fw within c-ball as defined in (4).
Recently, several works (Li & Liu, 2023; Ma et al., 2022; Sun et al., 2023; Wei et al., 2023; Xu et al., 2021; Zhang et al., 2024) have explored ways to address the fairness issue in adversarial robustness (the imbalance issue for robust accuracies across classes). Xu et al. (2021) was the first reveal that the issue of robust fairness occurs in conventional adversarial training, which can introduce severe disparity in accuracy and robustness between different groups of data when boost- ing the average robustness. To mitigate this problem, they proposed a Stir-Robust-Larriin (FRL) framework that employs reweight and remargin strategies to fine-tune the pre-trained model, reduc- ing the significant boundary error within a certain margin. Ma al. (2022) empirically discovered that trade-off off exists between robustness and robustness fairness, and adversarial training (AT) with a larger perturbation radius will result a larger variance. To mitigate this trade-off, they added variance regularization term to the objective function, naming the method FAT (Fairness-Awaa Adversarial Training), which relieves the trade-off between average robustness and robust fairness. Sun al. (2023) proposed method called Balance Adversarial Training (BAT), which adjusts the attack strengths and difficulties of each class to generate samples near the decision boundary for easier and fairer model learning. Wei et al. (2023) presented framework named CFA Class-wiie Fair Adversarial training), which automatically customizes specific training configurations for each class, thereby improving the worst-class robustness while maintaining the average performance. More recently, Li & Liu (2023) considered the worst-class robust risk and proposed framework named WAT (Worst-class Adversarial Training). leveraging no-regret dynamics to solve this prob- lem. Zhang et al. (2024) proposed Fairness-Awar Adversarial Learning (FAAL) to enhance robust fairness by considering the worst-case distribution across various classes.
Unlike the above works, this study develops robust generalization bound for the worst-class ro- bust error and proposes a method enhance worst-class robust performance and robust fairness by regularizing the spectral norm of the robust confusion matrix.
14

---

Published as a conference paper at ICLR 2025
B PROOF OF LEM. 3.2
Proof B.1 Let Su be the set of perturbations with the following property:
S
max [w+n(x) - Jw (x(()) 2 xER#
Sn
(14)
Let be the probability density function over u. We construct new distribution Q over ú that is restricted to Su with the probability density function:
(()
u E
((ū) = 0
(15)
otherwise,
where: z is a normalizing constant and by the lemma assumption 2 P(u S.) 2 By the definition of Q, we have:
max (.f++ū())-
fw(()) <
(16)
xE
Therefore, with probability at least over training dataset S, we have:
||c/" 1l2 S 110% la
bbecasue of Pf. B.2
- ||c 5, lle +
8dy mmin - 8dy
[KLL(QIP)) + in
mmin
bbecause of Pf. B.3
48
Memin - 8dl - ||CE;,11 V
8dy
[DKL(QIP)) + In
Mmmin 46
bbecause of Pf. B.4
dy
330min 48
S &ICc ll2 +
V mmin
DKL(Q]IP) + In
bbecasse of Pf. B.5
Sdy
Hence, proved.
Proof B.2 Given (14) and (15). for all á E Q, we have
max (fw+a(x) fw(x)) < ?
(17)
xEXB
For all x E XB s.f. arg max; fw (x) * y. we have
fw (w-u(x)(arg) max fw (x)[i]] + 4
7 2 fw+a(x))ul 2
(18)
Thus for all i # j, we have
(c )ij < (CO, )zg
(19)
According to Perron-Frobenius theorem (Frobenius et al., 1912), for all 1 i,j S dy a(C),
a|C||
2 0.
Combine the above conditions, we get ||C_= S 1Ic2, D. lll.
Proof B.3 Apply |||A||2 |B < A BII2 and Thm. 2.1.
Proof B.4 For all x E XB. there exists ú Q s.t. max (x)(()(0)) 2 fw+a(x))ll we
have
max fw (x) + 2 (x)[g) ig
(20)
Thus for all i + j. we have
(cL.g)s S (C
(21)
According to Perron-Frobedd theorem, for all 1 i.j S dg o(C),
a||C|
2 0. Combine the above
conditions, we get 1 s.g ll2 I 1|c/2,11,
15

---

Published as a conference paper at ICLR 2025
Proof B.5 Given 9. 9, and Su in (15), let St denote the complement set of Su and q denote the normalized density function restricted to S. Then, we have
DRL(allp) = =Dxt (ύlp)) + (1 D). (1)),
(22)
where (z) = = (1 2) 1n(1 2) = is the binary entropy fumction. Since DKL is always positive, we get
1 |DKI H())) (1 - DR.. (p))) 2 ((Dra. +1.
DRL(ÎllD)
(23)
2
Thus have 2(DKL + ul|P) In Smimn
DKL (w ullP) In Monin
C PROOF OF LEM. 3.3
Proof C.1 Following Neyshabur et al. (2017b), we use two main steps to prove Lem. 3.3. Firstly, compute the maximum allowable perturbation margin 7. In the second step, we compute the KL term in the bound, considering the perturbation obtained from the previous step. This computation is essential in deriving the ACC-Bayssann bound.
required to satisfy the given condition on the
Consider a neural network with weights W that can be regularized by dividing each weight matrix Wi by its spectral norm [Wrll2 Let B be the geometrie mean of the spectral norms of all weight matrices, defined as:
B
II Will
where n is the number of weight matrices in the network. We introduce modified version of the weights, denoted as W which is obtained by scaling the original weights Wi by a factor of TWi
8
3
W
1ill2 Wi.
Due to the homogeneity property of the ReLU activation fanction, the behavior of the network with the modified weights, denoted as Jwn is identical to that of the original network fww
Furthermore, we observe that the product of the spectral norms of the original weights, given by IF Will2- equal to the product of the spectral norms of the modified weights, expressed as IT Will2- Moreover, the ratio of the Frobenius norm to the spectral norm remains unchanged for both the original and modified weights:
Wille |
Wellz
[Wll22
As result, the excess error mentioned in the theorem statement remains unaffected by this weight normalization. Therefore, it is sufficient to prove the theorem only for the normalized weights w. Without loss of generality, we assume that the spectral norm of each weight matrix equal to B, iee. [|ill = for any layer I.
In our approach, we initially set the prior distribution P as Gaussian distribution with zero mean No0 I")),
and diagonal covariance matrix I²1, We incorporate random perturbations where the value of a will be determined relation to 3 at later stage. Since the prior must be independent of the learned predictor w and its norm, we choose according to estimated value B. We calculate the PAC-Bayesian bound for each 3 selected from pre-determined grid, offering generalization guarantee for all w satisfying |3 31 < 13. This ensures that each relevant value covered by some 3 in the grid. Subsequently, we apply a union bound across all B defined by the grid. For now, we will consider a set of 3 and the corresponding w that meet the condition |/ S 1, which implies:
ga-1 30 < eg
16

---

Published as a conference paper at ICLR 2025
According to Bandeira & Boedihardjo (2021) and the fact that (O, T) we can obtain the following bound for the spectral norm of the perturbation matrix Uj (n ())):
t²
Pu. U1/ll > t 2h exp
(24)
2h
where h is the width the hidden layers. By taking union bound the layers, we establish that, with a probability of at least 2 the spectral norm of the perturbation Uj in each layer is bounded by a 2 In(Anh).
Plugging the bound into Lem. C.2, we have that
1
max [l fw((x]l2 xEAn
eB Σ
B
eB
Σ
|
(25)
em
/ 22 In(4nh) S
To make (25) hold, given 3n-1 S efn-1, we can choose the largest a as
114nB 114nB (nnh)
|W
Hence, the perturbation with the above value of a satisfies the assumptions of the Lem. 3.2. We now compute the KL-term using the selected distributions for P and Q, considering the given value of a.
lw
DKL(W + P) s
20²
[W
20
W
W W
0
B2n2 2 In(nn)
Then, we can give a union bound over different choices of 3. We only need to form the bound
for 28
which can be covered using a cover of size nmm as discussed in Neyshabur el al. (2017b). Thus, with probability 2 1 1 8, for any 3 and for all w such that
I 3 <
2B
| 3 < 1, we have:
||c ll - 11 +0
(1/ (1mmmn 8dy)7²
( dy
((fw) +In
MMmmmn ))}
(26)
8
where (ffw)= B²n hn(h)))))))))))))))))))))))n))) [[ 1
Hence, proved.
Lemma C.2 (Neyshabur al. (2017b)) For any B, n. let fwr XB + be n-layer feedfor- ward network with ReLU activation function. Then for any w, and x E XB, and any perturbation vecl ( (1)))) such that | S W/122 the change the output of the network can be
bounded as follow
n
Utl12 W
(lf++u(x) - (x) S eB
W 12
(27)
17

---

Published as a conference paper at ICLR 2025
D PROOF FOR LEM. 3.4
Proof D.1 Following the proof process from Xiao et al. (2023), we first introduce some definitions. Then, derive Lems. D.4 and D.3. By combining these results, obtain Lem. 3.4. Note that provide a concise process here, a more detailed one can be found in Xiao et al. (2023).
Definition D.2 (Local perturbation bound) Given x XB. we say Iw (x) has (I,, Ln)-- local perturbation bound w.r.t. w, if
72 L1 I|:
9gw (x) gw (x)1 I
Will2
1=1
where L1 can be related to w, w' and x.
The bound introduced in Def. D.2 plays a crucial role in quantifying the variation in the output of the function 9w (x(x), especially when the weights are subject to small perturbations. Building upon this foundation, we can derive the following lemma, as demonstrated in the work of Xiao al. (2023).
Lemma D.3 (Xiao et al. (2023)) If (x) has (A1(x), An, perturbation bound, i.e.,
(gw(x) 9w (x)l S Σ A||x I| Will
1=1
the robustified function bound.
Iw (x') has a (A1(Ix + tc), An( + loocl perturbation | x1
max
Margin Operator. Following the notation used by Bartlett et al. (2017); Xiao et al. (2023), the mar- gin operator is defined for both the true label given an input x and for pair of classes (i. This definition provides clear and precise measure of class separation for the model, quantifying the difference between the model's 's output for the true class and other classes, well as the difference between the model's outputs for any pair of classes.
M(fw(x); y) fw (x)[v) max fw (x)
(28)
M (ff fw (x)li (x)
Robust Margin Operator. Similarly, the robust margin operator is also defined for a pair of classes (i,j) with respect (x,y)
RM (. (f (x).
max 1--xIl:-Se
[fw(x))l
max fw (x') 379
(29)
(f
max I|x-x'IlaSe
(xw() fw
Building upon the previously introduced definitions and Lem. D..,, Xiao al. (2023) presents the form of A; for the margin operator in the following lemma.
Lemma D.4 (Xiao et al. (2023)) Consider fw(?) as an n-layer neural network characterized by ReLU activation functions. It is established that the following bounds apply to local perturbations within this framework.
1. Given x and i.j, the margin operator (fw (x), has a (Alx)),,,n) An|x) -local perturbation bound w.r.t. w, where = IT= || [ 1|22- And
U
MM(f+uuxx)... MMf
(x), i.)) 2eB
(30)
Will2
Given x and in the robust margin operator RM (. (x): i,j) has (Ai( + E), A.. local perturbation bound w.r.t. And
(xxl
|U11|2
(MM(f+u(())
2e
W 12
(31)
W
18

---

Published as a conference paper at ICLR 2025
By combining Lems. 3.2 and D.4, and building upon the work of Xiao et al. (2023), obtain the following lemma, which demonstrates that the weight perturbation of the robust margin operator can be utilized to develop PAC- PAC-Bayesian framework.
Lemma D.5 Let fw XB + y be any predictor with weights and P be any distribution on the weights that independent of the training data. Then, for any 7, with probability least 1 - 5 over the training set of size m, for any w, and any random perturbation u s.I.
Pu
max xJE
M(ff(x), (f
7
2
1
have
dy
3mm
IIc/" 112 I ||C 112 +
+ mminn 8dy
DKL(W + +ul +
46
2.
Fu
max ij
[RM( (M)0)) -
2
2
2
we have
dy
3mmmin
IC/22 2 S |1CS/, 112
AV
DKL +ullP) + In
(32)
Mmmnn
8dy
46
Finally, combine Lems. D.4, D.5 and Lem. 3.3 (App. C), we get Lem. 3.4.
E MORE EXPERIMENTAL RESULTS
E. SENSITIVITY ANALYSIS FOR HYPER-PAREE PARAMETERS
Table 6: Training from scratch on CIFAR-I0 using Preact-ResNet118 model under foo norm attack with different hyper-parameters. Left table shows results for fixed 7 0.0 with a ranging from 0.0 to 0.4. Right table shows results for fixed a 0.3 with 7 ranging from 0.0 to 0.4.
0.0
a 0.3
AA (%)
Worst (%)
AA (%)
Worst (%)
0.0
47.38
12.90
0.0
49.92
33.80
0.1
49.02
21.50
0.1
49.73
34.90
0.2
49.76
24.40
0.2
49.31
34.70
0.3
49.92
33.80
0.3
48.56
33,90
0.4
49.13
30.10
0.4
47.68
33.20
We investigate how regularization hyper-parameters and 7 influence model performance through experiments on CIFAR-10 with PreAct ResNet-18. Models are trained for 200 epochs with batch size 128, using two configurations: (1) fixed 7 0.0 with a varying from 0.0 to 0.4, and (2) fixed = 0.3 with y varying from 0.0 to 0.4. As shown in Tab. 6 (left), both average and worst-class AA accuracy initially increase with a before declining due the disruption of training performance at larger values, leading to our choice of a 0.3 for subsequent experiments. Tab. 6 (right) demon- strates that with increasing 7, average AA accuracy consistently decreases while worst-class AA accuracy shows an initial improvement followed by deterioration. This behavior can be explained by two competing effects: while larger y values may impair overall training performance, they also reduce the influence of the final term in Prop. 3.1, allowing the regularization term more ef- fectively optimize worst-class AA accuracy. This trade-off explains why y 0.1 achieves better worst-class performance while maintaining acceptable average performance.
19

---

Published as a conference paper at ICLR 2025
Table 7: Following Cui al. (2024), conduct experiments ImageNet and CIFAR-100 with
clean training, compare ours with other methods on fairness.
Dataset
Method
Easy (%)
Medium (%)
Hard (%)
All (%)
Baseline (ResNet-50)
93.1
81.1
59.4
77.8
Menon al. (2021)
91.7(-1.44
79.8(-1.3
61.4(+2.0)
77.6
ImageNet
Cui et al. (2019)
91.6(-1.5)
79.6(-1.5)
61.3(+1.9)
77.5
o.0
91.5(-1.6)
79.6(-1.5)
62.3(+2.9)
77.8
Baseline (WRN-34-10)
92.2
83.2
70.1
81.7
Menon et al. (2021)
91.5(-0.7)
83.2(+0.0)
70.4(+0.3)
81.6
CIFAR-100
Nam al. (2020)
90.4(-1.8)
81.5(-1.7)
67.7(-2.4)
79.7
Liu al. (2021)
91.3(-0.9)
82.4(-0.8)
69.6(-0.5)
81.0
Ours,=0.0
91.3(-0.9)
83.0(-0.2)
71.2(+1.1)
81.8
E.2 EXPERIMENTS CLEAN TRAINING
Following Cui et al. (2024), we extend our evaluation to clean training scenarios on ImageNet and CIFAR-106 100, comparing our method with other approaches for clean accuracy fairness. As demon- strated in Tab. 7, our method effectively enhances fairness in clean training, improving test accuracy on "hard" subsets of ImageNet and CIFAR- 100 while maintaining overall accuracy.
E.3 SHARPNESS ANALYSIS
Table 8: Sharpness-like method estimated variance with respect robust generalization gap and worst-class AA accuracy. The models are trained from scratch on CIFAR-10 using Prcact-ResNette model with &o norm attack.
Method
Training AA Test AA (%)
Test worst-class AA (%)
Largest variance
PGD-AT
7.53
12.90
0.14
TRADES
6.08
20.70
0.17
Ours.y
5.47
33.80
0.21
Our approach follows established PAC-Bayesian frameworks (Neyshabur et al., 2017b; Farnia et al., 2019). where the norm restriction serves theoretical bridge connecting worst-class error with the spectral norm of empirical confusion matrix and model weights.
The perturbation degree of reflects the sharpness/flatness of the base classifier fw- Its effectiveness is usually evaluated in relation to generalization gaps (Jiang et al., 2020), as the single value of is un-imformative. While Sec. presents weight-norm- based bounds, we further validate the PAC-Bayesian bound/assumption empirically using sharpness-based sampling method (Jiang et al., 2020):
Sample 50 perturbations u1,-.., Uço from V(0,00T)
Find the largest o² e {0.01, 0.02. 1} where training accuracy drop between fw and any fw+u, stays within 5%.
The results in Tab. show that smaller generalization gaps and higher worst-class accuracy corre- spond to larger variances, indicating smoother base classifiers. These findings align with previous work (Jiang al., 2020; Xiao al., 2023), supporting the effectiveness of the PAC- MAC-Bayesian frame- work.
E.4 LONG-TAIL EXPERIMENTS
20

---

Published as a conference paper at ICLR 2025
Table 9:
The performances ImageNer-I.T with ResNeXt-50.
Method
Many-shot (%)
Medium-shot (%)
Few-shot (%)
Baseline
66.1
38.4
8.9
Ours,=0.0
61.3
45.5
31.2
We evaluate long-tail image classification on ImageNet-LT (Liu et al., 2019) using ResNeXt-50- 32x4d as our baseline, trained with SGD (momentum 0.9, batch size 512) and cosine learning rate decay from 0.2 to 0.0 over 90 epochs. As shown in Tab. 9, our regularizer leads to improved fair- ness across the distribution: while showing slight decrease in many-shot performance, it achieves significant gains in few-shot classes and moderate improvements in medium-sher classes, demon- strating effectiveness addressing fairness problem long-tail scenarios.
E.5 TRAINING DYNAMIC
0
3
TRADES
Our Method
Figure 4: We adversarially trained Preact-ResNet-i models for standard TRADES (left) and our method with y = 0.0 based on TRADES (right) for 200 epochs using SGD with momentum of 0.9, batch size 256, weight decay of 5 x 10-4 and an initial learning rate of 0.1, which is reduced by a factor of 10 at the 100th and 1 150th epochs. Blue line represents training accuracy under PGD-10, while orange line represents testing accuracy under PGD-10.
As illustrated in Fig. 4, both methods exhibit similar training and testing dynamics. These results suggest that our method does not independently introduce robust overfitting or address robust over- fitting; rather, this phenomenon appears to be inherent to the fundamental adversarial training frame- works, e.g., TRADES, AWP, and AT.
E.6 BEST CLASS PERFORMANCE
Evaluation of different methods on CIFAR-10. We report the average accuracy, the worst- class accuracy, and the best-class accuracy under standard lo norm AA, with baseline models of TRADES/TRADES-A
Table 10:
Method
AA (%)
Worst (%)
Best (%)
TRADES
52,51
23.20
77.10
+ FRL-RWRMo.0s
49.97
35.40
75.70
+ FAALAWP
52.45
35.40
77.50
Ours,-000
53.46
36.30
78.50
TRADES-AWY
56.18
25,80
77.60
+ FRR-RRRRM...
46.50
27.70
72.80
+ FAALAWP
53.93
37.00
76.20
+ Ours,=0000
54.65
37.00
76.90
21

---

Published as a conference paper at ICLR 2025
F IMPLEMENTATION DETAILS
In the current implementation version, the confusion matrix is computed over training set and the computation of gradients involves key terms:
a a 8 Jo
The gradient of the confusion matrix's 's spectral norm:
This is computed once
per epoch over training data using SVD, and the resulting gradient matrix is cached for throughout the epoch.
The final KI. gradient term in (11): 2w which is computed over batch set due to the computational overload of processing the entire training set once. We believe this operation is commonly used in DNNs training.
Then, model updates during each minibatch combine these two components.
Our method also regularize both terms batch set, we show empirical results in the following. We also compare our results with FAAL, as they reweight classes each minibatch. Note that in the table, Hybrid means the first spectral term (11) is computed once per epoch over training set, and the final gradient term is comptued each minibatch over batch set. Minibatch means both terms are computed each minibatch over batch set.
Evaluation of regularization over epoch or minibatch on CIFAR-10. We report the training time, average accuracy and the worst-class accuracy under standard &or norm AA, with baseline models of TRADES.
Table 11:
Method
AA (%)
Worst (%)
Time/Epoch (s)
Regularize on
TRADES
52.51
23.20
664
N/A
+ FAALAWP
52.45
35.40
921
Minibatch
+ Ours,=0000
53.46
36.30
997
Hybrid
+ Ours.==u.0
53.39
36.10
1089
Minibatch
To improve computational efficiency, we have implemented and evaluated an alternative version of our method. Following CFA, we utilize adversarial examples from the previous epoch generate the confusion matrix for the current epoch.
Table 12:
Experimental setting follows the above table. Here, the confusion matrix in our method generated by adversarial examples from previous epoch.
Method
AA (%)
Worst (%)
Time/Epoch (s)
Regularize on Hybrid
TRADES =0.0
53.31
36.10
705
22


Reviews:
[{"review_id": "Z5aA3B2MTI", "reviewer": "Reviewer_rown", "summary": "The paper studies the robust fairness of deep neural networks. The authors first derive a robust generalization bound for the worst-class robust error within the PAC-Bayesian framework. The bound comprises two key components: the spectral norm of the empirical robust confusion matrix and a model-dependent and training data-dependent term. Based on this, the authors further develop a novel regularization technique to optimize the spectral norm of the robust confusion matrix to improve the robust fairness. Extensive experiments are conducted to show the effectiveness of the method.", "questions": "- This question relates to the motivation in Fig. 2. What is the correlation between the class-wise robust accuracy of the training and the test set? I understand the robust confusion matrix over the training set does not always align with that of the test set. But if they are aligned most of the time, should it still be an important concern?\n\n- It seems that $\\gamma=0$ always has slightly better AA and worse Worst compared to $\\gamma=0.1$. Why is this the case?\n\n- The derivation from Eq. 9 to Eq. 11 is a bit confusing. Why is the middle term approximated by the sign? How good/bad is this approximation? It would be great if the authors could provide a bit detailed explanation for lines 354-358.\n\n- Why is the best result in the 5th column of Tab. 1 the original TRADES-AWP? It seems that all the fine-tuning methods fail to improve the average accuracy?", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "- The paper is well-written and easy to follow. It gives adequate background on the topics of fairness, adversarial robustness, and PAC-bound, which can be very helpful for readers who are not familiar with the field to understand the gist of the paper.\n- The contribution is quite significant because:\n1. this is the first PAC-Bayesian framework to characterize the worst-class robust error across different classes.\n2. the proposed regularization term is novel because it aims to improve the robust fairness from the spectral norm of the robust confusion matrix, which is ignored by previous methods.\n3. during evaluation, the method shows improved results in terms of robust fairness across all settings.", "weaknesses": "- The motivation from the intro feels disconnected from the method. In Figure 2, the authors argue that the class exhibiting the worst robust performance on the training set may not be the same as the one on the test set. However, how would the proposed method in Section 4 address this issue? It would be great if the authors could provide some discussion about the connection between this motivation and the proposed method.\n\n- It would be great to also see some analysis for the hyper-parameters $\\alpha$ and $\\gamma$ for a better understanding of the method. How optimal is 0.3 for $\\alpha$? What is the effect of changing it? Does it trade off the average accuracy vs the worst class robustness? I would appreciate if the authors can provide some intuition behind the effect of these two hyper-parameters and also some experimental results showing how AA & Worst changes with respect of different values.\n\n- Typos:\n1. In Equation 10, (x, y) -> (x', y)\n2. Line 425, W -> We", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "7vR8ncUBfI", "reviewer": "Reviewer_dWn3", "summary": "This work derives a robust generalization bound for the worst-case (i.e. adversarial) robust error using a PAC-Bayesian analysis. This is the worst-margin violation in an epsilon-perturbed adversarial input setup, which can be represented as L1 norm on a perturbed confusion matrix. Through a link to the L2 norm (with an unknown empirically tight ratio), the bound further splits to (1) spectral norm of the empirical margined confusion matrix and (2) a component that depends on the information content of the input data and the specifics of the hypothesis space.\n\nThe paper focuses on the spectral norm component as much of the recent literature has focused on the other component. The work argues that this spectral norm can be used as a regularization term during training, and provides an approximation of it with a feasible implementation path.\n\nThe proposed method is evaluated on the worst-case accuracy (test) metric under both clean-data and AutoAttack (Groce & Hein, 2020b) settings, and is compared to a number of common adversarial training methods. Experiments on image datasets show that the proposed method has comparable results to SOTA on average metrics while outperforming most methods on worst-case robust error. Transfer learning experiments (CIFAR to ImageNet) show that the regularized fine-tuning outperforms the baseline on the worst-case robust error metric.", "questions": "- The assumption on the norm of U (i.e. restricting f_{w+u}(x) - f_w(x), instead of bounding the input perturbation) seems crucial to the derivation of Lemma 3.2. Have you looked at the value of this norm in your experiments? An analysis of the norm of U for some of the experiments conducted for the work could help establish how tightly this assumption is satisfied in practice.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 4, "strengths": "- The approximation in section 4.1 makes it possible to implement an adversarial spectral-norm regularizer effectively.\n\n- Based on limited empirical analysis, the method looks robust to the choice of hyperparameters.\n\n- The method performs well against SOTA attack methods (AutoAttack), and not just the limited setting considered in the theoretical analysis.", "weaknesses": "- Empirical analysis is somewhat limited both in domain and the datasets used. It’s hard to argue only based on the provided analysis that the results will extend to larger models, other vision datasets, or non-vision classification tasks. Adding experiments with much larger datasets (e.g. larger ImageNet) or non-vision tasks would greatly improve the empirical analysis in the paper.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "tkt72bQPiY", "reviewer": "Reviewer_ZUyD", "summary": "This paper endeavors to address the robust fairness problem and derives a robust generalization bound for the worst-class robust error within the PAC-bayesian framework, accounting for unknown data distributions.\nLeveraging the insights gleaned from our theoretical results, they propose an effective and principled method to enhance robust fairness by introducing a spectral regularization term on the confusion matrix.", "questions": "See weakness", "limitations": "", "rating": 6, "confidence": 1, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This work represents the first endeavor to develop a PAC-Bayesian framework to characterize the worst-class robust error across different classes. This is an important problem.\n2. This paper is theoretically solid.\n2. The improvement brought by this method is obvious in the experiment.", "weaknesses": "1. The fairness improvement method in this article seems to be designed only for adversarial training, so is there any improvement for the unfairness brought by other settings (such as long-tail training distribution)?\n2. In the experiment, the author targeted AutoAttack. Does it have any effect on other attack methods?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "E3zihPURIp", "reviewer": "Reviewer_ry7R", "summary": "Recent studies have identified \"robust fairness\" as a significant challenge in deep learning, where the robust accuracy of DNNs can differ widely across various classes, affecting their reliability. Traditional methods attempt to tackle this issue by adjusting class weights during training, yet these methods often fail to predict which class will have the poorest robust accuracy in testing. To address this, researchers have developed a new theoretical framework within the PAC-Bayesian paradigm to better understand and control the worst-case robust error. This framework introduces a regularization technique aimed at reducing the spectral norm of the robust confusion matrix, thereby improving the robust accuracy of the most vulnerable class and promoting fairer outcomes across all classes.", "questions": "Please see Weakness.", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper is well written and organized for readers' easy understanding.\n\n2. The work is well motivated.\n\n3. The performance is good.", "weaknesses": "1. The spectral norm should be denoted by another symbol rather than ||*||_2. It is rather confused between spectral norm and l_2 norm. Specifically, in Line 311 ~ Line 315, the authors mention the relationship of l_1 and l_2 norm, but the norm in Eqn. (8) should be spectral norm? So I not sure whether it is correct for the derivation.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "1coutgpIUY", "reviewer": "Reviewer_RdH6", "summary": "This paper addresses the issue of fairness in adversarial robustness. The authors leverage PAC-based bounds to analyze the worst-class error. They first provide a bound for deterministic classifiers based on the PAC framework. Next, using techniques proposed by Neyshabur et al., they bound the KL divergence, which is challenging to compute. Finally, they apply the analysis from Xiao et al. to obtain Lemma 3.4. Empirically, based on their analysis of the confusion matrix, they propose the addition of an approximated regularization term. Empirical results support the effectiveness of the proposed method.", "questions": "Please see weaknesses.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "This paper is well-motivated, clearly written, and easy to follow. \n\nThe theoretical results are novel and offer an interesting perspective on the problem of robustness fairness. \n\nEmpirically, the proposed method enhances worst-class performance.", "weaknesses": "Concerns regarding this paper primarily focus on practical implications. From a methodological perspective, the authors apply a regularization term to the confusion matrix. Intuitively, calculating the KL divergence between misclassified examples is akin to re-examining those examples or, in other words, assigning greater weight to misclassified instances. Since only the empirical confusion matrix is used for optimization during training, this method may not effectively address their motivation, which is to resolve the mismatch between training and testing worst-class performance.\n\nAs a result, the proposed method may encounter issues such as sacrificing the performance of the best class and an increased likelihood of robust overfitting, both of which are evident in the empirical results presented in this paper.\n\nRegarding the experimental setup, the authors overlook important evaluations under PGD attacks. Each experimental condition should be assessed across all three datasets rather than just one or two, and both $L_2$ and $L_\\infty$ attacks should be included.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "WHTa03CTFf", "reviewer": "Reviewer_ZB6w", "summary": "This paper aims to enhance the worst-class accuracy under adversarial attacks. The authors first establish a robust generalization bound within the PAC-Bayesian framework, demonstrating that the worst-class error is constrained by the spectral norm of the empirical robust confusion matrix. Based on this theoretical insight, they propose a regularization loss to minimize the spectral norm of the confusion matrix. Extensive experiments on CIFAR-10, CIFAR-100, and TinyImageNet validate the effectiveness of the proposed method in improving worst-class accuracy under adversarial attacks.", "questions": "See weaknesses. I am open to increasing my score if the identified weaknesses are adequately addressed.", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 4, "contribution": 4, "strengths": "(1) The paper is well-written and easy to follow. Although I am not an expert in the PAC-Bayesian framework, the authors clearly explain the flow of their proof, enabling me to understand how the main results are derived. \n\n(2) To address the problem of non-differentiable confusion matrix, the authors propose a novel approximation method — using KL divergence to replace binary errors. This approach is conceptually sound and interesting.\n\n(3) Improving worst-class accuracy is important but often overlooked. The authors make a meaningful contribution by providing both theoretical insights and practical methods to address this issue effectively.", "weaknesses": "(1) I find Paragraph 3 (Lines 51 to 66) unclear in its intended message. First, the authors state that “our findings indicate that the robust confusion matrix over the training set does not always align with that of the test set. In other words, as shown in Fig. 2.” However, Figure 2 illustrates a strong correlation between training and testing accuracy, with the worst-performing class in training being the second-worst in testing. Additionally, the performance gap between the two worst-performing classes in testing is small, which could be attributed to estimation variance. Second, the authors assert that their findings “motivate the need for a principled approach to mitigate the disparities in robust performance.” However, Proposition 3.1 suggests that the discrepancies between the training and testing confusion matrices arise from a second term, which depends on the model and training set. Minimizing this term is not a contribution of the paper and is not explicitly addressed in the work. I recommend that the authors explain more explicitly how their findings motivate their approach.\n \n(2) Lines 182–184: It is not immediately clear why the worst-class robust error can be represented as the L_1 norm of the confusion matrix. Could the authors provide a detailed derivation to clarify this relationship?\n \n(3) There is an inconsistency between the confusion matrix in Figure 3 and the one in Eq. (1). In Eq. (1), the diagonal entries are defined as 0, whereas in Figure 3, the diagonal contains non-zero values. I suggest that the authors clarify this discrepancy and modify either Figure 3 or Equation 1 to be consistent, if appropriate.\n\n\n(4) The experiments in this paper focus solely on adversarial training and evaluate both clean and robust worst-class accuracy. According to Lemma 3.3, the proposed method is also applicable to improving worst-class accuracy under clean training (e.g., using standard cross-entropy loss). I am curious whether the proposed method can enhance worst-class accuracy under clean training setting (CIFAR100 and ImageNet results), as demonstrated in [1]. For example, conduct additional experiments on CIFAR100 and ImageNet using standard cross-entropy loss.\n\n(5) Why is the sign() function required in Eq. (11)? Why can’t the average KL divergence be used directly? Are there any ablation studies to justify this operation? I suggest that authors include ablation studies comparing performance with and without the sign() function or\ndiscuss any potential drawbacks or limitations of using the average KL divergence directly.\n\nminor typos: Line 470, Tab. 2 should be Tab. 3. \n\n[1] Classes Are Not Equal: An Empirical Study on Image Recognition Fairness", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)