Can we have it all? On the Trade-off between Spatial and Adversarial Robustness of Neural Networks
Authors: Sandesh Kamath
Amit Deshpande
K Venkata Subrahmanyam
Vineeth N. Balasubramanian
Venue: NeurIPS 2021 Poster (2021)
Keywords: Adversarial robustness
spatial robustness
invariance
curriculum learning

Abstract: (Non-)robustness of neural networks to small, adversarial pixel-wise perturbations, and as more recently shown, to even random spatial transformations (e.g., translations, rotations) entreats both theoretical and empirical understanding. Spatial robustness to random translations and rotations is commonly attained via equivariant models (e.g., StdCNNs, GCNNs) and training augmentation, whereas adversarial robustness is typically achieved by adversarial training. In this paper, we prove a quantitative trade-off between spatial and adversarial robustness in a simple statistical setting. We complement this empirically by showing that: (a) as the spatial robustness of equivariant models improves by training augmentation with progressively larger transformations, their adversarial robustness worsens progressively, and (b) as the state-of-the-art robust models are adversarially trained with progressively larger pixel-wise perturbations, their spatial robustness drops progressively. Towards achieving Pareto-optimality in this trade-off, we propose a method based on curriculum learning that trains gradually on more difficult perturbations (both spatial and adversarial) to improve spatial and adversarial robustness simultaneously.

Can we have it all? On the Trade-off between Spatial and Adversarial Robustness of Neural Networks
Sandesh Kamath
Amit Deshpande Microsoft Research India
Indian Institute of Technology, Hyderabad
K V Subrahmanyam
Vineeth N. Balasubramanian
Chennai Mathematical Institue, Chennai
Indian Institute of Technology, Hyderabad
Abstract
NNon-)robustness of neural networks small, adversarial pixel-wise perturba- tions, and as more recently shown, to even random spatial transformations (e.g-- translations, rotations) entreats both theoretical and empirical understanding. Spa- tial robustness to random translations and rotations is commonly attained via equivariant models (e.g.. StáCNNs, GCNNs) and training augmentation, whereas adversarial robustness is typically achieved by adversarial training. In this paper, we prove quantitative trade-off between spatial and adversarial robustness in a simple statistical setting. We complement this empirically by showing that: (a) the spatial robustness equivariant models improves by training augmentation with progressively larger transformations, their adversarial robustness worsens progressively, and (b) as the state-of-the-arr robust models are adversarially trained with progressively larger pixel-wise perturbations, their spatial robustness drops progressively. Towards achieving Pareto-optimality in this trade-off, we propose a method based on curriculum learning that trains gradually on more difficult pertur- bations (both spatial and adversarial) to improve spatial and adversarial robustness simultaneously.
1
Introduction
Neural network (NN) models have achieved state-of-thh-an performance on several image tasks over the last few years. However, they have been known to be vulnerable to adversarial attacks that make small, imperceptible pixel-wise perturbations to images [39 5]. Most pixel-wise adversarial perturbations studied in previous work carefully constructed, model-dependent and, in most cases also input-dependent, perturbations of small fox. norm (and sometimes & or & norm). To achieve adversarial robustness, a popular, principled, and effective defense against foe adversarial attacks known at present is adversarial training
37 49].
From another perspective, recent work has also shown natural, physical-worid attacks neural network models using 2D and 3D spatial transformations such as translations, rotations and pose 47 I. Even random spatial transformations such random translations and random rotations degrade the accuracy of neural network models considerably [[2]. Recent benchmarks also measure the robustness of NN models to the average-case, model-agnostoe perturbations (e.g., noise, blur, brightness, contrast) or natural distribution shifts, and not only to the worst-case adversarial perturbations [21] 40 Spatial robustness robustness spatial transformations (e.g., translations, rotations) has been long studied as a problem of model invariance, and is generally addressed using equivariant models or training augmentation. While standard Convolutional Neural Networks (StdCNNs) are translation-equivarinn recent efforts have resulted in equivariant NN models for other transformations such rotation, flip T6
and scaling 30 46
35th Conference on Neural Information Processing Systems (NcurIPS 2021).

---

Such group- equivarir NN models (GCNNs) are designed to be invariant to specific group of transformations, so they need training augmentatiin to attain spatial robustness to random or average- case transformations. However, aided by clever weight-sharing. these recent works have achieved good spatial robustness performance with lesser training augmentation than their non-equivariant counterparts.
In this paper, we address an inevitable trade-off' between the average-case spatial robustness and the worst-case loo adversarial robustness in neural network models, and show results theoretically as well as empirically. On the one hand, as we attain better spatial robustmess via equivariant models and larger training augmentation, the adversarial robustness worsens. On the other hand, as we attain better adversarial robustness via adversarial training against larger pixel-wise perturbations, the spatial robustness worsens. We then provide curriculum learning- based approach to mitigate this issue and achieve a certain degree of Pareto-optimality in this trade-off.
Our work extends recent progress on two important questions, namely, the robustness to multiple attacks and the robustness vs accuracy trade-off. The robustness to translations (up #3 pixels) and rotations (up to +300) has been shown to have a fundamentally different loss landscape than the robustness adversarial lp perturbations [1]] A trade-off between robustness to adversarial lo perturbations and adversarial translations and rotations up to =3 pixels and =400, respectively, was also recently noted 42). Adversarial attacks on l adversarially robust models by exploiting invariance at intermediate layers have also been of interest in recent work [23 41). A key difference of our work with these efforts is that: (i) we study spatial robustmess to random translations and rotations (which is more closely related to practice when training NN models and has not been studied in these earlier efforts), instead of adversarial translations or rotations; (ii) we study spatial robustness w.r.t transformations over their entire range, and do not restrict ourselves to a +30 - 40 range, for instance; and (iii) we consider the use of group-equivaarint models with training augmentation (which are designed for spatial robustness) in our studies, beyond just StdCNN models. Our results show a progressive decline in spatial robustness as adversarial robustness improves, and vice versa trend that was not explicitly noted in previous results. Our result can also be interpreted as progressive trade-off between adversarial robustness and generalization accuracy itself [43] 49 48), where generalization performance measures accuracy on test distribution that includes natural data augmentation such as random translations, rotations, etc.
Given the nature of this trade-off, we then ask the question of how one can obtain a model close to the Pareto-optimal frontier for adversarial and random spatial robustness. Are there training strategies that can help achieve a balance between both? We observe that the obvious solutions of training in two stages - first, adversarial training and then training augmentation by spatial transformations, or vice versa does not help address this issue. This results in a version of catastrophic forgetting, where as the model learns robustness on one of these fronts, it loses robustness on the other. We instead show that curriculum bearning-basel strategy, where the model is trained by applying an adversarial perturbation to a randomly transformed input with gradually increased difficulty levels, gives solutions consistently closer to the Pareto-optimal frontier across well-known datasets and models. This strategy reflects the progressive nature noted of the trade-off itself, and highlights the importance of the observation of this trend.
Our key contributions can be summarized as follows:
We study a trade-off between adversarial robustness and spatial robustness (with a focus on random spatial transformations) both theoretically and empirically, on setting closer to natural neural network training, which to the best of our knowledge, has not been considered before. We explain the trade-off between spatial and adversarial robustness with a well-motivated theoretical construction.
We conduct comprehensive suite of experiments across popularly used models and datasets, and find that models trained for spatial robustness (StdCNNs and GCNNs) progressively improve spatial robustness when their training is augmented with larger random spatial transformations but while doing so, their Eo adversarial robustness drops progressively. Similarly, models adversarially trained using progressively larger -nom attacks improve their adversarial robustness but while doing so, their spatial robustness drops progressively.
We provide a simple yet effective approach based on curriculum learning that gives better-balanced, Pareto-optimal spatial and adversarial robustness compared to several natural baselines derived from combining adversarial training and training augmentation by random spatial transformations.

---

2 Problem Setting and Formulation
We begin by describing our problem formally. Let (x, Y) denote random input-label pair from given data distribution over the input-label pairs (z, y) E X x y. Let f be a neural network classifier. The accuracy of f is given by Pr (f( = Y), the fraction of inputs where the prediction matches the true label. For c > 0, an for adversarial attack A maps each input x to x + A(x) such that |[ I c, for all E X. The fooling rate of A is given by Pr (f(X + A(X)) + f(X),, the fraction of inputs where the prediction changes after adversarial perturbation. For a given spatial transformation T, the classifier ʃ said be T'invarriat if the predicted label remains unchanged after the transformation T for all inputs; in other words, [(Tx) = (xx) for all x E X. The spatial transformations such as translation, rotation and flip preserve the foo norm, so TA(xx)) is an adversarial perturbation of small foc norm for the input Tr for a --ivvariant classifier. Therefore, for a given perturbation bound e > the maximum fooling rate for any T'invariant classifier on the transformed data {Txx= : E } must be equal to the maximum fooling rate for f on the bit more subtle when
original data X.
not truly invariant, that is, f(Tx) = f(x) for most inputs x but not all x. We define the rate of invariance of a classifier f to transformation as Pr (f = f f()) or the fraction of test images whose predicted labels remain unchanged under the transformation T. For a class of transformations, e.g., random rotation from the range +0%). we define the rute of invariance as the average rate of invariance over transformations T in this class, i.e., Pr (J(r = s(X)), where the probability is over the random input X as well as the random transformation r. The rate of invariance is 100% if the model f is truly invariant. When f is not truly invariant, the interplay between the invariance under transformations and robustness under adversarial perturbations of small -nom is subtle. This interplay is exactly what we investigate.
In this paper, we study neural network models and the simultaneous interplay between their spatial robustness, viz, rate of invariance for spatial transformations (such as random rotations between [- + for 0 varying in the range [0, 180), and their adversarial robustness to pixel-wise pertur- bations of Sx norm at most e. Measuring the robustness of model to adversarial perturbations of tp norm at most is NP-hard [24 37 Previous work on the comparison of different adversarial attacks has shown the Projected Gradient Descent (PGD) attack to among the strongest 2 Hence, we use PGD--baed adversarial training as the methodology for adversarial robustness in a model, as commonly done. We show that our conclusions also hold for other forms of adversarial training such as TRADES [49. which gives trade-off between adversarial robustness and natural accuracy (on the original unperturbed data).
Theoretically speaking, we prove quantitative trade-off between spatial and adversarial robustness in a simple, natural statistical setting proposed in previous work [43). Our theoretical results (described in Sec B show that there is a trade-off between spatial and adversarial robustness, and that it is not always possible to have both a given model. Empirically, we study the following: (a) change in fx adversarial robustness as we improve only the rate of spatial robustness using training augmentation with progressively larger transformations; (b) change in spatial invariance as we improve only adversarial robustness using PGD adversarial training with progressively larger -norm of pixel- wise perturbations. We study StdCNNs, group-equivariant GCNNs, as well as popular architectures used to assess adversarial robustness 22 49]. Our empirical studies are conducted on MNIST, CIFARIO, 10, CIFAR 100 as well as Tiny ImageNet datasets, thus showing the general nature of these results (described in 4) Importantly, as stated earlier, we consider random spatial transformations that are more commonplace than adversarial rotations in previous work 42]. We look at the entire possible range for spatial transformations. Similarly, we normalize the underlying dataset, and compute the accuracy of a given model on test inputs adversarially perturbed using PGD attack of loc norm at most c, for varying over (0, 1]. In contrast with the certifiable lower bounds robustness 35 28 32), we study upper bounds on spatial and adversarial robustness, respectively.
3 15
3
Spatial-Adversaria Robustness Trade-off
In this section, we prove the trade-off between spatial and adversarial robustness theoretically, and support this result with experiments in Sec We use A(z) to denote an adversarial Ex perturbation and r(z:) to denote random spatial transformation. Equivariant model constructions often consider a group of transformations and construct a neural network model invariant to this group. For simplicity, we consider cyclic group that can model a rotation group (e.g., integer multiples of 30"), or horizontal/vertical translations (c.g., horizontal translations by multiples of, say, #4 pixels).
3

---

We take construction proposed in previous work for a robustness vs accuracy trade-off [3] and infuse it with simple idea from the theory of error correcting codes [4. Consider a binary eyclic code of length d, where each codeword is a binary string in { {-1 1, 1 1 and all the codewords can be obtained by applying successive cyclic shift of coordinates to a generator codeword: see Chapter 8 in [3]. The cyclic code is said to have relative distance 6, if any two codewords differ in at least ōd coordinates. Let с = (c1, . , ca) be the generator codeword. Consider a random input-label pair (X, with X (Xp, XI.... X2) taking values in R4+1 and Y taking values in 1-1,1), generated as follows. The class label Y takes value =1 with probability 1/2 each. Xg Y y takes value y with probability p and -y with probability 1 1-p P, for some p 2 1/2. The remaining coordinates are independent and normally distributed with X, Y y as (2ccyy/ Vd, for 1 S < d. Let be an integer divisor of d, and let (zxx) denote the cyclic shift of mj coordinates applied to (I1, T2......., Ta) while keeping To unchanged, i.e., rz(x) = cyelic permutation of pixels with m = d/4 and the center pixel Zo being fixed. Now let r(x) denote a random permutation that takes value ry rz)),, uniformly at random over j E {1,2.... d/m}. For example, using m = d/4 as above, r r(x) can model a random multiple of 909 rotation.
(Fu, Emj+1, Tmj-2. ................................ Fd. 21: ..... Zmj). ). For example, a 909 rotation can be considered
First, we show that achieving high degree of spatial robustness on the above distribution is non- trivial even if we have high accuracy on the original data without any transformations. So our subsequent trade-off between spatial and adversarial robustness cannot be derived from previously known trade-offs between accuracy and adversarial robustness 43
Proposition There exists p 2 1/2 and a cyclic code with relative distance 6 2 3/8 such that given the input distribution defined as above, the classifier of maximum accuracy input (X, Y) has accuracy at least 97%. Similarly, the classifier of maximum accuracy on the transformed input (r,(X),Y Y) also has accuracy at least 97%. However, when the classifier of maximum accuracy (X is applied to (r,(X,,Y) Y,, for any j. it has accuracy at most 85%.
Next we show that if we have a classifier of high adversarial robustness on the above data distribution, then it must have low spatial robustness and vice versa. The proof of this follows from previously known accuracy vs robustness trade-off by Tsipras et al. [3). However, their distribution invariant to any permutation of the coordinates 2 T2,..... Fd, so the accuracy and the spatial robustness are equal for their distribution.
Theorem 2. Given the input distribution defined as above, any 1j > O and any classifier f RRd+1 > 1-111, if the adversarial accuracy of f is at least 1 17, then the spatial accuracy of f is at most Similarly, if the spatial accuracy of f is at least - r then the adversarial accuracy f is at
np
(1 - p)
most 1 (1 p1 n)
P
The above results show that adversarial and spatial robustness not just be high simultancously. We do not explicitly model the effect of adversarial training with larger foo perturbations but, as a reasonable proxy, consider the increase in the adversarial accuracy for fixed perturbation bound. A tighter analysis of Theorem towards a gradual trade-off between spatial and adversarial robustness is presented in the supplementary.
4 Empirical Analysis
Experimental Setup. In order to study the effect of spatial transformations (e.g. rotations, trans- lations) and adversarial perturbations (c.g. Projected Gradient Descent or PGD attacks), we use well-known popularly used NN architectures well as state-of-the-ar networks known to have strong invariance [8], as well as networks which are known to have strong robustness (2 49 We study the spatial vs adversarial robustness trade-off using well-known architectures (described below) on MNIST, CIFAR1O, CIFAR100 and Tiny ImageNet datasets. Our code is made available for reproducibility.
Spatially Robust Model Architectures: StdCNNs are known to be translation-equivariant by design, and GCNNs [8] are votation-equivarin by design through clever weight sharing 255) Equivariant models, especially GCNNs, when trained with random rotation augmentations have been observed to come very close to being truly invariattn [8] 9 7 (or spatially robust in our context). We

---

hence use both StdCNNs and equivalent GCNNs trained with suitable data augmentations for our studies with spatially robust architectres. In particular, for each StdCNN we use, the corresponding GCNN architecture is obtained by replacing the layer operations with equivalent GCNN operations as in 8 For the StdCNN, we use a Conv-Conv- Pool-Cov--Con- Poon-Pol--CC-CC architecture for MNIST (more details in the supplementary); VGG16 [36] and ResNet18 8 [9] for CIFARIO and CIFAR100; and ResNet18 for the Tiny ImageNet dataset.
Adversarially Robust Model Architectures:
For adversarial training, we use a LeNet-based architec- ture for MNIST and ResNet- baseed architecture for CIFARI Both these models are exactly as given in [29] For CIFARI00, we use the popularly used WideResNet- 34 architecture also used in 49
We use ResNet18 [19] for the Tiny ImageNet dataset.
Training Data Augmentation: Spatial: (a) Aug R Data is augmented with random rotations in the range + given 0, along with random crops and random horizontal flips (for MNIST alone, do not apply crop and horizontal flips); (b) Aug T: Data is augmented with random translations within
[-i,+i] range of pixels in the image, given (eg. for CI with i 0.1 is 32 0.1 x =3pr) in both horizontal and vertical directions; (c) Aug RT: Data is augmented with random rotations in ií 180 and random translations within [-ł, +-] range of pixels in the image (eg. for CIFARIO IO with i - 0.1 is 0.1 * 180 = 188 rotation and 32 * 0.1 R +3pp translation). here no cropping and no horizontal flip is used. We use nearest neighbour interpolation and black filling to obtain the transformed image. Adversarial: : Adv PGD: Adversarial training using PGD (GDDpeeturbed adversarial samples using an e-budget of given e. Our experiments with PGD use random start, 40 iterations, and step size 0.01 on MNIST, and a random start, 10 iterations, and step size 2/255 on CIFAR 10, CIFAR 100 and Tiny ImageNet. While we study the trade-off under fixed PGD setting our trend holds even with different PGD hyperparameter settings. Refer supplementary [ for details. Our results, presented in the next section, are best understood by noting the augmentation method mentioned in the figure caption. For example, in Fig [a), the augmentation scheme used is Aug-R. The red line (annotated as 60 in the legend) corresponds to the model trained with random rotation augmentations in the range -0
Hardware Configuration: We used a server with 4 Nvidia GeForce GTX 1080i GPU to run all the experiments in the paper.
Evaluation Metrics: We quantify performance using a spatial invariance profile and adversarial robustness profile.
Spatial invariance:
We quantify rotation invariance by measuring the rate of invariance or the fraction of test images whose predicted label remains the same after rotation by a random angle between -0000%) As 0 varies from 0 to 180, we plot the rate of invariance. We call this the rotation invariance profile of a given model. Similarly, by training a model with other augmentation schemes given above, obtain translation invariance profile and a for a given model.
invariance profile
Adversarial robustness: Similarly, we quantify the for adversarial robustness of a given model to a fixed adversarial attack (e-g.. PGD) and fixed Eo norm e E [0, 1] by (1 fooling rate), i.e., the fraction of test inputs for which their predicted label does not change after adversarial perturbation. We plot this for varying from 0 to We call this the robustness profile of a given model. (One can also choose accuracy instead of - fooling rate and we observe similar trends, as shown in the supplementary. We use - fooling rate for clearer visual presentation of our main results.)
Results. We now present our results on spatially robust model architectures followed by adversarially robust ones.
Results on Spatially Robust Model Architectures: Fig present our results on the trade-off on ad- versarial robustness for VGG16, trained with spatial augmentations, on CIFAR1O. (More results including ResNet18 on CIFAR10, model on MNIST are deferred to the supplementary owing to space constraints.)
8 on CIFAR 100 and the StdCNN/GCNN-base
hhtps://githu..coo///ee http://hww.....mmaaaaaaaaaaannna
p hherps///itthubbbc "hanps//ggthuh.cco//Maaalilllll http:/hhhww.acmm//aaaaaaaaaaaaaa _aalllncccaaeeeeae
5

---

(8)
(b)
(d)
(c)
183
(f)
(g)
(h)
fpates
(m)
(n)
(0)
(p)
Todallin Tange
Cpal
Figure 1: On CIFAR10, For VGG16 model (a-b) Aug R StdCNN, (c-d) Aug R GCNN, (e-f) Aug T StdCNN, (g-h) Aug T GCNN, (i-l) Aug RT StdCNN, (m-p) Aug- invariance profiles of StdCNN/GCNN models and corresponding robustness profiles.
For any fixed E [0, 180], we take an equivariant model, namely, StdCNN or GCNN, and augment its training data by random rotations from [-0-, +++]. For example, Fig I show how the robustness profile of StdCNN changes of the model. We use PGD attack provided in versions of AdverTorch [T] to obtain the robustness profiles. Similarly, Figs T a) show the rotation invariance profile of the same models on CIFAR 10. The black line in Dib) shows that the adversarial robustness of StdCNN which is trained to handle rotations up +180 degrees CIFAR10, drops by more than 50%, even when the budget for PGD attack is only 2/255. Similarly, the black line in Fig T(a) shows this model's 's rotation invariance profile this model invariant larger rotations depicted by the red line this StdCNN is trained to handle rotations up to 60 degrees. The rotation invariance profile of this model below that of the model depicted by the black line and hence is to
CIFAR 10,
increase the degree used in training augmentation
test data. This be contrasted with the model
lesser invariant to large rotations. However, this model can handle ad adversarial for Se--erturbations 2/255 on unrotated data, with an accuracy more than 10%, seen from the red line in Fig [ The remaining plots in Figs T show similar trends for translation, as well as combination of rotation and translation (e.g. plots (e-p) in [ for CIFAR10) for both StdCNN and GCNN models (e.g. Figs [e.d).
The above results show that the spatial robustness these models improves by training augmentation but at the cost of their adversarial robustness, indicating a trade-off between spatial and adversarial robusiness. This trade-off exists in both StáCNN and GCNN models.
Results on Adversarially Robust Model Architectures: Fig presents our results on the trade-off on spatial robustness for models trained adversarially using PGD (29 MNIST, CIFAR10 and CIFAR 100 datasets. Each row corresponds to experiments for a single dataset with a plot of robustness profile (for which they trained) followed by the spatial invariance profiles. Each colored line in the plots corresponds to a model adversarially trained with a different value of an e-budget.
On MNIST, adversarial training with PGD with larger results in drop in the invariance profile of the LeNet-based model; in Fig (b-d), the red line (PGD with 0.3) is below the light blue line (PGD with e = 0.1). Similar observations hold for the ResNet model on CIFAR10 (see Fig 2 (f-h)), as well as for WideResNet-34 on CIFAR 100 (see Fig (D)) To complete this picture, the robustness profile curves confirm that as these models are trained with PGD using larger budget,

---

their adversarial robustness increases. The robustness profile curves of the LeNet model trained with a larger PGD budget dominates the robustness profile curve of the same model trained with smaller PGD budget; the red line in Fig 2 a) dominates the light blue line. This is true of the ResNet model too, as in Figs e) in)
In other words, adversarial training with progressively larger e leads to a drop in the rate of spatial invariance on test data. Fig shows an additional result with StáCNN (VGG-16) with PGD-based adversarial training on CIFARIO. These results too support the same findings.
(8)
(b)
(C)
(d)
Apilas
KT mndtteeragg
(e)
(f)
(g)
(h)
0.25
0225
2.235
2235
2255
2755
rang
(1)
(
(k)
18253
(2253
3251
2.255
2225
2225
2225
3253
40155
Epulan
Dotasssaang Targe
Figure 2: Adv PGD. (1) Robustness, (2) Rotation, (3) Translation, (4) Rotation-Tranen Translation invariance profiles for PGD adversarially trained models. (a-d) LeNet based model from 22 on MNIST (e-h) ResNet based model from 129 on CIFARIO, (i-l) WideResNet34 model on CIFARIO0. Different colored lines represent models adversarially trained with different too budgets e [0, 1].
(b)
(c)
0235
3:25
4.255
4/255
4/255
4/55
0255
CB)
Figure 3: On CIFARIO, - PGD, For StdCNN/VGG16 model (a) Robustness profile, (b) Rotation invariance profile, (c) Translation invariance profile (d) Rotation-Translaln invariance profile. Different colored lines represent models adversarially trained with different lor budgets e E [0, 1].
Results on Tiny ImageNet: Appendix studies both adversarial robustness of spatially robust models, as well as spatial invariance of adversarially robust models on the Tiny ImageNet dataset. Our observations mentioned so far holds here too, corroborating our claim that this trade-off is not merely theoretical but noticed in real-world datasets too.
Going beyond PGD-bbsed Adversarial Training: sarial training for the study of robust models in all the results so far, we conduct experimental studies with another recent popular adversarial method, TRADES [4]. Fig 4 shows the results of these studies on CIFARIO, where we observe the same qualitative behavior of the models.
While we have used the popular PGD-based adver-
Additional Empirical Evidence (Average Perturbation Distance to Boundary): While more results and implementation details are provided in the supplementary section, we briefly provide an inter- esting evidence to our claims based on the average distance to the decision boundary (details in Appendix D. We notice that there is a distinct reduction in the distance to decision boundary as model achieves better spatial invariance (Figure 5). This reduction in distance can be linked to the drop in adversarial robustness. Such study also has the potential to be used to study trade-offs the presence of other common corruptions 21 22 20).
7

---

(0)
(b)
(d)
0:23
0255
3G55
0223
4235
0.330
0223
0220
8250
Figure 4: On CIFARIO, Adv TRADES, For ScdCNW/WideResNees/ model (a) Robustness (b) Rotation invariance, (c) Translation invariance (d) Rotation-Translatio invariance profiles. Different colored lines represent models adversarially trained with different to budgets E [0, 1].
S4BCMM Lenditted
02MM unviiteed ledd
54/130 ueamoited
OCVR ureriiteted
(5)
(c)
oangell sison 200
(3)
Aage sitn sartid sggeradd min
Iiiped andon Sarsic Noteraddt
Figure 5: Average perturbation distance of StdCNN/GCNN on (a-b) (bsSe on appendix Table 2) (c-d) CIFARIO(VGG16) wrt unrotated test data.
5 Curriculum Learning- Approach for Pareto-Optimality
The progressive nature of the trade-off between spatial invariance and adversarial robustness elicits the need to study training methods that can simultaneously achieve robustness on both of these fronts. In this section, we propose a curriculum learning- basen training strategy that consistently provides models close to the Pareto-optimal frontier of the trade-off. An obvious strategy to obtain both kinds of robustness would be to sequentially combine adversarial training and augmentation by spatial transformations. i.c., take an adversarially trained network and re-train it with spatial (e.g., rotation) augmentation, vice versa (Appendix K. We however observe that such a strategy presents version of catastrophic forgetting where the robustness learned earlier is forgotten when the other robustness is enforced. A model thus trained has either good spatial robustness good adversarial robustness but not both. We hence explore a curriculum learning strategy to this end.
Curriculum learning is inherently inspired by how humans learn; first learning simple tasks and then followed by gradually difficult tasks 4. Previous work has demonstrated its effectiveness training DNN models 44 [8]. A purriculum-based adversarial training has also been proposed [6] which however focuses only on adversarial robustness. For simultaneous spatial and adversarial robustness, we propose CuSP (Curriculum based Spatial-Adversarrti Robustness training for Pareto-Optimality) where the difficulty of spatial augmentation and adversarial strength is gradually increased each time the learning rate is updated as part of a schedule. In particular, each time the learning rate is updated, we increase the spatial augmentation range [-00, 0'] as well as the adversarial perturbation bound and adversarial train randomly perturbed input within that range. This strategy reflects an optimization procedure where the difficulty of robustness handled by the model is increased when the model treads more slowly (lower learning rate) along areas of the loss surface. The outline of the proposed CuSP approach (Curriculum based Spatial-Adversarr Robustness training for Oprimo-Optimality) is given in Algorithm 1
To study the goodness the proposed strategy, we look at three metrics: (a) spatial accuracy on large random transformations Pr (T = Y), where Tiso denotes a random rotation in the range [-180-, 180 (b) adversarial accuracy at large perturbations Pr (f(X + As/255 = =Y). where A8/255 denotes an adversarial attack (PGD or TRADES) of -orm bounded by e = 8/255, and finally, (c) natural accuracy on the unperturbed data Pr (f(X) = Y). The last one included for completeness because want better spatial and adversarial robustness simultaneously but not lose on natural accuracy in the bargain 43 49
Results: We studied CuSP across models and datasets in our experiments, and report the results of VGG16 on CIFARIO Ta]le The remainder of these results are presented in Appendix M We follow the learning rate schedule 75-90-100 100 as used in TRADES [9 where the learning rate starting
8

---

Algorithm 1: CuSP: Curriculum based Spatial Adversarial Robustness Training for Pareto-Optimalin
Input
:Training data (X, ))
Parameters No. of epochs: K, Learning rate: Adversarial training (AT) method: PGD or
TRADES, Range of spatial transformations: 01 S 02 S ... S Bt.
Adversarial perturbation bounds: c1 I C2 S Cx.
Learning rate schedule: 7) 122 > > 1
Output
:Model parameters &
Initialize model parameters Φ; i,J, +-1
0 < 0,,6 +- Ej
OK
3 for epochs 1, ...... E do
k k 1: T/ /* Change in learning rate schedule
then - i- 1: + j+ Update + 0, and E Egi
< AdversorialTrainnngg (To()) + Ac(To(X),n)
** Minimize loss on input randomly transformed within [-0, and an adversarial attack of norm at most
end
Training Method
Adv (PGD)
Std
Spatial
Accuracy( %))
Accuracy %
Accuracy( %))
Natural (Aug
00.05:10.06
0.33
33.99=0.54
Natural (Aug 180)
00.00
85.00
83.78=0.95
PGD (Aug 0)
44.88
80.08-10.55
33.07=00811
4
PGD (Aug 180)
32.79-+0073
54.60-+0.51
53.69=
PGD (Aug - Aug 180
00.00:10.00
85.46:10.25
83.99=0.44
Aug 180 > PGD (Aug 0)
4..80
81.03-+0.14
33.19=0.33
7
PGD (Aug 0) - PGD (Aug 180)
35.1
58.96++0.21
57.84-0.15
8
Aug 180 - PGD (Aug 180)
35.94-+0.35
60.27+00.39
59.02-00211
CuSP (PGD, 30-60-1880
0..63+0.111
65.92-40.35
53.31
785 255 255
10
CuSP (PGD, 60-1 120-180,
07.18+10.14
65.88
59.09=0.18
20g 250 25g
CuSP (PGD. 120-150-188
255
36.01=10.36
64.96
61.41=0.61
12
CuSP (PGD, 180, [ 755 255 255
33.63-L0.38
62.17
0.44
13
CuSP (PGD, 120-150-180,
1255
35.57:10.16
18.26
55.54
PGD (Aug 0) -
CuSP (PGD, 120-150-1800
36.92:10:28
66.25
62.51=0.12
255
255
255
15
Aug 180 ->
CuSP (PGD, 120-150-1880 { (555 255 253
37.16:10.12
66.58-10.12
63.04
Table 1: Comparison of performance of proposed CuSP for CIFARIO StdCNN/GG16 with other baseline strategies. (Aug 0): denotes training data augmented with random rotations the range --0,+0]: -> denotes a sequentially followed by during training. The top 7 values each column are in boldface.
with 0.1 decays by a factor of 0.1 successively at the 75-th, 90-th and 100-th epochs. Our algorithm works with given sets of values for 0 and and does optimize for the choice of these values. We empirically studied various combinations of (0, values as 0 varies over {0, 30, 60% 60",..,, 180} and varies over {0, 2/255, 4/255, 8/255]. While each of these options improves performance over the baselines, we found the list of = {120", 150%, 180%) to give the best results on this particular setting. We also include results for CuSP training after a warm start, viz., PGD with no augmentation and natural training with 180 +100% augmentation. rigure/ccompant against other baseline training strategies. visualized in the context of the Pareto frontier for PGD accuracy and spatial accuracy.
the performance of CuSP
Conclusions and Future Work
In this work, we present a comprehensive discussion on the trade-off between spatial and adversarial robustness in neural network models. While a few recent efforts have studied similar trade-offs, we study random spatial transformations in this work, which are more popularly used practice than any adversarial spatial transformations. We study the trade-off both theoretically and empirically, and

---

0.47
0.4
0.40
PGD Accuracy
78
PGD Accuracy
0.3
0:38
14
13
0.1
0.34
0.0
0.22
044
0.5
0.4
0.7
0.8
0.52
2.54
0.58
0.58
0.60
0.62
0.54
Spatial Accuracy
Spatial Accuracy
Figure 6: Visualization of performance of CuSP based PGD against other baseline strategies CIFARIO for StdCNN/VGGI 16 model (each index corresponds to row in Table []. On the left, we compare CuSP against various baselines. On the right, zoom in compare different variants of CuSP.
prove a quantitative trade-off between spatial and adversarial robustness in simple statistical setting used in earlier work. Our experiments show that equivariant models (StdCNNs and GCNNs) trained with progressively larger spatial transformations, their spatial invariance improves but at the cost of their adversarial robustness. Similarly, adversarial training with perturbations of progressively increasing norms improves the robustness of well-known neural network models, but with a resulting drop in their spatial invariance. We also provide curriculum learning-basse training method obtain a solution that is close to Pareto-optingg
in comparison to other baseline adversarial training methods. While CuSP gradually increases both the range of spatial transformation in the augmentation and the ad adversarial perturbation bound we conjecture that tuning these further with the learning rate schedule along with a warm start for model parameters could give further improvements. Recently, 122 20 have shown that study of other common corruptions is important in the study of state-of- the-art NN models. Similar studies between spatial invariance and such common corruptions an interesting direction of future work.
21
Broader Impact. Adversarial robustness is one of the most important problems in better understand- ing the functioning of neural networks. Another important problem is how networks can efficiently handle various spatial transformations like rotation, translation, etc. The trade-off studied and the algorithm proposed to find a better Pareto-optimal in this paper tries to understand the interaction between the two which natural question. Hence, we believe this study is towards better under- standing of the networks learning capability. There is no known detrimental social impact of our work.
Acknowledgements and Funding Transparency Statement. Sandesh Kamath would like to thank Microsoft Research India for funding a part of this work through his postdoctoral research fellowship at IIT Hyderabad.
References
[1] Michael A. Alcorn, Qi Li, Zhitao Gong, Chengfei Wang, Long Mai, Wei-Shinn Ku, and Anh Nguyen. Strike (with) a pose: Neural networks are easily fooled by strange poses of familiar objects. In The IEEE Conference Computer Vision and Pattern Recognition (CVPR), 2019.
[2] Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses adversarial examples. In Proceedings of the International Conference on Machine Learning (ICML), 2018.
[3] Mislay Balunovic, Maximilian Baader, Gagandeep Singh, Timon Gehr, and Martin Vechev. Certifying geometric robustness of neural networks. In Advances in Neural Information Processing Systems (NeurIPS), 2019.
[4] Yoshua Bengio, Jérôme Louradour, Ronan Collobert, and Jason Weston. Curriculum learning. In In Proceedings of the International Conference Machine Learning (ICML), 2009. 2009.
10

---

[5] Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Sinić, Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion attacks against machine learning time. Lecture Notes in Computer Science, 2013.
[6] Qi-Zhi Cai, Chang Liu, and Dawn Song. Curriculum adversarial training. In Proceedings of the Twenty-Seventh International Joint Conference on Artificial Intelligence, IJCAI-18, pages 9740-3747 International Joint Conferences on Artificial Intelligence Organization, 7 2018.
[7] Mario Cohen, Taco S. Geiger and Maurice Weiler. A general theory of equivariant cnns on homogeneous spaces. arXiv preprint
2018.
[8] Taco S. Cohen and Max Welling. Group equivariant convolutional networks. In Proceedings of the International Conference on Machine Learning (ICML., 2016.
[9] Taco S. Cohen and Max Welling. Steerable CNNs. In International Conference on Learning Representations (ICLR), 2017.
[10] Sander Dieleman, Jeffrey De Fauw, and Koray Kavukcuoglu. Exploiting eyclic symmetry in convolutional neural networks. In Proceedings of the International Conference on Machine Learning (ICML), 2016.
[11] Gavin Weiguang Ding, Luyu Wang, and Xiaomeng Jin. AdverTorch v0.1: An adversarial robustness toolbox based on pytorch. arXiv preprint arXiv:1902.07623. 2019.
[12] Logan Engstrom, Brandon Tran, Dimitris Tsipras, Ludwig Schmidt, and Aleksander Madry. Exploring the landscape of spatial robustness. In Proceedings of the International Conference on Machine Learning (ICML), 2019.
[13] Carlos Esteves, Christine transformer networks. In International Conference on Learning Representations (ICLR), 2018.
Xiaowei Zhou, and Kostas Daniilidis. Polar
[14] Kevin Eykholt, Ivan Evtimov. Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. In The IEEE Conference Computer Vision and Pattern Recognition (CVPR), 2018.
[15] Mare Fischer, Maximilian Baader, and Martin Vechev. Certified defense image transfor- mations via randomized smoothing. In Advances in Neural Information Processing Systems (NeurIPS), 2020.
[16] Robert Gens and Pedro M Domingos. Deep symmetry networks. In Advances in Neural Information Processing Systems (NeurIPS), 2014.
[17] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adver- sarial examples. In International Conference on Learning Representations (ICLR), 2015.
[18] Guy Hacohen and Daphna Weinshall. On the power of curriculum learning in training deep networks. In In Proceedings of the International Conference on Machine Learning (ICML), 2019.
[19] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In The IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2016.
[20] Dan Hendrycks, Steven Basart, Norman Mu, Saurav Kadavath, Frank Wang, Evan Dorundo, Rahul Desai, Tyler Zhu, Samyak Parajuli, Mike Guo, Dawn Song, Jacob Steinhardt, and Justin Gilmer. The many faces of robustness: A critical analysis of nut-of-distribution generalization. arXiv preprint arXiv:2006. 16241, 2020.
[21] Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. In International Conference Learning Representations (ICLR), 2019.
[22] Dan Hendrycks, Kevin Zhao, Steven Basart, Jacob Steinhardr, and Dawn Song. Natural adversarial examples. arXiv preprint 11XX:11907.0714,,2011

---

[23] Joern-Hente Jacobsen, Jens Behrmann, Richard Zemel, and Matthias Bethge. Excessive invari- ance causes adversarial vulnerability. In International Conference on Learning Representations (ICI.R) 2019.
[24] Guy Katz, Clark W. Barrett, David L. Dill, Kyle Julian, and Mykel J. Kochenderfer. Reluplex: An efficient smn solver for verifying deep neural networks. In CAV, 2017.
[25] Risi Kondor and Shubhendu Trivedi. On the generalization of equivariance and convolution in neural networks to the action of compact groups. In Proceedings of the International Conference on Machine Learning (ICML), 2018.
[26] Dmitry Laptev, Nikolay Savinov, Joachim M. Buhmann, and Mare Pollefeys. Ti-pooling: mansformation-innaaiin pooling for feature learning in convolutional neural networks. In The IEEE Conference on Computer Vision and Pattenn Recognition (CVPR), 2016.
[27] Junying Li, Zichen Yang, Haifeng Liu, and Deng Cai. Deep rotation equivariant network. arXiv preprint arXiv: /705.0863.. 2017.
[28] Linyi Li, Maurice Weber, Xiaojun Xu, Luka Rimanic, Tao Xie, Ce Zhang, and Bo Li. Provable robust learning based on transfornation-speeiiic smoothing, 2020.
[29] Aleksander Madry, Aleksandar A Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Confer- ence on Learning Representations (ICLR), 2018.
[30] Diego Marcos, Benjamin Kellenberger, Sylvain Lobry, and Devis Tuia. Scale equivariance in cnns with vector fields. arXiv preprint arXiv: /807. 1783, 2018.
[31] Diego Marcos, Michele Volpi, Nikos Komodakis, and Devis Tuia. Rotation equivariant vector field networks. In International Conference on Computer Vision (ICCV), 2017.
[32] Jeet Mohapatra, Tsui-Way Weng, Pin- Yu Chen, Sijia Liu, and Luca Daniel. Towards verify- ing robustness of neural networks against family of semantic perturbations. In The IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2020.
[33] Seyed-Mohsen Dozsavi- Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2016.
[34] Ron Roth. Introduction to Coding Theory. Cambridge University Press, 2006.
[35] Anian Ruoss, Maximilian Baader, Mislav Balunović, and Martin Vechev. Efficient certification of spatial robustness, 2021.
[36] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint /rX9 1556, 2014.
[37] Aman Sinha, Hongseok Namkoong, and John C. Duchi. Certifying some distributional robust- ness with principled adversarial training. In International Conference on Learning Representa- tions (ICI.), 2018
[38] Ivan Sosnovik, Michal Szmaja, and Amoll Smeulders. Scale- equivvqquivrriant steerable networks. In International Conference on Learning Representations (ICLR), 2020.
[39] Christian Szegedy, Wojciech Zaremba, llya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.
[40] Rohan Taori, Achal Dave, Vaishaal Shankar, Nicholas Carlini, Benjamin Recht, and Ludwig Schmidt. Measuring robustness to natural distribution shifts in image classification. In Advances in Neural Information Processing Systems (NeurIPS), 2020.
[41] Florian Tramèr, Jens Behrmano, Nicholas Carlini, Nicolas Papernot, and Jörn-Henrik Jacobsen. Fundamental tradeoffs between invariance and sensitivity to adversarial perturbations. In Proceedings of the International Conference on Machine Learning (ICML), 2020.
12

---

[42] Florian Tramèr and Dan Boneh. Adversarial training and robustness for multiple perturbations. In Advances in Neural Information Processing Systems (NeurIPS). 2019.
[43] Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry, Robustness may be at odds with accuracy. In International Conference on Learning Representations (ICLR), 2019.
[44] Daphna Weinshall, Gad Cohen, and Dan Amir. Curriculum learning by transfer learning: Theory and experiments with deep networks. In In Proceedings of the International Conference Machine Learning (ICML), 2018.
[45] D. E. Worrall, S. J. Garbin, D. Turmukhambetov, and G. Brostow. Harmonic networks: Deep translation and rotation equivariance. arXiv preprint arXiv:1612.04642, 2016.
[46] Daniel Worrall and Max Welling. Deep scale-spaces: Equivariance over scale. Advances in Neural Information Processing Systems, 2019.
[47] Chaowei Xiao, Jun- Yan Zhu. Bo Li, Warren He, Mingyan Liu, and Dawn Song. Spatially transformed adversarial examples. International Conference on Learning Representations (ICLR), 2018.
[48] Yao-Yuan Yang, Cyrus Rashtchian, Hongyang Zhang, Russ Salakhutdinov, and Kamalika Chaudhuri. A closer look at accuracy vs. robustness. In Advances in Neural Information Processing Systems (NeurIPS), 2020.
[49] Hongyang Zhang. Yaodong Yu, Jiantao Jiao, Eric P. Xing. Laurent Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. In In Proceedings of the International Conference on Machine Learning (ICML), 2019.
13


Reviews:
[{"review_id": "t9w4yDvOaeD", "reviewer": "Reviewer_YXLX", "summary": "The authors study the trade-off between spatial (translation and rotation) robustness and adversarial robustness. They show theoretical proofs and empirical evidence that two properties may be at odds with each other. A curriculum lraining based method is proposed to mitigate the problem.", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "[Theoretical results]\n\nThe theoretical results are interesting but not substantial. The authors study the bayes optimal classifier in a simple setting and show that spatial robustness is non-trivial to achieve and high adversarial accuracy leads to low spatial accuracy. However, the low spatial accuracy is mostly due to the decrease in the standard accuracy. To see this, since the authors consider the average-case spatial robustness which depends on the accuracy of both translated and original data, the accuracy on the original data play a larger role when the number of possible translations is smaller, i.e. $m$ is larger, which is exactly when Theorem 2 supports the claim. This also can be seen in the proof (line 566) where the authors bound the accuracy of the translated data to be 1. In general, the setting with $m=1$ might be more practical and hence interesting as it considers all the possible translations.\n\n[Experiments]\n\nThe authors train stdCNNs and GCNNs with different levels of data augmentation to achieve different levels of spatial / adversarial robustness. The results seem to support the claim on the trade off between two robustness but only in a sense of correlation rather than causality. For example, the observation that the larger translation robustness and worse adversarial robustness can be both attributed to the stronger data augmentation [1, 2]. A more convincing proof needs more carefully controlled factors, for example, the authors may consider models with inherently different levels of spatial robustness like fully connected networks and ViTs [3].\n\nSometimes slightly improving the spatial robustness improves the adversarial robustness, e.g. Fig. 7 (f, h, p), which seems to be at odd with the claim.\n\nMinor - Figure 7 caption: \"(m-p) Aug - RT\" --> \"(m-p) Aug - RT GCNN\".\n\n[Originality]\nThe proposed curriculum lraining based method is novel and interesting. There is an ongoing discussion on the trade-off between spatial and adversarial robustness and it might be interesting to discuss the relationship to these works [4, 5].\n\n[1] Chen, Lin, et al. \"More data can expand the generalization gap between adversarially robust and standard models.\" International Conference on Machine Learning. PMLR, 2020.\n\n[2] Rebuffi, Sylvestre-Alvise, et al. \"Fixing data augmentation to improve adversarial robustness.\" arXiv preprint arXiv:2103.01946 (2021).\n\n[3] Shao, Rulin, et al. \"On the adversarial robustness of visual transformers.\" arXiv preprint arXiv:2103.15670 (2021).Shao, Rulin, et al. \"On the adversarial robustness of visual transformers.\" arXiv preprint arXiv:2103.15670 (2021).\n\n[4] Ge, Songwei, et al. \"Shift Invariance Can Reduce Adversarial Robustness.\" arXiv preprint arXiv:2103.02695 (2021).\n\n[5] Kamath, Sandesh, Amit Deshpande, and K. V. Subrahmanyam. \"Invariance vs Robustness of Neural Networks.\" (2019).\n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "The authors discuss the societal impact. I didn't see any section / paragraph of the discussion on the limitations of the work.", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "6"}, "extra_text": {}}, {"review_id": "cMOP0BgF-dq", "reviewer": "Reviewer_h24y", "summary": "The work presents a comprehensive discussion on the trade-off between spatial robustness (robust against spatial transformations like rotation, translation, etc) and adversarial robustness (robust against adversarial attacks) in neural network models, by proving the phenomenon theoretically and justifying it empirically. The experiment results show that the model trained with better spatial robustness via equivariant models and larger training augmentation has worse adversarial robustness, and vice versa. To improve both robustness, the authors designed a curriculum learning-based approach where the difficulty of spatial augmentation and adversarial strength is gradually increased during training.", "questions": "", "limitations": "", "rating": 7, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "- Originality: The work discussed a very interesting phenomenon, which looks counterintuitive at first sight but is actually justifiable. The related works are cited in the introduction section. There is no related work section. I am not familiar with this field, so I cannot comment on if related work is adequately cited.\n\n- Quality: The work is technically sound. The claims are well supported by theoretical analysis and empirical results. \n\n- Clarity: The work is clearly written, and the theoretical analysis and empirical results are well organized. The table and figures are easy to follow. The theoretical results are a little difficult to understand, especially for people like me who are not familiar with the cyclic codewords setting. It would be better to add some figure to show the setup of the theoretical analysis. \n\n- Significance: The results for justifying the trade-off between two types of robustness are clear and significant. The results for the performance of the proposed curriculum learning algorithm (Table 1) are not that clear to me. It seems the proposed method achieves better spatial accuracy than PGD, but worse adversarial accuracy than Aug 180 -> PGD.  So I am not sure if you can claim that the proposed method improves both types of robustness (Abstract).  Moreover, as justified in the first part of the paper, there is always a trade off between the two types, so even with the proposed curriculum learning method, it should not achieve the improvement for both.\n\n\nUpdate: Thank the authors for answering to my questions. I keep my rating. I would suggest the authors incorporate the new results into the final version. ", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "Yes, the authors addressed the limitations and societal impact.", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "3"}, "extra_text": {}}, {"review_id": "VAGYHq8WPXz", "reviewer": "Reviewer_Uu2b", "summary": "This paper explores the trade-off between (1) average-case robustness to translation and rotations and (2) adversarial robustness. The paper shows through extensive experiments and a theoretical example that the trade-off occurs, and they show that curriculum learning can lead to a reasonable trade-off that achieves some degree of both types of robustness.", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Overall, the paper is clear and well-written, and has mostly solid supporting experimental evidence. Thus, the quality and clarity of the work is high. On the other hand, the originality and significance is more limited, but I feel that it is still interesting. Thus, I would recommend a weak accept for this paper.\n\nThis paper explores the question of whether or not robustness to random translations and rotations (“spatial robustness”) can be achieved while also achieving adversarial robustness, and the authors show in a specific theoretical construction that the answer is “no” -- that is, there exists a distribution on which a classifier of high adversarial robustness necessarily has relatively low spatial robustness. They then show experimental evidence that when optimizing purely for adversarial robustness (via standard PGD-adversarial training), spatial robustness decreases, and vice versa. In particular, they measure metrics that are reasonable, such that all models start at the same value for that metric and performance degradation occurs only after the adversarial epsilon (or the amount of rotation/translation) is increased. The results are presented in a fairly clear and logical manner, and the experiments are relatively comprehensive, covering multiple datasets and a few different models and architectures.\n\nThe authors also show that a simple curriculum-learning approach can lead to relatively high adversarial robustness and spatial robustness; I am not too sure of the significance of this, as I do not know if optimizing for this combination of robustness (as opposed to, say, adversarial robustness and common corruption robustness) is particularly useful for any specific downstream task. However, understanding how different types of robustness in general can be mixed with each other is valuable, so I do think it is still interesting.\n\nI do have some more minor questions/clarifications/suggestions for the authors to improve their work.\n\n1) Can you also include evaluation results for adversarial spatial robustness? For example, it might be interesting to know how well the curriculum-learned models perform when faced with adversarial rotations/translations -- does it still work well?\n2) Around L105-113: What is an example of a truly invariant model, vs. a model that is invariant for most inputs but not all x?\n3) L236 - when you measure adversarial robustness using PGD, are you still using the same number of PGD-attack steps as during train-time? Usually, it is better to use a greater number of attack steps (e.g. 100 steps instead of 10 steps for CIFAR) when evaluating test-time adversarial robustness, as sometimes PGD attacks are still relatively weak without more attack-steps.\n4) L244 - in general, are there significant differences between StdCNNs/GCNN’s, or different architectures? From my inspection of Figure 1, the overall trends seem similar.\n5) Table 1 - Have you also tried PGD (Aug 0) -> PGD (Aug 180), or Aug 180 -> PGD (Aug 180)? Those both seem like more natural ways to try to achieve both types of robustness, as opposed to completely ignoring one type of robustness during the second phase of training.\n6) Figure 6 - it seems that the curriculum learning helps a little bit, but not too much, relative to something simpler like PGD (Aug 180). Could this relatively minor difference just be a result of the learning rate schedule, for example? That is, is it possible that the curriculum learning step is not actually necessary?\n\n\n\n------------\nUpdate: The authors responded to my questions and also performed new experiments, which had results that still support their original conclusions (and also, the new experiments seem to get even better numbers than the original experiments in the paper).\n\nThus, I still believe that the paper should be accepted, and I would encourage the authors to add some of the updated experimental results into their paper for completeness.\n\n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "The authors have addressed the societal impact of their work.\n", "review_text": "", "extra_scores": {"ethical_concerns": "None.", "needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "3"}, "extra_text": {}}, {"review_id": "0k8dCXy60Q", "reviewer": "Reviewer_wu4B", "summary": "This paper studies the properties of spatial and adversarial $\\epsilon$-bounded robustness of convolutional neural networks. Throughout the paper, the authors focus on __random__ spatial transformations, as opposed to __targeted__ (adversarial) rotations/translations. Their key hypothesis is that spatial robustness and adversarial $\\epsilon$-bounded robustness are inimical to each other, and increasing one must be at the cost of decreasing the other.\n\nThey derive theoretical results for a specific distribution, and derive upper and lower bounds for the spatial robustness of an adversarially trained network on this distribution. They also show that high accuracy on the original data does not imply high spatial robustness.\n\nThrough a set of elaborately designed experiments, they provide empirical evidence for their main hypothesis. Finally, they propose a curriculum-learning based approach to find a pareto-optimal solution that achieves the optimal trade-off between the two types of robustness.", "questions": "", "limitations": "", "rating": 7, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "**High-level comments :**\n\nThe paper is nicely structured, and the experiments are thorough. Overall, it provides compelling evidence for the hypothesis that there is a trade-off between the two notions of robustness. The theoretical results provide support for the main hypothesis, although I have not checked the proof of Theorem 2 in detail.\n\n**Questions :**\n\n1. Do you think a similar trade-off holds for the worst-case spatial robustness? That is, choosing a custom rotation/translation for each image and neural network, using an approach like in [1].\n\n2. It would be nice if you could do one experiment with more than 10 iterations of PGD on CIFAR-10. Unless PGD converges, it is sometimes difficult to draw definitive conclusions from the results.\n\n3. I am slightly confused about the role of $m$ in the theoretical analysis. If all the coordinates (other than $x_0$ are identical), then how does shifting by different amounts correspond to a greater or lesser degree of transformation? For example, couldn’t one just re-number the coordinates without changing anything (modulo the choice of code word)?\n\n**Minor remarks :**\n\n1. Line 63 - “First, we show that spatial robustness on the above distribution is non-trivial...”. This is confusing because at first glance it seems like “the model has spatial robustness to some non-trivial extent”, which is actually the opposite. I would re-word it as “First, we show that achieving a high degree of spatial robustness on the above distribution is non-trivial…”.\n\n2. In Proposition 1, could you qualify the meaning of $j$ in both mentions of $r_j$? For instance, “...$(r_j(X), Y)$ for any $j$ also has accuracy at least 97%.”\n\n3. Could you add a row in Table 1 for a standard model trained without PGD or augmentation?\n\n**References :**\n\n1. Xiao, Chaowei, et al. \"Spatially transformed adversarial examples.\" 6th International Conference on Learning Representations, ICLR 2018. 2018.", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "I do not see any possible negative societal impact arising from this paper.", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "6"}, "extra_text": {}}]

Author rebuttal:

Meta-review: This work studies tradeoffs between robustness to translations (spatial robustness) and robustness to worst case lp-perturbations (adversarial robustness). First the authors mathematically construct distributions for which tradeoffs between these two forms of robustness provably exist. Then the authors present a series of empirical studies showing that the tradeoff occurs in practice, and methods towards achieving pareto optimality. Reviewers were overall supportive of acceptance, noting that the empirical experiments presented were particularly interesting and well executed. There was a long discussion during the rebuttal period regarding Theorem 2. For the distribution in question, a tradeoff between spatial and adversarial robustness follows as a direct consequence from a tradeoff between adversarial robustness and standard accuracy (which has been shown already theoretically for some distributions in prior work). Reviewers agreed that the original text did not make it clear that this weaker bound followed from the standard accuracy - robustness tradeoff, or how Theorem 2 strengthened upon this weaker bound. However, even with this issue reviewers agreed that the experimental results were arguably interesting enough to warrant publication. After follow up discussions between the AC and the authors, the authors have agreed to rework this section to make the weaker bound explicit (and better discussion on how it follow from  the standard accuracy / adv robustness tradeoff) while highlighting how their construction strengthens this result. With these changes in mind, the paper seems ready for publication.
Decision: Accept (Poster)