Why Do Artificially Generated Data Help Adversarial Robustness
Authors: Yue Xing
Qifan Song
Guang Cheng
Venue: NeurIPS 2022 Accept (2022)
Keywords: adversarial robustness
unlabeled data
semi-supervised learning

Abstract: In the adversarial training framework of \cite{carmon2019unlabeled,gowal2021improving}, people use generated/real unlabeled data with pseudolabels to improve adversarial robustness. We provide statistical insights to explain why the artificially generated data improve adversarial training. In particular, we study how the attack strength and the quality of the unlabeled data affect adversarial robustness in this framework. Our results show that with a high-quality unlabeled data generator, adversarial training can benefit greatly from this framework under large attack strength, while a poor generator can still help to some extent. To make adaptions concerning the quality of generated data, we propose an algorithm that performs online adjustment to the weight between the labeled real data and the generated data, aiming to optimize the adversarial risk. Numerical studies are conducted to verify our theories and show the effectiveness of the proposed algorithm.

Why Do Artificially Generated Data Help Adversarial Robustness?
Yue Xing Department of Statistics
Qifan Song
Guang Cheng Department of Statistics University of California, Los Angeles guangcheng@ucla. edu
Department of Statistics Purdue University gfsong@purdue. edu
Purdue University xing49@purdue edu
Abstract
In the adversarial training framework of Carmon al. (2019); Gowal et al. (221) people use generated/real unlabeled data with pseudolabels to improve adversarial robustness. We provide statistical insights explain why the artificially generated data improve adversarial training. In particular, we study how the attack strength and the quality of the unlabeled data affect adversarial robustness this framework. Our results show that with a high-quality unlabeled data generator, adversarial training can benefit greatly from this framework under large attack strength, while a poor generator can still help to some extent. To make adaptions concerning the quality of generated data, we propose an algorithm that performs online adjustment to the weight between the labeled real data and the generated data, aiming to optimize the adversarial risk. Numerical studies are conducted to verify our theories and show the effectiveness of the proposed algorithm.
Introduction
Adversarial training a popular and simple way to improve the adversarial robustness of modern machine learning models. There are fruitful results in the theoretical justification and methodology development. Among various research directions, one interesting aspect to use unlabeled data to assist adversarial training. Recent works successfully demonstrate a great improvement in the adversarial robustness with additional unlabeled data. For example, Carmon al. (211); Xing et al.
b2021b 2022), show that additional external real data help improve adversarial robustness; Gowal al. (2021) uses synthetically generated data to improve the adversarial robustness and achieves the highest 66% adversarial testing accuracy for CIFAR-10 dataset under AutoAttack (AA) in Croce et al. 2200 in the literature. The algorithms utilizing real/generated unlabeled data in adversarial training in Carmon et al. (2019); /00w): et al. (202T) are summarized in Figure I Note that to unify the these two algorithms, we view the unlabeled real data used in Carmon et al. (2019) as synthetic data generated from ideal generator.
However, two fundamental questions about utilizing additional unlabeled data remain unclear.
First, as shown by Carmon et al. (201)) unlabeled data provide more information about the density of the data near the decision boundary, leading to the robust test accuracy of CIFAR- from 53.08% to 59.53% for 8/255 C. attack). However, the performance improvement of this training strategy is limited when the attack strength is small zero Therefore, it is natural to ask
robust adversarial estimator (e.g., it increases
Q1: Compared clean training, why and how adversarial training significantly benefit from unlabeled data under the framework of Figurel T
httpe://rrobustbench github.15
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

S2: real/generated data with imputed label dog
$1: real data (xy)
Clean Class fier
Gowal et al.
Carmon et. al. (Ideal deneratory
Robust Classifier
Generator of
Figure 1: The procedure to do adversarial training with real/generated data. In Carmon al. 2019 a clean classifier is trained to impute the label for additional real unlabeled data to form S2. In Gowal al. (02T), the clean classifier and the unlabeled data generator trained via clean training form S2. Obtaining S2, we use both S₁ and S2 in the adversarial training. To unify the two algorithms, we call the unlabeled real data in Carmon al. (2019) as data generated from ideal generator.
Generator cost
Cross
terms
Label cost
Ideal generator
Good generator
Poor generator
B|(((c)
0.1
(e) /2
The excess adversarial risk ER(0, c) R(O,.c) c) Elje 0e 1/3../2 + o for f E {0(c),((c) for some E.. Ideal/good/poor generator refers to the unlabeled data generator (Pa). If ny is finite, the label cost gets smaller because we use less noisy-label samples, but the generator cost gets larger because a smaller sample size gives larger estimation variance.
Figure 2: Exact risk decomposition of ((c) and 0(c) when n2
Second, besides the ideal generator in Carmon et al. (2019), Gowal et al. (202T) observe two other interesting phenomena regarding the quality of the generated unlabeled data. When the unlabeled data are generated from a generative model trained from original labeled data, although they introduce no more information beyond the original labeled data, the adversarial robustness gets enhanced. On the other hand, they also generate synthetic data from multivariate Gaussian, which is much different from the real data. this case, the generated data still slightly improve the robustness. Hence, is important to investigate that
Q2: How does the quality the unlabeled data generator affect the adversarial robustness?
This work aims to provide mathematical answers for the above two questions. Existing literature. Uesato et al. 2019 Carmon et al., 2019 Zhai et al. 2019 /Shwwa et al. 2021 Xing al. 2021b 2022) provide justification that adversarial training potentially benefit from
(e.g.. Alayrac et al. 2019
data and fail to explain that unlabeled data help little when attack strength is small. contrast, we explicitly cxplain why and how adversarial training can be improved via an exact error decomposition rather than upper bound statement.
For the convenience of our discussion below, we preliminarily introduce some notations, with detailed explanations given later. Denote 0(e) as the robust estimator utilizing additional unlabeled data as in Figure I and 0(e) as the estimator via vanilla adversarial training. Denote the true distribution of X as Po. and the distribution of the generated unlabeled data as Pa. The true conditional distribution of Y|X is Pgy, and Y|X- E [X] has distribution Pe.. As defined in Figure [ Sj is the set of original labeled training data with sample size n1, and S2 the set of generated data with size n2- Denote /1/ (11 + 112) as the proportion of real data. Let I, be the adversarial loss function w.r.t. attack strength e, lo the clean loss (i.e., 0), and Og be the parameter of the underlying true clean model.

---

Contributions We conduct theoretical analysis under some simple statistical setups. Through studying the convergence of ((e) and ((e), we decompose the excess adversarial risk of 0(e) into two major components (and their cross product): label cost (related to the quality of the imputed labels of generated unlabeled data) and generator cost (related to the quality of unlabeled data generator) as in Figure 2 Using this decomposition, we can answer Q and Q2.
First, unlike (e)) whose risk noticeably affected as e increases, since the adversarial risk is stable to the imputation model, the label cost of ((e) is more insensitive w.r.t. e. In consequence, although in clean training, the label cost and the risk of ((c) are comparable, the former one becomes relatively smaller as e increases. As in Figure 2 when > O, the label cost of O(e) smaller than the risk of (e). Using infinite data from the ideal unlabeled data generator, the generator cost becomes zero, and hence the overall cost of ((() is smaller than 0(e).
Second, we characterize how the quality of the unlabeled data generator affects the final adversarial robustness. In general, a better data generator is always preferred. For the ideal generator, it will always improve adversarial robustmess effectively, i.e., the generator cost is negligible when n2 - oo. If the generator is learned from S and captures extra information, it may effectively help well when n2 + oo. For a poor generator, may slightly improve the performance for large attack when 122 is small, and the generator cost is always not negligible.
Finally, following Gowal et al. (02I)) we balance the weights of S₁ and S2 the adversarial training process in order to achieve the optimal adversarial robustness. We show that a larger n2 is always preferred with a proper choice of weight, even if generated from non-ideal generators. Tuning the best choice of weights via repeated trial-and-error runs can be infeasible due to the slow convergence of adversarial training. We propose an algorithm that dynamically adapts the weight during the training of neural networks and shows its promising performance in Section 5
2 Adversarial Training
To formally introduce adversarial training, let to denote the loss function and fa( be the model with parameter 0. The adversarial loss function 1e and the (population) adversarial risk are defined as
R(O,c) e) : Ep, [lo (x + Aeffe. xr y). y, 0)] == Ep, [Le (z, 3z. (,,,
where A, an attack of strength e > and intends to deteriorate the loss the following way Ac(So, y) = argmax (lo(x 0)} ze z0,,(0,c)
where (x. r) is Cp ball centering at with radius r. Denote A. argming R(0, c). Note that for simplicity, we only consider real-data experiment,
in our theorems and simulations, while in the numerical studies of follow the routine setup and set p = co.
Given the data set S1 consisting of n, i.idd labeled samples, the estimator Ō(E) from the vanilla adversarial training aims to minimize the empirical version of R(0,c), c):
R( c)
1
Σ (2x, 0)
n2 (x.y))
To take the advantage of the extra unlabeled data, we first assign pseudo-response variable ÿ = (( (z) to them, where for regression, g(a, b) = + and follows the true noise distribution; for classification, g(a, b) 1(a 2 b) and E Unif(o, 1]. Then Ö(e) aims to minimize
R(0,c) n1 722
Σ (2.8)ES;
Le (x. + Σ
(3)
(x.
To evaluate the performance of an estimator we use the excess adversarial risk ER(0, - R().,
Besides the pseudolabel S. we define the the imaginary "true" response for the unlabeled data y = [ff, Ez), where is the same realization used in generating pscudolabels. These true responses are not observable but will be used when analyzing the convergence rate of ²(c). To evaluate the size of vectors and matrices, we denote || || as the La norm of vectors, operator norm of matrices, and denote | a Aa for any vector and positive definite matrix A.
3

---

Related Literature
Commonly used techniques (without extra data fed into training process) in adversarial training include adversarial regularization Goodtellow et al. (2015); Zhang et al. (2019): Wang et al.
(0199b
curriculum-basee based algorithms Cal et al. 2018); Zhang
(2020a).
Theoretical investigations, besides the aforementioned works, have been conduct for adversarial
training from different perspectives. For instance, Chen et al.
(2020); Javanmard et al.
2020);
Javanmard & Soltanolkotabi (2020); [Taheri et al. (2021); Yin et al.
(2018: Raghunathan et al.
(2019) :
Najafi et al. (2019); Min al. (2020); Henddrycks et al. (2019); Wu et al. (2020b); Xing et al.
[202
studied the statistical properties of adversarial training, (Sinha et al. (2017): Wang et al.
(2019a)
studied the optimization convergence of adversarial training, Zhang et al. (202b); Allen-Zhu & Li
(2020); Wu et al. (2020a); Xiao et al. (2021) studied theoretical issues related to adversarial training with Deep learning models.
4
Main Result
In this section, we present the main theorem, answer the two key questions, and show that balancing the weights of S₁ and S2 leads to the hetter utility of the generated data. Due to the page limit, we postpone the whole simulation study section to Appendix B. Briefly speaking, our simulation results justify all the theoretical results below.
4.1 General Convergence Result
To present our theoretical investigations in d(E), we first introduce some assumptions:
Assumption 1. The loss function satisfies the following conditions:
Al. The clean loss function to is the square loss or logistic loss. The attributes X E Rd follow sub-Gaussian distribution. The true clean model Oo is defined as B[Y| = x] = Oo for regression and P(Y = 1 z) = 1/(1 + exp(x' (6))) for classification. In addition, it satisfies that ||0o|| S by for some constant bo and the noise in regression has finite variance. The distribution Pa is Bub-Gaussian as well.
A2. The distribution Pa and n2 satisfy [Ep.xP, 06. YX,,(X o((n + 122/ log m))). where Pa & Py denotes the joint distribution induced by marginal distribution Pa and conditional distribution Py-
Assumption A1 for the simplicity of derivation. When doing Taylor expansion as in ④ the remainder term (if exists) does not explode under A1. Under Assumption A2, if Pa is of poor quality, i.e., [Ep,,, 39, (X, Y, B.)ll is not vanishing, then one can only take a relatively small n2 compared to n2 Vice versa, to allow a large n2, the generator Pa need to be almost "unbiased". is possible relax Assumptions Al and A2 as discussed in Section P the appendix. However, the relaxations are technical and tailored to the derivations of Theorem |I
The following theorem is general result to decompose ER(((ee) R(O,, Theorem 1. Under Assumption Al to A2, assuming the unlabeled data generator independent to Sp when nı - oc, the excess adversarial risk using ((e) is
ER(((E). R(O,,e) E) = 2
E [((e)
+0.
(4)
N.
where 02 - -(() is dominated by
n2 D2 D-1 Ep.oP,
E-1
(X. 8, 0.) 00_
(x.
Σ
(x, 0.0
+ n2
00
71 + n2
00_
$1.82
E. S, (0(00) #o)+0:=E
and
8 Σ,
Ø2 00000,
EpSP, (X,Y,0), Σ.
Ep. E.l(X (x.0(((
003

---

The term "o" represents the remainder terms which are not dominant.
Therefore, taking the decomposition of (0) into ER(Ø(E), e), the excess adversarial risk becomes
ER(Ō(e), e) R(fe: c) = 2 + 1 ES + Es, E2 + where Eo(o) || E1 /2, quantifies how the quality of pseudolabel affects the excess risk (label cost). and ss EB /2 quantifies how the quality of Pa affects the excess risk (generator cost).
Meanwhile, the vanilla adversarial training estimate 0(e) satisfies
a
0. -(-
=,-1 Th 00. S1
+
proof sketch can be found in Section 0 while the detailed proof is postponed to the appendix. For simplicity of the derivation, Pa in Theorem is independent S1. A case-by-case study is essential Pa is trained from S,. In Example 2
later, we provide a case where Pa is trained from Sj.
Based on Theorem as shown in Figure 2 in the introduction, the error of d(c) consists of two parts and their cross terms:
Label cost, (o E /2: 22 It is mainly due to the discrepancy between the pseudolabel ÿ and "true" label of the generated data. The label cost depends on both clean training error A(0)- 6g and the matrix Σ-' and is maximized when - xX. It measures the quality of the pseudolabel.
Generator cost, ss, S, |E 123. /2: By the definition of f., i.e. the global minima of the adversarial risk, the expectation of a0, (x, y. 0.) under Po @ Py is 0, thus Es, 80, (e, y, 0.) = Consequently, the generator cost mostly rely the term Es, á 30. (2 y, 0e), which depends on the quality of the unlabeled data generator Pa. For ideal Pa, i.c., Pa = Po. Ep.oP, 00, (X, Y, 0,) 0, and the generator cost goes to zero when n2 + oc. For non-ideal Pa. |Ep eP 36, L. Y, 0.) may be vanishing, but not exact zero.
Besides Figure 2 we also provide graphical illustration on how the label cost and generator cost change along n2/ nu in Section F to ease the understanding.
4.2 Discrepancy between Clean and Adversarial Training with Unlabeled Data
We provide some intuitions to explain the discrepancy in the algorithm performance between c = 0 and 0 from two aspects, the loss function aspect and information (minimax lower bound) aspect. The following discussion assumes that the ideal data generator is used.
Loss function and label cost We rewrite the adversarial loss as (0, 6o) (X, gfa, E)), 0) to explicitly reveal its dependency on the true parameter 9g. A crucial difference between clean training and adversarial training the roles of the and Og in the loss functions. For clean loss, e.g. linear regression, the loss function can be rewritten as (x - x 9 - z)², where and 6g play symmetric roles. In contrast, for adversarial loss, the loss becomes ((x + (fe. 2. y)) 0 - x= 0, =)², thus 0 and O have asymmetric roles. The adversarial loss is more sensitive than fg. Consequently, when (()) is treated as true parameter and used to impute labels for S2, the impact of the error in (() is much less influential for adversarial training than clean training.
Label costlilcc Adv Risktäte))
1.0
00
01
02
0.3
0.4
05
0.5
Figure 3: The ratio between label cost
of 0(e) and B[(Ø(e) - 0.1]3. in linear re- gression, n22 - 0o. Solid line: theory. Dashed line: simulation. Derivations are
In Theorem the matrix ε. reflects the sensitivity men- tioned in the above illustration. Assume 0, for both
in Appendix H
5

---

Excess Rick Robio 6/8, Ideal Generator
Excess Risk Rabio 618,c 2.0.4-00
1.2
1.0
1.0
0.9
0.7
0.-
generstor
05
05
00
0.4 0.6
10 0.0
0.6
10
agho (progartion of (U60)
alpte (proportion data)
Figure 4: Simulation: how the attack strength (c), quality of data generator, and the proportion of real data (a- = n/1 (22)) affect the convergence of the adversarial estimator. The y-axis represents the R(O,, ()(((E))())) e) - R((O,, +)]- A smaller-than-one ratio implies better performance of 0(e). Detailed model information is in Appendix B the left panel corresponds to the left panel of Figure B.T and the right panel for = 0.5 from four different generators in Figure B. and B.2
excess adversarial risk ratio of Ō(e) and ((e), i.e., [E)(((())
linear regression and logistic regression, we have- Σ.- = Ev. so when n2 + oo,
((0) - 0o = (0) - 0o +
which means that clean training cannot be improved using S2 with pseudolabel.
On the other hand, for adversarial training, the matrix Σ- is no longer -Ta. and the singular values get changed. As a consequence, the label cost is cheaper than the overall risk of Ō(e) even the label cost is maximized as 122 - A toy simulation in Figure justtifies this. In Figure 3 we calculate the theoretical values of the label cost of f(c) and the risk of O(c) to compare them. When gets larger, the label cost (()) becomes much smaller compared to the overall risk of Ō(e).
Together with an ideal Pa that yields zero generator cost (m2 - 20), we obtain that 0(c) is much better than ((e). The simulation results in the left panel of Figure
4 verifies this as well. All these theoretical insights and numerical observations under e >> O, are summarized Figure 2 Figures and jointly are the main answer towards QT. Note that we assert adversarial training benefits much more from unlabeled data than clean training, rather than that clean training cannot benefit from unlabeled data. See the remark below:
Remark 1. It is possible to improve clean training using unlabeled data with pseudolabels. In Lee al. 2013): [un et al. (2017), each training iteration, pseudolabels are updated based on the model of the current step. This is equivalent to a SGD with the gradient of Es, ([f(()), w)/n1 + [(0, (()) for some regularization term L that stabilizes the training process, where g(t) the current model.
Minimax lower bound Besides the exact decomposition of ((+) answer Q1, also provide minimiax lower bound result to reveal another difference between clean and adversarial training.
Minimax rate refers to the best possible convergence rate that can be achieved by any estimator in the worst case given finite samples. As mentioned Dan et al. (020), it represents the information- theoretical limit given the data set.
In general, for the clean estimate without model misspecification, this information limit regards mostly the uncertainty about the conditional distribution of Y given X which completely determines Op- The additional information about the marginal distribution of only affects the multiplicative constant of the bound but not the rate of convergence.
However, the true robust model 0 can depend on both Y|X and X for the adversarial estimate. The following example demonstrates the difference between clean and adversarial training:
Example 1. Consider linear regression under Gaussian model = 0 X + where X ~ N E) and (0, o²). Then 0o is the best clean model, and 0 = (I + X -ー -00 for some X O.
The derivation of Example D can be found in Appendix H
Based on Example D is intuitive that the minimax lower bound for the adversarially robust estimate is contributed by two sources, one for the

---

uncertainty of Bu. and the other one for the distribution of X. where the additional unlabeled data can improve the latter term. The following proposition reveals this difference theoretically:
Proposition 1. Under the setup of Example ! assume ||0o|l S by and there are n2 unlabeled real data. Assume R(Oe: E) is bounded from above and below, and e E [0,e*] with some constant for L2 attack. Assume L is unknown. Then for some positive constant for any estimator f.
inf sup e) (((,,,)) 2 cmax PoSP,
inf sup Bliōo 80 8o
e200 inf sup BI E/12 Σ
Σ
4.3 Quality of Unlabeled Data Matters
We study how the quality of non-ideal unlabeled data generator affects adversarial training. Unsur- prisingly, we always prefer a high-quality/ideal Pa. addition, when there is some extra information of the marginal distribution of X (such as parametric modeling assumptions) which cannot be di- rectly utilized in the vanilla adversarial training process, training P. from S can potentially give high-quality adversarially robust model. On the other hand, given a poor Pa. via bias-variance trade-off, it still possible to reduce the error of 0(e). Note that the discussion the section assumes that the unlabeled data generator (Pa) is independent to the training data S1, as assumed in Theorem I unless stated otherwise.
A high-quality Pa is preferred
The term Eg in Theorem ! satisfies
① (x, Y,0)
2 (xx,),0))
EE
Ep. PP 00,-
EP.oP 80.
(5)
(T01 122
Square bias
a 1, (X, + (m1 + n2)
T12
a TAe
V VorPo (mi + n2)
Varp.SP,
00.
Variance
For the variance term in when n2 > oc, is always negligible for reasonable Pa.
For the square bias in 5). it is in general nonzero Pa * Po. and is similar to the maximum mean discrepancy (MMD, Gretton et al., 2012) that measures the dissimilarity between Pa and Po- There exists some function class J. such that Ol./a0, E F F and
θ Br.er (X,Y 00.
0 SP.SP L (X,Y,,0) EPOPP 00. a0.
(X,Y,
P..
Based on the above decomposition, higher quality of the unlabeled data generator is preferred because it leads small generator cost, And as shown in Figure 4 with the ideal P.. the generator cost can be zero when n2 - co. Using an ideal/good Pa. we can have TE](((e) 0. 112. < El(((() - 0.1
A graphical illustration can be found in the right panel of Figure 4 When is large, we know that the ideal Pa will efficiently improve the adversarial robustness. When Pa gets worse, there less improvement in the adversarial robustness. This is the main answer towards Q2, and we illustrate some specific cases in the following discussions.
Training data generator from S For the vanilla adversarial training, there is no trivial way to incorporate the extra information of the marginal distribution of X into the optimization of In contrast, (c)) can use the extra information to train good unlabeled data generator from St. Example 2 (Sparse Covariance Matrix Estimate). Assume X N (0, E) and E is unknown. We follow Cai al. (2000) to consider a family of sparse covariance matrix as follows:
lassl < MK Vk, Amnoe (Σ) S Mo, Amin ( 2 mg 0)
F8
E: max
()))))]>>k)
If we use the sparse estimator proposed in Cai et al. (2010), then IE E E112 00n0==0np00)))0000 -2/129+1)
7

---

Besides, when Σ is either the sample covariance matrix or the generation of Sr, the decomposition of ((e) in Theorem 1 still holds, and the bias in satisfies
Σ Egparse. with probability tending to 1 over
n (1l + n2)²
0 (x =0 EP.sP 00.
n3 n2 n E1
(6)
(11 T22
I E F3 and d > n 1/28+11), when ny - oc, 8(c) with Esparse leads to a rate of o(d/n1) for the generator cost, which is negligible compured the label cost.
Compared to Theorem T difference in the assumption is that in Example the generator is not independent to Sy. Therefore, the proof of presented Appendix G
is more involved.
Biri-nariance trade-off in poor P For poor unlabeled data generator, when n2 + cc, it leads poor 0(e) shown in Figure However, based on the bias-variance trade-off of E2, for relatively mı,, it is still possible to obtain a O(e) better than Ō(e).
Proposition (Bias-varianes trade-off). Assume the conditions of Theorem 7 holdd n2 ni and the unlabeled data generator is independent to S₁, then
[BO(() - 0. -0 (mm) dn3
) tr ( 0.))) =0
d
(1))+ n2
+ n22
As shown by Proposition there is trade-off between bias and variance w.r.t the size of S2. This implies U-shaped curve of the generator cost w.r.t. S2, and there exists some small n2 that strikes the balance of this trade-off and can improve the adversarial robustness.
4.4 Balancing the Weights between S and S2
Following Gowal et al. (2021) and Carmon et al. 2019 we try to improve the performance of (()) via balancing the weights of Si and S2 in Bh, and consider the weighted minimization.
R(0, w. 6) n11 w12
Σ (s.yleS
(x, +
0)
Σ Le (z, (x.0)S
When using the ideal Pa and assuming (()) = Gu (i.e., we can generate extra independent labeled real data), trivially the optimal w minimizing the risk of ((c) is 1. When using non-ideal Pa or 8(()) 3 dp- intuitively, one need to downweight the generated data and the best w 1. We demonstrate this observation in the simulation in Figure B.3 as well.
In addition, stated in the following proposition, through taking the optimal choice of w, for any Pa. larger Th always leads to better 0 when O.
Proposition 3. We assume the assumptions of Theorem 7 Toold, and consider a fixed > 0, n1). Denote 0( ((w n22) as the minimizer of p and w" (nz) minimizes the excess adversarial risk 0f n2) w.r.t. w. Then for náz n2, taking w' such that w/ nn'n22 w² (12) My,,,, the risk of 0(w', nb)) is smaller than 0ww" (n2),, n2), and the risk of Oww" (nb),,b) is further smaller than (( n()). As a result, larger n2 always gives a better O.
4.5 Summary of Numerical Experiments
Due to the space limit, we postpone simulations and most real experiments to Appendix B Below is a summary of simulation and empirical studies.
B we aim to use simple models to numerically verify: (1) given the ideal data generator, the performance of f(c) is better than 0(c) when deviates from zero; (2) the better quality of the data generator implies the better performance of 0(e); ; and (3) balancing the weight between S and S2 improves the performance. We observe all (1) to (3) in the simulations.
In Appendix

---

In Appendix C we aim to verify that the label cost and the generator cost are important factors in deep learning. We aim to show (1) adding more unlabeled samples from the ideal generator will improve adversarial robustness, and (2) adding unlabeled samples from a poor generator with a small n2 will slightly improve the performance. We perform an experiment on the CIFAR-10 data set. We take part of the samples as labeled training data and remove the label of the other samples. Therefore, we train a classifier to classify airplanes and cars, then (i) the unlabeled airplane and car pictures can be viewed as ideal unlabeled samples, and (īi) the unlabeled samples from other classes are viewed as from a poor generator. Our empirical results verify (1) and (2). Besides, we also find that the unlabeled data with the pseudo label can improve the adversarial training as much as labeled data of the same sample size (the middle panel of Figure C.I, This observation further verifies the effectiveness of unlabeled data and implies that the label cost is small in adversarial training.
5 How to Decide a Proper w
To determine a proper w, it is possible to conduct cross validation for simple models. However, due to the heavy computation of adversarial training under DNN models, this is infeasible for real applications. Our proposed algorithm in below aims to simplify the tuning process of w.
To design a proper metric to tune w, denote as the average adversarial loss difference in S1 and S2. "n and By as the variance of the adversarial loss for S1 and S2 respectively. Since real practice one can often obtains high-quality clean classifier (i.e., low label cost), we tune w based on the generator cost only. Inspired by the variance-biar trade-off in ( we define a surrogate of the generator loss as
b² (wnn))
+ U1 + u2
k(b, 01. U2 R1, T22, Whiss) = Wbias (n1 + wm2)2
(n1 + wn2)²
Due to wver-parameterization the mean and variance of the gradient are volatile in neural networks. Hence, instead of using the gradient of loss (i.e., 0l./00.) as suggested by 5 we use the adversarial loss to construct k and introduce Whins to balance 6 and (2), To control over-fitting problem, we tune w during the first 20% iterations in the experiment. The algorithm is shown in Algorithm ||
Algorithm 1 Select during Training
Training dataset S₁ and S2 with size nı and n2, optimizer OPT, total number iterations T, number of iteration per weight 7, initial weight wo, bias weight Whass, decay factor 6, number of epochs K to train weight.
Input:
Initialize the model parameters 0, take w wn..
, do for = ...... T/T
b 01 = 02 0. for t = I,..,, do Calculate the mean and variance of adversarial loss for the samples from S and S₂ in this batch as bri, be2, U21, V/2-
Update b - b 8 + bi bi U1 = 11 * Ue1, U2 U2 *
+ Vrz-
Update 0 using OPT.
end for
Update b = b/(1 5). vn = 01 -8,, 22 21/(1
if h: S K then
Update to reduce
end if
end for Output: 0.
In the experiment, we consider binary classification for the CIFAR-10 dataset to classify airplane and car. The implementation for all real-data experiments is modified from Rice al. (0020 @ We take 500 samples from each class as labeled data, i.c., n1 1, 000. To form S2, we sample n2 2 data from the other 9,000 airplane and car pictures, and n2/ data from other classes, i.c., the unlabeled data generator generates both ideal and poor samples. The experiment setups are postponed to Appendix
We repeat the experiment for 10 times to get the average robust testing accuracy and its standard error. The details of how tune Whis and how to update using k in Appendix C

---

The results are summarized in Table ! lead to better performance than the unweighted training and as good as the best fixed obtained by grid search. We found that 75% of the total epochs are needed for each fixed w to reveal the performance difference among w's (Figure 3 leading to long computing time for grid search of w. In contrast, our proposed method only needs several epochs to tune Wias-
One can see that adjusting using Algorithm I can always
Table I: Adversarial test accuracy using unweighted training (w 1), Algorithm I and best fixed The latter two methods reaches similar performance.
712
200
2000
4000
18000
(..847(0.004)))
0.8170(0.0096) 0.7612(0.0168)
0.8622(0.0057)
Algorithm
|
0.7870(0.000 0090))
0.7942(0.0126)
0.8407(0.0070) 0.8765(0.0038)
Best fixed w
0.7868(0.0091) 0.7957(0.0128) 0.8429(0.0068) 0.8754(0.0027)
We also evaluate the performance of Algorithm I using the full CIFAR-1O, CIFAR-100, and SVHN
with the additional data generated by Gowal et al. (2021) The results are postponed Appendix C
6 Proof Sketch of Theorem
We assume B(c) is consistent to 0g and start from the first-order optimality condition of f(e) and obtain that
0 + n2 00,
Σ
le y, 0(e)) +
E4( D. 0(e))
(e(z,
(8)
5₁
$2
Σ
(xx, (e v,,(,,
E4(0,y,0))
11 n2 00.
71 n2 00.
S1
91
=
0
Celo 0(0())
n1 + n2 00.
n2 + n2 00.
82
82
:=A2
0
Σ E1(e,,,,00))
a
El(r,v,0)
n1 n2 00.
n1 n2 00.
Sa
Sa
1
a
" (( + Eeeax,y,03)
111 + n2 00,
We observe that, when (()) consistent, i.e., [1((e)) 0.11 L, O, with probability tending to 1,
A As = (,(e) 0.) +
n2 Σ. (0(0)
A ni + 712
-00) +
As result, rearranging the terms in we can prove Theorem | One the other hand, one can also
show that (i((c) 02ll P, because R( - R(e, <) for any reasonable 6.
7 Conclusion
This paper studies how adversarial training benefits from unlabeled (generated) data. We show that (i) the label cost of 8(c) is small in adversarial training: (ii) with a high-quality data generator, large S2 leads to negligible generator cost. These two facts together indicate that adversarial training benefits a lot from unlabeled (generated) data. Motivated by these observations and our theory, we balance the weights between S₁ and S2 to improve the performance and propose an algorithm to determine the weight automatically during training.
10

---

Acknowledgements
This project is partially supported by NSF-SCALE MoDL (2134209) and ONR N00014-22-1-2680.
References
Alayrac, J.-B., Uesato, J., Huang, P.-.., Fawzi, A., Stanforth, R., and Kohli, Are labels required for
improving adversarial robustness? Advances in Neural Information Processing Systems, 32, 2019.
Allen-Zhu, Z. and Li, Y. Feature purification: How adversarial training performs robust deep learning. arXiv preprini 20X::20055/01900 2020.
Cai, Q--., Du, M., Liu, C., and Song, D. Curriculum adversarial training. arXiv preprint 1rXiv:1805.04807, 2018.
Cai, T. T., Zhang, C.-.., and Zhou, H. H. Optimal rates of convergence for covariance matrix estimation. The Annals of Statistics, 38(4):2118 2144, 2010.
Carmon, Y., Raghunathan, A., Schmidt, L.., Duchi, J. C.,, and Liang, S. Unlabeled data improves adversarial robustness. In Advances in Neural Information Processing Systems, pp. 11192-11205 2019.
Chen, L., Min, Y., Zhang, M., and Karbasi, More data can expand the generalization gap between adversarially robust and standard models. In International Conference on Machine Learning, pp. 1670-1680. PMLR, 2020.
Croce, F., Andriushchenko, M., Sehwag, V., Debenedetti, E., Flammarion, N., Chiang. M., Mittal, P., and Hein, M. Robustbench: standardized adversarial robustness benchmark. arXiv preprint arXiv:2010.09670, 2020.
Dan, C., Wei, Y., and Ravikumar, P. Sharp statistical guaratees for adversarially robust gaussian classification. In International Conference on Machine Learning, pp. 2345-2355. PMLR, 2020.
Goodfellow, J., Shlens, J., and Szegedy, C. Explaining and harnessing adversarial examples, In 3rd
International Conference on Learning Representations, 2015.
Gowal, S., Rebuffi, S.-A., Wiles, O., Stimberg, F., Calian, D. A., and Mann, T. A. Improving robustness using generated data. Advances in Neural Information Processing Systems, 34, 2021.
Gretton, A., Borgwardt, K. M., Rasch, M. J., Schölkopf, B., and Smola, A. kernel two-sample test. The Journul of Machine Learning Research, 13(1):723-773, 2012.
Hendrycks, D., Lee, K., and Mazeika, M. Using pre-training can improve model robustness and uncertainty. arXiv preprint PeXXi:1901.09900 2019.
Javanmard, A. and Soltanolkotabi, M. Precise statistical analysis classification accuracies for adversarial training. arXiv preprint 1xXi::2010.12213. 2020.
Javanmard, A., Soltanolkotabi, M., and Hassani, H. Precise tradcoffss in adversarial training for linear regression. In Conference on Learning Theory, pp. 2034-2078. PMLR, 2020.
Koltchinskii, V. et al. Local rademacher complexities and oracle inequalities in risk minimization. The Annaly of Statistics, 34(6):2593-2656 2006.
Lee, D.-H. al. Pseudo-label: The simple and efficient semi-supervised learning method for deep neural networks. In Workshop on challenges in representation learning, ICML, volume 3, pp. 896, 2013.
Min, Y., Chen, L., and Karbasi, The curious case of adversarially robust models: More data can help, double descend, or hurt generalization. arXiv preprint arXiv:2002. 2020.
Najafi, A., Maeda, S.-i., Koyama, M., and Miyato, T. Robustness to adversarial perturbations in learning from incomplete data. In Advances Neural Information Processing Systems, pp- 5542-5552, 2019.
11

---

Raghunathan, A., Xie, S. M., Yang, F., Duchi, J. C., and Liang, P. Adversarial training can hurt generalization. arXiv preprint arXiv:1906.060:3 06032, 2019.
Rice, L., Wong, E., and Kolter, J. Z. Overfitting in adversarially robust deep learning, arXiv preprint arXiv:2002.11569, 2020.
Sehwag, V., Mahloujifar, S., Handina, T., Dai, S., Xiang, C., Chiang, M., and Mittal, P. Improving adversarial robustness using proxy distributions. arXiv preprini arXiv:2104.0944 2021.
Sinha, A., Namkoong, H., Volpi, R., and Duchi, J. Certifying some distributional robustness with principled adversarial training. arXiv preprint arXiv:1710.1057/ 2017.
Sun, W. Tseng, T.-L. B., Zhang, J., and Qian, W. Enhancing deep convolutional neural network scheme for breast cancer diagnosis with unlabeled data. Computerized Medical Imaging and Graphics, 57:4-9, 9, 2017.
Taheri, M., Xie, F., and Lederer, J. Statistical guarantees for regularized neural networks. Neural Networks, 142:148-166 2021.
Uesato, J., Alayrac, J., Huang, P.-.., Stanforth, R., Fawzi, A., and Kohli, P. Are labels required for 13725, 2019.
improving adversarial robustness? arXiv preprint
Van Der Vaart, A. W. and Wellner, J. A. Weak convergence. In Weak convergence and empirical processes, pp. 16-28. 28. Springer, 1996.
Wang, Y., Ma, X., Bailey, J., Yi, J., Zhou, B., and Gu, Q. On the convergence and robustness of adversarial training. In International Conference on Machine Learning, pp. 6586-6595, 2019a.
Wang, Y., Zou, D., Yi, J., Bailey, J., Ma, X., and Gu, Q. Improving adversarial robustness requires revisiting misclassified examples. In International Conference on Learning Representations, 2019b.
Wu, B., Chen, J., Cai, D., He, X., and Gu, Q. Does network width really help adversarial robustness? arXiv preprint arXiv:2010.01279, 2020a.
Wu, D., Wang, Y., and Xia, S.-t. Adversarial weight perturbation helps robust generalization. arXiv preprint 7XXv:2004.05884 2020b.
Xiao, J., Fan, Y. Sun, R., and Luo, Z.-Q. Adversarial rademacher complexity of deep neural networks. 2021.
Xie, C. and Yuille, A. Intriguing properties of adversarial training at scale. arXiv preprint 1906.09906.0787,, 2019.
Xing. Y.. Song. Q. and Cheng, G. On the generalization properties of adversarial training. In International Conference on Artificial Intelligence and Statistics, pp. 505-513. PMLR, 2021a.
Xing, Y., Zhang, R., and Cheng, G. Adversarially robust estimate and risk analysis in linear regression. In International Conference on Artificial Intelligence and Statistics, pp. 514-522. PMLR, 2021b.
Xing, Y., Song, Q. and Cheng, G. Unlabeled data helps: minimax analysis and adversarial robustness. In International Conference on Artificial Intelligence and Statistics. PMLR, 2022.
Yin, D., Ramchandran, K., and Bartlett, P. Rademacher complexity for adversarially robust general- ization. arXiv preprint arXiv:1810. 11914, 2018
Zhai, R., Cai, T., He, D., Dan, C., He, K., Hopcroft, J., and Wang, L. Adversarially robust generalization just requires more unlabeled data. arXiv preprint 10X::0190.000555 2019.
Zhang, H., Yu, Y., Jiao, J., Xing, E. P., Ghaoui, L. E., and Jordan, M. I. Theoretically principled trade-off between robustness and accuracy. In Proceedings of the 36th International Conference on Machine Learning, volume 97 of Proceedings of Machine Learning Research, pp. 7472-7482 PMLR, 2019.
12

---

Zhang, J. Xu, X.. Han, B., Niu, G., Cui, L., Sugiyama, M., and Kankanhalli, M. Attacks which do not kill training make adversarial learning stronger. In International Conference on Machine Learning, pp. 11278-11287 11287. PMLR, 2020a.
Zhang, Y., Plevrakis, O., Du, S. S., Li, X., Song, Z., and Arora, S. Over-parameterizeed adversarial training: An analysis overcoming the curse of dimensionality. arXiv preprint arXiv:2002.0666 066688, 2020b.
Checklist
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's
contributions and scope? [Yes]
(b) Did you describe the limitations of your work? [Yes]
(c) Did you discuss any potential negative societal impacts of your work? [No] Our work
a theoretical study, and studies the existing adversarial training method other than introducing new applications.
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you are including theoretical results...
(a) Did you state the full of assumptions of all theoretical results? [Yes]
(b) Did you include complete proofs of all theoretical results? [Yes]
3. If you experiments..
(a) Did you include the code, data, and instructions needed to reproduce the main experi- mental results (cither in the supplemental material or as a URL)? [Yes] We are using the code of Rice et al. (2020) to do experiments, and we also provide the code for CIFAR-10 experiment with data from Gowal et al. (202I).
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)? [Yes] In Section C
(c) Did you report error bars (e-g., with respect the random seed after running experi- ments multiple times)? [Yes]
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)? [Yes] Section C
4. If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) your work uses existing assets, did you eite the creators? [Yes]
(b) Did you mention the license of the assets? [N/A]
(c) Did you include any new assets either in the supplemental material or as a URL? [N/A]
(d) Did you discuss whether and how consent was obtained from people whose data you'l 'rere using/curating? [N/A]
(c) Did you discuss whether the data you using/curating contains personally identifiable information or offensive content? [N/A]
13


Reviews:
[{"review_id": "oMS-Gnnv8n", "reviewer": "Reviewer_VSRZ", "summary": "In this paper, the authors provide a statistical insight to explain the reason that using unlabeled generated data can improve model's robustness. The experiments verify that the theories in this paper are correct and can enhance the model's robustness.", "questions": "1. In Figure 2, the authors suppose that $n_2 \\to \\infty$. Later, the authors analyze the case where $n_2$ is finite. I think there may exist a gap. Could the authors add more details for different ratio of $\\frac{n_1}{n_2}$, and analyze the remainder term $o$?\n\n2. What does ``unbiased'' mean in Line 127? I guess the authors judge a generator based on the gap between real data distribution and a data distribution generated by a generator. So, an ideal generator means it can generate a real data distribution. But, how do we define a good one and a poor one without any threshold?", "limitations": "I do not see any limitations.", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n1. The writing is good. This paper is very easy to follow.\n\n2. This paper gives detailed theoretical analysis of the reason that using unlabeled data can improve model's robustness. \n\n3. The experimental results strongly verify the analysis is correct.\n\nWeaknesses:\n\n1. As the quality of unlabeled data matters, how to choose a proper generator for adversarial training is vital. However, the theory in this paper cannot directly guide people to train or choose such a generator. On the other hand, it seems like judging a poor generator is much easier. Could the authors attempt to solve this challenge?\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "keBElZRFlzg", "reviewer": "Reviewer_bXme", "summary": "This paper provides statistical insights to explain why the artificially generated data improve adversarial training. In particular, it studies how the attack strength and the quality of the unlabeled data affect adversarial robustness in the adversarial training framework of Carmon et al. (2019); Gowal et al. (2021). The results show that with a high-quality unlabeled data generator, adversarial training can benefit greatly from this framework under large attack strength, while a poor generator can still help to some extent. It then proposes an algorithm that performs online adjustment to the weight between the labeled real data and the generated data, aiming to optimize the adversarial risk. Numerical studies are conducted to verify the theories and show the effectiveness of the proposed algorithm. ", "questions": "1. Do the theoretical results still hold for $p=\\infty$? \n\n2.  Could the theoretical results generalize to multi-class classification? ", "limitations": "The limitations and potential negative societal impact of the paper are properly addressed. ", "rating": 7, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "I think this paper has the following strengths: \n\n1. The theoretical analysis is novel and the results seem sound, though I don't check the proof of the theories carefully. It is important to understand why and how using unlabeled data can benefit adversarial training. It is also important to understand how the quality of the unlabeled data generator affects the adversarial robustness. \n\n2. It proposes an algorithm that dynamically adapts the weight during the training of neural networks and shows its promising performance empirically. \n\n3. It is well-written and the ideas are clearly presented. The related works are properly discussed. \n\nHowever, this paper has the following weaknesses: \n\n1. There are some mismatches between the theory and the actual experiments. For example, it only considers $p=2$ in the theorems while in the experiments, it sets $p=\\infty$. Do the theoretical results still hold for $p=\\infty$? \n\n2. It only considers binary classification for the theoretical analysis. Could the results generalize to multi-class classification? \n\n3. It puts simulations and most real experiments in Appendix. I think it should at least summarize the results and findings in the main body of the paper.  \n\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "Ms1YIziHEQF", "reviewer": "Reviewer_RigD", "summary": "This paper investigated the phenomena when using simulated data to improve adversarial robustness and provided the theoretical analysis. Specifically, the author decomposed the adversarial risk used in adversarial training to explain why and how unlabeled data can help and how its quality affects the resulting robustness. ", "questions": "1. Why perform Taylor expansion for Eq. 4?\n2. When doing simulation, how do authors make sure they are aligned with your assumptions? For example, the datasets used are in sub-Gaussian distribution.\n3. When do the assumptions A1 and A2 hold?\n4. In what situation, the assumption would not hold. In this case, how would the robustness performance be affected?\n", "limitations": "Please refer to my review.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\nThe authors clearly shape the research questions and provide the theorem and experiments to verify their points of view. The theoretical analysis for to answer the interesting questions that artificially data helps robustness is the main contribution of this paper. This paper is also generally well-written, delivering the main message clearly. \n\nWeaknesses:\nThe proofs for the proposed theorems/lemmas/propositions are all in the appendix, I would suggest including more details, especially the motivation and reasons when giving the theorem. \n\nIt is intuitive to ask if there have some scenarios that the theorems cannot explain; the authors use too many assumptions in giving the derivations, however, if the assumptions should be reasonable not for convenience. The discussion on counterexamples where the theorems might not hold would shed light on the paper.\n\nSecondly, in my opinion, most of the equations are hard to understand and follow, this might be due to the loss of the explanation before giving the statement. \n\nThird, the experiments seem to lose some baselines for comparison, it would be great if compare with more others.\n\nLast, the paper requires careful proofreading, e.g., \"minimiax\" in line 185, “… is the current model” in line 183, etc.\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "DtOwPKU_nlC", "reviewer": "Reviewer_Htxg", "summary": "This paper includes several theoretical analyses about introducing additional artificial data in adversarial training: its benefits and the relationship between the generator performance and training performance. The analysis starts from their main theorem that decomposes the access risk into two parts: label cost (from mislabeling the artificial data) and generator cost (from the poor performance of the generative model).\n\nThen, the authors use this decomposition to investigate their two research questions further. The answer to the first question is that, assuming an ideal generator (with no generator cost), the excess risk after introducing artificial data is smaller than the excess risk of vanilla adversarial training.  This result shows the benefits of introducing artificial data in adversarial training. Also, the author decomposed the generator cost further to bias and variance terms and showed that the bias term is upper bounded by the dissimilarity between the data distribution and the distribution of generated data. Because the variance term converges to 0 as the number of generated samples grows, the result shows that we can reduce the generator cost by having a better-quality generative model. This paper's last contribution is the strategy of weighting the usual training samples and the introduced artificial samples.\n", "questions": "1. Where are the missing proofs for Proposition 2 and Proposition 3? If they do not need proof, please explain. I consider those proofs missing quite seriously, so if the proofs are in the paper but I missed them somehow, please let me know so that I can adjust the rating.\n2. I recommend the authors proofread the writings once again. Some typos and grammatical errors that I spotted are as follows.\n\n  - Line 83: “$\\theta_\\epsilon = \\min R(\\theta, \\epsilon)$” -> “$\\theta_\\epsilon = \\arg\\min_\\theta R(\\theta, \\epsilon)$” ($\\min R(\\theta, \\epsilon)$ is the value of minimum risk, but $\\theta_\\epsilon$ must be the model parameter minimizing the risk.)\n\n  - Line 175: “The simulations results in” -> “The simulations result in” (Grammar)\n\n  - Line 480: “Figure B.1” -> “Figure B.2” (It looks like that Figure B.1 is the result for Section B.2)\n\n  - Line 516: “Lemma 1” -> “Theorem 1 (According to the structure of this section, the proof for Theorem 1 comes last.)\n\n  - Equation after Line 547: “$\\mathcal P_a \\otimes \\mathcal P_\\epsilon$” -> “$\\mathcal P_a \\otimes \\mathcal P_y$” (I don’t think that $\\mathcal P_\\epsilon$ is defined in the article.)\n\n3. I don’t understand why the authors separated Section 5 from subsection 4.4, whereas it can be just a continuation of subsection 4.4. Also, it would be better to separate subsection 4.1 and the other parts, because subsection 4.1 looks to be the main insight and the other parts are analysis/design from the main insight.\n4. In my opinion, you use the notation \"$\\cdot\\otimes\\mathcal P_y$\" multiple times, consuming too much space in the paper. Defining a shorter notation for \"$\\cdot\\otimes\\mathcal P_y$\" and changing all the occurrences would save some space.\n", "limitations": "This paper does not have a part assigned to address the limitations and potential negative societal impact. I understand the hardship of putting many results in the page limit, but it must be possible to condense the contents further to ensure space for this. (I don’t know whether moving some contents to the Appendix at this stage is allowed, but I recommend it if it is allowed.)", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Originality: To the best of my knowledge, the paper contains novel ideas.\n\nQuality: \n\n[[Strength]]\n1. Assuming the correctness of lemmas, the proof of Theorem 1 seems correct.\n\n[[Weakness]]\n1. The proofs for Proposition 2 and Proposition 3 are missing. I don’t think they are trivial statements, but the proofs are neither in the main part nor the Appendix.\n\nClarity: There are a few typos and grammatical errors. See Questions for more details.\n\nSignificance:\n\n[[Strength]]\n1. This paper is dense with theoretical discussions on adversarial training. Considering the lack of theoretical understanding of adversarial training in adversarial machine learning research, I believe that this paper provides valuable insights into the field.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Accept