Efficient and Effective Augmentation Strategy for Adversarial Training
Authors: Sravanti Addepalli
Samyak Jain
Venkatesh Babu Radhakrishnan
Venue: NeurIPS 2022 Accept (2022)
Keywords: Adversarial Training
Data Augmentation
Adversarial Robustness

Abstract: Adversarial training of Deep Neural Networks is known to be significantly more data-hungry when compared to standard training. Furthermore, complex data augmentations such as AutoAugment, which have led to substantial gains in standard training of image classifiers, have not been successful with Adversarial Training. We first explain this contrasting behavior by viewing augmentation during training as a problem of domain generalization, and further propose Diverse Augmentation-based Joint Adversarial Training (DAJAT) to use data augmentations effectively in adversarial training. We aim to handle the conflicting goals of enhancing the diversity of the training dataset and training with data that is close to the test distribution by using a combination of simple and complex augmentations with separate batch normalization layers during training. We further utilize the popular Jensen-Shannon divergence loss to encourage the \emph{joint} learning of the \emph{diverse augmentations}, thereby allowing simple augmentations to guide the learning of complex ones. Lastly, to improve the computational efficiency of the proposed method, we propose and utilize a two-step defense, Ascending Constraint Adversarial Training (ACAT), that uses an increasing epsilon schedule and weight-space smoothing to prevent gradient masking. The proposed method DAJAT achieves substantially better robustness-accuracy trade-off when compared to existing methods on the RobustBench Leaderboard on ResNet-18 and WideResNet-34-10. 
The code for implementing DAJAT is available here: https://github.com/val-iisc/DAJAT

Efficient and Effective Augmentation Strategy for Adversarial Training
Sravanti Addepallit
Samyak Jain" o
Venkatesh Babu
Video Analytics Lab, Indian Institute of Science, Bangalore
Indian Institute of Technology (BHU) Varanasi
Abstract
Adversarial training of Deep Neural Networks is known to be significantly more data- mata-hungry when compared to standard training. Furthermore, complex data aug- mentations such as AutoAugment, which have led to substantial gains in standard training image classifiers, have not been successful with Adversarial Training. We first explain this contrasting behavior by viewing augmentation during training as a problem of domain generalization, and further propose Diverse Augmentation- based Joint Adversarial Training (DAJAT) use data augmentations effectively in adversarial training. We aim to handle the conflicting goals of enhancing the diversity of the training dataset and training with data that is close to the test distri- bution by using a combination simple and complex augmentations with separate batch normalization layers during training. We further utilize the popular Jensen- Shannon divergence loss to encourage the joint learning of the diverse augmen- tations, thereby allowing simple augmentations to guide the learning of complex ones. Lastly, to improve the computational efficiency of the proposed method, we propose and utilize two-step defense, Ascending Constraint Adversarial Training (ACAT), that uses an increasing epsilon schedule and weight-space smoothing to prevent gradient masking. The proposed method DAJAT achieves substantially better robustness-accuracy trade-off when compared to existing methods on the RobustBench Leaderboard on ResNet-18 and WideResNee-34-100 The code for im- plementing DAJAT is available here: https: // //g//iii github. com/ han/vallii -iAAAATA
Introduction
Deep Neural Network (DNN) based image classifiers are vulnerable to crafted imperceptible perturba- tions known as Adversarial Attacks [41] that can flip the predictions of the model to unrelated classes leading to disastrous implications. Adversarial Training [14, 27, 50) has been the most successful defense strategy, where model is explicitly trained to be robust in the presence of such attacks. While early defenses focused on designing suitable loss functions for training, subsequent works [29, 34] showed that with careful hyperparameter tuning, even the two most popular methods PGD-AT [27] and TRADES [50] yield comparable performance, highlighting the saturation in performance with respect to changes in the training loss. Schmidt al. [35] observed that adversarial training has large sample complexity and further gains require the use of additional training data. Subsequent works [5, 16] indeed used additional data whose distribution close to that of the original dataset in order to obtain performance gains. The availability of large amounts of relevant data is impractical to assume, leading to an exploration towards augmentations based on Generative Adversarial Networks [13] and Diffusion based models [19, 16]. However, the use of such generative models incurs an
Equual Contribution.
Correspondence to Sravanti Addepalli <sravantia anti Samyak Jain <samyakjain.css 18 @ itbbu.ac.in> Work done during internship at Video Analytics Lab, Indian Institute of Science.
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

(Auto Augment)
Fauto
Adversarial Attack (2-step)
Tauto
Sal Faanto fol (Fauto)
TRADES Loss
Separate Batch-norm
Weights
Js Divergence
layers
Original Image
Sal (Ziase) Sol (Brase)
TRADES
Adversariel
Plaze (Pad + Crop)
Attack (2-stap)
Lasse
Figure 1: Schematic representation of the proposed approach DAJAT
additional training cost and suffers from limited diversity in low-data regimes and in datasets with high-resolution images.
simple and efficient solution to improve the diversity of training data in standard Empirical Risk Minimization (ERM) based training has been the use of random transformations such rotation, color jitter, and variations contrast, sharpness and brightness [24, 8, 9]. which can change images significantly in input space while belonging to the same class the original image. However, prior works have surprisingly found that such augmentations, that cause large changes in the input distribution, do help adversarial training [34, 15, 40]. This limits the augmentations in adversarial training to simple ones zero padding followed by random crop, and horizontal flip [34, 29, 15] which may be able fill in the large data requirement of Adversarial Training.
In this work, we firstly analyze the reasons for this contrasting trend between Standard and Adversarial Training, and further show that it is indeed possible to utilize complex augmentations effectively in Adversarial training as well, by jointly training on simple and complex data augmentations using separate
layers for each type, shown in Fig.1. While complex augmentations increase the data diversity resulting in better generalization, simple augmentations ensure that the model specializes the training data distribution as well. We further minimize the Shnoon-Shanoo divergence between the softmax outputs of various augmentations to enable the simple augmentations guide the learning of complex ones. In order improve the computational efficiency of the proposed method, we use two attack steps (instead of 10) during training. By progressively increasing the magnitude of perturbations and performing smoothing weight space, we show that is indeed possible to improve the stability of training. Our contributions are listed below:
We analyze the reasons for the failure of strong data augmentations in adversarial training by viewing augmentation during training domain generalization problem, and further propose Diverse Augmentation based Joint Adversarial Training (DAJAT) to utilize data augmentations effectively in Adversarial training. The proposed approach can be integrated with many augmentations and adversarial training methods to obtain performance gains.
We propose and integrate DAJAT with efficient 2-step defense strategy, Ascending Con- straint Adversarial Training (ACAT) that uses linearly increasing & schedule, cosine learning rate and weight-space smoothing prevent gradient masking and improve convergence.
We obtain improved robustness and large gains in standard accuracy on multiple datasets (CIFAR-10. 10, CIFAR-100, ImageNette) and model architectures (RN-18. WRN-34-10 We obtain remarkable gains a low data scenario (CIFAR- 100, Imagenette) where data aug- mentations most effective. On CIFAR-100, we outperform all existing methods the RobustBench leaderboard [7] with the same model architecture.
2 Related Works
We discuss various existing strategies for improving the Adversarial robustness Deep Networks.
Adversarial Training (AT): Goodfellow et al. [14] proposed FGSM-AT where single-step adversarial samples were used for training. However, these models were susceptible to gradient masking [30), where the local loss landscape becomes convoluted leading to the generation of weaker single-step

---

attacks during training. This leads to a false sense of security against single-step attacks, while the models are still susceptible to stronger multi-step attacks such PGD [27]. PGD-AT [27, 34] used multi-step attacks in a similar adversarial training formulation to obtain robust models that stood the test of time against several attacks [2, 6, 38.. TRADES [50] explicitly optimizes the trade-off between the accuracy on natural and adversarial examples by minimizing the cross-entropy loss on natural images along with the Kullback-Leible (KL) divergence between the predictions of adversarial and clean images. In the proposed defense, we use the base loss from TRADES-ATT [50].
Several works have explored the use of auxiliary techniques in AT such as weight-space smoothing [22, 44], architectural changes [15, 47] and increasing the diversity of training data by using additional natural and synthetic data [35, 5, 15, 33]. Increasing the diversity of training data achieves significant performance gains since the sample complexity of adversarial training is known to be high [35].
While data augmentations such as contrast, sharpness and brightness adjustments are known to improve performance in the standard training regime, they have not led to substantial gains in adversarial training. AutoAugment [8] uses Proximal Policy Optimization to find the set of policies that can yield optimal performance on a given dataset. Contrary prior works [34, 15], we show that the policies that are optimized for standard training indeed yield a boost in performance of adversarial training as well, when used in the proposed training framework.
Augmentations in Adversarial Training:
In a recent work, Rebuffi et al. [33] show that it is possible to obtain substantial gains in robust accuracy by using spatial composition based augmentations such as CutMix [48] and CutOut [[]] that preserve low-level features of the image. Cutmix replaces part of an image with another and also combines the output softmax vectors in the same ratio, while CutOut blanks out a random area of image. The authors hypothesize that the augmentations used in Adversarial training need to preserve low-level features, which severely limits the possibilities for mitigating the large sample complexity in adversarial training. We show that by using the proposed approach DAJAT, is indeed possible to use augmentations such as color jitter, contrast, sharpness and brightness adjustments that significantly change the low level statistics of images (Ref: Table-6).
3 Preliminaries: Notation and Threat Model
We consider the Adversarial Robustness of DNN based image classifiers. An input image is denoted as X and the corresponding ground truth label as E [0, 1]. We denote a simple transformation of x obtained using Pad, Crop and Horizontal flip (Pad+Crop+HFliip. referred to as Base augmentations) by Tbase and other transformations of x: by the respective subscript. For example, Fauto refers to the image x being transformed by AutoAugment (AA) [8] followed by the base augmentations. The function mapping of the classifier C from input space X' to the softmax vectors is denoted using fo(-). where 0 denotes the network parameters. Adversarial examples corresponding to the images vr Tbase and Tauto are denoted using é. Tbase and Fauto respectively. We consider the foo norm based threat model, where 전 is valid perturbation within E if it belongs to the set Ag (x) = {i: j æ01o0 S {.).
4 Motivation: Role of Augmentations in Neural Network Training
In this section, we first explore the contrasting factors that influence the training of neural networks when data is augmented (Sec.4.1, 1), and further delve into the specifics of adversarial training which make it challenging to obtain gains using complex data augmentations (Sec.4.2).
4.1 Impact of Augmentations in Neural Network Training
Conjecture-1: We hypothesize that the role of data augmentations in the training of Neural Networks is influenced by the following contrasting factors:
(i) Reduced overfitting due to an increase in diversity of the augmented dataset, leading to better generalization of the network the test set.
(ii) Larger domain shift between the augmented data distribution and the test data distribution, leading to a drop in performance on the test set.
(iii) Capacity of the Neural Network in being able to generalize well to the augmented data distribu- tion and the unaugmented data distribution for the given task.
Justification: The training of Neural Networks using augmented data can be considered as a problem of domain generalization, where the network is trained on source domain (augmented data) and is
3

---

Table 1: Impact of augmentations: Perfor-
Cosine Similarity
1.00
mance (%) of ACAT models on Base augmen- tations and Augmmnt (Auto). Clean and robust accuracy against GAMA attack [38] are
0.75
gamma
0.50
beta
0.25
mean
reported. The of AutoAugment results in
1.5 - 2% drop in robust accuracy.
0.00
10 14 16 20 24 BatchNorm Layers
28 30
Test:
No Aug
AutoAugment Robust
Figure 2: Comparison of BN layer statisties for a WRN-34-10 model trained on CIFAR-I0 us- ing DAJAT. BN layers of the Base augmentations Fra++Crop.H-Figg are compared with those of Au- toAugment. Initial layer (L3) parameters are diverse, while those of deeper layers (L25) are similar.
Model
Train
Clean
Robust
Clean
Base
82.41
50.00
63,79
37.07
ResNet-18
Auto
82.54
48.11
76.40
43.22
34-eReeNNet-4-11
Base
86.71
55.58
68.24
40.83
86.80
53.99
82.64
expected to generalize to a target domain (test data). We use the theoretical formulation by Ben-Davic al. [3] shown below to justify the respective claims in Conjecture-1:
1 -dFA)(s,1)) +
a - +
The use of a more diverse or larger source dataset reduces overfitting, improving the performance of the network on the source distribution. From Eq. expected error on the target distribution 6 (test set in this case) is upper bounded by the expected error on the source distribution 6x (augmented dataset) along with other terms. Therefore, improved performance the
augmented distribution can improve the performance on the test set as well.
(ii) The expected error on the target distribution 6, is upper bounded by the distribution shift between the source and target distributions =d t) along with other terms. Therefore, larger domain shift between the augmented and test data distributions can indeed limit the performance gains on the test set.
(iii) The constant in Eq.1 measures the risk of the optimal joint classifier: À = min es (f) + (e(f). JEF
Neural Networks with a higher capacity can minimize the expected risk on the source set e, and the risk of the optimal joint classifier effectively. Therefore, capacity of the Neural Network and complexity of the task influence the gains that can be obtained using augmentations.
4.2 Analysing the role of Augmentations in Adversarial Training
We analyse the trade-off off between the factors described in Conjecture-1 I for adversarial training when compared to standard ERM training. In addition to the goal of improving accuracy on clean samples, adversarial training aims to achieve local smoothness of the loss landscape as well. Hence, the complexity of Adversarial Training is higher than that of standard ERM training, making important to use larger model capacities to obtain gains using data augmentations (based Conjecture-1 (ii)). This justifies the gains obtained by Rebuffi et al. [33] on the WRN-70-16 architecture by using CutMix based augmentations (2.9% higher robust accuracy and 1 1.23% higher clean accuracy). The same method does not obtain significant gains on smaller architectures such as ResNet-18 18 where a 1.76% boost in robust accuracy is accompanied by 2.55% drop in clean accuracy.
Secondly, while the distribution shift between augmented data and test data (ddFAr t)) may be sufficiently low for natural images leading to improved generalization to test set (Conjecture- (i.ii), same may not be true for adversarial images. There is a large difference between the augmented data and test data in pixel space, although they may be similar in feature space. Since adversarial attacks perturb images in pixel space, the distribution shift between the corresponding perturbations widens further shown in Fig.3-5 of the Appendix (Details in Appendix-B) Based on Conjecture- (ii), unless this difference is accounted for, complex augmentations cannot improve the performance of adversarial training. This trend has also been observed empirically by Rebuffi et al. [33], where they conclude that augmentations designed for robustness need to preserve low-level features.
We present the performance of Adversarial Training by using either Base augmentations (Pad+Cropp Flip) or Automug [8] during training and inference on the CIFAR-IU -10 dataset using ResNet- 18 and WideResNNe-34-10 architectures in 1able-1. Firstly, we note that by using AutoAugment during training alone, robust accuracy on the test set drops by 1.5 2% which is as observed in prior work [15]. Secondly, the clean and robust accuracy drop by ~ 6.5% when augmented images

---

used for both training and testing, highlighting the complexity of the learning task. We present additional results by training without any augmentation, and by training using a combination of both augmentations in every minibatch in Table-9 of the Appendix. The use of Base Augmentations alone (Pad+Cro++HFlip) still gives the best overall performance on the unaugmented test set.
5
Proposed Method
5.1
Background
We briefly discuss the TRADES-AWP defense [50, 44], which is the base algorithm used in DAJAT.
N
CWWP- = max (EM(()
Σ N
1
CCE(FO40(T))).o M.) + max KL((oto(zi)llooo0a (..).
(2)
Firstly, an adversarial attack is generated by maximizing the KL. divergence between the softmax predictions of the clean and adversarial examples iteratively for 10 attack steps. An Adversarial Weight Perturbation (AWP) step additionally perturbs the weights of the model to maximize the overall loss in weight-space. The weight perturbations are constrained in the feasible region M(0) such that for given layer ||0:]| S 7 ||0.1. The overall training loss is a combination of Cross- entropy loss on clean samples and the KI. divergence term. The latter is weighted by a factor 3 that controls the celuustness-accuraee trade-off. Training the model using Adversarial Weight Perturbations leads to smoothing of loss surface in the weight space, resulting in better generalization [44, 403.
5.2 Diverse Augmentation based Joint Adversarial Training (DAJAT)
As discussed in Section-4, the use of augmentations in training can be viewed a problem of domain generalization, where performance on the source distribution or augmented dataset is crucial towards improving the performance on the target distribution or test set. Since adversarial training is inherently challenging, for limited model capacity, it is difficult to obtain good performance on the training data that is transformed using complex augmentations. Moreover, the large distribution shift between augmented data and test data, specifically with respect to low-level statistics, results in poor generalization of robust accuracy to the test set.
To mitigate these challenges, we propose the combined use of simple and complex augmentations during training, so that the model can benefit from the diversity introduced by complex augmentations, while also specializing on the original data distribution that is similar to the simple augmentations. We propose to use separate batch normalization layers for simple and complex augmentations, so as to offset the shift in distribution between the two kinds of augmentations. In our main approach, we propose to use Pad and Crop followed by Horizontal Flip (Pad+Crop+HFliip) as the Simple augmentations, and Autoaugment followed by Pad+Crop+HFlip as the complex augmentations. We justify the choice of this augmentation pipeline in Appendix-B.3.
Motivated by Aug [18], we additionally minimize the Jenson-Shannon (JS) divergence between the softmax outputs of different augmentations, so to allow the simple augmentations guide the learning of complex ones. We present the training loss LDAJAT of the proposed method, Diverse Augmentation based Joint Adversarial Training (DAJAT) below Eq.5:
Crn(0, (0, = (f (x), +
max (L(f(()))lfo(a) BEA.(()
(3)
0- argmax BEM(U)
LTR (0 + -, 0, base, yc)
N
LDAJAT-
(rn + +0, 0, Wi) +
Σ LTR(O + Ō, sr,, vb)
T+I
N
1=1
JSD(So46(Fi, (ase) (F (0 (5)
N
Adversarial attacks are generated individually for each augmentation by maximizing the respective KI. divergence term of the TRADES loss shown in Eq.3. To improve training efficiency, we compute i using two attack steps with step-size e. We use combination of linearly increasing schedule
5

---

of E, cosine learning rate schedule and model weight-averaging [22] to improve the stability and performance of adversarial training (Details in Scc.5.4). The DAJAT loss (Eq.5) is combination of the TRADES 2-step loss on each of the augmentations Tbase and Fauto(()) along with an adversarial weight perturbation step on the loss corresponding to the base augmentations alone to reduce compute. For every batch normalization layer, two sets of running statistics and affine parameters are maintained and used for simple and complex augmentations respectively (Ref: Algorithm-1 in the Appendix).
While we use Augment in our main approach, we show in Table-6 that the proposed approach works well with other augmentations as well. The role of the base (primary) augmentations is primarily to learn the batch normalization layers that would be used during inference time, and to provide better supervision for the training of complex augmentations using the JS divergence term. The role of the complex (secondary) augmentations is to enhance the diversity of the training dataset. Therefore we use a single primary augmentation and multiple instances of the secondary augmentation. We find that the gains in performance saturate with the addition of more instances of secondary augmentation, and therefore recommend the use of single base augmentation and trade-off. We note from
two instances of secondary augmentation for the best performance-accurac Table-2 and Appendix-Fo F.6 that in this setting, the computational efficiency of the proposed method is better than the TRADES-AWP [50, 44] defense, while achieving considerable performance gains.
5.3 Split Batch Normalization Layers for Different Augmentations
A Batch Normalization (BN) layer [21] is implemented as follows on a given feature map g(x;) of an input image æy; ((x;)) ((z))= 7 + B. Here, lr and denote the mean and standard deviation of the current mini-batch during training. During inference, these are set to the running mean and variance computed during training. 7 and / constitute parameters of the network that are trained.
Prior works use separate batch normalization layers to improve the performance of standard [46, 43, 28] and adversarial training [45, 42], in both supervised [46, 43, 28, 45, 42] and self-supervised settings [23, 12]. The proposed defense DAJAT uses separate batch normalization layers for simple and complex augmentations as discussed in the previous section. We do not use separate batch normalization for clean and adversarial images here.
In DAJAT, we maintain two sets of BN statistics and aT, and two sets of affine parameters, / and y for every BN layer. We plot the cosine similarity between the BN layers corresponding to Base augmentations and AutoAuggent across different layers on a WideResNeet33-100 10 model trained using DAJAT on CIFAR- 10 in 2 While the mean and variance are relatively more similar across most of the layers (0-30 in x-axis), we note significant differences in the y and 3 values, specifically in the initial layers. We present a detailed study on the importance of having separate running statistics and affine parameters in Appendix-C. and conclude that our method works effectively by separating either the running statistics or affine parameters individually as well. However, it works best by using combination of both (Ref: Table-5 5 of the Appendix). We further note that very small differences in running statistics (as seen in F and Fig.7 of the Appendix) can also result in noteworthy performance gains. Finally, we find that the use of a single batch-norm layer for both augmentations degrades results significantly. Therefore, the use of different parameters for each augmentation type ensures that the function mapping differs for each augmentation, thereby effectively offsetting the large differences in low level statistics.
5.4 Ascending Constraint Adversarial Training (ACAT)
In this section, we discuss the methods incorporated to improve the training efficiency of DAJAT in greater detail. We apply these methods to the TRADES-AWP defense impact, and term the proposed defense as Ascending Constraint Adversarial Training (ACAT). We aim to improve the training efficiency by reducing the number of attack steps of the base defense from 10 to 2. We use two attack steps for training since it is known to be more stable when compared to single-step adversarial training, while still being computationally efficient [39].
defense to independently analyse their
As shown in 3ig.3, naively reducing the number of attack steps to 2 in TRADES AWP AT (Fixed constraint AT) causes drop in clean and robust accuracy. While the drop is larger at higher training 8, a drop in clean accuracy is seen at و = 8/255 as well. Further, the large robustness gap between last and best epochs indicates that the training stability deteriorates towards the end of training. The instability of TRADES-AWP AT at E = 8/255 is higher for larger model capacities (WideResNet-344 10) discussed in Appendix-E.1.

---

Ascending constraint AT (ACAT)
Fixed constraint AT (TRADES-AWP 2-step)
Robustt Accuracy 1961
Robuse AcctLast Sertye
10'
Accuracy
80
80
10-
10:
10"
70
20
10-3
12 Training r0255)
16
12
16
12 Training EU/255)
16
Training ri/255) (b)
(a)
(c)
Figure 3: Comparison of ACAT (2-step) against TRADES-AWP 2-step baseline on CIFAR-10 with ResNet-18 18 architecture. (a) Clean accuracy, (b) Robust accuracy, and (c) Difference in Robust accuracy between the last and best epochs are reported. ACAT has better performance and stability even at large training e values. Robust Accuracy is reported against GAMA attack [38] on 88/255.
Curriculum learning approaches [37, 4] have been used to improve robustness-accurann trade-off in adversarial training. Prior works [36, 1] also show that training convergence at large bounds can be improved by linearly increasing E as training progresses. Inspired by this, we propose to linearly increase alongside cosine learning rate schedule and weight-space smoothing for improving the stability and convergence training (Ref: Algorithm-2 in the Appendix). The use of a lower learning rate larger improves training stability. As shown in Fig.3 and 7 of the Appendix, the performance and stability of the ACAT are significantly better when compared to the TRADES-AWP 2-step baseline, specifically computational cost. The proposed defense maintains a good clean accuracy at all the training e values considered, and has < 0.1% % robustness difference between last and best epochs.
larger perturbation bounds and higher model capacities, at the same
We thus show that even without modifying the training loss function it is possible to obtain significant gains in the stability and performance of 2-step adversarial training by using the proposed Ascending Constraint Adversarial Training. The proposed method can indeed improve the performance of other defenses such GAT [38] and NuAT [39] well, as shown in Table-8 of the Appendix.
Analysis of the proposed ACAT defense:
Conjecture-2: We hypothesize that given a Neural Network fo, that minimizes the TRADES loss [50] within a maximum perturbation radius of e, and has sufficient smoothness in weight space within an b radius &b around f.. there exist > E and model fo. where ||0g- 0zl I 36, such that fa. has lower TRADES loss within g' when compared to soa.
Justification presented Appendix-E.3.
Based on Conjecture-2, by selecting a small enough learning rate and large enough s/. it is possible move towards better solution w.r.t. the TRADES loss at e'. The smoothness loss surface further ensures that the gradients at e' are bounded with a low magnitude, preventing the onset of catastrophic
overfitting, which is known to be associated with large magnitude gradients [26]. This motivates the proposed approach ACAT that effectively combines an increasing schedule, cosine learning rate schedule that allows low learning rates larger values, and adversarial weight perturbation to ensure smoothness in the loss surface.
Stability improvements obtained using ACAT: We consider extreme of using single-step attacks for training, to demonstrate the stability improvements obtained using ACAT. We consider a checkpoint obtained at /25 while training using the proposed ACAT defense on CIFAR-10 architecture. We use this model as an initialization and perform
dataset for a WideResNer-344 single-step adversarial training using the TRADES-AWE training objective c=7.5/255. Our goal here is to merely verify the stability of single-step training, although the use of single-step attack makes the robustness gains marginal. We present the clean accuracy and robust accuracy against PGD-20 attack using different values of Adversarial Weight Perturbation step size y in 4(g.4(a). It evident from the plots that for fixed value of learning rate, increasing 7 can delay the onset of gradient masking, thereby improving the training stability. We also note marginal improvements in performance at higher 7, due to the enhanced generalization. Therefore, weight-space smoothing indeed helps in improving the performance and stability of the proposed defense. We also note from Fig.4 (bb that for fixed value of 7 = 0.01, lower learning rate leads to better stability, therefore cosine schedule also helps in improving stability. We note that the value of gamma in relation to the learning rate is crucial. Therefore, the proposed approach, we use a fixed value of y and reduce the learning rate using a cosine learning rate schedule to improve training stability increases.
7

---

Table 2: CIFAR-10: Performance (%) of the proposed defenses ACAT and DAJAT when compared to the state-of-the-ane Robust evaluations are performed on GAMA [38] and AutoAttack [6]. Training
time per epoch reported by running each algorithm across V100 GPUs.
CIFAR-10, ResNet-18
CIEAR-10, WideResNet-34
Method
Steps
Clean
GAMA
AutoAttack
Time/ppcch (sec)
Clean
GAMA
AutoAttack
NuAT2-WA [39]
2
82.21
50.97
50.75
109
86.32
55.08
54.76
ACAT, Ours (Base, 2step)
82.41
50.00
49.80
95
86.71
55.58
55.36
PGD-AT [27]
10
81.12
49.08
48.75
182
86.07
52.70
52.19
TRADES-AWP [50,44] 44]
10
80.47
50.06
49.87
228
55.88
55.69
TRADES-AWP-VE WA
10 80.41
49.89
49.67
228
85.10
56.07
55.87
TRADES-AWP- WA (200 epochs)
10
81.99
51.65
51.45
228
85.36
56.35
56.17
DAIAT, Ours (Base, AA)
2+2
85.60
51.27
51,06
160
87.87
56.97
56.68
DAJAT, Ours (Base, 2*AA)
2+4
85,99
51.71
51.48
219
88.90
57.22
56.96
DAJAT, Ours (Base, 3*AA)
2+6
86.67
51.81
51,56
280
88.64
57.34
57.05
Table 3: CIFAR-100, ImageNette: Performance (%) of the proposed defense DAJAT when compared to the state-of-the Robust evaluations are performed on GAMA [38] and AutoAttack [6].
CIFAR-100, ResNet-18
CIFAR-100. WideResNet-34
IN-10, ResNet-118
Method
[No. Steps
Clean
GAMA |AutoAtaack
Clean
GAMA
AutoAttack
Clean
GAMA
AutoAttack
TRADES-AWP [50, 44]
10
58.81
25,51
25.30
62.41
29.70
29.54
82.73
57.52
57.40
TRADES- SEEES-AAP-VEE WA
10
59.88
25.81
25.52
62.73
29.92
29.59
82.03
57.04
56.89
ACAL Ours (Base, 2stop)
2
62.05
26.35
26.10
65.75
30.61
30,23
82.34
57.12
56.96
DAIAT, Ours (Base. AA)
2+2
65.75
27.58
27.21
67.82
31.65
31.26
85.27
61.55
61.19
DAJAT. Ours (Base, 2*AA)
2+4
66.84
27.61
27.32
68.74
31.58
31.30
86.01
62.52
62.31
DAJAT, Ours (Base, 3*AA)
2+6
66.96
27.90
27.62
70.35
31.15
30.89
86.92
62.14
61.89
Experiments and Results
6.1 State-of-the-art comparison
We compare the performance of the proposed defenses ACAT and DAJAT against the 2-step and 10-step state-of-the-arr defenses NuAT2-WA [38]. TRADES-AWE [50, 44] and PGD-AT [27, 34] in Tables- 2, 3 and on the CIFAR-IO, CIFAR-100 [25] and ImageNette [20, 10]. We show in Table-16 of the Appendix that TRADES-AWE outperforms several other defenses in most settings, and the proposed defense DAJAT consistently outperforms all methods, showing substantial gains in performance. Further, since we integrate the proposed approach with TRADES-AWP, we primarily compare our approach with this across all datasets. We show in Table- 17 of the Appendix that DAJAT can be integrated with other base defenses [1, 32] as well to obtain performance gains. We integrate model weight averaging with the TRADES-AVE for fair comparison. We train all models for 110 epochs unless specified otherwise.
defense (termed as TRADES-AWP-WE as well
ACAT: We compare the performance of the proposed 2-step defense ACAT with the existing state-of-the-art 2-step defense NuAT2-WA [39] in the first partition of Table-2. While we achieve similar performance on ResNet-11, we obtain improvements in both clean and robust accuracy on WideResNNet34-100, We show in Section-E. E.4 that our proposed defense ACAT can be integrated with the Nuclear Norm training objective as well to obtain improved results. The performance of the proposed ACAT defense is superior to PGD-AT (10-step) defense [34] as well. When compared to the TRADES-AWT (10-step) defense, ACAT achieves substantial gains in clean accuracy and improved robust accuracy on CIFAR- 100 (Table-3), and improved clean accuracy at a slight drop in robust accuracy on CIFAR- 10 (Table-2), half the computational cost.
DAJAT: We present three variants of the proposed defense DAJAT, by using one, two and three AutoAugment based augmentations for every image, denoted (Base, AA). (Base, 2* AA) and (Base, A*AA) respectively. From Tables-2 and 3, we note that even by using only a single augmentation (Base, AA), we obtain improved clean and robust accuracy when compared to most of the baselines considered across all datasets and models. By increasing the number of augmentations to 2 (Base, 2* 2*AA), we observe consistent gains in robust and clean accuracy in all cases. In this setting, the computational complexity of the proposed approach matches with that of TRADES-AWE [44] as shown in Table-2. With the setting (Base, A*AA), we further obtain marginal improvements in performance over (Base, 2* AA). Overall, using the (Base, 2* AA) approach, which has comparable time complexity as the TRADES-AWP 10-step defense, we obtain large gains ranging from 3.8% to 7% on clean accuracy and ~ 1.8% in robust accuracy against AutoAttack [6] across most settings. On the Imagenette dataset we obtain 4.2% higher clean accuracy and 4.49% higher robust accuracy, showing that augmentation strategies work best when the amount of training data is less when
8

---

Table 4: Performance (%) of DAJAT using higher attack steps and 200 training epochs on CIFAR-10 and CIFAR-100. Evaluations are performed against Attok [6] and Common Comuptions (CC) [17].
RODUST
50
Robust Ace
Lh=0
LR=0 001
LR-0 0005
Training Epochs
Training Epochs
(a)
Dalaset
Mode
Method
[Cean
AutoAltack
CC
Figure 4: Impact of (a) AWP step size y and (b)
ResNec-18 18
TRADES- AWP-WA
Ours (Base. 2*AA)
81
85.71
52.50
51.45
76.13
learning rate (LR) stability of single-step
CIFAR-10
WRN-34-10
TRADES-AWE S.SSSAPP-WW.
Ours [Base. 2*AA)
85,36
$8.71
57,81
56.17
80.12
75.83
TRADES-AWP training using E = 7.5/255 2252 on model pretrained upto
7.25/255 using
18
Ours (Base, 27AA)
TRADES-AWP-WA.
68.45
59.11
25.97
27.69
47.95
54.85
ACAT. (a) For a fixed LR, increasing 7 improves
CIFAR-100
WRN-34-10
TRADES-AW
Ours (Basc, AA)
68.75
31.85
28.68
56.95
0.01, lower LR leads to better stability.
training stability. (b) For a fixed value of y
compared to the complexity of the task. We observe similar trend using smaller subsets of training data on C1 as shown in Fig.8 of the Appendix.
Scaling to higher attack steps, longer training and larger models: While the use of 2 attack steps helps in improving the training efficiency of DAJAT, we show that by using more attack steps and longer training epochs, we can indeed obtain further gains in performance. The varying schedule in DAJAT allows the use of an increasing schedule in the number of steps as well, thereby limiting the overall cost associated with higher attack steps. We present results by increasing the number of attack steps from 2 to uniformly every 50 epochs in Table-4 We obtain ~ 3.5% and 9% higher clean accuracy, along with 1 1.6% and 1.7 3.2% gains in robust accuracy against Auto/Atack on CIFAR-10 and CIFAR- 100 respectively when compared to the TRADES AWP- WA 200 epoch baseline. This achieves better mobustness-accuracy trade-off when compared to all existing defenses that use the same model architecture on the RobustBench leaderboard [7]. On the CIFAR-100 RobustBench leaderboard, we outperform all existing methods using the same model architecture, w.r.t. both clean and robust accuracy, including the ones that use additional data, showing that data augmentations can be effectively used to overcome the large sample complexity of adversarial training. The use of diverse augmentations in DAJAT also improves the generalization of the model to Common Corruptions by 4% and 8% on CIFAR-10- and CIFAR-100-C datasets [17] respectively as shown in Table-4. Further, we find that the performance gains obtained using DAJAT are higher on larger capacity models (Ref: Table-10 of the Appendix).
Computational Efficiency: As shown in Appendix-F.ae the use of ACAT strategy in the proposed DAJAT defense enables to achieve similar computational complexity as TRADES-A AWP defense, while obtaining gains in performance. Using DAJAT, we achieve 10% reduction in FLOPs (training) and training time, while obtaining 3.8-5.5% higher clean accuracy and 1-1.6% higher robust accuracy.
6.2 Ablation experiments
We present ablation experiments to highlight the significance of different components of the proposed approach in 5 on the CIFAR- 10 dataset using ResNet- 18 architecture. All experiments run for 1 110 training epochs, except A7 which is run for 220 epochs. We show the importance of the JS divergence term in the proposed loss in the ablations A1-A6 of 5 Using the IS divergence term we obtain ~ 1% higher clean accuracy across (Base, AA), (Base, A*A and (Base, A*A settings of the proposed defense. For (Base, 2* AA) and (Base, 3* AA) we obtain marginal improvements in robust accuracy as well. From A7, A9 and A10, we find that the proposed JS divergence term helps even in the case where both augmentations of image are generated using the same pipeline. Using based transformations, we obtain 1.6% higher clean accuracy when compared to the 220 epoch 2-step defense a comparable computational cost. Comparing A9, A10 and A11, we note that the use of simple and complex augmentations indeed shows improvements over the case of using 2 complex or simple augmentations alone. The importance of split-batch norm in the proposed approach can be evidently seen by comparing A12 and A14. By using single batch norm (A12) robust accuracy drops by 8. 8.24%. Further. in this case the JS term is also dropped, the robustness of the network is almost completely lost. This shows that using single batch norm layer for diverse augmentations makes harder for the network to converge. We also note that the JS divergence term indeed helps in improving the convergence of training in addition to improving performance. From Appendix-F.4 we note that the use of varying & schedule in DAJAT improves the stability of training resulting in large performance gains w.r.t. the use of fixed e, specifically at larger model capacities.
two

---

Table 5: Ablation experiments performed on the CIFAR-10 dataset using ResNet- architecture.
Robust Accuracy is reported against GAMA attack [38]
Method
| Steps
Clean
Robust|
Method
# Steps
Clean
Robust
[A]] Ours (Base, AA ), no div
2+2
84.55
51.45
[A8] Ours (Base, 2step)
2 82.41
50.00
[A2] Ours (Base. AA)
2+2
85.60
51.27
[A9] Ours (AA, AA)
2+2 2
84.68
49.71
[A3] Ours (Base, A*AAA no JS div
2+4
85.07
51.53
[A10] Ours (Base, Base) )
2+2
83.93
49.88
[A4] Ours (Base. 2*AA) )
2+44
85,99
51.71
[A1]] Ours (Base,
2+4
85.60
51.27
[A5] Ours (Base. 3*AA), ), no JS div
2
85.31
51.67
[A12] Ours (Base, 3* Single BN
2+ 6
86.68
43,57
[A6] Ours (Base, A* )
2+6
86.67
51.81
[A13] Ours (Base, 3+AA) Single BN, no JS
2+6
75.64
4,20
[A7] Ours (Base, 2step), 220 epochs]
83.05
50.31
[A14] Ours (Base, 3+AA)
2+6
86.67
51.81
Table 6: Impact of using other augmentations in DAJAT. Performance on CIFAR-10 dataset
with 18 architecture is reported. Robust evaluations are done against GAMA attack [38].
PreAct-ResNetle with Swish activation is used [33, 31].
Augmentation
Base + Aug
Base + 2 (Aug)
Augmmentation
Base + Aug
Base + 2 (Aug)
Angmentation
Clean| Robust
Clean Robust
Clean|
Robust
AAgmentation
Clean Robost
Clean Robust
Clean
Robust
No Aupmentation
76.32
43.20
78.08
41.71
77.42 47.42
41.07
Cateut [[]]
82.38
50.14
84.1
$1,40
85.11
51.60
Pul-Crop-!I-Fiip
82.41
50.00
83.69
51.30
83.62
$1.09
Cokour Jitter
82.98
48.82
84.50
51.19
84.85
$1.62
AutoAugment [8]
82.54
48.11
84,94
51.23
85,99
51.71
Mixup [49]
79.08
45.07
85.18
50.18
84.24
50.01
Cutmix [48]
79.03
41.57
82.33
50.90
81.64
49.50
RandAugment [9]
82.48
44.66
84.61
51.01
85.47
51.33
Cutmix [33,
82.01
47.65
50.97
85.49
51.58
Augmix [18]
82.38
48.84
84.96
50.4
85.18
50.51
6.3 Combining the proposed defense with other augmentations
We explore combining the proposed defense DAJAT with other augmentations in Table-6, and present the impact of individual augmentations in AutoAugment in Table-4 of the Appendix. We do not use the JS divergence term for Cutmix and Mixup since they involve changes in the label space. Without using any augmentation in the training dataset, we obtain poor clean and robust accuracy, highlighting the importance of the simple augmentations. The proposed approach obtains good performance gains using AutoAugment [8]. Color Jitter and CutOut [1 ]] augmentations, highlighting that it can work well with pixel-level and spatial augmentations. In case of CutMix [48] and Mixup [49], since the base accuracy obtained by using the augmentation alone is itself very poor, combining them with the proposed approach does not yield competent results. However they considerably better than naively using the augmentation. This shows that the proposed approach enables the use of a variety of augmentations without the need for careful selection. The use of Cutmix and Mixup in adversarial training are challenging since they involve changes in label space. We note that Rebuffi et al. [33] obtain considerable gains using Cutmix along with many other improvements. However, naively augmenting using CutMix leads to considerably degraded performance. By incorporating some of the tricks reproduced by Rade et al. [31] we obtain improvements in the CutMix baseline and obtain further gains in the proposed method as well (Ref: Appendix-F.7. Table- 15 of the Appendix).
7 Conclusion
Contrary to prior knowledge, we show that it is indeed possible to use common augmentation strategies that modify the low-level statistics of images to improve the performance of adversarial training. We propose a novel defense Diverse Augmentation based Joint Adversarial Training (DAJAT), that uses a combination of simple and complex augmentations with separate batch normalization layers allow the network training to benefit from the diverse training data distribution obtained using complex augmentations, while also specializing on a distribution that close to the test set. The use of JS divergence term between network predictions of different augmentations enables the joint learning across various augmentations. We improve the efficiency of the proposed defense by utilizing the proposed approach Ascending Constraint Adversarial Training (ACAT), that improves the stability and performance of TRADES 2-step adversarial training significantly by using a linearly increasing e schedule along with a cosine learning rate schedule and weight-space smoothing.
Limitations: While we focus our work on how to use augmentations effectively in adversarial training, we do not focus on which augmentations are best suited for the same. We believe this work can open up further possibilities towards finding better data augmentations for adversarial training.
8 Acknowledgments and Disclosure of Funding
This work was supported by a research grant (CRG/2021/005925 from SERB, DST, Govt, of India. Sravanti Addepalli is supported by Google PhD Fellowship in Machine Learning.
10

---

References
[1] S. Addepalli, S. Jain, G. Sriramanan, and V. B. Radhakrishnan. Sealing adversarial training large perturbation bounds. In The European Conference Computer Vision (ECCV), 2022. 7,8 8
[2] A. Athalye, N. Carlini, and D. Wagner. Obfuscated gradients give false sense of security: Circumventing defenses adversarial examples. In International Conference on Machine Learning (ICML., 2018. 3
[3] S. Ben-David, J. Blitzer. K. Crammer, A. Kulesza, F. Pereira, and J. W. Vaughan. A theory of learning from different domains. Machine learning, 79(1):151-175 2010.
[4] Q-Z Cai, C. Liu, and D. Song. Curriculum adversarial training. In Proceedings of the 27th International Joint Conference Arrificial Intelligence (ICCAI), 2018. 7
[5] Y. Carmon, A. Raghunathan, L. Schmidt, J. C. Duchi, and P. S. Liang. Unlaheled data improves adversarial robustness. In Advances in Neurol Information Processing Systems (NeurlPS), 2019. 1,3
[6] F. Croce and M. Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter- free attacks. In International Conference Muchine Learning (ICML), 2020. 3, 8,
[7] F. Croce, M. Andriushchenko, V. Sehwag, E. Debenedetti, N. Flammarion, M. Chiang. P. Mittal, and M. Hcin. Robusthench: a standardized adversarial robustness benchmark. In Thirty-fifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track (Round 2), 2021. 2,9
[8] E. D. Cubuk, B. Zoph, D. Mane, V. Vasudevan, and Q. V. Le. Autoaugment: Learning augmentation strategies from data. In Proceedings of the IEFF/CVP Conference Computer Vision and Pattern Recognition (CVPR), June 2019. 2, 3, 4. 10
[9] E. D. Cubuk, B. Zoph, J. Shlens, and Q V. Le. Randaugment: Practical automated data augmentation with reduced search space. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR) Workshops, 2020. 2,
[10] J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei. ImageNet: A Large-Scale Hicrarchical Image Database. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2009. 8
[11] T. DeVries and G. W. Taylor. Improved regularization of convolutional neural networks with cutout, arXiv preprint 1708 04552, 2017. 3, 10
[12] L. Fan, S. Liu, P.-Y. Chen, G. Zhang, and C. Gan. When does contrastive learning preserve adversarial robustness from pretraining to finetuning? Advances in Neural Information Processing Systems (NeurIPS), 34, 2021.
[13] I. Goodfellow, J. Pouget-Abadie, M. Mirza, Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio. Generative adversarial nets. Advances in neural information processing systems (NeurIPS), 27, 2014.
[14] I. J. Goodfellow. J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. In Interna- tional Conference on Learning Representations (ICLR), 2015. 1,2
[15] S. Gowal, C. Qin. J. Uesato. T. Mann, and P. Kohli. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arX1:20010.33591, 2020. 2, 3,
[16] S. Gowal, S.-A. Rebuffi, O. Wiles, F. Stimberg, D. A. Calian, and T. A. Mann. Improving robustness using generated data. Advances Neural Information Processing Systems (NeurlPS), 34, 2021. I
[17] D. Hendrycks and T. Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. In International Conference Learning Representations (ICLR), 2019. 9
[18] D. Hendrycks*, N. Mu E. D. Cubuk, B. Zoph. J. Gilmer, and B. Lakshminarayanan. Augmix: A simple method to improve robustness and uncertainty under data shift. In International Conference Learning Representatiions (ICLR),, 2020. 5, 10
[19] J. Ho, A. Jain, and P. Abbeel. Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems (NeurIPS), 33, 2020.
[20] J. Howard and S. Gugger. Fastai: a layered api for deep learning. Information, 11(2):108, 2020. 8
[21] S. loffe and C. Szegedy. Batch normalization: Accelerating deep network training by reducing internal covariate shift. In Proceedings of the 32nd International Conference on Machine Learning (ICML). Proceedings of Machine Learning Research. PMLR, 2015. 6

---

[22] P. Izmailov, D. Podoprikhin, T. Garipov, D. Vetrov, and A. G. Wilson. Averaging weights leads to wider optima and better generalization. arXiv preprint arXiv: 18X3:00003 2018. 3,
[23] Z. Jiang. T. Chen, T. Chen, and 7. Wang. Robust pre-training by adversarial contrastive learning. Advances in Neural Information Processing Systems (NeurIPS), 2020. 6
[24] A. Krizhevsky, I. Sutskever, and G. E. Hinton. Imagenet classification with deep convolutional neural networks. Advances in neural information processing systems (NeurIPS), 2012. 2
[25] A. Krizhevsky al. Learning multiple layers of features from tiny images. 2009. 8
[26] T. Li, Y. Wu, S. Chen, K. Fang, and X. Huang. Subspace adversarial training. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), 2022. 7
[27] A. Madry, A. Makelov, I.. Schmidt, T. Dimitris, and A. Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference Learning Representations (ICLR), 2018. 3,
[28] A. Merchant, B. Zoph, and E. D. Cubuk. Does data augmentation benefit from split batchnorms. ArXiv, abs/2010.07810, 2020. 6
[29] T. Pang. X. Yang, Y. Dong, H. Su, and J. Zhu. Bag of tricks for adversarial training. International Conference on Learning Representations (ICLR), 2021. 1,2
[30] N. Papernot, P. McDaniel, I. Goodfellow, S. Jha. Z. B. Celik, and A. Swami. Practical black-box attacks against machine learning. Proceedings of the ACM Asia Conference on Computer and Communications Security (ACM ASIACCS), 2017.
[31] R. Rade. PyTorch implementation of uncovering the limits of adversarial training against norm- coom-bounded adversarial examples, 2021. URL /ttps://github com/ imr ahulr / /wavvvvvvvarrrreeeeeee aal_ _erbuurouutttee tness_
pytorch. 10
[32] R. Rade and S.-M. Moosavi-Dezfooli. Reducing excessive margin to achieve a better accuracy vs. robustness trade-off. In International Conference on Learning Representations (ICLR), 2022. 8
[33] S.-A. Rebuffi, S. Gowal, D. A. Calian, F. Stimberg, O. Wiles, and T. A. Mann. Data augmentation can improve robustness. Advances in Neural Information Processing Systems (NeurIPS), 34, 2021. 3,4, 10
[34] L. Rice, E. Wong, and J. Z. Kolter. Overfitting in adversarially robust deep learning. In International Conference on Machine Learning (ICML), 2020. 1, 3,3, 8
[35] L.. Schmidt, S. Santurkar, D. Tsipras, K. Talwar, and A. Madry. Adversarially robust generalization requires more data. Advances in neural information processing systems (Neur/PS), 31, 2018. 1,3
[36] A. Shaciri, R. Nobahari, and M. H. Rohban. Towards deep leaminng models resistant to large perturbations. arXiv preprint arXiv:2003. 2020.
[37] C. Sitawarin. S. Chakraborty, and D. A. Wagner. Improving adversarial robustness through progressive hardening. ArXiv, 0bs/2003.093477 2020.
[38] G. Sriramanan, S. Addepalli, A. Baburaj, and R. Venkatesh Babu. Guided Adversarial Attack for Evaluating and Enhancing Adversarial Defenses. In Advances in Neural Information Processing Systems (NeurIPS).
2020. 3, 3,4,7 7, 8,
[39] G. Sriramanan, Addepalli, A. Baburaj, and R. Venkatesh Babu. Towards Efficient and Effective Adversarial Training. In Advances in Neural Information Processing Systems (NeurIPS), 2021. 6, 7.8
[40] D. Stutz, M. Hein, and B. Schiele. Relating adversarially robust generalization flat minima. In Proceedings of the IEFF/CVF International Conference on Computer Vision (ICCV), 2021. 2,5
[41] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations (ICLR), 2013.
[42] H. Wang, Chen, S. Gui, T.-K. Hu, Liu, and Z. Wang. Once-for-all adversarial training: In-situ tradcoff between robustness and accuracy for free. In Advances in Neural Information Processing Systems (NeurIPS), 2020.
[43] H. Wang. C. Xiao, J. Kossaiti, Z. Yu, A. Anandkumar, and Z. Wang. Augmax: Adversarial composition of random augmentations for robust training. In Advances in Neural Information Processing Systems (NeurIPS), 2021. 6
12

---

[44] D. Wu, S.-T. Xia, and Y. Wang. Adversarial weight perturbation helps robust generalization. Advances in Neural Information Processing Systems (NeurIPS), 2020. 3, 6,
[45] C. Xie and A. Yuille. Intriguing properties of adversarial training scale. In International Conference on Learning Representationss (ICIRR), 2020.
[46] C. Xie, M. Tan, B. Gong, Wang. A. L. Yuille, and V. Le. Adversarial examples improve image recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2020.
[47] C. Xie. M. Tan. Gong, A. Yuille, and Q. V. Le. Smooth adversarial training. arXiv preprint arXiv:2006.1453 2020.
[48] S. Yun. D. Han, S. J. Oh, S. Chun, Choc, and Y. Yoo. Cutmix: Regularization strategy to train strong classifiers with localizable features. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2019. 3, 10
[49] H. Zhang, M. Cisse, Y. N. Dauphin, and D. Lopez-Paz. mixup: Beyond empirical risk minimization. In International Conference Learning Representations (ICLR), 2018. 10
[50] H. Zhang, Y. Yu, J. Jiao, E. Xing. L. El Ghaoui, and M. I. Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference Machine Learning (ICML), 2019. 1, 3,
5. 6, 8
Checklist
1. For all authors...
(a) Do the main claims made the abstract and introduction accurately reflect the paper's contribu- tions and scope? [Yes]
(b) Did you describe the limitations your work? [Yes] Section-7
(c) Did you discuss any potential negative societal impacts of your work? [N/A] There are no known negative societal impacts of our work.
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you including theoretical results...
(a) Did you state full set of assumptions of all theoretical results? [N/A]
(b) Did you include complete proofs all theoretical results? [N/A]
3. If you experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experimental results (either in the supplemental material or as URLY? [Yes] https:/ //github. com/ vaavvvaliiii -isc// DAJAT.
(b) Did you specify all the training details (c.g., data splits, hyperparameters, how they were chosen)? [Yes] Appendix-F.2 F.2 and ReadMe file at https: //gtttb.b..... com/val- con/val-iiies -issc/DAJAT
(c) Did you report error bars (e.g.. with respect to the random seed after running experiments multiple times)? [Yes] Table 12 of the Appendix
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, cloud provider)? [Yes] Details compute: Table-13 of the Appendix, Details on resources: Appendix-F.2
4. If you using existing assets (e.g., code, data, models) curating/relcasing new assets...
(a) your work uses cxisting assets, did you cite the creators? [Yes] Appendix-F.I
(b) Did you mention license of the assets? [Yes] Appendix-F.I
(c) Did you include any new assets either the supplemental material as a URL? [Yes] We share the code for the proposed approach at ht https: // gi thub. com/val 1isc/DAJAT
(d) Did you discuss whether and how consent was obtained from people whose data you're us- ing/curating? [N/A] We use only publicly released and open-sourced datasets and codes.
(c) Did you discuss whether the data you are using/curating contains personally identifiable informa- tion or offensive content? (Yss) Appendix-F.1
5. If you used crowdsoureing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, if applicable? [N/A]
13

---

(b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, if applicable? [N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation? [N/A]
14


Reviews:
[{"review_id": "pIFlarnsNMN", "reviewer": "Reviewer_Kbj7", "summary": "The authors group common data augmentation into two groups: simple and complex.\nThe authors propose to use separate batch normalization layers for the two types of data augmentations, simple and complex. They argue that this helps to reconcile the distribution shift between the two types of augmentations. They also propose minimizing the JSD between the output of a network with perturbed weights when given different augmentation of a sample as an input. They show improvements in the clean and robust accuracy on multiple datasets. ", "questions": "Please address the points listed under Weaknesses and Questions above.", "limitations": "n/a", "rating": 6, "confidence": 2, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n- The authors' approach shows emperically gains in robustness and accuracy on multiple datasets.\n- The methods work well on small datasets.\n- The method is relatively computationally efficient.\n- The authors try to explain the results using the transfer learning theory proposed in [4].\n\n\n\nWeaknesses and Questions:\n1. The paper is not very easy to follow.\n2. The distintion between simple and complex is not very clear. For example: flip results in a large jump in the pixel space. Pad and crop is similar to translate in AA. I'm not sure how the authors draw the line and sperate the two augmentations. Many AA have little effect on the pixel space statistics.\n3. Line 143-151:  I don't think the results shown conclusively support the arguments presented. I think the section should be revised to better explain what the authors mean. For example, the authors say (Line 145) `There is a large difference between the augmented\n data and test data in pixel space, although they may be similar in feature space. `. I think the differnce between the augmented data and the  test data is similar to that between the augmented data and the adverserial test data in the pixel space, since the adversarial examples are only an $\\epsilon$ away from the real test data.\n4. Table 1 should include baseline models trained with neither of the data augmentation types and both. \n5. Lines 221-223: I don't understand the reasoning here. $\\gamma$ and $\\beta$ are learned parameters and expected to be different when trained on different data, even if the data disterbution is similar. $\\gamma$ and $\\beta$  scale and add a bias to the normalized data (equation in line 208). Figure 1 shows the the mean and var are the same for both augmentation types (in cos similarity) which hints the the statstics of both augmentation types are similar. This contracdicts the argument the authors presenting ? \n\n**UPDATE:**\nI appreciate the authors' comprehensive response and clarification of the ambiguous points. I must admit that I am still not convinced that the authors' method of splitting the augmentation is completely sound. However, the authors provide strong empirical evidence to support their approach.\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "_c5j2v6m8VD", "reviewer": "Reviewer_nzVH", "summary": "This paper tackles the problem of Lp-norm robustness for classification. More specifically, previous papers have shown that data augmentations are helpful for adversarial robustness for certain conditions: network with big capacity and data augmentations have to preserve low-level features. Here, this paper shows that these conditions can become unnecessary by using data augmentation specific batch normalization layers. In this way, complex data augmentations will not impact the network capacity. The authors also propose an optimised training strategy with: 1) increasing perturbation radius throughout training and 2) using JS divergence.", "questions": "* Please see above the weaknesses section: especially point 1) which could be easily addressed.\n\n* Just a quick related work comment: split batch normalization layers have been used for supervised learning setting (page 3) in AdvProp and similar line of work (Pyramid Adversarial Training) and not only self-supervised learning setting.", "limitations": "The authors did not mention any negative societal impact of their work.", "rating": 6, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths: \n* The paper is very clear and well-written. This work starts from previous results in the literature to come up with a simple but effective approach regarding the use of data augmentation for adversarial training.\n* Very thorough experimental section and appendix. This type of paper with many ablation studies and in-depth analysis is very useful for the community as it can be a great source of inspiration for future work.\n* Experimental results speak for themselves with clear improvement on robust and clean accuracies.\n\nWeaknesses:\n1) The usefulness of the ascending perturbation radius could be more extensively checked in the paper. Currently, in Figure 2, panel (a) shows better performance on clean accuracy but not really on robust accuracy in panel (b) as the robust accuracy at 8/255 seems the same when training at 8/255 with or without ACAT.  Hence, it is not clear that it is a key element in DAJAT as there is no ablation study of DAJAT without ascending perturbation radius (sorry if I missed it) and it would have been nice to have in Table 2 ACAT vs fixed perturbation radius (besides just having Figure 2 for this comparison).\n2) It is not clear whether this approach stills helps for larger architectures as split batch normalization layers is already a way of cleverly increasing the network expressiveness with few parameters. Maybe, this approach has diminishing returns when the network has more capacity. This would require further investigation but I understand that it might require too much compute to check it.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "5PB2u_paMqC", "reviewer": "Reviewer_7Xuh", "summary": "This paper combines many previous robust training techniques together: adversarial training, Auto Augmentation, Split batch normalization, smoothness regularization (JSD loss), progressively hardened adversarial training, etc.", "questions": "Please see above. ", "limitations": "Please see above. ", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\nThe paper is well written, and the method achieves good empirical performance. \n\nWeakness:\n1. The technical novelty is limited. \nThis proposed method is just a simple combination of many previous robust training techniques together: adversarial training, Auto Augmentation, Split batch normalization, smoothness regularization (JSD loss in AugMix), progressively hardened adversarial training [1,2], etc. It is undoubtedly a good technical report but hard to justify its technical novelty as a research paper. \n\n[1] Curriculum Adversarial Training. IJCAI, 2018.\n[2] Improving Adversarial Robustness Through Progressive Hardening. 2020.\n\n2. Unfortunately, I find some claims in the paper to be wrong. \n\nFor example, in lines 211-214: \"Prior works use separate batch normalization layers for clean and adversarial images to improve the performance of adversarial training, specifically in a self-supervised learning scenario [46, 27, 14]. However, in a supervised learning setting, state-of-the-art defenses often use single batch normalization layers for both clean and adversarial images.\"\n\nThis is wrong. Unfortunately, your paper is not the first to use separate BN in supervised learning. In fact, separate BN is originally proposed and most widely used in supervised learning. Just to name a few: [3,4,5,6,7,8]\n\n[3] Intriguing properties of adversarial training. ICLR, 2020. \n[4] Adversarial examples improve image recognition. CVPR, 2020.\n[5] Does data augmentation benefit from split batchnorms. 2020.\n[6] Once-for-all adversarial training: In-situ tradeoff between robustness and accuracy for free. NeurIPS, 2020.\n[7] Shape-texture debiased neural network training. ICLR, 2021.\n[8] AugMax: Adversarial composition of random augmentations for robust training. NeurIPS, 2021.\n\n\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "0LxUfpjiM8U", "reviewer": "Reviewer_v5Go", "summary": "The paper proposes an augmentation strategy for adversarial training by combining simple and complex augmentations to improve the effectiveness of the augmentation and introducing ACAT that gradually increases adversarial epsilon with 2 adversarial defence steps to allow the method to work efficiently. Three claims of justification are listed based on the connection with domain generalization theory. Two important conjectures are proposed and verified through detailed analysis and solid experiments. Comprehensive experiments conducted on several benchmarks for comparisons and ablation studies are provided in the main paper and the supplementary materials. With comprehensive experiments and substantial improvement, this study may be an important milestone for future work.", "questions": "NA", "limitations": "NA", "rating": 7, "confidence": 5, "soundness": 4, "presentation": 3, "contribution": 4, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n-The paper is well-written and easy to follow. Claims are supported by detailed analysis and convincing experiments.\n\n-The proposed method gains substantial improvement over the state-of-the-art baselines and beats the concurrent work. \n\n-The proposed method is novel, effective, efficient and convincing. The paper provides better understanding of augmentations in adversarial training.\n\n-The authors conduct comprehensive experiments considering different settings and different comparisons to verify their ideas.\n\nWeakness:\n\n-The author claims that the method is efficient, could they provide FLOPs, number of parameters and training time of the model?", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Accept