Label Noise in Adversarial Training: A Novel Perspective to Study Robust Overfitting
Authors: Chengyu Dong
Liyuan Liu
Jingbo Shang
Venue: NeurIPS 2022 Accept (2022)
Keywords: Adversarial training
Label noise
Robust overfitting
Double descent

Abstract: We show that label noise exists in adversarial training. Such label noise is due to the mismatch between the true label distribution of adversarial examples and the label inherited from clean examples – the true label distribution is distorted by the adversarial perturbation, but is neglected by the common practice that inherits labels from clean examples. Recognizing label noise sheds insights on the prevalence of robust overfitting in adversarial training, and explains its intriguing dependence on perturbation radius and data quality. Also, our label noise perspective aligns well with our observations of the epoch-wise double descent in adversarial training. Guided by our analyses, we proposed a method to automatically calibrate the label to address the label noise and robust overfitting. Our method achieves consistent performance improvements across various models and datasets without introducing new hyper-parameters or additional tuning.

Label Noise in Adversarial Training: A Novel Perspective to Study Robust Overfitting
Chengyu Dong
Liyuan Liu Microsoft Research
University of California, San Diego edongdeng.. ucsd. edu
lucl micliu@micoosoft.c com
Jingbo Shang
University of California, San Diego j jshangSeng, ucsd. edu
Abstract
We show that label noise exists in adversarial training. Such label noise is due to the mismatch between the true label distribution of adversarial examples and the label inherited from clean examples - the true label distribution is distorted by the adversarial perturbation, but is neglected by the common practice that inherits labels from clean examples, Recognizing label noise sheds insights on the prevalence of robust overfitting in adversarial training, and explains its intriguing dependence on perturbation radius and data quality. Also, our label noise perspective aligns the epoch-wise double descent in adversarial training.
well with our observations Guided by our analyses, we proposed a method to automatically calibrate the label address the label noise and robust overfitting. Our method achieves consistent performance improvements across various models and datasets without introducing new hyper-parameten or additional tuning.
Introduction
Adversarial training (Goodfellow et al. 2015 Huang al. 2015 Kurakin al. [017 Madry et al.
2018) known as one the most effective ways (Athalye et al. 2018 Uesato et al. al. 2018) to enhance the adversarial robustness of deep neural networks (Szegedy et al. 2014 Goodiellow al. 2015)
augments training data with adversarial perturbations to prepare the model for adversarial attacks. Despite various efforts to generate more effective adversarial training examples (Ding al. 2020
Zhang et al. 2020), the labels assigned to them attracts little attention. As the common practice, the assigned labels of adversarial training examples are simply inherited from their clean counterparts.
In this paper, we argue that the existing labeling practice of the adversarial training examples introduces label noise implicitly, since adversarial perturbation distort the data semantics (Tsipras) et al. 2019 [lyas et al. 2019). For example, as illustrated Figure even with slight distortion of the data semantics (e.g.. more ambiguous), the label distribution of the adversarially perturbed data may not match the label distribution of the clean counterparts. Such distribution shift is neglected when assigning labels adversarial examples, which are directly copied from the clean counterparts. We observe that distribution mismatch caused by adversarial perturbation along with improper labeling practice will cause label noise adversarial training.
is a mysterious and prominent phenomenon that the robust test error would start to increase after conducting adversarial training for certain number of epochs (Riee et al. 2020). and our label noise perspective provides an adequate explanation for this phenomenon. Specifically, from a classic bias-variance view of model generalization, label noise that implicitly exists in adversarial training
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

airplane
cat
frog
horse
ship
Label
Assigned
P(P
Figure 1: Illustration of the origin of label noise in adversarial training. The adversarial perturbation causes a mismatch between the true label distributions of clean inputs z and their adversarial examples x². Such a distribution mismatch is however neglected by the labels assigned to adversarial examples in the common practice of adversarial training, resulting in label noise implicitly.
can increase the model variance (Yang et al. 2020) and thus make the overfitting much more evident
compared to standard training. Further analyses of label noise in adversarial training also explain the intriguing dependence of robust overfitting on the perturbation radius (Dong et al. 2021b) and data quality (Dong al. 202 a presented in the literature.
Providing the label noise in adversarial training, one can further expect the existence of double descent based on the modern generalization theory of deep neural networks. Epoch-wise double descent refers to the phe- nomenon that the test error will first decrease and then
80-
WRN FFRN-28-U 1/4
Robust Test Error (%)
WRN-28-1
75.-
WRN-28-5
70-
increase as predicted by the classic bias variance trade- off, but will decrease again as the training continues. Such phenomenon is only reported in standard train- ing of deep neural networks, often requiring significant label noise in the training set (Nakkiran As the label noise intrinsically exists in adversarial training, such epoch-wise double descent phenomenon also emerges when the training goes longer. Indeed, as shown in Figure 2 for a relatively large model such as WRN-28-5, on top of the existing robust overfitting phenomenon, the robust test error will eventually de- crease again after 1, 000 epochs. Following Nakkiran et al. 2020), we further experiment different model sizes. One can find that medium-sized model will follow a classic U-curve, which means only overfitting is observed; and the robust test error for a small model will monotonically decrease. These are well aligned with the observations in standard training regime. This again consolidates understanding of label noise in adversarial training.
65-
60-
al., 2020).
10'
10a
10'
Epochs
Figure Robust overfitting can be viewed as early part of the epoch- wise double descent. We employ PGD training (aadry et al. 2018) CIFAR- 10 (Krizhessy)) 2009) with Wide ResNet (WRN) Zagoruyko & Komodakis 2016) and fixed learning rate. WRN-28-k refers WRN with depth 28 and widen factor k.
In light of our analyses, we design theoretically eeeoroicallly-grouneedd method mitigate the label noise in adversarial training automatically. The key idea is to resort to an alternative labeling of the adversarial examples. We show that the predictive label distribution of an adversarially trained probabilistic classifier can approximate the true label distribution with high probability. Thus it can be utilized as a better labeling of the adversarial examples and provably reduce the label noise. We also show that with proper temperature scaling and interpolation, such predictive label distribution can further reduce the label noise. This echocs the recent empirical practice of incorporating knowledge distillation (Hinton et al. 2015) into adversarial training (Chen et al. 2021). While previous works heuristically select tixed scaling and interpolation parameters for knowledge distillation, we show that it is possible to fully unleash the potential of knowledge distillation by automatically determining the set of parameters that maximally reduces the label noise, with a strategy similar to confidence calibration (Guo al. 2017). Such strategy can further mitigate robust overfitting to minimal amount without additional human tuning effort. Extensive experiments on different datasets, training methods, neural architectures and robustness evaluation metrics verify the effectiveness of our method.
In summary, our findings and contributions are: 1) we show that the labeling of adversarial examples in adversarial training practice introduces label noise implicitly; 2) we show that robust overfitting

---

can be adequately explained by such label noise, and it is the early part of an epoch-wise double descent: 3) 2e show an alternative labeling of the adversarial examples can be established provably reduce the label noise and mitigate the robust overfitting.
2 Related Work
Robust overfitting and double descent in adversarial training. Double descent refers to the phenomenon that overfitting by increasing model complexity will eventually improve test set performance (Neyshabur et al. 2017 Belkin et al. 2019). This appears to conflict with the robust overfitting phenomenon in adversarial training, where increasing model complexity by training longer will impair test set performance constantly after a certain point during training. is thus believed in the literature that robust overfitting and epoch-wiss wise double descent are separate phenomena (Rice) et al. 2020). In this work we show this is not the complete picture by conducting adversarial training for exponentially more epochs than the typical practice.
recent work also considers different notion of double descent that is defined with respect the perturbation size Yu et al. 202T). Such double descent might be more related to the robustness- accuracy trade-off problem Papernot et al., 2016 Su al. 2018 Tsipras al. 2019 Zhang et al.) 2019), rather than the classic understanding of double descent based on model complexity.
Mitigate robust overfitting. Robust overfitting hinders the practical deployment of adversarial training methods as the final performance often sub-optimal. Various regularization methods including classic approaches such as é and & regularization and modern approaches such as cutout (Devries & Taylor 2017) and mixup (Zhang et al. 2018) have been attempted to tackle robust overfitting, whereas they shown perform
better than simply early stopping the training on a validation set (Rice et al. 2020). However, early stopping raises additional concern as the best checkpoint of the robust test accuracy and that of the standard accuracy often do not coincide (Chen et al. 202I). thus inevitably sacrificing the performance on either criterion. Various regularization methods specifically designed for adversarial training are thus proposed to outperform early stopping, including regularization the flatness of the weight loss landscape (Wu et al. 2020 Stutz et al. 1 introducing cow-curvature activation functions (Singla al. (021). lata-driven augmentations that adds high-quality additional data into the training (Rebutfi et al. 2021) and adopting stochastic weight averaging (Izmailov et al. 2018) and knowledge distillation (Hinton et al. 2013) (Chen el al. 2021). These methods are likely to suppress the label noise in adversarial training, with the self-distillation framework (i.e. the teacher shares the same architecture as the student model) introduced by (Chen)
et al., 2021) as a particular example since introducing teacher's 's outputs as supervision is almost equivalent to the alternative labeling inspired by our understanding of the origin of label noise in adversarial training.
3 Preliminaries
statistic model of label noise (Frénay & Verleysen, 2014). Let X C IRd define the input space equipped with norm || : X - IR and y = [ == (I, K} define the label space. We introduce four random variables to describe noisy labeling process. Let X E X' denote the input, Y E Y denote the true label of the input, Y E y denote the assigned label of an input provided by an annotator, and finally E denote the occurrence of a label error by this annotator. E is binary random variable with value indicating that the assigned label is different from the true label for a given input, i.e., E = 1 (Ý o Y). We study the case where the label error depends on both the input X and the true label Y. For classification problem, training set consists of set of examples that are sampled as = { (.) hie
Definition 3.1 (Label noise). We define label noise Pe in training set DD as the empirical measure of the label error, namely (D) 1/N EiEIN 1( # y.).
Assumption 3.1. We assume the annotation of a clean dataset involves no label error, namely P(E = 1|Y w) 0. This directly implies P(ý (x) = P(Y (x)) (see proof in the Appendix).
Definition 3.2 (Data quality). Given a training set D, we define data quality as g(D)
P(y y/4)
3

---

as the Adversarially augmented training set. Let f : + y be probabilistic classifier and f()); be its predictive probability class j. The adversarial example of x generated by is obtained by solving the maximization problem x' = arg max (x) {(f(z), y). Here & can be typical loss function such cross-entropy. And (x) denotes the norm ball centered at with radius i.e. (x)x) {a E X: || x|| S E...
Following previous notations, we denote Y' as random variable representing the true label of æ' and Y' as random variable representing the assigned label of r', We refer D adversarially augmented training set.
Adversarial training. Adversarial training can be viewed as a data augmentation technique that trains the parametric classifier fo the adversarially augmented training (Tsipras al. 2019).
namely
0" arg min
1 |DI
Σ
((o()').T))
4 Label noise implicitly exists in adversarial training
In this section, demonstrate the implicit existence of label noise in the adversarially augmented training set. We first consider a simple case where the adversarial perturbation is generated based on an ideal classifier that predicts the true label distribution. Under such case we prove that the label noise in the adversarially augmented training set is lower-bounded. We then show that in realistic cases an adversarially trained classifier can approximate the true label distribution with high probability. Therefore, additional error terms will be required to lower bound the label noise. All proof's for the remainder of this paper are provided in the appendix.
4.1 When adversarial perturbation is generated by the true probabilistic classifier
We first consider ideal case where the adversarial perturbation is generated by the probabilistic classifier f(x) = P=Y]:,, namely the classifier producing the true label distribution on any input x.
The true label distribution is distorted by adversarial perturbation. We quantify the mismatch between two probability distributions using the total variation (TV) distance.
Definition 4.1 (TV distance). Let A be a collection of the subsets of the label sample space y The TV distance between two probability distributions P(Y) and P(Y!) can be defined as P\Y P(Y')ll = sup IP(Y E J) - P(Y" E J))-
We now show that adversarial perturbation generated by the true probabilistic classifier can induce a mismatch between the true label distributions of clean inputs and their adversarial examples. For simplicity we consider adversarial perturbation based on FGSM and cross-entropy loss, namely x' = x=</IV f())y|1 [(x)y- The distribution mismatch induced by such adversarial perturbation can be lower bounded.
Lemma 4.1. Assume f(x)yy is T-locally Lipschitz around x with bounded Hessian. Let om infzeB,()) (x) Jmin (z))) > and σ = SuP=eB.(z) Tmax (Ta (2)gg O. Here Juin and T denote the minimum and maximum eigenvalues of the Hessian, respectively. We then have
[P(Y - P(Y'\=') -P(Y))) 2
E (1-1(x))
Tm 2²
4 OM:
L
One can find that the right-hand side is positive as long as the upper bound of the Hessian norm not too large, which is reasonable previous works have shown that small hessian both standard (Keskar et al. 2017) and robust generalization (Moosavi-Deziooll et al. 2019).
is critical to
Assigned label distribution is unchanged. Despite the fact that the true label distribution is distorted by adversarial perturbation, we note that the assigned label distribution adversarial examples is still the same their clean counterparts.
Remark 4.1. In adversarial training, it is the common practice that directly copies the label of clean input to its adversarial counterpart, namely i =ÿ ÿ and P(Ý'|x') px))

---

Standard Test Error (%6)
70
80
40/255
80/255
60-
Test Error (%)
60
50
40-
0
8/255
30
10"
10
10
10"
10a
10'
10
10a
Epochs
Epochs
Figure Standard training on fixed ad- versarially augmented training set (e.g. 16/255) can also produce prominent over- fitting. In contrast, the original training set without adversarial perturbation applied (e = 0), no overfitting is observed.
Figure Standard training on a training set augmented by Gaussian noise will not pro- duce overfitting. Here we select extremely large perturbation radius (e.g. to reduce the test error to be comparable to the adversarially augmented case.
80/255)
Distribution mismatch indicates label noise. distribution and the assigned label distribution in training set will always indicate the existence of label noise.
We show that a mismatch between the true label
Lemma 4.2. Given training set D ((xs Me (e) selN, the label noise is lower-bounded by the mismatch between the true label distribution and the assigned label distribution. Specifically, with probability 5, we have
Pe (D) 2 P. P(Y -
log
(3)
2N
Label noise implicitly exists in adversarial training.
the adversarially augmented training set D', such distribution mismatch exists exactly. By Remark 4.1 we have P(Ý*(z²)= P(Y|=)) and by property of the clean dataset (Assumption 3.1 we have P( = P(Y[z), which together means P(Ý'=>) = P(Y (z). However, Lemma 4.1 shows that P(Y'(z') * P(Y[z), which implies that P(Y'<z)) # P(Y' This indicates that label noise exists in the adversarially augmented training set. We now have the following theorem, which is our main result.
Theorem 4.3. Assume f(x), is L-locally Lipschitz around with Hessian bounded below. Instantiate the same notations as in Lemma H.1 With probability 1 ò. we have
E (1- (D('))
c(D)) 0m
2
2 log
OM
2N
8
The above results suggest that as long as a training set augmented by adversarial perturbation, but with assigned labels unchanged, label noise emerges. We demonstrate this by showing that standard training on a fixed adversarially augmented training set can also produce overfitting. Specifically, for each example in clean training set apply adversarial perturbation generated by adversarially trained classifier. We then fix such an augmented training set and conduct standard training on it. We experiment on CIFAR-10 10 with WRN-28-5. A training subset of size 5k is randomly sampled speed up the training. More details about the experiment settings can be found in the appendix. Figure 3 shows that prominent overfitting (as well as epoch-wise double descent) can be observed when the perturbation radius is relatively large.
On the other hand, if training set is augmented by perturbation that will not distort the true label distribution, there will not label noise. We demonstrate this by showing that standard training on training augmented with Gaussian noise will not induce overfitting. As shown in Figure even with a extremely large radius of Gaussian perturbation, no overfitting observed. This also demonstrates that input perturbation not necessarily leads overfitting.
Intuitive interpretation label noise in adversarial training. We introduce simple example to help understand the emergence of label noise in adversarial training.
5

---

Example 4.1 (Label noise due to a symmetric distribution shift), Let D = { yi Ne be clean labeled training subset where all inputs x; x are identical and have a one-hot true label distribution, i.e., [(Y ly
We now construct an adversarially augmented training subset DD' = {(dd; HENN, where v' and x' is generated based on adversarial perturbation that distorts the true label distribution symmetrically. Specifically,
[1-1,
i- 1n/(K 1), otherwise.
P(Y' = jj'la')
Then by Lemma 4.2 we have Pe 2 1
One can find that there is indeed 7) faction of noisy labels in D'. This is because if we sample the labels of x' based on its true label distribution, expect 1 1- faction of z' are labeled y, while fraction x' are labeled to be other classes. However, in D', all x' are assigned with label y which consider inputs with similar
means yy fraction of x' are labeled incorrectly. In realistic datasets features for such reasoning.
The above example also shows that label noise in adversarial training may be stronger than one's impression. Even slight distortion the true label distribution, e.g. 1/ = 0.1, will equivalent to at least 10% noisy label in the training set. This is because the true label distribution of every training input is distorted, resulting in significant noise in the population.
Dependence of label noise in adversarial training, Theorem 4.3 shows that the label noise in adversarial training proportional (I) the perturbation radius (2) the data quality. Considering label noise can be an important source of variance in the generalization of deep neural networks (Nakkiran al. 2020 Yang et al. 2020), such dependence of label noise explains the intriguing observations in the literature that robust overfitting (or spoch-wise double descent) in adversarial training will vanish with small perturbation radii (Dong et al. 2021b) or high-qu sigh-quality data (Dong et al. 2021a). We conduct more controlled experiments to verity this correlation empirically, as shown in Figure
Perturbation Radius (/255)
Quality Rank (x10²)
16
30
30
40
100
95
(Rabust) Test Error (%)
Robust Test (96)
90-
80-
80-
20-
73
30-
30
10a
100 100
101
10a
Epochs
Epochs
Figure 5: (Left) Dependence of robust overfitting on the perturbation radius. A training subset of size 5k is randomly sampled to speed up the training. ε = 0/255 indicates the standard training where double descent occurs. (Right) Dependence of robust overfitting the data quality with a fixed perturbation radius (s = 8/255). To construct a training subset with high data quality, we first calculate the predictive probability based all training examples based on the predictive probability and select the top-k ones. The curves smoothed by a window of 5 epochs to reduce overlapping. Here conduct PGD training on CIFAR-10 10 with WRN-28-5. More experiment details can be found the Appendix.
ensemble of multiple models. We then rank
4.2
Adversarial perturbation generated by realistic classifier
We now consider a realistic case where the adversarial perturbation is generated by probabilistic classifier fg-
Approximation of the true label distribution. We show that after sufficient adversarial training, the predictive label distribution of fo can approximate the true label distribution with high probability. Lemma 4.4. Denote S {a (x. y) E D) as the collection of all training inputs. Let p 2 and C be an pe-external covering of S with covering number N Let fo be probabilistic classifier

---

that minimizes the adversarial empirical risk 4 Assume fo is Lo-locally Lipschitz continuous in a norm ball of radius pe, around & E C. Let k. 2 1 and S be a subset of S with cardinality at least (1 (1-1/K+1/ (x N. (S) denote the neighborhood of the set S, i.e. Ne(S)) = Une$ (z)).
Then for any a E N (S) with probability at least 1 6.
KN 2N
2 + log 8 -(2
1 1 -(2--x K
(Ifo(z) - P(X S
Lg + +L) PE,
(5)
Label noise in adversarial training with a realistic classifier. Adversarial perturbation generated by a realistic classifier fo will distort its predictive label distribution by gradient ascent. Subsequently, the true label distribution will also be distorted with high probability since the predictive label distribution of a realistic classifier fo can approximate the true label distribution. Specifically, by the triangle inequality we have
[|P(Y)=)) P(Y" llv 2
(6)
where the last two terms are the approximation error of true label distribution on both clean and adversarial examples, which are guaranteed to be small. To conclude, we have the following result.
Theorem 4.5. Instantiate the notations of Lemma 4.4 For any x (S) with probability least
1 - -6, we have
Pe(DD) 2 (1 (1-Eufo(z))) 2L
2p ((2
1 K
La +1) Lo
20 -5V 2N
2 log
(7)
8"
where { 1 / /ARNNck
5 Mitigate Label Noise in Adversarial Training
Since the label noise incurred by the mismatch between the true label distribution and assigned label distribution of adversarial examples in the training set, we wish to find an alternative label (distribution) for the adversarial example to reduce such distribution mismatch. We've already shown that the predictive label distribution of classifier trained by conventional adversarial training, which we denote as model probability in the following discussion, can in fact approximate the true label distribution. Here we show that it is possible to further improve the predictive label distribution and reduce the label noise by calibration.
5.1 Rectify model probability to reduce distribution mismatch
We show that it is possible to reduce the distribution mismatch by temperature scaling (Hinton et al. 2015 Guo et al. 2017) enabled in the softmax function.
Theorem 5.1 (Temperature scaling can reduce the distribution mismatch). Let fo T) denote the predictive probability of probabilistic classifier scaled by temperature T, namely fo(x; exp(2,/T)/(E, exp(z;/T)), where is the logits of the classifier from x. Let x' be an adversarial example correctly classified by a classifier fo. i.e. arg max; fo(x')s = y', then there exists T, such that
[loo - P(Y'(=')llv & [1fo(x²) - x2))lv
Another way to further reduce the distribution mismatch to interpolate between the model probabil- ity and the one-hot assigned label. We show that the interpolation works specifically for incorrectly classified examples and thus can be viewed as a complement to temperature scaling.
Theorem 5.2 (Interpolation can further reduce the distribution mismatch). Let x' be an adver- sarial example incorrectly classified by a classifier fe. i.e. arg max, fe(x';T), 4 y'. Assume max; P(Y'= = j]x'') 2 1/2, then there exists an interpolation ratio X such that [= A) P(Y"\a")llvv S () -
where fola';I, X fo(x' (1 A) P(Ý'
7

---

As a summarization, to reduce the distribution mismatch, we propose to use fo(x';T, X) as the assigned label of the adversarial example in adversarial training. which we refer as the rectified model probability.
In Appendix
show that the optimal hyper-parameters (i.e. T and X) of almost all training examples concentrate on the same set of values by studying on synthetic dataset with known true label distribution. Therefore it is possible to find an universal set of haper-parameters that reduce the distribution mismatch for all adversarial examples.
5.2
Determine the optimal temperature and interpolation ratio
The set of temperature and interpolation ratio in the rectified model probability that maximally reduces the distribution mismatch is not straightforward to find as the true label distribution of the adversarial example unknown in reality. Fortunately, given sufficiently large validation dataset as whole, it is possible to measure the overall distribution mismatch in frequentist's s view without knowing the true label distribution of every single example. popular metric adopted here the negative log-likelihood (NLL) loss, which is known as proper scoring rule (Gneiting & Raftery 2007) and is also employed in the confidence calibration of deep networks (Guo et al. 2017). By Gibbs's s inequality it is easy to show that the NLL loss will only be minimized when the assigned label distribution matches the true label distribution (Hastic et al. 2001), namely
(a'aa J'E log fo(='; 2 P(Y")))( P(Y'
(8)
Therefore, we propose to find the optimal T and À as
T, A = arg min - B JED,,, log (x': N)y-
(9)
5.3 Rectified model probability mitigates robust overfitting
We now work on realistic dataset (CIFAR-10) demonstrate the rectified model probability can effectively mitigate the robust overfitting, or equivalently the epoch-wise double descent in adversarial training. The outer minimization of adversarial training (Equation ①
now becomes
1.53
1.00
0" = arg min Ex (god'"),
Robuat Teat Ace 190
(10)
where 0 denotes the parameters of classifier adversarially trained beforehand. The details
of the experimental setting are available in the
Lac Chockces
Appendix.
As shown in Figure 6, adversarial training on rectified model probability can mitigate the ro- bust overfitting when the temperature T and in- terpolation ratio À are optimal. Such optimal hyperparameters perfectly aligns with the ones automatically determined by Equation (
Figure 6: (Upper) NLL loss obtained on the valida- tion set for different T and X. (Bottom) Robust test accuracy at the best and last checkpoint by adver- sarial training with the rectified model probability with different T and X. X 0.8 for grid search (Left) and T = for grid search on À (Right). Orange dashed lines indicate T and X determined by Equation
Experiments
Experiment setup.
We conduct experiments on three datasets including CIFAR- 10, CIFAR-
100 (Krizhevsky) 2009) and Imag-Ima (Le & Yang, 2015). We conduct PGD training on pre- activation ResNet- (He et al. 2016) with 10 iterations and perturbation radius 8/255 by default. We evaluate robustness against Exx norm-bounded adversarial attack with perturbation radius 8/ 8/255, and
employ AutoAttack (Croce Hein 2020) for reliable evaluation. Appendix D.2 includes results on
additional model architectures (c.g., VGG (Simonyan & Zisserman 2015), WRN), adversarial training

---

CIFAR-10
CIFAR-100
Tiny-ImageNet
[a]
(b)
Test Accuracy (%6
60-
Test Accuracy (%)
Test Accuracy (96)
60-
60-
SAIPG ATI
(PGD
(TGD-A)
(PG2.ATI
(PGD-AT)
20-
10
25
50
75
100
125
150
25
50
75
100
125
150
5
25
60
Epochs
Epochs
Epochs
Figure 7: Our method can effectively mitigate robust overfitting for different datasets.
Table 1: Performance of our method on different datasets. denotes the hlyper-parametent automati- cally determined by our method.
Robust Acc.
(%)
Standard Acc.
(%)
Dataset
Setting
T
X
Best
Last
Diff.
Best
Last
Diff.
47.35
41.42
5.93
82.67
84.91
-2.24
CIFAR-10
KD-AT
2
0.5
48.76
46.33
2.43
82.89
85,49
-2.60
KD-AT-Auto
1.47*
0.8
49.05
48.80
0.25
84.26
84.47
-0.21
AT
24.79
19.75
5.04
57.33
57.42
-0.09
CIFAR-100
KD-AT
2
0.5
25.77
23.58
2.19
57.24
60.04
-2.80
KD-AT-Auto
1.53*
0.83"
26.36
26.24
0.12
58.80
59.05
-0.25
AT
17.20
15.40
1.80
47.72
47.62
0.10
Tiny-ImageNet
KD-AT
2
0.5
17.86
17.18
0.68
47.73
48,28
-0.55
KD-AT-Auto
1.23*
0.85*
18.29
18.39
-0.10
47.46
47.56
-0.10
methods (e.g., TRADES Zhang et al. 2019), FGSM (Goodfellow al. 2015)). and evaluation
metrics (e.g., PGD-1000 (PG attack with 1000 iterations), Square Attack (Andriushchenko et al.
2020 RayS (Chen & Gu 2020 ). More setup details can found Appendix G
Our method is essentially the baseline adversarial training with a robust- trained self-teacher, equipped with an algorithm automatically deciding the optimal hyper-parameters, which we now denote as KD-AT-Auto. We compare KD-AT-Auto with two baselines: regular adversarial training (AT), and adversarial training combined with self-distillation (KD-AT) with fixed temperature T = 2 and interpolation ratio À = 0.5 as suggested by Chen et al. (2021).
Results & Discussions.
As shown in Figure 7 our method effectively mitigate robust overfitting for all datasets, with both standard accuracy (SA) and robust accuracy (RA) constantly increasing throughout training. In Table D. we measure the difference between the RA the best checkpoint (Best) and at the last checkpoint (Last) to clearly show the overfitting gap. Our method can reduce the overfitting gap to less than 0.5% for all datasets. One may note that self-distillation with fixed byper-parametens is in fact inferior in terms of reducing robust overfitting, while its effectiveness can be significantly improved with the optimal hyper-parameters automatically determined by our method, which further verifies our understanding of robust overfitting. Compared with self-distillation with fixed hyper-parameters, our method can also boost both RA and SA the best checkpoint for all datasets.
Our method can further be combined with orthogonal techniques such as Stochastic Weight Averaging (SWA) (Izmailov et al. 2018) and additional standard teachers as mentioned in previous work (Chen et al. 2021) to achieve better performance. More results and discussion can be found in Appendix D.3
7 Conclusion and Discussions
In this paper, we show that label noise exists implicitly in adversarial training due to the mismatch between the true label distribution and the assigned label distribution of adversarial examples. Such label noise can explain the dominant overfitting phenomenon. Based on a label noise perspective, we also extend the understanding of robust overfitting and show that is the early part of an epoch-wise double descent in adversarial training. Finally, propose alternative labeling of adversarial

---

examples by rectifying model probability, which can effectively mitigate robust overfitting without any manual myper-paraman tuning.
The label noise implicitly exists in adversarial training may have other important effects on adversari- ally robust learning. This can potentially consolidate the theoretical grounding of robust learning. For instance, since label noise induces model variance, from a model-wise view, one may need to increase model capacity to reduce the variance. This may partially explain why robust generalization requires significantly larger model than standard generalization.
Acknowledgments
We sincerely thank Like Hui for the discussions on the theory of double descent and confidence calibration. We thank anonymous reviewers for their valuable comments and suggestions. We also thank the audience Neurips 2022 main conference for their thoughtful questions and feedback. Our work is sponsored in part by NSF Convergence Accelerator under award OIA 01A-2040727, NIH Bridge2AI Center Program under award IU54HG012510-U) as well as generous gifts from Google, Adobe, and Teradata. Any opinions, findings, and conclusions or recommendations expressed herein are those of the authors and should not interpreted as necessarily representing the views, either expressed or implied, of the U.S. Government. The U.S. Government is authorized to reproduce and distribute reprints for government purposes not withstanding any copyright annotation hereon.
References
Andriushchenko. M., Croce, F., Flammarion, N., and Hein, M. Square attack: query-efficient black-box adversarial attack via random search. ArXiv, abs/1912.0000l 2020.
Athalye, A., Carlini, N., and Wagner, D. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. ArXiv, abs/ 0ts//802.00420. 2018.
Belkin, M., Hsu, D. J., Ma, S., and Mandal, S. Reconciling modern machine- learning practice and the classical birinvari trade-off. Proceedings of the National Academy of Sciences, 11::15849 15854, 2019.
Carmon, Y., Raghunathan, A., Schmidt, I., Liang. P., and Duchi, J. C. Unlabeled data improves adversarial robustness. ArXiv, 13736, 2019.
Chen, and Gu, Q Rays: A ray searching method for hard-label adversarial attack. Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Datu Mining, 2020.
Chen, T., Zhang. Z., Liu, S., Chang, S., and Wang, Z. Robust overfitting may be mitigated by properly learned smoothening. In International Conference on Learning Representations, volume 1, 2021.
Croce, F. and Hein, M. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In ICML, 2020.
Devries, T. and Taylor, G. W. Improved regularization of convolutional neural networks with cutout. ArXiv, abs// 74.50452. 2017.
Ding, G. W., Sharma, Y., Lui, K. Y. C., and Huang, R. Max-margin adversarial (mma) training: Direct input space margin maximization through adversarial training. ArXiv, abs/1812.02633 2020.
Dong, C., Liu, I.,, and Shang, J. Data profiling for adversarial training: On the ruin of problematic data. ArXiv, abs/2102.07437, 2021a.
Dong, Y., Xu, K., Yang. X., Pang, T., Deng, Z., Su, H., and Zhu, Exploring memorization in adversarial training. ArXiv, abs/2106.01606, 2021b.
Frénay, B. and Verleysen, M.
Classification in the presence of label noise: A survey. IEEE Transactions on Neural Networks and Learning Systems, 25:845-869, 2014.
Gneiting, and Raftery, A. Strictly proper scoring rules, prediction, and estimation. Journal of the American Statistical Association, 102:359 378, 2007.
10

---

Goodfellow, I. J., Shlens, J., and Szegedy, C. Explaining and harnessing adversarial examples. CoRR, abs/1442.6 2015.
Gowal, S., Qin, C., Uesato, J., Mann, T. A., and Kohli, Uncovering the limits of adversarial training against norm-bounde adversarial examples. ArXiv, abs/2010.03593, 2020.
Guo, C., Pleiss, G., Sun, Y., and Weinherger, K. Q. On calibration of modern neural networks. ArXiv, 011117006.49999 2017.
Hastie, J., Tibshirani, R., and Friedman, J. The elements of statistical learning. 2001.
He, K., Zhang. X., Ren, S., and Sun, Identity mappings deep residual networks. ArXiv, 100.6000277,..
Hinton, G. E.. Vinyals, O., and Dean, J. Distilling the knowledge in neural network. ArXiv, 1bs/1553.02531, 2015.
Huang, R., Xu, B., Schuurmans, D., and Szepesvari, C. Learning with a strong adversary. ArXiv, abs/1511.03034, 2015.
llyas, A., Santurkar, S., Tsipras, D., Engstrom, L., Tran, B., and Madry, A. Adversarial examples not bugs, they are features. In NeurlPS, 2019.
Izmailov, P., Podoprikhin, D., Garipov, T., Vetrov, D., and Wilson, A. Averaging weights leads to wider optima and better generalization. ArXív, abs/1803.054400 2018.
Keskar, N. S., Mudigere, D., Nocedal, J., Smelyanskiy, M., and Tang, P. T. P. On large-batch training for deep learning: Generalization gap and sharp minima. ArXiv, abs/1609. 609.04836, 2017.
Krizhevsky, A. Learning multiple layers of features from tiny images. 2009.
Kurakin, A., Goodfellow, I. J., and Bengio, S. Adversarial machine learning at scale. ArXiv, abs/1611.0122 2017.
Le, Y. and Yang, X. Tiny imagenet visual recognition challenge. 2015.
Loshchilov, I. and Hutter, F. Sgdr: Stochastic gradient descent with warm restarts. arXiv: Learning, 2017.
Madry, A., Makelov, A., Schmidt, L.,, Tsipras, D., and Vladu, A. Towards deep learning models resistant adversarial attacks. ArXiv, 0ts//700606088.. 2018.
Moosavi-Dezfoolli, S.-M., Fawzi, A., Uesato, J., and Frossard, P. Robustness via curvature regulariza- tion, and vice versa. 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 9070-9078, 2019.
Nakkiran, P., Kaplun, G., Bansal, Y., Yang, T., Barak, B., and Sutskever, I. Deep double descent: Where bigger models and more data hurt. ArXiv, abs/1912.02292, 2020.
Netzer, Y., Wang, T., Coates, A., Bissacco, A., Wu, B., and Ng, A. Reading digits in natural images with unsupervised feature learning. 2011.
Neyshabur, B., Bhojanapalli,, S., McAllester, D., and Srebro, N. Exploring generalization in deep learning. In NIPS, 2017.
Papernot, N., McDaniel, P., Sinha, A., and Wellman, M. P. Towards the science of security and privacy in machine learning. ArXiv, abs/1611 1.03814, 2016.
Qian, J., Fruit, R., Pirotta, M., and Lazarie, A. Concentration inequalities for multinoulli random variables. ArXiv, abs/2001.11595 2020.
Rebuffi, S.-A., Gowal, S., Calian, D. A., Stimberg, F., Wiles, O., and Mann, T. A. Fixing data augmentation to improve adversarial robustness. ArXiv, abs/2103.01946. 2021.
Rice, I.., Wong, E., and Kolter, J. Z. Overfitting in adversarially robust deep learning. ArXiv, 11669, 2020.

---

Simonyan, K. and Zisserman, A. Very deep convolutional networks for large-scale image recognition. CoRR, abs/1409.15555 2015.
Singla, V., Singla, S., Jacobs, D., and Feizi, S. Low curvature activations reduce overfitting in adversarial training. ArXiv, abs/2102.07861,, 2021.
Smith, N. Cyclical learning rates for training neural networks. 2017 IEEE Winter Conference Applications of Computer Vision (WACV), pp. 4644464422 472, 2017.
Stutz, D., Hein, M., and Schiele, B. Relating adversarially robust generalization to flat minima. ArXiv, abs/2104. 04448, 2021.
Su. D., Zhang. H.. Chen, H., Yi. J., Chen, P.. and Gao, Y. Is robustmess the cost of accuracy? comprehensive study on the robustness of 18 deep image classification models, In ECCV, 2018.
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I. J., and Fergus, R. Intriguing properties neural networks. CoRR, abs/1312.6199, 2014.
Tsipras, D., Santurkar, S., Engstrom, L.,, Turner, A., and Madry, A. Robustness may be at odds with accuracy. arXiv: Machine Learning, 2019.
Uesato, J., O'Donoghue, B., Oord, A., and Kohli, Adversarial risk and the dangers of evaluating against weak attacks. ArXiv, abs/ abs/1802.05666 2018.
Uesato, J., Alayrac, J.-B., Huang, P.-S., Stanforth, R., Fawzi, A., and Kohli, P. Are labels required for improving adversarial robustness? ArXiv, abs/1905. 2019.
Weissman, T., Ordentlich, E., Seroussi, G., Verdú, S., and Weinberger, M. Inequalities for the 11 deviation of the empirical distribution. 2003.
Wu, D., Xia, S., and Wang, Y. Adversarial weight perturbation helps robust generalization. arXiv: Learning, 2020.
Yang, Z., Yu, Y., You, C., Steinhardt, J., and Ma, Y. Rethinking bias-variance trade-off for generaliza- tion of neural networks. In ICML, 2020.
Yu. Y., Yang, Dobriban, Steinhardt, J., and Ma, Y. Understanding generalization adversarial training via the viai-variance decomposition. ArXiv, abs/2103.09947,, 2021.
Zagoruyko. S. and Komodakis, N. Wide residual networks. ArXiv, abs/ abs//665.00711 07606,111110 2016.
Zhang, H., Cissé, M., Dauphin, Y., and Lopez-Paz, D. mixup: Beyond empirical risk minimization. ArXiv, abs/1 11100992,,9 2018
Zhang, H., Yu, Y., Jiao, J., Xing, F., Ghaoui, I.,, and Jordan, M. Theoretically principled trade-off between robustness and accuracy. ArXiv,
2019.
Zhang, J., Xu, X., Han, B., Niu, G., zhen Cui, L., Sugiyama, M., and Kankanhalli, M. Attacks which do not kill training make ad adversarial learning stronger. ArXiv, abs/2002. 11242, 2020.
12


Reviews:
[{"review_id": "qFDS1slV_UZ", "reviewer": "Reviewer_a79S", "summary": "The authors show that label noise exists implicitly in adversarial training due to the mismatch between the true label distribution and the assigned label distribution of adversarial examples.  Based on a label noise perspective, the authors formalize robust overfitting and show that it is the early part of an epoch-wise double descent in adversarial training.  Also, the authors propose an alternative labeling of adversarial examples by rectifying model probability, which uses temperature scaling and interpolation together.", "questions": "Why do you assume that $f$ is a L-Lipschitz function?  Is this assumption reasonable?  What if this assumption does not hold?", "limitations": "It would be better to discuss the possibility that the alternative labeling even increases the risk of robust overfitting.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "The authors nicely presents that adversarial perturbation implicitly generates label noise.  This phenomenon is explained intuitively and proven formally.  The observation is correct in that there is a mismatch between the true label distribution and the assigned label distribution of adversarial examples.  To solve this issue, the authors propose an alternate labeling scheme based on temperature scaling and interpolation.  As a result, the proposed training method achieves higher accuracy than conventional adversarial training methods.  Overall, the observation is interesting, and the theoretical analysis is well presented.\n\nAt the same time, I have the following concerns.\n\nThe authors prove that temperature scaling and interpolation can be effective for reducing the distribution mismatch.  However, it is not clear why these two methods are specifically selected.  Are there any other techniques applicable for the same purpose?  To me, introducing these two techniques is somewhat abrupt.\n\nThere is a gap between the theory and the actual method.  In Theorem 5.1 and Theorem 5.2, there exists satisfying $T$ or $\\lambda$ for each example.  However, a single value is used for the hyper-parameters in the actual method (Equation (9)).  Thus, the connection between the theory and the method is not very rigorous.  In Section E. the optimal hyper-parameter values for each example are not highly concentrated, as opposed to the authors' claim.\n\nDifferent perturbations and dataset qualities need to be considered for validating the effectiveness of the alternate labeling.  Currently, one a single perturbation radius is used.\n\nIt would be better to show how many adversarial examples are assigned labels different from those of the original examples.  The authors can discuss whether the alternating labeling schemes chooses a reasonable label when a different label is generated.  Such case study will be very interesting to the reader.\n\nIt is not clear how the validation set is extracted for determining the optimal parameter values in Table 1.  What if a sufficiently large validation set does not exist?\n\np. 2 is not shown using Acrobat on Windows.  (Okay on iPad.)\n\n=== Post-rebuttal update ===\n\nI have increased my rating from 5 to 6, mainly due to the authors' additional experiments.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "DidpPscqoru", "reviewer": "Reviewer_9nZa", "summary": "This paper demonstrates that adversarial training will introduce label noise through both theoretical and empirical investigations. This noise helps to interpret the robust overfitting phenomenon. The paper further proposes to use a rectified model probability in adversarial training to mitigate the robust overfitting. Experiments on CIFAR10/100 and Tiny-ImageNet are conducted to illustrate the effectiveness of the proposed method.", "questions": "\n\n1. Can the authors estimate the significance of such AT-caused label noise in realistic cases, e.g., considering the classification task on CIFAR100?\n2. The arguments in section 4.2 seem artificial.\nif an AT-trained model can approximate the true label distribution, then the robust overfitting won't be a problem. That is it doesn't matter whether the AT will distort the true label distribution. \n3. A possible typo in table 1, in the last column for CIFAR100, -0.25 is in bold instead of -0.09.", "limitations": "The paper addresses the limitations in the supplementary material. As far as I am concerned, there is an additional limitation: \n- the paper does not discuss how severe would the label noise be in realistic applications.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n1. The observation that adversarial training introduces label noise is insightful and novel, and sheds light on the understanding of robust overfitting.\n2. The paper provides a clear and in-depth theoretical investigation of the label noise caused by adversarial perturbations. The example and relevant experiments are helpful for readers to grasp the key idea of this novel label noise.\n3. Based on the label noise understanding, the paper further proposes to use a rectified model probability to mitigate the robust overfitting. Comparisons with regular AT and KD-AT illustrate the effectiveness of the proposed method.\n\nWeaknesses:\n1. Though the experiments successfully demonstrate the connection between the label noise and robust overfitting, it would be overstated to say \"robust overfitting can be adequately explained by such label noise\" (line 76). A rigorous theoretical analysis is needed to establish that strong conclusion.\n2. while the example shows that the label noise introduced by adversarial perturbation can be significant in synthetic datasets, it is not clear how severe would the label noise be in realistic cases.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "-hFdKxmVKan", "reviewer": "Reviewer_GHmS", "summary": "The paper tackles the problem of adversarial overfitting, that is a critical breakdown of robust accuracy that commonly happens in adversarial training and makes early stopping a necessity for AT. They give an interpretation of robust overfitting from the standpoint of label noise, ie they argue that the adversarial attacks change the true target for the image but AT does not adapt to the change in label. \n\nThe paper first gives a theoretical analysis, in which they first show that for locally Lipschitz and optimal (P(Y|x) = f(x)) classifiers, the adversarially perturbed data distribution has non-negative label noise (if the labels remain unchanged) that depends, among others, on the size of the perturbation radius. A similar theorem is then given for the case of non-optimal classifiers. \n\nIn the practical section, they show various phenomena, for example, that robust overfitting follows a double descent curve and that robust overfitting correlates with radius and data quality. \n\nFinally, they introduce a new adversarial training formulation, that uses temperature rescaling, interpolation, and the output of an external adversarially trained classifier to relabel the perturbed samples during adversarial training. In the evaluation, they show that this scheme is less likely to overfit and can yield better robust accuracies. ", "questions": "- Section 3 assumes that Y and Y-hat are integers, ie this means that a true label exists. Now for certain images, an adversarial attack might introduce a new class without completely deleting the original one, eg we could have an image with both a dog and a cat. Is it possible to extend your framework such that Y is a distribution to handle those circumstances? \n\n- Figure 7 shows that the proposed method does not overfit in 150 epochs. Is this also true if we continue training for 1k epochs? \n\n- In the past, papers like \"Unlabeled Data Improves Adversarial Robustness\" have shown that quantity matters. In light of your theorem, it seems like data quality is more important. Do you think this behavior is simply not explained by your theory or is there another explanation? \n\n- In a way, this scheme resembles self-training. Is it possible to iterate the method, ie use the first classifier trained with your new loss to train a second classifier with the first one as \"teacher\" (to label the adv samples during training)? ", "limitations": "The limitations in the appendix address the largest issues. The training of the additional classifier can be expensive and the entire scheme can only work if one can actually find a model that can properly classify the adv samples for the new classifier during training. ", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n- The problem of robust overfitting is relevant and while the intuitive idea that AT can create a sample-label mismatch is quite obvious, the theoretical and practical connection to robust overfitting is interesting. \n\n- The paper is well written and clear in its explanations.\n\n- The robustness evaluation uses a strong and reliable attack. \n\n- The proposed training method improves over AT, Trades and KD-AT in terms of robust accuracy on all 3 datasets. \n\nWeakenesses: \n\n- Like every theoretical paper, the authors make certain assumptions. This is fine and I think that the local Lipschitz assumption is quite common and established in the AT literature. However for the others, such as external covering in 4.4, the authors do not comment on whether or not this is a realistic assumption or if it is highly likely to be violated in practice. \n\n- The proposed training scheme is not very novel and resembles for example the cited [Robust overfitting may be mitigated by properly\nlearned smoothening] with a heuristic for hyperparameter optimization. ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Accept