Exploring Adversarial Robustness of Deep State Space Models
Authors: Biqing Qi
Yiang Luo
Junqi Gao
Pengfei Li
Kai Tian
Zhiyuan Ma
Bowen Zhou
Venue: NeurIPS 2024 poster (2024)
Keywords: Adversarial Robustness; Robustness Exploration; State Space Models
Primary area: safety_in_machine_learning

Abstract: Deep State Space Models (SSMs) have proven effective in numerous task scenarios but face significant security challenges due to Adversarial Perturbations (APs) in real-world deployments. Adversarial Training (AT) is a mainstream approach to enhancing Adversarial Robustness (AR) and has been validated on various traditional DNN architectures. However, its effectiveness in improving the AR of SSMs remains unclear.
While many enhancements in SSM components, such as integrating Attention mechanisms and expanding to data-dependent SSM parameterizations, have brought significant gains in Standard Training (ST) settings, their potential benefits in AT remain unexplored. To investigate this, we evaluate existing structural variants of SSMs with AT to assess their AR performance. We observe that pure SSM structures struggle to benefit from AT, whereas incorporating Attention yields a markedly better trade-off between robustness and generalization for SSMs in AT compared to other components. Nonetheless, the integration of Attention also leads to Robust Overfitting (RO) issues.
To understand these phenomena, we empirically and theoretically  analyze the output error of SSMs under AP. We find that fixed-parameterized SSMs have output error bounds strictly related to their parameters, limiting their AT benefits, while input-dependent SSMs may face the problem of error explosion. Furthermore, we show that the Attention component effectively scales the output error of SSMs during training, enabling them to benefit more from AT, but at the cost of introducing RO due to its high model complexity.
Inspired by this, we propose a simple and effective Adaptive Scaling (AdS) mechanism that brings AT performance close to Attention-integrated SSMs without introducing the issue of RO.

Exploring Adversarial Robustness of Deep State Space Models
Biqing Qi!?, Yiang Luo", Junqi Pengfei Lit, Kai Tian', Zhiyuan Ma', Bowen Zhou 1.2,+
Department of Electronic Engineering, Tsinghua University, Shanghai Artificial Intelligence Laboratory.
Department of Control Science and Engineering, Harbin Institute of Technology, School of Mathematics, Harbin Institute of Technology
{qibiqing7 normannuonnm,,, ggjnqii77 Agpengeee02200)@mmallll com,
t tiankaidyx0163. com, {mzyth, whouboxen edu. edu.
Abstract
Deep State Space Models (SSMs) have proven effective in numerous task scenar- ios but face significant security challenges due to Adversarial Perturbations (APs) in real-world deployments. Adversarial Training (AT) mainstream approach to enhancing Adversarial Robustness (AR) and has been validated on various tra- ditional DNN architectures. However, its effectiveness in improving the AR of SSMs remains unclear. While many enhancements in SSM components, such as integrating Attention mechanisms and expanding to data-dependent SSM pa- rameterizations, have brought significant gains in Standard Training (ST) settings, their potential benefits in AT remain unexplored. To investigate this, we evalu- ate existing structural variants of SSMs with AT' to assess their AR performance. We observe that pure SSM structures struggle to benefit from AT, whereas in- corporating Attention yields markedly better trade-off between robustness and generalization for SSMs in AT compared to other components. Nonetheless, the integration of Attention also leads to Robust Overfitting (RO) issues. To under- stand these phenomena, we empirically and theoretically analyze the output er- ror of SSMs under AP. We find that exed-parameterized SSMs have output error bounds strictly related to their parameters, limiting their AT benefits, while input- show dependent SSMs may face the problem of error explosion. Furthermore, that the Attention component effectively scales the output error of SSMs during training, enabling them to benefit more from AT, but the cost of introducing RO due to its high model complexity. Inspired by this, we propose a simple and effective Adaptive Scaling (AdS) mechanism that brings AT performance close to Attentiin-inteerated SSMs without introducing the issue of RO. Our code is available Robustness-of-SS!
Introduction
Deep State Space Models (SSMs) represent promising emerging model architecture inspired by traditional linear state space models [1. These models capture temporal dependencies in sequences via structured state space transitions 2
By leveraging their inherent recurrent nature and linear discretized transmission form. SSMs excel in long-sequence modeling with linear computa- tional complexity 3 This makes SSMs highly competitive in various downstream tasks, with the potential to surpass classical architectures like convolutional networks and Transformers [6] 7 8]. While the superior performance of SSMs on clean data has been well established across various tasks, these models may face significant security risks from meticulously crafted Adversarial Per- turbations (APs) T0 [
3 4
12 B real-world scenarios. Therefore, it is essential to thoroughly explore and discuss the Adversarial Robustness (AR) of SSMs. Previous work [4] has conducted
*Corresooniigg authors.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

preliminary robustness evaluations on visual SSMs. However, their assessment was limited to the VMamba structure. More importantly, they did not specifically evaluate and analyze the perfor- mance of SSMs under Adversarial Training (AT) 10 15 16]. This aspect is crucial for enhancing the AR of SSMs, as AT' the mainstream approach for improving a model's AR 16 17 18 bridge the current research gap, we aim to answer the following questions:
To
1. Do many component designs that have proven effective in boasting SSM performance un- der Standard Training (ST) [19 20 similarly enhance SSMs when subjected to AT? Ad- versarial attacks aim to induce erroneous predictions by adding meticulously crafted small perturbations 99 10 which may cause a more pronounced negative impact on SSM mod- els. This is because SSMs heavily rely on sequential dependencies in inputs, causing errors accumulate through state propagation. Consequently, it remains uncertain whether com- monly employed AT frameworks, such as PGD-AT [16] and TRADES [21] can effectively improve the AR of SSMs.
2. How do various components influence the robustness- -eeeestttesssegeeenazaatiooo trade-off in AT? Due to the trade-off between robustness and generalization (22 AT often leads to a decrease in the accuracy of deep learning models on clean data, thus hindering their generalization. Additionally, deep learning models are prone to Robust Overfitting (RO) 24 251, where models trained adversarially overfit to the AT samples but fail to generalize to adversarial test samples, significantly limiting the effectiveness of AT. We aim to investigate how ex- isting structural variants of SSMs, such as diagonalized (66 and Multi Aulti-Input Multi- Outtpt (MIMO) SSM (27]. affect the -eatteessggeeeelizzatton trade-off and RO issues in SSMs, thereby providing insights for designing more robust SSM structures.
3. Can the analysis various SSM components' performance in AT provide valuable insights for the design of more robust SSM structures? Our objective is to analyze how components of different SSM variants influence model behavior during AT and to identify those that contribute positively. This analysis aims to inform adjustments that enhance the robustness and performance of SSMs under AT.
To response Q1 and Q2, we employ AT using common AT frameworks on various structural variants of S.Ms. These include implementations such as Normal Plus Low-Rank (NPLR) decomposition (S4) B1 diagonalization (DSS) 28 26). MIMO extension (S5) (27] integration of attention mech- anisms (Mega) 19] and data-dependent SSM extension (Mamba) (20). Subsequently, we conduct comprehensive robustness evaluations to assess their performance. Specifically, we obtain the fol- lowing observations: 1)A Clear
Trade-off in SSM Structures. We observe a significant decrease in the Clean Accuracy (CA) of SSMs following AT. Specifically, for the S4 model on the CIFAR- 10 dataset, the CA dropped by nearly 15% compared to ST. This indi- cates pronounced robustness- -eeeraaliiggnnniniattionnnn trade-off in SSM structures. Pure SSM structure struggles in benefit from AT. Despite expanded to data-dependent SSM, Mamba fails to show distinct superiority over the fixed-paran exeedpparameterized counterparts (S4 and DSS) under AT, even though all are SISO systems. 3) Only the incorporation of attention mechanisms significantly enhances both the CA and RA of SSMs after AT. However, this improvement also introduces significant issue of RO.
To response Q3, we conduct both empirical and theoretical analyses of the output error of SSMs un- der AP. Our findings demonstrate that paed-eaarmeterizee SSMs have bounded output errors strictly related their parameters, which limits their ability to reduce output errors during AT. In contrast, deta-dependent SSMs may encounter an explosion of output errors. Furthermore, incorporating attention mechanisms provides additional adaptive scaling of the SSM's output error, facilitating better alignment of outputs corresponding to adversarial and clean inputs. However, this also in- creases complexity, raising the risk of RO. Inspired by this, we explore whether low-complexity adaptive scaling operation could assist SSMs in output alignment while avoiding RO issues. To this end, we designed simple Adaptive Scaling (AdS) mechanism to aid in output alignment. Our re- sults indicate that this design effectively enhances the AT performance of SSMs and reduces output errors without introducing RO issues. We hope that our responses to the above three questions will inspire further research and development of robust SSM structures.

---

2 Preliminaries of SSMs
Given the input signal u()) E R + Rd and time 1. IR+, the general linear SSM, parametrized by an state matrix A Rixh, an imput matrix B Raxd, output matrix C' Rd and direct transmission matrix E Iddd can be formalized as follows:
(()) = Ax + Bu((),
(1)
(()) = C=(() Du(t),
where (1) E R and y() E IR' represents respectively represent the hidden state and the output signal at time
S4 For the discretized input sequence u E R L.xd S4 [ broadcasts the same SSM parameters to each input dimension for state propagation, instantiating a SISO system. Specifically, they employ a bilinear method [29] for discretization to obtain discretized approximations of the parameters:
Fk A 1 + Buu A = (I A1/2 A)
(I + A1/2 A) E
(3)
(4) yk = Cark B = (I 2- A) R hx1
= C e Rixh
(4)
where u and V/ represents the i-th element in the k--th token of and y respectively. At E R is a fixed step size that remains constant for each time step. S4 parameterizes the matrix using NPLR decomposition for efficient optimization. By setting Do 0, the output take the following form:
(4)
CA Buy" + CABu + CBu
(5)
This can be achieved by parallelized efficient convolution computation: y ( = u0 where the convolution kernel K
CB,. CAB CAA
CA--AA-- resulting in complexity of (
DSS Instead of employ bilinear discretization, DSS 28 uses the Zero-Order Hold (ZOH) dis- cretization:
A = eAp(AAO), B= (
C=C
(6)
Based on this, they diagonalize A to instantiate the SSM parameters:
( exp(A,A() - (X, - ISiSA
A = diag (exp(A1 Ar), exp()22tt) exp(An B
(7)
where exp A the i-th diagonal element of A.
S5 $5 [7 still employs 7OH discretization, but with a distinction, they utilize a MIMO setup.
meaning all hidden dimensions of each token are jointly involved in state transition as in c1. and (2) and employs parallel scanning for computation. To ensure efficiency, they set A = V AV for diagonal reparameterization:
B B-V--B v-)((, this reduces the complexity of parallel scanning from Ohh O(hL).
== A,
Č=
(8)
Mamba (S6) Similar to DSS and S5, Mamba 20 utilizes ZOH for discretization and performs di- agonal instantiation of A, with computations carried out through parallel scanning. It noteworthy that Mamba sets adaptive Bg (xx),, C2 (ux) and (12()), k S for each step through learn- able linear transformation (meaning that they adpoted data-dependent SSM parameters setting), while still maintaining a SISO configuration.
Mega Mega's SSM component is implemented in the form of Exponential Moving Average (EMA) 19]. Specifically, their Multi-dimennional Damped EMA given by:
= as C d (1 as 8,) 2
J = B.u (1)
y 17 x
where the expansion parameters 3 E R.th projection parameters 77: E Rh az 5 E TR' represent the weighting and damping factors, respectively. This can be formalized equivalently as SISO SSM with parameters A; diag(1 a, O 6,), B, = a O B, and = n. Following the execution of SSM, Mega introduces Attention mechanism between the SSM output y and input sequence u, which made it most competitive -aased SSM structure (27].
3

---

Table 1: Comparisons among the test accuracy (%) of different SSM structures with different Train- ing types on MNIST and CIFAR-10 test set. 'Best' and 'Last' mean the test performance on the best and last checkpoint, respectively. 'Diff' denotes the accuracy gap between the 'Best' and 'Last'. The best checkpoint is selected based on the highest RA on the test set under PGD-10.
Dataset
Structure
Training Type
Clean
PGD-10
AA
Best
Last
Diff
Best
Last
INff
Best
Last
DNM
ST
90.1 16
0.01
4.57
01.7
3.85
0.07
9.001
0.472
S4
TRADES
99 20
99.1
0.18
99. 11
95.82
0.29
89.01
58.35
0.66
PIOCAT
00:33
09.21
0.02
24.80
24.37
0.34
0.84
0.00
0.04
YOPO
11.35
11.35
0.00
11.35
11.35
0.00
11.35
11:35
0.00
ST
99.3 38
09.33
0.05
344
2.92
4.62
0.23
0.00
0.23
PGD
59.87
12.30
27.65
99 95
89
0.06
0.62
0.00
0.62
DSS
TRADES
99 21
09.11 16
0.05
08.97
08
0.23
89.40
88.
1.25
YOPO
11:35
11.35
0.00
11:35
11.35
0.00
11.35
11.35
0.00
ST TRADES
98.98
98. 95
0.0A
3.65
01.44
3.22
0.29
0.00
0.29
MNIST
98.9
98. 89
0.06
98.11 17
97.97
0.20
$1.15
80.33
0.95
FrocAT
99.53
99.3
0.02
21.5 39
20.55
0.51
0.06
10000
0.06
YOPO
11.35
11.35
0.00
11.35
11:35
0.00
11.35
11:35
0.00
ST
90 34
0.04
9.54
7.93
0.00
0.25
Mega
TRADES
PG
99.35
43.15
24. 24
30
17 39
0.04
99 94
09:05
05.07
69. 8656
0.08
010
11.09
0.70
10.90
1000
0.19
0.79
YOPO
11:38
11.35
0.00
11.35
11.35
0.00
11:35
11.35
0.00
ST
98.9 98.93
9% 86
0.07
25 53
19.35
6.
0.09
9.00
0.09
Mamba
PGD-AT
98.32
0.70 76
47
02 82
36.9
309
0.50
000
0.5
PreeAT
99:05
03
0.02
15.69
50.20
15 45.49
0.26
1000
0.00
YOPO
11.35
11:35
0.00
11.35
11:35
0.00
11:35
11:35
0.00
ST TRADES
78.78
78.58
0.20
10.38
0,00
10.38
0.96
0.00
0.96
S4
FreeAT
63.91
69.69
63.74
64
0.1
0.12
0.05
1091
56.00
30.11
15.42
19.63
0.38
1.28
15:51
M035
25. 36.36
24.90
30.55
15.99
0.00
0.42
0.28
ST
76.03
75.86
0.17
42
0,00
11
0.62
0.00
0.62
PGD-AT
$4.92
70
0.32
37.31
$7.07
0.20
$1.65
31.00
0.05
DSS
TRADES
05.00
0.09
38
14.98
YOPO
39.87
$7.77
1.10
31.77
30.89
0.88
26.36
26.01
0.35
ST TRADES
70.32
30
0.02
7.62
0,00
7.02
0.48
0.00
0.48
CIFAR-10
SS
57
57 23
0.45
34
81 10
0.23
36:66
28.69
0.30
ProcAT
YOPO
38.13
60.00
0.15
19:39
18
2.10
15.20
13
0.07
ST
79.03
0.05
1.86
0,07
3.79
0.84
0.00
0.84
PGD.AT
22.54
72.08
0.46
40.33
9.5
25.70 79
25.36
0.53
Mega
TRADES
21.01
70.84
0.17
43.05
42 63
100
31.50
36.91
0.33
YOPO
1:30
$6.39
31.56
28.68
19.13
ST
23.59
72.31 31
0.28
766
0.48
0.43
0,00
0.43
Mamba
TRADES
60.93
60.66
0.27
34.84
$2.75
3.99
29.87
29.07
0.80
FRECAT
84:37
61
63.36
17.40
10.9
8:18
1188
9,65
3 Empirical Evaluation:
Component Contributions to AT Gains
In this section, we empirically assess the natural AR of various SSM structures and their AR post AT to explore the AR enhancement provided by mainstream AT frameworks for SSMs and the generalization behavior of SSM variants under AT.
Training Setup. We adopt the ST and two most commonly used AT frameworks, PGD-AT [66] and TRADES (21). as well as two more efficient and advanced adversarial training frameworks, FreeAT (30 and YOPO [3I]. to conduct experiments on the MNIST, CIFAR-10, and Tiny-ImageNet datasets. For AT, we utilize 10-step &or PGD (PGD-10) as the attack method. Following [21]. on MNIST, we set the adversarial budget to ||||= = 0.3, attack step size a = 0.04, the KL divergence regularizer coefficient for TRADES 3 = 1.0, and the training epoch to 100. On CIFAR- 10 and Tiny- Imagenet, we set || 0.031, a 0.007, 3 = 6.0, and the training epoch to 180. After each training epoch of AT, we conduct adversarial testing on both the training and test sets to evaluate robustness and measure generalization on adversarial examples (i.e. Robust Generalization, RG) 21 32]. For the model architecture of SSMs, we set all models to a uniform 2-layer architecture with hidden dimension d = 128 on MNIST, and 4-layer architecture with d = 128 CIFAR- 10 and
Considering that SSMs are a class of models highly reliant on the sequential dependence, we adopt sequence image classification setup thoroughly investigate the AR of SSMs. For MNIST, we resize inputs to (784, 1), for CIFAR-10 and to (1024, 3) and (4096,3) 3). Further experimental results, including the results for Tiny-Im and detailed configurations are presented in the Appendix C and D
we resize inputs
Evaluation Setting. We record the CA and adversarial test accuracy (i.e. Robust Accuracy, RA) 1C [k] of each model at their best and final checkpoints across three training schemes to evalu- trade-off as well as the issue of RO. The
ate robustness and examine the

---

20
Adk Train Laws
Train Loss
Toat Loss
15
20
10
Adv
05
100 apoch
125
1.50
175
25
50
13
160
125
150
175
25
90
15
N60
125
Lio
175
25
50
75
100 upoch
125
130
175
epoch
spoch
10.
1.0
1.D
1.-
08.
Adl Trinn Ace
Adc Test Ap2
0.6-
Acc
0.6
0.6
04.
GA.
02-
02-
0.2-
125
1:0
1TS
100 125 150 175
75 opoch
25
30
spach
epoch
opoch
CEARR
Mega
CIBAR
DSS MINIST
Mamba MIIIS
Mega MINSST
SUNNNIST
S5 MNIST
Figure I: The PGD-AT training process, testing process, and the adversarial PGD-10 testing process on the training and testing datasets CIFAR-I0 and MNIST datasets.
results are presented in Table] | Beyond adversarial testing with PGD-10, we incorporate AutoAt-
tack (AA) (34) for rigorous robustness evaluation. AA integrates four attack strategies: APGD-CE
34 APGD-DLR (4). FAB [35 and Square [3 serving as a powerful adversarial attack baseline
widely used in AR evaluation
25
For SSMs trained with ST, almost all models exhibit no adversarial robustness, and the adversarial test loss for all models shows continuous increase during the training process, as depicted in Fig. in Appendix D consistent with the conclusions drawn for convolutional networks [16]. However, it noteworthy that the RA of Mega and Mamba trained standardly are higher than the rest of the SSM structures, especially on MNIST where this performance is particularly pronounced. This suggests that the flexibility introduced by Attention [9] and data-dependent SSM structures also helps the models to some extent in adapting to adversarial examples. Compared to the ST scenario, we are more interested in understanding the AR improvement of AT for SSMs and the dynamic behavior of SSMs during AT. To this end, we plot the training, testing, AT, and adversarial test loss and accuracy changes of various SSM variants on both datasets for PGD-AT (Fig. T and TRADES (Fig. 2 In conjunction with Table
we have the following observations:
1) AT remains an effective strategy for enhancing the AR of SSMs, yet different SSM structures exhibit a clear trade-off between robustness and generalization. All models benefit from AT, achieving higher RA with both PGD-AT and TRADES frameworks. Some intriguing phenomenons occurs on the MNIST dataset, where models trained under the PGD-AT framework exhibit a marked decrease in CA and almost no RA under AA. In contrast, TRADES does not lead a significant re- duction in CA and substantially improves robust accuracy under AA. This disparity is not observed on CIFAR- 10 and Tiny- Imagenet. The phenomenon can be elucidated by findings from (37, which indicate that MNIST's limited semantic information may lead PGD-AT to fit to spurious rather than causal features, resulting in overfitting to fo PGD attacks. On the other hand, TRADES explic- itly constrains the KL divergence between clean and adversarial sample logits, ensuring that the model learns causal features from clean data while adapting to adversarial distributions. Besides, on the MNIST dataset, all model architectures fail to converge when trained with YOPO. This ad- vanced adversarial training strategy relies on the parameters of the model's 's input layer for auxiliary calculations, making it difficult to simply extend and be effective on non-convolutional structures. However, on the CIFAR-10 10 dataset, noticeable decrease CA is observed across all SSM struc- tures after AT, particularly for S5, which experienced 16.62% drop in CA under PGD-AT, with other structures also showing approximately a 10% reduction CA, a similar phenomenon is ob- served on Tiny- ImageNe.. This indicates clear trade-off between robustness and generalization for SSM structures.
2) The incorporation of Attention indeed yields a better trade-off between robustness and gen- eralization, yet it also introduces significant issue RO. Compared to other SSM structures, Mega exhibits the least CA degradation after AT, while compared to DSS, the model with the sec-
5

---

175
1:7
Adl Train Los
Adv Tox Loss
125
100-
Rest
1.00
0:0
0.00
025
0.00
0.0
115
180
150
spoch
spoch
spoch
qpoch
099
0.8
0.3
Adh Train Are
Ad' Tor
Toin Aoc
0.7-
6.7
0.6
0-6-
0.1
0.4
0.4
0.-
0.3
35
50
15
100
1is
1:0
175
160 125 spoch
50
15
100
150
spoch
spoch
quech
CIFAR-10
Mumbs-CIFAR-10 MonIa-MNIST
Mega-CIFARII Megs-MNNST
S4-CIFAR-10 S4-MNIST
S5-CIFAR-10 S5-MNIST
DSS-MNIST
Figure 2: The TRADES training process, testing process, and the adversarial PGD- 10 testing process on the training and testing datasets on CIFAR- 10 and MNIST datasets.
ond least CA degradation, Mega achieves improvements of 4.21% and 2.68% in CA degradation under PGD-AT and TRADES, respectively. Moreover, Mega attains the highest adversarial accu- racy against PGD-10 and AA attacks post-AT (in the best sense). This indicates that the introduction trade-off. However, from Fig.
of Attention can indeed lead to a better and is observed that CIFAR-10, both under PGD-AT and TRADES, Mega demonstrates continuous decrease in AT loss and an increase in AT accuracy, but the RA in adversarial testing shows almost growth trend in the middle and late stages of training, resulting in difference of over 40% (PGD-AT) and over 20% (TRADES) between AT and test accuracy at the end of train- ing. Particularly for PGD-AT, after achieving the best RA of 40.53% at the 39th epoch, Mega's RA begins to gradually decline, eventually falling to 30.68%, showing very evident RO issue. Addi- tionally, Mamba also exhibits clear RO issue during the TRADE training process, depicted in Fig. 2 resulting in a difference of over 20% between AT and test accuracy.
3) The pure SSM structure exhibits a significant disadvantage in AT, and the data-dependent parametrization does not aid in the AT SSMs. $4, DSS and Mamba, due their SISO charac- teristics, require the addition of linear layers after SSM calculation to aid in the interaction between different feature elements. While S5 that expanded with MIMO capabilities can be equivalent to a linear combination of multiple SISO SSMs, thus obviating the need for extra position-wise linear layers (27). This makes the S5 block consist solely of a MIMO SSM. Nonetheless, on CIFAR- 10, S5 demonstrates marked disadvantage in RA and compared to other SSMs after training with both PGD-AT and TRADES (Tab. [ Furthermore, also observe that, despite the inclusion of linear layers, Mamba still exhibits reduction in CA and RA compared to $4 and DSS, indicating that the extension of the data-dependent SSM does not contribute the model's AT.
abbustness-generalle
trade-off
Based on the observations, we give an answer to the questions Q1 and Q2. SSMs alone seem to struggle to perform well in AT, while SSMs integrated with linear layers Attention demonstrate a significant enhancement in AR compared to the pure SSM structure. However, SSMs with At- tention, although showing the greatest gain in both robust and clean accuracy, exhibit much more pronounced RO issue compared to SSMs with only linear layers integrated.
Based on these findings, we consider the following: Does the inherent nature of SSMs limit their benefit AT? Is the Attention mechanism itself causing overfitting to AT data? Can formal analysis of Attention's behavior in AT provide insights for finding ways to improve SSMs AR while avoiding RO issues? We will delve deeper into these questions in the following section.
4 Component-wise Attribution: Theoretical and Experimental Analysis
In this section, we first theoretically investigate the stability boundaries of various SSMs under APs to understand why SSMs alone do not benefit significantly from AT. This theoretical analysis aims to uncover the reasons behind the limited effectiveness of AT on pure SSM structures. Next, we

---

KL. Divergene- SSM
KI. Divergence - Linear
KL. Divergence - Atlention
Structure Training Lype
Structore Structre-Tranning Training Type:
Structure Structure-Traiii Training
-0X
-64 -2
Chango/Befare Component
Chunge/BBfore Component
ChangeBBefors Componert MSE Attention
MSE SSM
MSE Linesr
Squcture Tricing Type
Steuctre- Ceannno--rriin Triining Type
777
Siructure Trrini-iiiinn
10
20
10
40
90
-03
-0.6
-04
-0.3
0.0
0.3
-0.6
-06
-12 00
ChangoBBcfore Component
Change/Before Component
Change/Befors Component
Mega
S1--GiD-A--jm
DSS -T---
Mrgt-PUI--A-- 1---------- Test
Mambo-PGil- PGID-A--TTe
DSS-TRADES--ii
SS-TRADES--Sii
Mege-TRADES-Trin
MamnheTTRADES-TTii
SI-JRADES--en
DSS-TRADES-Tet
S5-TRADES-TeS
Mrg--TRADESSTeet
SAmbs-TRADDS--11
Changes in KL divergence and MSE before and after different components in various SSM structures are presented. The change for each component is calculated as: after component before component. The data represents the change rate, calculated change / before component. Blank sections indicate the absence of a corresponding component. Bars with diagonal hatching represent results the test set, while bars without hatching represent results the training set.
Figure 3:
experimentally validate each component integrated with SSMs to further elucidate their roles in enhancing AT performance. Finally, we conduct a formal analysis of why incorporating attention mechanisms aids in AT, aiming provide insights for improving the robustness and performance of SSMs during AT.
4.1 Theoretical Analysis of SSM Stability Under APs
We consider a generalized scenario where the SSM input is denoted as u (u1, U2 (2)" R and the input after AP is u' (u/, 12
) R fxx Let E = n' (E1, c..... , E R and assume E[c] μ. E[e s M, for k 1,2, .... ., L (such sumptions are reasonable due to the perturbation budget constraints inherent to AP), Considering the generalized SSM setup:
y/ = Cx II A,B +... C2A, CiB (A = 1,2....... L).
(10)
The form in eq. (10) encompasses both the paeemeparameterizeed and the data-dependent sce- (i = 1,...). .. Equation (10) represents a fixed- consider only the SISO case here, as after diagonal
nario, where when A, = A, B = B.C, parameterized SISO SSM. It is reasonable reparameterization, each hidden dimension of the state transition equation in S5 can still be regarded as an independent SISO system. Based on the above settings, we have the following theorem:
Theorem 4.1.1 Given the SSM formalized as in eq. (10), the output error before and after pertur- bation, Eg
||y'
yll? has the following upper and lower bounds:
2
(C,B,)² <. |1 2112 <
A
max
(C,B,)² (II)

---

KL. Divergence SSM
KL. Divergetce AdS
Kl. Divergence Linenr
- Trining Type. Type-Aul
Strueture Trining Type
Structure Tmining
00
0.2
0.4
0.6
-06
-0.8
-02
00
-03
-01
00
Change/Before Component MSE SSM
Chango/Before Componcnt
ChanoBeefore Component MSB Lincar
MSE
Sieneture Training Ads
Senarar Conauue--ii Training Type- AdS
Strasture Type-
0.
0.5
2.5
08
0.
6.2
0.5
60
Change/Bofore Component
ChangeBelor Component
Ching/Before Component
S4PGD--AT-cll-Tmii
SA-TRADES-Rci-TTul
DS5-PKiD-AT-Rdle-
DSS-TRADES-RAE TRADEE--ccc---eei
S4.GD-AT B.-DD-A--Rel--Te- Rest-Test
SA-TRADES Rela Text
DSS DSS-PGD-Ja Relu Tex
DSS TRADES Relu
54 PGD Signold
TRADES
Thin
Signoid
TRADES Signold Trin
S4.GGD-TT A7-Siamai
S4-TRADES Sigmald-ar Test
DSS-PCO DS5--GD-AAT RRD-AT-Sieae -i---o---g Test
F//
DSS TRADES BRADES-Simalld Test
PGD Tanh Tran
TRADES
Train
TRADES Tunh Train
SI-JRAINS-Tuuh-lee
DSS- TRADEE--ann- Test
Figure 4: Changes in KL divergence and MSE before and after different components in the S4 and DSS with different AdS under PGD-AT and TRADES training on CIFAR-10. 10. The change of the component is calculated as: after component before component. The data in the figure represents the change rate which calculated as: change / before component. Bars with diagonal hatching represent the results the test set, while bars without hatching represent that the training set.
where L denotes the length of the input sequence, O < S are constants, and Xmax and Xmin are the eigenvalues of matrix A; with the maximum and minimum absolute values, respectively.
Theorem 4.1.1 indicates that the output error of SSMs in the presence of AP is strictly related to the parameters of the SSMs. It should be noted that under the setting of sxee-parameteriized
SSMs (S4, DSS, S5, and Mega), the output error Eg |ll' - yl 2] has a fixed lower bound
Re Σ j=1 1 (C,B,)2, which increases with the length the sequence
This implies that even when seed-parameterized SSMs aim to stabilize the output of adver- sarial examples during AT by minimizing output error, they are constrained by fixed lower bound the error: This constraint leads to inevitable error accumulation, making it challeng- ing for pure SSM structures to effectively benefit from AT. While Mamba can avoid the issue of a fixed error lower bound through adaptive SSM parameterization, it may also introduce more severe negative impacts. Notice that during the ZOH discretization process, as At; + 0, the eigenvalues of A in B, = (Ax ()t+ Ax) Att B tend towards This results an ill-conditioned problem when computing the inverse operation A) 11 causing B& + oc. Consequently, this leads to max, C₁ (u,) ( )² < C (ux) B (xx) + oo in Mamba, potentially resulting in almost infinite error bound. In contrast, training stable parettearaeteri SSMs ensures fixed upper bound on output error, thereby avoiding such error explosion issues.
4.2 Experimental Validation and Further Insights
To validate our theoretical analysis with quantitative metric and to deeply investigate the spe- cific roles of components within various SSM structures during AT, record the relative change

---

Table 2: Comparisons among the test accuracy (%) of S4 and DSS with different AdS modules and different AT types on CIFAR-10 and MNIST test set. 'Best' and 'Last' mean the test performance at the best and last epoch, respectively. 'Diff" denotes the accuracy gap between the 'Best' and 'Last', '_' indicates that the results of AdS are not used. The best checkpoint is selected based on the highest RA on the test set under PGD-10.
Dataset
Strueture
Training Type
Clean
PGD-10
Best
Last
DilT
Besl
Last
DiIT
Best
Last
Difr
PGD-AT
Sipmoid
R
53.3 1.36
53 26
50:
50.55
2.71
3.15
99
02.92
53
99.5
09.5 09.57
0.06
0.05
0.06
0.38
0.00
0.00
0.06
0.25
Tani
66
58.98
9.33
99.55
99.85
0.05
0.05
0.00
0.05
0.29
80.07
01
15
0.66
TRADES
ReLU
09
99
0.04
90
09.
0.01
00. 13
50
00.08
0.88
Sigmoid
99.33
99.25 28
99.17
FreeAT
Sipmoid
1
09
09 15
22.21
0.00
0.02
50
25 15
24.51
0.16
0.44
R.04
0.04
0.00
0.00
004
0.04
999
99:21
0.09
25:02
0.51
0.04
0.00
0.04
35
0.00
11.35
11 11:35
0.00
11:35
11:35
0.00
YOPO
0.00
11 11:38
11.35
9.00
11:35
11:35
0.00
MINIST
Tanb
11:35
11:35
0.00
11.35
11
0.00
11.35
11:35
0.00
27.65
0:06
0.62
0.00
0.62
PGD-AT
Sugmnnd
ReLU
50.23
58.82
49.00
46.00
4.19
99
0.03
0.23
0.00
0.23
51.49
0,43
99.2 21
98 S7
98.
0.22
39. 36
59 20
1.26
TRADES
Sigmoid
09.3
09.35 30
0.03
99
99
0.00
86 35
00
0.25
DSS
Timbs
99.30
99:27
0.03
99 00
98.
0.05
90:34
90.25
0.09
FreeAT
Sipmoid
ReLu
09
38:45
95:43
00
0.05
000
21.
47
19
1.98
0.07
0.06
0.00
0.00
0.07
006
1.55
0.00
0.00
35
0.00
YOPO
Sigmond
U
0.00
0.00
000
Funi
11:35
0.00
11.35
0.00
11:35
11.35
0.00
PGD-TT
Sipmoid
Re
68
69 20.33
69 10
65.
0.18
0.13
17.47
6:00
633
13.8
11.85
087
0.
70.38
63.91
63.35 78
0.13
56:00
35 35
0.58
30
30:55
0.00
TRADES
Sigmoid
67 51
67. 55
0.66
5850
0.24
84.69
31.0
074
S4
Tanb
66.96
66 49.49
0.47
S8. 11
31.9%
0.15
33.96
33.55
061
FreeAT
Sigmoid
ReL.
70
70
0.00
3164
2052
16.17
16.01
16
019
0.10
70.47
70.38
21.48
20.28
YOPO
Sigmoid
1
61
2.
61.
62- 42
0.19
0.12
20 04
11
0.36
25.61
36
26.27
24.94
0.3
0.4
CIFAR-10
Fanb:
62.7
62 69
0.12
$1.58
31 $1.25
0.35
26.57
26.31
0.26
64.9
64. 20
PGD-AT
KeL.
70.43
70
006
2008
18 20
0.88
Tank
09.52
09.31
0.11
38.80
38.06
0.83
33.89
33.70
0.19
0.09
36
15
0.40
TRADES
Sugmond
ReLU
09
06
61.46
09.00 09.09
0.20
34.44
39.12
18
35115
000
DSS
69
0.29
40.67
36.78
0.13
67 61.46
34
0.12
20 28
1815
1.53
14.8
FreeAT
R
68 78
68.00
39
006
31
5051
0.8
5.6
0
Tunb
68.
65.07
0.23
21.15
20
0.72
15.83
15.6
0.22
30.89
YOPO
Sipmoid
ReLU
40
00.33
3036
0.84
034
33.38
61N
022
76.87
11.01
0.14
017
in feature sequence differences I' E R2xd represent the feature sequences corresponding to adversarial and clean inputs. respectively. We measure the differences using two metrics: the Mean Squared Error (MSE) +Ilf' - f12. to quantify the absolute discrepancy between ff and f', and the Kullback-Leiller to evaluate the distributional divergence between f' and f. where S represents the Softmax operation over the sequence dimension, given by S(f)
(%) on 10 for each model post-AT, where
(KL) divergence (8]
exp(f)ia.)/ ΣT= exp(f)r..)) We average the statistical results from both the training and test sets, analyzing the performance differences between them to attribute the issue of RO. For each compo- nent, we calculate the average results across all layers. As shown in Fig. 3 there is an increase in both MSE and KL divergence before and after the SSM in all models. Notably, Mamba exhibits an over 40 times increase in KL and MSE on both the training and test sets after training with TRADES, significantly higher than the changes observed in other prad-parameterized SSMs. These findings are consistent with our theoretical analysis, indicating that SSMs inherently struggle to reduce out- put discrepancies through AT, while data-dependent SSMs may experience an explosion of output errors during AT.
9

---

It is noteworthy that both the linear layers and the Attention mechanism exhibit significant re- duction in MSE and KL divergence, implying that they indeed serve to diminish the discrepancy between feature sequences of clean and adversarial input during AT. This explains why SSMs inte- grated with Attention and linear layers achieve higher CA and Robust RA AT. Compared to linear layers, Attention induces a more pronounced reduction in MSE and KL divergence. However, while Attention after PGD-AT achieves more than a 90% decrease in MSE and KL divergence on the training data, it only yields about 60% reduction on the test set, which is significantly weaker than the improvements observed on the training set. In contrast, other components do not exhibit such a notable degradation in difference reduction the test set, indicating that the RO issue essentially stems from Attention itself, rather than other components. In fact, the incorporation of Attention introduces excessive model complexity, which, according to the conclusions in previous work (39], also limits the model's RG. According to eq. (11), ), the introduction of Attention effectively allows the model to adaptively scale the output error: E. [I]A(y')))
A(y) A(y)yl|)) where A denotes the Self- Attention operation. This inspires us to consider: whether incorporating an Ads to the SSM's ss outuut sequence y with minimal added complexity could enable fixed-parameted AT performance of Attention while avoiding the introduction of RO?
SSMs approach the
To answer this question, we introduced an AdS module after the SSM of S4 and DSS, to adaptively scale the SSM output y: yks = (L ) @ yk + (L)(()))), where L1 and Lg are learnable linear mappings, (y()) is used assist in adaptive scaling to adjust the output bias, and is activation function, which includes ReLU, Tanh, or Sigmoid. We conduct AT on SSMs with AdS integrated with different activations best and final CA and RA. As shown in the results in Table 2 regardless of the type of activation 2%
CIFAR-10 10 and MNIST using PGD-AT and TRADES, and record the
integrated, S4 and DSS with AdS showed more than 3% improvement in CA and improvement in RA. In particular, the AdS with ReLU as activation brought a 4. 4.1% improvement in CA and 3.97% improvement in RA for DSS when trained with TRADES, nearly matching Mega's performance in terms of CA and RA under PGD-10 and AA, without exhibiting RO issues observed in Mega with PGD-AT. The experimental results on Tiny-ImageNet (Tab. 6 also support the same conclusion. To further confirm that AdS can indeed help reduce SSM output discrepancies, similar the effect of Attention, we also quantify the differences in the intermediate layer feature sequences for each component of S4 and DSS after integrating AdS, as shown in Fig. 4 The feature sequence differences before and after Ads, in terms of both KL divergence and MSE, shows a decrease, indicating that the introduction of AdS does help in reducing the disparity between clean and adversarial feature sequences. This provides an affirmative answer to our question, suggesting that the primary advantage of Attention in enhancing SSM's performance in AT is due to its adaptive sequence scaling. Incorporating a low-complexity adaptive scaling module can improve the SSM model's 's CA and RA in AT while preventing RO issues.
5 Conclusion
In this study, we evaluate the performance of various SSMs structures in AT and investigate which components positively assist SSMs in this context. Our findings reveal the boousttess-geerrlizzen trade-off inherent in SSMs during AT. Although the integration of Attention improves both the CA and RA of SSMs, it also increases model complexity. leading RO issues. Through experimental and theoretical analyses, we demonstrate that pure SSM structures hardly benefit from AT, whereas Attention facilitates further reduction of output error through sequence scaling. Inspired by this, we show that introducing a simple and effective AdS module to SSMs effectively enhances their AT performance and prevents RO. This provides valuable guidance and insights for the future design of more robust SSM structures.
6 Acknowledgement
This work is supported by the National Science and Technology Major Project (2023ZD0121403) We extend our gratitude to the anonymous reviewers for their insightful feedback, which has greatly contributed to the improvement of this paper.
10

---

References
[1] Syama Sundar Rangapuram, Matthias W. Seeger, Jan Gasthaus, Lorenzo Stella, Yuyang Wang, and Tim Januschowski. Deep state space models for time series forecasting. In NeurIPS, 2018.
[2] Albert Gu, Tri Dao, Stefano Ermon, Atri Rudra, and Christopher Ré. Hippo: Recurrent mem- ory with optimal polynomial projections. In NewrlPS, 2020.
[3] Albert Gu, Karan Goel, and Christopher Ré. Efficiently modeling long sequences with struc- tured state spaces. In ICLR, 2022.
[4] Biqing Qi, Junqi Gao, Kaiyan Zhang, Dong Li, Jianxing Liu, Ligang Wu, and Bowen Zhou. Smr: State memory replay for long sequence modeling, 2024.
[5] Albert Gu, Isys Johnson, Karan Goel, Khaled Saab, Tri Dao, Atri Rudra, and Christopher Ré. Combining recurrent, convolutional, and continuous-time models with linear state space layers. In NeurIPS, 2021.
[6] Harsh Mehta, Ankit Gupta, Ashok Cutkosky, and Behnam Neyshabur. Long range language modeling via gated state spaces. In ICLR, 2023.
[7] Karan Goel, Albert Gu, Chris Donahue, and Christopher Ré. It's raw! audio generation with state-space models. In ICML, 2022.
[8] Eric Nguyen, Karan Goel, Albert Gu, Gordon W. Downs, Preey Shah, Tri Dao, Stephen A. Baccus, and Christopher Ré. S4ND: modeling images and videos as multidimensional signals using state spaces. CoRR, abs/2210.06583, 2022.
[9] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In ICLR, 2014.
[10] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adver- sarial examples. In ICLR, 2015.
[11] Junqi Gao, Biqing Qi, Yao Li, Zhichang Guo, Dong Li, Yuming Xing, and Dazhi Zhang. Perturbation towards easy samples improves targeted adversarial transferability. In NeurIPS 2023, 2023.
[12] Biqing Qi, Junqi Gao, Jianxing Liu, Ligang Wu, and Bowen Zhou. Enhancing adversarial transferability via information bottleneck constraints. IEEE Signal Process. Lett., 31:1414- 1418, 2024.
[13] Biqing Qi, Junqi Gao, Yiang Luo, Jianxing Liu, Ligang Wu, and Bowen Zhou. Investigating deep watermark security: An adversarial transferability perspective. CoRR, abs/2402.163977, 2024.
[14] Chengbin Du, Yanxi Li, and Chang Xu. Understanding robustness of visual state space models for image classification. CoRR, abs/2403. 10935, 2024.
[15] Alexey Kurakin, lan Goodfellow, and Samy Bengio. Adversarial machine learning at scale. arXiv preprint 1rX.v:1611.01236 2016.
[16] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018.
[17] Takeru Miyato, Andrew M. Dai, and Ian Goodfellow. Adversarial training methods for semi-supervised text classification. In ICLR, 2017.
[18] Biqing Qi, Bowen Zhou, Weinan Zhang, Jianxing Liu, and Ligang Wu. Improving robustness of intent detection under adversarial attacks: A geometric constraint perspective. IEEE Trans. Neural Networks Learn. Syst., 35(5))6133-6144 2024.
[19] Xuezhe Ma, Chunting Zhou, Xiang Kong, Junxian He, Liangke Gui, Graham Neubig, Jonathan May, and Luke Zettlemoyer. Mega: Moving average equipped gated attention. In ICLR, 2023.
11

---

[20] Albert Gu and Tri Dao. Mamba: Linear-tine sequence modeling with selective state spaces. CoRR, abs/2312.00752. 2023.
[21] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML, 2019,
[22] Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. In ICLR, 2019.
[23] Rafael Pinot, Laurent Meunier, Alexandre Araujo, Hisashi Kashima, Florian Yger, Cédric Gouy-Pailler, and Jamal Atif. Theoretical evidence for adversarial robustness through ran- domization. In NeurlPS, 2019.
[24] Leslic Rice, Eric Wong, and J. Zico Kolter. Overfitting in adversarially robust deep learning. In ICML, 2020.
[25] Yinpeng Dong, Ke Xu, Xiao Yang, Tianyu Pang, Zhijie Deng, Hang Su, and Jun Zhu, Explor- ing memorization in adversarial training. In /CLR, 2022.
[26] Albert Gu, Karan Goel, Ankit Gupta, and Christopher Ré. On the parameterization and initial- ization of diagonal state space models. In NeurIPS, 2022.
[27] Jimmy T. H. Smith, Andrew Warrington, and Scott W. Linderman. Simplified state space layers for sequence modeling. In ICLR, 2023.
(28) Ankit Gupta, Albert Gu, and Jonathan Berant. Diagonal state spaces are effective as struc- tured state spaces. In NeurlPS, 2022.
[29] Arnold Tustin. A method of analysing the behaviour of linear systems in terms of time series. 1947.
[30] Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John P. Dickerson, Christoph Studer, Larry S. Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! In Advances in Neural Information Processing Systems, pages 3353-3364, 2019.
[31] Dinghuai Zhang. Tianyuan Zhang, Yiping Lu, Zhanxing Zhu, and Bin Dong. You only prop- agate once: Accelcrating adversarial training via maximal principle. In Advances in Neural Information Processing Systems, pages 227-238, 2019.
[32] Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. Adversarially robust generalization requires more data. In NeurlPS, 2018.
[33] Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan. Better diffu- sion models further improve adversarial training. In ICML, 2023.
[34] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter- free attacks. In JCML, 2020.
[35] Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with a fast adaptive boundary attack. In ICML, 2020.
[36] Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: A query-efficient black-box adversarial attack via random search. In ECCV, 2020.
[37] Lukas Schott, Jonas Rauber, Matthias Bethge, and Wieland Brendel. Towards the first adver- sarially robust neural network model on MNIST. In ICLR, 2019.
[38] S. Kullback and R. A. Leibler. On information and sufficiency. The Annals of Mathematcaa Statistics, (1):79-86, 1951
[39] Zhuozhuo Tu, Jingwei Zhang, and Dacheng Tao. Theoretical analysis of adversarial learning: minimax approach. In NeurIPS, 2019.
[40] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial intelligence safety and security. 2018.
12

---

[41] Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adver- sarial examples. ICML, 2018.
[42] Chengzhi Mao, Ziyuan Zhong, Junfeng Yang, Carl Vondrick, and Baishakhi Ray. Metric learning for adversarial robustness, In NeurIPS, 2019.
[43] Tianyu Pang, Kun Xu, Yinpeng Dong, Chao Du, Ning Chen, and Jun Zhu. Rethinking softmax cross-entropy loss for adversarial robustness. arXiv preprint arXiv: 1905. 2019.
[44] Zekai Wang and Weiwei Liu. Robustness verification for contrastive learning. In JCMI., 2022.
[45] Muzammal Naseer, Salman Khan, Munawar Hayat, Fahad Shahbaz Khan, and Fatih Porikli. self-supervised approach for adversarial robustness. In CVPR, 2020.
[46] Tianyu Pang, Kun Xu, Chao Du, Ning Chen, and Jun Zhu. Improving adversarial robustness via promoting ensemble diversity. In ICML, 2019.
[47] Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. Ensemble adversarial training: Attacks and defenses. arXiv preprint 17X1v:1705.07204, 2017.
[48] Maksym Andriushchenko and Nicolas Flammarion. Understanding and improving fast adver- sarial training. In NeurlPS, 2020.
[49] Bai Li, Shiqi Wang, Suman Jana, and Lawrence Carin. Towards understanding fast adversarial training. arXiv preprint arXiv:2006. 03089, 2020.
[50] Lianghui Zhu, Bencheng Liao, Qian Zhang, Xinlong Wang, Wenyu Liu, and Xinggang Wang. Vision mamba: Efficient visual representation learning with bidirectional state space model. arXiv preprint arXiv:2401.09441. 2024.
[51] Yue Liu, Yunjie Tian, Yuzhong Zhao, Hongtian Yu, Lingxi Xie, Yaowei Wang, Qixiang Ye, and Yunfan Liu. Vmamba: Visual state space model. arXiv preprint arXiv:2401.10166 2024.
[52] Shida Wang and Beichen Xue. State-space models with layer-wise nonlinearity are universal approximators with exponential decaying memory. In NeurlPS, 2024.
[53] Liliang Ren, Yang Liu, Shuohang Wang, Yichong Xu, Chenguang Zhu, and Cheng Xiang Zhai. Sparse modular activation for efficient sequence modeling. NearlPS, 2023.
[54] Kaizhao Liang, Jacky Y Zhang, Boxin Wang, Zhuolin Yang, Sanmi Koyejo, and Bo Li. Un- covering the connections between adversarial transferability and knowledge transferability. In ICML, 2021.
13

---

A Mathematical Derivations
A.1
The Proof of Theorem 4.1.1
Denote
B
0
C₂A, B2
C
H
C7
A
Bl
CL-1
I1:=1
A
BL-1
B
then we have y (y1, "2. vt) Hu, y = V2., ... .12) H( (i) First, we explain how the lower bound is derived
E ( y) (y' w)} E [HH)) (He)]
2 ((v' - yill [By'' - y)ll (Cauchy Schiwarz)
(12)
121 (HHH)
where 1 (1, ... ,1)²
Denote H A [1 12, ... .r.l. where h1 h2,
hr
are
column vectors of H. i.e.
h
CB C2A,Br, ,,, CL [T A, B h2
(0, Ci ... CL-1 2-2 A
BL-1
hz = (0,0, "., ,,C then the inequality 12
can be written as
E (y)' 8) (3'' y) 2
h
T
h:)
1=1
i=1
C₁B
C C,A + C,B
C2A +C
2
Σ C I Bj
Σ 5 T
IH A
B
C.B.
B.B.B
C₂A B2
C₂A,B2
2
E
C₁ - 1 A
B
C₁
| 1 A
Bi.
hh Ex Eh
(13)
1
1
1
I
where E
is a lower triangular matrix with all elements being 1.
1
Therefore, ET E is real symmetric positive definite matrix and is full rank, then there exists an orthogonal matrix Q and a diagonal matrix = diag(>1, d2,... .dr.). where X; are eigenvalues of E E, and X must satisfy A 0, denote Amax max(A,, Ag...., A 02 and Amin

---

22.... d = C1, we have,
(y' y) T (y/ -y w)
2 hh E" Ehy
=ph Q" AQm
prenh qf
(14)
= ppatti hi
= Pre CC
A
B,)²
j=1
1=1
(ii) Perform similar derivation for the upper bound
(v/ -y) (y'
w)} EE
(H (He)
E
_ H
HE]
E
h4) T
1=1
1=1
T
C
CBB
C2 B2
C₂A,B2
E
E E.
C₁ I1 A
Br.
C₁
I1 A
Br.
(15)
Eih E E.hi]
EEh? A. E EA
S c2 A
T A
jj-1
= 02 Σ (C,
A,
B,)²
S M M Σ (C
A
B,)
i=1
i=1
[E1
E1
E2
where Eg =
E "" ,EL) & EAg- Let the eigenvalue
E2 EL_
with the maximum absolute value of matrix A, be denoted Ammax and the eigenvalue with the minimum absolute value Xmin note that IP-11 [xmin (C,B,)² < (C, I B,)² s
Ammax (C, B,)², which means:
j-1 X m
Σ
(9' (C,B))* <E
T) (y' (w'-v) -n) c Σ
(C,,,)²² X
max
(16)

---

Table 3: Specific architecture of models with different SSM structures on each dataset.
CIFAR-10
Input
Layerx4
Output
Input
Layer
Output
84 SSM
$4 SSM
S4
Linear(3.128) LayerNormu(125 (2))
Lineart 128, 128,128)
GeLLU
GoLU
Linear(128, (8,10))
LayerNormn (228)
Linear( (28))
Lincar 128,, 128)
GeLU
GcLU
1.8,
LayerNorms (28)
LayerNorm(122
DSS SSM GcLU Lincart 128, 128)
DSS SSM GcLU
DSS
LayerNormc (8))
I Linear(3, 128)
(eLLU
Linear(128,1)
Lineart I, LayerNorm[ (12)
Lineart 128, (28)
GeLUU
Linear(128,110
LayerNormi, 128)
LayertNorm(125 (288)
LayerNortat (28)
Lineart3, 3,188)
LayerNormi 128)
85 SSM
Lineur(18.,))
Linear(1.1220 LayerNorm(125
LayerNormm(128)
SSM
Linear( (128,10)
FMA
EMA
Atiention
Atlention
Softmax
Softmax
Megu
Linear(3.1288 LayerNorma (22)
LayerNormi 128)
Lineurt 128, 256)
Linear(128,1]
LayerNorm(120)
Limeurt1.1220
Lineurt 128.
LayerNorm(1225
Linear( (22
SiLU 256, 128)
SiLU
Lincur 128) LayerNormi(128)
LayerNorms 128)
Mamba
LayerNorm
Lincar(3, 128)
256, 256, 128) LayerNorm
Mamna SSM
Lincar(128.10)
Lineart I. LayerNorm( (28)
LayerNorm(122
Mamha SSM L 128)
Lincar(128.10
Table Model and Training parameters on MNIST, CIFAR-10 and Tiny-Imagened datasets.
Parameters
MNIST
CIFAR-10
Tiny- Viny-Imagenet
Input Dim
SSM laverss
Model Dim
128
128
128
Model
Stute Dim
32
64
64
Output Dim
10
10
50
Reduction Before Head
Mean
Mean
Mean
Optimizer
Adam
AdamW
AdamW
Batch Size
256
128
64
Learning Rate
0.001
0.001
0.001
Training
Weight Decay
Scheduler
cosine
0,0002
Epoch
|elloo
0.3
0.031
0.031
0.04
0.007
0.007
TRADES
B Related Works
B.1 Robust Attacks and Defenses
The existence of adversarial examples 9 TO
has revealed the vulnerability of deep neural net- works, where even imperceptible perturbations added to clean samples can deceive these networks. Such adversarial examples can be crafted by malicious adversaries the real world [40] 41], thus necessitating models to possess sufficient adversarial robustness to effectively counter adversarial attacks.
To enhance the adversarial robustness of models against adversarial attacks, numerous adversarial defense methods have been proposed. Currently, the most widely used and effective defense method is AT 15 16]. AT employs samples perturbed by adversarial attacks as training data, enabling the model adapt the distribution of adversarial examples and thus gain adversarial robust- ness [5 16 21]. Additionally, various other learning frameworks have been integrated into AT to improve effectiveness, such as metric learning [42 43), self-supervised learning 44 45). and ensemble learning [46] 47). However, AT still has two main limitations: 1) the inherent robustness- generalization trade-off in deep models (21). which leads to decrease in the model's 's clean accuracy where the model overfits to the adversarial examples in the training set.
after AT; 2) RO 48 49
B.2
SSM Models
Due to SSMs' excellent oong-sequence modeling capabilities and efficient linear computational com- plexity, these models have garnered widespread attention and achieved great success in various fields

---

200
200
1.75
1.75
60-
1.50
1.50
Adl Tow Loss:
1.25
1.00-
0:75
0.50
0.25
8100
25
50
75
100
125
150
175
0
25
50
100
125
150
0-1
25
50
75
160
125
150
epoch
epoch
epoch
0.85
Tpin A2e
0.7
0.7
Ade Toxl
0.15
0.00
0.5
0.4
0.4
15
125 175
50
100 epoch
125
150
17s
50
75
100
150
175
epoch
epoch
DSS-CIFAR-10
Mannoe Al-.
Map-CIFAR--O
SI-CIFAR-10
S5-CIFAR-10
MN05T
Moss MNIST
54-MNIIT
Figure 5: The ST training process, testing process, and the adversarial PGD-10 testing process on the testing datasets on CIFAR- 10 and MNIST datasets.
Table 5: Comparisons among the test accuracy (%) of different SSM structures with different Train- ing types on Tiny-Imagenet test set. 'Best' and 'Last' mean the test performance on the best and last checkpoint, respectively. "Diff" denotes the accuracy gap between the 'Best' and 'Last'. The best checkpoint selected based on the highest RA on the test set under PGD-10.
Dataset
Structure
Training Type
Clean
PGD-10
AA
Best
Last
Diff
Best
Last
Diff
Best
Last
Difff
ST
21.00
20.88
0.12
0.00
0.00
0.00
0.00
0.00
0.00
84
TRADES
17.92
17.44
0.48
3,48
3,24
0.24
3.00
2.88
0.12
ST
23.20
23.00
0.20
0.40
0.00
0.40
0.00
0.00
0.00
PGD-AT
11.68
11:20
0.48
4.75
4.56
0.20
3.20
0.0%
-iny-Imagrnet
S5
PGD-AT
ST
12.20
18.64
11.6%
18.60
0.04
0.52
0.04
4.48
4.00
0.00
0.04
0.48
0.00
3.28
0.00
3.12
0.16
0.00
TRADES
14.72
13.96
0.76
2.56
2.20
0.36
2.12
1.92
0.20
ST
36.84
36,80
0.04
1,60
0.00
1,60
0.00
0.00
0.00
Mega
RGI-AT
28.08
23.96
4.12
11.32
2.76
8.56
1.88
1.08
4.80
TRADES
32.17
30.00
2.12
10.44
8.48
1.96
5.24
4.88
0.36
29 12
28
0.08
0.00
Mamba
PGD-AT TRADES
0.16
4.04
4.08
1.93
29.28
28.64
0.64
3.00
4.36
0.64
2.80
2.36
0.44
such as computer vision [50 51 and natural language processing 200). M was the first to integrate state-space models from modern control theory with deep learning. initiating extensive research on SSMs within the deep learning community. Early research on SSMs was limited by issues such the computational complexity of training and the exponential decay of memory [52). which re- stricted their application. S4 (3] optimized the parameterization scheme of SSMs to reduce the com- putational requirements for training, while S5 (27] further extended S4's SISO system to MIMO system. Mamba 20 introduced a selective scanning mechanism to more flexibly adapt to the input, significantly enhancing the performance of SSM models. Additionally, series of works aimed to integrate SSM models with attention mechanisms 6 [33 19 to mitigate the flexibility limitations imposed by the inherent fixed structure bias of SSMs.
B.3 Adversrial Robustness of SSM Models
Despite the widespread attention on the superior performance of SSMs, the adversarial robustness of such models has not been thoroughly investigated. This is an urgent issue that needs to be explored before SSMs can be widely applied. To the best of our knowledge, 54 is the only work that has investigated the adversarial robustness of SSMs. This study shows that VMamba is more susceptible to adversarial attacks compared convolutional networks on 2D image data, indicating that the robustness of SSMs requires more attention. However, this work only studied VMamba in the visual

---

Table 6: Comparisons among the test accuracy (%) of S4 and DSS with different AdS modules and different AT types on Tiny-Imagenc test set. 'Best' and 'Last' mean the test performance at the best and last epoch, respectively. 'Diff' denotes the accuracy gap between the 'Best' and 'Last', '-' indicates that the results of AdSS are not used. The best checkpoint is selected based on the highest RA on the test set under PGD-10.
Dalest
Structure
Training Type
AdS
Clean
PGD-10
AA
Diit
12.32
11.88
0.44
6.68
4.60
0.08
3.36
3.30
0.16
Rel R1
12.62
2.36
0.28
5.02
4.03
01:12
1.96
1.44
0.13
Tanh
12.58
12.33
0.25
4.95
4.85
0.10
3.52
3.43
0.09
17.92
17:44
0.48
3.48
3.25
0.24
3.00
0.12
TRADES
Sigraood
Rel.U
18:45
18.32
0.1.3
3-10
3.82
0.14
3:20
3.12
3.16
0.08
18.48
3.96
3.33
S4
23.64
23.48
0.34
7.84
48
0.36
104
0.76
0.78
ReeAAT
ReLU
26.10
13.80
0.20
0.04
183
0.08
Tanh
24.08
23.92
0.16
3.64
3.58
0.06
198
150
0.05
16.08
YOPO
Statoood
ReLU
19:31
19.60
18:51
034
615
016
Ting-Imagenet
3.68
0.17
11.68
11200
0.48
4.76
4.5
0.29
3.0
3.12
008
PGD-AT
RelAU
11.7
3.96
4.81
0.18
Tunh
12.13
11.95
0.18
5.11
4.96
0.15
3.00
5.73
0.19
TRADES
Rell EJ
2.55
17:19
12.44
0.13
040
0.13
37M
300
015
03p
Tanh
24.32
23.96
0.36
2,80
260
9.20
096
0.5
008
FieeAT
Sigitooud
Tanh
25.31
25.45
25.29
25.15
0.14
0.16
3.28
3.36
8.21
0.15
111
111
091
092
021
021
5.28
0.30
150
104
0.16
ReLU
19:20
18.02
034
5.92
580
0.02
340
320
0.20
Tanh
19.70
18.87
0.83
5.85
5.77
0.06
3.39
3.18
domain and did not evaluate the sequence modeling robustness of SSMs. Additionally, it lacks comprehensive evaluation of various SSM structures, and our understanding of the commonalities and characteristics of different SSM structures still insufficient. More importantly, this study did not provide methods to improve the robustness of SSMs.
C Experimental Details
The specific structures of different SSM architectures on each datasets are shown in Table 3 And the training parameters and details used for each dataset are shown in Table All experiments were implemented on multiple NVIDIA RTX A6000 GPUs.
D Additional Results
In this section, report additional experimental results, including the ST training process, testing process, and the PGD-10 attack test results on the test datasets of CIFAR- 10 and MNIST (Fig. 5). the CA and RA of five SSM structures frameworks (Tab. 5), and the related comparison of results with and without the AdSS mechanism (Tab. 6)
under different adversarial training
E
Limitations
While this paper offers a componential analysis and exploration of SSM performance in AT, with the goal of informing the design of more robust SSM structures, there are several limitations to our study. Due to space constraints, our explorations have been limited to fundamental visual classification tasks. Future research will need extend this analysis to wider array of modalities and downstream tasks to fully understand and enhance the robustness of SSMs in diverse applications.
5

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: All our conclusions and contributions are summarized in the abstract and explained in the introduction.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals motivation as long as it is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes],
Justification:
Due to the limited space of the main text, we put the limitations in Appendix
H
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The au- thors should reflect on how these assumptions might be violated practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the ap- proach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to system might not be used reliably provide closed captions for online lectures because fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to ad- dress problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

---

Answer: [Yes]
Justification:
The complete mathematical derivations are provided in the Appendix
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theo- rems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be comple- mented by formal proofs provided appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclu- sions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: We report all settings and details the reproducible experiments Section 3 and Appendix C
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is a dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can accomplished various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data often one good way accomplish this, but reproducibility detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of model checkpoint, other means that are appropriate to the research performed.
also be provided via
While NeurIPS does not require releasing code, the conference does require all sub- missions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or a way re- produce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which thors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing or verifying the results.
5. Open access to data and code

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.com cc/
for more details.
While we encourage the release of code and data, understand that this might be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https:
ssi onpolicy for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We report all settings and details the reproducible experiments Scction 3 and Appendix
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropri- ate information about the statistical significance of the experiments?
Answer: [No]
Justification: The adversarial training of multiple models is highly time-consuming, and given the stability of adversarial training results, the necessity for conducting statistical significance tests is deemed unnecessary.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

---

The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors). should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK report I-sigma error bars, but one should state The authors should prefer- ably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
of the paper reports the computer resources needed to reproduce Justification: Appendix of the experiments.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental rums well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't t make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics hattps://euurpp:: ctc//uuulic//hhcsuuuuuuee
Answer: [Yes]
Justification:
The research conducted in the thesis complied with the NeurIPS Code of Ethics in all respects.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No. they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA]
This an exploratory study the SSM model and does address social impacts.
Justification:
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.

---

Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact spe- cific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitiga- tion strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
The paper poses such risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by re- quiring that users adhere to usage guidelines restrictions access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification:
The creators original owners of assets used in the paper, properly credited and the license and terms of use explicitly are mentioned and properly respected.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
10

---

If assets are released, the license, copyright information, and terms of use in the pack- age should be provided. For popular datasets, pattastts.paperswiiiae paperswithcooeeeo com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the li- cense of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information not available online, the authors are encouraged to reach out to the asset's s creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and the documenta- tion provided alongside the assets?
Answer: [NA]
Justification: The paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and Research with Human Subjects
For crowdsourcing experiments and research with human subjects, does the pa- per include the full text instructions given to participants and sereenshots, applicable, well as details about compensation (if any)?
Question:
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contri- bution of the paper involves human subjects, then as much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, cura- tion, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper deseribe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
The paper does not involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equiva- lent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
12


Reviews:
[{"review_id": "cqhMLJ4yKc", "reviewer": "Reviewer_eBVC", "summary": "This paper presents a comprehensive analysis of the adversarial robustness of Deep State Space Models (SSMs). The authors evaluate various SSM structures under different adversarial training (AT) frameworks, specifically examining how different components contribute to adversarial robustness. They observe that pure SSM structures struggle to benefit from AT, while the incorporation of attention mechanisms yields better trade-offs between robustness and generalization, albeit with the introduction of robust overfitting issues. The authors provide theoretical and empirical analyses to explain these phenomena and propose a simple Adaptive Scaling (AdS) mechanism to enhance SSM performance in AT.", "questions": "- It’s a bit surprising to see that PGD-AT doesn’t work on MNIST (according to AutoAttack), while TRADES does. Were the hyperparameters properly tuned?\n- Have you considered exploring the interaction between SSM robustness and other aspects of model design, such as depth or width of the network?", "limitations": "Yes.", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "- Originality: The paper addresses an important and under-explored area in the intersection of SSMs (that have become very prominent recently, both for text and vision) and adversarial robustness. It provides novel insights into how different SSM components behave under adversarial attacks and training, including important observations about robust overfitting.\n- Quality: The work demonstrates high-quality research through its comprehensive empirical evaluations and some theoretical analysis. The authors conduct thorough comparisons across various SSM structures and AT frameworks.\n- Clarity: The paper is well-structured and clearly written. The authors present their methodology, results, and analyses in a logical and easy-to-follow manner. \n- Significance: This work makes significant contributions to understanding the adversarial robustness of SSMs, which is crucial given the increasing popularity of these models. The proposed AdS mechanism offers a practical solution to improve SSM robustness without incurring the drawbacks of attention mechanisms.\n- Relation to previous works: The most related previous work is [10] which has conducted only preliminary robustness evaluations on visual SSMs (only VMamba architecture).", "weaknesses": "- I don’t quite understand the claim about robust overfitting: based on Table 1, using AutoAttack, the “Diff” is always very small, almost always <1%. Why is there robust overfitting then?\n- Limited scope of experiments: While the paper provides comprehensive evaluations on MNIST and CIFAR-10 datasets, it lacks experiments on more complex datasets (e.g., at least Tiny ImageNet or some dataset with a higher image resolution) or real-world scenarios. This limitation somewhat restricts the generalizability of the findings.\n- [Less important] Comparison with non-SSM models: The paper focuses exclusively on SSM variants without comparing their adversarial robustness to other popular model architectures like CNNs or Transformers. Such comparisons could provide valuable context for the robustness of SSMs relative to other widely-used architectures.\n\nI would be willing to increase the score if the first 2 points are addressed.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "5UzV0rFMfw", "reviewer": "Reviewer_PGjA", "summary": "This paper investigate the adversarial robustness in deep state space models (SSMs). They provide both empirical and theoretical analysis of the SSMs' performance under the adversarial perturbation. They find that fixed-parameterized SSMs are limited in their adversarial training benefits due to output error bounds strictly tied to their parameters, whereas input-dependent SSMs risk experiencing error explosion.", "questions": "1. Have you tested proposed AdS performance on larger dataset (e.g, ImageNet-1k, ImageNet-tiny)?\n2. The proposed AdS is more like a naive try. Is that possible to propose a new SSM architecture based your observation?", "limitations": "See weaknesses and questions.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper is well organized and easy to follow.\n2. The experiments on serval image classification benchmarks are solid and comprehensive.\n3. The theory analysis and visualization is helpful.", "weaknesses": "1. Tested dataset size is small.\n2. Better to add a result of without AdS in Table 2 so we can better observe the improvement.\n3. Lack of analysis why different activation function in AdS influence performance.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "5cfmdOGFcR", "reviewer": "Reviewer_a6wJ", "summary": "The paper investigates and evaluates the effectiveness of traditional Adversarial Training (AT) methods on recently emerged State Space Models (SSMs). The paper finds that pure SSM is not a suitable choice for AT and attention-based SSM learns the adversarial feature more effectively. Based on such insights, theoretical proof is developed and the Adaptive Scaling is applied to SSM for better robust generalization. The experiments are mainly on MNIST and CIFAR-10.", "questions": "Please address my concerns stated in the weakness section. Given the current version of the submission, I rate it as a borderline rejection considering the lack of sufficient empirical evaluation and the limited novelty of the adversarial training methods. However, I look forward to the authors' response, and I will consider revising the rating based on the soundness of the response.", "limitations": "The paper has stated the limitations in Appendix E.", "rating": 5, "confidence": 5, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. The paper is well-written with a clear storyline and a suitable motivation.\n2. The trustworthiness (e.g., robustness, explainability) research for SSM is an important topic and is yet to be fully explored.\n3. The theoretical proof of the generalization bound is clear.", "weaknesses": "1. The evaluation dataset is not sufficiently scaled up to be representative. It would be more convincing if the paper developed similar findings on larger datasets such as CIFAR-100 and Tiny-ImageNet. \n\n2. The involved adversarial training methods lack novelty. While PGD-AT and TRADES are classic AT methods, other representative variants can significantly improve AT efficiency and its robust performance. To name a few, Free-AT [1] substantially improves the training efficiency, and YOPO [2] boosts the robustness with fewer computations. Will SSMs be able to adopt these variants other than classic PGD-AT?\n\n[1] Adversarial Training for Free. NeurIPS 2019.\n\n[2] You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle. NeurIPS 2019.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We are grateful for the comprehensive and professional feedback from the reviewers. It is both pleasing and encouraging to see that they have recognized our work as **novel** (R1), of **high quality** (R1), and of **significant importance** (R1, R3). They have also noted the **clear logic** in our writing (R1, R2, R3), a **well-defined motivation** (R3), **explicit theoretical contributions** (R2, R3), and **solid and comprehensive experimentation** (R2). We sincerely appreciate the reviewers' careful reading of our paper and their identification of the innovation, contributions, and strengths of our work. 

We also thank the reviewers for their valuable and insightful comments and questions, which are crucial for further refining our work. We are confident that our responses will address the concerns raised by the reviewers.

Moving forward, we will first provide a unified response to the common questions from all reviewers, followed by a point-by-point reply to each individual's specific concerns.

**Q1: The evaluation dataset is limited and should be conducted on datasets with larger sizes/ scales to ensure more comprehensive evaluation.**

We greatly appreciate the valuable suggestions from the reviewers. To ensure a more thorough evaluation, we have conducted ST and AT on a larger dataset, Tiny Imagenet, which contains more classes. The results are presented in **Table 1 of the supplementary pdf**. Consistent conclusions with those obtained on MNIST and CIFAR10 can be drawn from these results, namely:
1) All SSM structures experienced a significant drop in CA after AT, especially the DSS, which saw a more than 10% decrease in natural accuracy after PGD-AT. This indicates **a clear trade-off between robustness and generalization in SSM structures**.
2) **Pure SSM structures hardly benefit from AT**. Even the Data-Dependent Mamba did not show a significant RA improvement compared to Data-Independent SSMs like S4 and DSS after AT.
3) **The incorporation of attention mechanisms indeed leads to better CA and RA, but introduces RO issues**, especially after PGD-AT, where Mega's final RA dropped by 8.56% compared to the best RA.
4) **After integrating our designed AdS, the CA and RA of Data-Independent SSMs, S4 and DSS, have been universally improved**.

Note that we have selected only the first 50 classes of the training and validation sets for experiments. The reason for this is the time cost required for experiments. We aim to better address the reviewers' questions within a limited time frame. For example, for models like Mega with a quadratic complexity attention mechanism, even using A800/A100 GPUs and a batch size of 128 on CIFAR10 for 180 epochs of TRADES AT, it takes more than three days. Tiny Imagenet's width and height are twice that of CIFAR10, which means the sequence length for sequential image classification will be four times that of CIFAR10, undoubtedly bringing a significantly higher time cost. Therefore, we chose the first 50 classes of Tiny Imagenet, ensuring that both the size and the number of classes of the dataset are significantly higher than those of CIFAR10 and MNIST for a more comprehensive evaluation. We believe our experiments and conclusions will effectively address the reviewers' concerns.

**Q2: More AT frameworks should be included for comparison to provide stronger support for the article's conclusions.**

We appreciate the constructive feedback from the reviewers. The purpose of this work is not to propose an AT strategy, but rather to conduct a comprehensive evaluation of the AR of SSMs. Additionally, by analyzing the structure of SSMs, we aim to identify the limitations that prevent them from benefiting from AT, thereby guiding the design of further corrective strategies. Considering the inclusion of newer AT frameworks to refine our assessment, we have introduced FreeAT[1] and YOPO[2], two more efficient AT baselines, and conducted experiments on MNIST, CIFAR10, and Tiny ImageNet. Hyperparameter settings were referenced from the original papers[1][2], with results shown in **Table 2 of the supplementary pdf**. We found consistent conclusions with those obtained using PGD-AT and TRADES:
1) Each SSM structure exhibited a reduction in normal accuracy, demonstrating **a clear trade-off between robustness and generalization**, especially on the CIFAR10 and Tiny ImageNet datasets.
2) **Pure SSM structures still struggle to benefit from these two AT frameworks**, and neither brought better RA than PGD-AT. Moreover, on MNIST, we found that all models had difficulty converging under the YOPO framework. This suggests that these two AT frameworks, effective for convolutional structures, may not be directly transferable to SSMs performing sequential image classification tasks. When using SSMs for sequential modeling, more targeted design is needed for the specific conditions of this scenario to analyze and design AT strategies. 
3) Mega, which incorporates the Attention mechanism, showed a more pronounced decrease in final RA compared to other SSM structures, indicating a **more severe RO issue**.
More importantly, **the incorporation of our designed AdS into these two frameworks still universally improved the CA and RA for Data-Dependent SSMs S4 and DSS**. This further supports the effectiveness of the AdS design. We would like to express our gratitude once again to the reviewers for their constructive feedback.

[1] Adversarial Training for Free. NeurIPS 2019.

[2] You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle. NeurIPS 2019.

Meta-review: This paper presents a study of adversarial robustness of the state space models (SSMs), including both theoretical and empirical analysis. Through the analysis of different components of SSMs, the authors show that incorporation of the attention mechanism helps enhance their robustness due to its input-dependent nature, while there could be a risk of robust overfitting. Then, the authors proposed a simple mechanism to enhance the adversarial training performance while avoiding robust overfitting, and validated this on multiple small-scale benchmarks.

The paper received borderline ratings, with the reviewers leaning toward acceptance. The reviewers initially had concerns over the small-scale experiments, lack of experimental results with stronger attacks, underdeveloped method, and unclear claim over robust overfitting. However, these concerns were partly addressed during the rebuttal period as the authors provided clarification and additional results with more attacks and an additional dataset (TinyImageNet). 

I believe that the paper proposes an interesting study that could be of interest to researchers working on SSMs, and the findings could lead to many follow-up studies in this direction. However, the problem addressed in this work seems niche, which may limit its potential impact.
Decision: Accept (poster)