Generalizable Lightweight Proxy for Robust NAS against Diverse Perturbations
Authors: Hyeonjeong Ha
Minseon Kim
Sung Ju Hwang
Venue: NeurIPS 2023 poster (2023)
Keywords: neural architecture search
generalization
efficiency
zero-cost proxy
TL;DR: We propose an lightweight consistency-based proxy for robust neural architecture search that can find well-generalized neural architectures to diverse tasks and perturbations.

Abstract: Recent neural architecture search (NAS) frameworks have been successful in finding optimal architectures for given conditions (e.g., performance or latency). However, they search for optimal architectures in terms of their performance on clean images only, while robustness against various types of perturbations or corruptions is crucial in practice. Although there exist several robust NAS frameworks that tackle this issue by integrating adversarial training into one-shot NAS, however, they are limited in that they only consider robustness against adversarial attacks and require significant computational resources to discover optimal architectures for a single task, which makes them impractical in real-world scenarios. To address these challenges, we propose a novel lightweight robust zero-cost proxy that considers the consistency across features, parameters, and gradients of both clean and perturbed images at the initialization state. Our approach facilitates an efficient and rapid search for neural architectures capable of learning generalizable features that exhibit robustness across diverse perturbations. The experimental results demonstrate that our proxy can rapidly and efficiently search for neural architectures that are consistently robust against various perturbations on multiple benchmark datasets and diverse search spaces, largely outperforming existing clean zero-shot NAS and robust NAS with reduced search cost.

Generalizable Lightweight Proxy for Robust NAS against Diverse Perturbations
Hyeonjeong Ha'*, Minseon Kim Sung Ju Hwang 1.2
Korea Advanced Institute of Science and Technology (KAIST), "DeepAuto.ai (hyeonjeongha, minseonkim, sjhwang82) Skaist..aatt......eaa ac ac.kr
Abstract
Recent neural architecture search (NAS) frameworks have been successful in finding optimal architectures for given conditions (e.g., performance or latency). However, they search for optimal architectures in terms of their performance on clean images only, while robustness against various types of perturbations or cor- ruptions is crucial practice. Although there exist several robust NAS frameworks that tackle this issue by integrating adversarial training into one-shot NAS, however, they are limited in that they only consider robustness against adversarial attacks and require significant computational resources to discover optimal architectures for single task, which makes them impractical in real-world scenarios. ad- dress these challenges, we propose novel lightweight robust zero-cost proxy that considers the consistency across features, parameters, and gradients of both clean and perturbed images at the initialization state. Our approach facilitates an efficient and rapid search for neural architectures capable of learning generalizable features that exhibit robustness across diverse perturbations. The experimental results demonstrate that our proxy can rapidly and efficiently search for neural architectures that consistently robust against various perturbations benchmark datasets and diverse search spaces, largely outperforming existing clean zero-shot NAS and robust NAS with reduced search cost. Code is available at http:///httbb..oom//yyeeeegggnnt
multiple
1 Introduction
Neural architecture search (NAS) techniques have achieved remarkable success in optimizing neural networks for given tasks and constraints, yielding networks that outperform handerafted neural architectures [2, 24, 28, 33, 42]. However, previous NAS approaches have primarily aimed to search for architectures with optimal performance and efficiency clean inputs, while paying less attention robustness against adversarial perturbations [16, 29] or common types corruptions [20]. This can result in finding unsafe and vulnerable architectures with erroneous and high- high-confidence predictions on input examples even with small perturbations [31, 22], limiting the practical deployment of NAS in real-world safety-critical applications.
To address the gap between robustness and NAS, previous robust NAS works [31, 18] have proposed to search for adversarially robust architectures by integrating adversarial training into NAS. Yet, they are computationally inefficient they utilize costly adversarial training on top the one-shot NAS methods [26, 4], requiring up 33x larger computational cost than clean one-shot NAS [42]. Especially, Guo et [18] takes almost 4 GPU days on NVIDIA 3090 RTX GPU to train the supernet, as it requires performing adversarial training on subnets with perturbed examples (Figure 2, RobNet). Furthermore, they only target a single type perturbation, i.c., adversarial perturbation [16, 29], thus, failing to generalize to diverse perturbations. In order to deploy NAS to real-world applications
Equul contribution. Author ordering is determined by coin flip.
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

antl
Clean Network
Single-Step Updote
Clean
Clean NAS
Robust
CRaže
VOL
Consurency
Adversarial
Perturbution
6-
V L
Koay Wolk
Dog
Car
Cat
Dog
Dog
Cat
Dog
Dog
Dog
Common
Robust Network
Single-Step Update
Comuptiin
(a) Clean NAS and Robust NAS vs CRoZe.
(b) Consistency- based zero-cost proxy (CRoZe).
Figure I: Generalizable lightweight proxy for robust NAS against diverse perturbations. While previous NAS methods search for neural architectures primarily on clean samples (Clean NAS) or adversarial perturbations (Robust NAS) with excessive search costs and fail to generalize across diverse perturbations, our proposed proxy, namely CRoZe, can rapidly search for perforrrf neural architectures against diverse perturbations. Specifically, CRoZe evaluates the network's robustness in single step based on the consistency across the features and 2²), parameters and 8*), and gradients (Vol and V between clean and robust network against clean and perturbed inputs, respectively.
that require handling diverse types of tasks and perturbations, we need a lightweight NAS method that can yield robust architectures without going over such costly processes.
To tackle this challenge, we propose a novel and lightweight Consistency-basee Robust cero-cost proxy (CRoZe) that can rapidly evaluate the robustness of the neu- ral architectures against diverse semantic- preserving perturbations without requiring any iterative training. While prior clean zero-shot NAS methods [1, 30] introduced proxies that score the networks with ran- domly initialized parameters [23, 39, 27, 37] without any training, they only con- sider which parameters are highly sensi- tive to clean inputs for given task, determined by measuring the scale of the gradients based on the objectives and thus yield networks that are vulnerable against perturbed inputs (Figure la).
HRS Accurscy (9)
35
Aug. Rob. Accuracy (%)
58
@ORNAS PC-DARTS
GRaZE
Adviluss
30-
Aduifuuh:
GradNom
25
PC PC-DARTS
Robbee
SynPlow
52
SysFoow
GradNorm
200x10"
100x10" 200x10' 300x10"
Search Time (GPU
Search Time (GPU sea)
(a) Standard- Trained
(b) Adverserially-Trainee
Figure 2: Final performance of the searched network in
DARTS search space CIFAR-10 10 through clean one-shot NAS, robust NAS, clean zero-shot NAS and our CRoZe.
Specifically, our proxy captures the consistency across the features, parameters, and gradients of randomly initialized model for both clean and perturbed inputs, which is updated with a single gradient step (Figure 1b). This metric design measures the model's 's robustness in multiple aspects, which is indicative of its generalized robustness to diverse types of perturbations. This prevents the metric from being biased toward specific type of perturbation and ensures its robustness across perturbations. Empirically, we find that a neural architecture with the highest performance for single type of perturbation tends to exhibit larger feature variance for other types of perturbations (Figure 4), while our proxy that considers the robustness in multiple aspects obtains features with smaller variance even on diverse types of perturbations. This suggests that our proxy is able to effectively discover architectures with enhanced generalized robustness.
diverse remantic-preserveee
We validate our approach through extensive experiments on diverse search spaces (NAS-Boc Bench 201, DARTS) and multiple datasets (CIFAR- 10, CIFAR- 100, ImageNet16-120; with not only the adversarial perturbations but also with various types of common corruptions [20], against both clean zero-shot NAS [1, 30] and robust NAS baselines [31, 18). The experimental results clearly demonstrate our method's 's effectiveness in finding generalizable robust neural architectures, as well as its computational efficiency. Our contributions can be summarized as follows:
We propose a simple yet effective consistency- zero-cost proxy for robust NAS against diverse perturbations via measuring the consistency of features, parameters, and gradients between perturbed and clean samples.
Our approach can rapidly search for generalizable neural architectures that do not perform well only on clean samples but also are highly robust against diverse types of perturbations various datasets.

---

Our proxy obtains superior Spearman's 's across benchmarks compared to existing clean zero- shot NAS methods and identifies robust architectures that exceed robust NAS frameworks by 5.57% with 14.7 times less search cost within the DART'S search space on CIFAR-10.
2 Related Work
Robustness of DNNs against Perturbations. Despite the recent advances, deep neural networks (DNNs) are still vulnerable to small perturbations the input, c.g., common corruptions [20]. random noises [10], and adversarial perturbations [3, 36]. which can result in incorrect predictions with high confidence. To overcome such vulnerability against diverse perturbations, many approaches have been proposed to train the neural network to be robust against each type of perturbation individually. To learn a rich visual representation from limited crawled data, previous works [21, 8] utilized combination of strong data augmentation functions to improve robustness to common corruptions and random Gaussian noises. Furthermore, to overcome adversarial vulnerability, widely used defense mechanisms [16, 29, 32] generate adversarially perturbed images by taking multiple gradient steps to maximize the training loss and use them in training improve the model's robustness.
Neural Architecture Search. Neural architecture search (NAS) leverages reinforcement learn- ing [45, 2, 44] or evolutionary algorithms [34, 25, 13, 35] to automate the design of optimal archi- tectures for specific tasks or devices. However, those are computationally intensive, making them impractical to be applied in real-world applications. To address this, zero-shot NAS methods [1. 30] have emerged that significantly reduce search costs by predicting the performance of architecture at the initialization state only with single batch of a given dataset. Despite the improvement in NAS, previous zero-shot NAS methods, and conventional NAS methods aim only to find architectures with high accuracy clean examples, without considering their robustness against various perturbations. In particular, SynFlow [1] lacks data incorporation in its scoring mechanism, potentially failing to find the network that can handle diverse perturbations. NASWOT [30] search models with low activation correlation across two different inputs, emphasizing their distinguishability. However, the criterion contradicts the requirements of robustness, which necessitates finding network that maintains similar activations for both clean and perturbed inputs. As a result, models found with pre- vious NAS methods often lead to incorrect predictions with high confidence [31, 22] even with small imperceptible perturbations applied to the inputs. A new class of NAS methods [18, 31] that considers robustness against adversarial perturbations has emerged. Yet, they require adversarial training of the supernet, which demands more computational resources than conventional NAS [34, 13] due to repeated adversarial gradient steps. Furthermore, adversarial robust NAS often overfit to a single type of perturbation due to only considering the adversarial robustness. Thus, there is a need for lightweight NAS approach that can achieve generalized robustness for safe real-world applications.
3 Methods
Our ultimate goal is to efficiently search for robust architectures that have high performance on various tasks, regardless of the type of perturbations applied to the input samples. To achieve this goal, we propose Consistency-bast -based Robust Zero-cost proxy (CRoZe) that considers the consistency of the features, parameters, and gradients between a single batch of clean and perturbed inputs obtained by taking single gradient step. The proposed proxy enables the rapid evaluation of the robustness of the neural architectures in the random states, without any adversarial training (Figure 1).
3.1 Robust Architectures
Formally, our goal is to accurately estimate the final robustness of a given neural architecture A and single batch of inputs = ((x, 3)), without training. Here, x E X is the input sample, and y E Y is its corresponding label for the given dataset D. In the following section, the network fo(-) consists of an encoder (.) and linear layer (-), which is AA that is parameterized with & and म, respectively. The straightforward approach to evaluating the robustness of the network is measuring the accuracy against the perturbed input x' with unseen semantic- preseriing perturbations, as follows:
N (arrg max P(h o ex(x') = c) = =)), eEY
Accuracy
(1)
n=1
3

---

where Ç is the Kronecker delta function, which returns if the predicted class is the same as and 0 otherwise, x' is perturbed input, such as one with random Gaussian noise, common types of corruptions [21]. or adversarial perturbations [29, 16] applied to it. Specifically, to have a correct prediction on the unseen perturbed input x', the model needs to extract similar features between x' and æ, assuming that the model can correctly predict the label for input as follows:
e (z) - (xx) ||ا
(2)
where e is sufficiently small bound. Thus, a robust model is one that can extract consistent features across a wide range of perturbations. However, precisely assessing the accuracy of the model against perturbed inputs requires training from scratch with a full dataset, which incurs a linear increase in the computational cost with respect to the number of neural architectures to be evaluated.
3.2 Estimating Robust Network through Perturbation
In this section, we explain details on preliminary protocols before computing our proxy. Due to the impractical computation cost to obtain a combinatorial number of fully-trained models in a given neural architecture search space (i.e., 10t9 for DARTS), we propose to utilize two surrogate networks which together can estimate the robustness of fully-trained networks within a single gradient step. The two surrogate networks are a clean network Se with the randomly initialized parameter 0 and robust network før with the robust parameter 8", which is determined with a parameter perturbations from fe. Then, the obtained 6" is used to generate the single batch of perturbed inputs for our proxy.
Robust Parameter Update via Layer-wise Parameter Perturbation. We employ a surrogate robust network to estimate the output of fully-trained networks against perturbed inputs. To make the perturbation stronger, we use a double- double-perturbatee perturbation scheme that combines layer-wise parameter perturbations [41] and input perturbations, both of which maximize the training objectives L. This layer-wise perturbation allows us to learn smoother updated parameters by min-max optimization, through which within a single step. Specifically, given a network f is composed of M layers, fo = san .... o fer. with parameters = {01..... 8M], the th layer- wise parameter perturbation is done as follows:
obtain the model with the maximal possible generalization capability [41, 14]
V Om (fo(T))))
0n 0m +
|0ml||
Ve,, (fo(z)) v)
where B is the step size for parameter perturbations, || || is the norm, and C is the cross-entropy objective. This bounds the size of the perturbation by the norm of the original parameter ||0m.]|
Perturbed Input. On top of the perturbed parameters (Eq. 3), we generate perturbed input images by employing fast gradient sign method (FGSM) [16]. which is the worst case adversarial perturbation to the input x as follows:
8 raign V (v (z).
(4)
where 5 is a generated adversarial perturbation that maximizes the cross-entropy objective L of given input æ and given label y. Then, utilize the perturbed inputs (a' x + 5) to estimate the robustness of the fully-trained model. Although CRoZe is an input perturbation-agnosti proxy (Supplementary B.2), we employ adversarially perturbed inputs for all the following sections.
3.3 Consistency- based Proxy for Robust NAS
We now elaborate the details on our proxy that evaluate the robustness of the architecture with the two surrogate networks: the clean network that is randomly initialized and uses clean images x as inputs, and the robust network parameterized with H" which uses perturbed images + 5 as inputs.
Features, Parameters, and Gradients. As we described in Section 3.1, we first evaluate the representational consistency between clean input (x) and perturbed input (x') by forwarding them through the encoder of clean surrogate network (.) and robust surrogate network for (-), respectively,
as follows:
Zm (fo = =1+ 1+
Zm
2
(5)
1.m

---

where 2m and zn are output feature of each network f-(-) and fo-(-), (-), respectively, from each m layer. Especially, we measure layer-wise consistency with cosine similarity function between clean and robust features. The higher feature consistency infers the higher robustness of the network.
However, the proxy solety considering the feature consistency within single batch can be heavily reliant on the selection of the batch. Therefore, to complement the feature consistency, we propose incorporating the consistency of updated parameters and gradient conflicts from each surrogate network as additional measures to evaluate the robustness of the network. To introduce these concepts. let us first denote the gradient and updated parameter of each surrogate network. The gradient from the clean surrogate network fe and robust surrogate network for against clean images and perturbed images x', respectively, are obtained as follows:
(6) where g and g" are the gradients with respect to eross-entropy objectives C for clean images x and perturbed images x', respectively. Then, we can acquire single-step updated clean parameters 0 and robust parameters 0" calculated with gradients and g" and learning rate respectively as follows:
g VoC(fo(t). 2), g" (for(())
0 0 7g, 01 + -9"".
(7)
Since each surrogate network represents the model for each task, i.e., clean classification and perturbed classification, the parameters and gradients of each surrogate network correspond to the updated weights and convergence directions for each task. Thus, the network that has high robustness will exhibit identical or similar parameter spaces for both classification tasks. However, as acquiring parameters of fully-trained network is impractical, we estimate the converged parameters with the single-step updated parameters 02 and 0"- Accordingly, since the higher similarity of single-step updated parameters may promote the model to converge both tasks, we evaluate the parameter similarity as one of our proxy terms as follows:
identical or similar parameter space for
0 fm.m= 0
Pm (01, 07) = 1+
(8)
1|0
O 1.
Moreover, each gradient of the surrogate networks represents the converged direction of given objectives for each task, which is cross-entropy loss of clean input and perturbed input (Eq. 6). We employ the similarity of these gradients to assess the difficulties of optimizing architecture for both highly aligned between the two tasks, the learning trajectory
tasks. When the gradient directions for both tasks becomes more predictable, facilitating the optimization of both tasks easily. In contrast, orthogonal gradient directions lead to greater unpredictability, hindering optimization and potentially resulting in suboptimality for both clean or perturbed classification tasks. Therefore, to evaluate the stability of optimizing both tasks, measure the absolute value of gradient similarity follows:
9m(g.g") = Im
Im
l1gm I1
Consistency-bases Robust Zero-Cost Proxy: CRoZe. In sum, to evaluate the robustness of the given architecture, we propose a scoring mechanism that evaluates the consistencies of features, parameters, and gradients between the clean network fo and the robust network for that are obtained with single gradient update. The robustness score for a given architecture is computed as follows:
M
CRoZela, fo: for)
Σ
Zm x Pm x Gm-
(10)
That is, we score the network fo with higher CRoZe score as more robust to perturbations. In the next section, we show that this measure is highly correlated with the actual robustness of fully-trained model (Table l).
Experiments
We now experimentally validate our proxy designed to identify robust architectures that perform well on both clean and perturbed inputs, on multiple benchmarks. We first evaluate Spearman's p between robustness and the proxy's values across different tasks and perturbations in the NAS-Bench-201
5

---

Table Comparison of Spearman's p between the actual accuracies and the proxy values on CIFAR-II 10 in the WAS-Bench-201 search space. Clean stands for clean accuracies and robust accuracies are evaluated against diverse adversarial attacks [16, 5, 32, 38, 17, 7]. denotes the HRS value of cach attack and AA. indicates AutoAttack. Avg. stands for average Spearman's 's o values with all accuracies. Bold and underline stands for the best and second, respectively, All models are trained on adversarially perturbed images.
Proxy Type
Clean
FGSM
PGD
FGSM
PGD*
CW
DeepFool
SPSA
LGV
AA.
Avg.
FLOPs
0.670
0.330
0.418
0.531
0.515
0.189
0.364
0.196
0.347
0.365
0.393
#Params.
0.678
0,341
0.429
0.541
0.526
0.182
0,371
0.209
0.355
0.375
0.401
Plain [1]
-0.042
-0.007
-0.012
-0.016
-0.016
0.072
0.009
0.009
0.010
0.015
0.002
Grasp [1]
0,470
0.324
0.341
0.392
0.375
0.179
0.393
0.249
0.401
0.397
0.352
Fisher [1]
0.482
0.226
0.276
0.335
0.334
0.234
0.242
0.092
0.239
0.244
0.270
GradNorm [1]
0.659
0.336
0.400
0.478
0.264
0.421
0.149
0.401
0.405
0.400
SynFlow [1]
0,635
0.355
0.420
0.519
0.498
0.202
0.397
0.196
0.387
0.383
0.399
NASWOT [30]
0.600
0.332
0,381
0.437
0.438
0.240
0.250
0.197
0,265
0.280
0.342
CRoze
0.723
0.417
0.501
0.602
0.588
0.220
0.454
0.240
0.449
0.458
0.465
search space, comparing it to clean zero-shot NAS methods (Section 4.2). We then evaluate the computational efficiency and final performance of the chosen architecture using our proxy in the DARTS search space, comparing it to existing robust NAS methods, which are computationally costly (Section 4.3). Lastly, we analyze the proxy's ability to accurately reflect the fully trained model's s behavior in a single step, as well as the capacity of the chosen robust architecture to consistently generate features, aligned gradients, and parameters against clean and perturbed inputs (Section 4.4).
4.1 Experimental Setting
Baselines. We consider three types of existing NAS approaches as our baselines. 1) Clean one- shot NAS [42, 6]: One-shot NAS methods for searching architectures only on clean samples. 2) Clean zero-shot NAS [1, 30]: Zero-shot NAS with proxies that evaluate the clean performance of architectures without any training. 3) Robust NAS [18, 31]: One-shot NAS methods for searching architectures only on adversarially perturbed samples.
Datasets. For the NAS-Bench-201 [12, 22] search space, we validate our proxy across different tasks (CIFAR-10, 10FAR-100, and ImageNet16-122) and perturbations (FGSM [16], PGD [29]. and 15 types of common corruptions [20]). To measure Spearman's p between final accuracies and our proxy values, we use both clean NAS-Bench-201 [12] and robust NAS-Bench-201 [22], which include clean accuracies and robust accuracies, respectively. Finally, we search for the optimal architectures with our proxy in DARTS [26] search space and compare the final accuracies against previous NAS methods [31, 18, 6, I] on CIFAR-I0 and CIFAR-100.
Standard Training& & Adversarial Training. For fair comparison, use the same training and testing settings to evaluate all the architectures searched with all NAS methods, including ours. 1) Standard Training: We train the neural architectures for 200 epochs under SGD optimizer with learning rate of 0.1 and weight decay le-4, and use a batch size of 64 following [31]. 2) Adversarial Training: We train the neural architectures with 4. PGD attacks with the epsilon of 8/255, step size 2/255, and 7 steps. We evaluate the robustness against various perturbations, which are adversarial attacks (FGSM [16], PGD [29]. CW [5], DeepFool [32], SPSA [38], LGV [17], and Auto [7]) and common corruptions [20]. More experimental details are described in Supplementary A.
4.2 Results on NAS-Bench-201
Standard-Trained Neural Architectures. We verify our proxy's capability to search for high- performing neural architectures across various tasks and perturbations by employing Spearman's s p to measure the rank correlation between the proxy values and final accuracies [1, 30, 11]. While existing clean zero-shot NAS works [1, 30] display weaker correlations with clean accuracies than using the number of parameters (#Params.) as a proxy, our proxy exhibits significantly stronger correlations with clean accuracies across all tasks. Specifically, it shows improvements of 5.92% and 1.95% on CIFAR- 10 and CIFAR-100, 100, respectively, compared to best- pessorerfonnin baselines (Table 2).
Furthermore, CRoZe shows remarkable Spearman's for robust accuracies obtained against adversar- ial perturbations and corrupted noises across tasks. Notably, our proxy outperforms the SynFlow [1] by 6.41% and 8.77% in an average of Spearman's 's p for adversarial perturbations and common cor-

---

Table 2: Comparison Spearman's p between actual accuracies and the proxy values on CIFAR- -0. CIFAR-100, and ImageNet16- 120 in NAS-Bench-201 search space. Clean stands for clean accuracies and robust accuracies are evaluated against adversarial perturbations (FGSM) [16] with various attack sizes (c) and common corruptions [20]. Avg. stands for average Spearman's o values with all accuracies within each task. Bold and underline stands for the best and second, respectively. All models are hundard-traineee on clean images.
CIFMR-10
CIFAR-ICO
IraacNatt 120
Type
Cleas
PGSM
Connico Cooretion (CC.
Cleas
PGSM
Conrico Cooupttnn (CC)
Clean
PGSM
4
Wextie:
Nosic
Blur
Digital
Weztan
Nosc
Blu
Digital
Arg.
8.776
1:755
0.740
11:05
01138
0,752
0:171
0.532
0.699
01061
11:85
01402
0.601
0:157
(1:88)
01611
0/634
atomm
0:387
0:756
0.719
11576
01131
0139
0.384
0.500
0.738
0.854
0.585
(1310)
0.489
0.618
0.166
0168%
11677
0.611
Groepil [1)
0.551
0.657
0411
[1611
(.250)
0.358
0.238
0.332
0.350
01699
0.555
01311
0.486
0.515
03310
0.555
11601
0.572
Files [1]
0.385
0.866
0439
0.411
0.77
0.221
0.344
0.345
0.353
0.573
0.45
0
0.447
0.3%5
04425
0.334
0.384
0.359
GualNoon [1]
0.687
0.360
0224
0.540
0.20
0.383
0.375
0.400
0.68
0.789
0.654
0.357
0.562
0.63
0.000
0.53
0.60
0611
0.372
0.588
0.351
0.587
0.600
0.300
0.315
0.551
NASWOT
0.714
0.23
1.376
0.801
1L763
0 190
0.236
0.561
1.508
0.7M4
0.001
0.747
0.251
0.505
0.682
16610
6.765
0.006
0,731
Fandom Search
Aging ution Search
Random Search
Aging Evolution Search
wooooogyeeee (0kgn))
2500
Mith
MLB
Xi
Trainod Modale
Trannd Moids
Trainos Modcl
Talno Mords
(a) Search on Clean Inputs
(b) Search on Adversarially Perturbed Inputs
Figure 3: Search with our proxy on CIFAR-10 in NAS-Bench-201 search space. Our proxy can reduce the sampling costs in searching for neural architectures against both clean (left) and perturbed samples (right).
ruptions CIFAR-10, respectively (Table 2). Our results on multiple benchmark tasks with diverse perturbations highlight the ability of our proxy to effectively search for robust architectures that can consistently outperform predictions against various perturbations. Importantly, our proxy is designed to prioritize generalizability, and as a result, it exhibits consistently enhanced correlation with final accuracies for both clean and perturbed samples. This result indicates that considering generalization ability is effective in identifying robust neural architectures against diverse perturbations but also leads to improved performance for clean neural architectures.
Adversarially-Trann -rained Neural Architectures. We also validate the ability of our proxy to precisely predict the robustness of adversarially-traine networks, specifically for adversarial perturbations. Adversarial training [29] is a straightforward approach to achieving robustness in the presence of adversarial perturbations. To assess the Spearman's 's p of robustness in adversarially-traine networks, we construct a dataset consisting of final robust accuracies of 500 randomly sampled neural architectures from NAS- MAS-Beech-2201 search space that are adversarially-trainee [29] from scratch. The final robust accuracies are obtained for 7 different adversarial attacks, including FGSM, PGD, CW, DeepFool, SPSA, LGV, and AutoAttack.
Notably, our proxy showcases the highest overall correlation for the 7 different adversarial attacks, supporting the ability of our proxy to search the architectures that are robust against diverse perturba- tions. Considering the trade-off between the clean and robust accuracy adversarial training [43], employ the harmonic robustness score (HRS) [9] to evaluate the overall performance of the adversarially-trainn models. When comparing the correlations between clean performances and proxy values, existing clean zero-shot NAS methods, i.e., SynFlow and Grasp, demonstrate higher correlations in the FGSM or PGD, but their correlations with clean accuracies are poorer than Grad- Norm and Fisher, respectively. This result shows that clean zero-shot NAS methods tend to search for architectures that are more prone to overfitting to either clean or robust tasks (Table 1, 2). In contrast, CRoZe consistently achieves higher Spearman's 's p for both clean and robust tasks, ultimately enabling the search for architecture with high HRS due to consideration of alignment in gradients.
4.3 End-to-End Generalization Performance on DARTS
In this section, we evaluate the effectiveness of CRoZe in rapidly searching for generalized neural architectures in the DARTS search space and compare with previous clean one-shot NAS [42, 6]. clean zero-shot NAS [37], and robust NAS [31, 18] in terms of performance and computational cost.
Efficient Sampling with CRoZe. The efficiency of our proxy lies in evaluating neural architectures without iteratively training models. As a result, most search time is dedicated to sampling the
7

---

Table 3: Comparisons the final performance and search time of searched network DARTS search space on CIFAR-10 10 and CIFAR-100. All NAS methods are executed on a single NVIDIA 3090 RTX GPU.
Method
Training-free
Params
Search Time
Standard- Trained
NAS
(M)
(GPU sec)
Clean
CC.
FGSM
HRS
PC-DARTS [42)
3.60
8355
(5 0.16)
73.57 (2: 0.89)
17.74 (2: 3.44)
29.76 4.81))
DINAS [6]
4.10
46857
94,18 (4: 0.33)
71.79 (.7.4)
15.63 2.78)
26.71 (= (.01)
RobNet [18]
5.44
274062
0.26)
72.49 0.45)
1.15)
25 1.71)
CIFAR-10
AdvRush [31]
4.20
251245
93.44 (+: 0.41)
(1 1.07)
14.94 (4: 2.56)
25.67 (= (=187)
GradNorm [1]
4.69
9740
92.95 0.67)
(3.03
15.64 (+: 0.15)
26.78 (-2.4)
SynPlow
5.08
10138
(+ 1,25)
70.94
1.46)
22.22 2.32)
CRoZe
5.52
17066
94,34 (# 0.08)
74.11 (# 1.40)
20.51 (#: 1.32)
33,07 (= 2.30)
PC-DARTS (42)
3.60
8355
76,95 0.67)
50.02 (1 0.05)
7.68 (1 0,47)
13.96 0.80)
DrNAS [6]
4.30
46857
75.49 1.66)
49.18 (2: 1.31)
8.14 0.23)
14.69 (= 0.35)
RohNet [18]
5.44
274062
76,40 0.30)
49.77 0.82)
7,50 (+: 0.84)
13.65 (= 1.39)
CIFAR-100
Adviuus
4.20
251245
1.35)
48.27 (+ 1.42)
(+: 0.811
13555 1.37)
GradNorm [1]
3.83
9554
68.52 (:: 0.80)
43.69 2:22)
6.87 (2: 1.58)
12.44 2611
SynPlow [1]
4.42
9736
76.23 (+: 0.73)
49 60 0.78)
9.01 (+: 0.56)
16. (= 0.91)
CRooe
4.72
17457
75.46 0.81)
49.33 (2 0.38)
0.78)
17.26 (= 1.22)
candidate architectures. To thoroughly explore the sampling costs involved in identifying good neural search space with two representative sampling-base search algorithms: random search (RAND) and evolutionary search (AE).
architectures, conduct experiments in the
Our experiments show that CRoZe can rapidly identify architecture with 91.5% clean accuracy and 50% FGSM robustness, even early in the search. By leveraging the initial pool of architectures from CRoZe with high proxy values (RAND+warmup and AE+warmup), our proxy cuts sampling costs and rapidly identifies high-performing sampling around the architecture with the highest proxy values of CRoZe (AE++armp++move), can find even more robust architectures using fewer sampled models (< 50) (Figure 3b). In essence, CRoZe effectively identifies high- persrrerfoning neural architectures for both clean and perturbed inputs in the
architectures for clean imputs (Figure 3a). Moreover, by focusing
search space.
End-to-End Performance. We validate the final performance of the neural architectures discovered by CRoZe (Table 3, 4) and compare the search time and performance with existing NAS methods in- cluding robust one-shot NAS (RobNet [18] and AdvRush [31]), clean one-shot NAS (PC-DARTS [42] and DrNAS [6]). and clean zero-shot NAS (SynFlow, GradNorm [1]). For fair comparison between clean zero-shot NAS (SynFlow, GradNorm) and CRoZe, we sample the same number of candidate architectures (e.g.. 5,000) using the warmup+move strategy in the DARTS search space. We report the average and standard deviation of accuracies evaluated over 3 different neural architecture searches. All experiments are conducted on single NVIDIA 3090 RTX GPU measure search costs.
In standard training, the searched network by our proxy surpasses the networks by robust one-shot NAS methods, RobNet and AdvRush, in terms of robust accuracy against FGSM CIFAR- 10, improving by 5.82% and 5.57%, respec- tively (Table 3). CRoZe also shows the highest HRS accuracy, 7.40% better than AdvRush on CIFAR-10, indicating its efficiency in mitigating the trade-off between clean and robust accuracy, while reducing the search cost by 14.7 times.
Table 4: Final performance of the searched networks that are adversarially -rriindd on CIFAR-10. 10.
NAS
Robustesss
Mechod
Clean
PGD
CW
SPSA
LGV
AAA.
Avg.
PC-DARTS
56.02
79.32
DrNAS
86.45
54.66
6.44
85.86
79.64
52.40
$5.80
RobNer
50.53
50.62
22.91
$0.85
77.79
46.34
55.70
AdvRush
85.98
53.89
6.68
84.81
79.61
$1.88
55.37
GradNorm
81.61
49.86
12.02
77.
73.27
SynFlow
77.08
45.95
26.50
75.78
74.14
42.45
$2.96
CRoze
84.28
52,17
19.13
83.43
76.85
48.14
55.94
Compared to the previously best-performing clean zero-cost proxy. SynFlow, CRoZe finds architec- tures with superior performance in clean, common corruptions, and FGSM scenarios. showcasing the effectiveness of our proxy in identifying generalized architectures. Moreover, the architecture chosen by CRoZe outperforms clean one-shot NAS methods in HRS accuracy, addressing vulnerability against both perturbations and clean inputs effectively (Figure 2a). When we adversarially train the searched architectures. CRoZe achieves the highest average robustness against 5 adversarial attacks at much lower search costs compared to robust NAS on CIFAR- 10 (Table 4, Figure 2b).
4.4 Further Analysis
Ablation of Each Component of CRoZe Our proxy consists of three components: feature, parameter, and gradient consistency. To analyze the importance of considering all factors for evaluating the robustness of the given neural architecture, we conduct an ablation study in both the
8

---

Table 5: Comparisons the final performance of the searched network in NAS-Bench-201 and DARTS search space on CIFAR-10. 10. All models are standard trained. Bold and underline stands for the best and second.
Proxy components
MMS-Bench-200
DARTS
Feature
Purameter
Gradient
Clean
CC.
FGSM
HRS
Avg.
Clean
CC.
FGSM
HRS
Avg.
93.30
55.62
44,30
60.08
63.33
94.37
72.26
16.87
28.62
53.03
93.70
56.93
45.80
61.53
64.49
94,99
74.06
16.82
28.58
53.61
93.70
56.93
61.53
64.49
94.30
74.91
16.67
28.33
53.55
93.70
56.93
45.80
61.53
64.49
94.34
74.46
15.71
26.93
52.36
93.70
56.93
45.80
61.53
64.49
94.45
74.63
22.38
36.19
56.91
Our Prozy
Festure Consistenyy
Parsmeter Consistency
Gradient Consetercy
Fully- Trainwt 0.07
Fulyy Trainwr SPC 0.949
Fully 0.337
Fully Trair aediiidd: SPC 0.379
10-Stup Traind: 0.905
10-Stpp Tranned SRC 0.981
10-Swp Trannd: 0.905
10-S Trained: SRC 0.000
Fuly- Fuly- Trarned State
SIIS pourLL dris Or
Fuly- Traa and State
uIn poupLL deis OK
WFIT DONAPALL dRIS OO
Full-
Full-
Singe-Sttpp Trained
Singl--Sepp Tranned State
Singe-SSepp Trained State
Single Trained State
Figure 5: Spearman's 's p in our proxy and each consistency component between the architectures with single-step trained states and two of mally-trained and 10-step trained states, respectively, against clean and perturbed images.
NAS-Bench-200 search space and the DARTS search space. On the NAS-Bench-20 search space, all ablation proxies identified the same candidate architecture except for the feature- based proxy. To compare the ablation proxies thoroughly, we extend our examination to the DARTS search space, which contains a significantly larger number of candidate architectures (e.g.. 1019) compared to the HAS-Bench-205 search space. As shown in Table 5, architecture identified solely by feature consistency exhibits better average performance compared to those discerned by proxies without feature consistency. emphasizing the influential role of feature consistency in evaluating robustness. Notably, the architecture selected by our proxy showcases the highest average performance. This indicates that both parameter and gradient consistency can bolster feature consistency, offering more insight into the learning trajectory, as elaborated in Section 3.3. Overall, considering all components is crucial to evaluate the robustness within single batch.
CRoZe
FOSM
Feature Variance of the Robust Models. Our proxy searches for architectures that can generalize to all types of perturbed inputs, which are not over- fitted to a single type of perturbation, as described in Section 3.1 (Eq. 2). To validate this, we analyzed the feature variance of neural architectures that demon- strated the highest performance against a single type of perturbation, namely FGSM and PGD, compared Figure 4: Feature variance across perturbations. to an architecture selected with the CRoZe proxy from a pool of 300 standard- trained and adversarially- trained models (Figure 4). Features were obtained from 18 different perturbations, including clean, PGD, FGSM, and 15 types of common corruptions. Remarkably, the neural architectures selected with our proxy exhibited the smallest standard deviations between the features obtained from the 18 different perturbations, in both standard and adversarially-traine architecture with the best PGD robustness demonstrated 2.48 times larger variations adversarially- trained scenarios, indicating a higher risk of overfitting to specific perturbations. These results provide compelling evidence of the effectiveness of CRoZe in identifying robust architectures that can consistently extract features and generalize across diverse perturbations.
Feature Variance
0.1699
Festure Variance
0.3447
0.1489
0.1502
0.21
0.1389
Standard-Trained
Advorsarially-Trainee
scenarios. Conversely, the
Assessment of CRoZe Predictiveness. To empirically validate whether our proxy obtained from a random state accurately represents the proxy in the fully-trained model, we conducted an analysis using Spearman's 's p. We randomly sampled 300 architectures from the NAS-Benche A-S-Bench-20) search space and trained them on the entire dataset, using both the full training and reduced training only of 10 steps. The Spearman's 's between the proxy value obtained from a single-step trained state and the 10-step trained state shows a strong correlation of 0.995. Even after full training, the correlation remained high at 0.970 (Figure 5). These suggest that our proxy, derived from estimated surrogate networks, can significantly reduce the computational costs associated with obtaining fully-trained models. Furthermore, each component of CRoZe consistently demonstrates high correlation with

---

the fully-trained states, supporting the notion that the high correlation computed with the final state is not solely a result of the collective influence of components, but rather an accurate estimation.
Validation of CRoZe for Estimating Fully- Trained Neural Architectures. To investi- gate whether the architectures selected with our proxy possess the desired robustness properties discussed in Section 3.1, we conduct an analysis. From a pool of 300 samples in the NAS-Bench- 201 search space, we select top-5 and bottom- 5 architectures based on our proxy, excluding trained states.
1S410"
Fewure Consaoeetty (A7)
Top-5
Sx12
10xl0"
2x10
5H10
1x10
Figure 6: Comparisons of feature consistency in fully-
those with a robust accuracy of less than 20%. We evaluate the performances of these architectures that are handard-trained (ST) and adversarially-trainee (AT) against clean inputs and three distinct
types of perturbed inputs: adversarial perturbations (i.e., FGSM and PGD), and common corruptions.
Notably, the top-5 networks show impressive av- erage clean accuracies of 89.62%, and 84.36% on CIFAR- 10, while the bottom-5 networks achieve significantly lower average clean accu- racies of 61.34%, 51.64% in standard training and adversarial training, respectively (Table 6). Moreover, the top-5 networks exhibit aver- age robust accuracy of 54.95% against perturba- tions, compared only 28.50% for the bottom-5 group. Furthermore, by considering feature con- sistency between clean and perturbed inputs, as defined in Eq. 2, the top-5 group exhibited similar features, whereas the bottom-5 group showed dissimilar features (Figure 6). This supports that architectures with consistent features across inputs are more likely to make accurate predictions under perturbations. Overall, our analysis provides strong evidence that our proxy can search for generaliz- able robust architectures that accurately predict the final accuracies under diverse perturbations.
Standard Trained (ST)
Type
Clean
CC.
PGD
FGSM
Avg. Roh.
Top-5
89.62
77.66
26.09
61.08
54.95
Bottom-5
61.34
49.13
19.35
17.01
28.50
Adversarially- Trained (AT)
Clean
PGD
HRS(PGD)
RUSM
HRS(FUSMM
Top-5
84.36
40.55
54.76
74.34
Botton
51.64
22.59
31,36
37,20
43.04
Table 6: Comparisons of the performance.
5
Conclusion
While neural architecture search (NAS) is a powerful technique for automatically discovering high- performing deep learning models, previous NAS works suffer from two major drawbacks: compu- tational inefficiency and compromised robustness against diverse perturbations, which hinder their applications in real-world scenarios with safety-criticts applications. In this paper, proposed simple yet effective lightweight robust NAS framework that can rapidly search for well-generalized neural architectures against diverse tasks and perturbations. To this end, we proposed novel consistency-ban based zero-cost proxy that evaluates the robustness of randomly initialized neural net- works by measuring the consistency in their features, parameters, and gradients for both clean and perturbed inputs. Experimental results demonstrate the effectiveness of our approach in discovering well-generalized architectures across diverse search spaces, multiple datasets, and various types of perturbations, outperforming the baselines with significantly reduced search costs. Such sim- plicity and effectiveness of our approach open up new possibilities for automatically discovering high-performing models that are well-suited for safety-critical applications.
Acknowledgement
This work was supported by the Institute of Information & communications Technology Planning & Evaluation (IITP) grant funded by the Korea government (MSIT) (No. N0.20020-0-00133,, the National Research Foundation of Korea(NRF) grant funded by the Korea Covernment(MSIT) (No. RS-2023- 00256259), the Institute of Information & communications Technology Planning Evaluation (UITP) grant funded by the Korea (overnment(MSIT) School Program(KAISTT) Center for Applied Research in Artificial Intelligence (CARAI) grant funded by DAPA and ADD (UD19003 IRD), and Google Research Grant and Google Cloud Research We thank Jin Myung Kwak, Eunji Ko,
2--200011-0007550 Artificial Intelligence Graduate
Credits program with the award Yulmu Kim, Sohyun An, and Hayeon Lee for providing helpful feedback and suggestions in preparing an earlier version of the manuscript. We also thank the anonymous reviewers for their insightful comments and suggestions.
10

---

References
[1] Mohamed S Abdelfattah, Abhinav Mehrotra, Lukasz Dudziak, and Nicholas D Lane. Zero-cost proxies for lightweight nas. International Conference Learning Representations, 2021.
[2] Bowen Baker, Otkrist Gupta, Nikhil Naik, and Ramesh Raskar. Designing neural network archi- tectures using reinforcement learning. In International Conference on Learning Representations, 2017.
[3] Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Šmniić, Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. In Joint European conference machine learning and knowledge discovery in databases, pages 387-402. Springer, 2013.
[4] Han Cai, Chuang Gan, Tianzhe Wang, Zhekai Zhang, and Song Han. Once-for-all: Train one network and specialize it for efficient deployment. International Conference on Learning Representations, 2019.
[5] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks, In IEEE symposium on security and privacy (sp), pages 39-57. IEEE, 2017.
[6] Xiangning Chen, Ruochen Wang, Minhao Cheng, Xiaocheng Tang, and Cho-Jui Hsieh. Drnas: Dirichlet neural architecture search. arXiv preprint arXiv:2006. 10355, 2020.
[7] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free free attacks. In ICML, pages 2206-2216. PMLR, 2020.
[8] Ekin D Cubuk, Barret Zoph, Jonathon Shlens, and Quoc V Le. Randaugment: Practical automated data augmentation with a reduced search space. In Advances Neural Information Processing Systems, 2020.
[9] Chaitanya Devaguptapu. Devansh Agarwal, Gaurav Mittal, Pulkit Gopalani, and Vineeth N Balasubramaniaa. On adversarial robustness: A neural architecture search perspective. In IEEE International Conference on Computer Vision, pages 152-161, 2021.
[10] Samuel Dodge and Lina Karam. A study and comparison of human and deep learning recogni- tion performance under visual distortions. In 20/7 26th international conference on computer communication and networks (ICCCN), pages 1-7. IEEE, 2017.
[11] Peijie Dong, Lujun Li, and Zimian Wei. Diswot: Student architecture search for distillation without training. IEEE Conference on Computer Vision and Pattern Recognition, 2023.
[12] Xuanyi Dong and Yi Yang. Searching for robust neural architecture in four gpu hours. In IEEE Conference on Computer Vision and Pattern Recognition, pages 1761-1770, 2019.
[13] Thomas Elsken, Jan Hendrik Metzen, and Frank Hutter. Efficient multi-objective neural archi- tecture search via lamarckian evolution. International Conference on Learning Representations, 2019.
[14] Pierre Foret, Ariel Kleiner, Hossein Mobahi, and Behnam Neyshabur. Sharpness-aware min- imization for efficiently improving generalization. In International Conference on Learning Representations, 2021.
[15] Xavier Glorot and Yoshua Bengio. Understanding the difficulty of training deep feedfor- ward neural networks. In Proceedings of the thirteenth international conference artificial intelligence and statistics, pages 249-256, JMLR Workshop and Conference Proceedings. 2010.
[16] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples. In International Conference on Learning Representations, 2015.
[17] Martin Gubri, Maxime Cordy, Mike Papadakis, Yves Le Traon, and Koushik Sen. Lgv: Boosting adversarial example transferability from large geometric vicinity. In ECCV, pages 603-618. Springer, 2022.
11

---

[18] Minghao Guo, Yuzhe Yang, Rui Xu, Ziwei Liu, and Dahua Lin. When nas meets robustness: In search of robust architectures against adversarial attacks. IEEE Conference on Computer Vision and Pattern Recognition, 2020.
[19] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Delving deep into rectifiers: Surpassing buman-level performance on imagenet classification, In Proceedings of the IEEE international conference computer vision, pages 1036-1034, 2015.
[20] Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. International Conference on Learning Representations, 2019.
[21] Dan Hendrycks, Norman Mu, Ekin D Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshmi- narayanan. Augmix: A simple data processing method improve robustness and uncertainty. International Conference on Learning Representations, 2020.
[22] Steffen Jung, Jovita Lukasik, and Margret Keuper.
Neural architecture design and robustness: dataset. In International Conference on Learming Representations, 2023.
[23] Namhoon Lee, Thalaiyasingam Ajanthan, and Philip HS Torr. Snip: Single-shot network pruning based connection sensitivity. International Conference on Learning Representations, 2019.
[24] Chenxi Liu, Barret Zoph, Maxim Neumann, Jonathon Shlens, Wei Hua, Li-Jia Li, Li Fei-Fei, Alan Yuille, Jonathan Huang, and Kevin Murphy. Progressive neural architecture search. In European Conference on Computer Vision, pages 19-34, 2018.
[25] Hanxiao Liu, Karen Simonyan, Oriol Vinyals, Chrisantha Fernando, and Koray Kavukcuoglu. Hierarchical representations for efficient architecture search. In International Conference on Learning Representations, 2018.
[26] Hanxiao Liu, Karen Simonyan, and Yiming Yang. Darts: Differentiable architecture search. International Conference on Learning Representations, 2019.
[27] Liyang Liu, Shilong Zhang, Zhanghui Kuang, Aojun Zhou, Jing-Hao Xue, Xinjiang Wang, Yimin Chen, Wenming Yang, Qingmin Liao, and Wayne Zhang. Group fisher pruning for practical network compression. In ICML, pages 7021-7032. PMLR, 2021.
(28) Rengian Luo, Fei Tian, Tao Qin, Enhong Chen, and Tie- Yan Liu. Neural architecture optimiza- tion. Advances in Neural Information Processing Systems, 31, 2018
[29] Aleksander Madry, Alcksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference Learning Representations, 2018
[30] Joe Mellor, Jack Turner, Amos Storkey, and Elliot J Crowley. Neural architecture search without training. In International Conference on Machine Learning, pages 7588-7598. PMLR, 2021.
[31] Jisoo Mok, Byunggook Na, Hyeokjun Choe, and Sungroh Yoon. Advrush: Searching for adversarially robust neural architectures. In IEEE Conference on Computer Vision and Pattern Recognition, pages 12322- 12332,, 2021.
[32] Seyed-Mohsen Moosavi- DDzoio,,e,ool, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference computer vision and pattern recognition, pages 2574-2582, 2016.
[33] Hieu Pham, Melody Guan, Barret Zoph, Quoe Le, and Jeff Dean. Efficient neural architecture search via parameters sharing. In International Conference Machine Learning, pages 4095-4104. PMLR, 2018
[34] Esteban Real, Sherry Moore, Andrew Selle, Saurabh Saxena, Yutaka Leon Suematsu, Jie Tan, Quoe Le, and Alexey Kurakin. Large-scale evolution of image classifiers. In ICML, 2017.
[35] Esteban Real, Alok Aggarwal, Yanping Huang, and Quoe Le. Regularized evolution for image classifier architecture search. In AAAI Conference on Artificial Intelligence, 2019.
12

---

[36] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, lan Good- fellow, and Rob Fergus. Intriguing properties of neural networks. International Conference on Learning Representations, 2014.
[37] Hidenori Tanaka, Daniel Kunin, Daniel L Yamins, and Surya Ganguli. Pruning neural networks without any data by iteratively conserving synaptic flow. Advances in Neural Information Processing Systems, 33:6377-6338 2020.
[38] Jonathan Uesato, Brendan O D'donoghue, Pushmeet Kohli, and Aaron Oord. Adversarial risk and the dangers of evaluating against weak attacks. In ICML, pages 5025-5034. PMLR, 2018.
[39] Chaoqi Wang, Guodong Zhang, and Roger Grosse. Picking winning tickets before training by preserving gradient flow. International Conference on Learning Representations, 2020.
[40] Eric Wong, Leslie Rice, and 7ico Kolter. Fast better than free: Revisiting adversarial training. arXiv preprint arXiv:2001.0333 2020.
[41] Dongxian Wu, Shu-Tac Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin, editors, Advances in Neural Information Processing Systems, 2020.
[42] Yuhui Xu, Lingxi Xie, Xiaopeng Zhang, Xin Chen, Guo-Jun Qi, Qi Tian, and Hongkai Xiong. Pe-darts: Partial channel connections for memory-efficient architecture search. International Conference Learning Representations, 2020.
[43] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P Xing, Laurent Ghaoui, and Michael I Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning, 2019.
[44] Zhao Zhong, Junjie Yan, Wei Wu, Jing Shao, and Cheng-Lin Liu. Practical block-wise neural network architecture generation. In IEEE Conference Computer Vision and Pattern Recognition, pages 2423-2432, 2018.
[45] Barret Zoph and Quoc V Le. Neural architecture search with reinforcement learning. Interna- tional Conference Learning Representations, 2017.
[46] Barret Zoph, Vijay Vasudevan, Jonathon Shlens, and Quoe V. Le. Learning transferable architectures for scalable image recognition. In IEEE Conference on Computer Vision and Pattern Recognition, 2018.
13


Reviews:
[{"review_id": "1N9eVTiPek", "reviewer": "Reviewer_m6P2", "summary": "This work introduces a lightweight proxy, CRoZe, designed to facilitate the development of Neural Architecture Search (NAS) based architectures that are robust across a diverse set of semantic-preserving perturbations. CRoZe operates by measuring consistency across the features, parameters, and gradients for a given clean image and its perturbed counterpart. This approach enables it to withstand a wide range of perturbations, unlike existing methods that focus on a specific set of perturbations (adversarial or Out-of-Distribution samples). Experimental results demonstrate that the proposed proxy can rapidly and efficiently search for neural architectures that exhibit consistent robustness against various perturbations across multiple benchmark datasets (CIFAR-10, CIFAR-100, ImageNet16-120) and diverse search spaces (NAS Bench201, DARTS). This performance significantly surpasses that of existing clean zero-shot NAS and robust NAS methods, all while reducing search costs.", "questions": "1. How does the proposed method perform when confronted with novel types of perturbations that were not considered during the architecture search? Is there a mechanism to make the method more adaptive to new perturbations? (This question is related to Weakness 1)\n2.  Is there a specific reason for choosing a relatively older search space like DARTS, especially when there are more recent search spaces available? (Please refer to NAS Bench  [NAS Bench](https://www.automl.org/nas-overview/nasbench/), [$A^{3}D$: A Platform of Searching for Robust Neural Architectures and  Efficient Adversarial Attacks](https://arxiv.org/pdf/2203.03128))\n3. Comparison with robust ensemble-based methods: Ensemble-based methods in NAS are often known to be more robust. Does the proposed proxy support ensemble-based approaches?", "limitations": "Limitation and Broader impact are discussed in the supplementary", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "* The focus on developing architectures that are robust against a *diverse range of perturbations* is novel and has not been studied earlier, presenting a wide range of potential applications.\n* The problem setting is well-motivated and effectively approached, with the introduction setting the context particularly well.\n* The experimental setup is solid, employing two benchmarks and three datasets.", "weaknesses": "* The choice of adversarial attacks -- FGSM and PGD -- seems somewhat outdated from the perspective of adversarial attacks. It would be beneficial to understand how the proposed method would perform with more recent adversarial attack methods such as  [LGV](https://arxiv.org/abs/2207.13129), [SPSA](https://arxiv.org/abs/1802.05666) etc. \n* The same concern applies to the set of experiments where adversarial training is used. The choice of $L_\\infty$ PGD attacks may not be very contemporary, and exploring more recent approaches could enhance the paper's relevance and applicability.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**W1. Evaluation against recent adversarial attacks is needed (i.e., LGV, SPSA).**\n* Thanks for your comment, we provide additional experimental results on recent adversarial attacks such as CW, DeepFool, SPSA, LGV, and AutoAttack by evaluating Spearman’s rank correlation on the NAS-Bench-201 search space where each candidate architecture is adversarially trained with PGD-7 on CIFAR-10. \n* For evaluation, we employ CW and DeepFool attack with 50 steps, SPSA with  $\\epsilon$=8/255 and a single iteration, LGV with $\\epsilon$=4/255, $\\alpha$=4/255/10, and 10 steps, and AutoAttack with $\\epsilon$=8/255. \n* As evidenced by the correlation in the ‘Avg.’ column, our proxy consistently **shows the highest overall correlation of 0.399 for robust accuracies** even against recent adversarial attacks, while the best baseline (GradNorm) only achieves 0.352. This suggests that our proxy is capable of identifying neural architectures that are robust against a wide range of adversarial attacks. (Detailed table can be found in Table R1 in PDF)\n|Proxy Type|CW|DeepFool|SPSA|LGV|AutoAttack|Avg.| \n|-|-|-|-|-|-|-|\n|GradNorm|**0.264**|0.421|0.149|0.401|0.405|0.352|\n|NASWOT|0.240|0.250|0.197|0.265|0.283|0.271|\n|CRoZe|0.220|**0.454**|**0.240**|**0.449**|**0.458**|**0.399** |\n\n------------------\n\n**W2. The choice of PGD attacks may not be very contemporary.**\n* The main reason for using adversarial training is that it is the most straightforward way to attain a robust model for a reliable robust evaluation. To address your concern, we additionally provide the experimental results on the NAS-Bench-201 search space (our response to W1, **Table R1**) and the DARTS search space on CIFAR-10, presented in **Table R2** in the PDF file. We assess the robustness of the architectures identified by each method against recent adversarial attacks, including CW, DeepFool, LGV, SPSA, and AutoAttack. Our proxy underscores its ability to discover neural architectures demonstrating **the highest average robustness of 55.77% against various attacks with 15 times less search cost** compared to AdvRush. (Detailed table can be found in Table R2 in PDF)\n||Type|Search Cost (GPU sec)|Avg. Rob.| \n|-|-|-|-|\n|DrNAS|Clean one-shot|46857|55.60|\n|AdvRush|Robust one-shot|251245|55.57|\n|GradNorm|Clean zero-shot|9740|51.61|\n|SynFlow|Clean zero-shot|10138|52.96|\n|CRoZe|Robust zero-shot|17066|**55.77**|\n\n-------------\n\n**Q1. How does the CRoZe perform against novel types of perturbations?**\n* Experimental results against novel attacks can be found in response to W1, W2.\n* Our theoretical insight is derived from that a robust model can learn invariant features with respect to clean and perturbed images regardless of the type of perturbations applied to input [1,2,3]. On top of this motivation, our proxy mainly focuses on the consistency of features, parameters, and gradients between clean and perturbed inputs without targeting a specific type of perturbation for assessing the robustness of the given neural architecture. \n* Due to properties not limited by perturbation types, our proxy works well with any kind of perturbed inputs such as Gaussian Noise or adversarial examples (Table 4). Furthermore, our proxy demonstrates the ability to handle novel types of perturbation not considered during the search (Table 1,2).\n\n[1]Xia et al., Feature Denoising for Improving Adversarial Robustness, CVPR 2019\\\n[2]Ilyas et al., Adversarial Examples Are Not Bugs, They Are Features, NeurIPS 2019 \\\n[3]Goodfellow et al., Explaining and Harnessing Adversarial Examples, ICLR 2015\n\n------------\n**Q2. Is there a reason for choosing an older search space like DARTS?**\n* We choose the DARTS search space because 1) for a fair comparison with prior works [1,2] and 2) it is the largest search space for image classification tasks as shown in the following table. Besides, please note that we also conducted experiments on NASBench-201 in Table 1, and 2.\n|Benchmark|NAS-Bench-101|NAS-Bench-201|NAS-Bench-301|NAS-Bench-Macro|DARTS| \n|-|-|-|-|-|-|\n|Size|423k|6k | $10^{18}$ |6k| $10^{18}$ |\n* Furthermore, the search spaces (NASBench) that you have mentioned are, in fact, encapsulated within NAS-Bench-101, NAS-Bench-201, and NAS-Bench-301, differing only in their use of metrics for neural architectures outside of validation accuracy. In NAS-Bench-301, each neural architecture is defined with the configuration of the DARTS search space which eventually aligns with the DARTS search space. In addition, the $A^3$D search space is a subset of the DARTS search space with fewer operation choices, so compared to $A^3$D, we employ a wider range of operations, including sep_con_7x7 and dil_con_7x7.\n\n[1]Chen et al., DrNAS: Dirichlet Neural Architecture Search, ICLR 2021\\\n[2]Mok et al., AdvRush: Searching for Adversarially Robust Neural Architectures, ICCV 2021\n\n------------\n**Q3. Comparison with robust ensemble-based methods.**\n* If we understand correctly, we assume that you might be referring to [1], which is able to orthogonally use in our approach. We have carried out additional experiments with ensemble-based NAS. We estimate the robustness by ensembling zero-cost proxies on the NAS-Bench-201 search space across CIFAR-10, CIFAR-100, and ImageNet16-120. As depicted in Table, our proxy exhibits an improved correlation. This suggests that the robust evaluation for given neural architectures can be significantly enhanced by ensemble integration with our proxy. (Detailed table can be found in Table R6 in PDF)\n| |CIFAR-10||||CIFAR-100||||ImageNet16-120|||\n|-|-|-|-|-|-|-|-|-|-|-|-|\n||Clean|FGSM|PGD|CC|Clean|FGSM|PGD|CC|Clean|FGSM|PGD|\n|CRoZe|0.823|0.826|0.188|0.719|0.784|0.786|0.343|0.765|0.765|0.596|**0.707**| \n|Ensemble|0.803|0.681|0.543|0.771|0.793|0.739|**0.444**|0.798|0.749|0.638|0.296|\n|CRoZe+Ensemble|**0.894**|**0.872**|**0.633**|**0.894**|**0.894**|**0.851**|0.415|**0.878**|**0.810**|**0.688**|0.259|\n\n[1]Adelfattah et al., Zero-Cost Proxies for Lightweight NAS, ICLR 2021"}, {"review_id": "C0LgGta6r6", "reviewer": "Reviewer_DQhw", "summary": "This work proposes a new zero-shot proxy to find robust NN architecture at initialization. The proxy utilizes the consistency of model features and gradients for clean and perturbed input. Experiments are conducted on robust NAS benchmarks. Performance is also provided for end-to-end NAS on DARTS search space.", "questions": "See weakness.", "limitations": "The work is limited in theoretical insights of the proposed method. No potential negative socal impact is observed.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This work provides a novel and effective proxy for the search of robust NN model\n2. The proposed method is well formulated and easy to follow\n3. Results are provided on both NASBench and end-to-end search to show the effectiveness of the proposed method", "weaknesses": "1. The theortical insight behind the proposed consistency score is unclear. As the score is only computed at the initialization of the model, it is unclear whether the proposed score is consistent for different random weight initialization, and if its correlation to the model robustness is affected by different adversarial training methods. More theortical analysis or ablation studies are needed to answer these questions\n2. End-to-end NAS performance is an important metric to show the true effectiveness of the proposed method. However, in Tab.3 the results are limited to clean training and robustness against FGSM perturbation only. More final performance results with adversarial training and different types of perturbation is needed to verify the contribution.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**W1. The theoretical insight is unclear and the ablation experiments on different weight initialization methods and adversarial training methods are needed.**\n\n- The underlying theoretical insight of our proxy is premised on the notion that **a robust model should learn invariant useful features with respect to the clean and perturbed images [1,2,8,9]**. Based on this theoretical insight, we propose to design the proxy to measure the similarity of features, gradients, and parameters between the clean and perturbed inputs. \n- In response to your concerns regarding the compatibility of our proxy with various weight initialization methods, we conducted additional experiments with **Random initialization, Kaiming initialization [5], and Xavier initialization [6]** on the NAS-Bench-201 search space on CIFAR-10 in **Table R3 in the PDF file**.  As demonstrated, **our proxy maintains a consistently higher correlation** compared to the baselines, **irrespective of the weight initialization methods employed**. Specifically, our proxy shows the highest average correlation of **0.568 and 0.399 for standard training and adversarial training scenario, respectively, while the best baseline only achieves 0.529 and 0.352** against diverse perturbations with the same random weight initialization. Since our approach considers the similarity vector of the parameters and gradients between the clean and perturbed image, Our superior performance can be achieved regardless of the initialization method. (*Detailed table with more baselines can be found in Table R1 and R3 in the PDF*)\n| |Standard-Trained| | | | |Adversarially-Trained| | | | | | | | |\n|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|\n| |Clean|FGSM|PGD|CC|Avg.|FGSM|PGD|CW|DeepFool|SPSA|LGV|AutoAttack|Avg.|\n|FLOPs|0.726|0.753|0.183|0.384|0.512|0.357|0.446|0.189|0.364|0.196|0.347|0.365|0.323|\n|SynFlow|0.777|0.778|0.163|0.396|0.529|0.369|0.442|0.202|0.397|0.196|0.387|0.383|0.339|\n|GradNorm|0.638|0.750|0.259|0.383|0.508|0.378|0.446|0.264|0.421|0.149|0.401|0.405|0.352|\n|NASWOT|0.660|0.511|-0.280|0.206|0.274|0.311|0.354|0.240|0.250|0.197|0.265|0.280|0.271|\n|CRoZe(Random)|0.823|0.826|0.188|0.436|**0.568**|0.441|0.532|0.220|0.454|0.240|0.449|0.458|**0.399**|\n|CRoZe(Kaiming)|0.812|0.818|0.189|0.430|0.562|0.428|0.512|0.217|0.443|0.227|0.426|0.436|0.384|\n|CRoZe(Xavier)|0.816|0.822|0.190|0.433|0.565|0.428|0.513|0.217|0.442|0.227|0.425|0.436|0.384|\n\n- With regard to adversarial training, unfortunately, **no benchmark datasets currently exist that contain robust accuracy of models that are trained with diverse adversarial training methodologies**, such as AT [3] and TRADES [4]. Therefore, it is challenging to illustrate dependencies on the type of adversarial training methods. However, based on the RobustBench [7], we can presume **different adversarial training methods may not affect the correlations** because the rank of performance holds even in diverse types of architectures (WideResNet 70-16, WideResNet 34-10, and ResNet18). Additionally, the performance ranking between our method and zero-cost proxy baselines remains consistent across different adversarial training types [3, 4], as shown in the following table.\n|Proxy Type|Adversarial Training Type|Clean|PGD-20|Rank|\n|-|:-:|:-:|:-:|:-:|\n|GradNorm|[3]|81.61|49.86|2|\n| |[4]|72.43|44.84|2|\n|SynFlow|[3]|77.08|45.95|3|\n| |[4]|59.87|36.07|3|\n|CRoZe|[3]|85.05|52.04|1|\n| |[4]|79.48|51.89|1|\n\n[1] Xia et al., Feature Denoising for Improving Adversarial Robustness, CVPR 2019 \\\n[2] Ilyas et al., Adversarial Examples Are Not Bugs, They Are Features, NeurIPS 2019 \\\n[3] Madry et al., Towards Deep Learning Models Resistant to Adversarial Attacks, ICLR 2018 \\\n[4] Zhang et al., Theoretically Principled Trade-off between Robustness and Accuracy, ICML 2019 \\\n[5] He et al., Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classification, IEEE 2015 \\\n[6] Glorot et al., Understanding the difficulty of training deep feedforward neural networks, JMLR 2010 \\\n[7] Croce et al.,  RobustBench: a standardized adversarial robustness benchmark, NeurIPS 2021 \\\n[8] Goodfellow et al., Explaining and Harnessing Adversarial Examples, ICLR 2015 \\\n[9] Zhang et al., Understanding deep learning requires rethinking generalization, ICLR 2017\n\n----------\n\n**W2. End-to-end performance is limited to clean training and robustness against FGSM attack.**\n\n- We appreciate your thoughtful response. In light of your comments, we have included additional experimental results that demonstrate the end-to-end NAS performance within the DARTS search space, where the searched architectures are **adversarially trained on CIFAR-10** following [1] and are subsequently evaluated against diverse perturbations including **PGD, CW, SPSA, LGV, and AutoAttack in Table R2 in the PDF file**. Our proxy, as substantiated by the results, shows **superior robustness, averaging robustness of 55.77%** against diverse perturbations, even with **15 times more efficient search cost** compared to the existing Robust NAS method (AdvRush). (*Detailed table can be found in Table R2 and Figure R1 in the PDF*)\n|NAS Type|Method|Clean|PGD-20|CW|SPSA|LGV|AutoAttack|Rob. Avg.|Search Cost (GPU sec)| \n|-|-|-|-|-|-|-|-|-|-|\n|Clean one-shot|DrNAS|86.45|54.66|11.39|85.73|79.82|52.40|55.60|46857|\n|Robust one-shot|AdvRush|85.98|53.89|6.68|80.85|79.61|51.88|55.57|251245|\n|Clean zero-shot|GradNorm|81.61|49.86|12.02|77.19|73.27|46.69|51.61|9740|\n|Clean zero-shot|SynFlow|77.08|45.95|26.50|75.78|74.14|42.45|52.96|10138|\n|Robust zero-shot|CRoZe|85.05|52.04|16.82|83.23|77.62|49.15|**55.77**|17066|\n\n[1] Madry et al., Towards Deep Learning Models Resistant to Adversarial Attacks, ICLR 2018 \n\n---------------------------------------------------\n**Limitation. No potential negative social impact is observed.**\n- Since our approach does not bring any potential negative social impact, we neglect it as mentioned in the Neurips 2023 Author policy.\n\n\n\n\n"}, {"review_id": "MuonTAoOjS", "reviewer": "Reviewer_41nW", "summary": "The paper proposes a lightweight approach to generate new architectures with robustness formulated in the NAS process. \nThe paper claims that the proposed method is capable of generating architectures that can learn generalized features with higher robustness.", "questions": "The main question is whether it is possible to provide a more comprehensive evaluation to show the effectiveness of the proposed method.", "limitations": "Based on the current experimental results it seems the effectiveness of the proposed method is very limited", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "Efficient algorithms for generating robust architectures are an important topic in NAS field and the paper focuses on an important topic. \nThe proposed method is simple but effective based on the experimental results.", "weaknesses": "While I like the approach I think the experimental results are limited to show the effectiveness of the proposed method properly. \n1- Most of the experiments are based on the FGSM and as mentioned in the paper it is considered as the worst adversarial attack currently. \n2- I can see one experiment on PGD in the paper but it is very limited. \n3- I was hoping to see some comparison with the well-known human-made architectures (like ResNet) for both clean and robust accuracy.\n4-  Having more comprehensive experiments on more SOTA adversarial attacks like AutoAttack would help to show the effectiveness of the proposed method better.\n5- It has been claimed that the proposed method is \"Generalized to Diverse Perturbations\" but I think there is not enough evidence and more experiments should have been done to make it justice.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**W1, 2. Experimental results are limited to FGSM and PGD.**\n- First, we would like to clarify that we report experimental results on three types of perturbations, including **FGSM, PGD, and 16 types of common corruption (Table 1, 2, 3)**. However, following your suggestion, we further provide additional experimental results against a wide range of recent adversarial attacks, including **CW, DeepFool, SPSA, LGV, and AutoAttack** on the NAS-Bench-201 search space in **Table R1 in the PDF file**. Specifically, for the accurate evaluation of the robust accuracy, we adversarially train each candidate architecture in the NAS-Bench-201 search space on CIFAR-10 following the protocol from [3]. Then, we subsequently evaluate the robustness of those models against diverse adversarial attacks. \n- **Our proxy shows the highest overall correlation of 0.399 for robust accuracies** while the best baseline (GradNorm) achieves 0.352, which demonstrates that our proxy can rapidly search for a neural architecture capable of learning robust features against diverse attacks. (*Detailed table can be found in Table R1 in PDF*)\n|Proxy Type|FGSM|PGD|CW|DeepFool|SPSA|LGV|AutoAttack|Avg.| \n|-|-|-|-|-|-|-|-|-|\n|FLOPs|0.357|0.446|0.189|0.364|0.196|0.347|0.365|0.323|\n|GradNorm|0.378|0.446|**0.264**|0.421|0.149|0.401|0.405|0.352|\n|NASWOT|0.311|0.354|0.240|0.250|0.197|0.265|0.280|0.271|\n|CRoZe|**0.441**|**0.532**|0.220|**0.454**|**0.240**|**0.449**|**0.458**|**0.399**|\n\n------------\n**W3. Comparison with human-made architecture is needed.**\n- Following your valuable suggestion, we additionally provide comparisons with well-known human-made architectures with **similar parameter sizes, such as Conv4, Conv6, MobileNetV2, and ResNet12**. The neural architectures identified by our proxy even show **better clean and robust accuracy with fewer parameters than ResNet12**. \n- Specifically, our method achieves **2.11% and 2.35% higher clean and robust accuracies (PGD-20) with 2.48MB fewer parameters compared to ResNet12**. All models are adversarially trained following the conventional protocol [1] on CIFAR-10 and evaluated against PGD [1]. (*Detailed table can be found in Table R4 in PDF*)\n| | # Params (MB)|Clean|PGD-20|HRS|\n|-|-|-|-|-|\n|Conv4|0.03|60.12|29.98|40.01|\n|Conv6|0.05|65.92|33.04|44.02|\n|MobileNetV2|2.24|66.04|33.04|46.79|\n|ResNet12|8.00|82.94|49.69|62.15|\n|CRoZe|5.52|**85.05**|**52.04**|**64.57**|\n\n----------\n**W4. Experimental results against AutoAttack would be helpful to demonstrate its effectiveness.**\n- We evaluated against SOTA adversarial attacks, including **AutoAttack, SPSA, LGV, DeepFool, and CW in Table R2 and Figure R1 in the PDF file**.  All architecture searched by each method on DARTS search space is adversarially trained following [1] on CIFAR-10. \n- Architecture that is identified by our proxy shows **the highest average robust accuracy of 55.77%** against various adversarial perturbations, even with **15 times more efficient search cost** compared to the AdvRush. \n|NAS Type|Method|Clean|PGD-20|CW|SPSA|LGV|AutoAttack|Avg. Rob.|Search Cost (GPU sec)|\n|-|-|-|-|-|-|-|-|-|-|\n|Clean one-shot|DrNAS|86.45|54.66|11.39|85.73|79.82|52.40|55.60|46857|\n|Robust one-shot|AdvRush|85.98|53.89|6.68|80.85|79.61|51.88|55.57|251245|\n|Clean zero-shot|GradNorm|81.61|49.86|12.02|77.19|73.27|46.69|51.61|9740|\n|Clean zero-shot|SynFlow|77.08|45.95|26.50|75.78|74.14|42.45|52.96|10138|\n|Robust zero-shot|CRoZe|85.05|52.04|16.82|83.23|77.62|49.15|**55.77**|17066|\n\n-----------------------------------\n**W5. Not enough evidence for claim of \"Generalized to Diverse Perturbations\".**\n- We clarify that our model demonstrates its ability to generalize to **7 types of adversarial attacks (Table R1, R2 in the PDF file) and 16 types of common corruption perturbations (Table 1, 2) with diverse search space**. Especially, simple version of the results of Spearman's rank correlation evaluation with adversarially-trained NAS-Bench-201search space against recent adversarial attacks (Table R1) is presented in the below. \n- Therefore, we believe our approach is effective in searching for neural architecture that is capable of learning generalizable robust features against diverse perturbations. \n- Through extensive experiments on NAS-Bench-201 and DARTS search space against a wide range of perturbations in both standard (Table 1,2) and adversarial (Table 1, R1, R2) training settings, we validate our approach, as noted by reviewer m6P2.\n|Proxy Type|CW|DeepFool|SPSA|LGV|AutoAttack|Avg.| \n|-|-|-|-|-|-|-|\n|GradNorm|**0.264**|0.421|0.149|0.401|0.405|0.352|\n|NASWOT|0.240|0.250|0.197|0.265|0.283|0.271|\n|CRoZe|0.220|**0.454**|**0.240**|**0.449**|**0.458**|**0.399** |\n\n-----------------------------------\n**Question/Limitation. A more comprehensive evaluation is necessary to validate the effectiveness of the approach.**\n- Thanks to your suggestions, in addition to FGSM, PGD, and common corruption (Table 1,2,3), we further conducted experiments on a wide range of attacks including **CW, DeepFool, SPSA, LGV, and AutoAttack** on NAS-Bench-201 search space (Table R1) and DARTS search space (Table R2). \n- Moreover, we demonstrate that our proxy can rapidly search for neural architectures capable of learning generalizable representations against diverse perturbations in both standard (Table 1 left, 3,2) and adversarial settings (Table 1 right, R1, R2). \n\nWe strongly believe that these additional experimental results show the clear effectiveness of our method against a diverse set of attacks, which further strengthens our work and its potential practical impact. \n\nThank you for the valuable suggestion. \n\n[1] Madry et al., Towards Deep Learning Models Resistant to Adversarial Attacks, ICLR 2018 \\\n[2] Croce et al., Reliable Evaluation of Adversarial Robustness with an Ensemble of Diverse Parameter-free Attacks, ICML 2020\\\n[3] Wong et al., Fast is better than free: Revisiting adversarial training, ICLR 2020\n"}, {"review_id": "RHJi7RT4FH", "reviewer": "Reviewer_KEHv", "summary": "The paper concerns the automatic generation of architectures that are robust to diverse perturbations. Neural architecture search (NAS) has been used for the automatic generation of such architectures, but the paper notes that most of those architectures are dedicated to the clean accuracy, which leaves the resulting architectures unprotected against (adversarial) perturbations. One of the reasons that the previous works have focused on clean accuracy is that making the architecture robust to perturbations is costlier and results in methods that are computationally heavy. This is precisely the gap the paper intends to fill by proposing a lightweight way to obtain robust architectures. Concretely, it considers a \"zero-cost proxy\" that considers the consistency across features, parameters and gradients of clean/perturbed images. The exact heuristic, called croze, is provided in eq. 10 and accounts for the aforementioned consistency across features, parameters and gradients. The method is empirically validated in small scale datasets of cifar10, cifar100 and imagenet16. \n\n\n**Update**: I am thankful to the authors for their answers. I strongly believe that the discussion and points below should be included in the camera-ready version, along with the results on accuracy. Practitioners care about the accuracy in both clean and robust accuracy and this is the metric that should be compared with standard benchmarks. In addition, the insights reported during the rebuttal period might be interesting to the reader, therefore I would urge the authors to include the relevant insights in the paper.", "questions": "The paper mentions that previous NAS approaches paid less attention to robustness. \"This can result in [...] limiting the practical deployment of NAS in real-world safety-critical applications\". There are no citations or references about such safety-critical applications for NAS, so I am wondering what those applications are. \n\nThe paper claims that \"to have a correct prediction on the perturbed input x', the model needs to extract similar features between x' and x\". Is there any proof that this is a necessary condition? Otherwise, I find this a strong claim that is nontrivial to me. In addition, I am wondering whether eq. 2 is a sufficient condition and whether there is a reference for this, or what the norm is. \n\nIn sec. 3.3 there are a number of unclear claims to me. Firstly, why should the features from two different functions $f_{\\theta}$ and $f_{\\theta^r}$ be similar? Secondly, what is the $z_m$ in eq. 5? Is it the output of $e_{\\psi}$ from sec. 3.1? Thirdly, in high-dimensions, aren't the features very likely to be (near) orthogonal? So, I am not sure what the eq. 5 can capture in realistic networks that have representations of thousands or millions dimensions. \n\nThe paper mentions that \"Accordingly, since the higher similarity of single-step updated parameters may promote the model to converge to an identical or similar parameter space for both tasks, we evaluate the parameter similarity as one of our proxy terms as follows:\". I am wondering what the last part, i.e. proxy term, means in this context. How does this proxy term mitigate the drawback mentioned in the previous sentence? \n\nAs I understand, the final cost is the one in eq. 10, but I am wondering why the multiplication is selected for this. Is there any intuition for this? \n\nThe reference [17] mentioned as a benchmark is only evaluating the robustness at test-time, right? The architectures are trained with clean training. \n\nWhat is the 0.747 in the number of parameters (e.g. in table 1)? Is this million parameters? This is not clear to me.", "limitations": "The limitations are mentioned in the supplementary. The text \"while existing NAS frameworks require enlarged computational resources when utilizing larger datasets such as ImageNet, our method requires constant computational resources that are unaffected by the specific tasks\" mentions ImageNet, but this paper does not do search on ImageNet.", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "NAS is an important way to discover new architectures and as such I believe the paper is relevant to the community. In addition, the paper proposes a method to obtain robust architectures, which is a topic of intense research in the ML community. In addition, I find the figures 1,2 quite clear in the message they want to convey. Having said that, the paper raises a lot of questions and could be improved (see below).", "weaknesses": "The paper is not entirely clear in a number of paragraphs and legends. For instance, in fig. 2 the CC Accuracy and HRS accuracy are not referred to in the introduction, so they leave the reader searching or wondering about them. In addition, the related work with respect to train-free NAS is slightly outdated and more methods do mitigate the issue the paper raises, i.e. the computational cost. For instance, the papers [1-3] are directly relevant. It is also recommended to include those in the related experimental validation. \n\nWhat is more, I find the experimental validation slightly unusual, since typically in recognition we are interested in the clean/robust accuracy, especially when comparing with other methods. \n\nMinor: The paper would benefit from proofreading since there are several mistakes or phrases that are unclear. For instance, \"the gradients similarity as an evaluating\", \"poorer correlations\" (line 263), \"using a less number of sampled words\". \n\n\n[1] NASI: Label- and Data-agnostic Neural Architecture Search at Initialization, ICLR’22.\n\n[2] Knas: Green neural architecture search, ICML’21. \n\n[3] Generalization Properties of NAS under Activation and Skip Connection Search, NeurIPS’22.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**W1. A number of paragraphs and legends are not clear.**\n* We will clarify that CC refers to the Common Corruption dataset, and HRS accuracy stands for Harmonic Robust Score, which is the harmonic average of clean and robust accuracy in the paper, and change the names accordingly. \n---\n**W2. Prior train-free NAS works are outdated. NASI, Knas, and Eigen-NAS should be included.**\n* We will include NASI, KNAS, and Eigen-NAS in the related work. Moreover, **in Table R5 of the PDF, we verified the effectiveness of our proxy** in identifying the robust architecture compared to those works. CRoZe **exhibits consistently the highest clean and robust accuracies** on CIFAR10 and CIFAR100 compared to recent train-free NAS works, **outperforming the best baseline (KNAS) by 0.32% and 4.26%** for clean and average robust accuracies on CIFAR10.\n---\n**W3. Experimental validation seems unusual.**\n* Our approach aims to seek an architecture that performs well on both clean and perturbed inputs. Thus, we validate our proxy by measuring the correlation between our proxy score at initialization and the final performance of architectures from the search space. **This follows the protocol used in prior works on zero-cost proxy[1,2]**.\n* **In Table 3, we present results that demonstrate the superiority of our proxy in terms of clean and robust accuracy, following an end-to-end evaluation similar to [3]**. Moreover, in **Table R2 of PDF**, we show end-to-end NAS results in adversarial training settings, achieving the **highest average robust accuracy of  55.77% with 15 times less search cost** compared to AdvRush. From these experimental validations, we believe our proxy is able to find robust architecture rapidly.\n---\n**W4. Paper needs proofreading.**\n* We will incorporate the corrections in the revised version.\n   - line 188: Thus, we employ gradient similarity as a means of evaluating the ~.\n   - line 263: lower correlations\n---\n**Q1. No citations on safety-critical applications for NAS.** \n* NAS[4,5] is used to find the optimal architecture for various tasks of real-world applications, which may be safety-critical, such as autonomous driving systems [6]. If NAS does not consider robustness in such a setting, the resulting system may be vulnerable to perturbations.\n---\n**Q2. Is there evidence that the model needs to extract similar features against clean and perturbed images for correct prediction?**\n* Our proxy is designed on top of the theoretical understanding that robust architectures learn invariant features against clean and perturbed images [7,8,9], irrespective of type of the perturbations applied. \n* We assume that 1) the neural network is continuous and 2) semantic-preserving perturbations satisfying $||x^{’}-x||<\\delta$ hold true, where $\\delta$ is sufficiently small bound. We will clarify that $||.||$ is the $L_p$ norm.\n---\n**Q3. Why should features from two different functions be similar? Is eq.5 the output from sec 3.1? Does eq.5 capture realistic networks with high dimensions?**\n* Since the two functions represent the clean surrogate network (randomly initialized) and the robust surrogate network (perturbed weights), both within the same architecture, we can calculate the feature difference between the clean and robust model. This proxy term is inspired by how robust models extract perturbation-invariant features from clean and robust inputs.\n* $z_m$ is the output vector of the $m^{th}$ layer of $f_\\theta$. We will clarify this in the manuscript.\n* Even in high dimensions, Eq.5 can capture whether the model can extract invariant features from clean and perturbed inputs. Specifically, features from clean and perturbed images with a dimension of 512 show a high similarity of 0.983, which is not orthogonal.\n---\n**Q4. Exact context of lines 183-185.**\n* The proxy term is used to evaluate the parameter similarity to estimate how the model will converge to an identical or similar parameter space for both tasks. By measuring the similarity from the single-step updated parameters, we can assess how well the convergence process is likely to proceed.\n---\n**Q5. Why the multiplication is selected for the proxy?**\n* As shown in Figure 1 (b), we believe each component should be proportional to the final cost in eq.10. Therefore, we employ the multiplication of each component for the final proxy.\n---\n**Q6. The referenced benchmark evaluates the robustness only at test-time?**\n* Yes. To provide a more comprehensive robust evaluation, we further provide results (Right, Table 1) with robustness against diverse perturbations of adversarially-trained architectures from the subset of the NAS-Bench-201 search space.\n---\n**Q7. Meaning of 0.747 in table 1.**\n* The value 0.747 represents **Spearman’s rank correlation coefficient value** between the rank derived from the number of parameters and the rank derived from the final validation accuracies.\n---\n**L1. The paper mentions ImageNet but no experiments on that.**\n* **We provide the experimental results on ImageNet 16-120 in Table 2**. ImageNet16-120 is a widely used benchmark in NAS works [1,2,10], which is a downsample variant of ImageNet with 151.7K training instances for 120 selected classes. We will update the paper to explicitly refer to ImageNet16-120 in the revised version to ensure clarity.\n---\n[1]Zero-Cost Proxies for Lightweight NAS\\\n[2]Neural Architecture Design and Robustness: A Dataset\\\n[3]Meta-prediction Model for Distillation-aware NAS on Unseen Datasets\\\n[4]PC-DARTS: Partial Channel Connections for Memory-Efficient Architecture Search\\\n[5]Once-for-All: Train One Network and Specialize it for Efficient Deployment\\\n[6]Robust Physical-World Attacks on Deep Learning Visual Classification\\\n[7]Feature Denoising for Improving Adversarial Robustness\\\n[8]Adversarial Examples Are Not Bugs, They Are Features\\\n[9]Explaining and Harnessing Adversarial Examples\\\n[10]NAS-Bench-201: Extending the Scope of Reproducible Neural Architecture Search"}]

Author rebuttal:
Dear Reviewers, 

We deeply appreciate the time and effort you have invested in reviewing our paper. During the initial response period, we did our best to address all the concerns you raised in the response. Moreover, **we have thoughtfully included the additional experimental results that you requested in the attached PDF file**. We kindly request your thorough consideration of our responses and the additional experiments in the PDF. For your convenience, we have provided tables summarizing the contents, corresponding to each reviewer. We hope that our revisions have fully resolved your concerns, and we kindly request that you consider reflecting these changes in your updated review scores.

Best,\
Authors

---
### **Summary**
> **Reviewer m6P2**
> - Evaluation of adversarially trained models against recent adversarial attacks (Table R1, Table R2, Figure R1)
> - Compatibility with ensemble-based NAS (Table R6)
---
> **Reviewer DQhw**
> - Evaluation with different weight initialization methods (Table R3)
> - Influence of different types of adversarial training (Response)
> - End-to-end NAS performance against diverse adversarial attacks (Table R2)
---
> **Reviewer 41nW**
> - Evaluation against diverse adversarial attacks (Table R1)
> - Comparison with human-made architectures (Table R4)
> - Evaluation against AutoAttack (Table R2)
> - Verification the generalizability to diverse perturbations (Table R1, R2, 1, 2, 3)
---
> **Reviewer KEHv**
> - Comparison with recent train-free NAS works (Table R5)
> - Experimental results on final clean and robust accuracy (Table R2, 3)
---
### **Contents in PDF file**
* **[Table R1]**: Evaluation of adversarially trained models against diverse adversarial attacks on NAS-Bench-201 search space
   * Reviewer m6P2 (Weakness 1,2)
   * Reviewer 41nW (Weakness 1,2)
* **[Table R2/Figure R1]**: End-to-end performance of adversarially trained models against diverse adversarial attacks on DARTS search space
   * Reviewer m6P2 (Weakness 2)
   * Reviewer DQhw (Weakness 2) 
   * Reviewer 41nW (Weakness 3)
* **[Table R3]**: Comparisons with diverse weight initialization methods of our proxy
   * Reviewer DQhw (Weakness 1)
* **[Table R4]**: Comparisons with human-made architectures
   * Reviewer 41nW (Weakness 3)
* **[Table R5]**: Comparisons with more recent train-free NAS baselines
   * Reviewer m6P2 (Question 3)
* **[Table R6]**: Compatibility with ensemble-based NAS
   * Reviewer KEHv (Weakness 2)



Meta-review: The paper receives mostly positive reviews acknowledging novelty of the approach of zero cost NAS robuestness and the authors promptly respond to reviewers' questions. However, the reviewer KEHv's comments for better presentation and less thorough empirical validation are still remaining. Accordingly, the AC recommends to accept the submission to NeurIPS 2023 but strongly recommends to apply reviewer KEHv's comments in the final camera ready version.
Decision: Accept (poster)