Revisiting Adversarial Robustness Distillation from the Perspective of Robust Fairness
Authors: Xinli Yue
Ningping Mou
Qian Wang
Lingchen Zhao
Venue: NeurIPS 2023 poster (2023)
Keywords: Deep Learning
Knowledge Distillation
Adversarial Training
Fairness
TL;DR: This paper is the first to explore the issue of robust fairness in adversarial robustness distillation and proposes a novel adaptive class re-weighting scheme that improves the robust fairness of student models.

Abstract: Adversarial Robustness Distillation (ARD) aims to transfer the robustness of large teacher models to small student models, facilitating the attainment of robust performance on resource-limited devices. However, existing research on ARD primarily focuses on the overall robustness of student models, overlooking the crucial aspect of $\textit{robust fairness}$. Specifically, these models may demonstrate strong robustness on some classes of data while exhibiting high vulnerability on other classes. Unfortunately, the "buckets effect" implies that the robustness of the deployed model depends on the classes with the lowest level of robustness. In this paper, we first investigate the inheritance of robust fairness during ARD and reveal that student models only partially inherit robust fairness from teacher models. We further validate this issue through fine-grained experiments with various model capacities and find that it may arise due to the gap in capacity between teacher and student models, as well as the existing methods treating each class equally during distillation. Based on these observations, we propose $\textbf{Fair}$ $\textbf{A}$dversarial $\textbf{R}$obustness $\textbf{D}$istillation (Fair-ARD), a novel framework for enhancing the robust fairness of student models by increasing the weights of difficult classes, and design a geometric perspective-based method to quantify the difficulty of different classes for determining the weights. Extensive experiments show that Fair-ARD surpasses both state-of-the-art ARD methods and existing robust fairness algorithms in terms of robust fairness (e.g., the worst-class robustness under AutoAttack is improved by at most 12.3\% and 5.3\% using ResNet18 on CIFAR10, respectively), while also slightly improving overall robustness. Our code is available at: [https://github.com/NISP-official/Fair-ARD](https://github.com/NISP-official/Fair-ARD).

Revisiting Adversarial Robustness Distillation from the Perspective of Robust Fairness
Xinli Yue, Ningping Mou, Qian Wang, Lingchen Zhao" Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University, Wuhan 430072, China (xinliyue, ningpingmou, qianwang, lczhaocs @whu. edu. cn
Abstract
Adversarial Robustness Distillation (ARD) aims to transfer the robustness of large teacher models to small student models, facilitating the attainment of robust perfor- mance on resource- limited devices. However, existing research on ARD primarily focuses the overall robustness of student models, overlooking the erucial aspect of robust fairness. Specifically, these models may demonstrate strong robustness some classes of data while exhibiting high vulnerability on other classes. Un- fortunately, the "buckets effect" implies that the robustness of the deployed model this paper, we first
depends on the classes with the lowest level of robustness. investigate the inheritance of robust fairness during ARD and reveal that student models only partially inherit robust fairness from teacher models. We further vali- date this issue through fine-grained experiments with various model capacities and find that it may arise due to the gap in capacity between teacher and student models, as well as the existing methods treating each class equally during distillation. Based on these observations, we propose Fair Adversarial Robustness Distillation (Fair- ARD), novel framework for enhancing the robust fairness of student models by increasing the weights of difficult classes, and design geometric perspective-basse method to quantify the difficulty of different classes for determining the weights. Extensive experiments show that ARD surpasses both state-of-the-art ARD methods and existing robust fairness algorithms in terms of robust fairness (e.g., the worst-class robustness under AutoAttack improved by at most 12.3% and 5.3% using ResNet18 on CIFARIO 10, respectively), while also slightly improving overall robustness. Our code is available at: https://gtthub.com wwwpllcooo////Soooioooii -offfciia//aaar-RDD....
Introduction
Knowledge distillation [15, 29, 19, 5] is currently a popular technique for transferring knowledge from large models (teacher models) to small models (student models). This practice is particularly vital in resource-constrained environments such as mobile or embedded devices. However, as neural networks notably vulnerable to adversarial examples [31, 10], where the addition of small perturbations to input examples can potentially lead to misclassification, student models obtained through knowledge distillation are also susceptible to these adversarial attacks [4, 7, 2, 8J. Therefore, Adversarial Robustness Distillation (ARD) [9, 44, 45, 43] have been proposed to train robust student models by integrating adversarial training (AT) [24, 40, 34, 37].
However, some recent works [38, 33] have revealed the issue of robust fairness in AT, where adversarially trained models may exhibit high robustness on some classes while demonstrating significantly low robustness on others. Due to the "buckets effect," " the security of a system often depends on the security of its weakest component. Therefore, even if the overall robustness of
"Corresponding author.
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

model is high, poor robustness on a specific class of data can pose security issues. For instance, an autonomous driving system that demonstrates high robustness for inanimate objects on the road but lacks robustness when detecting pedestrians may be misled by adversarial examples, leading to traffic accidents.
Thus, we raise a question: how about the robust fairness of ARD that also incorporates adversarial examples into training like AT? Previous works have only concentrated on the overall robustness of ARD, overlooking the aspect of robust faireess. In this paper, we, for the first time, investigate whether ARD can transfer robust fairness from teacher models student models. Unfortunately, experimental results provide negative answer to this question, revealing that student models can only partially inherit robust fairness from their teacher counterparts.
Then, we reveal that the main reason lies in the capacity gap between the teacher model and the student model, and the common strategy of the prior works that treats the knowledge about each class in the same way during the distillation process. For instance, in the CIFAR-10 dataset [20], the "car" class is relatively easy for the teacher model to learn, and the student model can fit it well. By contrast, for the "cat" class, learning its knowledge is already challenging for the teacher model. Therefore, expecting a student model with significantly reduced capacity attain the same level of robustness as the teacher model becomes even more difficult. This implies that the equitable treatment of each class in previous methods [9, 44, 45, 43] may be inappropriate regarding robust fairness. becomes challenging for the student model to effectively learn the knowledge from the teacher model regarding difficult classes.
In light of these observations, we argue for treating different classes distinctively during distillation, focusing more on difficult classes and less easy ones (those student models can fit relatively easily). While previous methods [38] have incorporated re-weighting schemes to address robust fairness in AT, closer examination of their quantification of example difficulty suggests that their metric for measuring class difficulty is intuitively coarse-grained, potentially lacking precision in assessing the actual difficulty of classes. From geometric perspective, examples farther from the decision boundary are less likely to be misclassified, thereby implying lower difficulty. Therefore, the distance from an example to the decision boundary can serve as a metric for example difficulty. Comparative analysis indicates that this metric provides finer granularity. Additionally, the average difficulty of examples within a class can be employed to measure the class's s difficulty. Drawing inspiration from these insights, we introduce novel, more fine- inn-grained class difficulty metric. We further devise a unique re- weighting scheme, adaptively assigning different weights to classes with varying levels of difficulty during distillation, thereby mitigating the bias of student models towards knowledge of different classes.
Our contributions can be summarized as follows:
To the best of our knowledge, we are the first to investigate the issue of robust fairness in adversarial robustness distillation. We reveal that the student model only partially inherits the robust fairness of the teacher model and present the internal reasons.
We present the Fair Adversarial Robustness Distillation (Fair-ARD) framework, which employs a more refined difficulty metric and an adaptive class re-weighting approach, enabling the student model to leam the knowledge about each class from the teacher model in a fairer way. Fair-ARD a versatile method: existing ARD techniques such as IAD [44], RSLAD [45], and MTARD [43] can also be modified into Fair-IAD, RSLA,, and Fair-MTARD, respectively.
Extensive experiments validate that Fair-ARD can significantly improve the robust fairness of the student model and slightly improve the overall robustness, outperforming statc-of-the art ARD methods and existing robust faimess algorithms.
2 Can the Student Model Inherit the Robust Fairness of the Teacher Model?
In this section, we investigate the capability of the student model to inherit robust fairness from the teacher model. Due to the space limitation, we extensively introduce the related works in Appendix B, including AT, ARD, robust fairness, etc.
2

---

1.42
0.34
0.34
MD
SAAD
0.40
MC
0.32
0.32
2.30
0.35
0.30
4.2
0.28
0.20
0.28
0.26
FGSH
C5.N
10
10
36
22
18
192450
10L
152
Alack
(a) ResNet18
(b) WRN 3RN-34-WW W
(c) WRN-D-10
(d) ResNet-X
Figure 1: The NSD of teacher and student models on CIFAR1O. (a) The NSD of the teacher model WideResNet-33-10 [39] and student model ResNet18 [13] generated by four ARD methods under four adversarial attacks. (b)~(d) The NSD of teacher (WideResNet-34-100 and student models with different capacities generated by four ARD methods under PGD-20 attack [24], where (b) the horizontal axis W represents the widen factor of WideResNet; (c) the horizontal axis D represents the depth of WideResNet; (d) the horizontal axis X represents the number of layers in ResNet.
Table I: The percentage of the robustness for different classes inherited by the student model ResNet- 18 with respect to the corresponding class robustness of the teacher model WidcResNet-34-10.
FGSM
PGD
C&W
AA
Method
cat
car
cat
car
cat
car
cat
car
ARD IAD
85.15%
94.95 %
80.60%
92.78 %
80.74%
93.59 %
72.53%
93.13 %
84.55%
96.39% %
81.72%
94.42% %
86.89%
95.26%
79.83%
94.69 %
RSLAD
90.30%
95.07%
88.81%
93.79%
92.62%
94.36%
89.70%
94.56%
MTARD
89.70%
99.28%
75.37%
96.70%
71.31%
96.41%
63.52%
96.11%
2.1 The Degree of Robust Fairness Inheritance
Prior works about ARD [9, 44, 45, 43] mainly focused on improving the overall robustness of the student model. However, following the observation of robust fairness concerns with AT, the usability of ARD should be carefully evaluated to avoid potential security risks. In this section, we present detailed analysis of the ARD methods robust fairness.
Specifically, we evaluate the Normalized Standard Deviation (NSD²) of the class wise robustness for the teacher model and the student models trained by four ARD methods: ARD [9], IAD [44], RSLAD [45], and MTARD [43]. The results are shown in Fig. 1(a). The details about hyperparame- ters and the methods for generating adversarial examples are Section 4. The results show that all the student models consistently achieve higher NSD than the teacher model, i.e., the robust fairness of the student models is worse than the teacher model. In other words, student models can only partially inherit the teacher model's 's robust fairness.
2.2 Influential Factors in Robust Fairness Inheritance
is well-known that the gap in model capacity accounts for the inferior performance of the student model compared to the teacher model in knowledge distillation [25, 5]. Naturally, this leads us to consider whether the robust fairness inheritance also related this gap. We vary the capacity of the student model (by adjusting the depth or width of the model [28]) and analyze the change of NSD. As shown in Fig. (b) to (d), for given teacher model, the NSD decreases with the increasing of the student model's 's capacity, approaching or even falling below the teacher model's NSD. This confirms our hypothesis that the capacity gap between models leads to the inferior robust fairness of the student model compared to the teacher model.
Next, we conduct more detailed evaluation of the relationship between the capability of the student model and the robust fairness it inherits. We calculate the proportion robustness inherited by the student model for each class from the teacher model. Table presents the results for the least robust class (cat) and the most robust class (car) in the teacher model. We can observe that the hardest class
NSS is metric proposed in [38] measure the robust fairness of a model; the larger NSD, the worse the robust fairness. NSD 5//mmenn, where SD is the Standard Deviation of class wise robustness.
3

---

(cat) inherits less robustness than the easiest class (car). It reveals that the learning difficulty for the student model varies among different classes. For instance, the "car" class, whose knowledge is relatively easy, is well fitted by the student model with smaller capacity, inheriting about 94% of the teacher model's robustness under AutoAttack (AA) [8] for these four distillation methods. In contrast, the "cat" class presents increased difficulty, with the teacher model only achieving 26.8% robustness under PGD-20 [24]. This decline amplifies the limitation for the student model, which only inherits less than 80% of the teacher's robustness under AA for ARD, IAD, and MTARD. More results about other classes are available in Appendix C.2. Therefore, considering the inherent difference in difficulty among different classes, the practice of prior ARD methods that treat all classes equally poses an obstacle to the inheritance of robust fairness. This could potentially result in a case where student models may effectively learn knowledge of easy classes while hard to learn knowledge of difficult classes. Consequently, we should assign larger (smaller) weights to harder (easier) classes, allowing student models to focus more on the teacher model's knowledge about hard classes.
Methodology: Fair Adversarial Robustness Distillation
In Section 2, we observe that treating all classes equally poses an obstacle to the inheritance of robust fairmess. An intuitive way to mitigate this issue is to assign different weights to different classes. Let wi be the weight for the i-th class, we formulate fair adversarial robustness distillation (Fair-ARD) method as follows:
1
The W CARD (S.T, 2e. T.):
min Us
(1)
C
n2s ==1
j=1
CARD (S.T,E,,6.,,a) al CE ST (e.).8))) K (S (3)) (z)).² T" (x.))
(2)
where x² is the j-th example of the i-th class, o/ is the adversarial example of x Yi is the label of the i-th class, is the number of examples of the i-th class, C' is the total number of classes, CARD is the loss of ARD [9], S is the student model with parameter 0g, the teacher model, is the temperature constant added to the softmax operation, is hyperparameter in ARD, CE is the Cross-Entropy loss, and KL is the Bullback-Leible divergence loss.
3.1 Metrics to Measure Class Difficulty
The main challenge is determining the optimal weights. Hence, it is necessary to propose metric for quantifying class difficulty to calculate the weights. Prior works about improving the robust fairness of AT, such as Fair Robust Learning (FRL) [38], measure the class difficulty by the class-wise robustness, i.e., the expectation of the successful defense of adversarial examples within a given class. Let ry represent the robustness of the i-th class, and can be formulated as
1 n,
rs
Σ 4 1 (24.11))
(3)
n; j=1
p y) (S (i) = =y)
(4)
where ā is the adversarial example of the natural example y is the label of æ. 1 (-) is the indicator function, which outputs 1 when 5 (ō) = y and otherwise. Thus, the difficulty of an example, denoted by sp (x,, y). can only be 1 or 0, representing defense success or failure, respectively. And we refer to this metric of example difficulty as FRL Example Difficulty (FED).
However, we are concerned that such a coarse sorse-grained method of quantifying example difficulty can be further refined obtain more precise results. In Support Vector Machines (SVMs) [6], the distance of an example to the decision boundary can be utilized to measure the difficulty of that example, offering a broader range and finer granularity in difficulty measurement. For linear SVMs. where the decision boundary is a hyperplane, distance computation is relatively straightforward. However, in DNNs, the decision boundary high-dimensional space might constitute complex, non- linear surface, rendering the calculation of heample-to-bunddee distance challenging. Inspired by GAIRAT [41], the least PGD steps (LPS), representing the steps needed for adversarial perturbations of natural example to cross the decision boundary, can be employed as approximation for the

---

LPS-1
FED-O
LPS-6
FED-O
Natural Example
X
Adversarial Intermediate Varfant
Adversarial Example
FED-1
LPS-10
1-10
PGD Step
Advensriall Direction
Decision
Figure 2: Comparison with the example difficulty metrics FED, adopted by FRI. [38] and L.S [41]. 22, F3. and T4 are natural examples from the same class. Adversarial examples of 21, 22, and 2z can cross the decision boundary, indicating defense failure. Thus, their FED values are all However, the required PGD steps for successful attacks differ for 31, 22, and v3, resulting in their LPS values being 1, 6, and 10, respectively. The adversarial example of x4 does not cross the decision boundary, indicating successful defense. This results in FED value of and an LPS value of 10 for æz.
distance from the example to the decision boundary. Specifically, for data point (z, (z, the distance (x,y) y) from the data point (z, y) to the decision boundary is calculated as follows:
x(++1) = [x] (2(*) + sign Vane (z((1) ( v))
(5)
d(r, v) = argmin (s (00)) + y)
=E(0.K)
where ((() is the adversarial example of the natural example at PGD step f, K is the number of steps. y the step size, f the loss function, e.g. CE loss, and H,, (+](.) the projection function that projects the adversarial data back into the e-ball centered at z when necessary.
Fig. 2 presents example show the difference between FED and LPS. For three different natural examples, 21, 22, and Ig, their FED values are all 0, but their LPS values are 1, 6, and 10, respectively. Thus, I.PS can effectively distinguish difficult levels between different examples, providing more fine-grained measure for quantifying example difficulty than FED. We will provide more experimental results to show the differences between the two metrics Section
Then, the average LPS all examples within a class can serve as metric of class difficulty. Therefore, let K₃ denote the average LPS for all examples in the i-th class, and it can be calculated follows:
K4
d
x 1
1=1
3.2 The Re-weighting Strategy
After defining the metric for measuring class difficulty, we need to design a re-weighting function to allocate appropriate weights for each class based on its difficulty. Following the principle of giving larger (smaller) weights to harder (easier) classes, the weight w; should decrease w.r.t. Rg- Therefore, heuristically design several re- re-weighting functions, and here we provide example. More examples re-weighting functions are discussed in Appendix C.8.
W1
where 3 is hyperparameter controlling the smoothness of the re- re-weighting function. To make the total loss roughly in the same scale when applying wi, normalize wi that 1 D W/ = 1.
Formally, given example from the i-th class, we propose add a weight factor of 1/k, in the loss function, where the hyperparameter [0, oo). re-weighting, i.c., Fair-ARD recovers to vanilla ARD with equal weights for all classes.
O, then w; 1, corresponding to no
5

---

Table 2: The average (Avg.) and worst-class (Worst) robustness for various algorithms using ResNet18 on CIFAR-10. Better results in comparison with vanilla ARD and our proposed fair version are bolded.
Clean
FGSM
PGD
C&W
AA
Method
Avg.
Worst
Avg.
Worst
Avg.
Worst
Avg.
Worst
Avg.
Worst
Natural
94.35
87.40
16.13
5.30
0.00
0.00
0.00
0.00
0.00
0.00
SAT TRADES
84.27
64.10
56.81
28.30
49.11
22.10
48.58
20.50
46.13
17.40
82.22
64.80
58.38
31.00
52.35
25.80
50.33
22.30
49.01
21.20
ARD
83.22
61.00
58.77
28.10
51.65
21.60
51.25
19.70
49.05
16.90
Fair-ARD (ours)
82.96
68.10
57.69
39.20
52.05
33.20
50.69
31.00
49.13
29.20
IAD
83.25
60.60
58.90
27.90
52.08
21.90
51.01
21.20
48.95
18.60
FAD (ours)
83.19
68.70
58.31
36.50
52.27
30.00
51.16
28.10
49.28
25.60
RSLAD
83.04
62.70
60.03
29.80
54.13
23.80
52.76
22.60
51.18
20.90
Fair-RSLAD (ours)
83.59
67.80
60.16
35.50
54.33
29.70
53.07
26.90
51.23
25.10
MTARD
87.14
69.80
60.62
30.10
50.81
20.70
48.85
18.00
46.10
16.10
Fair-MTARD (ours)
81.98
62.10
59.11
30.60
53.96
27.50
52.32
24.20
50.60
22.60
FGSM
PGD
C&W
AA
0.40
0.40
0.40
0.40
0.35
NSD
0.30
0.30
0.30
0.30
0.25
0.25
0.25
0.25
0.20
ARD
IAD
RSLAD
MTARD
ARD
IAD
RSLAD
HTARD
ARD
IAD
RSLAD
MTARD
ARD
IAD
RSLAD
MTARD
Teacher
Vanilla
Fair
Figure 3: The NSD of the vanilla ARD (Vanilla) and our proposed fair version (Fair) using ResNet18 on CIFAR-10. The red line represents the NSD of the teacher model (WideResNet34-10) From left right, the panels show results under FGSM, PGD, C&W, and AA, respectively.
Due to the requirement of computing the weights for each class based on the entire dataset, wi cannot be updated by mini-batch like GAIRAT. Instead, it calculated based the model from the previous epoch. To demonstrate the generality of the proposed re-weighting strategy, we apply it to four ARD methods: ARD [9], IAD [44], RSLLA [45], and MTARD [43]. And the algorithms of their fair version Fair-ARD, IAD, RSALD and Fair-MTARD are in Appendix A.
Experiments
4.1 Experimental Setup
Baselines. We conduct the experiments four benchmark datasets, CIFAR-10, CIFAR-100 [20], SVHN [27], and Tiny-ImageNer [21]. Due to the space limitation, results for datasets beyond CIFAR- 10 are presented in Appendix C. We consider seven baseline methods, including natural training. two AT methods: SAT [24] and TRADES [40], and four distillation methods: ARD[9], IAD[44], RSLAD[45], and MTARD[43].
Teacher-Student Pairs. Following [45, 43], the used teacher models include a naturally trained ResNet-56 [13] and robust WideResNNet34110 [39] trained with TRADES. Student models include ResNet- 18 and MobileNetV2 [30].
Training Settings. We use the stochastic gradient descent (SGD) optimizer with an initial learning rate 0.1, a momentum 0.9, and weight decay of 2e-4 train the networks. The batch size set 128. For the baseline methods, i.c., SAT, TRADES, ARD, IAD, RSLAD, and MTARD,

---

Table 3: The average (Avg.) and worst-class (Worst) robustness for various algorithms using MobileNetV2 on CIFAR-10. Better results comparison with vanilla ARD and our proposed fair version are bolded.
Clean
FGSM
PGD
C&W
AA
Method
Avg.
Worst
Avg.
Worst
Avg.
Worst
Avg.
Worst
Avg.
Worst
Natural
92.22
82.40
9.26
0.40
0.00
0.00
0.00
0.00
0.00
0.00
SAT TRADES
81.36
55,50
55.88
24.10
49.97
18.10
48.70
16.50
46.10
12.40
80.44
63.20
56.40
30.20
51.14
25.80
48.38
21.30
47.39
20.50
ARD
81.15
59.20
56.44
26.40
50.74
22.00
49.96
21.10
48.20
18.60
Fair-ARD (ours)
82.09
69.40
56.48
36.70
50.94
29.80
49.69
26.40
48.03
24.00
IAD
81.07
56.80
56.73
26.30
51.57
22.50
49.75
19.90
48.02
17.40
Fair-IAD (ours)
81.48
66.90
56.72
38.60
51.75
32.60
49.42
28.90
47.72
27.10
RSLAD
82.97
62.60
58.67
29.30
52.91
24.10
51.58
21.50
49.93
19.60
Fair-RLLAD (ours)
83.56
67.10
59.14
34,90
53.50
30.20
52.15
28.10
50.22
26.30
MTARD
87.78
71.40
56.09
24.60
43.15
13.20
42.17
12.30
39.42
9.80
Fair-MTARD (ours)
81.97
63.00
58.20
31.40
53.26
27.90
51.16
24.90
49.66
22.80
FGSM
PGD
C&W
AA
0.40
0.40
0.40
0.40
0.35
NSD
0.30
0.30
0.30
0.30
0.25
0.25
0.25
0.25
0.20
ARD
IAD
RSLAD
MTARD
ARD
IAD
RSLAD
HTARD
ARD
IAD
RSLAD
MTARD
ARD
IAD
RSLAD
MTARD
Teacher
Vanilla
Fair
Figure 4: The NSD of the vanilla ARD (Vanilla) and proposed fair version (Fair) using Mo- bileNetV2 on CIFAR-10. The red line represents the NSD of the teacher model (WideResNet34-10) From left right, the panels show results under FGSM, PGD, C& W, and AA, respectively.
strictly follow their original settings. For the version improved by our proposed method, namely Fair-ARD, Fair-IAD, Fair-RSLAD, and Fair-MTARD, we also follow the original settings of the non-fair training version. Additionally, we search for the hyperparameter B on CIFARIO using Fair-ARD and determine 3 We adopt 3 2 for all other fair adversarial robustness distillation methods and other datasets. All the results are reported as the average of five runs, and standard deviations are omitted because they are too small.
Evaluation Metrics. We evaluate the model using four typical attacks: FGSM [10], PGD [24]. C&W [4], and AutoAttack (AA) [8]. For both datasets, the maximum perturbation is set = 8/255, and the perturbation steps for both PGD and C&W are set to 20 following [45]. And following [38], we use the worst-class robustness and NSD to measure the robust fairness of the student model. The average and worst-class robustness of teacher models under the four attacks can be found in Appendix C.
4.2 Robustness and Fairness
As shown in Table 2 and Table 3, after applying Fair-ARD, the models have significant improvement in robust fairness. addition, in most of the results, there is a slight improvement in the average accuracy and robustness as well. Our method achieves state-of-thh-an art worst-class robustness under all attacks, surpassing even the worst-class robustness of the teacher model. These results confirm that Fair-ARD outperforms all baseline methods in inheriting robust faimess from the teacher model. Considering that we fine-tune the hyperparameter using ResNet-18 18 on Fair-ARD, demonstrates the most significant enhancement, with the worst-class robustness under AA experiencing substantial
7

---

1.00
52.00
35
70
Rabustness 9%)
84
68
0.75
51.75
Accura Baraa
Robustness
30
66
Accuracy/S:
3 0.50
51.50
64
0.25
51.25
81
25
62
0.00
51.00
20
60
10
0.1
0.5
2
0.1
0.5
3
8=0
0.5
B-2
Avg. Rob
Worst Rob
8 ==
8 8=1
=
Avg. Acc
Worst Acc
Figure 5: Effects of different / Fair-ARD using ResNet-18 on CIFARIO. Left: w values under different B. Middle: the average robustness and accuracy of student models using different B. Right: the worst-class robustness and accuracy of student models using different 3.
12.3% improvement. If the hyperparameter they could potentially exhibit further improvements.
fine-tuned other fair methods, e.g., Fair-IAD,
For MTARD, observe that while Fair-ARD can improve its robust fairness, it may decrease clean accuracy. This is due the workflow of MTARD. The student model simultaneously guided by a clean model and teacher model, where the weights of these two models aims to enhance robust fairness. Consequently, the robust teacher's weight is potentially increased during the training process, naturally leading to decrease in the clean teacher's weight, thereby reducing the clean accuracy.
up to And Fair-ARD
Then, we present the NSD of both the vanilla ARD and Fair-ARD across various models in Fig. 3 and Fig. The results show that Fair-ARD effectively reduces the NSD of the student model, especially in most experimental results where the NSD of the student model even falls below that of the teacher model. This further demonstrates the superiority of our method in enhancing robust fairness.
4.3 Ablation Studies
To obtain a comprehensive understanding of Fair-ARD, we investigate the effect of 3. Additional ablation studies different re-weighting functions and teacher models presented in Appendix C.8 and C.9, respectively. Specifically, we choose ResNet-18 18 as the student model and ARD as the baseline method; other settings are the same in Section 4.1. We first visualize the value of with different 3 in the left panel of Fig. 5. With the increase of B, the re-weighting magnitude and the weight gap among classes also increase, and student models will pay more attention to the knowledge of difficult classes.
In the middle and right panels of Fig. 5, present the average and worst-class performance of the student model obtained with different 3, respectively. Note that when = 0, all classes are considered equally, i.e., Fair-ARD is the same ARD in this case. We observe that the average robustness of Fair-ARD is worse than ARD when 3 is too small. However, when , >> 1, Fair-ARI) exhibits higher robustness compared to ARD while almost not sacrificing accuracy. Additionally, the worst-class robustness and accuracy Fair-ARD across various 3 values surpass those of ARD, the student model achieves the
highlighting the superiority of method. In particular, when highest worst-class robustness. Therefore, we adopt this setting in our experiments. Moreover, the worst-class robustness of Fair-ARD initially increases and then decreases as / increases. The reason might be that an excessively large 3 leads to a significant weight disparity among classes, resulting in unstable training.
Discussion
In this section, we discuss the differences between our Fair-ARD and related works about (fair) adversarial training with detailed experimental results. More discussions are provided in Appendix C.I0.

---

Table 4: The average (Avg.) and worst-class (Worst) robustness for various algorithms using ResNet- 18 on CIFAR-10. The best results are bolded, and the second best results are underlined.
Clean
FGSM
PGD
C&W
AA
Method
Avg.
Worst
Avg.
Worst
Avg.
Worst
Avg.
Worst
Avg.
Worst
ARD
83.22
61.00
58.77
28.10
51.65
21.60
51.25
19.70
49.05
16,90
GAIR-ARD
81.09
65.80
54.04
34.60
50.00
32.60
42.69
20.70
40.88
18,90
FRL-ARD
81.47
61.40
56.90
34.30
50.24
28.60
49.76
26.80
47.84
23.90
FAT-ARD
82.98
65.20
57.62
38.00
51.11
31.00
49.99
29.20
48.22
25.90
CFA-ARD
82.00
62.30
57.68
30.60
52.43
25.00
51.23
22.30
49.73
20.00
Fair-ARD (ours)
82.96
68.10
57.69
39.20
52.05
33.20
50.69
31.00
49.13
29.20
5.1 Comparison with GAIRAT
GAIRAT [41] is an instance-reweighted adversarial training algorithm, and our metric for measuring class difficulty is designed based the LPS proposed by GAIRAT. We highlight several differences between our Fair-ARD and GAIRAT. Firstly, Fair-ARD focuses on both overall robustness and robust fairness, while GAIRAT only concerns overall robustness. Additionally, GAIRAT can be viewed as finding solutions for each individual example, whereas Fair-ARD seeks solutions for an entire class of examples. Finally, the reightng functions of the two are also different: GAIRAT' function is a tanh-type function, while ours is a power function. And the comparison of different re-weighting functions is provided in Appendix C.8.
For a fair comparison, we applied the GAIRAT method to ARD, resulting in a variant we refer to as GAIR-ARD. As shown in Table 4, although GAIR-ARD demonstrates higher worst-class robustness under the PGD attack than ARD, it still does not outperform our Fair-ARD. Furthermore, under the AutoAttack, the average robustness and robust fairness of GAIR-ARD are both significantly lower than our Fair-ARD. Upon investigating the reason, we observed the weights assigned to each example during the training process of GAIR-ARD and found that the disparities among different examples' weights were substantial, even differing by several orders of magnitude. This may lead to subtle gradient masking [3, 16], resulting in a substantial drop in robustness when facing AA. Instead, our Fair-ARD employs a re-weighting function that acts on the classes, and the hyperparameter 3 can control the re-weighting amplitude within a smaller range. Consequently, Fair-ARD does not suffer from gradient masking, as evidenced by the results under AA.
5.2 Comparison with Robust Fairness Algorithms
FRL [38], FAT [23], and CFA [35] are the state-of-the-art methods for improving the robust fairness of AT. FAT enhances robust fairness by controlling the variance of class-wise adversarial risk. which offers distinct perspective compared to methods like FRL, CFA, and Fair-ARD Hence, we mainly focus on comparing our Fair-ARD with both FRL and CFA, as they all employ the re-weighting approach. Firstly, they use different metrics to quantify the class difficulty. FRL and CFA use the class-wise robustness on the validation set, while we utilize the average distance between examples and the decision boundary, which offers finer granularity, as shown in Fig. 2. Additionally, their re- re-weighting functions differ from ours. FRL's function an iterative algorithm based on the difficulty metric, with more than four hyperparameters, and CFA applies fractional function based on class difficulty, whereas we mainly use power functions for re-weighting. We make more discussions about several types of re-weighting functions in Appendix C.8. Finally, CFA utilizes the exponential moving average (EMA), while FRL and Fair-ARD do not employ it.
To show the advantages of our proposed method compared to FRL, FAT, and CFA, we also employed them in ARD, namely FRL-ARD, FAT-ARD, and CFA-ARD, respectively. The results in Table demonstrate that while FRL and FAT can improve the worst-class robustness of ARD, they also lead to a slight decrease in the average robustness. On the other hand, Fair-ARD outperforms both FRL-ARD and FAT-ARD in terms of both average and worst-class robustness. Most notably, Fair-ARD improves the worst-class robustness under AA by 5.3% compared to FRL-ARD. This also provides rough evidence that the metric LPS is superior to FED. Regarding CFA, while CFA-ARD outperforms ARD in terms of robust faireess, it falls short when compared to Fair-ARD. This distinction highlights the superiority of ARi in enhancing robust faimess.
9

---

Conclusion
In this paper, we conducted an in-depth investigation into the issue of robust fairness in ARD. We revealed that the student model obtained through ARD fails to fully inherit the robust fairness from the teacher model. We discovered that this issue may arise due to the capacity gap between the teacher and student models, and previous ARD methods treated the knowledge of all classes equally, Based on these observations, we proposed Fair-ARD, which utilizes refined class difficulty metric from geometric perspective and weighting strategy for distinct classes to enhance the robust fairness of the student model. Extensive experiments showed that Fair- Bur significantly improves the robust fairness of student models compared to existing methods while maintaining high overall robustness. Our work can help in establishing adversarially robust and fair lightweight deep learning models.
Acknowledgements
This work was partially supported by the NSFC under Grants U20B2049, U21B2018, and 62302344, and the Fundamental Research Funds for the Central Universities, 2042023k00122.
References
[1] Jean-Baptiste Alayrac, Jonathan Uesato, Po-Sen Huang, Alhussein Fawzi, Robert Stanforth, and Pushmeet Kohli. Are labels required for improving adversarial robustness? In NeurlPS, 2019.
[2] Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: query-efficient black-box adversarial attack via random search. In ECCV, 2020.
[3] Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of security: Circumventing defenses to adversarial examples. In ICML, 2018.
[4] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In S&P, 2017.
[5] Jang Hyun Cho and Bharath Hariharan. On the efficacy of knowledge distillation. In ICCV, 2019.
[6] Corinna Cortes and Vladimir Vapnik. Support-vector networks. Machine learning, 1995.
[7] Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with fast adaptive boundary attack. In /CML, 2020.
[8] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. ICML, 2020.
[9] Micah Goldblum, Liam Fowl, Soheil Feizi, and Tom Goldstein. Adversarially robust distillation. In AAAI, 2020.
[10] Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples. In ICLR, 2015.
[11] Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03593. 2020.
[12] Moritz Hardt, Eric Price, and Nati Srebro. Equality of opportunity in supervised learning. In NeurIPS, 2016.
[13] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016.
[14] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings deep residual networks. In ECCV, 2016.
10

---

[15] Geoffrey Hinton. Oriol Vinyals, and Jeff Dean. Distilling the knowledge in a neural network. arXiv preprint 1503002533.
[16] Dorjan Hitaj, Giulio Pagnotta, lacopo Masi, and Luigi V Mancini. Evaluating the robustness of geometry-awar instance-reweighte adversarial training, arXiv preprint arXiv:2103.01914 2021.
[17] Xiaojun Jia, Yong Zhang, Baoyuan Wu, Ke Ma, Jue Wang, and Xiaochun Cao. Las-at: adversarial training with learnable attack strategy. In CVPR, 2022.
[18] Sangwon Jung, Donggyu Lee, Taeeon Park, and Taesup Moon. Fair feature distillation for visual recognition. In CVPR. 2021.
[19] Nikos Komodakis and Sergey Zagoruyko. Paying more attention attention: improving the performance of convolutional neural networks via attention transfer. In ICLR, 2017.
[20] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. Technical report, 2009.
[21] Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 231N, 2015.
[22] Chen Liu, Mathieu Salzmann, Tao Lin, Ryota Tomioka, and Sabine Süsstrunk. On the loss landscape of adversarial training: Identifying challenges and how to overcome them. In Advances in Neural Information Processing Systems, 2020.
[23] Xinsong Ma. Zekai Wang, and Weiwei Liu. On the tradeoff' between robustness and fairness. In NeurIPS, 2022.
[24] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018
[25] Seyed Iman Mirzadeh, Mehrdad Farajtabar, Ang Li, Nir Levine, Akihiro Matsukawa, and Hassan Ghasemzadeh. Improved knowledge distillation via teacher assistant. In AAAI, 2020.
[26] Vedant Nanda, Samuel Dooley, Sahil Singla, Soheil Feizi, and John P Dickerson. Fairness through robustness: Investigating robustness disparity in deep learning. In ACM FAceT, 2021.
[27] Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. 2011.
[28] Thao Nguyen, Maithra Raghu, and Simon Kornblith. Do wide and deep networks learn the same things? uncovering how neural network representations vary with width and depth. In ICLR, 2021.
[29] Adriana Romero, Nicolas Ballas, Samira Ebrahimi Kahou, Antoine Chassang, Carlo Gatta, and Yoshua Bengio. Fitnets: Hints for thin deep nets. In ICLR, 2015.
[30] Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, and Liang-Chie Chich Chen. Mobilenetv2: Inverted residuals and linear bottlenecks. In CVPR, 2018.
[31] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Good- fellow, and Rob Fergus. Intriguing properties of neural networks. In ICLR, 2014.
[32] Mingxing Tan and Quoc Le. Efficientnetv2: Smaller models and faster training. In ICML, 2021.
[33] Qi Tian, Kun Kuang, Kelu Jiang, Fei Wu, and Yisen Wang. Analysis and applications of class-wise robustness in adversarial training. In KDD, 2021.
[34] Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In ICLR, 2020.
[35] Zeming Wei, Yifei Wang, Yiwen Guo, and Yisen Wang. Cfa: Class-wise calibrated fair adversarial training. CVPR, 2023.
[36] Boxi Wu, Jinghui Chen, Deng Cai, Xiaofei He, and Quanquan Gu, Do wider neural networks really help adversarial robustness? In NeurIPS, 2021.

---

[37] Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. In NeurlPS, 2020.
[38] Han Xu, Xiaorui Liu, Yaxin Li, Anil Jain, and Jiliang Tang. To be robust or be fair: Towards fairness in adversarial training. In ICML, 2021.
[39] Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In BMVC, 2016.
[40] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurnnt El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML,, 2019.
[41] Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan Kankanhalli. Geometry-aware instance-reweighted adversarial training. In ICLR, 2021.
[42] Xiangyu Zhang, Xinyu Zhou, Mengxiao Lin, and Jian Sun. Shufflenet: An extremely efficient convolutional neural network for mobile devices, In CVPR, 2018.
[43] Shiji Zhao, Jie Yu, Zhenlong Sun, Bo Zhang, and Xingxing Wei. Enhanced accuracy and robustness via multi-teacher adversarial distillation. In ECCV, 2022.
[44] Jianing Zhu, Jiangchao Yao, Bo Han, Jingfeng Zhang, Tongliang Liu, Gang Niu, Jingren Zhou, Jianliang Xu, and Hongxia Yang. Reliable adversarial distillation with unreliable teachers. In ICLR, 2021.
[45] Bojia Zi, Shihao Zhao, Xingjun Ma, and Yu-Gang Jiang. Revisiting adversarial robustness distillation: Robust soft labels make student better. In ICCV, 2021.
12


Reviews:
[{"review_id": "jVbnqZHR6C", "reviewer": "Reviewer_qqxE", "summary": "This work studies the problem of fairness in the context of distillation of adversarially robust models. Specifically, it is shown that the accuracy disparity between classes (leading to “unfairness”) is _further exacerbated_ for student models, attributed to the a) capacity gap between the student and teacher model and b) equal importance given to classes during the distillation process. \nThis essentially leads to the need for fair adversarial distillation. This is achieved via modelling the “difficulty of learning a class” via the Least PDG Steps (LPS) measure to model the ease by which a sample can cross the decision boundary. Based on this, a flexible and general reweighting scheme is proposed which can be applied “post-hoc” on top of any distillation mechanisms by allowing for the reweighting. A thorough empirical evaluation is presented showing consistent improvements in the average and worst-group accuracy over existing methods as well as superiority over other fair adversarial training methods. ", "questions": "Please see section on Weakenesses.", "limitations": "While discussion on the choice of $\\beta$ is presented, it would be nice if any limitations of the existing method (such as reweighting) are discussed. ", "rating": 7, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "This paper studies an important and relevant problem of the fairness-robustness trade-off in the relevant setting of knowledge distillation. I like the motivation behind the need to study the \"fine-grained\" effect of adversarial distillation w.r.t accuracy gap between different classes. The approach to analyse the problem is concise and well motivated: and has important implications in both the \"inductive bias\" of adversarial robustness towards different classes as well as the generality of reweighting via class difficulty. Further, the empirical evaluation is thorough and comparisons are made with comprehensive baselines, both w.r.t original robust-distillation methods as well as different \"reweighting\" / fairness methods. \n\n", "weaknesses": "Following are some questions which I believe should be addressed:\n1. An essential baseline assumption is that _all classes are balanced_ i.e. equally represented in the training data. How do you foresee the generality of your method in the scenario where we not only consider class difficulty but also the class-imbalance? It looks like the estimator on Eq(6) would now be biased.\n2. The results seem to be evaluated only on the CIFAR datasets, it would be interesting to see how this observation holds beyond CIFAR. \n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your constructive comments. We have taken great care to address all your concerns, providing necessary clarifications when needed. We genuinely hope that our responses comprehensively answer your questions.\n\n> **(Comment 1): An essential baseline assumption is that all classes are balanced i.e. equally represented in the training data. How do you foresee the generality of your method in the scenario where we not only consider class difficulty but also the class-imbalance? It looks like the estimator on Eq(6) would now be biased.** \n\n**Answer 1:**\n\nOur Fair-ARD can also generalize to the scenario where both class difficulty and imbalance exist.\n\n**Firstly**, although the datasets used in this paper are balanced across classes, the number of examples in each class has a relatively minor impact on the $\\kappa_i$ metric, since it is calculated by averaging the difficulty of all examples within the $i$-th class as shown in Eq. (6). \n\n**Secondly**, to address your question about simultaneously considering class difficulty and class imbalance, we have conducted experiments on the SVHN dataset [1], which is an imbalanced dataset with different numbers of training examples across classes. \nUsing ResNet18 and IAD [2] as an example, our Fair-ARD framework achieved an enhanced worst-class robustness of **24.10%** against AA attacks, **3.98%** higher than IAD. This positive result on an imbalanced dataset further validates the generality of our method in tackling the combined challenges of class difficulty and imbalance. We will include these supportive experimental results in the revision of the paper.\n\n\n> **(Comment 2): The results seem to be evaluated only on the CIFAR datasets, it would be interesting to see how this observation holds beyond CIFAR.** \n\n**Answer 2:**\n\nOur observation also holds beyond CIFAR datasets. We have validated our viewpoint on the SVHN and Tiny-ImageNet [3] datasets on ResNet18. Since the worst-class robustness is extremely low and there are only 50 images for each class in the test set, we report the average of the worst-20% class robustness on Tiny-ImageNet following [4]. As the table below shows, compared to IAD, our Fair-ARD framework improved worst-class (worst-20% class) robustness under AA by **3.98%** (**0.45%**) on SVHN (Tiny-ImageNet). These consistent enhancements on additional benchmark datasets further demonstrate the generality of our method.\n\n\n|    Dataset    |     Method      | Clean Avg. | Clean Worst |  AA Avg.  | AA Worst/Worst-20% |\n| :-----------: | :-------------: | :--------: | :---------: | :-------: | :----------------: |\n|     SVHN      |       IAD       |   90.28    |    74.04    |   43.58   |       20.12        |\n|     SVHN      | Fair-IAD (ours) | **91.66**  |  **83.19**  | **44.55** |     **24.10**      |\n| Tiny-ImageNet |       IAD       |   40.06    |    15.95    |   14.46   |        1.15        |\n| Tiny-ImageNet | Fair-IAD (ours) | **40.94**  |  **16.80**  | **15.35** |      **1.60**      |\n\n> **(Comment 3): While discussion on the choice of $\\beta$ is presented, it would be nice if any limitations of the existing method (such as reweighting) are discussed.** \n\n**Answer 3:**\n\nThank you for your valuable suggestion. We will briefly discuss the limitations of our method here and include a detailed discussion in the revision of our paper.\n\nRegarding the limitations of our method, the reweighting function is heuristic and may not be optimal. Given the diverse perspectives in adversarial training, there may exist more effective methods. Besides, our adopted reweighing algorithm is an intuitive design. More fine-grained reweighting methods may achieve higher worst-class robustness. \n\nIn addition, our work primarily focuses on discovering and alleviating the robust fairness issue in Adversarial Robustness Distillation. We leave the exploration of designing more effective solutions for future work.\n\n[1] Yuval Netzer et al. Reading digits in natural images with unsupervised feature learning. 2011.\n\n[2] Jianing Zhu et al. Reliable adversarial distillation with unreliable teachers. In *ICLR*, 2021.\n\n[3] Ya Le et al. Tiny imagenet visual recognition challenge. In *CS 231N*, 2015.\n\n[4] Wei, Zeming et al. Cfa: Class-wise calibrated fair adversarial training. In *CVPR*, 2023."}, {"review_id": "ODvCY92lhx", "reviewer": "Reviewer_Mqsm", "summary": "This paper deals with the issue of fairness in adversarial training in image classification with distillation. The idea is that due to model capacity gap between the teacher and the student model, not all classes are equally capable of retaining the teacher model's robustness and thus the distilled student model shows a larger variation among different classes in terms of adversarial robustness which is not desired.\nThe proposed solution is a simple class-wise re-weighting of the training objective which increases the importance of such difficult classes and reduces that of the easier classes. The proposed weights are heuristically motivated according to the (inverse) of the number of PGD steps needed to find an adversarial example averaged over each class (weighted with hyper-parameter beta).\n\nNumerical results on CIFAR 10 and CIFAR100 show empirical improvements of the average and worst-class robustness.", "questions": "1- Given the empirical nature of the results, how sensitive is the model versus the PGD step-size in LPS? How would the results change if $gamma$ was 10 times smaller for instance?\n\n2- As motivating examples, it is mentioned that the gap between student and teacher is the reason behind worse fairness. However, tests show (see Fig1 for instance) that teacher models performance are often surpasses by the student model once the student model size reaches that of the teacher. This means that the size of the model is only partly responsible for the performance deterioration and contradicts the statement in my opinion.\n\n3- In the abstract two relative improvements are mentioned (12.3% and 5.3%) while both refer to CIFAR10 with Resnet18. Could you please clarify.", "limitations": "Yes", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "The problem is interesting and well-motivated. The paper is written well and easy to follow. The proposed solution is intuitive and simple.\n\nEmpirical results show improvement in terms of average and worst-class adversarial robustness against state-of-the-art on cifar 10 and cifar 100.", "weaknesses": "The paper proposed a simple re-weighting approach, and lacks any foundational contribution to the problem. The performance is thus heavily judged by empirical tests.\n\nMy concern on this issue is the following:\n\n1- Due to lack of theoretical grounding, how reliable are the experimental results? This is specially important in CIFAR100 results given the low robustness (<5%). One could for instance report the standard deviation across different training runs to show such sensitivity.\n\n2- The formulation is heuristic, especially as the proposed class weights are not predetermined and change according to the latest model obtained in the last iteration. This means the objective changes in each epoch. How stable is this approach? Also, what are these weights calculated over (training set or validation set)? As one of the differences with GAIRAT it is mentioned that least PGD steps (LPS) is calculated over the validation set in there. How important is this choice and how much difference does it make?\n\n3- The metric to measure class difficulty is borrowed from GAIRAT, with some modifications. What is the sensitivity to the pgd parameters such as the step-size.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your constructive comments. We have taken great care to address all your concerns, providing necessary clarifications when needed. We genuinely hope that our responses comprehensively answer your questions.\n\n> **(Comment 1): Due to lack of theoretical grounding, how reliable are the experimental results?  ...**\n\n**Answer 1:**\n\nThank you for your valuable suggestion. All training runs were independently conducted five times and reported averages, omitting negligible standard deviations (illustrated in line 198 of our paper). We have presented the results of using ResNet18 on CIFAR100 in the partial table below and the detailed Table 14 in the global rebuttal PDF. These minor standard deviations align with prior AT work [1,2], further demonstrating the stability. We will include the standard deviations for each experiment in the revision to provide full transparency and rigor regarding our experimental process.\n\n|Method|Clean Avg.|Clean Worst|AA Avg.|AA Worst|\n|:-:|:-:|:-:|:-:|:-:|\n|Fair-IAD (ours)|57.08±0.34|18.00±0.33|25.55±0.26|2.00±0.65|\n|Fair-RSLAD (ours)|58.33±0.45|21.00±0.48|26.37±0.51|3.00±0.51|\n|Fair-MTARD (ours)|57.72±0.21|22.00±0.41|26.18±0.53|3.00±0.43|\n\n[1] Chen Liu et al. On the loss landscape of adversarial training: Identifying challenges and how to overcome them. In *NeurIPS*, 2020.\n\n[2] Boxi Wu et al. Do wider neural networks really help adversarial robustness? In *NeurIPS*, 2021.\n\n> **(Comment 2): The formulation is heuristic, especially as the proposed class weights are not predetermined and change ...**\n\n**Answer 2:**\n\n1)  Stability of the Method\n\nFigure 10 in the global rebuttal PDF presented the variations in the weights of each class during training.  And we found that the weights initially fluctuated but gradually stabilized in the later stages. \n\n2)  Weight Computation\n\nBoth GAIRAT and our method calculate weights using the training set but differ in the subsets utilized for each calculation. We calculate weights across the entire training set, updating them once per epoch. In contrast, GAIRAT calculates weights on each mini-batch and updates them after every mini-batch. Since each batch may have different class distributions, this can potentially influence the measurement of class difficulty. Hence, our method can obtain a more accurate assessment by determining the class difficulty over the entire training set. The results in Tables 4 and 12 demonstrate our method's superiority.\n\n> **(Comment 3): The metric to measure class difficulty is borrowed from GAIRAT, with some modifications. What is the sensitivity to the pgd parameters such as the step-size.** \n\n**Answer 3:**\n\nWe analyze the sensitivity of the step size theoretically and empirically as follows.\n\nIncreasing step size $\\gamma$ reduces steps for examples to cross decision boundaries, diminishing LPS discrimination. As shown in the partial table below and the detailed Table 15 in the global rebuttal PDF, $\\gamma$=3/255 versus 2/255 maintains average robustness but worsens worst-class, due to weakened re-weighting from reduced LPS discrimination. However, Fair-ARD still exceeds ARD [3].\n\nConversely, decreasing γ can raise steps to boundaries, potentially improving discrimination. But smaller $\\gamma$ risks lower quality adversarial examples for training, hindering distillation. As shown in the partial table below and the detailed Table 15 in the global rebuttal PDF, a 10x smaller $\\gamma$ substantially decreased robustness, which can be attributed to poorer adversarial examples.\n\nIn summary, $\\gamma$ tuning balances discrimination versus adversarial training efficacy. Careful adjustment optimizes Fair-ARD performance.\n\n|Method|Step Size|Clean Avg.|Clean Worst|AA Avg.|AA Worst|\n|:-:|:-:|:-:|:-:|:-:|:-:|\n|ARD|2/255|83.22|61.00|49.05|16.90|\n|Fair-ARD (ours)|0.2/255|**86.22**|**70.30**|36.39|14.90|\n|Fair-ARD (ours)|1/255|84.35|69.90|47.95|22.80|\n|Fair-ARD (ours)|2/255|82.96|68.10|**49.13**|**29.20**|\n|Fair-ARD (ours)|3/255|83.90|69.60|49.10|27.00|\n\n> **(Comment 4): Given the empirical nature of the results, how sensitive is the model versus the PGD step-size in LPS? ...** \n\n**Answer 4:**\n\nPlease refer to Answer 3 for detailed analyses.\n\n> **(Comment 5): As motivating examples, it is mentioned that the gap between student and teacher is the reason behind worse fairness ...**\n\n**Answer 5:**\n\nWe first clarify that our conclusion aligns with yours - the capacity gap between teacher and student models is the main reason (Line 45 in our paper) rather than the sole reason for the robust fairness issues. In the following, we illustrate the capacity gap as a main reason because:\n\n**Firstly,** as shown in (b)~(d) of Fig1, continuously increasing the student model capacity leads to consistent improvements in robust fairness across larger model sizes. This clear trend corroborates our proposition that model capacity is a key factor influencing robust fairness.\n\n**Secondly,** since distillation itself can enhance model performance [3], if a pre-trained model is distilled using itself as the teacher, its performance will be boosted even more. Consequently, when model architectures are the same, distillation can heighten robust fairness, harmoniously aligning with our perspective. \n\n[3] Goldblum, Micah et al. Adversarially robust distillation. In *AAAI*, 2020.\n\n> **(Comment 6): In the abstract two relative improvements are mentioned (12.3% and 5.3%) while both refer to CIFAR10 with Resnet18. Could you please clarify.**\n\n**Answer 6:**\n\n1)  12.3%:\n\nOn ResNet18 and CIFAR10, our Fair-ARD improved the worst-class robustness under AA by 12.3% compared to vanilla ARD.\n\n2)  5.3%:\n\nOn ResNet18 and CIFAR10, our Fair-ARD improved the worst-class robustness under AA by 5.3% compared to FRL-ARD, which refers to applying FRL [4] techniques to vanilla ARD.\n\n[4] Xu, Han et al. To be robust or to be fair: Towards fairness in adversarial training. In *ICML*, 2021."}, {"review_id": "fQVei8gUnm", "reviewer": "Reviewer_DXyp", "summary": "Adversarial robustness distillation transfers knowledge from a teacher model to a student model and improves the overall robustness of the student in terms of resisting adversarial attacks. This work studies robust fairness in the task of adversarial robustness distillation, which focuses on the adversarial robustness of different classes. This work first makes an observation that the student may only partially inherit the teacher's robust fairness, due to the capacity gap between the teacher and student, and the varying class difficulties. To address this issue of robust fairness, this work proposes Fair-ARD, which uses a geometric perspective to quantify the per-class difficulty and adjust the weight of each class accordingly. Extensive experiments demonstrate the efficacy of Fair-ARD in improving the robust fairness in knowledge distillation.", "questions": "1. In Figure 2, the 10-th adversarial example of $\\tilde x_4$ is still correctly classified. Why the LPS value of $x_4$ is 10? This seems to contradict with Equation (5).\n2. Also in Equation (5), how to determine $d(x,y)$ if the adversarial examples within the $\\epsilon$-ball never move across the decision boundary?", "limitations": "Please check 1. in Weaknesses.", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This work, for the first time, explores how to transfer robust fairness in adversarial robustness distillation. Robust fairness can be of vital importance in ML applications with social and/or safety concerns. This research initiates an important direction for the community.\n2. The proposed method, Fair-ARD, is a general framework that can be readily incorporated into existing ARD methods.\n3. The experiment evaluation is thorough.\n4. The writing and math notations are clear.", "weaknesses": "1. The experiments are mostly done on CIFAR-10/100, a relatively curated and easy dataset. Following prior work like IAD [35], it is encouraged to include more realistic and challenging datasets like Tiny-ImageNet. In the sense of robust fairness, a large number of classes and/or unbalanced data distribution would introduce some more practical challenges.\n2. The re-weighting strategy in proposed method requires re-estimating the difficulty of every sample in every epoch. This process involves multiple PGD steps. This method may introduce a large quantity of computation overhead to the distillation procedure.\n3. Citations should be given when previous methods first appear in the paper (e.g., IAD, RSLAD, and MTARD in Line 75).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your constructive comments. We have taken great care to address all your concerns, providing necessary clarifications when needed. We genuinely hope that our responses comprehensively answer your questions.\n\n> **(Comment 1): The experiments are mostly done on CIFAR-10/100, a relatively curated and easy dataset. Following prior work like IAD [35], it is encouraged to include more realistic and challenging datasets like Tiny-ImageNet. In the sense of robust fairness, a large number of classes and/or unbalanced data distribution would introduce some more practical challenges.**\n\n**Answer 1:**\n\nWe have conducted experiments on the imbalanced SVHN [1] and large-scale Tiny-ImageNet [2] datasets. Using ResNet18 and IAD [3] as an example, our Fair-ARD approach achieved improved worst-class robustness against AA attacks, with enhancements of **3.98%** on SVHN and **0.45%** on Tiny-ImageNet compared to IAD. These consistent results further validate the effectiveness and generalization of our Fair-ARD.\n\n|    Dataset    |     Method      | Clean Avg. | Clean Worst |  AA Avg.  | AA Worst/Worst-20% |\n| :-----------: | :-------------: | :--------: | :---------: | :-------: | :----------------: |\n|     SVHN      |       IAD       |   90.28    |    74.04    |   43.58   |       20.12        |\n|     SVHN      | Fair-IAD (ours) | **91.66**  |  **83.19**  | **44.55** |     **24.10**      |\n| Tiny-ImageNet |       IAD       |   40.06    |    15.95    |   14.46   |        1.15        |\n| Tiny-ImageNet | Fair-IAD (ours) | **40.94**  |  **16.80**  | **15.35** |      **1.60**      |\n\n> **(Comment 2): The re-weighting strategy in proposed method requires re-estimating the difficulty of every sample in every epoch. This process involves multiple PGD steps. This method may introduce a large quantity of computation overhead to the distillation procedure.**\n\n**Answer 2:**\n\nApologies for the misunderstanding - to clarify, estimation of difficulty does not require any additional PGD steps to the distillation procedure.\n\nDuring the training process, ARD itself requires generating adversarial examples to improve robustness. Our method just leverages this process to estimate difficulty, without introducing any additional PGD steps. As a result, our Fair-ARD only adds negligible computation overhead compared to the original PGD operations. For specific computational overhead on training time and GPU memory, please refer to Appendix C.7 and Table 13 of our paper. Table 13 shows our method slightly increases computation time but does not increase GPU memory usage.\n\n|      Method       | Time (Avg. Epoch) | GPU Memory |\n| :---------------: | :---------------: | :--------: |\n|        ARD        |      130.14s      |  3645MiB   |\n|  Fair-ARD (ours)  |      154.96s      |  3645MiB   |\n|        IAD        |      167.22s      |  4231MiB   |\n|  Fair-IAD (ours)  |      207.70s      |  4231MiB   |\n|       RSLAD       |      161.50s      |  3877MiB   |\n| Fair-RSLAD (ours) |      215.23s      |  3877MiB   |\n|       MTARD       |      229.96s      |  4017MiB   |\n| Fair-MTARD (ours) |      232.87s      |  4017MiB   |\n\n> **(Comment 3): Citations should be given when previous methods first appear in the paper (e.g., IAD, RSLAD, and MTARD in Line 75).**\n\n**Answer 3:**\n\nThank you for your valuable suggestion. We will add these details in the revised version.\n\n> **(Comment 4): In Figure 2, the 10-th adversarial example of $\\tilde{x}_4$ is still correctly classified. Why the LPS value of $x_4$ is 10? This seems to contradict with Equation (5).**\n\n**Answer 4:**\n\nFollowing GAIRAT [4], the LPS value is constrained to the range $[0,K]$, where $K$ represents the maximum number of steps for generating adversarial examples during training. Since $K$ is set to 10 for the adversarial robustness distillation methods discussed in this paper (Appendix C.1, line 452), the LPS of example $x_4$ will be 10 even if its 10th adversarial example is correctly classified.\n\nThis is a special case for Equation 5. We will introduce a constraint, namely $d(x,y)\\in[0,10]$, to ensure consistency between Equation (5) and the examples shown in Figure 2.\n\n> **(Comment 5):  Also in Equation (5), how to determine $d(x,y)$ if the adversarial examples within the $\\epsilon$-ball never move across the decision boundary?**\n\n**Answer 5:**\n\nAs illustrated in Answer 4,  $d(x,y)$ is $K$ in this case. Since $K$ is 10 in the adversarial robustness distillation methods discussed in our paper, $d(x,y)$ is actually 10 if the adversarial examples within the $\\epsilon$-ball never move across the decision boundary.\n\nOur computation of $d(x,y)$ is as follows:\n\n1. $\\tilde{x} \\leftarrow x ; d(x, y) \\leftarrow 0$\n2. $\\textbf{while }K>0\\textbf{ do}$\n3. $\\quad \\textbf{if } \\arg\\max_i f(\\tilde{x})=y \\textbf{ then}$\n4. $\\quad\\quad d(x, y) \\leftarrow d(x, y)+1$\n5. $\\quad \\textbf{end if }$\n6. $\\quad \\tilde{x} \\leftarrow \\Pi_{\\mathcal{B}}[x, \\epsilon]\\left(\\gamma \\operatorname{sign}\\left(\\nabla_{\\tilde{x}} \\ell(f(\\tilde{x}), y)\\right)+\\tilde{x}\\right)$\n7. $\\quad K \\leftarrow K-1$\n8. $\\textbf{end while }$\n\nHence, if an adversarial example within the $\\epsilon$-ball never crosses the decision boundary, meaning the condition in line 3 of the code above is always true, $d(x,y)$ will accumulate $K$ times, and the value of $d(x,y)$ will be $K$, i.e., 10.\n\n[1] Yuval Netzer et al. Reading digits in natural images with unsupervised feature learning. 2011.\n\n[2] Ya Le et al. Tiny imagenet visual recognition challenge. In *CS 231N*, 2015.\n\n[3] Wei, Zeming et al. Cfa: Class-wise calibrated fair adversarial training. In *CVPR*, 2023.\n\n[4] Jingfeng Zhang et al. Geometry-aware instance-reweighted adversarial training. In *ICLR*, 2021."}, {"review_id": "QHYwtvXeP3", "reviewer": "Reviewer_5xrn", "summary": "This paper focuses on the issue of robust fairness in adversarial robustness distillation. This paper proposes the Fair Adversarial Robustness Distillation (Fair-ARD) framework, which utilizes a more refined difficulty metric and an adaptive class re-weighting approach, enabling the student model to learn the knowledge about each class in a fairer way. Extensive experiments confirm that Fair-ARD can significantly improve the robust fairness of the student model and slightly improve overall robustness.", "questions": "see weakness", "limitations": "see weakness", "rating": 5, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "+The main strength paper firstly investigates the issue of robust fairness in adversarial robustness distillation, and furthermore proposed a reweighting method to get a class-fair student model. \n\n+The paper is well-writing and easy to follow.\n", "weaknesses": "-The novelty is somewhat limited.  Robust fairness is widely studied in the adversarial training method (adversarial distillation is a type of variant to improve the robustness based on the adversarial training). In this regard, the originality of the research is limited.\n\n-The reweighting method toward different class is widely applied in adversarial training ([1], [2] as mentioned in article). More advanced state-of-the-art method (such as [3]) should be discussed and compared.\n\n-The metric to measure class difficulty is lack of theoretical basis. Directly applying the least PGD steps seem to not be a good estimate method. Different step size and steps num will lead to different results, e.g., Auto-PGD [4], and the similar idea is applied in AT (e.g. [2], [5]). If the least PGD steps is applied in reweighting and can really be helpful, a theoretical analysis is supposed to provide.\n\n[1] Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan Kankanhalli. 360 Geometry-aware instance-reweighted adversarial training. In ICLR, 2021.\n\n[2] Han Xu, Xiaorui Liu, Yaxin Li, Anil Jain, and Jiliang Tang. To be robust or to be fair: Towards 355 fairness in adversarial training. In ICML, 2021.\n\n[3] Wei, Zeming, et al. \"Cfa: Class-wise calibrated fair adversarial training.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023.\n\n[4] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an  ensemble of diverse parameter-free attacks. In International conference on machine learning, 362 pages 2206–2216. PMLR, 2020. \n\n[5] Xiaojun Jia, Yong Zhang, Baoyuan Wu, Ke Ma, Jue Wang, Xiaochun Cao; Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your constructive comments. We have taken great care to address all your concerns, providing necessary clarifications when needed. We genuinely hope that our responses comprehensively answer your questions.\n\n>**(Comment 1): The novelty is somewhat limited ...**\n\n**Answer 1:**\n\nTo begin with, you are correct that adversarial robust distillation (ARD) is an improvement based on adversarial training (AT). However, compared to existing works about AT, our novelty and originality are reflected in the following three aspects:\n\n**Firstly**, although ARD is an improved method based on AT, it significantly differs from AT. Such differences warrant special consideration for ARD.\n\n1) Their training processes are different. ARD achieves robustness by allowing the student model to mimic the teacher model's representations on adversarial examples, thereby transferring the teacher model's robustness to the student model [6]. In contrast, AT involves adversarial examples in the training process to enhance the model's robustness [7]. \n\n2) Their goals are different. ARD aims to improve the adversarial robustness of small models (e.g., ResNet18) for resource-constrained scenarios [6], while AT frequently uses relatively larger models (e.g., WRN34-10) [8]. And model capacity is a critical factor for robustness [1].\n\n3) Their considerations about robust fairness are different. For ARD, both the teacher model's robust fairness and the influence of distillation on the student's inherited fairness should be considered. In contrast, AT only needs to examine how the training process impacts the robust fairness of the model itself.\n\n**Secondly**, the robust fairness issue is important but **has not been studied in ARD**, and the terrible robust fairness of ARD may significantly hinder its application. To the best of our knowledge, **we are the first to investigate the issue of robust fairness in ARD**. We reveal that the student model can only partially inherit the teacher model's robust fairness and provide insights into the internal reasons.\n\n**Finally**, existing methods for improving robust fairness in AT do not perform as well when applied to ARD. In the discussion section of our paper, we have attempted to apply existing fair AT algorithms, such as FRL [2] and FAT [9], to ARD. Experimental results demonstrate that our Fair-ARD significantly outperforms these fair algorithms.\n\nTherefore, we believe that our work exhibits substantial novel contributions compared to prior works.\n\n[6] Goldblum, Micah et al. Adversarially robust distillation. In *AAAI*, 2020.\n\n[7] Aleksander Madry et al. Towards deep learning models resistant to adversarial attacks. In *ICLR*, 2018.\n\n[8] Boxi Wu et al. Do wider neural networks really help adversarial robustness? In *NeurIPS*, 2021.\n\n[9] Xinsong Ma et al. On the tradeoff between robustness and fairness. In *NeurIPS*, 2022.\n\n> **(Comment 2): More advanced state-of-the-art method (such as [3]) should be discussed and compared.**\n\n**Answer 2:**\n\nWe compare our method and CFA [3] across two dimensions: design and experimental performance.\n\n**Firstly**, our method diverges from CFA in three fundamental aspects:\n\n1) Different metrics for measuring class difficulty: CFA uses the model's robustness on each class as the difficulty metric, aligning with FRL [2] Example Difficulty (FED). Figure 2 of our paper depicts that our example difficulty metric LPS furnishes finer granularity than FED. So, our class difficulty measure $\\kappa$ provides more fine-grained estimates than the class-wise robustness used by CFA.\n\n2) Different reweighting functions: CFA applies a fractional function based on class difficulty, whereas we primarily use power functions for reweighting, and we discuss various types of reweighting functions in Appendix C.4. Based on the experimental results shown in the table below, it appears that our reweighting function might be more suitable.\n\n3) CFA utilizes exponential moving average (EMA), while Fair-ARD does not employ it.\n\n**Secondly**, we have compared Fair-ARD against CFA by implementing its method in ARD (CFA-ARD). As shown in the partial table below and the detailed Table 16 in the global rebuttal PDF, CFA has higher robust fairness than ARD, but CFA-ARD has lower robust fairness than Fair-ARD. This highlights Fair-ARD's strength in enhancing robust fairness. \n\n|Method|Clean Avg.|Clean Worst|AA Avg.|AA Worst|\n|:-:|:-:|:-:|:-:|:-:|\n|ARD|**83.22**|61.00|49.05|16.90|\n|CFA-ARD|82.00|62.30|**49.73**|20.00|\n|Fair-ARD (ours)|82.96|**68.10**|49.13|**29.20**|\n\n> **(Comment 3): The metric to measure class difficulty is lack of theoretical basis ...**\n\n**Answer 3:**\n\nAlthough our use of LPS (least PGD steps) lacks theoretical basis, empirical results demonstrate its efficacy. Firstly, GAIRAT [1] validated LPS for estimating difficulty. The left panel of Figure 3 shows more attackable examples with smaller LPS are closer to the decision boundary. Similarly, the right panel displays examples with smaller LPS values nearer the boundary. These trends affirm LPS as an effective difficulty metric. Furthermore, our extensive experiments exhibit Fair-ARD's robust fairness improvements over ARD, corroborating LPS's utility. Secondly, the PGD step size and number are fixed when computing LPS during adversarial example generation in our distillation process. This eliminates potential variations from differing step configurations, stabilizing the results.\n"}, {"review_id": "KThg2smItX", "reviewer": "Reviewer_3Z9v", "summary": "The paper addresses the issue of amplified class-imbalanced performance during adversarial robust distillation (ARD). The authors propose a fair-oriented ARD method that incorporates a class re-weighting mechanism for adversarial training. The method is applicable to various ARD techniques and consistently achieves success across different datasets.\n", "questions": "1. The term \"fairness\" has been overloaded in recent years. The authors seem to refer to the \"class-imbalance\" issue and evaluate it using \"minimax fairness.\" However, it is important to note that conventional fairness problems typically involve specified sensitive groups, which are orthogonal to predicted classes, and require multiple evaluation metrics such as demographic parity and equalized odds. It is recommended that the authors address more fairness topics in the paper, perhaps in the related work section, to provide clarity.\n\n2. The authors appear to have missed relevant related work, such as [B], which discusses fairness through robustness.\n\n[B] Nanda, Vedant, et al. \"Fairness through robustness: Investigating robustness disparity in deep learning.\" Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency. 2021.\n", "limitations": "Yes.\n", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper provides strong evidence (Fig. 1 and Tab. 1) to highlight the severity of the robust fairness (class-imbalanced adversarial robustness) issue.\n2. The proposed method is simple yet effective, as validated through extensive experiments.\n", "weaknesses": "1. The reviewer suggests investigating whether existing fair-oriented distillation methods can mitigate the robust fairness problem with slight modifications. For example, [A] addressed biased issues in standard knowledge distillation and conducted experiments on the CIFAR-10S dataset. It would be beneficial to discuss and compare these existing methods in this submission.\n\n2. Prior work [17, 29] has emphasized that average accuracy can be odd to fairness in both standard and adversarial robust settings. However, the experiments presented in Tab. 2, Tab. 4 of the main paper, as well as Tab. 7 and Tab. 8 in the supplementary material, show that the proposed method consistently achieves significantly better average scores while maintaining the best fairness scores, contrary to established theories. This raises concerns about the credibility of the experiments, and the reviewer requests an explanation for this phenomenon.\n\n[A] Jung, Sangwon, et al. \"Fair feature distillation for visual recognition.\" Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2021.\n\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your constructive comments. We have taken great care to address all your concerns, providing necessary clarifications when needed. We genuinely hope that our responses comprehensively answer your questions.\n\n> **(Comment 1): The reviewer suggests investigating whether existing fair-oriented distillation methods can mitigate the robust fairness problem with slight modifications. For example, [A] addressed biased issues in standard knowledge distillation and conducted experiments on the CIFAR-10S dataset.**\n\n**Answer 1:**\n\n**Firstly**, we will clarify the difference between fairness in existing fairness-oriented distillation methods and the fairness we are addressing.\n\n1) Their meanings differ. Prior work on fair distillation [A] aims to prevent discriminatory biases stemming from sensitive attributes. Our robust fairness focuses instead on minimizing differences in robustness across classes.\n\n2) Their metrics for measuring fairness differ. [A] measures fairness via equalized odds metrics $DEO_M$ and $DEO_A$ which account for sensitive attributes. In contrast, our metrics of the worst-class accuracy and NSD are solely based on model performance across classes.\n\n**Secondly**, we thoroughly investigated existing fair distillation methods to assess modifiability for addressing robust fairness. [A] proposes MMD-based Fair Distillation (MFD) to mitigate algorithmic bias via feature distillation. Unfortunately, without available open-source code, reproducing [A] was infeasible within the given timeframe. Nevertheless, we will include a detailed discussion of [A] and experimental results on adapted MFD for robust fairness improvements in the revision of our paper.\n\n> **(Comment 2): Prior work [17, 29] has emphasized that average accuracy can be odd to fairness in both standard and adversarial robust settings. However, the experiments presented in Tab. 2, Tab. 4 of the main paper, as well as Tab. 7 and Tab. 8 in the supplementary material, show that the proposed method consistently achieves significantly better average scores while maintaining the best fairness scores, contrary to established theories. This raises concerns about the credibility of the experiments, and the reviewer requests an explanation for this phenomenon.**\n\n**Answer 2:**\n\nAlthough prior work [17, 29] shows such a tradeoff between accuracy and fairness, we consider that the conclusions from these two studies may lack generalizability due to differences in settings compared to our work.\n\n**Firstly**, FRL [17] improves fairness but reduces average accuracy. However, [17] does not theoretically analyze whether average accuracy inherently causes fairness biases in standard and robust settings. Notably, CFA [C] improves both accuracy and fairness over FRL, indicating that the accuracy-fairness tradeoff may stem from the design of FRL rather than the relationships between accuracy and fairness. \n\n**Secondly**, [29] theoretically and empirically analyzed the robustness-fairness tradeoff. However, as shown in Tables 3 and 4 in [29], their FAT method attains superior robustness and robust fairness over Madry (SAT [18]), contradicting the proposed trade-off relationship. This discrepancy may arise from two factors: 1) Their theoretical analyses use simplified linear models, differing from large-scale deep neural networks. Thus conclusions may not extend. 2) The motivational experiments in [29] use inconsistent perturbation radii between training and testing, with training perturbation radii smaller than testing perturbation radii. This risks insufficient robustness gains, potentially restricting conclusion generalizability to standard equal perturbation settings. Therefore, the conclusion of [29] may not generalize to general settings.\n\n[C] Wei, Zeming et al. CFA: Class-wise calibrated fair adversarial training. In *CVPR*, 2023.\n\n> **(Comment 3): The term \"fairness\" has been overloaded in recent years. The authors seem to refer to the \"class-imbalance\" issue and evaluate it using \"minimax fairness.\" However, it is important to note that conventional fairness problems typically involve specified sensitive groups, which are orthogonal to predicted classes, and require multiple evaluation metrics such as demographic parity and equalized odds. It is recommended that the authors address more fairness topics in the paper, perhaps in the related work section, to provide clarity.**\n\n**Answer 3:**\n\nThank you for your valuable suggestions. We will add a detailed discussion on fairness topics in the related work section.\n\n**Firstly,** we clarify the distinction between our notion of robust fairness and conventional machine learning (ML) fairness. The robust fairness pertains to consistent predictive accuracy across classes under both standard and adversarial conditions [17]. In contrast, conventional ML fairness involves eliminating bias based on sensitive attributes like gender or race.\n\n**Secondly,** prior works have studied fairness in classification, e.g., equalized odds [D]. However, to the best of our knowledge, we are the first to investigate the problem of achieving adversarially robust fairness through knowledge distillation.\n\n[D] Hardt, Moritz et al. Equality of opportunity in supervised learning. In *NeurIPS*, 2016.\n\n> **(Comment 4): The authors appear to have missed relevant related work, such as [B], which discusses fairness through robustness.**\n\n**Answer 4:**\n\nThank you for your suggestion. We will discuss more related works, including [B], in the revision of our paper.\n\n[B] introduced the concept of robustness bias, pointing out that different classes of data should have the same robustness, but did not propose specific implementation methods. [B] also did not consider the impact of knowledge distillation on robust fairness. Furthermore, the fairness metrics used in [B] differ from ours. [B] uses their self-defined AUC, while we utilize the worst-class robustness and NSD."}]

Author rebuttal:
Figure 10: The weights of each class in Fair-ARD using ResNet18 on CIFAR-10 across epochs.

Table 14: The average (Avg.) and worst-class (Worst) robustness and their standard deviations for
various algorithms using ResNet18 on CIFAR-100.

Table 15: The average (Avg.) and worst-class (Worst) robustness for various algorithms and step
sizes using ResNet18 on CIFAR-10. The best results are **bolded**, and the second best results are
underlined.

Table 16: The average (Avg.) and worst-class (Worst) robustness for various algorithms using
ResNet18 on CIFAR-10. The best results are **bolded**.

Meta-review: All reviewers found the studied problem to be important, the proposed method to be effective, and the results promising. The rebuttal successfully addressed reviewer comments and all reviewers recommend acceptance. The authors are encouraged to improve the final paper version by following reviewer recommendations.
Decision: Accept (poster)