DAT: Improving Adversarial Robustness via Generative Amplitude Mix-up in Frequency Domain
Authors: Fengpeng Li
Kemou Li
Haiwei Wu
Jinyu Tian
Jiantao Zhou
Venue: NeurIPS 2024 poster (2024)
Keywords: Deep learning
Model robustness
Primary area: safety_in_machine_learning

Abstract: To protect deep neural networks (DNNs) from adversarial attacks, adversarial training (AT) is developed by incorporating adversarial examples (AEs) into model training. Recent studies show that adversarial attacks disproportionately impact the patterns within the phase of the sample's frequency spectrum---typically containing crucial semantic information---more than those in the amplitude, resulting in the model's erroneous categorization of AEs. We find that, by mixing the amplitude of training samples' frequency spectrum with those of distractor images for AT, the model can be guided to focus on phase patterns unaffected by adversarial perturbations. As a result, the model's robustness can be improved. Unfortunately, it is still challenging to select appropriate distractor images, which should mix the amplitude without affecting the phase patterns. To this end, in this paper, we propose an optimized **Adversarial Amplitude Generator (AAG)** to achieve a better tradeoff between improving the model's robustness and retaining phase patterns. Based on this generator, together with an efficient AE production procedure, we design a new **Dual Adversarial Training (DAT)** strategy. Experiments on various datasets show that our proposed DAT leads to significantly improved robustness against diverse adversarial attacks. The source code is available at https://github.com/Feng-peng-Li/DAT.

DAT: Improving Adversarial Robustness via Generative Amplitude Mix-up in Frequency Domain
Fengpeng Li'
Kemou Li
Haiwei Wu² Jinyu Tian
Jiantao Zhou
State Key Laboratory of Internet of Things for Smart City, University of Macau
DDeparmeent of Computer Science, City University of Hong Kong Faculty of Innovation Engineering, Macau University of Science and Technology
Abstract
To protect deep neural networks (DNNs) from adversarial attacks, adversarial training (AT) is developed by incorporating adversarial examples (AEs) into model training. Recent studies show that adversarial attacks disproportionately impact the patterns within the phase of the sample's frequency -peccrum-typically containing crucial semantic information- more than those in the amplitude, resulting in the model's erroneous categorization of AEs. We find that, by mixing the amplitude of training samples' frequency spectrum with those of distractor images for AT, the model can be guided to focus on phase patterns unaffected by adversarial perturbations. As result, the model's 's robustness can be improved. Unfortunately, it is still challenging to select appropriate distractor images, which should mix the amplitude without affecting the phase patterns. To this end, in this paper, we propose an optimized Adversarial Amplitude Generator (AAG) to achieve a better tradcoff between improving the model's 's robustness and retaining phase patterns. Based on this generator, together with an efficient AE production procedure, we design a new Dual Adversarial Training (DAT) strategy. Experiments on various datasets show that our proposed DAT leads to significantly improved robustness against diverse adversarial attacks. The source code is available at /ttps:// github. Cethuu.ccm/Font -eegg-eng--ae ppng-LiiDAA
Introduction
DNNs have been successfully applied to various tasks 21 32 25 However, recent studies reveal that DNNs vulnerable to adversarial examples (AEs), created by applying subtle yet deceptive adversarial perturbations to benign samples [40] 51]. Such vulnerabilities have sparked considerable interests, leading to the development of numerous adversarial attacks designed to deceive DNNs
Furthermore, serious concerns about the trustworthiness of artificial To mitigate these threats, adversarial training (AT) has been developed to enhance model robustness by incorporating
40
19
13
20 6
intelligence have been raised, due to these fundamental vulnerabilities 47 37
AEs into training through min-max strategy [40 61 38) Based the typical method, PGD-AT (see Appendix B for related works).
40 a variety of AT strategies have been devised 38 29 37
For image signals transformed into the frequency domain using, e.g. the discrete Fourier transform (DFT), several AT works (59 52 53 43) explore the adversarial attacks' behavior on sample's 's frequency spectrum. Frequency spectra consist of amplitude and phase; the amplitude typically captures stylistic information, whereas the phase encompasses richer semantics 77]. Recent studies [58 63 find, shown in Figure I that adversarial attacks often severely eliminate some semantics in the phase, making difficult for models to extract features for correctly predicting AEs, while the
*Corresponding author: Jiantao Zhou cechho@@um.dd...o
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

impacts on amplitude are relatively mild. Moreover, by forcing the model to focus on phase patterns, 63] confirm the model can learn more features unaffected by image corruptions, e.g., Gaussian noise and defocus blur, improving the model''s performance corrupted samples.
To explore the impact of ad- versarial perturbations on phase and amplitude patterns respec- tively, we conduct some stud- ies (see Sec. See. for for details). We find that the standard model trained without AT has worse performance samples with adversarial phase patterns than those with adversarial amplitude ones. Unlike the standard model, AT enhances the model's robust- ness against both phase- and amplitude-level adversarial per- turbations, with more notice- able improvement against adver- sarial perturbations on phase pat- terns. This indicates the potential for improving the model's 's robust-
Benign
Phase
Amplitude
Patterns
Spectrum
Patterns Spectrum
Figure 1: The adversarial perturbation severely damages phase patterns (especially in red rectangular) and the frequency spec- trum, while amplitude patterns are rarely impacted. The AE is generated by PGD-20 -b-uuddded with radius 8/255.
ness by focusing phase patterns unaffected by adversarial perturbations in AT. Then, by mixing the training samples' amplitude with randomly selected distractor, we observe that the robust model performance, particularly adversarial phase patterns, is further enhanced, without impacting that at adversarial amplitude ones. This demonstrates that training samples with mixed amplitude improve the model's performance on ABs, and maintain the model's robustness on amplitude-level
Inspired by these observations, we this work propose a new Dual Adversarial Training (DAT) strategy by focusing the phase patterns, with two adversarial procedures: adversarial amplitude generation and efficient AE production. Specifically, to guide the model to learn more phase patterns, first attempt mix the amplitude of training samples' frequency spectra with randomly selected distractor images. However, when the disparity between the distractor and the original image is too large, the recombined ones tend to disrupt original phase patterns, hindering the model from predicting AE correctly. Conversely, it is difficult for models to focus on phase patterns when the distractor closely resembles the original one 77 To tackle this challenge, we propose an optimized Adversarial Amplitude Generator (AAG) to synthesize an adversarial amplitude, maximizing the model loss and limiting the model fitting amplitude patterns, thereby the model focusing on phase patterns for convergence. During the training process, the AAG and robust model are optimized jointly with the original and recombined images, together with their AEs. The robust model undergoes training by empirical risk minimization, and maximizes the model loss to update the AAG adversarially. Experiments across various benchmarks against a range of adversarial attacks confirm the superior effectiveness of our proposed DAT, surpassing state-of-the of-thoofthe-art methods in robustness with big margins.
Contribution. The contributions of this work can be summarized
We verify that adversarial perturbations significantly influence phase patterns, resulting in the model's 's difficulty for predicting AEs correctly. Moreover, by mixing the amplitude of training image with that of a distractor, we find that the model robustness against AEs can be enhanced.
We propose the novel DAT strategy with an optimized AAG to synthesize an adversarial amplitude. With the AAG, we enforce the model to better focus on phase patterns, enhancing the model's robustness. Also, an efficient AE generation module is incorporated to improve the AT's efficiency.
Experiments on multiple datasets confirm that DAT significantly enhances the model's robustness against a variety of adversarial attacks. Specifically, DAT increases the model's robustness by ~2.1% on CIFAR-10, ~2.2% on CIFAR-100, and ~2.3% on Tiny ImageNet, on average.
Notation. Let = [(x, 94 } be a benign dataset comprising N samples from c classes, where each sample x; E X C xx is an image with C' channels, height H, and width W. and its label y1 E [c] {1, (l....,ch c). fo X Re denotes DNN function parameterized by 0 gd

---

80
80
80
Testing Accurscy
70- 60
70
Testing Accuracy 30
70
60
50
+
so
40
40
Testing
30
20-
10
PGD-20 C&W FAB Square Adversurial Attucks Adv Amp. Adv Pha.
PGD-20 C&W FAB Square
PGD-20 C&W FAB Square
Adversurial Attucks
Adversurial Attucks
Adv Amp. Adv Pha.
Adv Amp.
Adv Pha.
(a) Standard model
(b) Robust model
(c) Perturbed model
Figure 2: Test accuracy (%) on CIFAR-10 of (a) standard, (b) robust, and (c) amplitude- peruudeeppuurbbdd ResNet-18. 18. "Adv Amp./Pha. refers to -uump///ha AEs are generated by PGD-20, C&W oa. FAB, and Square, with -boudedd perturbation budget $/255 and inner step 2/255. The robust.
and perturbed models are trained by PGD-AT-10 following [40]
and Fo(x) = arg maX fo(x)y is the predicted label of x. Moreover, fo o h, where h the feature extractor and g is the classifier. Let H C Rm be the m-dimensional feature space, h4 : X' + R be a feature mapping function, and hxx [x) (x)x....,,,n.. feature map of x. Specifically, features induced from the amplitude and phase patterns of x are ha (x) and (x). respectively. Define S.[x] [x': ||x' - x oo & c} as an -ball centered on x with radius c. Let F(.) and (:).) denote the DFT and inverse DFT (IDFT) functions. Typically, DFT is independently applied to each channel of image within the pixel space as:
hm [x))) (x)]
E H denote the
H W
F(x)(u, = - x(h, w) -- (2
h=1w=1 m
where (h, w) denotes the pixel coordinates of x, and (u, v) E [H] [W] signifies coordinates in the frequency domain. The real and imaginary parts of F(x) are denoted by Re(F(x)) and (F(((x)), respectively. Then, the amplitude spectrum A(x) and phase spectrum P(x) are
A(x) = (Rex(F(x)) Imm (F(x))) P(x) = arctan Im(F(x))
(1)
Re(F(x))
2 Motivation: On Improving Adversarial Robustness in Frequency Domain
To investigate the approach enhance the model robustness and show the motivation of DAT, we perform exploration experiments in this section. As shown in Figure I adversarial perturbations severely compromise the semantics within phase patterns, resulting the difficulty of the model predicting AES correctly. Consequently, we examine the distinct effects of adversarial perturbations on amplitude and phase patterns. To achieve this target, we employ the standard and robust models, trained without and with AT as [40] on D, (the training subset of CIFAR- 10). Moreover, on training samples with perturbed amplitude, the model tends to focus on phase patterns, order to achieve convergence 7 588 Following this line, we discuss the impact of perturbing amplitude by mixing the amplitude training samples with those of distractors randomly selected from D.. For (x, v) Dr, the recombined sample x generated by amplitude-level mixing operations and IDFT, namely,
F= A(xo) (1 A) A(x),
Uniform 1),
where Xy is the distractor i.i.d. drawn from D,, We use (x, y) to construct dataset D, and train the perturbed model on it as 44) Then, for (x, y) E D. (the testing subset of CIFAR- 10), we generate AE x' by four representative adversarial attacks (PGD, C&W, FAB, and Square) and utilize DFT to derive the amplitude and phase of frequency spectra of both x and x'. Furthermore, images composed of adversarial amplitude/phase and benign phase/amplitude (denoted by X'mmp/ (xpha) are obtained by
Xamp = F (AAx'), P(x)), Xpha F (F-'(((x),, P(x')).
For each (x. y) De, with every adopted adversarial attack, use (x', y), (Xamps y) and (Xpha V) to combine evaluation datasets DAE Damp and Dpha. which are used to evaluate the robustness of
3

---

Adversarial
Benign
Generator
Recombined
AE &
fo(3]
X
(
A (kg)
N(0.
Px22)
+5gm
X,)
av
(Kk)
(1 Almor
(
8
LDT
Mrts
AL Generation
III. Joint Optimization
A
(1 Amir(( (c3)
Adversarial Amplitude Generation
A0
AL ix
x'
X
+ggn
Forward
Robust Model fe
AL
Generation
Backward
Figure 3: The overview of DAT, which consists of three stages: (I) adversarial amplitude generation, (II) AE generation, and (III) joint optimization.
the standard, robust, and perturbed models, respectively. The experimental outcomes are illustrated Figure 2 from which we can draw the following conclusion:
Impact Adversarial Attacks. As shown in Figure 2a under all four attacks, the standard model completely cannot predict samples in DAR Moreover, the standard model exhibits higher test accuracy on Damp than that on Dpha- These results suggest that adversarial attacks have a more substantial impact the phase patterns than amplitude ones.
Impact of AT. As depicted in Figure 2b AT simultancously enhances the model's performance on DAE and Damp and D pha. in comparison to the standard model. Notably, the robust model exhibits superior performance on Dpha over Damps contrary to the standard model. That indicates the AT helps the model learn robustness on both adversarial phase patterns and AEs. The phenomena indicate that by forcing the model focus on the phase patterns of samples, the model's robustness can be improved further.
phase patterns unaffected by adversarial attacks, enhancing the model's
Impact Mixing Amplitude. As shown in Figure 2c for the perturbed model trained with on Dr, compared with the robust one, its performance DAR and Dpha is improved further, while the performance on D Pomp is rarely changed. From these results, we can conclude that mixing the amplitude with that of the randomly selected distractor can force the model to focus phase patters,, learning more patterns within the phase unaffected by adversarial perturbations. Then, the model's robustness AEs is improved further, while robustness amplitude patterns is retained.
Following the insight from these studies, we propose DAT to enhance the model's 's robustness, mixing training sample's amplitude with an adversarial one, generated by the adversarially optimized AAG.
3 Methodology
In this section, the details of our proposed DAT are introduced and analyzed. As illustrated in Figure 3 DAT consists of three stages. It first adopts the AAG Ge to generate adversarial amplitude and obtain recombined data for benign ones Stage With the proposed loss LAE Stage II, we produce the AEs for both benign and recombined samples. Then, taking both benign and recombined samples, total loss LDAT for DAT are minimized to update robust model fo. and maximized to optimize G adversarially in Stage III. Stages and III involve the adversarially trained AAG G and commonly

---

updated model fo. both of which share the LDAT and optimized jointly following the objective as:
min E (x.0)>
max Bx- [CDAT (f +
(3)
where x is the recombined data of x. following a sample-dependent conditional distribution p( x, v)). Stage II encompasses efficient AE generation method, optimized using the proposed loss CAE as:
max (xx,))> (fxe(f((x)) fo (xx), y.))
x x'ES
Following the order of these three stages, we introduce (I) AAG in Sec. 3.1 and (II) the efficient AE generation in Sec. 3.2 Subsequently, building on these components, Sec. 3.3 details (III) the joint optimization. Ultimately, Sec. Sec.33.4 theoretically analyzes the mechanism of how the adversarial
amplitude spectrum generated by AAG enforces the model to focus on the phase-level patterns.
3.1 Adversarial Amplitude Generator
To explain the proposed AAG, we first introduce some constraints that the recombined & with perturbed amplitude is expected to meet. With a small 6 > and an 62 > 61, ideally, we expect & of (xx y) D based the generated adversarial amplitude to satisfy the following three conditions:
C1. [x)(x) h*(()]
61 Ensuring retains the same semantics in the phase spectrum as x.
C2. Fx(x) = (8): Ensuring & remains distinguishable with the same label as x by fe. C3. [x) ha. (8)1 e2:
Making & maximize the LDAT, causing the model's difficulty fitting the amplitude of images, and forcing the model to focus on phase patterns.
Let us first analyze the above conditions C1-C3 when randomly selected distractor image is used. Since is recombined by the mixed amplitude with the distractor and original phase of x, then, C1 can be easily satisfied. As stated in Sec. [ when the gap between the randomly selected distractor and training sample is too large, the P(x) (ix)'s information can damaged, resulting the inconsistent prediction between the x and &, destroying the C1 and C2. Conversely, it is difficult to satisfy C3, limiting the model's Is attention to the patterns in Pxx). The above statement indicates that it is difficult for & using the amplitude of the randomly selected distractor, to meet the above three constraints.
Instead of searching for an appropriate distractor, we here resort to generative approach, i.e.. developing G to generate an adversarial amplitude Ax(x) as
Ax (z, fo(x)), where z ~ WO I).
For efficient training, Gup is constructed by four linear layers (detailed architecture Appendix E.22p. Moreover, the input with fx) can case the difficulty of G. convergence. With Gvp, since & is still recombined by Ac(x) and the P(x), then, C1 is satisfied. For the outer minimization in Eq. (3). we retain the label of & same as minimizing LDAT update fe. meeting the C2. To meets C3, Gop is optimized adversarially by maximizing the LDAT (further details in Sec. B.3), shown as the inner step in Eq. 33). Thereby, & can limit fo to fit amplitude information. To achieve the convergence, fo has to focus on patterns in (xx), learning more phase patterns unaffected by adversarial perturbations.
Since G is adversarially trained by maximizing the LDAT Aa(x) is likely to compromise semantic integrity [33, hindering So to retain the prediction consistency between & and x 31 Moreover, due to the loss of original amplitude information, using (a(x) to replace A(x) entirely can also hurt the model's 's robustness [58). As shown in Sec. 2 the mix-up operation on amplitude rarely has impact on the amplitude level robustness. That indicates the linear mix-up operation can preserve the energy of the amplitude spectrum and maintain the original amplitude information with less impact on the sample's 's original information. Otherwise, the original amplitude could be compromised, thereby hindering accurate model predictions. Following this line, a mix-up operation is employed, ensuring that portion of the original amplitude information is preserved following:
Amin (x) = X AG(x) + (1 A) A(x), where À ~ 21(0 1).
The mix-up operation effecttiely satisfies C1 and C2, ensuring & remains distinguishable by fe. and keeping P(x)'s patterns closer to those in P(x) in manifold. Finally, & is obtained by IDFT as
- F= (x). P(x)).
To elaborate on Gep: we perform some experiments and provide visual results in Appendixes and F7 Now use & augmentation of x, introduced to Stage II for generating AEs.
5

---

3.2 Efficient Adversarial Example Generation
Since both x and x are fed into Stage for generating AE, it doubles the time consumption if we use the same AE generation strategies as existing methods, e.g., PGD-AT [40] and TRADES [39]. To improve the training efficiency of DAT, we now suggest an efficient AE generation strategy. Since simply reducing the iteration step results in the difficulty of AEs' reaching the actual maximum in the -aa-ball 49 we propose the loss CAE to increase adversarial perturbation length in each iteration as
(AE(So(X), (x('x), fo
y)
(C y) + 3 'KL (Jo(x'); (x))),
(5)
where 3 is a weighting parameter, and Lce and DKL cross-entropy (CE) loss and Kullback-Leibler (KL) divergence. According to [49 [0], it is effective to enlarge adversarial perturbation length for each step by maximizing the distance between (x) and fe (x'). Following this line, based on PGD-AT maximizing the LCE, the proposed LAE increases the adversarial perturbation step length by maximizing the KL. divergence between benign sample and its AE. Then, with LAE, ABs can use fewer iterative steps to achieve the actual maximum in the -bll. As shown by experiments in Appendix F.3 DAT only needs 5 steps to generate AEs for both benign x and recombined x', significantly reducing the training time while maintaining the model's robustness. Enlarging the inner step size a (in Eq. (T0 of Appendix (B.3) can also increase the adversarial perturbation length in each iteration. Due to the fact that the current AT methods typically employ a fixed a, we adopt an extra loss term for fair experimental comparisons. More details on the AE generation procedure, including pseudocodes and experimental analyses, are in Appendixes A.1 F.3 and F.5
With the AAG and efficient AE generation, Stage III attempts to improve the model's robustness.
3.3 Joint Optimization
After the introduction Stages and II, we now delve into specifics of Stage III, joint optimization, where le and G are optimized jointly following the objective as Eq. (3). In Stage III, to satisfy C2 in Sec. 3.1 keeping & with the same label x by So. recombined and benign samples and their AEs are fed into DAT for the model training, also reducing the negative impact of amplitude information loss. Moreover, LDAT needs to be minimized on benign and recombined samples' AEs enhance the robustness of fe. enforcing fe to focus on the phase patterns in the meanwhile. For commonly updating and adversarially renewing ab, we introduce the designed loss terms LDTT as:
CDAT (x) fo()), y) = 1 ())
([AA((((()))
+ (AT( v)) + w (os(Jo(x),So(8)) (6)
where LAT and Jss are adversarial training and consistency regularization losses respectively, and w is the weighting parameter for Djs. We discuss LAT and DJs below separately.
Adversarial Training Loss LAT. LAT is the loss used to guide fe to learn robust features on AEs against adversarial attacks. As shown in Figure although adversarial perturbations significantly damage phase patterns, there are still some unaffected features in the phase of AEs, important for fo to categorize AEs correctly. Since these unaffected phase patterns contain adversarial perturbations, it is difficult for fo to learn these features only with AEs. Therefore, we utilize benign samples and their AEs in AT, guiding the model to learn their shared features, significant for improving fo robustness. Following this line, LAT for (x, u) E 'D with AE x' can be expressed as:
(fo()) y) = (CE(Jo v) + 3 DKL [xo(x')
where 3 is the weighting parameter identical to that in Eq. (5) x adopts the same AT loss as that x.
Consistency Regularization Loss Djs- DJs is the loss used to preserve the prediction consistency between x and x. In DAT, the amplitude of x frequency spectrum mixed with the adversarial one generated by G maximizing LDAT, showing the large gap between (x) and ha (x). Since & has the same phase patterns as x, keeping the prediction consistency between x and & can make the model learn more phase patterns further, enhancing the model's robustness. Inspired by the mechanism, we use the Jehsen-Shannon (JS) divergence Djs to ensure the prediction consistency as:
Dis(fe(x), (o()(x))fo()))) fo()) = 1 (Dia fo(x) + fo()) 2
fo(()) + DKL fo(x) + so()) fo(x)))
(7)
2
2
This concludes the introduction to LDAT- Notably, during the model training of DAT, the gap of batch normalization (BN) parameters between x and & is quite large (details in Appendix D). posing challenges to model's convergence. To remedy this, we adopt different BNs for x and x during training. Please refer to the pscudocode of DAT in Appendix A.2 for comprehensive presentation.

---

3,4 Theoretical Analysis
Through a convergence analysis of the empirical risk, this section theoretically discusses the effects of DAT on the model to focus on phase patterns. Detailed proofs are provided in Appendix G Concretely, we instantiate g as a linear softmax classifier W [W1:-.. .... Wel E Rm on top of the learned features h. Generally, for (x, y) 'D, suppose (xx) represents the augmented distribution over data points, where x can be transformed as anyone in (x, x', &,*), x'). Then, the augmented data for x can be denoted as t(xx ~ T(x). Since the augmentation will increase the discrepancy between original and augmented distributions w.h.p., we can establish common assumption.
O is relatively large value. Since only the amplitude spectrum is perturbed in the proposed DAT, it reasonable that
Assumption 3.1. Assume 1 - h(x)ll) > Eg. where
Er(lha(t(x)) (x)]]] > [T(lsp(((x)) - (x)]])
Theorem 3.2 (Weight Regularization of Amplitude Features). Grant Assumption 3.1 when the empirical risk is minimized with some convex loss function & (e.g. CE loss):
R(W)
Σ
[(x))T())) [ (W h(((()).))]
D
(X.))ED
we have Wjaa + 0 for all j E [c]. where Wiaa is the corresponding weights of amplitude features ha- Corollary 3.3. Suppose the predicted probability fw(x) = [Pi..... where
exp(w,Th h) Pt Ej- exp(w) h) Ej= exp((w, w;)
For every i,j [c), we have (Wi,a W1aa)ha 0.
Remark. Theorem 3.2 suggests that for weights Wjoa corresponding to features ha derived from
amplitude pattern, minimizing the empirical risk î regularizes it to O. As a result, it is difficult for the model to fit the adversarial amplitude generated by AAG. In order to converge, the model needs to reduce the reliance on h. by restricting Wja. Hence, the model would mitigate the impact of h., the predicted labels, as shown in Corollary [.3 and pay more attention to features h, derived from phase patterns, capturing more phase patterns unaffected by adversarial attacks. Therefore, verify the effectiveness of DAT enhancing the model's ' robustness.
Experiments
In this section, we perform experiments to verify the effectiveness of DAT and explore the function of some DAT's parts. Sec. [. shows experimental setups. Sec. 4.2 compares the model's robustness with existing AT methods with fixed and a. Sec. 4.3 compares DAT with existing AT methods over
complex strategy, e.g., AWP and SWA. Sec. 4.4 presents the analysis of ablation studies.
4.1 Experimental Setup
Experimental and Evaluation Settings. We select three datasets: CIFAR-10, CIFAR-100, and Tiny ImageNet [17]. For all experiments in this work, ResNet-18, WideResNet-28-10 (WRN-28-10), and WideResNet-34-11 (WRN-34-10) are used as model architectures (experiments are attached to Appendix F.I). with 15 and 2 (exploration in Appendix F.4). During training, the inner step size is fixed as a 2/255 to generate adversarial perturbation l. bounded with constant radius
8/255 following 29
33
(details in Appendixes E.1 and E.2h
Baselines. We compare results with PGD-AT 44)
TRADES 61]. MART 54 and recent AT SCARL 33 and ST
methods with competitive performance: LAS-AT (29
37. We also compare
the DAT with OA-AT (2). DAJAT [Л. and IDBH 355
which uses extra strategies, egg., AWP [56
and SWA 28 Introduction and details of baselines are attached in Appendixes B.2 and B.3
4.2 Comparison with Common Methods
In this subsection, we compare the robustness of DAT with common methods that use fixed and during the training procedure. Table displays the results CIFAR-10, CIFAR- 100, and
7

---

Table 1: Average natural and robust accuracy (%) of ResNett against & threat with runs. The best results are boldfaced.
8/255 in
Natural
PGD-20
C&W 0c
PGID-T
40
82.78-0.112
56.94+0.17
51.30+0.16
50.88+0.26
49.72-40.24
47.63-0.088
TRADES 61
82.41-0.P5 12
58.47-0.19
52.76=00.88
52.47=0.13
50.43+0.17
49.37=0.08
MART
80.70+0.17
58.91+0.24
54.02=0.29
53.38+0.30
49.35+00.77
47.49=0.23
83.10:1.110
59.4210.22
54.5310.14
54.3110.17
51.3510.21
50.51=0.17
CIFAR-I0
SCARL 33
80.67+00.31
58.32+0.13
54.24=0.17
54.10+0.13
51.9330.115
50,45=0.11
DAT (Ours)
84.17+0.221
62.06--0.19
57.55 0.15
57.47
5..59
$1,36 0.14
TRADES+AWP
81.16:0.12
57.8610.14
54.56=0.06
54.4540.14
50.9540.12
50.31
AWP
81,46-0.115
59.26+00.16
55.38+0.14
55.274-0.33
52.15+0.115
51.08+0.11
DAT+AWP (Ours)
82.63:10.15
62.7811.21
58.87=0.12
58.7810.155
52.8810.21
02.54
PGD-AT 40
$7.2740.21
318110.11
08.6610.11
28.4910.16
26.89-1.008
24.60=0.04
TRADES
57.9410.15
32.37+0.18
29.25=0.118
29.10+:.20
20.8
24.71=0.04
MART 54
55.0340.110
33.1220.226
30.32-0.188
30.2010.17
26.6010.11
25.13
ST
58.44 12
33.3540..2
30.53-0.133
30.39++0.17
26. 70
25.61=0.00
CIFAR-100
SCARL
57.63+0.11
33.14+0.19
30.83:0.24
30.77++.211
26.86+00.16
25.82:#0.19
DAT (Ours)
62.57:0.117
36.6310.112
33.37=00115
33,15:00122
28.3410.14
27.11=0.155
TRADES+AWP
58.76+00077
33.82+0.15
31,53+0.14
31.42+0.12
27.03+0.16
26.06=0.112
SCARL+AWP
58.3640.12 12
34.2540.14
32.32-0.14
32.2641.133
27.9240.11
26.83=00.15
DAT+AWP (Ours)
63.2810.11
38.2210.14
35.29
35.18:0.122
29.4310.17
2.10
PGD-AT
AD
46.3620.22
23.49-0.39
20.41=0.299
20.35+0.37
17.86+0.228
14.46=0.31
TRADES
6
43.65+0.35
21.3710488
18.62-0.44
18.5630.33
15.38
13.32=0.41
LAS-AT
29
45.27440.35
24.6440.24
21.82-0.27
21.72-40.2
18.07-40.25
16.25-+0222
Tiny ImageNet
SCARL
33
49.75=00.17
25.52+0.16
22.64=0.11
22.58+00118
18.77=0..27
16.31=0.14
DAT (Ours)
52.4510.21
28.4510.155
25.47-0.12
25.3610.14
20.39:10.17
17.51
TRADES+AWP
46.64+0..55
26.58+0.19
22.31=0.20
22.28+0.12
17.84+0.11
15.34=0.12
LAS-AT+AWP
13.8510.13
25.7610.11
23.3010.11
23.0540.15
19.6810.11
17.98=0.15
DAT+AWP (Ours)
53.2910..25
30.9110.11
27.25-0.133
27.18100.16
22.12:10112
19.29-0.13
Table 2: Average natural and robust accuracy (%) of WRN-34-10 against &o threat with 6 = 6/255 in
7 runs. The best results are boldfaced.
DATASET
CIFAR-10
CIFAR-100
METHOD
Natural
PGD-100
C&W
Natural
PGD-100
C&W
PGD-AT
85.37=0.74
54.61:0.68
53.42:0822
52.03=20668
60.63:11.17
30.83=0.51
30.21:0..3
27.93=00.57
TRADES
61
85.54-0..59
56.04-+0.45
53.91+00.66
53.37+00511
61.26-0038
33.11-0.42
30.24+0.58
28.12+0.62
MAKT
13:0322
58.7240.66
53.0240.37
51.61:2048
60:52:0.22
32,34=062
29.07#0.43
25.91=0.36
LAS-AT AT
29
86.0720.31
55.9710.47
55.4910.54
53.34.1.42
61.8710.57
32:21-0.45
30.4710..34
28.9110.399
84.41=0.255
57.8110065
54.37:10.29
62.4120.36
34.19=0.46
30.5320.31
29.52=0.33
DAT (Ours)
86.78
61.32.10244
57.62.10.34
56.46.10.33
64.53.0.25
36.75 0.43
32.2110.27
30.7910.17
Tiny ImageNet using ResNet-18. Compared with existing methods, DAT not only improves the model's robustness but also enhances the natural accuracy. On CIFAR-10, DAT achieves an average improvement of ~2.9% against FGSM, PGD-20, and PGD-100. For challenging C&W and AA. DAT obtains ~0.66% and ~0.85% improvement, respectively. Specifically, since SCARL adopts contrastive learning strategy, DAT achieves less improvement against C&W oo compared to CIFAR- 100 contains more classes but fewer samples for each class, thereby making it challenging for AT. DAT enhances the model's robustness by ~2.7% on average against FGSM, PGD-20, and PGD-100 compared to the existing methods. For the demanding C&W no and AA, the model's robustness is improved by 1.55% and 1..3% DAT achieves ~2.9% better performance against FGSM, PGD-20, and 100-100. For the challenging C&W and AA, we enhance the model's robustness by ~1.6% and 1.2%. AWP is proved to be an effective method for protecting the model from robust overfitting. To further improve the model's robustness, we combine DAT with AWP, and compare the performance with the combination of various existing methods and AWP fairly. Since few methods provide the codes for the combination with AWP, we choose only these methods for comparison. As shown in Table I the combination of DAT and AWP improves the model's ''' robustness further and still outperforms previous methods.
intricate real-world dataset Tiny ImageNet,
Large-capacity models usually have better adversarial robustness. Thus, we also perform comparative experiments using 1R0-34-10 on CIFAR-10 10 and CIFAR-100, as shown in Table 2 Compared to existing methods, DAT still retains better performance and has lower negative impact on the model's 's natural accuracy, achieving ~1.51 ~0.63%, and ~1.31 % robust accuracy improvement

---

Table 3: The average experimental results for methods with complex strategies against Eo threat model with c = 8/255 in runs. The best results are boldfaced.
ARCHTECTURE
R8
WRN-34-10
METHOD
DATASET
CIFAR-10
CIFAR-100
CIFAR-10
CIFAR-1O0
PGD 20
PGD 20
PGD-20
AA
PGD-20 20
AA
TRADES+AWP
06.56=0006
50.3110.10
31.3320.11
26.06:0.122
39,2649.24
55.28-0.21
34.4820.26
29.7420.21
TRADES&AWPLSWE
55.21-0.24
11.14+0.15
51,72+0.25
2621+0.15
60.25-0.36
55.37-0.15
35.16-0.25
29.92+0.16
(SWAvarisble
56.47_0.37
50.8310.24
32.6810:25
26.6.10.66
57.91.0.88
36.1810.27
30.3510.233
DAJAI (AWPsSWA &el
56,52=0447
51.5500.26
32.9200.32
27.350029
62.34:0.255
56.02-023
37.050:114
31.5140117
IDHF (AWP-
52: 02.31+0.266
51.67+0.27
17.86+0.0
67.6-0026
36.46-0.25
31.34+0.22
DAT+AWP (Ouns)
98.57 0.14
52.54100.12
35.2910.13
28.09
63,3410.188
57.96 0.16
3.11
316210.12
DAT-AWP-SWA (Ours)
58.84 9.16
52.76.0..14
35.47.0..11
00.3
63.65.0.19
58.12 0.18
38.59 0.16
318110.12
Table 4: Results of ablation studies with ResNet-18 against &oo with
$/255 average in 7 runs.
DATASET
CIFAR-10
CIFAR-100 100
METHOD
Natural
PGD-20
AA
Natural
PGD-20
AA
Baseline
02.47
52.76+00.51
49.52=+0.2
58527=0.52
29.89-0.58
24.92-t0.39
DAT w/o Das
83.76=0.49
57.06-10.51
51.25:1..22
60492-0.46
32.83=0.47
26.53:1.228
DAT w/o Mix-up
81.45=0.49
55.64=0.54
50.13+0.35
59.84=0.42
30.83=0.46
25.41=0.229
DAT w/o Split BN
82.37-0.43
53.07-00.53
46.53+00.2
56.51-0.55
28.47-0.34
24.91+0.39
DAT w/o AAG
83.41-0.35
55.32-+0.62
49.81+0031
62.19-0.73
30.27-0066
25.82++0.42
DAT
84.17=0.21
57.55-10.15
51.36:10.14
62.57=0.17
33.37-0015
27.11-00115
on CIFAR-I0 with WRN-34-10. On CIFAR-100, the robustness obtained by DAT is enhanced by 2..66% ~1.68% and ~1.27%, showing significant improvement compared to existing methods.
4.3 Comparison with Complex Strategy Based Methods
After the comparison of common methods, we then demonstrate the performance of some existing methods with extra strategies, e,g., AWP and SWA. Addepalli et al. [I] find that variable and a can enhance the model's robustness, and some methods using variable and a (e.g., DAJAT, OA-AT, and IDBH) obtain competitive performance against various adversarial attacks. To further verify the effectiveness of DAT, we compare it with the latest competitive methods, e.g., DAJAT with one augmentation, OA-AT and IDBH, see Appendix B.2] As shown in Table 3 fixing e = $/253 and = 2/255, we combine DAT with AWP and SWA. Compared with IDBH, on CIFAR-10 with ResNet- 18 and WRN-34-10 10, DAT with AWP and SWA achieves robust improvement ~ ~ 1.36% and ~1.18% against PGD-20, and ~0.45% and ~0.488 against AA. For complex CIFAR-100 with ResNet-18 18 and 100.-34-10, compared with the previous best method, our method obtain ~1.8% and 11.54% improvement against PGD-20, and ~0.45% and ~0.30% enhancement against AA. Additionally, we perform with synthesized data and augmentation strategies, attached in Appendixes F. and F.2
4.4 Ablation Study
Through experiments on CIFAR-10 and CIFAR-100, this subsection discusses the impact of different components in DAT the model's natural accuracy and robustness against PGD-20 and AA. As shown in Table we use the model with the proposed AE generation method without recombined data as the baseline. Compared with complete DAT, the robustness decreased ~0.3% and ~0.5% on CIFAR-10 and CIFAR-100 without Djs. Due to DJs keeping the predictions consistent between the benign and recombined data, removing Djs makes the model learn less unaffected phase patterns and thus reduces the robust performance. As mentioned in Sec. B. the mix-up operation combines the generated adversarial and original amplitude spectrum. Since the model still needs some original amplitude information, Table 4 shows that replacing the original amplitude spectrum with the generated one drops ~ 1.6% and ~1.9% model's robustness on CIFAR- 10 and CIFAR-100, due to damaging original phase patterns. As mentioned in Sec. 333] the gap of BN parameters between original and recombined data is quite large. Without split BNs, the robustness of the model is reduced ~4.6% and ~3.5% on CIFAR-10 and CIFAR- 100, showing that the model robustness is significantly affected because of the convergence difficulty. For experiments without AAG, we mix the amplitude of training sample's frequency spectra as Sec. Table 4 shows the selected amplitude does not severely reduce the natural accuracy but significantly decreases robustness ~1.6% and 22.% on CIFAR-10 10 and CIFAR-100 100, confirming the effectiveness of AAG. To comprchensively

---

explore the effectiveness of AAG, we combine AAG with some existing AT methods on ResNet- 18, see Appendixes F.6 and Additionally, we compare the time consumption Appendix F3
Conclusion
This work presents novel Dual Adversarial Training (DAT) method improve adversarial robust- ness against various adversarial attacks. We first illustrate the motivation through some exploration experiments. Subsequently, we delve into the efficient and effective DAT, discussing both its under- lying motivation and detailed mechanics. Additionally, we theoretically validate the functionality of the Adversarial Amplitude Generator (AAG) and the convergence properties of the DAT model. Through experiments across multiple datasets against various adversarial attacks, we verify that the proposed DAT significantly improves model robustness. We also explore the hyper-parameters and discuss the function of specific components of DAT. In the future, we will design a more suitable amplitude generation and augmentation strategy to enhance robustness further.
Acknowledgements
This work was supported in part by Macau Science and Technology Development Fund under MLLITTSC--021-22233 0072/2020/AMJ, 0022/2022/A, and 0014/2022/AFI; in part by Research Committee at University of Macau under MYRG-GRG2023-0005 SONO8--FST-UMDF and MYRG2022- 00152-FST; in part by Natural Science Foundation of Guangdong Province of China under EF2023- 00116-FST; in part by the Natural Science Foundation China under Grant 62202009.
References
[1] Sravanti Addepalli, Samyak Jain, and Venkatesh Babu R. Efficient and effective augmentation strategy for adversarial training. In Proceedings of NeurlPS, November 28 December 9, 2022, New Orleans, LA, USA, pages 1488-1501, 2022.
[2] Sravanti Addepalli, Samyak Jain, Gaurang Sriramanan, and R. Venkatesh Babu. Scaling adversarial training to large perturbation bounds. In Proceedings of ECCV, October 23-27, 2022, Tel Aviv, Israel, pages 301-316, 2022.
[3] Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: query-efficient black-box adversarial attack via random search. In Proceedings of ECCV, August 23-28, 2020, Glasgow, UK, pages 484-501, 2020.
[4] Jiawang Bai, Bin Chen, Yiming Li, Dongxian Wu, Weiwei Guo, Shu-Tao Xia, and En-Hui Yang. Targeted attack for deep hashing based retrieval. Proceedings of ECCV, August 23-28, 2020, Glasgow, UK, pages 618-634, 2020.
[5] Jiawang Bai, Baoyuan Wu, Yong Zhang, Yiming Li, Zhifeng Li, and Shu-Tao Xia. Targeted attack against deep neural networks via flipping limited weight bits. In Proceedings of ICLR, May 3-7, 2021, Virtual Event, Austria, 2021.
[6] Yang Bai, Yuyuan Zeng. Yong Jiang, Shu-Tao Xia, Xingjun Ma, and Yisen Wang. Improving adversarial robustness via -hannel-wise activation suppressing, In Proceedings of ICLR, May 3-7, 2021, Virtual Event, Austria, 2021.
[7] Guangyao Chen, Peixi Peng, Li Ma, Jia Li. Lin Du, and Yonghong Tian. Amplitude-phart recombination: Rethinking robustness of convolutional neural networks in frequency domain. In Proceedings of ICCV, October 10-17, 2021, Montreal, QC, Canada, pages 448-457, 2021.
[8] Huanran Chen, Yichi Zhang, Yinpeng Dong, and Jun Zhu. Rethinking model ensemble in transfer-based adversarial attacks. CoRR, abs/2303.091000 2023.
[9] Pin- Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. Z0O: zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In Proceedings of AlSec @ CCS, November 3, 2017, Dallas, TX, USA, pages 15-26, 2017.
10

---

[10] Shuyu Cheng. Yinpeng Dong, Tianyu Pang. Hang Su, and Jun Zhu. Improving Dlack-box adversarial attacks with transfer-based prior. In Proceedings of NeurIPS, December 8- 14, 2019, Vancouver, BC, Canada, pages 10932-10942, 2019.
[11] Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang. Prateek Mittal, and Matthias Hein. Robustbench: standardized adversarial robustmess benchmark. arXiv preprint arXiv:2010.0963 2020.
[12] Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with a fast adaptive boundary attack. In Proceedings of ICML, July 13-18, 2020, Virtual Event, pages 2196 2205, 2020.
[13] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In Proceedings of ICML, July 13-18, 2020, Virtual Event, pages 2206-2216, 2020.
[14] Ekin D. Cubuk, Barret Zoph, Dandelion Mané, Vijay Vasudevan, and Quoc V. Le. Autoaugment: Learning augmentation strategies from data. In Proceedings CVPR, June 16-20, 2019, Long Beach, CA, USA, pages 113-123, 2019.
[15] Jiequan Cui, Zhuotao Tian, Zhisheng Zhong, Xiaojuan Qi, Bei Yu, and Hanwang Zhang. Decoupled kullback-leibler divergence loss. CoRR, hass23055.13453 2023.
[16] Tri Dao, Albert Gu, Alexander Ratner, Virginia Smith, Chris De Sa, and Christopher Ré. A kernel theory of modern data augmentation. In Proceedings of ICML, June 9-15, 2019, Long Beach, California, USA, pages 1528 1537, 2019.
[17] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hicrarchical image database. In Proceedings of CVPR, June 20-25, 2009, Miami, Florida, USA, pages 248-255, 2009.
[18] Terrance Devries and Graham W. Taylor. Improved regularization of convolutional neural networks with cutout. CoRR, abs/ 045552, 2017.
[19] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In Proceedings of CVPR, June 18-22, 2018, Salr Lake City, UT, USA, pages 9185-9193, 2018.
[20] Yanbo Fan, Baoyuan Wu, Tuanhui Li, Yong Zhang, Mingyang Li, Zhifeng Li, and Yujiu Yang. Sparse adversarial attack via perturbation factorization. In Proceedings of ECCV, August 23-28, 2020, Glasgow, UK, pages 35-50, 2020.
[21] Ross Girshick. Fast r-cnn. Proceedings of the CVPR, June 7-12, 2015, Boston, MA, USA. pages 1440-1448, 2015.
[22] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adver- sarial examples. In Proceedings of ICLR, May 7-9, 2015, San Diego, CA, USA, 2015.
[23] Sven Gowal, Sylvestre-Alvise Rebuffi, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy A. Mann. Improving robustness using generated data. In Proceedings of NeurlPS, December 6-14, 2021, virtual, pages 4218 4233, 2021.
[24] Yiwen Guo, Qizhang Li, and Hao Chen. Backpropagating linearly improves transferability of adversarial examples. In Proceedings of NeurlPS, December 6-12, 2020, virtual, 2020.
[25] Kaiming He, Georgia Gkioxari, Piotr Dollár, and Ross Girshick. Mask r-cnn. In Proceedings of the ICCV, October 22-29, 2017, Venice, Italy, pages 2961-2969, 2017.
[26] Zhuoxun He, Lingxi Xie, Xin Chen, Ya Zhang, Yanfeng Wang, and Qi Tian. Data augmen- tation revisited: Rethinking the distribution gap between clean and augmented data. CoRR, Abs/1999.091 148, 2019.
[27] Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. In Proceedings of ICMI, July 10-15, 2018 Stockholmsmüss san, Stockholm, Sweden, pages 2142-2151, 2018.

---

[28] Pavel Izmailov, Dmitrii Podoprikhin, Timur Garipov, Dmitry P. Vetrov, and Andrew Gordon Wilson, Averaging weights leads to wider optima and better generalization. In Proceedings of UAI, August 6- 10, 2018, Monterey, California, USA, pages 876-885, 2018.
[29] Xiaojun Jia, Yong Zhang, Baoyuan Wu, Ke Ma, Jue Wang, and Xiaochun Cao. LAS-AT: adversarial training with learnable attack strategy. In Proceedings of CVPR, June 18-24, 2022, New Orleans, LA, USA, pages 13388-13398, 2022.
[30] Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine. Elucidating the design space of diffusion-based generative models. In Proceedings of NeurIPS, November 28 December 9, 2022, New Orleans. LA, USA, pages 26565 (6665,2677,220 2022.
[31] Minyoung Kim, Da Li, and Timothy M. Hospedales. Domain generalisation via domain adaptation: An adversarial fourier amplitude approach. In Proceedings of ICLR, May 1-5, 2023, Kigali, Rwanda, 2023.
[32] Alex Krizhevsky, Ila Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks. Commun. ACM, 60(6):84-90, 2017.
[33] Huafeng Kuang, Hong Liu, Yongjian Wu, and Rongrong Ji. Semantically consistent visual representation for adversarial robustness. IEEE Trans. Inf. Forensics Secur. 18:5608-5622, 2023.
[34] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial intelligence safety and security, pages 99-112. Chapman and Hall/CRC, 2018.
[35] Lin Li and Michael W. Spratling. Data augmentation alone can improve adversarial training. ArXiv, abs/2301 0.9799, 2023.
[36] Qizhang Li, Yiwen Guo, and Hao Chen. Practical no-box adversarial attacks against DNNs. In Proceedings of NeurlPS, December 6-12, 2020, virtual, 2020.
[37] Qizhang Li, Yiwen Guo, Wangmeng Zuo, and Hao Chen. Squeeze training for adversarial robustness. In Proceedings of ICLR, May 1-5, 2023, Kigali, Rwanda, 2023.
[38] Xin Li, Yao Qiang, Chengyin Li, Sijia Liu, and Dongxiao Zhu. Saliency guided adversarial training for learning generalizable features with applications to medical imaging classification system. CoRR, abs/2209.04333 2022.
[39] Yandong Li, Lijun Li. Liqiang Wang, Tong Zhang, and Boqing Gong. NATTACK: learning the distributions of adversarial examples for an improved black box attack on deep neural networks. In Proceedings of ICML, June 151 2019, Long Beach, California, USA, pages 3866-3876, 2019.
[40] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In Proceedings of ICLR, April 30 May 3, 2018, Vancouver, BC, Canada, 2018
[41] Mchdi Mirza and Simon Osindero. Conditional generative adversarial nets. CoRR, Abs//411.1185 2014.
[42] Seyed-Mohsen Moosavi-Dezfoof Dezfooli, Alhussein Fawzi, Jonathan Uesato, and Pascal Frossard. Robustness via curvature regularization. and vice versa. In Proceedings of CVPR, June 16-20, 2019, Long Beach, CA, USA, pages 9078-9086, 2019.
[43] Raphaël Olivier, Bhiksha Raj. and Muhammad Shah. figh-frequency adversarial defense for speech and audio. In Proceedings of ICASSP, June 6-11, 2021, Toronto, ON, Canada, pages 2995 2999, 2021.
[44] Tianyu Pang, Min Lin, Xiao Yang, Jun Zhu, and Shuicheng Yan. Robustness and accuracy could be reconcilable by (proper) definition. Proceedings of ICMI, July 17-23, 2022, Baltimore, Maryland, USA. pages 17258-17271 2022.
12

---

[45] Nicolas Papernot, Patrick D. McDaniel, Ian J. Goodfellow, Somesh Jha, Z. Berkay Celik, and Ananthram Swami. Practical black-box box attacks against machine learning. Proceedings of AsiaCCS, April 2-6, 2017, Abu Dhabi, United Arab Emirates, pages 506-519, 2017.
[46] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agar- wal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and llya Sutskever. Learning transferable visual models from natural language supervision. In Proceed- ings of ICML, July 18-24, 2021, Virtual Event, pages 8748-8763, 2021.
[47] Sylvestre- Selvestre-Alvise Rebuffi, Sven Gowal, Dan A. Calian, Florian Stimberg, Olivia Wiles, and Timothy A. Mann. Fixing data augmentation improve adversarial robustness. CoRR, 0bs/2203.01999 2021.
[48] Leslie Rice, Eric Wong, and J. Zico Kolter. Overfitting in adversarially robust deep learning. In Proceedings of ICML, July 13-18, 2020, Virtual Event, pages 8093-8104, 2020.
[49] Gaurang Sriramanan, Sravanti Addepalli, Arya Baburaj. and Venkatesh Babu R. Guided adversarial attack for evaluating and enhancing adversarial defenses. In Proceedings of NeurlPS, December 6-12, 2020, virtual, pages 20297-20308, 2020.
[50] Gaurang Sriramanan, Sravanti Addepalli, Arya Baburaj. and Venkatesh Babu R. Towards efficient and effective adversarial training. In Proceedings of NeurIPS, December 6-14, 2021, virtual, pages 11821-11833 2021.
[51] Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In Proceedings of ICLR, April 14-16, 2014, Banff. AB, Canada, 2014.
[52] Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. In Proceedings of ICLR, May 6-9, 2019, New Orleans, LA, USA, 2019.
[53] Haohan Wang, Xindi Wu, Zeyi Huang, and Erie P. Xing. High-frequency component helps explain the generalization of convolutional neural networks. In Proceedings of CVPR, June 13-19, 2020, Seattle, WA, USA, pages 8681-8691, 2020.
[54] Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In Proceedings of ICLR, April 26-30, 2020, Addis Ababa, Ethiopia, 2020.
[55] Zekai Wang, Tianyu Pang, Chao Du Min Lin, Weiwei Liu, and Shuicheng Yan. Better diffusion models further improve adversarial training. In Proceedings of ICML, July 23-29, 2023, Honolulu, Hawaii, USA, pages 36246-36262 2023.
[56] Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. In Proceedings of NeurIPS, December 6-12, 2020, virtual, pages 2958 2969, 2020.
[57] Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L. Yuille. Improving transferability of adversarial examples with input diversity. In Proceedings of CVPR, June 16-20, 2019, Long Beach, CA, USA, pages 2730-2739, 2019.
[58] Qinwei Xu, Ruipeng Zhang, Ya Zhang, Yanfeng Wang, and Qi Tian, fourier-based framework for domain generalization. In Proceedings of CVPR, June 19-25, 2021, virtual, pages 14383- 14392, 2021.
[59] Dong Yin, Raphael Gontijo Lopes, Jonathon Shlens, Ekin Dogus Cubuk, and Justin Gilmer. A fourier perspective on model robustness in computer vision. In Proceedings of NewrlPS, December 8- 14, 2019, Vancouver, BC, Canada, pages 13255-13265. 2019.
[60] Sangdoo Yun, Dongyoon Han, Sanghyuk Chun, Seong Joon Oh, Youngjoon Yoo, and Junsuk Choe. Cutmix: Regularization strategy to train strong classifiers with localizable features. In Proceedings of ICCV, October 27- November 2, 2019, Seoul, Korea (South), pages 6022-6031, 2019.
13

---

[61] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent EI Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. In Proceedings of ICMI, June 9-15, 2019, Long Beach, California, USA, volume 97, pages 7472-7482, 2019.
[62] Xinze Zhang. Junzhe Zhang, Zhenhua Chen, and Kun He. Crafting adversarial examples for neural machine translation. In Proceedings of ACLIJCNLP, August 1-6, 2021, Virtual Event, pages 1967-1977, 2021.
[63] Dawei Zhou, Nannan Wang, Heng Yang, Xinbo Gao, and Tongliang Liu. Phase- aware adversar- ial defense for improving adversarial robustness. In Proceedings of ICML, July 23-29, 2023, Honolulu, Hawaii, USA, pages -2724-42741) 2023.
[64] Wei Zou, Shujian Huang, Jun Xie, Xinyu Dai, and Jiajun Chen. A reinforced generation of adversarial examples for neural machine translation. In Proceedings of ACL, July 5-10, 2020, Online, pages 3486 3497, 2020.
14

---

Appendix
Table of Contents
A
Pseudocodes of AE Generation and DAT
16
Pseudocode of the AE Generation Method
16
Pseudocode of
B
Related Work & Background
17
Adversarial Attacks
17
Adversarial Training
B.3
Generation of Adversarial Example Adversaria Training
18
B,4
Discrete Fourier Transform
18
Experiments the Amplitude Spectrum Operation
Visualization of the Mix-up Operation Amplitude Spectrum
18
Impact of the Range of Amplitude Mixture Parameters
19
Batch Normalization Parameter Analysis
19
E
Detailed Experimental Setup
20
E.
Datasets
20
E.2
Training Settings
................................
20
Baselines).
21
E,4
Robustness Evaluation
21
F
Additional Results and Discussion
21
F.1
Comparison Different AT Methods with Generated Data
21
F2
Comparison of DAT with Different Augmentations
22
F3
Comparison of Training Time Consumption
22
F.4
Hyper parameter Exploration)
23
F55
Iteration Step K AE Generation
23
F66
AAG with Existing AT Methods
23
F7
Impact of Different Inputs of G
24
Single AE Generation DAI
24
Limitations and Future Works
25
G Theoretical Analysis and Proof
26
This appendix provides additional support to the main ideas presented in the submission. The general pipeline as follows:
presents the algorithms of the proposed efficient AE generation and DAT.
B presents comprehensive related works, including adversarial attack and adversarial training methods.
C
pressents additional details of AAG (e.g., mix-up operation and À range).
presents the gap of BN parameters for benign and recombined data, showing the reason for the split BN operation in the model training of DAT.
presents more information about the training settings and selected datasets.
presents omitted experimental results (e.g., synthesized methods, data augmentation strategies and training time, iteration K and different inputs of AAG).
presents explanation and proof for Theorem 3.2
15

---

A Pseudocodes of AE Generation and DAT
A.1 Pseudocode of the AE Generation Method
Algorithm EFFICIENT ADVERSARIAL EXAMPLE GENERATION (EAEG)
Input: Mini-hatch B = [(x; (()),,))) model fo. perturbation radius iteration step K, step size a, weight parameter /
Output: AEs {x(]
// EAEG Procedure
1: for .,..., M (in parallel) do
2:
x f- + 0.001 &. where & bid I).,I)
initialize AE
3:
for k 1 K do
(AE(X(; X., yes (xE(fo(x)), v.) + DeL (fo(())))) fo(x)) x + (x])
Eq. b update AE
5:
x + a sign Vxx (AE(x); Vr.
A.2 Pseudocode of DAT
Algorithm 2 DUAL ADVERSARIAL TRAINING (DAT)
Input: Training data D {(x,, v W mini-bateh size M, model fe. Adversarial Amplitude Generator Ge,
AE generation method EA EG, perturbation radius e, iteration step K, step size a, weight parameter {3,
W), ) training epoch T
Output: Robust model fo
// DAT Procedure
1: for to T
2:
for cach batch B = (x,, ys 1- do
3:
for i I,.... M (in parallel) do
4:
x, EAEG(x; usi O K, a.
generate AE benign data
Ax = G (xx))) where sid. (O,
generate adversarial amplitude to mix amplitudes generate recombined sample generate AE for recombined sample
6:
Amir xx) = (x.) (1- ().(F((x)). where X ~ Unilorm( 1)
7:
& J (Amiz P P(F(x)))
8:
& EAEG(&L, Ui; K,
LOAT (x,),
(fox())(x.)) v4) Lar((f(()) Dos(ff( fo(x.)
Eq.
10:
Update vb and 0 by LOAT
16

---

B Related Work & Background
B.1 Adversarial Attacks
With the heightened attention on DNN vulnerabilittes, numerous adversarial attack methods have developed to study the model's robustness. FGSM [22] generates AEs by applying a gradient on benign samples in a single iteration step. Building upon I-FGSM 34 PGD [40] emerges as the strongest first-order attack, amplifying the adversarial impact of AEs. In order to reduce the difficulty is developed. To enhance the
of parameter settings in FGSM, the accurate and efficient Deepfool
effect of PGD attack, APGD, and APGD-DLR are proposed [13 These methods have alternative loss functions and do not require an inner step size in the AEs' generation procedure. However, these white-box attacks require detailed knowledge of the target model to generate AEs, which poses challenges in practical scenarios. To address this challenge, black-box [4]] 9 27 [ 24
and no-box 445 36 adversarial attacks are proposed. For comprehensive evaluation of model robustness, ensemble adversarial attacks consisting of multiple types of adversarial attacks become representative ensemble attack approach, seamlessly integrating white-box attacks including APGD, APGD-DLR, and FAB (12), alongside a black-box attack called Square attack R AA is broadly recognized as a benchmark tool for the robustness evaluation of models.
popular. AutoAttack (AA) [ stands
B.2 Adversarial Training
In effort to protect models from adversarial attacks, various methodologies have been developed. Adversarial training is one of the most effective methods for countering adversarial attacks [64]
61 M 35). PGD-AT [40] formulates AT as min-max optimization problem. AES are first generated via PGD and then fed into the trained model to minimize empirical risk. To address the robust overfitting issues, early stopping of PGD-AT is proposed to further enhance the model's 's robustness (48). However, PGD-AT only takes AEs into the training procedure. This approach, due the data distribution shift between AEs and benign samples, can diminish the model's 's accuracy. To make a better tradcoff between accuracy and robustness, TRADES [6]] takes both benign samples and AEs into the AT procedure. Motivated by weight perturbation methods in standard training, Adversarial Weight Perturbation (AWP) [56] adversarially perturbs both inputs and weights, markedly easing the robust overfitting issues and improving adversarial robustness. Additionally, Stochastic Weight Averaging (SWA) [28] is also a frequently used technology to reduce the negative impact of robust overfitting issues and enhance the model's robustness. Misclassification Aware adveRsarial Training (MART) (44) adopts misclassified training samples as regularizers to enhance the model's robustness against AEs generated by various adversarial attacks. Instead of generating AEs by maximizing the prediction distance between AEs and benign samples in TRADES, Squeeze Training (ST) (37) selects a better reference target and uses collaborative examples to benign ones, produced by minimizing the prediction distance between collaborative and benign samples. Different from existing hand-crafted strategy based AT, Adversarial Training with Learnable Attack Strategy (LAS--T) [29] generates AEs by reinforcement learning network. Motivated by Contrastive Language-Imase
62 4 5 19
20
40
Pre-training (CLIP) [46,, Semantic Constraint Adversarial Robust Learning (SCARL) [3] uses the text information obtain robust semantic information of training samples, improving the model's robustness. Due to the positive impact of data augmentation on AT, Diverse Augmentation--asse Joint Adversarial Training (DAJAT) I uses Augment, SWA, and AWP to achieve an effective AT. To reduce the time consumption of AE generation, DAJAT adopts variable adversarial perturbation radius and inner step size a to reduce the iteration steps. OA-AT (2) uses SWA and variable e and a to protect the model from AES with large adversarial magnitudes. Li al. [35] show that the effectiveness of data augmentations on robustness improvement depends on their impacts on the model's 's robust accuracy on test data, referred to as hardness. Moreover, the work proves that augmentation strategies with moderate hardness can protect the model from robust overfitting issues and enhance the model's 's robustness. Based on the phenomena, with variable adversarial perturbation radius e, Improved Diversity and Balanced Hardness (IDBH) (55 combines several data augmentation strategies to obtain significant robustness improvement against various adversarial attacks. Recently, motivated by the stable diffusion (SD) model (30), some methods
47 23
15
55 44) synthesize data by SD to enhance the model's 's robustness further.
17

---

B.3
Generation of Adversarial Example in Adversarial Training
PGD-AT 40
formulates a min-max strategy to inject AEs into AT. The optimization objective is
N
min
max (c)))o())) xX,
(8)
where x is the AE for x,, and LCE represents the cross-entropy (CE) loss. To achieve a better tradeoff between natural and robust accuracy, TRADES [6] incorporates both AEs and benign samples into training
m&L
(CE(SO(xi).
max DKL (x((fo())..oox)
where B is weight parameter, and DKL represents the Kullback-Leibler (KL) divergence.
For (x, y) D, its corresponding AE x' initialized by adding a random noise (e.g., uniform noise in PGD and Gaussian noise in TRADES) x, then iteratively updated by K steps following
(k++) [x
(x" (k) + a sign( V x ((fe(x ).)))
(10)
where II(-) is the projection operator, a is the projection inner step size, and & E {O...., K 1}, with K typically set to 10.
B.4 Discrete Fourier Transform
DFT transforms an image signal from the spatial domain into the frequency domain, while the inverse discrete Fourier transform (IDFT) reverses this process. Let F(-) and F (+:-) (--) denote the DFT and IDFT functions, respectively. Typically, DFT is independently applied to each channel of an image within the pixel space. An image can be transformed into the frequency domain as follows:
H
w
F(x)(u,o)
Σ
Σ
x(h, w) 12
h=1 m=
where (h, w) denotes the pixel coordinates of x, and (u, [H] [W] signifies coordinates in the frequency domain. The real and imaginary parts of F(x) are denoted by Re(F(x)) and Im (Fx)))))
respectively. Then, the amplitude spectrum A(x) and phase spectrum P(x) are defined as follows:
A(x) (Re" (F(x)) + Im (F(x))) P(x) arctan Im(F(x))
Re(F(x))
(11)
C Experiments of the Amplitude Spectrum Operation
To better explore the proposed AAG, we present the amplitude spectrum mix-up operation visually and explore the impact of the range on the model's robustness in this part. First, display and explain the visual results of the recombined samples and show the impact of the mix-up operation on the model's performance. Then, the experimental results of DAT with different ranges of X shown.
C.1 Visualization of the Mix-up Operation on Amplitude Spectrum
Figure 8 (see page 28) shows the benign samples, amplitude spectrum, phase spectrum, generated amplitude spectrum, and recombined data. Compared to images with mixed amplitude spectrum, data recombined by replacing the original amplitude from the generated one entirely has great gap for the original benign samples, reducing the natural and robust accuracy of the benign test samples. To better show the impact of the different strategies on the model's performance, we perform experiments with and without the mix-up operation. Table 5 shows the DAT with mix-up has better performance. That indicates the model still needs some original information on the amplitude spectrum, showing the effectiveness of the mix-up operation.
18

---

Table 5: Average experimental results of DAT with and without Mix-up CIFAR-10 and CIFAR-100 with ResNet-18 and 8/255 in runs.
CIFAR-10
CIFAR-100
METHOD
Natural
PGD-20
AA
Natural
PGD-20
AA
DAT w/o Mix-up
01.49
55.64-10.54
50.13
59.84+00.42
30.83++0.46
25,41++0.29
DAT w/ Mix-up
84.17 10.21
17.55
51.36.10.14
62.57.10.17
33.37
27.11
85
50
Robust Accuracy
80
Rohust Accuracy
45
75
40
70
35
65
30
25
0.2
0.4
0.8
1.0
0.2
0.6
Value
Value
CIFAR-10 Natural
CIFAR-100 Natural
CIFAR-10 Robust
CIFAR-100 Robast
(a) Natural accuracy of DAT with different
(b) Robust accuracy against AA of DAT with differ-
ent μ.
Figure 4: Natural and robust accuracy (%) against AA of DAT with different p on CIFAR-10 and CIFAR-100 with ResNet-18.
C.2 Impact the Range of Amplitude Mixture Parameters
In this subsection, to fully explore the impact of the À range on the model's robustness, we perform some experiments show the impact of different the work, the mix-up operation to perturb A(x) by the generated AG(x) follows
the natural and robust accuracy. As shown in
Amia (x) (x) + (1 A)A(xx,
(12)
where 0 < À < 1, reserving some information of A(x). Suppose that À Uniform pu), where 0 μ 1, we perform experiments with different values of μ CIFAR-10 and CIFAR-100 against AA, where B = 15 and w 2. As shown in Figures 4a and 4b the test accuracy fluctuations between different values of accuracy for CIFAR-10 and CIFAR-100 are different. For CIFAR-10, the model achieves the best natural performance when f 0.6, while its robust accuracy is better with μ 0.8. For results CIFAR-100, = 0.4 makes the best natural accuracy when the model achieves better robustness with μ 0.6. In the work, there already two hyper-parameters: w and 3. Moreover, the range of is more likely to influence the settings of w and B. Consequently, we do not discuss the impact of different ranges of À on the model's robust and natural accuracy in the main paper.
quite large, and the best settings of j for natural and robust
For the real-valued x, it is noticed that F(.) need to be even-conjugate, i.e., F(x) (xx))-u,-)) = F(x)(u, v). implying that the amplitude spectrum is symmetric. Conversely, IDFT returns real- valued signals for symmetric amplitude spectrum. Consequently, G. only generates Ag with the non-redundant and non-negative part of the amplitude spectrum.
D Batch Normalization Parameter Analysis
In the DAT training procedure, use different BNs for the benign data and their recombined samples. In the ablation study, we show the model performances with and without a split BN are quite different, showing that the single BN significantly influences the model's 's performance. To better present the necessity of the split BN in DAT training, we show the cosine similarity of the parameters of each BN layer between benign data and recombined ones. There are BN layers in ResNet-18 From Figures 5a and 5b on both CIFAR-10 10 and CIFAR-100, we can see the cosine similarity gaps for BN parameters different layers. The distance between the mean and variance each BN layer is small, while the gaps between the ys and Bs are large, especially in the low-level layers and the
19

---

1.0
1.0
0.9
Consin: Similarity
0.8
Consine Simllarity
0.9
0.7
0.8
0.6
0.5
0.7
0.4
0.6
0.3
0.2
0.5
100112131415100711811
101112233441111771111
Layer
Layer
gamma
mean
gamma
mean
beta
variance
heta
variance
(a) Cosine similarity between the parameters on CIFAR-10.
(b) Cosine similarity between the parameters on CIFAR-100.
Figure 5: Cosine similarity between the BN parameters of the original data and recombined ones in ResNet-18 (a) CIFAR-10 and (b) CIFAR-100.
last layer. Consequently, using a single BN in the training procedure DAT is likely to result in the difficulty of model convergence, showing as the performance comparisons in the ablation study, To solve the issue, we adopt different BNs for the original data and the recombined ones. In the model training procedure of DAT, split the BN into two groups: BN-A and BN-B, B, for each layer with BN, original data and its AE are processed by BN-A, while recombined one and its AE are regularized by BN-B.
E Detailed Experimental Setup
In this section, we add more details about the datasets and experimental settings. Moreover, the information about the robust evaluation is further introduced.
E.1 Datasets
To evaluate the performance of DAT, select three widely used benchmark datasets for robust evaluation: CIFAR-10, CIFAR-100, and complex Tiny ImageNet [17]. CIFAR-10 and CIFAR-100
contain 50,000 32x32 training samples and 10,000 32x32 test images, categorized into 10 and 100 classes respectively. Tiny ImageNet is a challenge 200-class real-world dataset, where there are 500 training and 50 test images for each category, where the image size is 64x64. Moreover, due the samples in the test set of Tiny ImageNet without labels, we evaluate the robustness of the validation set following 20
E.2 Training Settings
We use ResNet-18, WRN-34-10, and WRN-28-11 10 model architectures. Experiments with ResNet- 18 are performed Ubuntu 20.04.3 3 LTS GPU server with Intel Xeon 5120 and 5x3090 by PyTorch 2.0, while WRN-34-10 and WRN-28- 10 experiments are performed on DGX with H800 GPU on PyTorch 2.0. In the model training procedure, we adopt an SGD optimizer with momentum 0.9 and weight decay 5e-4, For the common experiments, the model is trained for 150 epochs for CIFAR- 10 and CIFAR- 100 and 100 epochs for Tiny ImageNet. Moreover, the learning rate follows the schedule [0.1, 0.01, 0.001] decay epoch schedule [100, 1 110] in CIFAR-10 10 and CIFAR- 100 and decay epoch schedule [75, 80] for Tiny ImageNet. For these datasets. the experiments with AWP or the combination of AWP and SWA use the same learning rate schedule with decay epoch as [100, 150).
For the proposed AAG, we use four-linear layer structure to build it. Since only the non-negative part of the amplitude spectrum is produced, the output of AAG is processed by a Sigmoid function. In the model training procedure, we set the dimension of z as 100. Due to the input of AAG combined by z and sample logits extracted by fo. the input dimension of AAG the sum of T and class number of D.
20

---

The AAG is optimized by an SGD optimizer with fixed learning rate 0.1, momentum 0.9, and weight decay 5e-4. For papam-parameerrs.. 3 and IS weight parameter w are set as 15 and 2 respectively. During the training procedure, we adopt the basic data augmentation strategies, Random Crop and Random Horizontal Flip, for all selected datasets. For AE generation, the inner step size a set to 2/255 with K 5 to generate adversarial perturbation f -bounded with radius 8/255 following
previous work 229 37 33
E.3 Baselines
For experimental result comparisons in this work, we select two typical PGD-AT and TRADES
40 61] as baselines. Moreover, we adopt two types of existing methods to perform experimental
result comparisons. For common type AT methods, which are trained with fixed = 8/255 and inner
step size a 2/255 and without any extra technologies, we select MART [54], ST [37]. LAS-AT (29 and SCARL [33]. Additionally, some methods with complex strategies, such as AWP, SWA, variable
and changeable a are also selected baselines. For AutoAugmentt based DAJAT ( consisting of
AT, SWA, variable e and a, we select it with one augmentation for fair comparison. OA-AT 2 is variable e based AT method with SWA. IDBH [35] is an AT method based on the augmentation combination of Cropping, CutOut, and ColorShape, and is combined with AWP and SWA strategies.
E.4 Robustness Evaluation
For the experimental results, report the model's natural and robust accuracy. We select several widely used types of adversarial attacks to generate AEs for robustness evaluation. FGSM, PGD- 20, PGD-100, and C selected as basic methods evaluate the model's robustness. To better show the model's robust generalization against different adversarial attacks, we also select AA consisting of black-box and white-box methods to evaluate the robustness of the model. The adversarial perturbation of these methods is foo -bounded with radius e 8/255 and inner step size 2/255.
F
Additional Results and Discussion
Due to the limitation of the pages, we perform some experiments on CIFAR-IO and CIFAR- to show the effectiveness of our proposed DAT further. In the first section, we show the experimental results on generated data with WRN-28-10 10. The experimental comparison between proposed DAT and some data augmentation strategies are presented in the second section. Then, we show the time consumption comparison between DAT and existing methods the third part. The fourth subsection discusses the impact of different 3 and w. Then, the impact of iteration K of AE generation on the model's performance explored in the fifth subsection. the sixth part, the AAG combined with existing methods to verify its effectiveness. Then, we explore the influence of AAG's input. The last two subsections show the results comparison of single and dual AE generation of DAT and limitations of the work.
F1 Comparison for Different AT Methods with Generated Data
we take advantage of the diffusion model to synthesize data enhance the model's ' robustness further. Since these existing methods are combined with strategies such as AWP, SWA, variable e and changed a, we use the DAT with AWP and SWA to show the experimental results comparison. Due to methods only providing single-time results, we just use the one- one-time test accuracy of DAT to compare with them on WRN-28811M 10. From Table compared with IKL-AT [15]. we can see DAT achieves about ~0.69% and ~0.48 robustness improvement with 1 M and 20M generated data on CIFAR-I0. On CIFAR- 100, as shown in Table 7 for current IKL-AT, the method with the best robustness against AA with WRN-28- 10 on the RobustBench (II, the model robustness enhanced by ~0.29% and ~0.23% with 1M and 50M synthesized samples, respectively.
In this subsection, following 47
23
15
55
21

---

Table 6: The average experimental results for different augmentations against &oc threat model with
c 6/255 on CIFAR-10. #Aug. refers to the number of augmentation. The best results are boldfaced.
METHOD
Architecture
#Aug.
Natural
AA
Rebulti et al.
47
WRN-28-10
1M
87.33
60.73
Gowal et al
26
WRN-28-10
100M
87.50
63.38
Wang
WRN-28-10
91.12
63.35
Wang al.
55
WRN-28-10
50M
92.27
67.17
Wang al.
155
WRN-28-10
20M
92.44
67.31
IKL-AT [5
WRN-28-10
1M
90.75
63.54
IKL-AT [5]
WRN-28-10
20M
92.16
67.75
DAT+AWP+SWA (Ours)
WRN-28-10
91.37
64.25
DAT+AWP+SWA (Ours)
WRN-28-10
20M
92.86
68.18
Table 7: The average experimental results for different augmentations against Eoo threat model with 8/255 on CIFAR-100. #Aug. refers to the number of augmentation. The best results are boldfaced.
МETHOD
Architecture
#Aug.
Natural
AA
Pang et
WRN-28-10
62.08
31.40
Rebuffi
WRN-28-10
62.41
32.06
Wang al.
155
WRN-28-10
1M
68.06
35.65
Wang al.
55
WRN-28-10
50M
72.58
38.83
IKI-AT 15
WRN-28-10
IM
68.99
35.89
IKL-AT TS
WRN-28-10
50M
73.85
39.18
DAT+ (Ours)
WRN-28-10
69.52
36.18
DAT=AWP+SWA (Ours)
WRN-28-10
50M
74.86
39.41
F.2 Comparison of DAT with Different Augmentations
Since the recombined data based on AAG can be regarded as an augmentation for benign samples, to better present the effectiveness of the proposed strategy, we combine the proposed AE generation method with three widely used augmentation policies in AT, such as CutOut [8], CutMix [60], and AutoAugment [4], and perform experiments CIFAR- 10 and CIFAR-10M The settings of CutMix and CutOut are as 35 while AutoAugment follows [. these experiments, the baseline AT with the proposed AE generation strategy. These selected data augmentation strategies adopt the same training strategy as DAT. As shown in Table S for the baseline, these augmentations enhance the model's robustness against PGD-20 and AA. Compared to other strategies, DAT achieves robustness improvement of ~ on CIFAR-10 and 1.2% on CIFAR-I00.
F.3
Comparison of Training Time Consumption
In this part, we compare the time consumption of different methods on CIFAR-10 and CIFAR-100 From Table we can obtain the time consumption of DAT is slightly higher than PGD-AT and TRADES because of added AAG. Compared with recently proposed methods, DAT takes less time and achieves better robustness.
Table 8: The average experimental results for different augmentations against foe threat model with 8/255 in 7 runs. The best results are boldfaced.
CIFAR-10
CIFAR-100
METHOD
PGD-20
PGD-20
AA
Baseline CutOut 18
53.13+0.51
49.64=0.62
30.0910.58
25.43-10.39
55.85+0.51
50.28=0.14
31.35+:044
26.26:i0.14
CutMix 60
55.76=10.42
50.13=0.54
31.26:10.22
26.17=0.19
AutoAugment
14
56.24+00.5
50.42-0.15
31.69+0.52
26.4440.17
DAT (Ours)
57.55+00.15
51.36-0.14
33.37+0.15
27.11-00115
22

---

Table 9: Time consumption (s) of each training epoch for different AT methods.
METHOD
CIFAR-I0
CIFAR-100
PGD-AT
187
188
TRADES 61
187
192
ST R7
320
326
SCARL
3
221
228
DAT (Ours)
218
221
F4 Hyper-parameter Exploration
After the performance comparisons, we then explore the settings 3 and by experiments on CIFAR-10 and CIFAR-100. Additionally, the X's range and the iteration step K of AE generation are also discussed, attached to Appendixes C.2 and
F.5
Setting of 3. As shown in Figure 6a of Appendix F.4 we present the model's natural and robust accuracy with different 3 with w and K = 5. We can see that the curves of robust accuracy rise first and then fall. Mcanwhile, natural accuracy keeps decreasing as 3 increases, indicating that B significantly influences the model's natural and robust accuracy. To achieve better tradeoff between robust and natural accuracy, we set / 15 for experiments of DAT on all datasets.
Setting of w. With 15 and K 5, discuss the settings of w. Figure 6b shows the model's accuracy changes along with w on both natural and AE. When w < 2, the curves of robust accuracy rise. On the contrary, >> 2 results in the performance decreasing. Unlike the robust accuracy, the model's performance on benign samples grows with the increase of w. For better model robustness, set as 2 in this work.
80
80
Testing Accuracy
Texting Arcuracy
70
60
60
50
20
3
5
7
11
13 15
17
19
2
5
B Value
Value
C-100
Na.
C-100
C-10 Rob.
C-100 Rob.
C-10 Rob.
C-100 Rob.
Impact of on natural and robust accuracy.
(b) Impact natural robust accuracy.
Figure The impact and 3 on model's natural (Na.) and robust accuracy (Rob.) against AA on 10 (C-10) and CIFAR-100 (C-100) with ResNet-18.
Iteration Step K of AE Generation
The generation iteration step K has extremely important impact the model's robust accuracy. As shown in 7 the larger the iteration step, the adversarial robustness against AA of the model rises with the increase of K. However, the larger K will significantly increase the time consumption of AT. To achieve a tradeoff between the model's robustness and time consumption, we set the iteration step K 5. Then, the time consumption of DAT will not be increased compared with existing methods.
F.6
AAG with Existing AT Methods
To further show the effectiveness of the proposed AAG, we combine AAG with PGD-AT and TRADES and perform experiments CIFAR-10 -O and CIFAR-100 against PGD-20 and AA. Compared
23

---

90
Texing Accuracy
60
50
40
30
20
10
Herration step
C-10 Na.
C-100 Na.
C-10 Rob. C-100 Rob.
Figure 7: The impact of different iteration step K on the model's performance on natural data and against AA CIFAR-IO and CIFAR-100 with ResNet-18.
with PGD-AT and TRADES, the combinations with AAG enhance the model's robust and natural accuracy further.
Table 10: Average experimental results of AAG with existing AT methods on CIFAR-10/100 with ResNet- 18 and 8/255 in 7 runs.
DATASET
CIFAR-I0
CIFAR-100
METHOD
Natural
PGD-20
AA
Natural
PGD-20
PGD-AT PGD-AT+AAG
82.7810.12
51.30:1..16
47.63=10088
57.27=0.21
28.6610.11
24.60 0.04
83.24100.21
55.6410.18
50.96=0.14
59.34-0.23
31.82-1.25
26.16:10.16
TRADES
52.76:+0.19 82.41+0.12 84.36:10.38
49.37=0.08 50.75=0.27
57.94=0.15
29.25=0.18
24.71=10.04
TRADES+AAG
5..45++0.22
60.18=0.24
32.43+1.22
26.76::0.17
Table 11: Average experimental results of different inputs of Ge with ResNet-18 and 8/255 in runs.
DATASET
CIFAR-10
CIFAR-100
METHOD
Natural
PGD-20
AA
Natural
PGD-20
AA
w/2 z
83.63+00.3
56.86:10.64
50.67+0.61
61.52=0.72
32.74-0055
26.64-10.43
z + one-hot label
83.86:10.33
$7.27:1.39
50.92-0.38
62.05=0.32
32.96-0.35
26.87=1.28
w/ z + logits
84.17:10.21
07.55
51.36-0.14
62.57=0.17
33.37-0.15
27.11=00115
F.7 Impact of Different Inputs of G.
For the Generative Adversarial Nets (GANs), Conditional GANs (CGANs) 41 usually have higher quality generative results than vanilla ones. Consequently, motivated by CGAN, we use combination of the sample logits from model fe and stochastic sampling noise vector z ~ (0, I) following standard Gaussian distribution as input of Gu,, which is different CGAN with one-hot label. To better show the effectiveness, we perform experiments on CIFAR-10 and CIFAR- 100 against the PGD-20 and AA. Table [T shows that the input of G significantly influences the model's natural and robust accuracy. Moreover, the performance of input with logits has smaller variance than in other cases, indicating the logits make the training runs more stable. As shown in Figure (see page 28). the gaps between the generated amplitude spectrum of different inputs quite small. However, the recombination from the input with z and logits have a small gap for benign samples, with significantly changed sample.
E8 Single AE Generation of DAT
In the training procedure of DAT, we take both benign and recombined samples' AFs into AT, To reduce the time consumption of AE generation, propose an efficient strategy to produce AEs.

---

We can also generate AE of recombined data by mixing the generated amplitude spectrum with that in the benign sample's AE. For an example, with (x, 3) E D, we use the x's AE x' to obtain the amplitude of recombined AE as
Amiz (x') = (AA(x)) + +1 (1- A)A((x).
(13)
Then, x' is obtained by
(14)
Table 12: Average experimental results with single and dual AE on CIFAR-10 and CIFAR-100 with ResNet- 18 and = 8/255 in 7 runs.
DATASET
CIFAR-I0
CIFAR-100
МЕTHON
Natural
PGD-20
AA
Natural
PGD-20
AA
Single AE Dual AE
84.2810.26
55.78:10.35
50.43-0.32
62.64=0.34
31.64:0.37
2..38:10.24
84.17:10.21
57.55:10.15
$1.36=10.4
62157=0.17
33.37-10115
27.11=00115
We call such a procedure to obtain recombined data and AE a single AE DAT, while the process described the main text Dual AE DAT. To explore the difference in performance between the two AE generation strategies, we perform experiments with the same experimental settings in Sec. E.2 on CIFAR-IP 10 and CIFAR-100 with ResNett-1.. The PGD-20 and AA are selected evaluate the model's performance with single or dual AE generation. As shown in Table 12 we report the natural and robust results. According to these experiments, the natural accuracy gap for the DAT with single and dual AE is small, while the difference for the robust performance is large. As mentioned in the work, the amplitude spectrum of the sample influences the model's learning of the phase patterns. The single AE of DAT does not reflect the impact of mixed amplitude & on adversarial perturbation, resulting in a lower robust performance than dual AE for DAT. Additionally, as shown in Table 4 although the model trained with single AE has lower robust performance than common DAT, it still enhances the model's 's robustness compared to the baseline. That indicates the single AE for DAT can also enforce the model to learn more robust phase patterns.
F.9 Limitations and Future Works
Although the proposed DAT significantly improves the model's robustness and natural accuracy of the model, there are still some limitations of the work. Since the robust over-fitting issues, DAT without AWP needs to be trained focused on protecting from adversarial attacks. Other types of image corruptions, e.g., Gaussian noise, and defocus blur, can also influence the model's performance. DAT needs to developed further to protect the model from various image corruptions. Due to the limitation of page length, only provide the experimental results on three frequently used datasets and deep models in the main paper. In the future, we will add experiments more large-scale datasets with different deep models.
limited epoch, restricting its performance. Moreover, our DAT
25

---

G Theoretical Analysis and Proof
Here restate and prove Theorem
Theorem 3.2 (Weight Regularization of Amplitude Features). Grant Assumption 3.1 when the empirical risk R minimized with some convex loss function L (e.g. CE loss):
i((): = D
Σ
Bxx))T(X) [A (W h(((())))))]
(x.y)ED
we have Wj.a + 0 for all j E [c], where Wja is the corresponding weights of ampliudde features ha-
We consider quadratic approximation of the objective in Theorem 3.2 and provide further and
extended analysis following [16] 26). Using the second-order Taylor expansion, we expand each term of the objective function:
(x(x)~((x)) (W (WWT(((())) v) = L(W h, y) +
2 B((x)~((x)) HAH((
(15)
where h = (x))))(()) [h(t(x))). A WT (h(t(x)) h) and H is the Hessian matrix with denoting the remainder. We introduce Lemma G.I demonstrate the properties of H.
Lemma G.1. For the CE loss with softmax, the Hessian matrix w.r.f the loss function satisfies
1. H > 0, i.e., H is semi-definite.
2. H is independent of the true label vector y.
Proof. The CE loss for a single instance x, when given the true label vector y (using one-hot encoding with c-dimension) is defined as
y log(p:).
(16)
The gradient of L w.r.t the logits is computed
àL
Ph
yk:
(17)
for i E [c]. where Pk (z)x is the predicted probability of class The Hessian matrix H, which is the matrix of second derivatives of L, has elements given by
Opk ① (px wk) 0zj 02,02 dz,
0
(18)
Using the derivation properties of the softmax function, the above derivative simplifies to
Opk
pR(Ó Pi),
(19)
0z,
where 6ky is the Kronecker delta, equal if and otherwise. Thus, the Hessian matrix H Haj p (ōks pj).
(20)
Positive Semi-Definiteness. The Hessian matrix can be expressed matrix form as
= H
(21)
where P is diagonal matrix with diagonal entries p&. and is the identity matrix. The product of P and I I-P, where P is a diagonal matrix with entries between 0 and 1, ensures that H is positive semi-definite.
Independence from Label y. The structure and values H depend solely on the predicted proba- bilities p. which are functions of z and not dependent on the specific values of This characteristic signifies that the Hessian's form invariant w.r.t. the true label vector y, thus highlighting its independence.
26

---

In the following, we omit the subscript of the expectation in Eq. (15) for simplicity, According to R when minimizing R, the first term in RHS of Eq. 15 may be no room for further improvement because the local optima has nearly the same value as the global optimum in neural networks, and we put main focus the second term. We first derive upper bound for the second term in Lemma G.2, since directly optimizing it which requires third-order derivative is intractable.
Lemma G.2 (stated informally, cf. Theorem 3.1 in [8). Assume that the covariance between H
and A 2 is zero, we can get the upper bound of the second term as
E
A
HA
E
H r-]
E |
(22)
Proof. By Hölder's inequality, we have
E A HA = E ||| 1p HA =
|||A||
H
ball4|111 = E Ing] E [[||]]]]] |p]/
(23)
where 1/r 1/4 1, Ilna is an induced matrix norm, When
2, we have
E A TAHHA HA] < E
[| 2
E
H F]
[
(24)
Intuitively, since ||| F represents the sharpness/flatness of loss landscape, and ||A||2 describes the translation of landscape, the two terms be assumed independent, where their covariance can be assumed as zero g Consider the latter item in RHS of Eq. (22):
E |
= E TATA A]
(h(((x)) - h) WWT (h(((x)) - 1i) E tr (WWT (h(t(x)) - h) (h(t(x)) - h) ')]
E
(25)
(WWTH [h(((x)) h) (h(((x)) h) "]
Lr (WW Σ)
where E the covariance matrix of h((())). For a model trained well enough, the feature extractor can completely distinguish different features, i..., Σ is a diagonal matrix. Then we can obtain
Ir (r(WWT)) Σ) Ir w.w. Σ
W Var (lx()
(26)
where Wya is the j-th entry w,. If the variance of the feature hx(t(x)) is large, minimizing the empirical risk R requires Ej=1 w3, +0 = Wy.s + 0 for all j E [c]. By Assumption 3.1 it is trivial that Varlha (f(x)) ((r[)) and therefore Wjja - 0. Under this circumstance, the model enforced learn more phase information. The claim follows.
27

---

Original Benign
Samples
Amplitude Spectrum
Phase Spectrum
G Generated Amplitude Spectrum
Mixed Amplitude Spectrum
Recombined Sample with M ixxe A mpplttude
Recombined Sample only with G Generated A Amplituee
Figure 8; Visualization of recombined samples w/wo mix-up.
(0
+label
Benign Samples
Generated
Amplitude
Spectrum
Amplitude
Spectrum
Mixed
A mppitude
Spectrum
Phase
Spectrum
Recombined
Image
(),1))
z (O 1)
+logits
Generated
G Generated
A mppitude
A Amplitude
Spectrum
Spectrum
Mixed
Mixed
Amplitude
A Amplitude
Spectrum
Spectrum
Recombined
Recombined
Image
Image
Figure 9: Visualization of recombined samples based the amplitude spectrum generated by different inputs of AAG.
28

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: See Abstract in the preamble and Introduction in Sec.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification: See Appendix F.9
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
Justification: See Sec. 3.4 and proof in Appendix G
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed reproduce the main perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification: See Sec.
5. Open access to data and code
Question: Does the paper provide open access the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: See httthttt/ wow.:uib..ooooeegeeeeeeeeeee -LiDAT
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: See Sec. 4.1
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: See Secs.
4.3 and Appendix
F22
8. Experiments Compute Resources
Question: For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Answer: [Yes]
Justification: See Sec. 4.1 and Appendix F3
9. Code Of Ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics http://ppw/.per...../aaaaa///aaa

---

Answer: [Yes]
Justification: following the Code Of Ethics of NeurlPS.
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA]
Justification: Since only open access models, codes, and datasets are used in this work, broader impacts are not applicable.
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: No such risks.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: See the supplemental materials.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: See Sec.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: Not involve crowdsourcing nor research with human subjects.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: Not involve crowdsourcing nor research with human subjects.
30


Reviews:
[{"review_id": "XtP3YthpqB", "reviewer": "Reviewer_8ttu", "summary": "This paper investigates a novel approach to improving adversarial training by performing data augmentation in the frequency domain. The authors propose a unique pipeline that jointly optimizes a classification network and a generator network. The generator is used to create adversarial noise, which is added to the amplitude component of the input to encourage the model to more accurately capture phase patterns. The authors conduct a comprehensive evaluation of their approach across multiple datasets and architectures, demonstrating its competitive performance.", "questions": "No questions", "limitations": "Yes", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "Comprehensive experiments on several datasets with different architectures.\n\nA novel approach that improves adversarial training by performing data augmentation using a generator network in the frequency domain.", "weaknesses": "In Table 1 and Table 2, the authors have only compared their approach with a few weak baselines. Since the proposed approach is based on data augmentation, the authors should consider comparing it with other data augmentation-based approaches, such as DAJAT[1] and [47]. Although DAJAT’s results are presented in Table 3, the table does not show the clean accuracy of the models, making it difficult to assess the accuracy-robustness tradeoff. In fact, DAJAT’s clean accuracy is significantly higher than that of the proposed approach. For instance, DAJAT’s clean accuracies on CIFAR-10 and CIFAR-100 (with ResNet-18) are 86.67% and 66.96%, respectively, while the proposed approach’s are 84.17% and 63.28%. [37]’s clean accuracy and AA robust accuracy with WRN-34-10 are 86.18% and 58.09%, respectively, while the proposed approach’s with WRN-34-10 are 86.78% and 56.46%.\n\nThe proposed pipeline is complicated, with a multi-part loss function and a requirement for joint optimization with a generator network. This complexity may necessitate extensive hyperparameter tuning to achieve satisfactory performance, making it a much more complex error-prone solution compared to data augmentation approaches such as [1] and [47].", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your review. Please find our responses below.\n\n---\n\n**W1: Natural Accuracy Compared to DAJAT [1]** \n\n**R1:** Our DAT utilizes **only 1** augmentation per benign training sample to prioritize speed and simplicity in this paper, while **DAJAT applies **2** and **3** data augmentations integrating AWP, SWA, and variable $\\epsilon$ and $\\alpha$** to achieve the natural performance you mentioned. Moreover, DAT exhibits superior robustness relative to DAJAT, albeit with a trade-off in natural accuracy. To ensure a fair comparison under identical training settings, we employ the adversarial amplitude generator in DAT to produce 3 adversarial amplitudes, resulting in 3 recombined data for each benign sample. Using these 3 recombined data, we extend our DAT to include 2 and 3 augmentations, integrating variable $\\epsilon$ and $\\alpha$, AWP, and SWA as in DAJAT [1]. Furthermore, to illustrate the trade-off between natural and robust accuracy, we select the checkpoint with the best performance on natural validation data. As illustrated in **Table A.1**, where DAJAT's performance is selected from [1], with 110 and 200 training epochs, we present a comparison of natural accuracy and robustness (AA) between the two methods on CIFAR-10 and CIFAR-100 with ResNet-18. When evaluated under the same augmentation conditions and experimental settings, our DAT outperforms DAJAT in both robustness and natural accuracy, with a smaller increase in time consumption per training epoch.\n\n**Table A.1: Comparison of DAJAT and DAT with the Same Settings**\n|||DAJAT|||DAT (Ours)|||\n-|:-:|:-:|:-:|:-:|:-:|:-:|:-:\nDataset|#Aug.|Natural|AA|Time (s/epoch)|Natural|AA|Time (s/epoch)\n**110 training epochs**\nCIFAR-10|2|85.99%|51.48%|295|**86.38**%|**51.92**%|318\nCIFAR-10|3|86.67%|51.56%|383|**86.81**%|**52.13**%|407\nCIFAR-100|2|66.84%|27.32%|300|**67.12**%|**27.95**%|323\nCIFAR-100|3|66.96%|27.62%|407|**67.43**%|**28.16**%|429\n**200 training epochs**\nCIFAR-10|2|85.71%|52.50%|295|**86.18**%|**53.16**%|318\nCIFAR-10|3|86.24%|52.66%|383|**86.63**%|**53.31**%|407\nCIFAR-100|2|65.45%|27.69%|300|**66.32**%|**28.35**%|323\nCIFAR-100|3|65.63%|27.92%|407|**66.74**%|**28.66**%|429\n\n---\n\n**W2: Robust Accuracy Compared to [47]**\n\n**R2:** We infer that you are referring to Rebuffi et al. [47] instead of ST [37]. In our DAT, to achieve a better trade-off between the model's performance and training time consumption, for results of DAT in Table 2, we use **only 5** iteration steps for AE generation of both benign and recombined samples, whereas [47] employs **10** iteration steps for AE generation of both benign and augmented samples with SWA. As reflected in **Table A.2**, when integrated with AWP and SWA, DAT delivers superior natural and robust performance compared to [47] with a 5-step iteration, which uses about half of training time consumption than [47] as shown in **Table A.3**. Moreover, to facilitate a fair comparison with [47], we conduct experiments on CIFAR-10 using a 10-step iteration for DAT's AE generation.  With identical iteration steps, **our DAT achieves an approximate 0.32\\% improvement in robustness over [47]. For DAT with AWP and SAW, extending the iteration step to 10 can enable it to secure approximately 1\\% improvement in robustness and 2.1\\% in natural accuracy over [47]**, thus highlighting a more favorable trade-off between generalization and robustness.\n\n**Table A.2: Comparison between [47] and DAT with WRN-34-10**\nMethod|#Iter. Step|Natural|AA\n-|:-:|:-:|:-:\n[47]|10+10|86.18%|58.09%\nDAT (Ours)|5+5|**86.78**%|**56.46**%\nDAT (Ours)|10+10|**86.23**%|**58.41**%\nDAT+AWP+SWA (Ours)|5+5|**88.65**%|**58.12**%\nDAT+AWP+SWA (Ours)|10+10|**88.28**%|**59.07**%\n\n**Table A.3: Comparison of Time Consumption per Epoch with WRN-34-10 on CIFAR-10**\nMethod|#Iter. Step|Time (s)\n-|:-:|:-:\n[47]|10+10|2884\nDAJAT [1]|5+5|1532\nDAT (Ours)|5+5|1551\n\n---\n\n**W3: Complexity**\n\n**R3:**\n* **For DAJAT [1]:**\nOur proposed DAT involves **only 2** hyperparameters, $\\beta$, and $\\omega$, which need to be explored by experiments. \nIn contrast, **DAJAT involves additional complexity beyond the balance parameters $\\beta$ and $\\omega$; it requires careful scheduling for adjusting adversarial perturbation $\\epsilon$, step size $\\alpha$, and iteration steps, due to its use of variable $\\epsilon$, $\\alpha$**, and iteration steps in AT. Moreover, the schedules for tuning adversarial perturbation $\\epsilon$, step size $\\alpha$, and iteration steps need to be adjusted continuously throughout the entire training epoch in DAJAT.\n\n* **For [47]:**\nIn the case of [47], a combination of data augmentation strategies is employed alongside the traditional TRADES method with **10** steps for AE generation and variable $\\alpha$, whereas our proposed DAT requires **only 5** steps per sample to generate AE. Consequently, as shown in **Table A.3**, **[47] demands nearly double the training time compared with our DAT when augmentations are applied to benign samples**.\n\nDespite its multi-component structure and joint optimization, our method remains simpler than DAJAT and [47] in terms of both hyperparameter tuning and computational complexity.\n\n---", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "SAnWh8eNd1", "reviewer": "Reviewer_KucH", "summary": "The paper introduces Dual Adversarial Training (DAT). This method enhances deep neural network resilience against adversarial attacks by employing generative amplitude mix-up in the frequency domain, focusing the model on phase patterns less impacted by such perturbations, and presenting an optimized adversarial amplitude generator for balancing robustness improvements with phase pattern retention. Experiments validate DAT's effectiveness against diverse adversarial attacks.", "questions": "1. Can the authors provide some results against feature space attacks?\n\n2. Can the authors provide some results on other models and datasets, like ImageNet and ViTs?", "limitations": "The authors have discussed the limitations of the method proposed in this paper. It is suggested that the authors provide some results on other models and datasets, like ImageNet and ViTs.", "rating": 5, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper is well-organized and easy to follow. \n2. The experimental results show the effectiveness of the proposed method.", "weaknesses": "1. In the experiment, only decision space attacks are used to test the defense capability. Compared with decision space attack, feature space attack can better destroy the semantic information of benign images and obtain more powerful adversarial samples. It is recommended that some feature space attacks be added to further demonstrate the effectiveness of the proposed method, like [a] and [b]. \n\n[a] StyLess: Boosting the Transferability of Adversarial Examples, CVPR 2023\n\n[b] Enhancing the Self-Universality for Transferable Targeted Attacks, CVPR 2023\n\n2. The types of models used in the experiment are not rich enough. Line 258 of this paper states that \"ResNet-18, WideResNet-34-10 (WRN-34-10), and WideResNet-28-10 (WRN-28-10) are used as the backbones\". Line 269 says \"Table 1 displays the results on CIFAR-10, CIFAR-100, and tiny-ImageNet using ResNet-18\". These models are all based on ResNet architecture and have high structural similarities. To show that the method proposed in this paper is generalizable, the proposed method should be able to achieve good results on different surrogate and target models. Therefore, it is recommended to add more surrogate and target models, such as Inception_v3, ViT, etc. \n\n3. This paper uses CIFAR-10, CIFAR-100, and Tiny ImageNet for experiments, but does not use ImageNet. However, ImageNet is the most widely used dataset in the CV field. The authors should provide additional experimental results on ImageNet for this paper's method.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your thorough and detailed reviews. Please find our responses below.\n\n---\n\n**W1: Additional Experiments against Feature Space Attacks**\n\n**R1:** In **Table B.1** (more results in **Tables 1-4** of **attached PDF**), we present results assessing the defense capability against feature space attacks [a, b].  We select StyLess+MTDI (SMTDI) and StyLess+MTDSI (SMTDSI) from [a], along with DTMI-CE-SU (DCS) and DTMI-Logit-SU (DLS) target to class 1 from [b], and perform experiments on ImageNette as in [c]. We adopt surrogate ResNet-50 $\\rightarrow$ targets [DenseNet-121, ViT-S] and surrogate DenseNet-121 $\\rightarrow$ targets [ResNet-50, ViT-S] execute black-box transfer attacks. AT on DenseNet-121 and ResNet-50 follow the same settings as Tiny-ImageNet in the paper, while ViT-S is trained adversarially as in [c]. **For the challenging SMTDSI attack, compared to the previous SOTA ST, our proposed DAT an average robustness improvement of approximately 4.9% across all four scenarios**. Moreover, since DAT performs AT in pixel space, its performance against feature space attacks is currently less satisfactory[d], which we plan to improve in the future.\n\n **Table B.1: Model's Performance against $\\ell_{\\infty}$ Threat with $\\epsilon=\\frac{16}{255}$  of Feature Space Attacks**\nMethod|SMTDI|SMTDSI|DCS|DLS\n-|:-:|:-:|:-:|:-:\n**ResNet-50$\\rightarrow$DenseNet-121**\nST|36.46%|31.68%|76.61%|73.67%\nSCARL|36.15%|31.31%|76.23%|73.46%\nDAT (Ours)|**41.62**%|**37.61**%|**79.12**%|**76.41**%\n**ResNet-50$\\rightarrow$ViT-S**\nST|46.42%|42.34%|86.27%|76.53%\nSCARL|46.32%|42.31%|86.71%|77.26%\nDAT (Ours)|**51.83**%|**46.76**%|**88.45**%|**80.41**%\n**DenseNet-121$\\rightarrow$ResNet-50**\nST|38.67%|33.29%|78.93%|66.83%\nSCARL|38.17%|33.13%|78.70%|65.93%\nDAT (Ours)|**43.38**%|**38.27**%|**82.12**%|**67.49**%\n**DenseNet-121$\\rightarrow$ViT-S**\nST|47.53%|43.07%|87.83%|78.41%\nSCARL|47.24%|42.95%|87.40%|77.58%\nDAT (Ours)|**52.06**%|**47.43**%|**89.12**%|**79.41**%\n\n[a] Liang and Xiao. StyLess: boosting the transferability of adversarial examples. CVPR 2023.\n\n[b] Wei et al. Enhancing the self-universality for transferable targeted attacks. CVPR 2023.\n\n[c] Mo et al. When adversarial training meets vision transformers: Recipes from training to architecture. NeurIPS 2022.\n\n[d] Xu et al. Towards feature space adversarial attack by style perturbation. AAAI 2021.\n\n---\n\n**W2: Additional Experiments with More Backbones**\n\n**R2:** In **Table B.2**, we provide results on CIFAR-10 with Inception\\_v3, DenseNet-121, and ViT-S. The settings for Inception\\_v3, and DenseNet-121 remain consistent with those mentioned in the paper, while ViT-S follows [c]. Compared to the previous SOTA ST, **DAT achieves robustness improvements of 0.63%, 0.90%, and 0.61%** against AA across various backbones, demonstrating its versatility and effectiveness on a range of deep models.\n\n **Table B.2: Experimental Results with More Backbones against $\\ell_{\\infty}$ Threat with $\\epsilon=\\frac{8}{255}$**\n||PGD-AT||TRADES||MART||ST||SCARL||DAT (Ours)||\n-|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:\nBackbone|Natural|AA|Natural|AA|Natural|AA|Natural|AA|Natural|AA|Natural|AA\nInception\\_v3|85.26%|48.83%|86.38%|49.74%|83.41%|48.75%|86.75%|51.18%|84.43%|50.98%|**87.74**%|**51.81**%\nDenseNet-121|86.34%|51.24%|86.92%|52.03%|84.11%|50.92%|58.63%|53.26%|85.15%|53.12%|**88.51**%|**54.16**%\nViT-S|81.86%|47.33%|81.95%|48.45%|80.31%|47.13%|82.42%|49.71%|80.85%|49.67%|**83.15**%|**50.32**%\n\n---\n\n**W3: Additional Experiments on ImageNet**\n\n**R3:** In **Table B.3**, we show results on ImageNet-1K, which adopt settings and baselines' results from [h]. It is worth noting that existing AT methods with multiple iteration steps for AE generation do not provide results on ImageNet-1K, since AT with a 10-step AE generation on ImageNet-1K needs **approximately one week**. Due to single iterative step AE generation using less time, some fast AT methods based on FGSM [e, f, g, h] typically perform experiments on ImageNet-1K. Consequently, considering the time limitation of rebuttal, to satisfy your suggestion of providing results on ImageNet-1K, we combine DAT with several fast AT methods [e, f, g, h] and compare its performance with these methods. **For the previous SOTA FGSM-PGK, DAT combined with FGSM-PGI obtains robustness improvements of 2.1% and 1.4% against PGD-10 and PGD-50**, respectively.\n\n**Table B.3: Experimental Results on ImageNet-1K with ResNet-50 against $\\ell_{\\infty}$ Threat with $\\epsilon=\\frac{4}{255}$**\nMethod|Natural|PGD-10|PGD-50\n-|:-:|:-:|:-:\nPGD-AT|59.19%|35.87%|35.41%\nFree-AT (m=4) [e]|63.42%|33.22%|33.08%\nFGSM-RS [f]|63.65%|35.01%|32.66%\nFGSM-PGI [g]|64.32%|36.24%|34.93%\nFGSM-PGK [h]|66.24%|37.13%|35.70%\nDAT+Free-AT (m=4) (Ours)|**66.36**%|**36.27**%|**36.12**%\nDAT+FGSM-RS (Ours)|**66.49**%|**37.43**%|**35.76**%\nDAT+FGSM-PGI (Ours)|**67.12**%|**39.24**%|**37.13**%\n\n[e] Shafahi et al. Adversarial training for free!. NeurIPS 2019.\n\n[f] Wong et al. Fast is better than free: Revisiting adversarial training. ICLR 2020.\n\n[g] Jia et al. Prior-guided adversarial initialization for fast adversarial training. ECCV 2022.\n\n[h] Jia et al. Improving fast adversarial training with prior-guided knowledge. TPAMI 2024.\n\n---\n\n**Q1: Results against Feature Space Attacks**\n\n**A1:** Please refer to **Table B.1** in **R1** and **Tables 1-4** in the **attached PDF**.\n\n**Q2: Results on Other Models and Datasets**\n\n**A2:** For results on additional backbones, please see **Table B.2** in **R2**. For experiments on ImageNet-1K, kindly refer to **Table B.3** in **R3**.\n\n---", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "RKuPh4YlT7", "reviewer": "Reviewer_FTsi", "summary": "Motivated by observation on the difference influence of amplitude and phase of adversarial examples, this paper propose a framework to generate better adversarial examples for adversarial training. Experiments verify the effectiveness of the proposed approach.", "questions": "1. In Figure 1, the authors claim that “The adversarial perturbation severely damages phase pattern and the frequency spectrum, while amplitude patterns are rarely impacted.” However, this comparison is not clear. It seems the amplitude patterns still changes a lot in Figure 1. Both the patterns and spectrum change. Could you provide more proof on this observation (e.g., results on more images and more datasets)?\n2. In Line 88, the features induced from the amplitude and phase patterns of x are denoted as $h_a(\\mathbf{x})$ and $h_p(\\mathbf{x})$ respectively.  Does it indicate an assumption that some parts of the learned $h$ correspond to the amplitude features? Do we need carefully design the network to explicitly accomplish this? It also makes the theoretical analysis in Sec. 3.4 difficult to understand.\n3. As the proposed framework contains multiple modules and optimization steps, it is surprising that the additional time consumptions are small. Could you please kindly provide more explanation on this? Do we need any relatively complex optimization tricks? Furthermore, what is the memory cost during training and could you please present the corresponding comparison with the baseline methods?\n4. It seems the mix-up operation is important in the whole framework. The adversarial amplitude and original amplitude are mixed by linear combination and the proportion is sampled from a uniform distribution. How do you make such a design? Have you ever tried other possible methods?", "limitations": "The authors discuss the limitations of this work in Sec. F.9 and say that the verification may be insufficient. No limitation of the proposed method itself is discussed.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. The motivation in Figure is clear and solid.\n2. The experimental improvements are clear and consistent.", "weaknesses": "1. The proposed framework contain many modules, making it complex and difficult to implement.\n2. Some descriptions are unclear and some details are missed.\n\nSee questions for details.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your thoughtful review. We have provided our detailed responses below.\n\n---\n\n**W1: Complexity**\n\n**R1:** Our DAT comprises **only 2** modules: the trained model and the adversarial amplitude generator (AAG). Due to the AAG's simple four-layer linear architecture, DAT's time consumption remains comparable to existing methods. Foremost, as shown in **Table C.1**,  DAT significantly enhances model robustness against various adversarial attacks.\n\n**Table C.1: Time Consumption and Memory Cost on CIFAR-10 with ResNet-18**\n||PGD-AT|TRADES|ST|SCARL|DAT (Ours)\n-|:-:|:-:|:-:|:-:|:-:\nAE Generation Time (s)|155|155|275|166|157\nOptimization Time (s)|32|32|45|55|61\nMemory (MB)|2589|3586|4589|5836|5763\n\n---\n\n**W2: Unclear Descriptions and Missing Details**\n\n**R2:** Please see the answers below.\n\n---\n\n**Q1: Impact of Adversarial Perturbation on Amplitude and Phase**\n\n**A1:** In Figure 1, the phase (3rd column) and amplitude (5th column) spectra are affected by adversarial perturbation. Moreover, the phase patterns (2nd column), particularly within the red rectangular, are damaged, while the amplitude patterns (4th column) are rarely affected. Since models rely on patterns, especially semantics in phase patterns [i], to make predictions, AE with damaged phase patterns hinder accurate prediction. Further results can be found in **Figures 1-4** of the **attached PDF** within the global **Author Rebuttal**.\n\n[i] Yin et al. A Fourier perspective on model robustness in computer vision. NeurIPS 2019.\n\n---\n\n**Q2: Learned Features and Theoretical Analysis**\n\n**A2:**\n\n* **Learned Features:** Indeed, we assume $h$ can extract features amplitude and phase patterns, respectively, since it is a **widely accepted assumption within feature learning theory [j, k, l]**.  In practice, $h$ can extract phase patterns (semantics) and amplitude patterns (color and style) respectively [i, l],  which can be readily **achieved using general networks in conjunction with the discrete Fourier transform, eliminating the need for specifically defined networks.** Such decoupling methods are commonly adopted. For instance, [i] represents Fourier information as amplitude and phase patterns, while [m] has demonstrated that CNNs (e.g., ResNet-50) can inherently capture these amplitude and phase patterns without meticulously designed components.\n\n * **Sketch of Theoretical Analysis:** Given that DAT utilizes AAG to generate adversarial amplitude, which is then combined with the benign image's phase to augment data, it naturally follows that during AT, amplitude differences between augmented and original datasets are more pronounced than phase differences (Assumption 3.1).  As a result, to achieve convergence during empirical risk minimization, the model regularizes the weights corresponding to amplitude features (Theorem 3.2), thereby reducing their influence on predicted labels (Corollary 3.3), and consequently shifting the focus towards phase features. We hope this explanation addresses your questions.\n\n[j] Ilyas et al. Adversarial examples are not bugs, they are features. NeurIPS 2019.\n\n[k] He et al. Data augmentation revisited: Rethinking the distribution gap between clean and augmented data. arXiv 2019.\n\n[l] Xu et al. A Fourier-based framework for domain generalization. CVPR 2021.\n\n[m] Chen et al. Amplitude-phase recombination: Rethinking robustness of convolutional neural networks in frequency domain. ICCV 2021.\n\n---\n\n**Q3: More Explanation on Time and Memory Costs**\n\n**A3:** For clearer comparison, we separately analyze the time consumption for AE generation and model optimization (updating the model's parameters), and present the memory costs in **Table C.1**. As shown, the majority of time consumption in DAT is attributed to AE generation. Thanks to our efficient AE generation strategy, DAT exhibits comparable time consumption to baselines. Additionally, the AAG, a four-layer linear model, demands little training time. Since both benign and recombined samples, along with their AEs, are used in model optimization, DAT takes roughly twice the time for optimization compared to baselines,  e.g., PGD-AT and TRADES.\n\n---\n\n**Q4: Mix-up Operation Design**\n\n**A4:**\n\n* **Linear Mix-up:** The linear mix-up operation is designed to preserve the energy of the amplitude spectrum and maintain the original amplitude information, since linear mix-up is a simple and effective method for augmenting data with less impact on the sample's original information [n, o]. Otherwise, the original amplitude could be compromised, thereby hindering accurate model predictions.\n\n* **$\\lambda$ Distribution:** To investigate the influence of $\\lambda$, we conduct experiments on CIFAR-10 using ResNet-18 with $\\lambda$ sampled from $\\mathrm{Uniform}(0,1)$, $\\mathrm{Beta}(1,1)$, and $\\mathcal{N}(0,1)$. Given that $\\mathcal{N}(0,1)$ can yield negative values, we transform $\\lambda$ into $\\mathrm{sigmoid}(\\lambda)$. **Table C.2** suggests that the distribution type of $\\lambda$ has little impact on the model's robust and natural performance.\n\n**Table C.2: DAT with Different $\\lambda$ Distributions**\nDistribution|Natural|AA\n-|:-:|:-:\nUniform|84.17%|51.36%\nBeta|84.06%|51.24%\nGaussian|84.09%|51.28%\n\n[n] Yun et al. Cutmix: Regularization strategy to train strong classifiers with localizable features. CVPR 2019.\n\n[o] Berthelot et al. Mixmatch: A holistic approach to semi-supervised learning. NeurIPS 2019.\n\n---\n\n**Discussion of Limitations**\n\n**R3:** Due to robust overfitting, DAT without AWP needs to be trained for a limited number of epochs, which restricts its performance. Moreover, while DAT primarily focuses on defending against adversarial attacks, other forms of image corruption (e.g., Gaussian noise and defocus blur) can also affect the model's performance. DAT requires further development to strengthen its protection against a broader spectrum of image corruptions. A comprehensive discussion will be included in the final version of the paper.\n\n---", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
Dear Reviewers and AC,

We sincerely appreciate the time and effort you have dedicated to evaluating our manuscript. The concerns and feedback raised during the initial review have significantly contributed to enhancing the quality of our paper. Below, we provide a summary of our key responses to the reviewers' suggestions and questions.

---

### **To Reviewer 8ttu**

1. **Performance Comparisons:**  
   To address concerns regarding experimental results, we conduct additional experiments comparing the performance of our DAT framework with DAJAT [1] and [47].  
   > See **R1** about DAJAT and See **R2** about [47] for Reviewer 8ttu.  

2. **Complexity Analysis:**  
   To clarify the complexity comparison between our DAT, DAJAT [1], and [47], we offer a detailed explanation of the hyperparameter settings and present the training time consumption analysis.  
   > See **R3** to Reviewer 8ttu.

---

 ### **To Reviewer KucH**

1. **Feature Space Attacks:**  
   In response to Reviewer KucH’s suggestions, we conduct experiments involving feature space attacks using various surrogate and target models. Detailed experimental comparisons are presented in **Tables 1-4** of the attached **rebuttal PDF**.  
   > See **R1** to Reviewer KucH.

2. **Backbone Diversity:**  
   As per Reviewer KucH’s recommendations, we perform experiments using a variety of backbones, including ViT, Inception, and DenseNet, and provide a comparative analysis between our DAT and existing methods.  
   > See **R2** to Reviewer KucH.

3. **ImageNet-1K Experiments:**  
   For ImageNet-1K, we conduct additional experiments to compare the performance of our DAT with current methods.  
   > See **R3** to Reviewer KucH.

---

### **To Reviewer FTsi**

1. **Clarification on Figure 1:**  
   Following Reviewer FTsi's suggestions, we further explain the impact of adversarial perturbations on phase and amplitude patterns. Additionally, we include more experimental results in **Figures 1-4** of the attached **rebuttal PDF**, demonstrating the influence of adversarial perturbations on both phase and amplitude, including their patterns and spectra.  
   > See **A1** to Reviewer FTsi.

2. **Theoretical Analysis Clarification:**  
   To clarify any confusion regarding learned features, we elaborate on our theoretical analysis, providing additional details and relevant citations.  
   > See **A2** to Reviewer FTsi.

3. **Time Consumption Explanation:**  
   To better illustrate the time consumption of DAT, we conduct experiments to provide a detailed analysis of the time and memory costs in comparison with other methods.  
   > See **A3** to Reviewer FTsi.

4. **Discussion of Limitations:**  
   In line with the suggestion, we outline additional limitations of DAT, which will be incorporated into the final version of the paper.  
   > See **R3** to Reviewer FTsi.

---

Meta-review: **Summary of the paper**

This paper proposes a new adversarial training method that improves adversarial robustness. Specifically, the authors focus on the frequency domain of adversarial perturbations and empirically verify that forcing the model to focus on the phase pattern would make the model more robust against adversarial attacks. Based on this observation, the authors propose an adversarial training strategy in which the model can learn the phase pattern unaffected by the adversarial attack. In particular, the authors suggest using a separate adversarial amplitude generator to keep the phase pattern unaffected by the adversarial attack. The authors provide some theoretical findings and experimental results regarding the proposed strategy.

**Summary of the discussion**

* In general, the reviewers mentioned similar strengths of the paper.
  * The paper is well-organized and easy to read.
  * Experiments show the improvement well. 
* Reviewer 8ttu pointed out two problems with the authors’ method.
  * First, the experiment baselines are weak, and one existing method, DAJAT, performs better. Regarding the first point, the authors emphasized that the proposed method requires fewer augmentations per sample compared to other methods that the reviewer mentioned.
  * Also, the proposed method is so complicated that it might require extensive searching for hyperparameters. Regarding this concern, the authors clarified that their method uses only two hyperparameters, which is much simpler than the existing methods.
  * After the discussion, the reviewer changed the rating from 5 to 6.
* Reviewer KucH pointed out three problems with the authors’ method.
  * First, only decision space attacks are used for performance evaluation.
  * Second, the authors should have used more models for experiments.
  * Third, the experiments were not performed on the ImageNet dataset.
  * The authors referred to their existing results (in the Appendix) regarding all the points.
  * After the discussion, the reviewer stayed at the original rating of 5.
* Reviewer FTsi pointed out two problems.
  * First, the proposed method is too complicated. Regarding the first concern, the authors emphasize that the method contains only two modules to argue that the proposed method is simple enough.
  * Second, some descriptions could be clearer, and some details should be included. The reviewer asked for clarification of the missing details as Questions. Then, the authors answered all four questions from the reviewers, providing more references.
  * After the discussion, the reviewer changed the rating from 5 to 6

**Justification of my evaluation**

* My rating is 6.
* I agree with the strengths the reviewers mentioned. The experiments show improvement, and the performance looks convincing.
* The authors communicated with the reviewers effectively, and as a result, two reviewers increased their ratings.
* All the weaknesses that Reviewer KucH mentioned were covered in the Appendix, so the reviewer should have changed the rating. The reviewer told me it does not fully address the questions, but I disagree with the reviewer's point that the experiments were insufficient.

I’m confident about my evaluation and recommend accepting this work (poster).
Decision: Accept (poster)