Bilevel Optimization for Adversarial Learning Problems: Sharpness, Generation, and Beyond
Authors: Risheng Liu
Zhu Liu
Weihao Mao
Wei Yao
Jin Zhang
Venue: NeurIPS 2025 poster ()
Keywords: Bilevel optimization
Sharpness-Aware Minimization
Generative Adversarial Learning
Accuracy-efficiency Trade-off
Primary area: optimization

Abstract: Adversarial learning is a widely used paradigm in machine learning, often formulated as a min-max optimization problem where the inner maximization imposes adversarial constraints to guide the outer learner toward more robust solutions. This framework underlies methods such as Sharpness-Aware Minimization (SAM) and Generative Adversarial Networks (GANs). However, traditional gradient-based approaches to such problems often face challenges in balancing accuracy and efficiency due to second-order complexities. In this paper, we propose a bilevel optimization framework that reformulates these adversarial learning problems by leveraging the tractability of the lower-level problem. The bilevel framework introduces no additional complexity and 
enables the use of advanced bilevel tools. We further develop a provably convergent single-loop stochastic algorithm that effectively balances learning accuracy and computational cost.
 Extensive experiments show that our method improves generation quality in terms of FID and JS scores for GANs, and consistently achieves higher accuracy for SAM under label noise and across various backbones, while promoting flatter loss landscapes. 
Overall, this work provides a practical and theoretically grounded framework for solving adversarial learning tasks through bilevel optimization.

Bilevel Optimization for Adversarial Learning Problems: Sharpness, Generation, and Beyond
Risheng Liui, Zhu Liu', Weihao Mao', Wei Yao Jin Zhang
Schooo of Software Technology, Dalian University of Technology
Mathematical Department, Southern University of Science and Technology
National Center for Applied Mathematics Shenzhen
Detection Institute for Advanced Technology Longhua-Shenzhee (DIATLHSZ)
rsliu@dlut edu. cn, liuzhu@mail. .dlut. edu. cn, mwhaea1 1345eeago345 com, yaow@sustech, edu. en, zhangj 99ssstechhhhh.mm.e.ooo.o
2hang]9Gssteechh edu. cn
Abstract
Adversarial learning is a widely used paradigm machine learning, often for- mulated as min-max optimization problem where the inner maximization im- poses adversarial constraints to guide the outer learner toward more robust so- lutions. This framework underlies methods such as Sharpness-Awan Aware Minimiza- tion (SAM) and Generative Adversarial Networks (GANs). However, traditional gradient-based approaches to such problems often face challenges in balancing accuracy and efficiency due to second-orde complexities. In this paper, we pro- pose bilevel optimization framework that reformulates these adversarial learning problems by leveraging the tractability of the lower-level problem. The bilevel framework introduces no additional complexity and enables the use of advanced bilevel tools. We further develop provably convergent single-loop stochastic algorithm that effectively balances learning accuracy and computational cost. Ex- tensive experiments show that our method improves generation quality of GANs, and consistently achieves higher accuracy for SAM under label noise and across various backbones, while promoting flatter loss landscapes. Overall, this work provides practical and theoretically grounded framework for solving adversarial learning tasks through bilevel optimization.
Introduction
Nowadays, adversarial learning has attracted considerable attention due to its broad applicability in machine learning, particularly in addressing f'armesss and robustness. Typically formulated as a min-max optimization problem [46, 80 [6],, adversarial learning involves maximizing an inner objective impose adversarial constraints, thereby guiding the outer learner toward more robust solutions. This framework underpins wide range of applications. In Generative Adversarial Net- works (GANs) [X. B3, 66. 77, [ a generator (minimizer) and discriminator (maximizer) com- pete to improve the quality of synthetic data. In Sharpness- Aware Minimization (SAM) [E. 58, 69). adversarial perturbations on model parameters encourage optimization flatter loss regions. ad- versarial training (62), Hd IL Σα], input-space attacks are maximized to enhance model robustness against perturbations. These examples highlight the foundational role of adversarial learning across various domains.
Despite the widespread adoption and their empirical success, the traditional min-max framework introduces significant challenges for scalability, primarily because each training step involves
"Corresponding Author
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

multiple nested maximization steps. This results in prohibitively high computational costs, ren- dering these methods impractical for many real-world applications and further understandings [32, 80, 61, 64. 82].
Among the various applications of adversarial learning, (SAM) as a representative example to highlight the challenges inherent in the min-max formula- tion and to motivate the need for a new reformulation.
Sharpness-Aware Minimization
Sharpness-Aware Minimization. Due to the influence of noise and overparameterization, mod- neural networks are often prone to overfitting, resulting in poor generalization performance [778, 15% [68]. This challenge remains a significant barrier to further progress in machine learning. Recent numerical and theoretical studies have revealed a strong correlation between model's gen- eralization ability and the sharpness of the loss function landscape around its optimized parameters [28, 12, 14, 50, 22]. Classical optimization methods, which aim solely minimize the value of the loss function, often fail to account for this geometric aspect and are thus insufficient for improving generalization.
To overcome this, researchers have turned their attention to the geometry of the loss surface, par- ticularly the sharpness near minimizers, leading to the formulation of min-max problem. This direction has culminated in the development of Sharpness-Awar Minimization (SAM), which ex- plicitly incorporates sharpness into the optimization process [7 SR. IT. 5J]]. Recent work by [[9]] further suggests that SAMs effectiveness lies in its ability to balance the quality of diverse features, rather than merely seeking flatter minima.
Difficulties in SAM: Min-Max Perspective. Despite the rapid development and empirical success of SAM, algorithms based on SAMs original min-max formulation require implicit differentiation, which is computationally demanding. To reduce cost, practical implementations often avoid this step, but at the expense of accuracy, even with various refinements [ITG, ISS D. 688. For example, [72] incorporated second-order information to improve efficiency. Most theoretical analyses, how- ever, still rely the full SAM formulation without simplifications [S. 68, 59, M.] For instance, [TG]] derived a PAC-Bayes bound for an averaged direction model, while [68] showed SAMs local regularization effect on the Hessian eigenvalues. These results point to gap between simplified practical algorithms and the theoretical models that justify them.
Difficulties in Adversarial Learning: the Min-Max Perspective. The challenges encountered in SAM are not isolated but reflect broader set of issues faced in many adversarial learning tasks. Similar difficulties appear in fast adversarial training [80, M]. generative adversarial learn- ing [M 154. 61, 82). These methods frequently exhibit the following limitations [62, S0]; (i) reduced computational cost at the expense of learning accuracy, and (ii) lack of sufficient theoretical guar- antees.
These recurring issues raise fundamental question:
Is there an efficient framework that balances computational cost and learning accuracy in such adversarial learning tasks?
To address this, we propose unified bilevel optimization perspective, where the lower-level prob- lem is chosen to be simple and, in many cases, admits a closed-form solution. This design allows us apply advanced bilevel optimization theory and algorithms without increasing computational burden, as the lower-level remains analytically tractable. As result, the proposed framework of- fers a principled and efficient approach applicable to various tasks, including SAM and generative adversarial networks, as discussed in this paper.
Contributions. We summarize our contributions as follows:
Formulation-wise. We propose unified bilevel optimization framework to reformulate range of adversarial learning tasks, including SAM and GANs, by introducing an efficient lower-level problem. This formulation enables the use of advanced bilevel optimization algorithms, achieving better balance between computational efficiency and learning accuracy.
Experiment-wise. We conduct comprehensive experiments to evaluate the proposed bilevel frame- work, focusing on Sharpness-Awe (GAN). The results demonstrate that our approach effectively balances computational cost and nu- merical accuracy, highlighting its practicality and robustness in real-world adversarial learning tasks.
Minimization (SAM) and generative adversarial learning
2

---

2
Related work
Examples from the Traditional Perspective. In recent years, mathematical formulations and corre- sponding optimization algorithms have played an increasingly prominent role in adversarial learning. Prominent examples of min-max formulations include adversarial training [178 770, M.] and genera- tive adversarial learning [5. 24,, 99, 27, 2G AX
25,, 9. 2K! Zal.. While these approaches often reduce
computational complexity, they tend compromise model accuracy and robustness.
As an illustrate example, [16] leveraged the relationship between flat minima and generalization error to train deep neural networks (DNNs) with improved generalization across natural distributions using SAM. Similarly, [/]i] proposed a method that regularizes the sharpness term in adversarial training. achieving significantly more robust generalization against adversarial attacks. A substantial body of research has explored combining SAM with other training strategies or neural architectures [TI, 67, [33] For instance, [3T]] improved SAM by scaling the sharpness adjustment relative to the parameter size, while [ optimized computational efficiency by reusing previously computed weight perturbations. Numerous efforts have been made to refine and adapt the SAM algorithm. For example, [[33] introduced the Efficient Sharpness-Awand
Minimizer (ESAM), which incorporates two key training strategies: Stochastic Weight Perturbation (SWP) and Charpness-Sensitiee Data Selection (SDS). [52]] provides a unified framework of analysis on SAM.
Bilevel Optimization. Bilevel optimization is hierarchical framework involving upper-level and a lower-level problem. It is a highly challenging yet impactful area in both theory and practice. This framework has led to significant progress in machine learning domains such as hyperparameter selection [53], 17,, [55l and meta-learning [6L, 30, 50% 17, 6G.
21. 75, [I] [744] proposed a bilevel
algorithm for the 0-1 classification problem, and [X]] introduced bilevel reformulation of fast ad- versarial training originally modeled as a traditional min- max problem in [= In this work, we take the step toward establishing bilevel perspective for adversarial learning tasks, and propose corre- sponding algorithms and theoretical analyses to overcome the limitations of traditional perspectives.
The Bilevel Perspective Beyond the Traditional Framework
In this section, we first revisit the traditional optimization approach commonly used in adversar- ial learning tasks, using Sharpness-Aware Minimization (SAM) as a representative example, and point out their key limitations. We then introduce a bilevel optimization perspective featuring an efficiently solvable lower-level problem. This reformulation enables the application of advanced bilevel methods without incurring additional computational complexity, offering principled and practical framework for a broad class adversarial learning problems.
3.1 Preliminary on The Traditional Perspective: Min-Max Formulations
We begin by introducing a widely used min-max optimization formulation that underlies several adversarial learning applications, such as adversarial training [78] 77, M], generative adversarial learning (55L 24, 277 26, 48,
25
9 2x! I6]), and, as discussed in the next subsection, SAM.
Consider the standard min-max formulation for many adversarial learning tasks:
min max L(w, 5),
(1)
SEC
where the parameter w E IR", 8 E C
C
C represents the regular closed constraint set. Let
N
S U ((us, v:)) represents the training dataset sampled from the data space U4 x V. The function
=1
L R R R is the empirical loss defined as
1 N Ls(w, 8, u4, U));
T( 6) = Σ
where Ls R xux R4 is the per-sample loss. The goal is to learn optimal parameters w and that solve the min-max objective (L).
The loss function L[w, 8) is often nonconvex with respect to both w and 6. This nonconvexity implies that local or global minimizers with identical loss values may exhibit vastly different neighborhood behaviors and theoretical capabilities.
3

---

An example of the computational challenges in min-max problems is provided by [733], where 128 GPUs were used to rum Adversarial Training (AT) on the ImageNet dataset. Such computational re- quirements highlight the prohibitive costs of solving large-scale min-max problems directly. Several computational techniques have been proposed improve the efficiency of min-max optimization. For instance, gradient alignment (GA) regularization [M]] and fast adversarial training methods [[0]] have been developed to address these challenges. However, these methods often suffer from prac- tical issues such instability, catastrophic overfitting, and degraded robustness [32, S[]. These limitations underscore the need for more robust and scalable approaches, such as the bilevel per- spective.
3.2 SAM: An Example of The Traditional Perspective
In this subsection, we present an example of Sharpness- Aware Minimization (SAM) [TG]., which is based on the observation that the generalization ability of a model is closely related to the sharpness of its loss function landscape.
Consider local neighborhood around a parameter w with radius r > 0 and a unit direction 6. SAM introduces the following min-max formulation:
min L(w) + max [I( + r8) T((W]]
(2)
which can be equivalently written as:
min max L(w + r8), 10
(3)
where C {6 E R" : |8|| < 13 the set of feasible perturbations, and r denotes the radius. This formulation augments the original loss function L(w) by incorporating a sharpness term L(w - rō) - L(w), which captures the worst-case increase the loss within the neighborhood defined by r5. The goal of SAM is thus twofold: minimize the loss function while simultaneously reducing sharpness in the worst-case direction.
The common strategy to address these computational challenges is to adopt approximation tech- niques. In the context of (2), the maximum function Liax R" R is defined as:
Lmax (w) == max L(w + r8), |
(4)
where r denotes the neighborhood radius. The traditional SAM algorithm minimizes Liax( by employing an approximation technique and a subsequent discard process.
Numerical Technique The approximation begins with a first-order Taylor expansion around wt
L(w rō) L(w) + rō V L(w).
Using this approximation, the maximizer 8 (w) is computed as:
VoL(W)
8" 8'(w) arg max [L(w) r V L(W)] 1 S1
L(WII
Substituting (w) back into the SAM formulation, it becomes:
Vol(W)
min LASc(w) L (w [IV
(
(6)
To efficiently compute the gradient, traditional methods calculate:
VaI(w + (w)) = d(w rō*(w))
V.I rr)
dw
(7)
V. + r8 (w)) - d6 ((
de
The second term, 8* (w),, which is computationally expensive evaluate. Therefore, traditional methods often discard
d5 (w) dw V V..L(w + r8* (w)), involves the derivative of the composition function

---

this term to simplify the gradient computation IR. 68 29]. be expressed as:
Thus, the standard iterative process can
VL(W*)
wh w
tVL
w +
[VL(w*)]]
(8)
where 0 the step size. Convergence analysis for this iterative scheme and its extensions has been extensively studied (e.g., [T6 29, 52]).
Importance of Hessian. To better understand the behavior of SAM, consider Table II In the table, A denotes the largest eigenvalue, Amin the smallest non-zero eigenvalue, Tr the trace operator, and H (w) the Hessian of the loss function L at w.
Table I: Definitions and biases of different SAM loss formulations [68].
Type of Loss
Definition
Biases
Worst
max L(w rd)
min A (HL(w))
18151
Ascent
L ( W MMCll
VL(w)
min Ami (H)(
Average
E E(,.))DDLss( (ws, u, w)]
min (w))
In Table II the worst-direction loss captures the sharpest curvature of the loss landscape and is associated with λ1. The ascent-direction loss reflects the local curvature along the most favorable direction of increase and corresponds to Amin- Finally, the average-direction loss characterizes the overall sharpness of the loss surface and is measured by Tr(Hr(w)) From this table, it is clear that the effectiveness of the SAM technique in minimizing sharpness arises from incorporation of second-order information via the Hessian matrix H (w)) Specifically, the largest eigenvalue A1 (w)) directly measures the sharpness of the loss function. This connection explains why SAM improves generalization by reducing sharpness. In fact, prior studies (e.g., [e gl {
have used X1 ( (w)) as key metric to evaluate SAM's efficiency enhancing generalization performance.
Loss of Accuracy. While the discarding step reduces computational costs, it introduces inaccuracies that may compromise learning performance. Specifically, in (Z)) we have
1 d8* dā)(w) Ve (IVL(W))) = |V (HL(w) VLw du
VL(w)
(9)
||V[(w)]
where Hy(w) denotes the Hessian of the loss function L (details are in Subsection I.). The term discarded in (αI) contains valuable geometric information about the loss landscape, which plays critical role in establishing theoretical guarantees and ensuring robust optimization [68,, 699]. This discrepancy between the theoretical formulation and its practical implementation highlights the need for a more principled and efficient framework. Experiments in Subsection 55.0 also shows that its loses accuracy.
3.3 The Bilevel Perspective
We introduce the bilevel perspective to address the limitations of traditional approaches, offering a simple lower-level problem without introducing additional complexities.
Bilevel Perspective. The bilevel optimization framework provides a natural and effective solution to the challenges in traditional perspectives. This formulation facilitates the application of advanced methods, such as those based on the Moreau envelope. Crucially, the lower-level problem remains simple and tractable, avoiding unnecessary complexity. This structure allows for the preservation of learning accuracy while managing computational costs, making it a robust alternative to traditional formulations.
Specifically, by selecting a suitable lower-level function L R x R + R, we reformulate traditional models such the min-max problem (II) into bilevel optimization problem:
min L(w, 8)
(10)
subject to ă = arg min Le 8)}.
dEC
5

---

where the lower-level problem allows efficient computation of the optimal solution for given w, and C denotes the feasible set for ò.
As an example, consider the SAM formulation in (2)) and ( By setting Le(w, == (L.)..
the lower-level problem becomes linear program the unit ball C. This admits closed-form solution: | Hence, this bilevel reformulation introduces no additional complexity com- pared to the original model. In this case, the bilevel formulation (IC) is equivalent to the traditional SAM model (2)) The bilevel perspective allows both theoretical analysis and numerical optimization
Vi(w)
tools from bilevel programming to be applied effectively to such tasks.
Algorithm and Theoretical Investigation
Given the bilevel perspective, we now investigate algorithms tailored for this type of bilevel op- timization. Solving large-scale bilevel optimization (BLO) problems for complex learning tasks presents two significant challenges: ensuring computational efficiency and guarantees of accuracy. To address these challenges, we apply a stochastic single-loop algorithm adopted from [3I], inspired by [IS],, based on the Moreau envelope.
Value Function. One of the main challenges in solving bilevel programming problems (BLPPs) lies in their nested structure: upper-level objective based on that solution.
must first solve the lower-level problem and then optimize the
Let the value function be defined as
((w) == min Le(w, 8).
6EC
Then, the bilevel problem (II)) can be equivalently reformulated as:
min L(w,0) 6)
(11)
subject to Le(w,8) V (w) 0, 8
However, the nonsmooth and nonconvex nature of V V(w) poses significant computational challenges.
Moreau Envelope. To address this issue, we reformulate the problem using the Moreau envelope of L)( with parameter y > 0:
(y(w () inf SEC
0) [e(lw,))
1 1/ 110 5112 24
(12)
The Moreau envelope provides smooth approximation to the value function. Geometrically, defines a family of smooth surfaces that approximate the graph of V. Using this, we reformulate problem (IIO) as:
min 0)
(13)
subject to
- - S, EEC.
If Le(w,)) is convex in 8 for each fixed w, then (III and (L<) are equivalent [TS, Theorem 2.1.. If Le(w, :) is only weakly convex, then the latter is a relaxation of the former [M0 Theorem A.
Note that 6) (w, 6) 2 0 for all (w.8) R x C. the constraint is effectively an equality constraint. This violates standard constraint qualifications and complicates the derivation of optimality conditions.
To circumvent this, we introduce a penalty parameter μ > and consider the penalized problem:
min (w, 6) = I(w, 6) + [Te(w, 8) u. (w, 8)), subject to 5 E C.
(14)
Algorithm. Based on the Moreau envelope, we propose a single-loop stochastic algorithm. At iteration k. given mini-batch 6% (L....,Ny N). define:
L (w,, 6)
Σ Ls(w, 8, u,,,,,), ie
(15)
[bxl

---

where Ls denotes the sample-wise loss. The batch-based lower-level loss is denoted as L (w, 6). The update is computed using gradients of I (w, 6), as described in (I8).
Unlike SAM [17] -0 or fast adversarial training [80], method avoids computing gradients of
composite functions, thus significantly reducing computational cost while preserving robustness
and accuracy.
Convergence Analysis. We define the residual function using the selected mini-batch by:
R (w: 6) == dist (., " (w, 6) + 1a V (w, 6) - Vul Vula (w, (w, 5)) + NR xc(,, ())
where NR xe(w, 6) is the normal cone R (w.
When by = N... denote
R& (w, 6) dist (0, VI(W, 6) + Ma (VLe(w, 6) - Veylu, 6)) + xc
This residual serves as stationarity measure for the penalized problem: min Fu, (w, 8) = L(w, 8) + Pa [L 8) Byy (w, subject Sec.
(16)
A point (w, 5) is stationary for (ITS) if and only if Rg 6) 0.
Special Case: SAM. the SAM setting where (ww, 6) L(w++() and Le(w, -88 - VWL(w). the lower-level solution is given by:
0w, VL(W)
[V
Then the gradient of the penalized objective becomes:
(w,, 6) (VL(W + r5), rVL(w + r8) /VL(w))
Thus [w, 8) captures the sharpness in the ascent direction model (8). We then present the follow-
ing convergence result for the proposed algorithm:
Theorem 4.1. Assume the algorithm satisfies some standard conditions. Then for any p E (0. ),
we have:
R (w (W 84411) LoSkSK
=0 (0 (
E min
(17)
Figure M compares the convergence performance of our algorithm with existing bilevel methods, demonstrating its superior efficiency.
BAMM
BAMM BOME
BAMM
BAMM
0.8
BOME
0.8
CG
0.8
BOME
CG
1.5
OG
BOME
3
0.6
JAPTT
5 0.6
IAPTT
5
IAPTT
[|6 81
IAPTT
RIG
RIG
RHG
RIG
0.4
VPBGD
0.4
VPBGD
VPBGD
VPBGD
0.2
Preposed
0.2
Proposed
0.2
Propased
0.5
Proposed
0.8
1.6
2.4
0.8
1.6
0.8
1.6
2.4
Time (S)
Time (S)
Time (S)
Time (S)
(a) || w"]
(b)
| 8*1|
(c) ||l w"
(d)
8"11
Figure 1: Illustration of convergence behaviors compared with representative BLO schemes.
Future Generalization. For various types of min-max problems, modern methods have been pro- posed (c.g.. [ D. 32 S0 b)))). For instance, [6>]] investigates min-max problems of the form ming max ((F()), G())) in the
setting. Our method can be applied to some of these problems, particularly when the inner concave subproblem max, L(F(A), G(Ø)) is tractable, but solving the overall min-max problem requires sacrificing learning accuracy for computational efficiency. Some of these problems suffer from cyelic behavior of level sets (see Figure [65]]). Unlike the approach in [65]. we address this issue through a bilevel reformulation, whose conver- gence is established Theorem A. In such cases, our bilevel framework provides a compelling alternative, offering more favorable balance between learning accuracy and computational cost.
7

---

5 Experiments
In this section, we validate the performance under two real-world learning applications, including generative ad adversarial network and sharpness-ware minimization. Then we demonstrate the supe- riority of proposed scheme, illustrating the convergence behaviors and computation efficiency on synthetic numerical problems compared with existing BLO schemes. Details of implementation configurations and parameters selection are provided in the Appendix H. The source codes will be released at
Table 2: Evaluation of the robustness for SAM under varying noise labels and diverse backbones.
Noise Label
SGD
SAM
Ours
Backbone
SGD
SAM
Ours
Clean
95.47
0.12
96.2710.03
96.34.10.. 0.11
ResNet34
95.58 1 0.15
96.61 1 0.08
97.75 0.06
10%
89.58 + 0.19
02.5
03.41+00.18
ResNet50
95,40 = 0.44
96.48 = 0.05
96.50 + 0.09
20%
82.64 + 0.31
90.80+H0.33
91.48 0.06
ResNet101
95.66 + 0.18 96.60 + 0.13
96.69 + 0.05
Table 3: Evaluation of the robustness based on sharpness metrics and diverse perturbation rates.
Sharpness Metrie
SGD
SAM
Ours
Perturbation
SAM
Ours
Hessian Norm
8.869 1 3.31
3.840 4.412.11.84
r=0.05
96.22 1 0.13
96.23 1 0.10
Trace
13756 + 1710
665011 1828
502311101
r=0.15
96.25 1 0.05
96.38 1 0.26
Top Eigenvalues
1048.347
621.349
520.889
0=02
96.26 + 0.05
96.28 + 0.17
8/8
7:8
088
S88
88
8/8
Wheel
Targst
SNIAAN
(b) WGAN
(O)LGGA
(e) Proposed
Figure 2: Comparison of generative adversarial learning under synthesized 2D wheels.
5.1 Real-world Applications
Generative Adversarial Learning. We conduct comparison with Stacked MNIST, a challenging dataset with 1000 modes and two- dimensional simulation experiments based on Gaussian distribution, generating eight distribution of 2D wheels. Table E reports the nu- merical performances compared with specialized methods, in terms of KL divergence and the maximum of modes. The visualization of data generation is shown in Figure D It can be observed that the proposed scheme can effectively generate all modes, compared with
Table 4: Performance
comparison of GAN on StackedMNIST.
Methods
Modes
D Drr.
DeGAN
[S
3.40
VEEGAN 600
150
2.95
WGAN G
959
0.73
SNGAN [ WGAN [3), L.CAN [15S] and UGAN [+
PacGAN 12
992
0.28
R3GAN (00
1000
0.12
Sharpness-ware Minimization. As aforementioned, we propose a BLO perspective for SAM with computation accuracy and efficiency. Table 2 illustrates the robustness of different optimizer under varying levels of label noise and backbones on the C1 benchmark. Compared to standard SGD and SAM, our method consistently achieves superior accuracy across all noise labels and backbone, demonstrating its adaptability and robustness. Table El presents the analyses of model robustness based on sharpness- aware metrics, specifically analyzing the Hessian properties and the impact of varying perturbation rates r. The Hessian Norm quantifies the overall curvature of the loss landscape. The trace of the Hessian matrix reflects the sum of its eigenvalues. Lower top eigenvalues correspond to smoother loss surfaces. These metrics indicates our method encourages convergence toward flatter, more robust regions in the parameter space. Furthermore, Ours achieves consistently higher accuracy than SAM, demonstrating the practical robustness against diverse perturbation radius.
Ours
1000
0.08
5.2 Synthetic Numerical Evaluation
General Min-Max Numerical Cases. Here, we compare the convergence behavior of our method with representative bilevel optimization (BLO) schemes, including -aased algorithms (e.g..
8

---

RHG | CG
E3I single-loop approach BAMM
IAPTT
37 39
first-order methods (e.g., BOME [35], VPBGD [
and the
150
EBG DC
BOME VPBCD DAMM
BUGSAT
120
BDA JAPUT
100
VPRGID
JAPTT
Time
Propreed
Tinre
Proposel
Propoeed
Proposed
40
100
1000
10000
1000
10000
(a) Comparison with Hessian-based algorithms
(h) Comparison with Hessian-free algorithms
Figure 3: Computation efficiency comparison as the dimension of samples and features increase.
The first min-max numerical example is min maxSeR w² -2 + sin(()))) where a controls the nonlinearity. This problem features bilinear coupling and oscillatory components, resulting in multiple saddle points that can hinder convergence. For simplicity, we set w. 8 [0, 1]. with the optimal solution at 0). Figure II (a) and (b) show the convergence of various BLO methods in terms of || - w*I and ||ō 8" Our method achieves the fastest convergence across both metries, while BOME and VPBGD exhibit slower decay and higher residuals. We also consider a more challenging case: min,, max; W Ab + [an[|w:]2 [8]1²), where w, 6, A E R. The nonlinear squared coupling introduces varying oscillation frequencies and degenerate critical points. With w, 8 E [0, 1] and method maintains superior convergence speed and stability, while other approaches, including BAMM, BOME, CG, and VPBGD, suffer from oscillations in the lower-level updates.
and constrain
1, the solution remains (0, 0). Figure M (c) and (d) illustrate that
Large-scale Computation Efficiency. We construct a synthetic numerical case to perform the large-scale computation, which is formulated as min, maxş Li Σi - (in((w.,66.))) where m and denote the numbers of samples and dimensions. Figure illustrates the computa- tion time of single step under varying numbers of samples and feature dimensions. Compared with Hessian-free algorithms,, value function based schemes (e.g., BVFSM [[8], BOME and VPBGD) suffer from steep computational increases, especially with larger feature dimensions. Moreover, compared with single-loop scheme BAMM, the proposed method remains highly efficient, improv- ing 16.8% at 10000 samples.
Conclusion
This paper presents a unified bilevel optimization framework for solving adversarial learning tasks, aiming to balance computational efficiency and learning accuracy. Motivated by the limitations of traditional methods, such as high cost and limited theoretical grounding, our approach offers an efficient and interpretable alternative. In particular, it effectively addresses Sharpness-Awan Minimization (SAM) and generative adversarial learning tasks. Extensive experiments show that method captures all data modes in generative modeling and improves FID and JS scores. For SAM, consistently achieves higher accuracy under label noise and across different backbones, while encouraging flatter loss landscapes. Overall, this work provides practical and theoretically sound foundation for addressing ad adversarial learning tasks via bilevel optimization.
Acknowledgment
This work is partially supported by the National Natural Science Foundation of China 6N0s.62450072, U22B2052, 624B2033, 12371305, 12222106 12326605), the Distinguished Youth Funds of the Liaoning Natural Science Foundation (No. 20o.2025JH6/1011 10000001), the Distinguished Young Scholars Funds of Dalian (No.2024RJ002), the Fundamental Research Funds for the Central Universities. Guangdong Basic and Applied Basic Research Foundation and the Longhua District Science and Innovation Commission Project Grants of Shenzhen (No.202501 13G43468522). We thank the anonymous reviewers for their valuable comments and constructive suggestions this work. Authors listed in alphabetical order.

---

References
[1] Andriushchenko, M. and Flammarion, N. Understanding and improving fast adversarial train- ing. Advances in Neural Information Processing Systems, 33:16048-16000 2020.
[2] Andriushchenko, M. and Flammarion, N. Towards understanding sharpness-awe aware minimiza-
tion. In International Conference Machine Learning, pp. 639-668, 2022.
[3] Arjovsky, M., Chintala, S., and Bottou, L.. Wasserstein generative adversarial networks. In International conference machine learning, pp. 214-223, 2017.
[4] Arora, S., Li, Z., and Panigrahi, A. Understanding gradient descent on the edge of stability in deep learning. In International Conference on Machine Learning, pp. 948-1024, 2022.
[5] Bartlett, P. L.., Long, M., and Bousquet, O. The dynamics of sharpness-aware minimization: Bouncing across ravines and drifting towards wide minima. Journal of Machine Learning Research, 24:1-36, 2023.
[6] Bennett, K. P., Kunapuli, G., Hu, J., and Pang, J.-S. Bilevel optimization and machine learning. In IEEE world congress computational intelligence, pp. 25-47. Springer, 2008.
[7] Cai, Q.. Hong, M., Chen, Y., and Wang, On the global convergence imitation learning: case for linear quadratic regulator. arXiv preprint arXiv: 1901.9367, 2019.
[8] Chan, R., Monteiro, M., Kellnhofer, P., Wu, J., and Wetzstein, G. pi-gan: Periodic im- plicit generative adversarial networks for 3d-aware image synthesis. In IEEE Conference on Computer Vision and Pattern Recognition, pp. 5799 5809, 2021.
[9] Chen, T., Cheng, Y., Gan, Z., Liu, J., and Wang, Z. Data-efficient gan training beyond (just) augmentations: A lottery ticket perspective. Conference on Neural Information Processing Systems, pp. 20941-20955, 2021.
[10] Chen, X., Hsieh, C.-.,, and Gong, B. When vision transformers outperform resnets without pre-training or strong data augmentations. In International Conference on Learning Represen- lations, 2022.
[11] Chen, Z., Zhang. J., Kou, Y., Chen, X., Hsieh, C.-J,, and Gu, Q. Why does sharpness-aware minimization generalize better than sgd? In Advances in Neural Information Processing Sys- tems, volume 36, pp. 72325-72376 2023.
[12] Dinh, L., Pascanu, R., Bengio, S., and Bengio, Y. Sharp minima can generalize for deep nets. In Proceedings of the 34th International Conference on Machine Learning, pp. 1019-1028, 2017.
[13] Du, Yan, H., Feng, Zhou, J., Zhen, L., Goh, R., and Tan, V. Efficient sharpness-ave aware minimization for improved training of neural networks. In Proceedings of International Con- ference on Learning Representations, 2022.
[14] Dziugaite, G. K. and Roy, D. M. Computing nonvacuous generalization bounds for deep (stochastic) neural networks with many parameters than training data. In Uncertainty in Artificial Intelligence, 2017.
[15] Engel, J., Hoffman, M., and Roberts, A. Latent constraints: Learning to generate conditionalyy from unconditional generative models. In International Conference on Learning Representa- fions, 2018.
[16] Foret, P., Kleiner, A., Mobahi, H., and Neyshabur, B. Sharpness-awart minimization for ef- ficiently improving generalization. In International Conference on Learning Representations, 2021.
[17] Franceschi, L., Frasconi, P., Salzo, S., Grazzi, R., and Pontil, M. Bilevel programming for hy- perparameter optimization and meta-learning. In International Conference on Machine Learn- ing, pp. 1568-1577, 2018.
10

---

[18] Gao, L. L., Ye, J. J., Yin, H., Zeng, S., and Zhang, J. Moreau envelope based serrrenceoo-wwaalyycoooeee reformulation and algorithm for bilevel programs. arXiv preprint arXiv:2306. 16761, 2023.
[19] Huang. F. Optimal bessian/jacobian free nonconvex-pl bilevel optimization. In International Conference on Machine Learning. 2024.
[20] Huang, N., Gokaslan, A., Kuleshov, V., and Tompkin, J. The gan dead: long live the gan! modern gan baseline. Advances in Neural Information Processing Systems, 37:44177-44215, 2024.
[21] Ji, K., Lee, J. D., Liang, Y., and Poor, H. V. Convergence of meta-learning with task-specific adaptation over partial parameters. In Conference on Neural Information Processing Systems, 2020.
[22] Jiang, Y., Neyshabur, B., Mobahi, H., Krishnan, D., and Bengio, S. Fantastic generalization measures and where to find them. In International Conference on Learning Representations, 2020.
[23] Jiang, Y., Chang, S., and Wang, Z. Transgan: Two transformers make strong gan. In Conference on Neural Information Processing Systems, 2021.
[24] Karras, T., Aila, T., Laine, S., and Lehtinen, J. Progressive growing of gans for improved quality, stability, and variation. In International Conference Learning Representations, 2018.
[25] Karras, T., Laine, S., and Aila, A style-based generator architecture for generative adversar- ial networks. In IEEE Conference Computer Vision and Pattern Recognition, 2019.
[26] Karras, T., Aittala, M., Hellsten, J., Laine, S., Lehtinen, J., and Aila, T. Training generative ad- versarial networks with limited data. In Conference on Neural Information Prucessing Systems, 2020.
[27] Karras, T., Laine, S., Aittala, M., Hellsten, J., Lehtinen, J., and Aila, T. Analyzing and im- proving the image quality of stylegan. In IEEE Conference on Computer Vision and Pattern Recognition, 2020.
[28] Keskar, N. S., Mudigere, D.. Nocedal, J., Smelyanskiy, M.. and Tang, P. T. On batce-batch training for deep learning: Generalization gap and sharp minima. In International Conference on Learning Representations, 2017.
[29] Khanh, P. D., Luong, H.-C., Mordukhovich, B., and Tran, D. B. Fundamental convergence analysis of sharpness-awas aware minimization. In Conference on Neural Information Processing Systems, 2024.
[30] Kunapuli, G., Bennett, K. P., Hu, J., and Pang, J. S. Classification model selection via bilevel programming. Optimization Methods and Software, 23(4):475-489, 2008
[31] Kwon, J., Kim, J., Park, H., and Choi, I. K. Asam: Adaptive sharpness-aware minimization for scale-invariant learning of deep neural networks. In International Conference on Machine Learning, pp. 5905-5914, 2021.
[32] Li, B., Wang, S., Jana. S., and Carin, L. Towards understanding fast adversarial training. arXiv preprint arXiv:2006.03008, 2020.
[33] Li, R., Wang, C., Wang, J., Liu, G., Zhang, H.-Y., Zeng, B., and Liu, S. Uphdr-gan: Generative adversarial network for high dynamic range imaging with unpaired data. IEEE Transactions on Circuits and Systems for Video Technology, 32(1 1):7532-7546 2022.
[34] Lin, Z., Khetan, A., Fanti, G., and Oh, S. Pacgan: The power of two samples in generative adversarial networks. Advances in neural information processing systems, 31, 2018.
[35] Liu, B., Ye, M., Wright, S., Stone, P., and Liu, Q. Bome! bilevel optimization made easy: A simple first-order approach. Advances neural information processing systems, 35:17248- 17262, 2022.
11

---

[36] Liu, R., Mu, P.. Yuan, X., Zeng, S., and Zhang, J. A generic first-order algorithmic frame- work for bi-level programming beyond lower-level singleton. International Conference on Machine Learning, pp. 6305-6315, 2020.
[37] Liu, R., Liu, Y., Zeng, S., and Zhang, J. Towards gradient-based bilevel optimization with non-convex followers and beyond. Advances in Neural Information Processing Systems, 34: 0662-8675, 2021.
[38] Liu, R., Liu, X., Zeng, S., Zhang, J., and Zhang, mization for bi-level optimization. IEEE Transactions on Pattern Analysis and Machine Intel- ligence, 1531)))5590015994 2023.
sequential mini-
[39] Liu, R., Liu, Y. Yao, W., Zeng. S., and Zhang, J. Averaged method of multipliers for bi-level optimization without lower-level strong convexity. International Conference on Machine Learning, pp. 21839-21111 21866, 2023.
[40] Liu, R., Liu, Z. Yao. W., Zeng, S., and Zhang, J. Rethinking moreau envelope for noncon- vex bi-level optimization: A single-loop and hessian-fris ffree solution strategy. In International Conference on Learning Representations, 2024.
[41] Liu, S., Li, S., and Cheng, H. Towards an end-to-end visual-to-raw-audio generation with gan. IEEE Transactions on Circuits and Systems for Video Technology, 12(3):1299-133 2021.
[42] Liu, Y., Mai, S., Chen, X., Hsieh, C.-J., and You, Y. Towards efficient and scalable sharpness- aware minimization. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, 2022.
[43] Luo, H., Truong, T., Pham, T., Harandi, M., Phung, D., and Le. T. Explicit eigenvalue reg- ularization improves sharpness-aware minimization. In Conference on Neural Information Processing Systems, 2024.
[44] Lyu, K., Li, Z., and Arora, S. Understanding the generalization benefit of normalization layers: Sharpness reduction. Advances in Neural Information Processing Systems, 35:34689-34777 347008 2022.
[45] Mackay, M., Vicol, P., Lorraine, J., Duvenaud, D., and Grosse, R. Self-tuning networks: Bilevel optimization of hyperparameters using structured best-response functions. In Inter- national Conference on Learning Representations, 2019.
[46] Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning mod- els resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
[47] Metz, L., Poole, B., Pfau, D., and Sohl-Dickstein, J. Unrolled generative adversarial networks. arXiv preprinl arXiv: 161 1.02/63,, 2016.
[48] Miyato, T. and Koyama, M. egans with projection discriminator. In International Conference on Learning Representations, 2018.
[49] Miyato, T., Kataoka, T., Koyama, M., and Yoshida, Y. Spectral normalization for generative adversarial networks. In International Conference on Learning Representations, 2018.
[50] Neyshabur, B., Bhojanapalli, S., McAllester, D., and Srebro, N. Exploring generalization in deep learning. In Advances in Neural Information Processing Systems, pp. 5947-5956, 2017.
[51] Norton, M. D. and Royset, J. O. Diametrical risk minimization: Theory and computations. In Machine Learning, pp. 1-19, 2021.
[52] Oikonomou, D. and I Loizou, N. Sharpness-aware minimization: General analysis and improved rates. In International Conference on Learning Representations, 2025.
[53] Pedregosa, Hyperparameter optimization with approximate gradient. In International con- ference machine learning, pp. 737-746, 2016.
12

---

[54] Radford, A., Metz, L., and Chintala, S. Unsupervised representation learning with deep convo- lutional generative adversarial networks. arXiv preprint arXiv:1511.064333 2015.
[55] Radford, A., Metz, L.., and Chintala, S. Unsupervised representation learning with deep convo- lutional generative adversarial networks. In International Conference on Learning Representa- lions, 2016.
[56] Rajeswaran, A., Finn, C., Kakade, S. M., and Levine, Meta-learning with implicit gradients. In Conference on Neural Information Processing Systems, 2019.
[57] Shen, H. and Chen, T. On penalty-based bilevel gradient descent method. In International Conference Machine Learning. pp. 30992-3 -1015, 2023.
[58] Si, D. and Yun, C. Practical sharpness aware optima. In Conference on Neural Information Processing Systems, 2023.
aware minimization cannot converge all the way to
(59) Springer, J. M., Nagarajan, V., and Raghunathan, A. Sharpness-aware minimization enhances feature quality via balanced learning. In International Conference on Learning Representa- sions, 2024.
[60] Srivastava, A., Valkov, I.., Russell, C., Gutmann, M. U., and Sutton, C. Veegan: Reducing mode collapse in gans using implicit variational learning. Advances in neural information processing systems, 30, 2017.
[61] Sun, R., Fang, T., and Schwing, A. Towards a better global loss landscape of gans. In Confer- ence on Neural Information Processing Systems, 2020.
[62] Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I,, and Fergus, R. Intriguing properties neural networks. In International Conference on Learning Represen- tations, 2014.
[63] Tseng, C.-H., Lee, S.-J., Feng. J.-N., Mao, S., Wu, Y.-P., Shang, J.-Y., and Zeng. X.-J. Upanets: Learning from the universal pixel attention networks. Entropy, 24(9):1233, 2022.
[64] Uppal, A., Singh, S., and Poczos, B. Non-parametric density estimation & convergence rates for gans under besov ipm losses. In Conference Neural Information Processing Systems, 2019.
[65] Vlatakis- Sannuki-GGarrgkouniis, E.-V., Flokas, L., and Piliouras, G. with hidden structure via gradient descent ascent. In Advances in Neural Information Process- ing Systems, volume 34, pp. 23866 2021.
Solving min-max optimization
[66] Wang, P., Zhu, H., Huang, H., Zhang, H., and Wang, N. Tms-gan: twofold multi-scale generative adversarial network for single image dehazing. IEEE Transactions on Circuits and Systems for Video Technology, 3265):270-22772 2021.
[67] Wang, P., Wang, X., Luo, H., Zhou, J., Zhou, Z., Wang, F., Li, H., and Jin, R. Scaled relu matters for training vision transformers. In Proceedings of the AAAI conference on artificial intelligence, volume 36, pp. 2495-2503, 2022.
[68] Wen, K., Ma, T., and Li, Z. How sharpness-aware minimization minimizes sharpness? In International Conference on Learning Representations, 2023.
[69] Wen, K., Li, Z., and Ma, T. Sharpness minimization algorithms do not only minimize sharp- ness to achieve better generalization. Advances in Neural Information Processing Systems, 36. 2024.
[70] Wong, F.,, Rice, I.., and Kolter, 7.. Fast is better than free: Revisiting adversarial training. In International Conference on Learning Representations, 2020.
[71] Wu, D., Xia, S.-T., and Wang, Adversarial weight perturbation helps robust generalization. Advances in Neural Information Processing Systems, 33:2958-200 -2999, 2020.
13

---

[72] Wu, T., Luo, T., and Wunsch II, D. C. Cr-sam: Curvature regularized sharpness aware min- imization. Proceedings of the AAAl Conference on Artificial Intelligence, volume 38, pp- 6144 6152, 2024.
[73] Xie, C., Wu, Y., Maaten, L. d., Yuille, A. L., and He, K. Feature denoising for improving adversarial robustness. In Proceedings of the IEEE/CVF conference on computer vision and pattem recognition, pp. 501-509, 2019.
[74] Xie, W., Latorre, F., Antonakopoulos, K., Pethick, T. M., and Cevher, V. Improving re- quires rethinking its optimization formulation. In International Conference on Machine Learn- ing, 2024.
[75] Ye, J., Yuan, X., Zeng, S., and Zhang. J. Difference of convex algorithms for bilevel pro- grams with applications in hyperparameter selection. Mathematical Programming, 198(2): 1616, 2023.
[76] Yu, N., Liu, G., Dundar, A., Tao, A., Catanzaro, B., Davis, S., and Fritz, M. Dual contrastive loss and attention for gans. In Proceedings of the IEEE/CVF international conference computer vision, pp. 6731-6742, 2021.
[77] Yuan, M. and Peng, Y. Bridge-gan: Interpretable representation learning for text-to-image synthesis. IEEE Transactions Circuits and Systems for Video Technology, 30(11):4258- 4268, 2019.
[78] Zhang, C., Bengio, S., Hardt, M., Recht, B., and Vinyals, O. Understanding deep learning requires rethinking generalization. In International Conference on Learning Representations, 2017.
[79] Zhang, G., Cui, K., Hung, T.-Y., and Lu, S. Defect-gan: High-fidelity defect synthesis for auto- mated defect inspection. Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pp.
2021.
[80] Zhang, Y., Zhang, G., Khanduri, P., Hong, M., Chang, S., and Liu, S. Revisiting and advancing fast adversarial training through the lens of bi-level optimization. In International Conference on Machine Learning, pp. 18699-267711 2022.
[81] Zhang, Y., Khanduri, P., Tsaknakis, I., Yao, Y., Hong, M., and Liu, S. An introduction bilevel optimization: Foundations and applications in signal processing and machine learning. 2024.
IEEE Signal Processing Magazine,
[82] Zhang, Z., Hua, Y., Wang, H., and McLoone, S. Improving the faimess of the min-max game in gans training. In Proceedings of the IEEE/CVF Winter Conference on Applications of Com- puter Vision, pp. 2910 2919, 2024.
[83] Zheng, Y., Zhang, R., and Mao, Y. Regularizing neural networks via adversarial model pertur- bation. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recog- nition, pp. 8156-8165, 2021.
14

---

A Convergence Analysis
This part will present some classical and basic properties in the convergence analysis for this paper.
Preliminaries for Convergence Analysis
In this subsection, we present essential properties of the Moreau envelope and gradient, which form the foundation for our convergence analysis. Detailed proofs of the following results can be found in [ 80
We now recall regularity result showing that the Morcau envelope inherits convexity under weak convexity of the original function.
Lemma A.l. In (L.).. suppose Ly(w,d) 5) is weakly convex in and with constants P1 P2 2 0,
respectively, and y (0, 202) Then, for any Por Z P1 and Pvg 2 1, the function
Un (w, 8) + Pet 1|01 + Pv2 |101
is convex over R. R
Next, state key result the differentiability of the Moreau envelope, which allows its gradient to be expressed via the minimizer of the inner problem.
Lemma A.2. Under the assumptions of Lemma A. the solution of the minimization problem
(w, 5) = arg min BEC
T=e(ws,)) 0)
5112
27
is unique for all (w, 8). Let (w, 8) denote this unique minimizer. Then the Moreau envelope vy is differentiable and satisfies
(e, 0)= = (Volalw. (w,,, 0)); -6 -0,(w,,,,) 02((w,0))
Finally, we establish Lipschitz-type bound for the smoothed minimizer (7 8), which is critical for bounding gradient approximation errors.
Lemma A.3. Let 7
(0, 2pz
and define La m1, Then for any (w, (w, 8)
Rn x Rm, we have
(w,(w,)) 8) 07 (w, < Lo (I|w wل|l + 1|8 811)
These results provide the theoretical basis for analyzing the approximation error and stability of our proposed algorithm.
Gradient of the Normalized Gradient
In this subsection, we calculate the gradient the discarded term d6" in M in details. Recall that w E R and L R + R be smooth function. Define the normalized gradient mapping as:
des
f(w) V((w)
[[w(()]]
We aim to compute the Jacobian fw) E B Denote:
g(w) == VL(w),
h(w) ||g(w)]| 1 |L(W)]
Then have:
f(w) g(w)
h(w)
Using the quotient rule for vector-valued functions:
g(w)
h(w) Vug(w) g(w)
h(w)z Vwh(w)T.
h(w))
We now compute the two components separately:
15

---

The Jacobian of g(w) is the Hessian matrix: Vug(w) V2 =: H,
The gradient of the scalar function h((w) is given by:
Vwh(w)) Vwlls(W)] VL(W)
[V((W]]
Substituting into the quotient rule, we obtain:
VLW
V((W)
HL(W)VL(W)
T
(
[V Hr.w)
IV
VL(W)VL(W) T HL(W)
HH(w)
[VL(W]]
VL(W)?
This expression gives the Jacobian matrix of the normalized gradient f(w), which appears frequently in sharpness- aware optimization and directional smoothing.
Algorithms
In this subsection, we underly our algorithm. The algorithm follows standard stochastic process.
Given batches by C ( ]) each iteration, the procedure is summarized as follows:
Initialization: Set step sizes {au). {.a). {me). and penalty parameters {ue}, and initialize the variables w 8", and 0
Update rules:
mh & (w 8h) + (0t 844)
gh+1 Proje
8+
1 V (w* 5*h + V 1.b (un,,tt)
1 7000 outtt)
gh+1 Proje
8t Bx
lkk
7
1
whtl wk a&
Iw gh++1) I (w+, 5k+
V Do (wt, gh+z))
NK
(18)
Algorithm for SAM
In particular, we consider the SAM problem given in (8)) For a fixed pair (w, 6), the Moreau envelope reformulates the lower-level problem the following smooth optimization problem:
min Le(w, 0) + 10 8112 BEC
(19)
which is typically convex in 0. In this case, any Karush-Kuhn- Kuhn-Tucker (KKT) point corresponds to global minimizer. The global minimizer (w, 8) of (19) satisfies the optimality condition:
0 E VoLe(w, 0*) + (0 - + N(0".C)
where C = {0 _R ||ô|| < 1), and N(0", ,) denotes the normal cone to C at 0*, defined by:
{0):
|0+|| < 1; |0 1.
N( C) = 11x0 02
(20)
Consequently, the closed-fon expression for the global minimizer (r 8) is:
8 (+),,(,,,
[(ww) < 1;
(w 8)
8t>V [++クV[[6]]]
|8 [ 2 1.
(21)
Then adopt the following algorithm:
16

---

Initialization: step sizes { {m the variables w 8" and 8".
and penalty parameters {1g) and initialize
Update:
8 + VL (W"), 8% V (w))
118th VL (w++)) || < 1, |18th + vV (w+))l ž 1.
g++1_
V (w=)))
Generate i..dd Gaussian vectors: Generate sequence of independent and identically distributed (i.id.) Gaussian vectors {ux,J RT) where each ukj is sampled from standard normal distribution. Update the parameters as follows:
V Pu (wr))
8k+1
1 1. bu [w*)]]
k+1
w a
V. t (w* rottt) H (w*)(( 88t1)
1k
1 V be (w+ k rott1) J (wk getz 8bt2)
0
Uk
1 V., L (w= roott)
1
V T. (w + pml.)) v T, (ws*) gk+t gkt1 uss
Q
Here, Hr. denotes the Hessian matrix, and J is approximation matrix used for numerical pur- poses, as described in [1]]
Convergence Result with Biased Estimator
In this section, we present the convergence analysis of the proposed algorithm. For convergence analysis, impose the following assumptions the bilevel formulation (II))
Assumption A.4. The lower-level function T=e 8) is locally Lipschitz continuous with constant
Assumption A.S. The functions L(w, 5) and Le 8) in (III are weakly convex with respect to both w and with constants PL.1, PL, Pl, 2 0. respectively. That is, the functions
Llw, 1 + 2
and Le(w, + p + P2 1012
convex.
The analysis relies on the following assumption regarding the variance of the biased gradient esti- mators.
Assumption A.6 (Biased Estimator). For any batch C (L...., NY. the following bounds on the expected squared bias hold for ow, G5. oew 0e,5 0:
V (w, 8) V.L(w, 5) < o2
E
1 (w, VoL(w, 0)] 5oz
(22)
V (W 8) VaLo(w 8) < 00uu.
(w,) VoLelw, 6)) S So
Given penalty parameter μ >> 0. we define:
(y( 1 L(w,, 6) Lo(w, 0) v, 8),
F,(w,8) = L(w, 8) + plLelw, 8) er (w, 8)].
17

---

The convergence analysis will be conducted primarily based on these two functions. Set
1 VaL. (w+ 8th) V T (wt 5th) 1 (0+ ghit1); be (w gutt) - Vulle (ott,rtt))
dz
Pk d 1 ww g + Vull
(23)
PAk
The following lemma shows that the expected value of fuz exhibits a monotonic decreasing behavior, which plays critical role in the convergence analysis.
Lemma A.7. Under Assumptions 44
A.S
A. and assumptions in Lemma the sequence
(w*, 8*) generated by the algorithm satisfies
Elfma (w ,8ht1) Sum (u 55 S
Liz
1
112
80
1
a
LB
Lt
118t 822
48
2
(24)
Bg
|10
(7( 81
+
+
2
273
2ak
23x
4anoi +
08 + 23
where T. is the Lipschitz constant of the gradient of Sps. in its second-order Taylor expansion.
Proof. Assuming that Suz is smooth, we have the inequality with Lis, > 0:
fHu (wutt1,0+t)) S fm (w gh+1) Vw (wt gl++1), whtt - why + Life W w012
2
= -m (8h+1) (V-Jm Skt1) - dh + dh wkth why + Lise |w - w011
2
fm (8tt2) (Vufuu (w+ 8htz) - wht1 - wh) Lis
1
1W wx
2
ak
(25)
By Assumption A.G. the expectation of the first inner product term satisfies:
E [VVWfmn (w+,8tt1) d wkt w
S EK Mk
(Vw ( - V. (wt ,8b+1)) + Te (8tt1) - V. ( ((tt))
(VwLe(wt 07 (w* gu+11) V. (wt 0h (/- () - wh)l
200k oi + -lwAt - w11 + 2aso + - -lwbtl - w²11
1k 80r
8ax
+ 20m
+
-lw - w/11 + e110r11 - 07 |1 w1ll
80x
7 1 x+1
agl |1ptt1 (7(w*, g++
2ak oā + 4a, 2r
111
8ark
(26)
Similarly, we apply the same approach for the update of gk+1 and obtain:
Jm " gh+1) z fox (w 8hh + (VsSun (w 8²h), gh+1 - 8 + Li 1184111110 8
2
= Sana(u* 1,k.8 8**) + (Vofna (w k 5t ds d/. gk+1 5h3 + Tifa ||
1
(27)
2
Lsz
1
1
(wk ,8*) + (Vofna (w, ,0 d3 r- 1 8hy +
|1 - 10112
2
3n
18

---

and
E [( [V fo (0)) - 0 - -841]
2 oz + 11 -5²112 + 2,3 + -= 11
10112 + 2.3x
11 - 5k11
8,8
8BB
Bk |1ght1 (l(
(28)
+ 27,
2βg o3 + 28 + 1
43/ 110 10113 +
3
3R 2/
110
Combining all parts, obtain the claimed result.
Using Lemma we obtain the following convergence result for the proposed algorithm:
Theorem A.8. Suppose 7 E (0. 2ps
and penalty parameters satisfy palk + 1)2 2 pk+1 2 Mk 2 BN TbJ. and 0 < mh p2,,+2p2 the
> O. Then, for any 0 < < Og < "LF 0 <
iterates {(w*, )8 generated by the algorithm satisfy
min H (w*+1, (8h11) =0 K oSkSk
(29)
K1/2
Furthermore, the step sizes satisfy Ex (ax + BB) 00, then for any p (0, 2), holds that
Pe (witt) (aaht1.844t) (8411)
E
min OSkSK
(30)
(K(1-2p)/2
Proof. By [18. Proposition 2.1,).100 Lemma A.7], we deduce that (e ef) V (wtt1, (
with
V Vw Jobe Me
(w1,, .8t+1) ux
1k (wktt wh)
Okk
(31)
c (W ghht1) -mad
PR (6k+1 8h:).
Br.
Then by Lipschitz continuity of Fuz and Le with constants LF l, we have
|| S W (w (w - Fhe in (w* 86+12| )| + V (ubl (wt gh--1 -madtll
uk (w - wl)l
+
(32)
a
S 1ox I. Il a+t w011 + U4
[ - will + mxellltt (7( g/ttt)11
as
||oš|| s 11 (witt ( VoF 8+) Fo ,80) med
Mk (8h+1 -8 55)l1
3k
(33)
< n/ L 11 (w k+1 wh gl++1 - |²1 + BB
Mk 1111tt111 8k11
+ Mk (110+11 (w, ,00))| + Lo -tll - -w*ll).
Thus,
1 Lo )|w - w/ll + HolLFE + _ )110111 -8011
Rhh (2LF. + +
8411
Oxk ?
3x
(34)
+ m* [* 00 (wt g(+11||| + 1 1100t1 0 (w))
By [Lemaa A.6], there exists σ (0, 1) such that
| (w s*)l S axll0* (w (ott)))))
19

---

Then we have
Ri (w 1
S (xLFF + 1 + La ][ ax
1ou-ttl-o - -w'll + uclLF + 1 + 1007110 Lo17110t11-8 -
Br
+ pu(l+ 110htt - 07(w* ,8h)11
(35)
I (2LFL + ak
- 40 M| - w01l + (o +
1
+ Lo0)1l0tt1 -8
Bx
+ +nooll++ 1 111000 - Og( (0(W",0") 801)11-
Because Oi >0 0, Bx > 3 0, there exists CR > 0, Co such that
ne (whtt1, ,,h+1)1²
1
(36)
1 | w/11
1
S Cnl 80%
|1 - 8/112 + Collo
16.3
Since Ma S 1,++1, then
fw ++1 sh++1) fire (wott (8et1)= = -(- )[wAtt ( < O.
(37)
M6+1 pe:
By inserting (G7) into Lemma we know
gh+1) B[ (wttt, ( + (62 + I F0)100 03(W4t11 (11+
Blfmi(w* (w 888) + (62 + 1 21100- 07(w*, 561
1
< Eis (wo "ock+110040 ,oh+1) - -mm (wr 50h]] + (e2 +
マ
)1l0 - 0, ( |
110
07 ,00
(38)
1
11w - 1 +
1 5 4
1
+ ag 1.2)
100 - 11t+112
2
8ay
BR
1
)110h+ 0z 81) + (e2
)ll10be 0r(wett (2[
+ 2-2²
72
110 07( , )0 + 20c
23x
o + 4.goo +
2 03 + +.300
2
lk
Besides, recall that by [Lemma A.6], there exists ox E (0, 1) such that
(w,,, S 0xl10= 0r (wt 5+)
Then for any Ek > O, we have
1
2 0x 10+t1 - (w* >12 + +110t11 - 07, ( - 110t - 0,( 88)1
1
S (a + a) a1llltttt
(,("*, (0,(w,8+)) 88 = 110 (w sh
2
(39)
+ - 110,
1
0% (w* ,8h )11
c4
< <co + (an) - 11|@0= - (w* , 81 + I
(1waett - w/112 + +115h11 -8(113)
2
cs
20

---

Similarily, we have
2 3/x 31:110t+1 , )12 + 110h+1 Bl ; )12 - 1100 - -u, 112
1
- (Ex + 2 26 (w ,0,1, - 1100 - 07 312
(40)
+ 1 110g , (wt, )01
Ek
1
-1]11 (7(,,, 011 + Lg
$ <loR(e>
2 20x))
w011 + 118 - -5t13)
Ek
Thus, when $/152 + cx
La s Isar
and 5/ + Lu
S 33t
1
(by an < Stm 3k xt. ). we have
c
El/mit (w gk+1)= + (l2 + 72
)100+1 - 07( (u(wtt gh+t1) |||
- -Elfm ,5t)+ + (f + 1 110b -0, ,11
1
< CloR(Ex 2 (00)) 72 Folle + 1 [a) - -1]10* On( 0²
+ 1 12- 8ak
1
1
+
[illwtt - -w²112 + 12 I:Sn 1
L
[11 -
(41)
4
Ck
+ 20 o% + 1am
23x 03 + =23,02
+
S CR(Co 07, /811112+ + 16a
11akt1 w0112=
18+t2 -))1
83
20x d + 4m. +
23x
+
03 22
As a result, by take the sum of iteratives & in (56), when max o3.0% om o 0², ph 2 p>0 0. there exists constant C > 0 such that
E (w 88
K >
20%
23x
S fuo + (e2 + 72 1100 (7 10)
+
4a
+
0g + 28,
Kk
k=0
1
1
S Smoow 00) (e2 + 7 |100 02(w0, 80)1
20 2
+ 1)
(20xx 3x))
112
k=0
(42)
Because 0g < 8h12
1 and Bx < 4h.4""
1 we have
K 1 K
El (w) 1..kt1,5ttu ,b+11)²
(43)
1
1
$ [no 80) + (E2 + 73 01100 07(W0, "00 + 20
+1)(
+
412
2L.
4L
Then
El El (w1
1ett1,tt ((+1]] = 0
(44)
K1/22
K1/2
Furthermore, when Σ (ax + Bx) < xc, we have
k=
E (wi+),
(u+t1,8t+11 84+11]2 < cc.
(45)
k=
21

---

For p E (0, 2), because 14: - fi(k + 1)
k
1
K+2
(K + +2 2))2222
2p
22
dt
(46)
(1 2p)
k=0
k=0
then
min OSKSK
(w
; 0
(47)
K 2p)/2
B
Experimental Details
We conducted the experiments on PC with Intel i5-13600KF CPU (3.5 GHz), 32GB RAM and NVIDIA RTX 4090 GPU. We leveraged the PyTorch framework on the 64-bit Linux system. In the following, we elaborately introduce the implementation details and parameter configurations.
Numerical Cases
As for the first case, we set 17, B3 at, Y, J4, and p as 0.001, 0.01, 0.0001, 20, and 0.1 and leverage || will I 1e-4 as the stop criterion. SGD optimizer is used for the update of w. We set the the maximum steps of optimization as 1000 uniformly. As for the second case, 1), 3, Or, 7/ p., and are 0.001, 0.05, 0.0001, 20, and 0.1, respectively.
Generative Adversarial Learning
The goal of generative adversarial learning to build min-max game between the generator -en(w;-) and discriminator Dis(5;-), which can be formulated min, max6 log(Dis(6; u)) log(1 (is Ge: v))). where u ~ Pdata represents the real data distribution and denotes the random latent vector. The hyperparameters 7), a, 7 14, and p set to 0.005, 0.005, 0.01, 100, 5 and 0.1, respectively. The generator is a three-layer fully connected neural network that maps input vector target output through two hidden layers. Each hidden layer is followed by a non-linear activation function. The final layer outputs the generated vector without activation. The discriminator consists of two hidden layers and final classification layer. All hidden layers use the ReLU activation function. The output is passed through a sigmoid activation. We conduct the experiments under 8 distribution of 2D wheel, sampling 500 data points from 2D surfaces. All experiments are repeated three times with diverse random seeds.
Sharpness-aware Minimization
We conduct image classification experiments using the standard open-source CIFAR-10 benchmark, which consists of 50,000 training and 10,000 testing image-label pairs. ResNet-18 18 is employed as the backbone model to evaluate performance under noisy labels and various perturbation radius For fair comparison in experiments involving both noisy labels and different backbone architectures, we fix r 0.1. The hyperparameters a, 7 μ. Q, and p are respectively. Following the setup in [2], we apply basic augmentation during training, including horizontal flipping, four-pixel padding, and cropping. Models are trained from scratch for 200 epochs using a batch size of 128 and a cosine learning rate schedule. To ensure fair comparison, all experiments are repeated three times with diverse random seeds.
0.05, 1 10-4 -,-4 0.75, and 0.01,
22

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize other settings.
fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations the work performed by the authors?
Answer: [No]
Justification: Our theoretical results (assumptions, lemmas, theorems) are formulated un- der general problem settings, with limitations naturally addressed within this framework, eliminating the need for separate limitations section.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The au- thors should reflect on how these assumptions might be violated practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the ap- proach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-tex system might not be used reliably provide closed captions for online lectures because fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach ad- dress problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
23

---

Answer: [Yes]
Justification:
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theo- rems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be comple- mented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper the extent that it affects the main claims and/or conclu- sions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, may be necessary to either make it possible for others to replicate the model with the same dataset, provide access to the model. In general. releasing code and data often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate the research performed.
While NeurIPS does not require releasing code, the conference does require all sub- missions to provide some reasonable avenue for reproducibility, which may depend on the nature the contribution. For example
(a) the contribution primarily new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to re- produce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case au- thors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing verifying the results.
5. Open access to data and code
24

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification:
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://niis..o cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so No is acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https:)
/ hnaps.cc/public/guideeee (CodeSSue wttpsSummmssiiooooooooooooo ssioniolicy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Question:
Does the paper report error bars suitably and correctly defined or other appropri- ate information about the statistical significance of the experiments?
Answer: [Yes]
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
25

---

The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
It OK report I-sgmma error bars, but one should state it. The authors should prefer- ably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification:
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics http:://marrrss.ccooooo/////eeee
Answer: [Yes]
Justification:
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. there a special consid- eration due to laws or regulations their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA]
Justification: This study focuses on advancements machine learning. While potential societal implications may exist, they fall beyond the scope of the current technical contri- bution and thus are not analyzed herein.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact spe- cific groups), privacy considerations, and security considerations.
26

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitiga- tion strategies (e.g., gated release of models, providing defenses addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility MI..
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g.. pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
The paper poses no such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by re- quiring that users adhere usage guidelines or restrictions access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do require this, but we encourage authors to take this into account and make best faith effort.
12. Lieenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification:
Guidelines:
The answer NA means that the paper does existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
assets are released, the license, copyright information, and terms use in the pack- age should be provided. For popular datasets, paperswi thcode com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the cense of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
27

---

If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documenta- tion provided alongside the assets?
Answer: [Yes]
Justification:
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moodl part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the pa- per include the full text of instructions given to participants and screenshots, if applicable, well as details about compensation (if any)?
Answer: [NA]
Justification: This paper does not involve such researches.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contri- bution of the paper involves human subjects, then as much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, cura- tion, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper deseribe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: This Paper does not involve such researches.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equiva- lent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
28

---

Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality the research, declaration is not required.
Answer: [NA]
Justification: LLMs only for editing and formatting.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs any important, original, non-standard components.
Please refer to our LLM policy (https: hecpss///eaarrrssecc//ooooeeeees for what should or should not be described.
29


Reviews:
[{"review_id": "HxeJmi1725", "reviewer": "Reviewer_fVRv", "summary": "This paper presents a bilevel reformulation of a broad class of non-convex min-max optimization problems by leveraging the Moreau envelope and efficient bilevel solvers. The goal is to transform unstable min-max problems into structured bilevel formulations that can be optimized more reliably. The authors argue that many min-max settings, such as those found in adversarial learning and sharpness-aware minimization (SAM) training, suffer from instability and convergence difficulties. Their proposed framework smooths the inner maximization, enabling the problem to be reformulated as two min-max problems, thereby facilitating faster optimization and providing theoretical convergence guarantees under appropriate conditions.", "questions": "Can the proposed bilevel reformulation be systematically applied to a broader class of min-max problems beyond the two case studies, and if so, what are the key structural requirements for reframing them as bi-level?\n\nHow does the proposed approach compare with those in Vlatakis et al. (2023)?\n\nWhat challenges or limitations arise when scaling the bilevel reformulation to high-dimensional settings (e.g., deep generative models for vision tasks)?", "limitations": "Limitations are not explicitly discussed either in the main paper or in the checklist.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 4, "strengths_and_weaknesses": "The paper is well-written and elegant in its mathematical presentation. It communicates complex optimization insights in an accessible and often tutorial style, which is valuable for readers looking to understand the deeper structure of bilevel optimization. In this sense, the paper is intellectually stimulating and has educational value. While some definitions and derivations (e.g, derivation of Table 1 or the definition of the Moreau envelope) could be made more explicit (or more directly linked to earlier assumptions, overall the exposition is smooth. The choice to apply the method to two different problems helps demonstrate the potential generality of the framework, even though, as discussed below, the scope of the experiments remains limited.\n\nThe main limitations I see relate to the scope of the experimental validation and the clarity of the practical motivation and applicability of the proposed framework.\n\nFirst, the empirical section on generative adversarial learning (Section 5.1) is limited to a two-dimensional toy example, despite being presented under the heading of \"Real-world applications\". A low-dimensional GAN example is not sufficient to demonstrate practical utility or scalability. Generative models, especially adversarial ones, typically operate in high-dimensional spaces (e.g., image generation), where both the generator and discriminator are deep networks with thousands or millions of parameters. It thus remains unclear whether the proposed bilevel reformulation can offer tangible advantages (computational or robustness-related) in these more practical settings. How does the approach scale? Is the inner problem still tractable when dealing with large-scale models and complex data distributions? Can the framework, in practice, compete with existing heuristics used in adversarial learning in terms of speed and quality of the results?\n\nSecond, while the goal of the paper is to reframe min-max problems as bilevel problems, it is not sufficiently clear **why** this is beneficial beyond the ability to apply specific solvers. The authors mention robustness benefits (e.g., line 84), but they do not demonstrate whether these benefits stem from the reformulation itself or the improved optimization dynamics afforded by better-behaved algorithms. Is the observed robustness in classification simply a result of smoother convergence, or is there a deeper benefit to recasting the problem as bilevel in structure beyond its theoretical framework? \n\nMoreover, the paper lacks a general guideline or procedure for reformulating generic min-max problems into bilevel ones. While the two case studies help illustrate the method, they do not offer a systematic view. Readers unfamiliar with the particular structure of the loss functions involved may struggle to apply this technique to other use cases. It would strengthen the work significantly to provide a more general prescription for when and how this reformulation applies, along with its assumptions and limitations. At the very least, this limitation should be explicitly acknowledged in the paper.\n\nLastly, the paper does not engage meaningfully with related work that attempts to solve min-max problems via alternative structure-aware methods. In particular, the recent work by Vlatakis et al. (2023) proposes gradient descent-ascent methods tailored for min-max problems with hidden structure. Given the similarity in motivation and objectives, a more thorough discussion comparing these two perspectives would be highly valuable. At the very least, the paper should provide a conceptual framework for its bilevel reformulation of existing methods. It would also be important to clarify whether bilevel approaches offer distinct computational or theoretical advantages over the work by Vlatakis et al. (2023), and under what specific conditions these advantages hold. \n\n[Vlatakis et al.] Solving min-max optimization with hidden structure via gradient descent ascent. NeurIPS 2023. \n\n*Minor Observations:* The derivation of Table 1 is not comprehensively explained, and the Moreau envelope definition appears somewhat unexpectedly, without strong contextual framing. \n\n\n**Conclusion.** The current experimental evidence is not sufficient to validate its utility in real-world, high-dimensional applications, particularly in the context of generative modeling. The paper would benefit from a more convincing empirical demonstration, stronger motivation for the reformulation in practical terms, and a more precise comparison with other recent advances in min-max optimization.", "was_revised": true, "final_justification": "During the rebuttal the authors clarified and addressed all of my concerns. Consequently, I have increased my already positive evaluation from 4 to 5.", "rebuttal": "**Comparison under high-dimensional applications**: \nFirstly, to address the reviewer’s concern about high-dimensional applicability, we conducted new experiments on CIFAR-10 with our method using the same network as R3GAN. Our method achieves a 5% FID improvement over R3GAN, only training with 2.4k steps, demonstrating competitive performance in image generation tasks.\n| Model      | Publication  | Parameters | FID   |\n|-------|-------|-------|-------|\n| BigGAN     | ICLR 2019    | 82M        | 14.73 |\n| TransGAN   | NeurIPS 2021 | 10M        | 9.26  |\n| ViTGAN     | ICLR 2022    | 86M        | 6.66  |\n| StyleGAN3  | NeurIPS 2021 | 40M        | 10.83 |\n| R3GAN      | NeurIPS 2024 | 21M        | 6.21  |\n| Ours       | -            | 21M        | **5.89** |\n\nFurthermore, our experiments on SAM (training with diverse typical bakcbones) and large-scale numerical cases also demonstrate the scalability. Comparing existing heuristic and bi-level optimization method, our method realize the consistent improvement. We are committed to revising the manuscript to incorporate these clarifications and results.\n\n**Theoretical Benefit of Bilevel Reformulation:** \nThe reviewer rightly questions whether robustness stems from the reformulation itself or algorithmic improvements. We emphasize that the advantages:\n\n•\tIntrinsic Stability: By decoupling the min-max dynamics via Moreau smoothing, our reformulation inherently avoids cyclic gradients (e.g., Figure 4 in Vlatakis et al.), even with vanilla solvers (Appendix C.3 validates this with fixed-step GDA).\n\n•\tAccuracy Preservation: Unlike heuristic simplifications (e.g., SAM’s \"discarding step\"), our bilevel framework preserves essential problem structure, enabling theoretical guarantees (Theorem 4.1). \n\n**General Guidelines for Reformulation:** General Guidelines for Reformulation\nTo clarify applicability, we will add a step-by-step flowchart outlining:\n1.\tProblem Screening: Check if the classical method sacrifies learning accuracy for the numerical cost.\n2.\tReformulation: Apply the bilevel reformulation, by reparametrization or convexitor if necessary. \n3.\tAlgorithm: Apply the single-loop algorithm for the reformulation. \nThis framework already covers SAM and GANs, and we explicitly discuss limitations:\n\n**Comparison to Vlatakis et al. (2023):** \nWhile both works address min-max instability, our approach differs fundamentally:\n| Aspect| Vlatakis et al.| Our Method|\n|------------|--------------|------------|\n| Assumptions | hidden convex-concave structure    | Smoothness | \n| Convergence Mechanism| Center-stable manifolds | Bilevel constraints (Theorem 3)| \n| Aim | Convergence of hidden convex-concave games    | Balancing learning efficiency and numerical cost |\n\nOur method bypasses cyclic attractors (Vlatakis’ Fig. 4) by bilevel methods. \n\n**Future Generalization.** For various types of min-max problems, modern methods have been proposed (e.g., [andriushchenko2020understanding, andriushchenko2022towards, li2020towards, zhang2022revisiting, vlatakis2021solving]). For instance, vlatakis2021solving investigates min-max problems of the form$\\min_{\\theta}\\max_{\\phi}L(F(\\theta),G(\\phi))$ in the convex-concave setting. Our method can be applied to some of these problems, particularly when the inner concave subproblem $\\max_{\\phi}L(F(\\theta),G(\\phi)) $ is tractable, but solving the overall min-max problem requires sacrificing learning accuracy for computational efficiency. Some of these problems suffer from cyclic behavior of level sets (see Figure 4 in vlatakis2021solving). Unlike the approach in vlatakis2021solving, we address this issue through a bilevel reformulation, whose convergence is established in Theorem~3.\n\nIn such cases, our bilevel framework provides a compelling alternative, offering a more favorable balance between learning accuracy and computational cost, as illustrated in the SAM and GAN applications.\n\nFurthermore, while not all min-max problems naturally satisfy the two features outlined earlier, many can be transformed into a suitable bilevel form through reparametrization techniques or the use of convexificators. This enables broader applicability of our approach, which can be extended via the following three-step process:\n\n- **Problem Screening**: Identify whether existing methods trade off learning accuracy for reduced numerical cost.\n- **Reformulation**: Apply a bilevel reformulation, using reparametrization or convexification techniques if needed, to ensure the lower-level problem is tractable.\n- **Algorithm Deployment**: Solve the reformulated problem using the proposed single-loop bilevel algorithm.\nThis process broadens the applicability of our framework beyond SAM-type problems. Investigating such extensions remains an important direction for future research.\n\n**Limitations.** Beyond the SAM and GAN problems discussed in this paper, our method is applicable to a broader class of min-max problems that possess the following characteristics:\n\n1). Classical methods for min-max problems often trade learning accuracy for numerical efficiency, as the inner-level optimization is typically difficult to solve. In such cases, introducing a bilevel reformulation allows us to better balance learning accuracy and computational cost.\n\n2). The original min-max problem can be reformulated as a bilevel problem in which the lower-level problem is easily solvable, without requiring any convexity assumptions on the objective function $L$. In such settings, the bilevel reformulation does not introduce significant additional complexity.\n\nGiven these two features, the bilevel approach offers distinct advantages. On the one hand, it preserves more intrinsic and essential information from the original problem than standard simplifications (e.g., the “discarding step” used in SAM), thereby enhancing learning accuracy. On the other hand, when the lower-level problem  is easily solvable, efficient bilevel optimization algorithms can be employed, resulting in a computational cost that remains manageable.\n\nNevertheless, in high-dimensional learning tasks, our method may encounter challenges in maintaining an acceptable computational cost while ensuring learning accuracy. This difficulty, however, is inherent to high-dimensional settings: higher-dimensional data typically carry more information, which inevitably leads to increased computational demands. In such cases, the trade-off between accuracy and efficiency becomes more pronounced, further emphasizing the value of a principled framework for balancing the two.\n\n**Table 1 Analysis:** Table 1 presents three key metrics for analyzing loss landscape geometry. The ascent-direction loss, corresponding to the minimum eigenvalue (λₘᵢₙ) of the Hessian matrix H_L(ω), captures the local curvature along the most favorable ascent direction. The average-direction loss, quantified by the trace of the Hessian (Tr(H_L(ω))), characterizes the overall sharpness of the loss surface. The table clearly demonstrates that SAM's effectiveness in sharpness minimization stems from its utilization of second-order information through the Hessian matrix. Notably, the largest eigenvalue (λ₁(H_L(ω))) serves as a direct measure of loss function sharpness, thereby elucidating SAM's mechanism for improving generalization via sharpness reduction. For detailed mathematical derivations of these relationships, we refer readers to Theorems E.1-E.3 in [Wen et al., 2023].\n\n**Moreau Envelope:** To address the nonsmooth nature of the value function, we employ the Moreau envelope technique to construct a smooth approximation. This approach not only enhances mathematical tractability but also facilitates algorithmic development. Geometrically, the Moreau envelope generates a family of smooth surfaces that progressively approximate the original value function's graph. We will revise this part for the clear description."}, {"review_id": "O5LSIOjvQx", "reviewer": "Reviewer_etJk", "summary": "The paper proposes a bi-level optimization technique as an alternative to the usual min-max optimization algorithms. The authors study the convergence of the proposed algorithm and perform numerical experiments.", "questions": "Can we have more empirical evidence of the performance of the method? Also, how does the proposed method compare to, say, training a standard GAN in terms of computational cost?", "limitations": "The results in the paper are limited in significance. The claims of extensive experiments and improvements over existing methods are not justified properly.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths: \n\n- The problem is interesting and well motivated.\n- The paper has both theoretical convergence results, and numerical experiments.\n\n\nWeaknesses:\n\n- The paper claims that the proposed method is better than the existing ones, but this claim is not supported by the experiments. The experiments on GANs are only done on the usual mixture of 8 Gaussians on a ring. It is known that the vanilla GAN can learn this distribution perfectly given the right hyperparameters. Moreover, it is very surprising for a  WGAN to have such poor performance on this dataset. This makes it hard to trust the results of Figure 2, since it is very easy to train a WGAN to learn this distribution. In the appendix, it is stated that the GANs were trained on 500 datapoints, which is extremely low for this dataset and neural networks.\n\n- With this, it is not clear what improvements the proposed algorithm brings compared to existing min-max optimization techniques. \n\n- Also, the use of the FID score on synthetic 2d datasets is not really meaningful, since FID is by definition tied to image datasets.\n\n- I think the writing of Section 4 could be improved, it is a bit dense and hard to follow.\n\n- Minor: typo on line 61 in the word \"Learning\"", "was_revised": true, "final_justification": "After reviewing the author's rebuttal, and the additional experimental evidence they provided, I am raising my score to a 4.", "rebuttal": "We thank the reviewers for their thoughtful feedback and careful evaluation. This work introduces a bilevel optimization framework that not only provides new theoretical insights beyond existing methods but also achieves strong practical performance and scalability across diverse domains. To address potential concerns regarding the theory–practice gap, we rigorously validate our framework through extensive large-scale experiments, including new GAN benchmarks against nine classical and state-of-the-art approaches, and demonstrate its extensibility to broader tasks such as adversarial learning. We believe these contributions establish both the novelty and practical relevance of our approach, and we respectfully request the reviewers to reconsider their evaluation in light of these results.\n\n **New experiments of GAN:** To validate our method’s effectiveness in high-dimensional and complex settings, we conducted two high-dimensional experiments of GAN, comparing with nine typical GAN methods and will replace the section of GAN with these new results in the revised paper.\n\nSpecially, we first conducted comparison with Stacked MNIST, a challenging dataset with 1000 modes. Obviously, Our method achieves full mode coverage (1000 modes) and the lowest $D_{KL}$ (0.09)，outperforming typical schemes (DCGAN, WGAN) and the latest baseline (R3GAN, NeurIPS 24), where our method is only trained with 1k steps.\n\n| Methods  | DCGAN | VEEGAN | WGAN | PacGAN | R3GAN | Ours  |\n|----------|-------|--------|------|--------|----------|-------|\n| Modes    | 99    | 150    | 959  | 992    | 1000     | **1000** |\n| $D_{KL}$ | 3.40  | 2.95   | 0.73 | 0.28   | 0.12     | **0.08** |\n\nWe tested our method on CIFAR-10 using the same architecture as R3GAN (NeurIPS 2024, 21M parameters) with 50,000 training samples. FID results illustrate the performance of our schemes compared to state-of-the-art GANs.\n| Model      | Publication  | Parameters | FID   |\n|------------|--------------|------------|-------|\n| BigGAN     | ICLR 2019    | 82M        | 14.73 |\n| TransGAN   | NeurIPS 2021 | 10M        | 9.26  |\n| ViTGAN     | ICLR 2022    | 86M        | 6.66  |\n| StyleGAN3  | NeurIPS 2021 | 40M        | 10.83 |\n| R3GAN      | NeurIPS 2024 | 21M        | 6.21  |\n| Ours       | -            | 21M        | **5.89** |\n\nConvergence analysis over training steps also shows our method’s stability. In summary, our method achieves a 5% FID improvement over R3GAN at 2.4K steps and converges more stably, demonstrating superior performance and robustness in high-dimensional settings.\n| Step | 200   | 400   | 800  | 1000 | 1400 | 1800 | 2000 | 2200 | 2400 |\n|------|-------|-------|------|------|------|------|------|------|------|\n| Base | 33.09 | 16.98 | 8.75 | 7.50 | 6.92 | 6.55 | 6.21 | 6.26 | 6.37 |\n| Ours | 34.47 | 18.15 | 9.32 | 7.92 | 6.94 | 6.09 | 5.98 | 6.02 | 5.89|\n\nFurthermore, please also note that the experimental details of 2D mixture about GAN follows with BVFSM (TPAMI 23), where WGAN also cannot displays the desired performance. \n\n**Computation efficiency of GAN:** We argue that standard GANs rely on simple alternating optimization, lacking robust convergence theory and often requiring engineering tricks (e.g., gradient penalties) to avoid mode collapse.  Unlike GANs, our single-loop algorithm is supported by rigorous convergence analysis with first-order computation, achieving faster and more stable convergence. This is validated by a 16.8% efficiency improvement over BAMM (single-loop BLO scheme) and  more stable FID reduction on CIFAR-10, compared with the latest GAN scheme R3GAN .\n\n**Theoretical Foundations of Our Framework:**\nThe technique in this paper is mainly based on the prior BLPP techniques and a reformulation of the min-max problem. Specifically, we build a stocstic version of the single loop algorithm and its convergence result which shows better numerical efficiency. And for the BLPP reformulation, as we maintain the intrinsic informations of classical min-max formulations (see the Example of SAM in Section 3), our method will conduct better effects then classical formulations without introducing too much numerical costs theoretically. \n\n**Revisions to Section 4 (Theoretical Part):** We have revised and reorganized several paragraphs to improve the clarity and quality of the writing.\n\n**Typos:** Thanks for pointing out these typos. We will check the paper carefully to revise all typos and mistakes."}, {"review_id": "F6i40fzwVX", "reviewer": "Reviewer_MepV", "summary": "The authors study bilevel optimization problems. They propose a single-loop stochastic algorithm for such problems and provide convergence guarantees when the inner problem is convex.  The core advantage of the proposed optimization algorithm is that it incurs no additional computational cost. The authors validate the effectiveness of their proposed method on two common bilevel optimization problems: GAN training and sharpness-aware problem.", "questions": "See above.", "limitations": "yes.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Pros:\n\n+ Bilevel optimization problems are of significant theoretical and practical importance.\n\n+ The proposed algorithm requires no extra computational cost.\n\n+ The authors provide a convergence proof and empirically demonstrate the proposed algorithm's performance.\n\nCons:\n\n- The proposed method only guarantees convergence when the inner problem is convex. However, many real-world problems, particularly those involving neural networks, are non-convex. Furthermore, the empirical validation has been limited to toy and simple datasets. Therefore, it remains unclear whether the proposed optimization algorithm can scale to more complex datasets.\n\n- The authors mention that discarding the second term in SAM (Eq. 7) sacrifices accuracy. It would be beneficial if the authors could quantify the impact of this term on SAM's performance.\n\n- Could the authors provide a more intuitive explanation for why their proposed optimization algorithm is effective? How should we understand Equation 15, and how does it overcome the limitations of SAM?\n\n- Several parts directly cite existing literature (e.g., Line 166, Line 202-203), which can be challenging for readers unfamiliar with the background. I suggest the authors incorporate more intuitive explanations or provide brief proof in appendix.\n\n- Are there any techniques that could transform the inner problem into a convex one (maybe reparameterization), potentially expanding the applicability of the proposed method? I recommend the authors discuss this.\n\n- The authors could further demonstrate the superiority of their proposed method by including experimental results on adversarial training.", "was_revised": true, "final_justification": "Overall, I think this paper is good. I maintain my rating.", "rebuttal": "For the reviewer’s concerns: \n\n1.\tIn Section 4, we give more explicit limitations and future generalizations. We put assumptions on the original problem which can be transformed into a bilevel problem with an easily solved lower level particularly convex. Indeed, our methods may extends its applications to more problems with convexitor or reparametrization methods. \n\n2.\t(9) shows the theoretical influence of the discarding process to the learning accuracy, and the experiments of SAM [1] shows different loss of this discarding. \n[1] Foret et al., 2021. Sharpness-Aware Minimization for Efficiently Improving Generalization.\n3.\t(15) is the iterations of the algorithm(we move it to the appendix), is indeed a gradient desent iteration of $L^{b_k}$. This is based on the reformulation by the Moreau envelope and the penalty method in (14) for BLPPs. This algorithm updates the upper level variable together with de lower level--single loop—meaning that it do not need to solve the inner problem first and thus ensures the numerical efficiency. Besides, it take the intrinsic Hessian informations of L into considerations and thus balances the learning efficiency and numerical costs to solve the traditional SAM difficulties. \n4.\tWe have add more explinations and backgrounds of some parts of this paper. Thanks for the reviewer’s valuable suggestions. \n5.\tYes, we have mentioned potential techniques to extends our methods in Section 4. Thanks again for the valueable suggestions. Following with SAM-AT(ICML 24), we perform our algorithm for the adversarial training on the semantic segmentation task. We construct the DeeplabV3 with Resnet50 as backbone under Standford background dataset.  Our method outperforms SGD and AT across all settings.\n\n\n| Method         | Natural | $L_\\infty$-AT | $L_2$-AT |\n|----------------|---------|-----------------|------------|\n| SGD            | 64.0    | 57.3            | 57.0       |\n| AT ($\\epsilon=4/255$) | 55.3    | 54.9            | 55.1       |\n| Ours ($r=0.02$)   | **64.7** | **57.6**        | **57.2**   |"}, {"review_id": "r9hlIWHHsB", "reviewer": "Reviewer_KhNq", "summary": "The authors propose a unified bilevel optimization framework designed to improve computational efficiency and learning accuracy in adversarial learning tasks, particularly addressing Sharpness-Aware Minimization (SAM) and generative adversarial tasks. Extensive experiments demonstrate its effectiveness in improving FID and JS scores, achieving higher accuracy under label noise, and providing a more interpretable solution with flatter loss landscapes, making it a promising approach for adversarial learning.", "questions": "1. How does the proposed bilevel optimization framework compare to more recent state-of-the-art methods in terms of both computational efficiency and learning accuracy? Could you include a broader range of comparisons to validate the effectiveness of your approach?\n2. While the experiments show improvements in FID and JS scores, could you provide more detailed analysis or ablation studies to demonstrate the specific impact of the bilevel optimization process on model performance?\n3. The paper mentions the method’s robustness under label noise, but how does it perform when faced with other types of adversarial conditions, such as domain shifts or noisy inputs in real-world scenarios?\n4. Can the framework be easily extended to other adversarial learning settings, or is it tailored specifically for SAM and generative adversarial tasks? How adaptable is it to other areas of machine learning? \n5. Since the approach appears to rely on existing optimization techniques, could you clarify what exactly differentiates it from prior works, and why it is expected to outperform them in terms of both theory and practice?", "limitations": "The method of comparison is too outdated, and the method proposed in this article also lacks novelty.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. The research addresses a significant and timely problem in adversarial learning, aiming to balance computational efficiency and learning accuracy, which is crucial for practical applications.\n2. The proposed bilevel optimization framework is well-motivated and offers a theoretically sound solution that improves Sharpness-Aware Minimization (SAM) and generative adversarial learning tasks, demonstrating potential for real-world use.\n3. The method shows promising results, particularly in terms of improving FID and JS scores, as well as achieving higher accuracy under label noise and across different backbones, which is a noteworthy contribution to the field.\n\nWeaknesses:\n1. The methods proposed in the paper lack significant novelty, as the approach seems to build upon existing techniques in optimization without introducing fundamentally new ideas or mechanisms.\n2. The comparative experiments are limited and do not provide a broad enough evaluation against other state-of-the-art methods to firmly support the claims of superiority or generalizability of the approach.\n3. The paper does not include comparisons with the latest advancements in the field, which would be crucial to demonstrate the unique advantages and relevance of the proposed framework in relation to current research trends.", "was_revised": true, "final_justification": "The author has solved my problem, and I will modify my score", "rebuttal": "We thank the reviewers for their constructive feedback and careful evaluation of our work. In this paper, we introduce a bilevel optimization framework that achieves a principled balance between computational efficiency and performance across diverse problem domains. Our contributions include novel theoretical advancements over existing methods while retaining strong practical applicability. The proposed framework is rigorously validated through extensive large-scale experiments, including new GAN benchmarks comparing against nine classical and state-of-the-art approaches, and further demonstrates promising extensibility to broader tasks such as adversarial learning. We respectfully request the reviewers to reconsider their evaluation in light of these substantive contributions.\n\n\n**Compared with SOTA methods:**\n\nWe present updated GAN experiments, including Stacked MNIST and CIFAR-10, Bi-level optimization results, and evidence of stable convergence, demonstrating our method’s superiority, and propose revisions to clarify these contributions.\n\n**(1) GAN Experiments – Stacked MNIST**: On Stacked MNIST (1000 modes, 50,000 samples), our method achieves full mode coverage and superior KL divergence:\n\n| Methods  | DCGAN | VEEGAN | WGAN | PacGAN | Baseline | Ours  |\n|----------|-------|--------|------|--------|----------|-------|\n| Modes    | 99    | 150    | 959  | 992    | 1000     | **1000** |\n| $D_{KL}$ | 3.40  | 2.95   | 0.73 | 0.28   | 0.12     | **0.07** |\n\nOur method reduces $D_{KL}$ by 41.7% compared to the baseline, showcasing robust generative performance.\n\n**(2) GAN Experiments – CIFAR-10**: Using the R3GAN architecture (21M parameters), our method outperforms recent GANs:\n\n| Model        | Publication   | Parameters | FID   |\n|--------------|---------------|------------|-------|\n| BigGAN       | ICLR 2019     | 82M        | 14.73 |\n| TransGAN     | NeurIPS 2021  | 10M        | 9.26  |\n| ViTGAN       | ICLR 2022     | 86M        | 6.66  |\n| StyleGAN3    | NeurIPS 2021  | 39M        | 10.83 |\n| R3GAN (2.4K) | NeurIPS 2024  | 21M        | 6.37  |\n| Ours (2.4K)  | -             | 21M        | **5.89** |\n\nOur method achieves a 7.5% FID improvement over R3GAN with stable convergence:\n\n| Step | 200   | 400   | 800  | 1000 | 1400 | 1800 | 2000 | 2200 | 2400 |\n|------|-------|-------|------|------|------|------|------|------|------|\n| R3GAN | 33.09 | 16.98 | 8.75 | 7.50 | 6.92 | 6.55 | 6.21 | 6.26 | 6.37 |\n| Ours  | 34.47 | 18.15 | 9.32 | 7.92 | 6.94 | **6.09** | **5.98** | **6.02** | **5.89** |\n\nOur method stabilizes by 1800 steps with fewer oscillations, unlike R3GAN’s fluctuations.\n\n**(3) Bi-Level Optimization**: We compared our framework to recent bilevel methods (HJBio, LwCL, PNGBiO) in the large-scale numerical case:\n\n| Methods      | HJBio      | LwCL       | PNGBiO     | Ours       |\n|--------------|------------|------------|------------|------------|\n| Publication  | ICML 2024  | TPAMI 2024 | ICML 2025  | -          |\n| FID / JS     | 0.181/0.127| 0.182/0.099| 0.142/0.108| **0.136/0.096** |\n| Steps        | 333        | 190        | 274        | **225**    |\n| Time (s)     | 0.858      | 3.41       | 0.527      | **0.499**  |\n\nOur method achieves the lowest FID (0.136) and JS (0.096), converging in fewer steps (225 vs. 274 for PNGBiO) and less time (0.499s vs. 0.527s), a 5.3% FID and 5.4% runtime improvement over PNGBiO.\n\nOur bilevel framework outperforms recent state-of-the-art methods in efficiency (fewer steps, lower runtime) and accuracy (lower FID/JS, full mode coverage), as shown in Stacked MNIST, CIFAR-10. Its stable convergence and theoretical guarantees enhance its applicability. We will revise the manuscript to incorporate these comparisons and clarify contributions.\n\n\n**Ablation studies of hyper-parameter selection:**\n\nWe present an ablation study on hyperparameter sensitivity from our large-scale numerical experiments, varying key hyperparameters $\\alpha$, $\\beta$, $\\eta$, $\\mu_0$, demonstrating the robustness and efficiency of our framework, and propose revisions to clarify its contributions. We will revise the manuscript to add these experiments.\n\n| Configuration | $\\alpha$ | $\\beta$ | $\\eta$ | $\\mu_0$ | Steps | Time (s) |\n|---------------|-----------|-----------|----------|----------|-------|----------|\n| Original      | 0.0001    | 0.01      | 0.001    | 0.1      | 225 | 0.499 |\n| $\\alpha$=0.0002 | 0.0002    | 0.01      | 0.001    | 0.1      | 240   | 0.470    |\n| $\\alpha$=0.0004 | 0.0004    | 0.01      | 0.001    | 0.1      | 323   | 0.631    |\n| $\\beta$=0.005  | 0.0001    | 0.005     | 0.001    | 0.1      | 345   | 0.705    |\n|$\\beta$=0.04    | 0.0001    | 0.04      | 0.001    | 0.1      | 341   | 0.666    |\n| $\\eta$=0.005    | 0.0001    | 0.01      | 0.005    | 0.1      | 228   | 0.442    |\n| $\\eta$=0.01     | 0.0001    | 0.01      | 0.01     | 0.1      | 231   | 0.466    |\n| $\\mu_0$=0.5     | 0.0001    | 0.01      | 0.001    | 0.5      | 238   | 0.472    |\n| $\\mu_0$=0.05    | 0.0001    | 0.01      | 0.001    | 0.05     | 612   | 1.361    |\n\n\nOur ablation study demonstrates the bilevel framework’s robustness and efficiency, with stable convergence across a wide range of hyperparameters, enabling robust adjustments of hyper-parameters in diverse tasks.\n\n\n**Generalization to other types of conditions:** We present new experimental results demonstrating our method’s performance in domain shifts and noise inputs.. The domain shift is performed by data augmentation and the noise are performed under diverse levels.\n\n| **ResNet18**         | SGD   | SAM   | Proposed |\n|----------------------|-------|-------|----------|\n| Source               | 95.47 | 96.27 | **96.34** |\n| Target (Domain Shift)| 90.88 | 92.27 | **92.60** |\n| Moderate   | 90.04 | 90.71 | **91.62** |\n| Heavy Noise   | 75.30 | 76.55 | **77.31** |\n\n| **ResNet50**         | SGD   | SAM   | Proposed |\n|----------------------|-------|-------|----------|\n| Source               | 95.40 | 96.48 | **96.50** |\n| Target (Domain Shift)| 89.95 | 91.90 | **92.01** |\n| Mild Noise    | 88.23 | 90.22 | **90.63** |\n| Moderate Noise   | 73.02 | 75.59 | **75.61** |\n\n\nThese results demonstrate the proposed scheme which optimizes for sharpness-aware objectives, enhancing generalization under diverse adversarial conditions. We will revise the manuscript to incorporate these findings, clearly addressing the reviewer’s concerns. \n\n**Extension to other adversarial learning:**\nOur bilevel framework is a general, theoretically guaranteed, and versatile computational approach for diverse min-max learning problem, where SAM and GANs are the two typical examples instead of specific design. The single-loop algorithm uses first-order gradients, ensuring computational efficiency comparable to or better than other single loop methods (improving 16.8% over BAMM). \n\nFurthermore, our framework can integrates seamlessly with existing methods, as shown in GAN experiments with R3GAN, which are demonstrated in the new adversarial tasks (improving performance on Cifar10 and Stacked MNIST). This compatibility allows performance enhancements across diverse models.\n\nFollowing with SAM-AT(ICML 24), we perform our algorithm for the adversarial training on the semantic segmentation task. We construct the DeeplabV3 with Resnet50 as backbone under Sandford background dataset.  Our method outperforms SGD and AT across all settings.\n\n| Method         | Natural | $L_\\infty$-AT | $L_2$-AT |\n|----------------|---------|-----------------|------------|\n| SGD            | 64.0    | 57.3            | 57.0       |\n| AT ($\\epsilon=4/255$) | 55.3    | 54.9            | 55.1       |\n| Ours ($r=0.02$)   | **64.7** | **57.6**        | **57.2**   |\n\n\n\n**Different with previous works:**\nOur proposed bilevel framework is not limited to SAM or GANs but extends broadly to general min–max problems, provided that the inner maximization can be rendered tractable, even without requiring convexity. Unlike standard approaches that often sacrifice accuracy for computational efficiency, our framework maintains a principled balance between the two. Its key adaptable components include modular solver design, stochastic approximation strategies, and flexible smoothing mechanisms. This generality enables seamless application to diverse domains, including adversarial robustness and generation.\n\n**Theoretical foundations of our framework:**\nThe technique in this paper is mainly based on the prior BLPP techniques and a reformulation of the min-max problem. Specifically, we build a stochastic version of the single loop algorithm and its convergence result which shows better numerical efficiency. And for the BLPP reformulation, as we maintain the intrinsic information of classical min-max formulations (see the Example of SAM in Section 3), our method will conduct better effects then classical formulations without introducing too much numerical costs theoretically."}]

Author rebuttal:

Meta-review: (a) This work reformulates adversarial learning as a bilevel optimization problem, enabling more efficient and accurate training without added complexity. The authors propose a provably convergent single-loop stochastic algorithm that improves robustness and efficiency. Experiments show gains in both GAN generation quality and Sharpness-Aware Minimization (SAM) accuracy under noise, highlighting the practical benefits of the approach.

(b) This paper provides a theoretical contribution with rigorous convergence results for the bilevel reformulation. It is also well-written and explains well the structure of min-max problems. It has practical value: requires no added computational overhead while showing empirical benefits. 

(c) Experiments are incomplete. GAN results restricted to toy datasets, so that scalability to high-dimensional, real-world tasks remains unclear.
The novelty is unclear. Some reviewers felt the approach builds on existing optimization techniques without introducing fundamentally new mechanisms. Some comparisons are missing. There is insufficient benchmarking against sota min-max methods. Although there is a theoretical contribution, it requires a convexity assumption, which is not available in general with deep neural networks.

(d) The theoretical results, conceptual clarity, and potential generality of the bilevel reformulation make this a valuable contribution. While the experimental validation is limited and novelty may be incremental, the framework provides new perspective on adversarial learning and optimization, with convergence results that strengthen its impact. Reviewers raised concerns about scalability and comparisons, but these were addressed during rebuttal, leading to improved scores.

(e) Reviewers initially highlighted concerns about limited experiments, lack of comparisons to recent methods, and unclear benefits beyond theory. Specific issues included reliance on toy GAN datasets, insufficient exploration of scalability, and ambiguity about novelty. In rebuttal, the authors clarified their framework, addressed methodological questions, and added experimental evidence, which reviewers found convincing. Reviewer fVRv raised their score from 4 top 5, etJk from 3 to 4, and KhNq from borderline reject to borderline accept, while MepV maintained a strong accept. The consensus after rebuttal converged toward acceptance, with recognition of theoretical soundness and practical promise despite limited empirical scope.
Decision: Accept (poster)