Improving Robust Generalization with Diverging Spanned Latent Space
Authors: Owen Dou
Zhiqiang Gao
Hangchi Shen
Ziling Yuan
Shufei Zhang
Kaizhu Huang
Venue: Accepted by TMLR ()

Abstract: Robust generalization (RG), concerning how deep neural networks could perform over adversarial examples generated from unseen dataset, has emerged as an active research topic. Albeit its crucial importance, most previous studies lack a well-founded theoretical analysis and certified error bounds. In this paper, we make a novel attempt to theoretically and empirically study how we could attain a better RG by learning discriminative representation, where the inconsistency of the inter-sample similarity matrix between clean and adversarial examples should be reduced. Our theoretical investigation discloses that introducing this inconsistency as a regularization term, named Gram matrix difference (GMD), will lead to tighter upper error bound and certify a better RG. Meanwhile, we demonstrate that previous efforts to reduce inter-class similarity and increase intra-class similarity among adversarial examples for enhanced adversarial robustness are approximate optimizations of our GMD approach. Furthermore, to avoid the vast optimization complexity introduced by the similarity matrix, we propose to optimize  GMD by building a diverging spanned latent space for adversarial examples. On the algorithmic side, this regularization term is implemented as a novel adversarial training (AT) method --- Subspace Diverging (SD) --- to expand the volume difference between the whole latent space's linear span and subspaces' linear spans. Extensive experiments show that the proposed method can improve advanced AT methods and work remarkably well in various datasets including  CIFAR-10, CIFAR-100, SVHN, and Tiny-ImageNet.

Published in Transactions on Machine Learning Research (12/2024)
Improving Robust Generalization with Diverging Spanned Latent Space
Zhihao Dou" Data Science Reseorch Center Duke Kunshon Universily
zhhhoo.dou@dukcccunshn...ec
Zhiqiang Gao"
agao edu.cm
Deportment Computer Science, College of Science, Mathematics and Technology Wenzhou-Kent Keon University
Hangchi Shen
stepheea19950emmllluuu...u
College of Artificial Intelligence Southwest University
Ziling Yuan
leogs1333@163.co
Bytedance
Shufei Zhang Shanghai Artificial Intelligence Laboratory
shangshufeii@jjiuboorggg
Kaizhu Huang!
bechh..warng@uueeennnnnn......
Data Science Reseorch Center
Duke Kunshun Universily
Reviewed on OpenReview: https: openreview. net/ forum? id= GddPPGGguufl
Abstract
Robust generalization (RG), concerning how deep neural networks could perform over ad- versarial ezamples generated from unseen dataset, has emerged as an active rescarch topic. Albeit its crucial importance, most previous studies lack a well-founded theoretical analysis and certified error bounds. this paper, we make a novel attempt to theoretically and em- pirically study how we could attain better RG by learning discriminative reprosentation, where the inconsistency of the inter-sample similarity matrix between clean and adversarial examples should be reduced. Our theoretical investigation discloses that introducing this inconsistency regularization term, named Gram matrix difference (GMD), will lead to tighter upper error bound and certify better RG. Mcanwhile, we demonstrate that previous efforts to reduce inter-class similarity and increase intra-class similarity among adversarial examples for enhanced adversarial robustness are approximate optimizations of our GMD approach. Furthermore, to avoid the vast optimization complexity introduced by the sim- ilarity matrix, we propose to optimize GMD by building a diverging spanned latent space for adversarial examples. On the algorithmic side, this regularization term is implemented as novel adversarial training (AT) method Subspace Diverging (SD) to expand the volume difference between the whole latent space's 's linear span and subspaces" linear spans. Extensive experiments show that the proposed method can improve advanced AT methods and work remarkably well various datascts, including 10, CIFAR-100, SVHN, and Tiny-lmageNee.
"Equal contribution.
i "oorrsppondigg authors.

---

Published in Transactions on Machine Learning Research (12/2024)
1 Introduction
Deep Neural Networks (DNNs) have attained great success recently in various applications, such as image classification, image generation, and object detection. Despite the impressive performance enhancement over various tasks, DNNs are strikingly vulnerable to specific well-crafted adversarial perturbations (Carlini & Wagner, 2017; Song al., 2018; Fischer et al., 2017; Lyu et al., 2015). Although these perturbations are invisible to humans, they can easily mislead DNNs predictions. Adversarial training (AT) (Mkadry et al., 2017; Wang & Zhang, 2019; Kannan et al., 2018; Gu & Rigazio, 2015; Zhang & Wang, 2019; Jia et al., 2022) is considered as one of the most effective defense methods capable of effectively improving model robustness against various types of adversarial attacks (Carlini & Wagner, 2017; Croce & Hein, 2020; Kurakin et al., 2016; Mkadrr al., 2017), such as widely used projected gradient descent (PGD) based AT (Mkadry et al., 2017), adversarial weight perturbation (AWP) (Wu et al., 2020), Feature Scatter (FS) (Zhang Wang, 2019) and TRADES (Zhang et al., 2019).
Traftional AT
Teutitoral AT
20-
Touttional
18-
Mebust accerry
Sccert
11
18
15
PGD-AT
AWP
Trndes
PGD-AT
AWP
PGD-AT
AWP
Trades
Mithod
Mithod
Mirhod
(c) Tiny-ImageNet Figure 1: Robust accuracy gap (over PGD20 generated CIFAR-10, CIFAR-100, and Finy-ImageNet between adversarial Training and test dalasets for classical AT methods and those augmented with our Subspace Diverging (SD) regularization method.
(a) CIFAR-10
(b) CIFAR-100
Although robustness has been improved significantly in previous studies, the robust models trained by most existing adversarial training methods still present poor robust generalization (RG). RG evaluates how well the model trained over the adversarial training set generalizes to further adversarial examples generated from unseen dataset (Rice et al., 2020), which usually measured by the robust accuracy gap, i.e. the accuracy difference between adversarial training examples and adversarial test examples (Gao al., 2022). As depicted in Figure 1, all robust AT models, including PGD-AT, AWP, TRADES, and FS, show poor RG and present large robust accuracy gaps.
Indeed, RG has been shown even more difficult to achieve than standard generalization since the sample com- plexity of adversarial examples can be significantly larger than that of standard or natural samples (Schmidt et al., 2018b). Recent efforts have studied RG from different perspectives, such as introducing customized early stopping (Rice el. al., 2020), activation function (Singla al., 2021), adversarial vertex mixup (Stutz et al., 2021), and diffusion term of Stochastic Differential Equation in AT (Sun et al., 2023). However, most of these methods empirically investigate RG and lack well-founded theoretical analysis. Recently, Zhang et al. (2021) proposed shift consistency regularization (SCR) term to theoretically certify the RG error, which is, however, shown to be underperformed than our method in experimental results.
In this paper, from the perspective of learning robust and discriminative representation, we aim to investigate an effective algorithm that can certify a tight RG bound in theory to ensure excellent adversarial robustness practically. Generally, adversarial perturbations induce feature shifts in the latent feature representation (Zhang al., 2021), which causes adversarial examples move into the semantic clusters of other classes, resulting in an incorrect classification. This phenomenon inter-sample relationship map of clean data with that of adversarial examples. In standard model, the discriminative fcatures of clean data are similar within the same class and dissimilar among different classes (see Figure 2a). On the contrary, in Figure 2b, features of adversarial examples exhibit smaller intra-class similarity, yet more considerable inter-class similarity than clean data. Ideally, enabling the features of adversarial examples be as discriminative as clean data will encourage better RG. Intuitively, this goal can be attained by reducing the inconsistency of inter-sample relationship maps between clean data and adversarial examples.
be visualized in Figure 2 by comparing the
2

---

Published in Transactions on Machine Learning Research (12/2024)
1000
1050
1000
0.30
3000
3000
4000
0.25
4000
4000
5000
5000
5000
5000
6m
0.20
6000
020
200
0.15
011
1000
A15
A15
10000
5000
0.0
10000
500g
A10
10000
5000
0.00
10000
5000
1000
200
500
000
200
100
10
1000
200
300
000
90
600)
700
000
1000
200
4000
X00
000
700
1000
5000
10000
100
700
200
000
0000
Clean data w/S Sta. (a)
(b) PGD20 w/ Sta.
(c) PGD20 w/ FS
(d) PGD20 w/ FS+SD
Figure 2: Visualization of inter-sample relationship (Gram matrix) of latent features on SVHN. We randomly select 1,000 samples for each class from the test dataset and sort all the selected samples according to their class indexes. The lighter color represents the higher cosine similarity of the two feature vectors, and vice versa. The latent features of standard model (abbreviated to Sta.) are generated from (a) clean data and (b) adversarial examples perturbed by PGD20. The latent features of adversarial examples perturbed by PGD20 are produced by robust models trained by (c) Feature Scattering (FS) (Zhang & Wang, 2019) and (d) FS applied with our Subspace Diverging (SD). All models are trained on the SVHN dataset and employ wide residual networks (WRN-28) as the backbone.
To further verify observation, theoretically analyze the robust generation issue from novel perspec- tive. We illustrate that the robust generalization gap can indeed be upper bounded by the above inconsistency of inter-sample relationship Gram matrix difference. Meanwhile, we demonstrate that previous efforts to reduce inter-class similarity and increase intra-class similarity among adversarial examples for enhanced ad- versarial robustness in (Li et al., 2019; Bui et al., 2020) are approximate optimizations of our approach. our case, this term is optimized by learning a diverging spanned latent space for adversarial examples, where Volume Difference between the Whole latent space's linear span and Subspaces' linear spans (VDWS) is enlarged, such that latent subspaces (divided by categorics) to be mutually orthogonal. Our method addi- tionally improves the representation diversily of adversarial examples which has been proved as one of the merits of improving the generalization ability of standard model (Liu et al., 2018). Compared with previous studics like (Li et al., 2019; Bui et al., 2020), our method offers a thcoretical guarantec for improving RG through learning discriminative representation. More importantly, compared with (Zhang el al., 2021), our approach enjoys a better RG performance, which can be observed in an empirical analysis in Section 6.6, thus certifying robust performance in many real-world datasets.
Built upon the above theory, towards better RG, we instantiate the VDWS with an AT method called Subspace Diverging (SD). As shown in Figure 2d, our SD improves the feature representation compared to traditional AT methods (e.g., FS in Figure 2c), which becomes more discriminative and diverse, thus promoting a better RG (as seen in Figure 1). Our contributions are digested as follows.
1) We study and reveal that the robust generalization gap correlates with the difference in inter-sample relationship maps between clean data and adversarial examples. Leveraging this insight, we derive a novel and tighter robust generalization bound.
2) To enable a tractable optimization, we propose to build a diverging spanned latent space for adversar- ial examples, which is theoretically well-founded for learning discriminate and diverse representation. We implement a novel adversarial regularization method named subspace diverging to achieve this goal.
3) Extensive experiments have been conducted to verify the effoctiveness of our adversarial regularization method on various benchmark datasets. The results demonstrate that our approach enhances the perfor- mance of various state-of-theeart methods.
3

---

Published in Transactions on Machine Learning Research (12/2024)
2 Related Work
2.1 Adversarial Training
Adversarial training (AT), a primary defense approach against adversarial examples (Goodfellow et al., 2015; Carlini & Wagner, 2017; Athalye et al., 2018), has been extensively researched to enhance the robustness of deep neural networks. Projected gradient descent (PGD) (Carlini & Wagner, 2017)-basod AT is one of the most common approaches used to improve robustness, and PGD is an iterative optimization technique designed to generate adversarial examples by perturbing imput samples within specified norm constraint. Adversarial weight perturbation (AWP) (Wu et al., 2020) is proposed, which is effective in boosting ro- bustness by directly perturbing the model's weights rather than the input samples. This approach aims to make the model resilient. to changes in its model parameters, thereby improving its overall stability and performance against adversarial attacks. Based on AWP, Jin et al. (2023) introduces small Gaussian noise into the weights of the neural network during adversarial training, and the weight perturbation is modeled using a Taylor series expansion, which allows the method to decompose the objective function into multiple terms. The goal is to balance the tradc-off between adversarial robustness and clean accuracy by smoothing the weight updates and finding flatter minima in the loss landscape. Feature Scatter (FS) (Zhang & Wang, 2019) disperses features of input data to generate diverse adversarial examples. By ensuring that adver- sarial examples cover a wider range of perturbations, FS can achieve better robustness. Geometry-Awaro Instance Reweighted Adversarial Training (GAIRAT) (Zhang et al., 2020c) optimizes the geometry of de- cision boundaries by assigning different weights to adversarial examples based on their distances from the decision boundary. GAIRAT effectively balances the trade-off between robustness and accuracy, leading to significant improvements in both arcas. Morcover, some rescarchers also invostigate the effects of adversarial training strategies on model performance (Zhang et al., 2020a; Jia et al., 2022; Wei et al., 2023). Friendly Adversarial Training (FAT) (Zhang et al., 2020a) emphasizes that AT from adversarial examples closer to the decision boundary can help in reducing the model's overfitting to adversarial perturbations. Learning attack strategy (LAS) (Jia et al., 2022) is introduced to adjust the attacking configurations for different data samples, and Wei et al. (2023) adapts the class-specific training configurations.
2.2 Robust Generalization
Robust generalization evaluates a model's performance against unseen adversarial examples, akin to standard gencralization. Yin et al. (2019.) investigate the relationship between model complexity and its ability to robust generalization against adversarial examples. It explores how increasing model capacity can improve adversarial robustness but may also lead to overfitting if not properly regularized. The finding provides the- oretical insights and empirical evidence on how to balance model complexity achieve optimal adversarial robustness and generalization. Schmidt et al. (2018b) argue that achieving robust generalization against adversarial examples necessitates significantly larger datasets compared to standard training. The statement highlights that increased data volume can enhance the model's ability to generalize and resist adversarial attacks. Zhang et al. (2019) decomposes the robust error into natural classification and boundary errors, offering a balanced approach to robustness and accuracy. This study examines the inherent trade-off be- tween achieving robustness against adversarial attacks and maintaining high accuracy on clean data. Li al. (2022a) analyze that the poor robust generalization is due to the VC dimension of adversarial testing samples being significantly larger than their intrinsic dimension. Sun et al. (2023) enhance robust generalization by approximating PGD-AT as continuous-tima time Stochastic Differential Equation (SDE) and manipulating its diffusion term. In (Zhang et al., 2021), the Shift Consistency Regulation (SCR) method is proposed to mitigate deficient robust generalization by reducing variance in perturbation direction between adversarial training and unseen datasets. In this paper, we investigate cosine similarity variants and analyze the ro- bust generalization gap to enhance model robustness. Thcorctical analysis suggests that achicving robust generalization faces challenges from random inter-sample relationship variation, susceptible to perturbation attacks. Our approach demonstrates better performance empirically, as observed in our experiments.
4

---

Published in Transactions on Machine Learning Research (12/2024)
2.3 Learning Discriminative and Diverse Representations
Metric learning-based approaches (Cheng el al., 2016b; Hadsell et al., 2006; Hu el al., 2014; Schroff et al., 2015; Huang et al., 2010; Chopra et al., 2005) are employed to increase inter-class distance and decrease intra-class distance for deep features, typically using Euclidean distance. Hadsoll et al. (2006) proposc how to reduce data dimensionality through invariant feature learning. It focuses on identifying and preserving essential data characteristics while minimizing irrelevant variations, thereby enhancing the efficiency and accuracy of subsequent analyses. The groundbreaking contrastive loss (Hadsell et al., 2006) enforce the above constraints using siamese network architecture (Chopra et al., 2005). This strategy gained popularity in various downstream tasks such as image retrieval (Yousefzadeh et al., 2023). Moreover, learning discriminative feature representations can also be beneficial in face recognition (Hadsell et al., 2006; Sun et al., 2014), where the triplet loss (Cheng et al., 2016a) and center loss (Wen et al., 2016) also demonstrate similar effectiveness. In a recent work by Lezama et al. (2018), a plug-and-play loss term for deep networks has been utilized explicitly reduce intra-class variance and enforce inter-class margin. Furthermore, Yu al. (2020) enhanced feature representation discriminability by augmenting the code rating of feature representation. Following (Yu al., 2020), Chan et al. (2022) introduce ReduNet, deep learning framework that constructs interpretable network architectures by maximizing the rate reduction of feature representation. ReduNet efficiently roduces information redundancy and captures essential features.
3 Theoretical Analysis
This section analyzes RG from the theoretical aspect. A novel method is proposed to optimize the robust generalization gap by introducing inter-class and intra-class similarity. Moreover, we propose to leverage volume variety between the whole linear and subspace spans for a tractable optimization, which further improves the diversity of fcature representation.
3.1 Robust Representation
Given a data distribution (z.y) (X, Y) with K classes, a training set, consisting of N i.idd. data pairs drawn from (X, Y); can be denoted as (Xp, YD), where XD 1 and YD E KxN denote a training data matrix and label matrix, respectively, and d is the dimension of the data sample. The object of standard generalization is to learn a deep neural network (DNN) fe(-) with parameters 0 on a training set so that the generalization error (the difference between the expected loss over the data distribution and the empirical loss over the training data) becomes as small as possible (Xu & Mannor, 2012; Bousquet & Elissooff, 2002; Neyshabur et al., 2017), where fo()) maps the data samples from the input space to the latent feature space with dimension r, e.g. fa(x) E RR. Leveraging the above insight, considering the loss function I(-) of fe(-), the robust generalization error (gap) (Zhang et al., 2021) is defined as the difference between the expected loss over adversarial examples (XDde YD) and the expected loss over their underlying distribution (Xadv Y), i.c.,
ERGE 2 |( (xadv Y) - ( (X YD)) where
1 ((xadu Y) = =E (1o (wad w)],
1 N
(x YD) = N Σ (folond)) v.u))
In general, test sel. (XT, Yr) is introduced as surrogate of data distribution (X, Y) to empirically estimate the robust generalization error since the entire (X, (X,Y) Y) is unavailable. Here, (Xr, Yr) includes i.i.d. samples that are drawn from (X, Y) and disjoint with (XD, YD).
In the following, we propose Theorem 3.1 to serve as the main theoretical foundation for our work, which establishes an upper bound of the robust generalization containing standard generalization error and one novel regularization term. This term was inspired based on our observations as illustrated in Figure 2, where the Gram matrix is widely used to measure inter-class and intra-class similarity to capture inter-sample relationships. Detailed proof can be seen in the Appendix.
5

---

Published in Transactions on Machine Learning Research (12/2024)
Theorem 3.1 Given the clean data matrix X; and adversarial data matriz X, that both contain N; samples of i-th class over the training sel, the sels of cleon data Cj and adversarial data Cyue of i-lh class over the underlying data distribution, and the DNN fe that maps data samples to latent features with dimension if the loss function 1(-) of fo(.) is t-Lipschitz, and fol.) is the L-Lipschitz, then for any o > O, with the probability at least aa, we have
1122 N
2K In + 2ln (2)
ERGE S EGE+ V -KV + tCHL]18112 + M
N
where
VTa = Tadv
Ta.
VT- = Tudo - T,
N
U
[
V =
K [
N
+1 K
C 2(N H R3
H (o())]l(>))12
2
8 is adversarial perturbation and M is the upper bound of the loss function I(-) over the whole underlying data manifold. TTa and VT denote the Gram matria difference over the training set and the underlying dala distribution respectively,
(Zado) T Zudo -(1) Z₁
(Zudo)
Zadv (Z1)² ZK
TTa
(Zodo) Zaddo (Zx) Zi
(Z
Zodn - -(Zx) ZK
(1)
(24d0)
27du
-211 21.
(zqde)
2x
(21) 2K
VT=
(>x(l)
2qd00 - (2x) 21
(2 T
)
2adv 2K
(zk) 2K
So (X,)
fo (X
where
Zi
Zaddu
Zi, Zaddu
E BRXx.
[o (X;) 12,c0l
IIfo (Xudu)
1|2,oo
Bi (x)
x E C.J
fo (wade) pade E [Codu)
adv
aade Rs, ai
E R".
E [o (x) E
E fo (xade) x Ciddo
l12
11.1,,coo represents the calculation of the Euclidean norm of column vectors in the matrix.
Theorem 3.1 highlights that robust generalization gap ÉREG can be decompased into three terms: 1) the standard generalization gap (SGE); 2) Gram matriz difference (GMD), i.e. xt2 N I|Tall2 + [KV*]/VT] which measures the inter-sample relationship difference between underlying and training adversarial data distribution; 3) constant components. In GMD, VT and VIa denote the Gram matrix differences on underlying and training data distributions respectively, and both of them aim to quantify the inconsistency of inter-sample relationship maps between clean and adversarial examples. To empirically illustrate the large GMD values of the vanilla AT method, we visualize the Gram matrices on test set that is randomly sampled and includes 1, 000 data points. Figures 2a and 2c show T (2, T Z,] of standard model and Tade- (Z z of robust model trained by FS, where i,j {1,2, ... K}. As observed, the features of adversarial examples present smaller intra-class similarity and larger inter-class similarity than those of clean data, i.c., [I(Z,dd) zadd1l2 < | Z and ((,,du)) 2,dx112 > || Z, This phenomenon results in value of Gram matrix difference, VT Tade T, so that a better RG is hard to achieve. Accordingly, we propose to minimize the GMD to reduce this inconsistency and certify a lower RG error.
Comparison to Shift Consistency Regularization (SCR) (Zhang et al., 2021). According to Zhang et al. (2021), for the thcoretical analysis of RG, the robust crror gap is divided into three com- ponents: the standard error gap (EGg), a constant term, and a feature shift inconsistency term. There- fore, Zhang et al. (2021) propose SCR, which constrains the feature shift to certify RG, and SCR

---

Published in Transactions on Machine Learning Research (12/2024)
0.2
RID-TT RID-AT+SD
Robust Accuncy Gap
0.2
RGD-AT PGD-AT-SD
0.1-
g IVTallla
||T]|2
IVTallz
||T||a
x
77
N:
(a) PGD20
(b) C&W
Figure 3: || V Talle and V 22 of our approach under (a) PGD20 and (b) C&W. All methods are trained by using WiderResNeet34--1 backbone.
[fo(sdde) fo(x) x C:] l2 where Ñ; is the set of index of training data for class i. SCR only constrains the difference between the feature shift fo (2add) - (xx)) of each Training data point and the expectation of feature shilts within the same class for the underlying distribution. Nevertheless, it overlooks the inconsistency among different classes, which intuitively leads less tight RG compared to optimizing Appendix. We use approximated approach to optimizing GMD, which is proposed in Section 5, and our method can achieve better RG as empirically shown in Section 6.6.
ming & EEE Ever, [
GMD. We provide indirect comparison in Section A.1 of the
Comparison to Inter-feature Relationship (IFR) (Zhang et al., 2024). The approach proposed by (Zhang et al., 2024) focuses on preserving the inter-feature relationship between natural and adversarial examples. This method aims to maintain the original feature distribution structure, minimizing the vari- ation caused by adversarial perturbations. In contrast, our approach introduces the GMD to address the inconsistency between clean and adversarial examples in the inter-sample relationships. By optimizing diverging spanned latent space, we enhance the discriminative power of feature representations.
In terms of the optimization of GMD, we can opt to minimize ||VTal|;; however, estimating ||VT|| is generally impractical due to the inaccessibility the entire underlying distribution. Alternatively, a widely accepted assumption is that the inter-feature relationships within the training data can reflect the struc- tural information of the whole data distribution. This assumption has been effectively utilized adversarial robustness (Li et al., 2019) and representation learning (Bui el al., 2020). Given the assumption, the train- ing feature representations become more discriminative, exhibiting larger intra-class similarity and smaller inter-class similarity, the fcature representations of the entire underlying distribution are supposed to follow the same trend. Moreover, by learning the discriminative features of adversarial examples, the diagonal elements of the Gram matrix increase, while the off-diagonal elements decrease accordingly for both training and underlying datasets. As such, ignoring ||VT]] la still represents a reasonable optimization strategy, since minimizing ||Vall tends to cause a docrease in || 12-
To address this aspect, present ||VTa|| and ||VT|2 of our SD, shown in Figure We empirically caleulate these values by randomly sampling N = 1, 000 data points from the training and test set of the CIFAR-10 dataset respectively, where our method is only applied to the training data. + / and No VT are calculated under the PGD20 and C&& attack with PGD-AT baseline in Figures 3a and 3b respectively. The results clearly illustrate that SD can docrease || VTa la and ||VT|| consistently.
Moreover, GMD can be approximately optimized by minimizing || v Tall2, which can be further decomposed
as:
VTal2 VTinter
VTintra
K
K
where VTrnneer
Σ
([ ( Zade (2
(2)
d=

---

Published in Transactions on Machine Learning Research (12/2024)
K
VTa
Z (Z y Zzdi - (Z.)
Here, || V Ti ll2 and || / I denote the inter-class and intra-class similarity respectively on training adversarial example distribution. Reducing || v Tall2 can be achieved when (Z.do) Zadd z Zi and (Z,do)² Zgde + Z Zy. Thus, the intra-class cosine similarity should increase, and inter-class cosine similarity should decrease. This solution aligns the general intuition for learning discriminative representation to improve generalization ability and is an approximation of our GMD.
3.2 Diverging Spanned Latent Space
The intricacies of point-to-point level optimization contribule to the vast optimization complexity. To solve this problem, we propose to optimize this term by learning a diverging spanned latent space for adversarial examples.
The linear spans of the whole training feature matrix and wise feature matrix Z, are denoted as $ and S₁ respectively, and calculated by
= S Z,Z,
where S, S; E R"xr, is feature dimension, and column vectors in S and S; represent the set of basis vectors for the whole latent spaces and class-wise subspace of i-th class. The volume of any latent space linear span can be represented by its determinant:
Vol (P) = det (P).
Intuitively, the more diverse the subspaces are, the more separable clusters of adversarial example feature representation. Consequently, the inter-class similarity tends to decrease. Such a latent space, composed of diverging subspaces, embodies larger volume, which is visualized in Figure 4. Besides, a smaller volume of each subspace indicates a larger intra-class similarity. We show the proof details of this viewpoint in Theorem 3.2.
Theorem 3.2 Let S be the span of the latent space, encompassing all subspaces (S S. Let I denote the identity matrix. Then,
If Vol(S) is maximized, all subspaces S, C S are mutually independent, Vol(I + S,) is minimized, the vectors in S, remain consistent.
(4)
Theorem 3.2 highlights that decreased cosine similarity among distinet subspaces basis expands the volume of the overall spanned latent space as illustrated in Figure 4. In contrast, heightened cosine similarity between intra-class basis is associated with reduced volume in each subspace. Detailed proof of Theorem 3.2 is provided in the Appendix.
To achieve a discriminative feature representation, we aim to maximize the overall volume of the training latent space linear span while minimizing the volume of the linear subspace span, as elaborated in Section 3.1. Specifically, sort these objectives by prioritizing the expansion of the Volume Difference between the Whole latent space's linear span and Subspaces' lincar spans (VDWS):
K
VDWS à Vol (Sadu)
Σ K
1
Vol (I + Sqdy),
(5)
where I is the identity matrix to prevent the subspace S, volume being close to 0; hence, the above issue can be reformulated aiming to maximize VDWS to diminish concurrently both ||VTinter [|2 and V l|2. denoted as:
VDWS - min VTal
8

---

Published in Transactions on Machine Learning Research (12/2024)
As the subspace becomes more independent, the volume the overall spanned space becomes larger (each small white ball represents the unit volume, and the white becomes more extensive, the overall volume becomes more prominent). Therefore, semantic clusters may become more dispersed, resulting in more discriminative feature representations.
Figure 4:
where || VTal22 represents the gram matrix difference on whole data distribution.
Here, we show that maximizing VDWS enjoys an additional advantage for certifying better robust general- ization since the diversity of adversarial example feature representations implicitly promoted. Specifically, VDWS that builds a diverging spanned latent space will produce a unique eigenveclor set for each subspace, including more significant number of eigenvectors.
By applying the singular value decomposition algorithm, the subspace be denoted as S, -; E, V,", where U; represents the eigenvector malrix of S.. The unique eigenveclor set for i-th class, including the orthogonal basis set that remains independent of other subspaces, is defined as:
U = -ei,.... Ci..... cirt
(7)
S.1. e; x S 0, Ve,. Uü, j E [1, K] and i f
Since our VDWS increases the volume of S, the more significant number of the whole latent space basis will be attained that the number of bases e;, in unique cigenvector set U. of subspace also increases.
From the above analysis, more sizable number of distinct eigenvectors ea, in U will naturally steer to a greater value of rank(U> ). which has been shown as a necessary condition for learning diverse representation (Chan et al., 2022). Therefore, the approach not only enhances feature representation discrimination but also improves feature representation diversity, which has been proven to enhance model generalization (Liu et al., 2018). Morcover, We further verify the feature diversity of our method through experimental analysis in Section 6.8.
Previous studies have investigated the discriminative and diverse representation learning for standard gen- cralization, such as Maximal Coding Rate Reduction (MCR²), considering the low level of feature distortion as an essential premise in (Yu et al., 2020). However, as shown in Figures 2b and 2c, features of adversarial examples are highly distorted, which leads to unclear inter-sample relationships. As a result, applying MCR2 directly on an adversarial example potentially introduces difficulty in the optimization process. In contrast, we propose to work on the volume to maximize VDWS to achieve robust generalization.
4 Empirical Analysis
In this section, we aim to confirm the validity Theorem 3.1 by demonstrating how the accuracy gap between test and training adversarial examples evolves with varying values of VDWS. We visually illustrate inter-sample similarity, shedding light on how adversarial perturbations play role in this accuracy gap. All the models discussed in this subsection are trained using Feature Scatter (FS) the SVHN dataset.
9

---

Published in Transactions on Machine Learning Research (12/2024)
4.1 Robust Generalization Volume of Linear Span
38
04
04
18
Aecio 69
AccoRn Grp
Accoay
VOWS
15
NEWS
10
Gah-
Canl
-11
Aooaay daph
00
00
00
00
Epoch
Epoch
Epoch
(a)
(b)
(c)
(d)
Figure 5: The accuracy gap vs. VDWS; at different training epochs. The comparison of FS and AT to train the robust models against various attacks: (a) C&W attack and (b) PGD20 attack. The comparison of FS and FS+SD (ours) to train the robust models against various attacks: (c) C&W attack and (d) PGD20
attack.
Adhering to the established evaluation protocol (Xu & Mannor, 2012), rather than using the error gap difference |ERGE - EGEL, we choose to calculate the accuracy gap difference,
ACC(XC YD)l which shares the same trend with error gap difference. This replacement will provide direct reflection of robust generalization, which has been widely utilized in previous studies (Zhang ct al., 2021). In Section 3.1, have demonstrated the correlation between VDWS and GMD. To validate Theorem 3.1 and show whether the gap difference is caused by GMD, the VDWS, and the accuracy gap difference under C&W and PGD20 across 60 to 200 epochs are shown in Figures 5a and 5b, where robust models are trained by FS and AT respectively and VDWS,, denote the VDWS values of the test datasets. As results can be observed, the VDWS, and the accuracy gap difference show obvious consistency. Therefore, the results indicate that GMD can capture the error gap difference (reflecting the difference between robust and standard generalization).
||ACC(X7*) Yr) ACC(X IACC((,)
Feature Visualization
(a) Clean w/ FS
(b) Clean w/ FS+SD
(c) PGD3 w/ FS
(d) PGD3 w/ FS+SD
Figure 6: The latent features generated from (a) FS with clean samples, (b) FS+ with clean samples, (c) FS against PGD3 attack, (d) FS+SD against PGD3 attack. All models are trained on the CIFAR-10 dataset and employ wide residual networks (WRN-28) as the backbone.
We select three classes for visualizing the feature distributions on the test datasct of CIFAR-10. We employ a multi-layer perceptron (MLP) backbone and utilize a PGD-3 altack with = 255 distributions presented in Figure 6. In the latent space of adversarial examples, after integrating our SD to FS in Figure 6d, the distributions of the categorics are more inclined toward the vertical, and the clusters of categories are more compact than the ones of FS Figure 6c. This trend also emerges in the clean dataset, observed in models trained by FS+SD in Figure 6b and FS in Figure 6a.
2 to generale feature
10

---

Published in Transactions on Machine Learning Research (12/2024)
5 Subspace Diverging Regularization
We now turn to solve the optimization problem outlined in Section 3.2. Initially, to expand the entire volume of the latent linear span Vol (S), we introduce the following functions:
Lepan log det(S).
(8)
The function (-t()) is smoothly concave function that aids in achieving an optimal solution more effectively. Moving on, reduce the volume of the subspace linear span, we define the contraction component below:
Lshrrin
K
N₂ 2N
log det
[+ w N;
Ss
(9)
where N; represents the number training samples for each class, and is a pro-defined parameter. These two components collaboratively function as:
Ldiverge -Ishrinkk (1 - 7) Iespan
(10)
where 7 is a balance prper-parametery scaling two functions effectively.
Algorithm Adversarial Training with our Subspace Diverging (SD)
Input: a neural network fo(.) initialized with learnable parameters 0, batches data pairs (62, (1)):1); (e)..... a Dn)). batch size V, a predefined hyper-parameter A, Gaussian noise e e
(-0.015, 0.015), number of epochs e.
Output: robust neural network fa(-).
Initialize Laer 0, L diverge +- 0, Lmar <-
for i t-1 to ft do
Add Gaussian noise on data samples: & = f; + Generate the adversarial examples for i-th data batch: gadv + argmax (Igono(3' Di, 0))
8f
Select. the maximum loss values for three sets:
mar max (gene (24,, Di, 0), L gene)) diverge &- max Ldiverge (1/,, Di. 0), gene!
maa maa((L(a (aaddu I., 0), L mar)
end for
Calculate the h and d by: l for j + to do
L maz Lonn
and d
Leuerne mas
for i i â do + +
Generate the adversarial examples: aadd + arg max (Lgono Dr, 0) Laivorgo (1/2 Dis 0))
21
Update the classifier: f min { (L(addv, 0.. + Laiverge (RRdV &s, 0))}
end for end for return robust neural network f-(.).
Consequently, we propose utilizing Ldiverge as regularization term in adversarial training. This regulariza- tion promotes subspace divergence, which can be defined as:
min { 1 (xxdr Yn.0) 2
A
Laivergo (X .D. f)
(Lyene (Xb.YD, + ( Laveeree (X), 0))
8.t. X = argmax X,
11

---

Published in Transactions on Machine Learning Research (12/2024)
Table 1: All used hyper-parameters on different methods.
Method
Datasets
Batch Size
Training Epoch
(d,k)
Y
W
C-FAR-10
120
400
(100,100)
0.5
0.5
0.05
PGD-AT+SD
CIFAR-100
80
300
(200,200)
0.7
0.05
0.01
Ting-emageNet
120
(200,400)
0.2
0.05
CIFAR-10
120
200
(100,100)
0.5
0.5
0.1
AWP+SD
CIFAR-100
120
250
(200,200)
0.7
0.02
0.1
Tiny-ImageNet
120
130
(150,400)
0.3
0.01
0.5
CI
120
300
(200,100)
0.5
0.5
0.1
FS+SD
CIFAR-100
100
400
(200,150)
0.5
0.02
0.05
SVHN
120
600
(200,100)
1
0.05
0.05
C-
90
(90,50)
0.8
0.05
TRADES+SD
CIFAR-100
100
90
(150,200)
0.5
0.01
0.01
where X indicate adversarial training dataset that are produced during the adversarial training, X represents the initial adversarial training dataset that adds random noise to the original image, I(-) is an adversarial training loss, and L-gne(-) (-) is the loss function which producing adversarial examples. As the scale of Ldiverge(-) and (-) are different, we design normalization parameters d and to adjust loss values, and À is an additional pre-defined parameter.
Due to the GPU memory limitations, calculating Ldiverge()) for all of the training dataset is very challenging. To solve this problem, caleulate Ldiverge--), L(-), and (-) for each data batch. Then, we select the maximum values among all the batches and define them Lmax Lyene: and L Laar diverge respectively, max ddiegres L
Lmaz Subsequently, we estimate and using Lmax, mar and L Lgene where Ldiverge and Trmn
We have observed that the values of d and k remain stable for each epoch. Therefore, to streamline our training process, we compute the d and k only in the first epoch. The specific values for d and k of various datasets and the entire algorithm can be found in experiment section. When training the generated adversarial examples, our algorithm can be regarded as a regularization increase the overall spanned space volume but reduce the volume of cach subspace.
6
Experiments
This section conducts comprehensive experiments to gauge the effectiveness of our SD method, in countering diverse adversarial examples.
6.1 Experimental Setting
We evaluate method's robustness against white-box and black-box adversarial examples CIFAR- 10, CIFAR-100, SVHN, and Tiny-Imagenet. We benchmark our approach against four established methods: Feature Scattering (FS) (Zhang & Wang, 2019), Adversarial Training (AT) (Mkadry et al., 2017), Adversarial Weight Perturbation (AWP) (Wu et al., 2020), and TRADES (Zhang et al., 2019). Our core model is based datasets, we follow (Jia et al., 2022)
on the WideResNet-34-- (WRN34) architecture. On and implement Pre as the backbone. FS, a well-known baseline, has been demonstrated perform poorly against strong attacks, such as Autoattack, in previous work (Nascer et al., 2022). As a result, we do not present it as primary outcome. However, since SCR is built upon FS, we will compare SD with SCR based on FS baseline alone in Section 6.3. Following (Zhang et al., 2021), we implement WideResNNet288-100 (WRN28) for comparison.
In our training regimen, we employ SGD with a momentum of 0.9, weight decay of 5 x 10-4, and an initial learning rate 0.1. Learning rates decrease at epochs 60 and 90 by factor 0.1. During training, we perform 7 attack iterations for PGD-AT and TRADES, and 1 itcration for FS. For consistency, the attack budget is maintained at 8/255 for all the methods. Adversarial examples are computed with the foe norm during training and testing. All experiments are conducted single GPU, e.g. RTX 3090, under the
12

---

Published in Transactions on Machine Learning Research (12/2024)
Table 2: Accuracy under white-box attacks on CIEAR-10 with WiderRResNet-34-10 (E 8).
Method
Clean
PGD-20
PGD-50
C&W
AA
PGD-AT
85.17
55.08
54.88
53.91
51.69
TRADES
85.72
56.10
55.90
53.87
53.40
AWP
85.57
58.13
57.92
56.03
53.90
LBGAT
88.22
54.66
54.30
54.29
52.23
MART
84.17
58.56
58.06
51.58
51.10
FAT
87.97
49.86
48.79
48.65
17.48
GAIRAT
86.30
59.54
58.74
45.57
40.30
PGD-AT+LAS
86.23
56.49
56.12
55.73
53.58
PGD-AT+SCR
85.91
56.91
56.51
54.93
53.04
PGD-AT+RAT
84.39
56.29
55.97
55.18
52.38
TRADES+LAS
85.24
57.07
56.80
55.45
54.15
TRADES+
86.31
56.81
55.97
54.29
54.10
TRADES+RAI
85.98
58.47
56.13
54.20
AWP+LAS
87.74
60.16
59.79
58.22
55.52
AWP+SCR
85.49
60.90
58.31
56.36
53.49
AWP+RAT
86.12
61.45
58.2
57.40
PGD-AT+SD
86.43 1 0.12
58.93 + 0.23
58.29 1: 0.18
55.79 + 0.22
53.91 1 0.16
TRADES+SD
85.99 + 0.14
58.79 + 0.24
57.03 1 0.22
56.93 1 0.17
55.03 1 0.15
AWP+SD
87.79 + 0.11
61.59 0.19
60.30 + 0.21
58.73 + 0.18
57.91 0.20
Table Accuracy under white-box attacks on CIFAR-100 with WiderRee..ett-4--D (e 8).
Method
Clean
PGD-20
PGD-50
C&W
AA
PGD-AT
60.89
31.69
31.45
30.10
27.86
TRADES
58.61
28.66
28.56
27.05
25.94
AWP
60.38
33.86
33.65
31.12
28.86
LBGAT
60.64
34.75
34.62
30.65
29.33
SAT
62.82
27.17
26.76
27.32
24.57
PGD-AT+LAS
61.80
32.77
32.54
31.12
29.03
PGD-AT+SCR
60.90
32.97
31.58
30.39
29.17
PGD-AT+RAV
61.15
32.29
30.97
31.53
28.77
TRADES LLAS
60.62
32.53
32.39
29.51
28.12
TRADES+SCR
60.42
32.15
32.17
29.57
27.68
TRADES+RAT
62.93
33.36
29.61
27.90
AWP+LAS
64.89
36.36
36.13
33.92
30.77
AWP+SCR
64.51
34.92
33.98
33.58
29.79
AWP+RAT
64.71
35.73
31.41
30.20
PGD-AT+SD
62.34 + 0.21
33.19 + 0.15
32.97 - 0.20
31.99 + 0.19
29.58 = 0.18
TRADES+SD
60.97 + 0.16
33.79 + 0.22
33.17 - 0.19
29.79
+ 0.17
28.43 + 0.14
AWP+SD
64.91 1: 0.14
36.59 1 0.17
35.97 1 0.16
34.03 1 0.19
31.14 1 0.17
environment using CUDA 11.7, Python 3.8, and Pytorch 1.80. Table lists all used parameters on different basclines, batch sizes, and training epochs. 7 is the balance paramcter, and X are pre-defined paramcters, d and k are normalization parameters. The early stopping is used for model selection in all methods. Our results and standard deviations obtained from 5 runs; each trained using different random seed.
Based on various baselines, we compare our proposed bascline+SD approach with other statc-of-the-ar adversarial training methods 1) PGD-AT (Mkadry el al., 2017), 2) AWP (Wu el al., 2020), 3) FS (Zhang & Wang, 2019). 4) SCR (Zhang et al., 2021), 5) LAS(Jia et al., 2022), 6) GAIRAT (Zhang et al., 2020c), 7) SAT (Sitawarin et al., 2021), 8) FAT (Zhang et al., 2020b), 9) LAT (Kumari al., 2019), 10) Bilateral (Wang & Zhang, 2019) and 11) RAT (Jin al., 2023). We report the results under the white-box attack in Table 2, Table 3, Table 4, and Table 5 while leaving the results of the black-box attack in Table 7.
13

---

Published in Transactions on Machine Learning Research (12/2024)
6.2 Robustness Against Adversarial Examples
Our results reveal that SD can improve the robustness of different, baselines against. attacks various datasets. Even for more complex datasets such as "iny-imagine, SD still has significant effect compared with baselines. Tables 2-5 summarize the robust accuracy of different methods under various adversarial attacks across CIFAR-10, CIFAR-100, Tiny-ImageNet and SVHN datasets. Our method, SD, consistently achieves superior performance, improving both accuracy and robustness across all datasets and attack types. Notably, SD demonstrates significant improvements over baseline methods, particularly in challenging scenarios such as the PGD and C&W attacks. These results highlight the effectiveness of SD in enhancing model robustness, making it reliable solution for adversarial defense.
Table 4: Accuracy under white-bax attack on Tiny- Eny-lmmgenet (e 8).
Method
Clean
PGD20
PGD50
C&W
AA
PGD-AT
41.98
20.43
19.98
17.60
13.78
AWP
41.48
22.79
22.51
19.02
17.34
PGD-AT+LAS
44.86
22.29
22.16
18.54
16.74
AWP-LAS
45.26
23.77
23.42
19.88
18.42
PGD-AT+SD
44.27 + 0.13
23.15 + 0.21
22.97 + 0.18
18.59 = 0.19
16.79 + 0.17
AWP-SD
45.59 = 0.11
23.91 = 0.16
23.49 = 0.19
20.07 + 0.15
18.81 + 0.14
Table 5: Accuracy under white-box attacks on SVHN (e = 8).
Models
Clean
PGD20
PGD100
C& W
Standard
97.20
0.30
0.10
0.30
PGD-AT
93.90
47.90
46.00
48.70
LAT
91.65
60.23
59.97
Bilateral
94.10
53.90
50.30
FS
96.20
62.90
52.00
61.30
FS+SCR
96.60
70.24
60.72
64.42
FS+SD
97.10 + 0.27
74.15 + 0.22
66.57 + 0.19
65.91 +: 0.22
6.3 Results FS Baseline Compared with SCR
Since SCR based on the FS baseline, we added an extra section compare SCR and SD specifically based the FS baseline. Table presents the performance of different methods based the FS baseline CIFAR-10, CIFAR-100 and SVHN. Notably, the results marked with asterisk (*) cited from (Nascer et al., 2022). On CIFAR-10, SD performs worse than SCR against certain attacks, such as PGD20. However, on CIFAR-100 and SVHN, SD comprehensively outperforms SCR. We demonstrated improved robust accuracy with SD compared to SCR across nearly all baselines, datasets, and attack types.
Table 6: Accuracy under white-box altack on FS baseline with Wider (e = 8).
Dataset Method
Clean
PGD-20
PGD-100
C&WW
AA
FS
90.00
70.50
68.60
62.40
36.64
CIFAR-10
FS+SCR
92.70
76.45
67.79
75.42
35.81
FS+SD
91.91 + 0.14
72.33 + 0.18
71.85
0.22
68.66 + 0.19
37.85 + 0.16
FS
73.90
47.20
46.20
34.60
0.00"
CIFAR-100
FS+SCR
74.20
48.87
47.34
38.90
FS+SD
74.55 + 0.12
51.03 + 0.17
49.57
0.16
41.53 0.19
4.77 + 0.14
FS
96.20
62.90
52.00
61.30
25.26
SVHN
FS+SCR
96.60
70.24
60.72
64.62
FS+SD
97.10 + 0.11
74.15 + 0.15
66.57 + 0.19
65.91 + 0.20
33.51 + 0.17
14

---

Published in Transactions on Machine Learning Research (12/2024)
6.4 Results Different Attack Budget
Figures 7 and 8 illustrate the effectiveness of SD, our proposed method, in improving model robustness under both PGD20 and CW attacks for CIFAR-10 and CIFAR-100 datasets. Across all attack budgets, models incorporating SD show a more gradual decline accuracy, particularly for PGD-AT+SD, The incorporation of SD enhances the resilience of both PGD-AT and TRADES, with PGD-AT+SD demonstrating the most significant improvement, especially the attack budget increases. This suggests that SD effectively promotes robustness by maintaining higher accuracy under stronger attack conditions.
70
70
PGD-AT
PGD-AT
PGD-AT+SD
Ac Accure Gap (%)
65
TRADES
65
TRADES
60
TRADES+5D
60
TRADES+5D
55
55
50
50
45
45
40
40
35
35
30
30
25
25
4
8
12
16
4
8
12
16
Attack Budget (E)
Attack Budget (E)
(a) CIFAR-10 w/ PGD20
(b) CIFAR-10 w/ CW
Figure 7: Accuracy vs. different attack budget for CIFAR-10 under PGD20 and CW attacks.
43
43
PGD-AI
PGD-AT+SD
PGD-AT+SD
38
TRADES
38
TRADES
TRDDES+5D
Accuracy [6)
TRADES
Accuraty
33
33
28
28
23
23
18
18
13
13
4
8
12
16
4
8
12
16
Attack Budget (E)
Attack Budget (s)
(a) CIFAR-10 w/ PGD20
(b) CIFAR-10 w/ CW
Figure 8: Accuracy vs. different attack budget for CIFAR-100 under PGD20 and CW attacks.
6.5 Results on Black-Bor Attack
Table 7 presents the robust accuracies under black-box attacks three datasets, including CIFAR-10. CIFAR-100, and Imay-lma Here, since the compared methods evaluated by using different back- boncs in original papers, it is difficult to compare the results of black-box attacks directly. To ensure fair comparison, we retrain all compared methods by leveraging the WiderResNee--34110 (WRN34) as the unified backbone and maintaining their original training parameter. We implement two black-box attacks FAB and SQUARE belonging Autoattack. By consistently outperforming other methods, particularly under black-box attacks, SD proves to be a robust and reliable defence mechanism. The significant improvements in accuracy across CIFAR-10, CIFAR-100, and Tiny-ImageNet confirm that SD offers superior protection.
15

---

Published in Transactions on Machine Learning Research (12/2024)
Table Accuracy under transfer-basel black- box attack on various datasets (e 8).
CIFAR-10
CIFAR-100
Tiny- Imageet
Method
AAFaB
AASQUARE
AAPAB
AASQUARE
AAPAB
AASQUARE
AWP
60.51
61.28
30.97
35.88
17.19
22.91
AWP+LAS
62.41
63.39
31.20
37.29
17.82
24.42
AWP+RAT
61.75
63.25
30.09
36.10
18.16
22.98
AWP+SCR
62.01
62.29
31.10
35.49
17.52
23.61
AWP+SD
63.02 0.15
63.88 0.18
31.72 + 0.19
37.90 +: 0.16
17.73 + 0.12
24.49 0.14
6.6 Generalization Analysis
Figures 5c and 5d illustrate the robust accuracy gap under C&W and PGD20 between training and test datascts CIFAR-10. We present VDWS, for both the FS and FS+SD. Notably, Figures 5c and 5d highlight that FS+SD achieves smaller accuracy gap and greater VDWS, in comparison to FS. FS+SD consistently maintains superior VDWS, throughout the convergence process and exhibits reduced accuracy gap. This observation underscores SD's role in diminishing the accuracy gap and enhancing robust generalization by emphasizing the volume difference between the entire space and the summation of subspaces.
Figures 9a and 9b illustrate a comparison of RG results obtained through optimization using the SD regular- ization term versus the SCR regularization term. We use PGD-AT as baseline and attacks are PGD20 and C&W, respectively. is evident that using the SD regularization term results in a smaller RG compared the SCR regularization term. The reason that compared SCR, SD not only constrains the inter-sample relationship variations within the same class but also decrcases the inter-class similarity. The outcomes validale that SD can achieve better RG compared with SCR term.
0.25
SCR
0.25
SCR
Accuracy Gap
0.20
Accuracy Gap
0.20
0.15
0.15
0.10
0.10
180
Epoch
Epoch
(a) PGD20
(b) C&W
Figure 9: RG with PGD-AT+SD and PGD-AT+SCR CIFAR-100 under (a) PGD20 and (b) C&W. All
methods are trained by using 11 as backbone.
6.7 Meta-Analysis
In this subsection, present meta-analysis comparing the performance of different adversarial training methods and our SD regularization term, focusing robust accuracy under PGD20 attack across CIFAR10 and CIFAR100. To rigorously quantify the differences in performance, we employed two statistical measures: Cohen's d effect size and t-test. Cohen's measures the effect size, which quantifies the magnitude of the improvement robust accuracy when SD is added. t-test assess whether the differences in robust accuracy between methods with and without SD are statistically significant. This combined approach helps us evaluate both how much SD improves robustness and whether these improvements consistent. across datasets.
16

---

Published in Transactions on Machine Learning Research (12/2024)
Erelikes Frankes
Erankar Frankyt sD
55
50
Frank
Erank
50
45
120
140
160
200
140
160
180
200
Epoch
Epoch
(a) FS baseline
(b) AT baseline
Figure 10: Erank values under PGD20 attacks from the CIFAR-100 dataset.
Table 8: Robust accuracy of different baselines on various datasets under PGD-20 attacks.
Method
CIFAR-10
CIFAR-100
PGD-AT
55.08
31.69
AWP
58.13
33.86
TRADES
56.10
28.66
PGD-AT SD
58.93
33.19
AWP + SD
61.59
36.59
TRADES SD
58.79
33.79
Table 9: Cohen's d for AWP vs. AWP + SD across datasets and t-test results for PGD-AT vs. PGD-AT + SD
Dataset
Cohen's d (AWP vs. AWP + SD) t-test (PGD-AT vs. PGD-AT + SD) p < 0.05
CIFAR-10
0.78
CIFAR-100
0.65
p 0.03
The results in Table show that SD regularization significantly improves robust accuracy when combined with adversarial training methods. In Table 9, Cohen's values confirm moderate to large effects across two datasets, indicating meaningful impact. In conclusion, SD enhances both the generalization and robustness of adversarial training, making it valuable addition to defenses against adversarial attacks.
6.8 Diversity Analysis
According to the definition given in Equation 7, an increase in the total unique vector numbers reflects greater feature representation diversity. However, the computation of unique eigenvector numbers poses a challenging task. To facilitate direct measurement of the diversity within the spanned space S, we utilize a widely adopted evaluation metric, effective rank, denoted as Erank. can be mathematically represented as:
L pilog (p:) (p:)) Pt ||ll
Erank(S) erp Σ
(11)
where or denote the 1-th element in an eigenvalue set a = {ai,.... ......, or.} of the spanned space S. ||a]a represents the LI norm of a, and pr is the normalized eigenvalue. The larger Erank represents the better diversity for feature representation. When the values of Erank reach maximum, the determinant of S (i.e. det(S)= = I'' az) also reach maximum. Following the above analysis, we can conclude that there is positive relationship between VDWS and Frank. Increasing the VDWS corresponds to enlargement of
17

---

Published in Transactions on Machine Learning Research (12/2024)
Erank. Meanwhile, Figure 10 also validates this statement. Figures 10a and 10b illustrate that SD enhances Frank values of both FS and AT under PGD20 attacks to enhance feature diversity.
6.9 Sensitivity Analysis
We examine the parameter sensitivity of and À CIEAR-10 in Figure 11. In Figure 11a, observe that the effect of the shirnk term is greater than that of the expand term since the ratio of the expand term is 7) Figure 1lb shows that our method is less sensitive to X as the fluetuation is only around 2.5%.
PGD20
PGD20
C&WW
C&W
58
58
Accuary
Accuary
56
56
54
54
52
0.0
02
0.4
0.6
0.8
1.0
0.2
04
0.6
0.8
1.0
(a) 7
(b) A
Figure 11: Parameter scnsitivity for y and À on CIFAR-10, where all models trained by AT+SD.
Conclusion
In this paper, we investigate the robust generalization (RG) problem from the perspective of learning dis- criminative representation for adversarial examples. Our theoretical and empirical analysis illustrate that roducing the inconsistency of inter-sample relationship maps between clean data and adversarial examples is feasible approach to alleviate robust overfituing and can be calculated by the proposed Gram malrix difference (GMD). Meanwhile, we provide a theoretical guarantee for RG by introducing novel and tight crror bound based on our GMD. Morcover, to case the complex optimization inter-sample relationship maps, we propose a method that expands the volume difference between the entire latent space's linear span and the subspace's linear span, thereby creating a diverging spanned latent space. On the empirical side, we design and implement an adversarial training method, called Subspace Diverging (SD), which alleviates the robust overfitting problem and achieves state-of-the-ae the-rrrtt performance multiple benchmarks.
Acknowledgement
The work partially supported by the following: National Natural Science Foundation of China un- der No. 92370119 and 62376113, the WKU Internal (Faculty/Staff) Start-up Research Grant under No. ISRG2024009.
References
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of sccurity: Circunventing defenses to adversarial examples. In International conference on machine learning, pp. 273-283. PMLR, 2018. 4
Olivier Bousquet and André Elisseeff. Stability and generalization. The Journal of Machine Learning Research, 2:499-500 526, 2002.
Stephen P Boyd and Lieven Vandenberghe. Conver oplimization. Cambridge university press, 2004. 27
18

---

Published in Transactions on Machine Learning Research (12/2024)
Anh Bui, Trung Le, He Zhao, Paul Montague, Olivier deVel, Tamas Abraham, and Dinh Phung. Improving adversarial robustness by enforcing local and global compactness. In European Conference on Compuler Vision, pp. 209 223. Springer, 2020. 3,
Qi-Zhi Cai, Min Du, Chang Liu, and Dawn Song. Curriculum adversarial training. arXiv preprint 1r0:: 048018800044777 2018.
N. Carlini and D. Wagner. Towards evaluating the robustness of neural networks. in 2017 ieee symposium security and privacy (sp). in 2017 IEFE Symposium on Security and Privacy (SP), pp., pp- 39 57, 2017. 2, 4
Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C Duchi, and Percy S Liang. Unlabeled data improves adversarial robustness. Advances in Neural Information Processing Systems, 32, 2019.
Kwan Ho Ryan Chan, Yaodong Yu, Chong You, Haozhi Qi, John Wright, and Yi Ma. Redunet: A white-box deep network from the principle of maximizing rate reduction. Journal of Machine Learning Research, 23 (114):1-103, 2022. 5,
De Cheng, Yihong Gong, Sanping Zhou, Jinjun Wang, and Nanning Zheng. Person re-identification by parts- based enn with improved triplet loss function. In Proceedings of the iEEE conference on computer vision and pottern recognition, pp. 1335-1344, 2016a. 5
De Cheng, Yihong Gong, Sanping Zhou, Jinjun Wang, and Nanning Zheng, Person re-identification by multi-channel parts- parts-based enn with improved triplet loss function. Proceedings of the IEEE conference on computer vision and paleen recognition, pp. 1335 1344, 2016b. 5
Sumit Chopra, Raia Hadsell, and Yann LeCun. Learning a similarity metric discriminatively, with applica- tion to face verification. In 2005 IEEE Computer Society Conference Computer Vision and Pattern Recognition (CVPR'05) volume 1, pp. 539-546. IEEE, 2005. 5
Rudi Cilibrasi and Paul MB Vitányi. Clustering by compression. IEEE Transactions on Information theory, 51(4):1523- -5445 2005.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. international conference on machine learning, pp. 1310 1320. PMLR, 2019.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning, pp. 2206 2216. PMT.R, 2020. 2
Volker Fischer, Mummadi Chaithanya Kumar, Jan Hendrik Metzen, and Thomas Brox. Adversarial examples for semantic image sogmentation. arXiv preprint arXiv: 703.010.11001 703001101, 2017. 2
Zhiqiang Gao, Shufei Zhang, Kaizhu Huang, Qiufeng Wang, Rui Zhang, and Chaoliang Zhong. Certify- ing better robust generalization for unsupervised domain adaptation. In Proceedings of the 30th ACM International Conference on Multimedia, pp. 2399 2410, 2022. 2
lan Goodfellow, Jonathon Shlens, and Christian Szegedy, Explaining and harnessing adversarial examples. Confeeere 3rd International Conference on Learning Representations, Conference Track Proceedings, 2015. 4
Shixiang Gu and Luca Rigazio. 3rd International Conference on Learning Representations, Workshop Track Proceedings, 2015. 2
Raia Hadsell, Sumit. Chopra, and Yann LeCun. Dimensionality reduction by learning an invariant mapping. 2006 IEEE Computer Society Conference on Computer Vision and Pattern Recognition, volume 2, pp. 1735 1742. IEEE, 2006.
K. He, X. Zhang, S. Ren, and Sun. Deep residual learning for image recognition. In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2016.
19

---

Published in Transactions on Machine Learning Research (12/2024)
Junlin Hu, Jiwen Lu, and Yap- Peng Tan. Discriminative deep metric learning for face verification in the wild. In Proceedings of the IEFE conference on compuler vision and pallern recognilion, pp. 1875-1882, 2014. 5
Kaizhu Huang, Zenglin Xu, Rong Jin, Trwin King, and R. Michael Lyu. Robust metric learning by smooth optimization. Proceedings of the Suenty-Siath Conference on Uncertainty in Artificial Intelligence, 2010.
5
Xiaojun Jia, Yong Zhang, Baoyuan Wu, Ke Ma, Jue Wang, and Xiaochun Cao. Las-at: Adversarial training with learnable attack strategy. Conference Computer Vision and Pattern Recognition, 2022. 2, 4, 12, 13
Gaojie Jin, Xinping Yi, Dengyu Wu, Ronghui Mu, and Xiaowei Huang. Randomized adversarial training via taylor expansion. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 16447 16457, 2023. 4, 13
Harini Kannan, Alexey Kurakin, and Ian Goodfellow. Adversarial arXiv:1803. 003333,,.33.... 2018. 2
logit pairing. arXiv preprint
Nupur Kumari, Mayank Singh, Abhishek Sinha, Harshitha Machiraju, Balaji Krishnamurthy, and Vinceth N Balasubramanian. Harnessing the vulnerability of latent layers in adversarially trained models. In Pro- ceedings of the 28th International Joint Conference on Artificial Intelligence, pp. 3779-2785, 2019. 13
A. Kurakin, I. Goodfellow, and Bengio. Adversarial machine learning at scale. 5th International Conference on Learning Representations, Conference Track Proceedings, 2016.
Yann LeCun, Yoshua Bengio, and Geoffrey Hinton. Deep learning. nature, 521 (2553):) :436533))33--)) 444, 2015.
Sachyung Lee, Hyungyu Lee, and Sungroh Yoon. Adversarial vertex mixup: Toward better adversarially robust generalization. In Proceedings of the TEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 272 281, 2020.
José Lezama, Qiang Qiu, Pablo Musé, and Guillermo Sapiro. Ole: Orthogonal low-rank embedding-a plug and play geometric loss for deep learning. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 1109-8118, 2018. 5
Binghui Li, Jikai Jin, Han Zhong, John Hopcroft, and Liwei Wang. Why robust generalization in deep learning is difficult: Perspective of expressive power. Advances in Neural Information Processing Systems, 35:4370 4384, 2022a. 4
Pengcheng Li, Jinfeng Yi, Bowen Zhou, and Lijun Zhang. Improving the robustness of deep neural networks via adversarial training with triplet loss. arXiv preprint arXi:: 2019. 3,
Tao Li, Yingwen Wu, Sizhe Chen, Kun Fang, and Xiaolin Huang. Subspace adversarial training. In Pro- ceedings of the IEEE/CVE Conference on Compuler Vision and Potlern Recognition, pp. 13409 13418, 2022b.
Weiyang Liu, Rongmei Lin, Zhen Liu, Lixin Liu, Zhiding Yu, Bo Dai, and Le Song. Learning towards minimum hyperspherical energy. Advances in neural information processing systems, 31, 2018, 3, 9
Yufei Liu, Yuan Zhou, Xin Liu, Fang Dong, Chang Wang, and Zihong Wang. Wasserstein gan-based small- sample augmentation for new-generation artificial intelligence: a case study of cancer-staging data in biology. Engineering, 5(1):156-163, 2019.
Chunchun Lyu, Kaizhu Huang, and Hai-Ning Liang. A unified gradient regularization family for adversarial examples. 2015 IEFE international conference date mining, pp. 301-309, 2015. 2
Yi Ma, Harm Derksen, Wei Hong, and John Wright. Segmentation of multivariate mixed data via. lossy data coding and compression. IEEE transactions on pattern analysis and machine intelligence, 29(9): 1546-1562 2007.
20

---

Published in Transactions on Machine Learning Research (12/2024)
Chengzhi Mao, Ziyuan Zhong, Junfeng Yang, Carl Vondrick, and Baishakhi Ray. Metric learning for adver- sarial robustness. Advances in Neural Information. Processing Systems, 32, 2019.
Takeru Miyato, Shin-Ichi Maeda, Masanori Koyama, and Shin Ishii. Virtual adversarial training: A regular- ization method for supervised and semi-supervised learning. IEFE Transactions on Pattern Analysis and Machine Intelligence, 41(8):1979-199) 1993, 2019. doi: N0.1109/TPAMI.200 2888888881....
Aleksander Mkadry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. 6th International Conference on Learning Repre- sentations, 1050:9, 2017. 2, 12, 13
Muzammal Nascer, Salman Khan, Fatih Porikli, and Fahad Shahbaz Khan. Guidance through surrogate: Toward generic diagnostic attack. IEEE Transactions on Neural Networks and Learning Systems, 2022. 12, 14
Behnam Neyshabur, Srinadh Bhojanapalli, David McAllester, and Nati Srebro. Exploring generalization in deep learning. Advances in newral information processing systems, 30, 2017. 5
S. Nowozin, B. Cseke, and R. f-gan Tomioka. Training generative neural samplers using variational divergence minimization. in advances in neural information processing systems, pp. pp. 271-279, 2016.
D. W. Otter, J. R. Medina, and J. K. Kalita, A survey of the usages of deep lcarning for natural language processing. IEEE Transactions on Neural Networks and Learning Systems, 2020.
Tianyu Pang, Kun Xu, Yinpeng Dong, Chao Du, Ning Chen, and Jun Zhu. Rethinking softmax cross-entropy loss for adversarial robustness. arXiv preprint 1rXis:1905.10622 2019a.
Tianyu Pang, Kun Xu, Chao Du, Ning Chen, and Jun Zhu. Improving ad adversarial robustness via promoting ensemble diversity. In International Conference on Machine Learning, pp. 4970 4979. PMLR, 2019b.
Zhuang Qian, Shufei Zhang, Kaizhu Huang, Qiufeng Wang, Xinping Yi, Bin Gu, and Huan Xiong. Pertur- bation diversity certificates robust generalization. Newral Networks, 172:106117, 2024.
Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in adversarially robust deep learning, In International Conference on Machine Learning, pp.
PMLR, 2020. 2
Kevin Roth, Yannic Kilcher, and Thomas Hofmann. Adversarial training is a form of data detandependent operator norm rogularization. Advances in Neural Information Processing Systems, 33:14973- 14985, 2020.
Olivier Roy and Martin Vetterli. The effective rank: A measure of effective dimensionality. In 2007 15th European Signal Processing Conference, pp. 606-610, 2007.
L. Schmidt, S. Santurkar, D. Tsipras, K. Talwar, and A. Madry. Adversarially robust genoralization requires more data. advances in neural information processing systems, pp- pp. 5014 5026,, 2018a.
Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry, Adversarially robust generalization requires more data. Advances in neural information processing systems, 31, 2018b. 2,
Florian Schroff, Dmitry Kalenichenko, and James Philbin. Facenet: A unified embedding for face recognition and clustering. Proceedings of the IEEE conference on computer vision and pottern recognition, pp. 815- 823, 2015.
Vasu Singla, Sahil Singla, Soheil Feizi, and David Jacobs. Low curvature activations reduce overfitting in adversarial training. In Proceedings of the IEEE/ IEEE/CVF International Conference on Computer Vision, pp. 16423-16433 2021. 2
Aman Sinha, Hongsook Namkoong, Riccardo Volpi, and John Duchi. Certifying some distributional robust- ness with principled adversarial training. ar preprint arxi 1700. 10571, 2017.
21

---

Published in Transactions on Machine Learning Research (12/2024)
Chawin Sitawarin, Supriyo Chakraborty, and David Wagner. Sat Improving adversarial training via curriculum-based loss smoothing. In Proceedings of the 14th ACM Workshop on Artificial Intelligence and Security, pp. 25 36, 2021. 13
Chuanbiao Song, Kun He, Jiadong Lin, Liwei Wang, and John E Hopcroft. Robust local features for improv- ing the gencralization of adversarial training. th International Conference Learning Representations, 2019.
Dawn Song, Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Florian Tramer, Atul Prakash, and Tadayoshi Kohno. Physical adversarial examples for object detectors. 12th USENIX Workshop Offensive Technologies (WOOT 18), August 2018. 2
Ralf C Staudemeyer and Eric Rothstein Morris. Understanding Istm a tutorial into long short-term memory recurrent neural networks. arXiv preprint Xrxiv:1909. 00586, 2019.
David Stutz, Matthias Hein, and Bernt Schiele. Relating adversarially robust generalization to flat minima.
In Proceedings of the IEEE/CVE International Conference on Compuler Vision, pp. 7807 7817, 2021. 2
Jianhui Sun, Sanchit Sinha, and Aidong Zhang. Enhance diffusion to improve robust gencralization. arXiv preprint ar Xtx:22300 02618, 2023. 2,
Sun, Yuheng Chen, Xiaogang Wang, and Xiaoou Tang. Deep learning face representation by joint cenntifcaation-veriiaattttt volume 27, 2014. 5
Christian Szegedy, Alexander Toshev, and Dumitru Erhan. Deep neural networks for object detection.
Advances in neural information processing systems, 26, 2013.
Mingxing Tan, Ruoming Pang, and Quoe V Le. Efficientdet: Scalable and efficient object detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 10781-10790, 2020.
Loring W Tu. Manifolds. In An Introduction to Monifolds, pp. 47 83. Springer, 2011.
Hongjun Wang and Yisen Wang. Self-ensemble adversarial training for improved robustness. arXie preprint arXiv:2208.000 096778 2022.
J. Wang and H. Bilateral adversarial training Zhang, Towards fast training of more robust models against adversarial attacks. In Proceedings of the IEEE International Conference on Computer Vision, 2019. 2, 13
Zeming Wei, Yifei Wang, Yiwen Guo, and Yisen Wang. Cla: Class-wise calibrated fair adversarial training. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 8193 8201, 2023. 4
Jon Wellner Weak convergence and empirical processes: with applications to stafistics. Springer Science & Business Media, 2013. 24
Yandong Wen, Kaipeng Zhang, Zhifeng Li, and Yu Qiao. A discriminative feature learning approach for deep face recognition. In Computer Vision Vision-ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11 11-14, 2016, Proceedings, Part VII 14, pp. 499-515. Springer, 2016.
Dongxian Wu, Shu-Tar Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization.
Advances in Newral Information Processing Systems, 33:2958-222 24225882999, 2020. 2, 4, 12, 13
Huan Xu and Shie Mannor. Robustness and generalization. The 23rd Conference Learning Theory, 86 (3):391 423, 2012. 5, 10
Yang, Cyrus Rashtchian, Hongyang Zhang, Russ R Salakhutdinov, and Kamalika Chaudhuri. A closer look accuracy vs. robustness. Advonces in neural information processing systems, 33:8588-8601 2020.
22

---

Published in Transactions on Machine Learning Research (12/2024)
Mingyang Yi, Lu Hou, Jiacheng Sun, Lifeng Shang, Xin Jiang, Qun Liu, and Zhiming Ma. Improved ood generalization via adversarial training and pretraing. In International Conference on Machine Learning, pp. 119977 PMLR, 2021.
D. Yin, R. Kamnan, and P. Bartlett. Rademacher complexity for adversarially robust generalization. in international conference machine learning, pp. pp. 7085-7094, 2019.
Saeideh Yousefzadeh, Hamidreza Pourreza, and Hamidreza Mahyar. A triplet-loss dilated residual network for high-resolution representation learning in image retrieval. Journal of Signal Processing Systems, pp. 1-13, 2023. 5
Yaodong Yu, Kwan Ho Ryan Chan, Chong You, Chaobing Song, and Yi Ma. Learning diverse and discrimi- native representations via the principle maximal coding rate reduction. Advances in Neural Information Processing Systems, 13:0422-9434, 2020. 5,
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. CoRR, abs/ abs/1605.07146, 2016.
URL
http://arxiv.ort org/ abaaaaaaaaaa 1605.666...0 1605.07146.
Runtian Zhai, Tianle Cai, Di Hc, Chen Dan, Kun He, John Hopcroft, and Liwci Wang. Adversarially robust generalization just requires more unlabeled data. Advances in Neural Information Processing Systems, 2019.
Haichao Zhang and Jianyu Wang. Defense against adversarial attacks using feature scattering- based adver- sarial training. Advances in Newral Information Processing Systems, 32, 2019. 2, 3, 4, 12, 13
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan, Theoreti- cally principled trade-off between robustness and accuracy. pp. 7472 7482. PMLR, 2019. 2, 4, 12
Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankanhalli. Attacks which do not kill training make adversarial learning stronger. In International conference on machine learning, pp. 11278 11287. PMLR, 2020a. 4
Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankanhalli. Attacks which do not kill training make adversarial learning stronger. In International conference machine learning, pp. 11278 11287. PMLR, 2020b. 13
Jingfeng Zhang, Jianing Zhu, Gang NIu, Bo Han, Masashi Sugiyama, and Mohan Kankanhalli. Geometry- aware instance-roweighheed adversarial training. arXiv preprint rrXi::2010.01330 2020c. 4, 13
Shufei Zhang, Kaizhu Huang, Jianke Zhu, and Yang Liu. Manifold adversarial learning. Neural Networks, 2018.
Shufci Zhang, Zhuang Qian, Kaizhu Huang, Qiufeng Wang, Rui Zhang, and Xinping Yi. Towards better robust generalization with shift consistency regularization. International Conference on Machine Learning, pp. 2354--2234 2021. 2, 3, 4, 5, 6, 10, 12, 13
Shufei Zhang, Zhuang Qian, Kaizhu Huang, Qiu-Feng Wang, Bin Gu, Huan Xiong, and Xinping Yi. Inter- feature relationship certifies robust generalization of adversarial training. International Journal of Com-
puler Vision, pp. 1 17, 2024.7 7
Long Zhao, Ting Liu, Xi Peng, and Dimitris Metaxas. Maximum-entropy adversarial data augmentation for improved generalization and robustness. Advances in Neural Information Processing Systems, 33: 14435-1444,, 2020.
Zhong- thong-Qiu Zhao, Peng Zheng, Shou-Tao Xu, and Xindong Wu. Object detection with deep learning: A review. IEFF Transactions Newral Networks and Learning Systems, 30(11):3212 3232, 2019. doi: 10.1109/INNLSS2011... 2876885..
23

---

Published in Transactions on Machine Learning Research (12/2024)
A Theory Proof
We make two assumptions to facilitate the analysis.
A Assumptions:
For the neural network fo(+), there exists Lipschitz constant for loss function ((-) such that for any æ1, 42
satisfying [ (fo(z))) vi) (x2( vo) S (x) f2(2))ll2-
For the neural network fo):); there exists a Lipschitz constant I. such that for any æ1; 22 satisfying (1fa(z1) fo fz(2))l12 S L||z] x2l12-
Proof of Theorem 3.1
Theorem 3.1 Given the clean data matrix X; and adversarial data matrix X that both contain N; samples of i-th class over the training set, the sets of clean data C₁ and adversarial data Cādv of i-th class over the underlying data distribution, and the DNN fo that maps data samples to latent features with dimension T, if the loss function I(-) of fo(.) t-Läpschitz, and fol.) the I--Lipschitz, then for any a > O, with the probability at least 0, we have
tt²
2K 122 2lm (1)
ERGE S EGE +
VTall2 + +KV
VT tCHL +
N
N
where
VTa Tod
Té.
VT-
Tado -T
N
K
=
V
E [fo( x Cilll,
N n=1
K
K2 +1
C 2(N
H = =uuuplloocrj Sopp]oo(>>>2
2
is adversarial perturbation and M is the upper bound of the loss function 1(+) over the whole underlying data manifold. VTa and VT denote the Gram matrix difference over the training set and the underlying data distribution respeclively,
(Zado) T Zudu (Z1) Zi
(Zade)
Zadv K
(Z1)
Zx
2ode) Zqduo (Zx) T Z1,
(Zndv)
Zadu -(Zx)
ZK
(12)
(2qd0)² =qde (21) 211
(=dde)
zadv
(21) T 2K
VT
(20ele)
=aq00 (2x) T
21,
(2nd2)
2K
(2x) 2K
So (X,)
So (X
where
Z, life (X,) 1|2,col'
Zuddu
Zi, Zadd R
IIJo (Xadu)
1|2
x E C.] E fe (x)
aade So (x
padd E @Cudu
2s, add E R".
E So (x))
x Ci
E fo (xnddt Codu
11
11-12,,oo represents the calculation of the Euclidean norm of column veclors in the matrir.
proof: Let (I. |Nxl) is an IID multinomial random variable with parameters N. N and K denote the total number of training samples and the total number of classes respectively. With the probability dis- following Breteganolle-Huun Huber- tribution set for the underlying classes {μ(C1), ((C2), ..., (.C.),....
Carel incquality (Proposition A6.6 of (Wellner et al., 2013)):
K Pr
|N
2N
-m(CC) 2 A} < 2 eap(
N
2
1=
24

---

Published in Transactions on Machine Learning Research (12/2024)
With the probability least - 8, can get:
N
2K In + 21n (1)
u(C)) $V
N
1 =x= E 1 (fo(z
Σ l (fo(zed)) Un)
ERGE
N
==1
Σ E (fo(z"d)))))) E ((C))
Σ (fol2gd)))
N
E (fo(cedd)) |xEC| B((((( - Cill((C))
(Fo(oat)))))) -I(fo(zm), Mn) +
((
K
N
Σ (((((()))))) 1 (CC 1
Σ ((o(an): + N
E (Jo(sdd)))))) 1 E
E (fo(z),)) x CEC(((C)
(Fo(aad)) ), -I
K
E (foo ( (((((()))))))) x E ((C:)- Σ (ffo(znd"..v)) ) (fo(2n).
EGE +
N
|M
E - c.]
N
N
Σ ( - x E
C.]]
N
< EGE Σ E [ (Jo(z x c - ((((((()))))) E Ccl:lllaC
Σ
[ (fo(aad)) x E C.]
N1
(l((f((z).v) v) x Cill
N
N
K N
Σ R=1
( v, - ((o(T
Σ
E (Jo(z - ((((())) - | xEc]]]
+
N
N
1=1
sup (aadd) as M, where X represents the distribution of adversarial gade e Xadu examples corresponding to the underlying data distribution. Therefore, we can get
We define the loss upper bound
K
N [ (Jo(xad)) ), - (Solzn), v.)]
N
$ SEGB +
Σ
E [ (Jo( - (fo()),)) EEC
N
N
|Nol N
M
(p(C.)
25

---

Published in Transactions on Machine Learning Research (12/2024)
Given that {[N is multinomial random variable with parameter N, we apply the Bretagnolle- Huber-- Carel inequality to obtain:
K
[
< EGE
Σ
E
(Fo(wadu),)) -1 (fo()))
[
(So(ua))) ((o((T))
N
i=1
2K In 2 + 21n (1)
M
N
2K In + 2In (1)
< EGE
Σ
fo
[Nd
Σ E
[ fo(x)))l22 c.]
+ M
N
K
N E [ xE Co. + +M- +M-
2K + 2 21n (
EGG
ll - fo(xx))l2
N
Let fo(Xa) E R x and fo( E R2* K denote the training and underlying feature matrix respectively,
where fo(X.) [ [f(]] æ E Ci and fo (Xadd) BTxN and fo (Xade) R denote the corre- sponding adversarial feature sets. Then, since [N;] < N, we can deduce that
2K In 2 + 21n (:)
< EGE
life (x - fo (Xa) 1l2 Kt [fe(X - E (f(x))) M
N
N
Il.fe (xalt) fo (Xx) 1le fe (x )²
[ff (X (x)) lll - [fo (x life (Xa)) 112
EGE
+ Kt
||E [fo (xxd"))
[[fo(X ) 1l2 + | [[ ade
)11² )11
[[o(X.)]1]] lll - |E [ 1
[io l12
2K In 2ln (+)
+ M
N
[X [fo 1l2 KI| [o [ x E [fo(
< EGE
N [Ilfo(Xxd") fo (Xp) 1l2 (I1fo(Xx + fe (XD) 212 1)]
KI [|LE [fo(Xade) [So (X la (I [fo(X + EE [So (X,)] 1)]
2K In + 21n (!)
M
H is defined as supli/ If (x) which, together with the assumption, we can gain:
K²
< EGE
[o )
) 2 - [fo(Xx)]] 112 Kt| [fo(X
E [ff
21(
K
HL
2
2K In 2 + 21n (1)
+
N
f
K2 +1
2K In 2ln (1)
= EGE
(Tude
Ta) 112++1 (Tade - T) 112 + 2t + K
HL||0||2 + +M
N
2
N
tU2
K2 +1
2K In 2 2 (t)
= EGE
|Taal2 + + + 21NN+ K
HL|001122 + M
N
2
N
26

---

Published in Transactions on Machine Learning Research (12/2024)
Proof of Theorem 3.2
Theorem 3.2 Let S be the span of the latent space, encompussing all subspaces {S:) C S. Let I denole the identity matria. Then,
If Vol(S) is marimized, all subspaces S, C S are mutually independent, If Vol(I + S:) minimized, the vectors in S₁ remain consistent.
(13)
Proof:
To establish the proof, we initially introduce the log det(..) function, leveraging concavity as detailed (Boyd & Vandenberghe, 2004).Since log det(I + S) log det(I + Z Z) holds for feature representations, this equivalence enables the following results:
max
log det(S) + max log det [I 2 Z).
(14)
z
Z denote the normalized feature matrix of fo(X), where Z = =Zit Zi represents the feature represen- lation matrix for the i-th class.
First, we prove that max log (S) can achieve all subspace independent.
Z
We define the matrix D as:
D I
(15)
The expression D be written
2 Z1
Z Z2
Z, Z1
Z Z2
ZR
D=I+
2 Z1
Z
Z2
z 2
Furthermore, we define D* as:
2 2 0
0
0
Z Z2
D*=14
2 Z
Consider D in which all subspaces are independent. If the volume of D (i.e., det(D")) is greater than that of D (i.e., (et(D)), then theorem be established. We assume that D is non-singular matrix and denote D as the transpose matrix of D. Because the strict concavity of letdet(-), can get the relationship as follow:
log det (D) log det (D*) < (Vlog det (D*), D D*).
(16)
From (Boyd & Vandenberghe, 2004), we can get that Vlog (D') D In addition, due to D=-1_ (D*-1) T the right hand side (RHS) of Equation 16 can be shown
D
= =(D" (D -D-D")) DD))
= -((D'1), D) - -(DD-1), D*)
27

---

Published in Transactions on Machine Learning Research (12/2024)
We set the matrix (D--1) D G
= tr(G) - tr(1)
N N
0.
The matrix G can be represented follows:
(I+ Z1) z,
(I+ -1 (I+ Zi
0
G=
(T 2g 21) -1 (T 2 Z1)
(T+ 2. Zk)
where 0 are the irrelevant mumbers with the process of calculating trace. Thus, when the volume of the latent span (*) reaches its maximum value, each subspace is independent of each other.
Then we proceed to prove that Vol(I + Si) is minimized, then the vectors within S remain consistent. The same theory as above, the relationship is also satisfied:
min log det (I S:) > min log det + Z; Zi),
Zi),
(17)
2.
where Z, E RTx is i-th class feature matrix, which includes T samples, and Z, [2.ll- In addition,
det + Z, Z,) and log det( z Z.) share the same trends. The matrix I+ Z, Z₁ can be defined as matrix Q
(Z 2b3)
(2t2 Zbr)
Q I
(18)
(Repy 24,)
(Zepr Zbr)
Consider the matrix Z Zz. Since its diagonal elements are equal to 1 and the off-diagonal elements are less than or equal to 1, it follows that det(Z; Z₁) 2 0. For any vector a, b E Z; and (a, b) = 1, det Zi" Zi) will close to minimum value of Correspondingly, log (et();)) will also reach its minimization value.
Our proof has been finished.
A.1 Indirect Comparison between SIC and GMD
For indirect comparison, we illustrate that our GMD is equivalent to lower bound (lowest value) of SCR term. As a result, using our GMD to upper bound the robust generation error will result in tighter upper bound than using SCR. Specifically, the lower bound of the SCR term is expressed as:
SCR = min
( fe(xx) - E (oo fo(xx) x C.] l12
V N:
min
Σ (fo(zcdu)) fo(wx)) N
E (a -f((z) C.] I13
NEN;
min Σ Σ (fe(oedo) fo((x)) 112 N
[o fo(x) x E C.] 112
NeN;
min ||l((x0")) -
adv
28

---

Published in Transactions on Machine Learning Research (12/2024)
When f(X(do)) f() and f(Xpt)) + f(D),, the resulting term,
- min t [x - (Xx -
provides more constrained optimization compared to SCR. This optimization encourages not only intra- class consistency, as is the case with SCR, but also improves inter-class separation, which is essential for better generalization and robustness against adversarial attacks.
For our GMD term,
min VTa +
[T = min
|| (xp()) (X() [fo(X + fo(Xx)] 12
0
+ [fo fo(()) [fo (X + fo(x)) l1a]
it also encourages both f(x + f(X)) and f(Xade) + f(X).
Based on the above analysis, the optimization of GMD is tighter and more constrained approach compared to SCR.
29


Reviews:
[{"review_id": "dd2E44LmCV", "reviewer": "Reviewer_GQUJ", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "## Strengths\n- Novel and interesting approach to the problem of robust generalization.\n- Extensive evaluation and impressive results.\n\n## Weaknesses\n### Issues with Thm. 3.1\n*Assumptions need to be clearly stated*\n- The Lipschitz assumption needs to be explicited as it is done in the proof (and it should be used as an assumption in the proof, not kind of reintroduced)\n- $L_d$ and $L_u$ need to be defined in the theorem (or say \"They are constants $L_d$ and $L_u$ such that...\")\n- The definition of $M$ needs to be made clearer.\n\n*Proof needs to be clearer*\n- I do not understand the argument at the top of page 24 that is bowrrowed from Zhang et al. 2024 with the Lagrange mean value theorem, and it does not seem right to me.\n- I do not understand why the Breteganolle-Huber-Carel inequality is needed. The term\n$\n\\sum_{i = 1}^K (\\frac{N_i}{N} - \\mu(C_i))\n$ is always zero, isn't it?\nSame for\n$\n\\sum_{i = 1}^K (\\mu(C_i) - \\frac{e}{N})\n$.\nIn other words, this theorem is not a generalization bound, it is only relating the robust generalization to the generalization error via a decomposition of the error without any probabilistic argument.\n\n*Very similar to Thm. 3.1 in Zhang et al. 2024*\n\nThere is a lack of comparison to the results of Zhang et al. 2024. From what I understand, the main difference with Zhang 2024 is that the bound here does not only concern the training error but also the generalization error. However, the resulting additional term $\\nabla T_d$ is dismissed quite early in the paper.\n\n### Issues with Thm. 3.2\n- The statement of the theorem is not formal and as such not clear to me.\n- Its status is not very clear: in the proof approximations are used, which is fine if they are discussed and if the final result is clearly marked as approximate.\n\n### Issues with the algorithm\n- Why is Gaussian noise added in the algorithm?\n- The experimental section is very impressive. However, there are not many details: how were hyperparamters tuned? how does it compare to the tuning of the hyperparameters of the baselines? How many runs were performed? etc... Having access to the code would be helpful as well.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper studies the problem of robust generalization for representation learning.\n\n- It proves a new generalization bound for the robust generalization problem.\n\n- It links the quantities appearing in the bound to the volume of the latent spaces.\n\n- Uses this insight to propose a practical algorithm, which is evaluated on a number of datasets.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "### Minors\n- The one before last equation on page 23 is not correct. It should be a plus and not a minus between the two sums (you are implicitely using the triangular inequality when using the Lipschitz assumption).\n- Please use the correct latex commands for scalar products in the proof of Thm. 3.2.\n- In the proof of Thm. 3.2, detail why $tr(G) = N$.\n\n### Major\n- Add a discussion on the difference with Zhang et al. 2024.\n- Adress the issues with both theorems as detailed above.\n- Address the reproducibility issues.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "jNljxK4JA7", "reviewer": "Reviewer_thck", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "1. The authors give good theoretical reasoning.\n\n2. Excellent visualization makes reasoning about spatial distances convincing.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "In this paper, an algorithm to enhance robust generalization is provided. The authors introduced the Gram matrix difference as a regularization term to tighten the upper bound on the error. The authors utilized the Subspace Diverging method for adversarial training to extend the difference between the current span of the potential space and the subspace. The authors then demonstrate experimentally that their method improves relative to the baseline.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "The experimental part of the paper is not sufficient and some of the results are not advanced enough.\n\n1. The limited effectiveness of the authors' method under AA casts doubt on the effectiveness of this method under complex attacks. It is hoped that the authors can conduct experiments for more complex attacks.\n\n2. The authors need more ablation experiments to demonstrate the effectiveness of their method at different attack intensities.\n\n3. The authors' design for the experimental hyperparameters in Table 1 is tricky. Hopefully, the authors can explain this in more detail, such as values other than the estimation of d,k. This would prove that the authors' method is useful and not a tricky choice of hyperparameters.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "q9fxR3ZZDL", "reviewer": "Reviewer_aW6S", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "## Strengths\n- **[S1]** The idea of intersample and intrasample similarities is intuitive.\n- **[S2]** The approach is well-motivated.\n- **[S3]** The paper gives experiments that analyze the properties of their algorithm (diversity of features, sensitivity of parameters). In my opinion validating and analyzing the proposed algorithm is more insightful than another empirical comparison.  \n\n## Weaknesses\n- **[W1]** On p.6 neglecting the GMD on the data distribution is motivated in a very heuristic way, I was not fully convinced. It would strengthen your argument if you provided some mathematical explanation or made the assumption more explicit and formalized.\n- **[W2]** The experimental section is weak. While the authors provide lots of comparison methods and apply their procedure to 3 computer vision datasets, the methodology makes the results questionable.\n  - [W2.1] There is no hint of hyperparameter selection and as the authors analyze in 6.5.4 improved results could well be due to more extensive hyperparameter selection\n  - [W2.2] The experiments seem to not be repeated, and as such, there are no standard deviations.\n  - [W2.3] No meta-analysis was done in an attempt to compare the methods rigorously over the set of dataset variations and attacks that were tested.\n- **[W3]** The inequality on the robust generalization gap is sometimes called \"tight\"; as far as I understand the result, this is not proven.\n- **[W4]** The overall paper is not polished: There are typos and stylistic errors, ie, missing axis labels, one or two-sentence sections, tables not complying with the margins, redundant descriptions of experiments, and incorrect highlighting in tables.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper uses the similarity in feature space to define and optimize a novel subspace divergence metric. They motivate their approach with theoretical arguments based on an inequality on the robust generalization gap involving differences in the class gram matrices under adversarial attacks. The paper proposes an algorithm to implement a loss term to minimize the robust generalization gap and gives numerical examples of its efficacy.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "## Rethink the methodology of the experimental section\n- **[C1]** Focus on fewer experiments and conduct them in a sound way. I.e. consistent hyperparameter tuning, statistically significant results.\n- **[C2]** The experimental section is hard to read and IMO unnecessarily wordy you can save some space and make your contribution clearer by reworking it. The experimental section right now overshadows and diminishes the conceptual results. Take, i.e., 6.2 paragraph 3 is hard to read as there is an abundance of abbreviations, and as far as I understand, there is no insight, but rather parts of table 2 spelled out in the text. A table is a good medium for comparing numbers, the text should focus on the main result and its interpretation. \n- **[C3]** While the authors mention the computational intractability of a regularizer and suggest a batch approximation, the actual computational time and memory complexities are not analyzed. Based on the selected hyperparameters it also seems like the method needs rather large batch sizes. These practical issues should be addressed. \n## Minor\n- Phrases like p.13 \"These results prove that SD can achieve better robust accuracy compared to SCR.\" Do not help in interpreting the result and are vague: can they achieve that with specific datasets or attacks, on average, ...\n- 6.5.2 \"increases the inter-class similarity\" decreases?\n- In the proof section, assumptions are made on the fly; they should be stated before or at the beginning of the theorem.\n- p.5 in the inequality for $\\epsilon_{RGE}$ there is a $\\sigma$ that should probably be a $\\delta$.", "broader_impact_concerns": "I have no concerns.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The reviewers recognized the paper's rigorous methodology and robust experiments against both mainstream and stronger adversarial attacks. They appreciated the thorough rebuttal that addressed initial concerns by clarifying theoretical aspects and expanding analyses. One minor concern raised by reviewers is the term "certifying" in the title, which they found disconnected from the content.
Decision: Accept (poster)