Title: Adversarial Self-Training Improves Robustness and Generalization for Gradual Domain Adaptation
Venue: NeurIPS 2023
Accepted: yes
Keywords: learning theory
Abstract: Gradual Domain Adaptation (GDA), in which the learner is provided with additional intermediate domains, has been theoretically and empirically studied in many contexts. Despite its vital role in security-critical scenarios, the adversarial robustness of the GDA model remains unexplored. In this paper, we adopt the effective gradual self-training method and replace vanilla self-training with adversarial self-training (AST). AST first predicts labels on the unlabeled data and then adversarially trains the model on the pseudo-labeled distribution. Intriguingly, we find that gradual AST improves not only adversarial accuracy but also clean accuracy on the target domain. We reveal that this is because adversarial training (AT) performs better than standard training when the pseudo-labels contain a portion of incorrect labels. Accordingly, we first present the generalization error bounds for gradual AST in a multiclass classification setting. We then use the optimal value of the Subset Sum Problem to bridge the standard error on a real distribution and the adversarial error on a pseudo-labeled distribution. The result indicates that AT may obtain a tighter bound than standard training on data with incorrect pseudo-labels. We further present an example of a conditional Gaussian distribution to provide more insights into why gradual AST can improve the clean accuracy for GDA.

Adversarial Self-Training Improves Robustness and Generalization for Gradual Domain Adaptation

Abstract

Gradual Domain Adaptation (GDA), in which the learner is provided with additional intermediate domains, has been theoretically and empirically studied in many contexts. Despite its vital role in security-critical scenarios, the adversarial robustness of the GDA model remains unexplored. In this paper, we adopt the effective gradual self-training method and replace vanilla self-training with adversarial self-training (AST). AST first predicts labels on the unlabeled data and then adversarially trains the model on the pseudo-labeled distribution. Intriguingly, we find that gradual AST improves not only adversarial accuracy but also clean accuracy on the target domain. We reveal that this is because adversarial training (AT) performs better than standard training when the pseudo-labels contain a portion of incorrect labels. Accordingly, we first present the generalization error bounds for gradual AST in a multiclass classification setting. We then use the optimal value of the Subset Sum Problem to bridge the standard error on a real distribution and the adversarial error on a pseudo-labeled distribution. The result indicates that AT may obtain a tighter bound than standard training on data with incorrect pseudo-labels. We further present an example of a conditional Gaussian distribution to provide more insights into why gradual AST can improve the clean accuracy for GDA.

1 Introduction

The key assumption of classical machine learning-that training and test data come from the same distribution-may not always hold in many real-world applications [15]. A data distribution typically evolves due to changes in conditions: for example, changing weather in vehicle identification [14], sensor aging in sensor measurement [43], the evolution of road conditions in self-driving [6], etc. To address this problem, Unsupervised Domain Adaptation (UDA) has been developed to train a model that performs well on an unlabeled target domain by leveraging labeled data from a similar yet distinct source domain.

Various works in UDA [5, 53, 34] theoretically demonstrate that the generalization error can be controlled by the domain discrepancy. Hence, the domain shift between the source domain and the target domain is expected to be small [15]. However, in some applications, the domain shift is substantial, leading to a sharp drop in the performance of the UDA method [26]. Furthermore, since changes in real-world data are more often gradual than abrupt [16], there are many intermediate domains between the source domain and the target domain. To get a better solution to the gradually shifting data, some recent works have focused on the Gradual Domain Adaptation (GDA) problem, where the learner is additionally provided with unlabeled intermediate domains. The large gap between the source and target domains is then divided up into multiple small shifts between the

intermediate domains. Recently, the celebrated work [26] proposes gradual self-training, which iteratively applies the self-training method to adapt the model along the intermediate domains. Empirically, the gradual self-training method greatly improves the target domain's accuracy compared to the traditional direct domain adaptation. After that, remarkable theoretical [45] and algorithmic [10, 1] advances have been achieved in GDA. However, the adversarial robustness of the GDA model remains unexplored, despite its vital role in security-critical scenarios. Adversarial robustness refers to the invariance of a model to small perturbations of its input [39], while adversarial accuracy refers to a model's prediction accuracy on adversarial examples generated by an attacker. Numerous works [33, 41, 49] have shown that very small perturbations, even those imperceptible to humans, can successfully deceive deep neural network (DNN) models, resulting in erroneous predictions.

One popular and effective method of improving robustness is Adversarial Training (AT), which adds adversarial examples to the training data. Due to the lack of labels in the target domain, it is difficult to directly generate adversarial examples. Accordingly, this paper replaces self-training with Adversarial Self-Training (AST), which first generates pseudo-labels on the unlabeled data and then adversarially trains the model based on these pseudo-labeled data. We conduct comprehensive experiments to validate the effectiveness of gradual AST in Section 3. Compared to the gradual self-training method, the proposed gradual AST method delivers a great improvement in adversarial accuracy, from 6 . 00% to 90 . 44% on the Rotating MNIST dataset. More interestingly, we find that the clean accuracy of gradual AST on the target domain also increases from 90 . 06% to 97 . 15% . This is a surprising result, since many prior works [52, 38] demonstrate that AT may hurt generalization; in other words, there is a trade-off between clean accuracy and adversarial accuracy. We then empirically investigate the reason why AST improves clean accuracy in GDA and find that the adversarially trained model has better clean accuracy than the standardly trained model when the generated pseudo-labels contain a proportion of incorrect labels.

In Section 4, we present novel generalization error bounds for the proposed gradual AST. The results show that if we have a model f with low adversarial margin loss on the source domain and the distribution shifts slightly, gradual AST can generate a new model f ′ that is also adversarially robust on the target domain. To explain why gradual AST achieves better clean accuracy than vanilla gradual self-training, we use the optimal value of the Subset Sum Problem [3] to bridge the standard error on a real distribution and the adversarial error on a pseudo-labeled distribution. The result shows that AT may yield a tighter generalization guarantee than standard training on pseudo-labeled training data. We further provide an example of a conditional Gaussian distribution to illustrate why AT outperforms standard training when a proportion of the labels in the training data are incorrect.

We summarize our contributions as below:

We are the first to apply the AST method in GDA. The proposed gradual AST method can not only improve the adversarial robustness but also the clean accuracy for GDA, which is an appealing and nontrivial result, considering that many prior works demonstrate that adversarial training may hurt generalization.

We empirically explore the reason for the improvements in clean accuracy and find that adversarial training performs better than standard training when the pseudo-labeled training set contains a proportion of incorrect labels.

From the theoretical perspective, we provide the generalization error bounds for gradual AST, which explain why the trained model is adversarially robust on the target domain. We provide an error bound and a toy example of Gaussian distribution to provide some intuitions for the improvements in clean accuracy.

2 Preliminaries

2.1 Multiclass Classification Learning Framework

Let Z = X × Y be a measurable instance space, where X and Y denote the input space and label space, respectively. The input space X is a subset of a d -dimensional space, X ⊆ R d . In this work, we focus on multiclass classification, and the label space Y is { 1 , . . . , k } , where k is the number of classes. Following the notations used in [5], a domain is envisioned as a tuple ⟨ P, h P ⟩ , consisting of a distribution P on input space X and a labeling function h P : X → Y . In practice, the true distribution P is unknown to the learner, which has access only to the training data S drawn

independent and identically distributed (i.i.d.) according to the true distribution P . We use ̂ P to denote the empirical distribution of P according to the training data S . Moreover, following the notations used in [35], we consider the class F = { f : X → R k } of scoring functions f . We use f y ( x ) to indicate the output of f associated with the data point x on the y -th dimension; the output indicates the confidence of the prediction. The label with the largest score is the predicted label of x . We use H F = { h f ( · ) = arg max y ∈Y f y ( · ) : f ∈ F} to denote the labeling function

̸

class induced by F . The expected risk and the empirical risk of a classifier h ∈ H with respect to a labeling function h ′ on distribution P are defined as R P ( h, h ′ ) ≜ E x ∼ P 1 [ h ( x ) = h ′ ( x )] and

̸

x ∼ ̂ P ) respectively. Furthermore, the 0-1 loss is non-

̸

and R ̂ P ( h ) to abbreviate R P ( h, h P ) and R ̂ P ( h, h P ) differentiable and cannot be minimized directly. Thus, a margin theory for multiclass classification was developed by [25], that replaces the 0-1 loss with the margin loss. The margin of a scoring function f ∈ F for labeled data ( x, y ) is defined as ρ f ( x, y ) ≜ f y ( x ) -max y ′ = y f y ′ ( x ) . And the expected margin loss of a scoring function f ∈ F with respect to another scoring function f ′ ∈ F on distribution P is defined as R ( ρ ) P ( f, f ′ ) ≜ E x ∼ P Θ ρ ◦ ρ f ( x, h f ′ ( x )) , where Θ ρ ( m ) = min { 1 , max { 0 , 1 -m/ρ }} is the ramp loss. Similarly, we use R ( ρ ) P ( f ) and R ( ρ ) ̂ P ( f ) to abbreviate R ( ρ ) P ( f, f P ) and R ( ρ ) ̂ P ( f, f P ) respectively. Note that R P ( h f , h f ′ ) ≤ R ( ρ ) P ( f, f ′ ) , since the 0-1 loss is upper bounded by the margin loss.

2.2 Gradual Domain Adaptation

Under the standard GDA settings [26, 45], the learner is sequentially trained on T + 1 domains with gradual shifts. The corresponding data distributions are P 0 , P 1 , . . . , P T , where P 0 is the distribution of the source domain, P T is the distribution of the target domain, and P 1 , . . . , P T -1 are the distributions of the intermediate domains. For simplicity, we assume that the number of data points in each domain is the same: namely, each domain t has a set of n data drawn i.i.d. from P t , denoted as S t . Recently, [26] proposes a gradual self-training method for GDA, which successively applies self-training to each of the intermediate domains. The self-training method adapts a pre-trained model trained on the previous domain to the current domain using unlabeled data drawn from the current distribution. Specifically, given a pre-trained model f and an unlabeled data set S , the model first predicts the labels of the unlabeled data, then trains f with empirical risk minimization (ERM) over these pseudo-labeled data, i.e.,

In gradual self-training, the model is first pre-trained on the labeled source domain and then successively self-trained on the unlabeled dataset of each of the intermediate domains, i.e.,

Since the domain shifts between the consecutive domains are assumed to be small [10, 26, 45], the accuracy of the pseudo-labels is expected to be high at each step. The gradual self-training method aims to output a final trained classifier h f T with low expected risk in the target domain.

2.3 Adversarial Self-Training

(

Given a classifier h f and a data point ( x, y ) , we can generate the corresponding adversarial example x adv , y ) by adversarially perturbing x in a small neighborhood B ϵ ( x ) of x , as follows: x adv = arg max x ′ ∈ B ϵ ( x ) Θ ρ ◦ ρ f ( x ′ , y ) . In this paper, we focus on the ℓ q adversarial perturbation B ϵ ( x ) ≜ { x ′ ∈ X : ∥ x ′ -x ∥ q ≤ ϵ, q ≥ 1 } , which is referred to as ℓ q -attack in the AT context and has been widely studied in existing works. Given a vector x ∈ R d , we define the ℓ q -norm of x as ∥ x ∥ q ≜ ( ∑ d i =1 | x ( i ) | q ) 1 /q , for q ∈ [1 , ∞ ) , where x ( i ) is the i -th dimension of x ; for q = ∞ , we define ∥ x ∥ ∞ ≜ max 1 ≤ i ≤ d | x ( i ) | . Similar to the definition of the standard risk R P ( h, h ′ ) , we

̸

scoring functions f, f on distribution P as follows:

define the adversarial risk on distribution P for any two classifiers h, h ′ as follows: ˜ R P ( h, h ′ ) ≜ E x ∼ P max ∥ δ ∥ q ≤ ϵ 1 [ h ( x + δ ) = h ′ ( x )] . We also define the expected adversarial margin loss for any two ′

Although the expected adversarial margin loss is asymmetrical, it satisfies the triangle inequality (see proof in Appendix A.1). The empirical adversarial risk and the empirical adversarial margin loss can be defined similarly. We use ˜ R ( ρ ) P ( f ) and ˜ R ( ρ ) ̂ P ( f ) to abbreviate ˜ R ( ρ ) P ( f, f P ) and ˜ R ( ρ ) ̂ P ( f, f P ) respectively. To train a robust model with resistance to the adversarial examples, AT aims to find a classifier h f that yields the minimal adversarial margin loss, i.e., arg min f ∈F ˜ R ( ρ ) ̂ P ( f ) . However, we cannot adversarially train the model directly on the unlabeled target domain because the conventional AT method requires labeled data. Instead, we adapt the self-training method to the adversarial self-training (AST) method by generating adversarial examples over the pseudo-labels, i.e.,

3 Empirical Exploration

In this section, we propose a gradual AST method to improve adversarial robustness. Surprisingly, we find that the gradual AST improves not only adversarial robustness but also clean accuracy. Our code is available at https://github.com/whustone007/AST_GDA.

Datasets. We run experiments on two datasets that are widely used in GDA [26, 45]. Rotating MNIST is a semi-synthetic dataset generated by rotating each MNIST image at an angle between 0 and 60 degrees. The 50 , 000 training set images are divided into three parts: a source domain of 5000 images ( 0 -5 degrees), 21 intermediate domains of 42 , 000 images ( 5 -60 degrees), and a set of validation data. The rotating degree gradually increases along the domain sequence. The 10 , 000 test set images are rotated by 55 -60 degrees, representing the target domain. Portraits [18] is a real dataset consisting portraits of American high school students across a century. The model aims to classify gender. The dataset is split into a source domain of the first 2000 images, seven intermediate domains of the next 14 , 000 images, and a target domain of the next 2000 images.

Methods. The standard gradual self-training method [26] successively adapts the model to the next domain via self-training. To improve the adversarial robustness, we replace the vanilla selftraining with AST. We implement multiple gradual AST methods with different starting domains τ ∈ { 0 , . . . , T +1 } where we begin to use AST, i.e.,

In particular, if τ = 0 , then the model is adversarially trained throughout; if τ = T +1 , then the model is standardly trained throughout. Note that T = 21 in Rotating MNIST and T = 7 in Portraits.

Implementation Details. We implement our methods using PyTorch [37] on two Nvidia GeForce RTX 3090 Ti GPUs. Following [26], we use a 3 -layer convolutional network with dropout ( 0 . 5 ) and BatchNorm on the last layer. We use mini-batch stochastic gradient descent (SGD) with momentum 0 . 9 and weight decay 0 . 001 . The batch size is 32 and the learning rate is 0 . 001 . We train the model for 40 epochs in each domain. We set the radius of the bounded perturbation to be 0 . 1 [51] for Rotating MNIST and 0 . 031 for Portraits. Following [33], we use PGD20 with a single step size of 0 . 01 as the adversarial attacker.

3.1 Results

The results of the different methods on Rotating MNIST are shown in Figure 1(a). The numbers in the abscissa represent different starting domains τ of various methods. From Figure 1(a), we can see that the vanilla gradual self-training method ( τ = 22 ) achieves a clean accuracy of 90 . 06% and adversarial accuracy of 6 . 00% on the target domain. Notably, the gradual AST method that uses AST

throughout ( τ = 0 ) improves the adversarial accuracy to 83 . 54% ( +77 . 54% ). More interestingly, we find that the clean accuracy is also slightly improved by 0 . 53% . Furthermore, the results of varying the starting domains τ indicate that the performance will be further improved if we use the vanilla self-training method for the first few domains and then use AST from an intermediate domain. We utilize the validation set of the target domain to choose the optimal starting time τ . Experimentally, the best choice of starting time for Rotating MNIST is τ = 9 , which achieves clean accuracy of 96 . 66% ( +6 . 6% ) and adversarial accuracy of 88 . 86% ( +82 . 86% ). We find that AST not only improves adversarial robustness but also clean accuracy with a large step. The results of the different methods on Portraits are shown in Figure 1(b). We find similar results to those on Rotating MNIST: the vanilla gradual self-training method ( τ = 22 ) achieves a clean accuracy of 82 . 03% and adversarial accuracy of 40 . 23% , while the gradual AST method ( τ = 0 ) improves the clean accuracy by 2 . 73% and the adversarial accuracy by 37 . 40% . We provide more experimental results of different ϵ , domain numbers, and neural networks in Appendix B.

3.2 Why Does Gradual AST Improve Clean Accuracy in GDA?

It is widely believed that AT would hurt generalization [52, 38] and decrease clean accuracy; thus it is surprising that the proposed gradual AST method improves the clean accuracy of the trained model in the GDA setting. In this section, we speculate on the reasons for this. Recently, some works [39, 42] have revealed that an adversarially pre-trained model tends to improve the target model's accuracy in transfer learning. We accordingly investigate whether the adversarially trained model has better clean accuracy on the next domain and thus generates more accurate pseudo-labels. However, by comparing the gradual AST methods with τ = 0 and τ = 1 on Rotating MNIST, we find that the model standardly trained on the source domain achieves a clean accuracy of 97 . 30% on the next domain, while the model adversarially trained on the source domain achieves a clean accuracy of 96 . 95% on the next domain. On the other hand, given that the pseudo-labels contain a small portion of incorrect labels, we wonder whether the adversarially trained model has better clean performance than the standardly trained model if trained on such a noisy training set. Since we set a fixed random seed for all gradual AST methods with varying starting domains, given a τ 0 ∈ { 0 , . . . , T } , the gradual AST method with τ = τ 0 and that with τ = τ 0 +1 have the same training processes before domain τ 0 and the same pseudo-label set on domain τ 0 . The difference between the gradual AST method with τ = τ 0 and that with τ = τ 0 +1 is whether we adversarially train the model on the domain τ 0 . We compare the clean accuracy of these two methods on domain τ 0 in Figure 1(c). As we can observe from the figure, the adversarially trained model ( τ = τ 0 ) has higher clean accuracy on domain τ 0 than the standardly trained model ( τ = τ 0 +1 ). Note that there are two exceptions in which AT hurts clean performance when the accuracy of pseudo-labels is very high ( τ 0 = 0 , 1 ), which explains why using AST from an intermediate domain is better than using AST throughout. Besides, we find that the adversarially trained model predicts more accurate pseudo-labels in the next domain than the standardly trained model when the current training set contains a proportion of incorrect labels. We then conclude that AT benefits the clean accuracy of GDA from two perspectives:

For the intermediate domains, AT improves the accuracy of the pseudo-labels in the next domain. So the learner can fine-tune the model on a more accurate dataset.

For the target domain, when the pseudo-labels contain a proportion of incorrect labels, the adversarially trained model has higher clean accuracy on the target domain than the standardly trained model.

3.3 Sensitivity of Filtration Ratio ζ

Following the standard experimental strategy [26, 45], for each step of self-training, we filter out a portion of images for which the model's prediction is least confident. In Figure 1, the ratio ζ is set to 0 . 1 as in the work of [26]. We further conduct more experiments with varying ζ . With smaller ζ , more data will be included for the next domain's training, but the accuracy of the pseudo-labels will decrease. Due to the page limit, we attach the detailed results of methods with different values of τ and ζ in Appendix B. We find that when ζ decreases, the performance of the standard gradual self-training also decreases. However, the gradual AST method prefers smaller ζ even though more incorrect pseudo-labels are included in the training set. For example, when we set ζ = 0 . 05 , the gradual AST with the optimal starting domain τ = 9 (chosen using the validation set) achieves clean accuracy of 97 . 15% ( +7 . 09% ) and adversarial accuracy of 90 . 44% ( +84 . 44% ) on Rotating MNIST.

(a)Theresults on Rotating MNiST forvarying starting domains

(b)TheresultsonPortraitsfor

100

varyingstartingdomains

90

90

70

80

50

70

30

012345678910111213141516171819202122

012345678

■cleanaccuracy

■adversarialaccuracy

■cleanaccuracyadversarial accuracy

(c)Thecleanaccuracyofmodelstrainedonpseudo-labeleddistribution

100

98

96

94

92

06

88

0

123456789101112131415161718192021

■standard training

■adversarial training

■accuracy of pseudo-labels

When we set ζ = 0 . 05 , the gradual AST with the optimal starting domain τ = 1 achieves clean accuracy of 86 . 04% ( +4 . 01% ) and adversarial accuracy of 77 . 25% ( +37 . 02% ) on Portraits.

3.4 Training with Labeled Intermediate Domains

In the setting of GDA, the learner is provided with unlabeled intermediate domains, and the model predicts pseudo-labels on an unlabeled data set in each iteration. The pseudo-labels contain a small proportion of incorrect labels, leading to performance degradation of the trained model. In this section, we conduct experiments to investigate the optimal performance of the model trained with ground-truth labels. In other words, the learner is provided with labeled intermediate data. Although the learner has access to the ground-truth intermediate labels, we still retain the filtering process, since we need to maintain the same data size to ensure fair comparison. We present the results of the models with varying τ in Table 19 and Table 20 (due to space limitations, we attach the tables in Appendix B). Since the results in Section 3.3 show that ζ = 0 . 05 is the optimal filtration ratio for gradual AST methods, we set ζ = 0 . 05 in this section. From Table 19, we can see that if the learner is provided with labeled intermediate domains, the vanilla gradual self-training method ( τ = 22 ) achieves clean accuracy of 98 . 44% on Rotating MNIST. Recall the results in Table 9 showing that the proposed gradual AST method ( τ = 9 ) achieves clean accuracy of 97 . 15% . The performance ( 97 . 15% ) of the proposed gradual AST is close to the optimal performance ( 98 . 44% ) of the gradual self-training where the learner is provided with labeled intermediate domains.

4 Theoretical Analysis

In this section, we theoretically analyze the experimental phenomena identified in Section 3 and explain the efficacy of gradual AST. In Section 4.1, we provide the adversarial error bound for gradual AST. In Section 4.2, we provide some theoretical insights about why AT outperforms standard training. In Section 4.3, we further present an example of a conditional Gaussian distribution to

show the error correction effect of AT on the incorrect labels. Our theory thus supports the excellent performance of gradual AST shown in Section 3.

4.1 Generalization Error Bounds for Gradual AST

We introduce the Margin Disparity Discrepancy (MDD) to measure the domain shifts, as below.

Definition 4.1 (MDD [53]) . Let P and Q be two distributions over X . Given a scoring function class F and a specific scoring function f ∈ F , the MDD between P and Q is defined as

When the domain shift is slight, the MDD between the domains is small. The MDD is well-defined and can be empirically estimated by the training data [53], where the estimation error can be bounded by Rademacher complexity. We next present the definition of Rademacher complexity, which is widely used in generalization theory to measure the complexity of a hypothesis class.

Definition 4.2 (Rademacher Complexity [44]) . Let G be a set of real-valued functions defined over X . For a fixed collection S of n data points, the empirical Rademacher complexity of G is defined as

The expectation is taken over ς = ( ς 1 , . . . , ς n ) , where ς i , i ∈ { 1 , . . . , n } , are independent uniform random variables taking values in {-1 , +1 } .

We next introduce an adversarial margin hypothesis class ˜ ρ F F .

Definition 4.3 (Adversarial Margin Hypothesis Class) . Given a scoring function class F , the adversarial margin hypothesis class is defined as

Having defined the Rademacher complexity and the MDD, we now focus on a pair of arbitrary consecutive domains. The following result shows that AST returns a new model f ′ with bounded adversarial margin loss if the domain shifts gradually. The proof can be found in Appendix A.2.

Theorem 4.4 (Adversarial Error Bound for AST) . Let ⟨ P, f P ⟩ and ⟨ Q,f Q ⟩ be two domains with gradual shifts. Suppose we have a scoring function f pre-trained on domain ⟨ P, f P ⟩ , and a data set S of n unlabeled data points drawn i.i.d. according to distribution Q . f ′ is the adapted scoring function by generated by the AST algorithm over S , i.e., f ′ = AST ( f, S ) . Then, for any α ≥ 0 , the following holds with probability of at least 1 -α over data points S :

Remark 4.5 . Theorem 4.4 indicates that if we have a model f with low adversarial margin loss on the domain ⟨ P, f P ⟩ and the distribution shifts slightly, AST generates a new model f ′ that is also adversarially robust on the domain ⟨ Q,f Q ⟩ . The λ ∗ term is widely used in domain adaptation theory [5, 34] to implicitly characterize the conditional distribution shift. In the setting of GDA, we assume that the domain shifts only slightly, i.e., λ ∗ and d f, F ( P, Q ) are relatively low.

Based on the error bounds for AST, we can apply this argument inductively and sum these error differences along the domain sequence to obtain the following corollary. See proofs in Appendix A.3.

Corollary 4.6 (Error Bounds for Gradual AST) . Given a sequence of domains ⟨ P t , f P t ⟩ , t ∈ { 0 , . . . , T } with gradual shifts, each intermediate domain has an unlabeled data set S t drawn i.i.d. from P t . The model is successively trained by the AST method, i.e., f t = AST ( f t -1 , S t ) , t ∈

{ 1 , . . . , T } . Then, for any α ≥ 0 , the following holds with probability of at least 1 -α over data points { S t } T t =1 :

Remark 4.7 . Our bound indicates that the adversarial risk on target domain can be controlled by the adversarial margin loss on the source domain and the discrepancy [53] between the intermediate domains. We also consider the standard risk and find that the standard risk of AST can be bounded similarly. We provide the bounds in Appendix A.4.

Comparison with Previous Work. Both of the works of [26] and [45] focus on binary classification and standard self-training, while our results non-trivially extend the error bounds into the setting of adversarial GDA and multiclass classification. Furthermore, [26] sets linear hypotheses as their training models, while we consider a more general hypothesis class that can be implemented by neural networks. [45] makes an assumption that the new model can always fit the pseudo-labels without error. As we can observe from the experiments, the training error tends to be small but never equal to 0 . Compared to [45], we don't need the assumption, so our setting is more consistent with real experiments.

4.2 Adversarial Training Improves Clean Accuracy for Self-Training

AT is generally considered harmful to the clean accuracy of the model [52, 38]. However, the experimental results in Section 3 indicate that AT unexpectedly improves both the clean accuracy and adversarial accuracy of the model trained on the pseudo-labels. In this section, we provide some theoretical insights showing that when the training data contains a small portion of incorrect labels, the adversarially trained model may have a tighter generalization guarantee than the standardly trained model. Our theorem is based on the following optimization problem.

Definition 4.8. Given two fixed vectors p and p ′ with all positive coordinates and a fixed N -dimensional 0 -1 vector e , i.e., e ∈ { 0 , 1 } N . Π is a fixed subset of { 1 , . . . , N } . The variant of the Subset Sum Problem [3] can be defined as follows:

We use Ψ ∗ ( p ′ , p, e, Π) to denote the optimal value of the problem. Given two fixed vectors p ′ and e , the value of the term p ′ T e is therefore constant. The optimization problem can be viewed as one of selecting a subset of p such that the sum of its elements is as close as possible to p ′ T e . Intuitively, the set Π adjusts the difficulty of this optimization problem. For two sets Π 1 ⊆ Π 2 , we have Ψ ∗ ( p ′ , p, e, Π 1 ) ≥ Ψ ∗ ( p ′ , p, e, Π 2 ) since we can optimize ˜ e on more coordinates.

̸

With a little abuse of notations, in this subsection, we consider a discrete real distribution P and a discrete noisy pseudo-labeled distribution P η over X × Y . We denote the corresponding probability mass functions as p and p η respectively. p and p η can be viewed as two vectors, i.e., p i = p ( x i , y i ) , ( x i , y i ) ∈ X × Y , i ∈ { 1 , . . . , |X × Y|} . The standard risk on the real data distribution is defined as R P ( h ) = ∑ ( x,y ) ∈X×Y p ( x, y ) 1 [ h ( x ) = y ] and the adversarial risk on the pseudo-labeled data distribution is defined as ˜ R P η ( h ) = ∑ ( x,y ) ∈X×Y p η ( x, y ) max ∥ δ ∥ q ≤ ϵ 1 [ h ( x + δ ) = y ] .

̸

The next result uses the optimal value Ψ ∗ ( p, p η , e, Π) to bound the difference between these two risks. The proof can be found in Appendix A.5.

Theorem 4.9. Given two distributions P and P η over X × Y with the corresponding probability mass vectors p and p η , the following bound holds for any classifier h ∈ H F :

̸

where e is the risk vector e i = 1 [ h ( x i ) = y i ] , and Π ϵ = { i : ∃ ∥ δ i ∥ q ≤ ϵ, h ( x i + δ i ) = h ( x i ) } .

̸

w'badv

badu W

W

ibadv

By setting ϵ = 0 , we can derive the error bound for standard training: R P ( h ) ≤ R P η ( h ) + Ψ ∗ ( p, p η , e, Π 0 ) . By the definition of the set Π ϵ , the larger the perturbation radius ϵ , the larger the size of Π ϵ , i.e., Π 0 ⊆ Π ϵ . We then have Ψ ∗ ( p, p η , e, Π ϵ ) ≤ Ψ ∗ ( p, p η , e, Π 0 ) . Theorem 4.9 implies that if the adversarial risk ˜ R P η ( h ) on the pseudo-labeled distribution is well controlled by AT, then AT may yield a tighter generalization guarantee than standard training.

4.3 A Toy Example of a Conditional Gaussian Distribution

We further provide an example of a conditional Gaussian distribution to show the efficacy of AT under incorrect pseudo-labels.

̸

Example 4.10 (Conditional Gaussian Distribution) . We consider the input space X = R and the label space Y = {-1 , +1 } . For simplicity, we assume that the two classes have symmetrical mean parameters {-µ, + µ } and the same standard deviations σ . The ( µ, σ ) -conditional Gaussian distribution P can then be defined as a distribution over X × Y = R × {-1 , +1 } , where the conditional distribution of X given Y is X | Y = y ∼ N ( yµ, σ 2 ) and the marginal distribution of Y is P Y ( {-1 } ) = P Y ( { +1 } ) = 1 / 2 . We consider a threshold hypothesis class, i.e., H ≜ { x ↦→ sgn ( x -b ) : b ∈ R } , where sgn is the sign function. We denote the hypothesis with threshold b as h b . In the setting of self-training, we have a labeling function h w , which is the model trained on the previous domain. The threshold w = 0 , since there is a distribution shift. The function h w assigns y = -1 to the data points where x < w and assigns y = +1 to the data points where x > w . We denote the pseudo-labeled data distribution over X × Y as P η . We use R P η ( h ) and ˜ R P η ( h ) to respectively denote the standard 0 -1 risk and adversarial 0 -1 risk on the pseudo-labeled data distribution P η . We assume | w |≪ µ and ϵ ≪ µ , since the domain shift is slight and the adversarial perturbation is subtle. We also assume µ > σ , which means that most samples can be well separated. The learner is provided with infinite samples. Under these assumptions, we provide the following results to demonstrate the efficacy of AT. The proof can be found in Appendix A.6.

Theorem 4.11. For the real data distribution P defined in Example 4.10, the optimal classifier that minimizes the standard risk R P ( h ) and adversarial risk ˜ R P ( h ) is h 0 ( · ) = sgn ( · ) . For the pseudo-labeled distribution P η defined in Example 4.10, the standardly trained classifier h std that minimizes the standard risk R P η ( h ) is h std = h w ; the adversarially trained classifier h adv that minimizes the adversarial risk ˜ R P η ( h ) has the following corresponding threshold b adv ,

5 Related Work

Self-Training. A series of works have achieved significant progress using self-training in semisupervised learning [29, 40] and domain adaptation [56]. The recent work [9] has proposed robust

self-training (RST) to leverage additional unlabeled data for robustness [2, 36]. While RST [9] focuses on utilizing additional unlabeled data drawn from the same distribution to improve adversarial robustness, our work investigates the different effects of vanilla self-training and adversarial selftraining on clean accuracy.

Gradual Domain Adaptation. Unlike the UDA problem, GDA has intermediate domains between the source domain and target domain of UDA. Some works [22, 17, 48] propose various algorithms to handle these evolving domains in a computer vision context. The recent work [26] adopts the self-training method and proposes gradual self-training, which iteratively adapts the model along the domain sequence. Moreover, [26] provides the first learning theory for GDA and investigates when and why the gradual structure helps. [45] further improves the generalization error bound in [26] and reveals the influence of the number of intermediate domains on the error bound. [10] investigates a more difficult setting in which the learner is provided with a set of unordered intermediate data. The authors propose TDOL, a framework that generates synthetic domains by indexing the intermediate data. However, the aforementioned works pay insufficient attention to the adversarial robustness of the model in a GDA context. In the field of UDA, the work of [11] constructs synthetic intermediate domains by creating Grassmannian manifolds between the source and the target. Another line of work instead uses a generative network, such as a cycle generative adversarial network [23], to generate the intermediate data.

Adversarial Training. After [41] shows that DNNs are fragile to adversarial attacks, a large amount of works have proposed various attack methods [33, 27, 8] and defense methods [47, 19, 51, 31, 20, 24, 30]. Adversarial training [19] is one of the popular and effective methods that improves adversarial robustness by adding adversarial examples to the training dataset. From the theoretical perspective, some works focus on the sample complexity [50, 54, 12] and the generalization of adversarial training. [32] investigates the trade-off between robustness and fairness. [46, 55] study adversarial robustness under self-supervised learning.

6 Conclusion

In this work, we empirically demonstrate that gradual AST improves both the clean accuracy and the adversarial accuracy of the GDA model. We reveal that the reason for this performance improvement is that AT outperforms standard training when the training data contains incorrect pseudo-labels. We first provide generalization error bounds for gradual AST in a multiclass setting. We then construct the Subset Sum Problem to connect the adversarial error and the standard error, providing theoretical insights into the superiority of AST in GDA. The example of conditional Gaussian distribution is further provided to give additional insights into the efficacy of AT on pseudo-labeled training data.

References

Samira Abnar, Rianne van den Berg, Golnaz Ghiasi, Mostafa Dehghani, Nal Kalchbrenner, and Hanie Sedghi. Gradual domain adaptation in the wild: When intermediate distributions are absent. arXiv preprint arXiv:2106.06080 , 2021.

Jean-Baptiste Alayrac, Jonathan Uesato, Po-Sen Huang, Alhussein Fawzi, Robert Stanforth, and Pushmeet Kohli. Are labels required for improving adversarial robustness? In NeurIPS , pages 12192-12202, 2019.

Jonathan Allcock, Yassine Hamoudi, Antoine Joux, Felix Klingelhöfer, and Miklos Santha. Classical and quantum algorithms for variants of subset-sum via dynamic programming. In European Symposium on Algorithms , pages 6:1-6:18, 2022.

Peter L. Bartlett and Shahar Mendelson. Rademacher and gaussian complexities: Risk bounds and structural results. Journal of Machine Learning Research , 3:463-482, 2002.

Shai Ben-David, John Blitzer, Koby Crammer, Alex Kulesza, Fernando Pereira, and Jennifer Wortman Vaughan. A theory of learning from different domains. Machine Learning , 79:151-175, 2010.

Andreea Bobu, Eric Tzeng, Judy Hoffman, and Trevor Darrell. Adapting to continuously shifting domains. In ICLR , 2018.

Stephen Boyd, Stephen P Boyd, and Lieven Vandenberghe. Convex optimization . Cambridge university press, 2004.

Nicholas Carlini and David A. Wagner. Towards evaluating the robustness of neural networks. In SP , pages 39-57, 2017.

Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C. Duchi, and Percy Liang. Unlabeled data improves adversarial robustness. In NeurIPS , pages 11190-11201, 2019.

Hong-You Chen and Wei-Lun Chao. Gradual domain adaptation without indexed intermediate domains. In NeurIPS , pages 8201-8214, 2021.

Zhen Cui, Wen Li, Dong Xu, Shiguang Shan, Xilin Chen, and Xuelong Li. Flowing on riemannian manifold: Domain adaptation by shifting covariance. IEEE Transactions on Cybernetics , 44:2264-2273, 2014.

Daniel Cullina, Arjun Nitin Bhagoji, and Prateek Mittal. Pac-learning in the presence of adversaries. In NeurIPS , pages 228-239, 2018.

Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research , 9(11), 2008.

Özgür Erkent and Christian Laugier. Semantic segmentation with unsupervised domain adaptation under varying weather conditions for autonomous vehicles. IEEE Robotics and Automation Letters , 5:3580-3587, 2020.

Abolfazl Farahani, Sahar Voghoei, Khaled Rasheed, and Hamid R. Arabnia. A brief review of domain adaptation. arXiv preprint arXiv:2010.03978 , 2020.

Ali Farshchian, Juan Alvaro Gallego, Joseph Paul Cohen, Yoshua Bengio, Lee E. Miller, and Sara A. Solla. Adversarial domain adaptation for stable brain-machine interfaces. In ICLR , 2019.

Michael Gadermayr, Dennis Eschweiler, Barbara Mara Klinkhammer, Peter Boor, and Dorit Merhof. Gradual domain adaptation for segmenting whole slide images showing pathological variability. In ICISP , pages 461-469, 2018.

Shiry Ginosar, Kate Rakelly, Sarah Sachs, Brian Yin, Crystal Lee, Philipp Krähenbühl, and Alexei A. Efros. A century of portraits: A visual historical record of american high school yearbooks. IEEE Transactions on Computational Imaging , 3:421-431, 2017.

Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR , 2015.

Sven Gowal, Sylvestre-Alvise Rebuffi, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy A. Mann. Improving robustness using generated data. In NeurIPS , pages 4218-4233, 2021.

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR , pages 770-778, 2016.

Judy Hoffman, Trevor Darrell, and Kate Saenko. Continuous manifold based adaptation for evolving visual domains. In CVPR , pages 867-874, 2014.

Han-Kai Hsu, Chun-Han Yao, Yi-Hsuan Tsai, Wei-Chih Hung, Hung-Yu Tseng, Maneesh Singh, and Ming-Hsuan Yang. Progressive domain adaptation for object detection. In CVPR , pages 749-757, 2020.

Qiyu Kang, Yang Song, Qinxu Ding, and Wee Peng Tay. Stable neural ODE with lyapunovstable equilibrium points for defending against adversarial attacks. In NeurIPS , pages 1492514937, 2021.

Vladimir Koltchinskii and Dmitry Panchenko. Empirical margin distributions and bounding the generalization error of combined classifiers. The Annals of Statistics , 30:1-50, 2002.

Ananya Kumar, Tengyu Ma, and Percy Liang. Understanding self-training for gradual domain adaptation. In ICML , pages 5468-5479, 2020.

Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In ICLR , 2017.

Michel Ledoux and Michel Talagrand. Probability in Banach Spaces: isoperimetry and processes , volume 23. 1991.

Dong-Hyun Lee et al. Pseudo-label: The simple and efficient semi-supervised learning method for deep neural networks. In Workshop on challenges in representation learning, ICML , page 896, 2013.

Boqi Li and Weiwei Liu. WAT: improve the worst-class robustness in adversarial training. In AAAI , pages 14982-14990, 2023.

Xiyuan Li, Zou Xin, and Weiwei Liu. Defending against adversarial attacks via neural dynamic system. In NeurIPS , 2022.

Xinsong Ma, Zekai Wang, and Weiwei Liu. On the tradeoff between robustness and fairness. In NeurIPS , 2022.

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR , 2018.

Yishay Mansour, Mehryar Mohri, and Afshin Rostamizadeh. Domain adaptation: Learning bounds and algorithms. In COLT , 2009.

Mehryar Mohri, Afshin Rostamizadeh, and Ameet Talwalkar. Foundations of Machine Learning . Adaptive computation and machine learning. MIT Press, 2012.

Amir Najafi, Shin-ichi Maeda, Masanori Koyama, and Takeru Miyato. Robustness to adversarial perturbations in learning from incomplete data. In NeurIPS , pages 5542-5552, 2019.

Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Köpf, Edward Z. Yang, Zachary DeVito, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala. Pytorch: An imperative style, high-performance deep learning library. In NeurIPS , pages 8024-8035, 2019.

Aditi Raghunathan, Sang Michael Xie, Fanny Yang, John C. Duchi, and Percy Liang. Adversarial training can hurt generalization. arXiv preprint arXiv:1906.06032 , 2019.

Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adversarially robust imagenet models transfer better? In NeurIPS , 2020.

Kihyuk Sohn, David Berthelot, Nicholas Carlini, Zizhao Zhang, Han Zhang, Colin A Raffel, Ekin Dogus Cubuk, Alexey Kurakin, and Chun-Liang Li. Fixmatch: Simplifying semisupervised learning with consistency and confidence. pages 596-608, 2020.

Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In ICLR , 2014.

Francisco Utrera, Evan Kravitz, N. Benjamin Erichson, Rajiv Khanna, and Michael W. Mahoney. Adversarially-trained deep nets transfer better: Illustration on image classification. In ICLR , 2021.

Alexander Vergara, Shankar Vembu, Tuba Ayhan, Margaret A Ryan, Margie L Homer, and Ramón Huerta. Chemical gas sensor drift compensation using classifier ensembles. Sensors and Actuators B: Chemical , 166:320-329, 2012.

Martin J Wainwright. High-dimensional statistics: A non-asymptotic viewpoint , volume 48. 2019.

Haoxiang Wang, Bo Li, and Han Zhao. Understanding gradual domain adaptation: Improved analysis, optimal path and beyond. In ICML , pages 22784-22801, 2022.

Zekai Wang and Weiwei Liu. Robustness verification for contrastive learning. In ICML , pages 22865-22883, 2022.

Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan. Better diffusion models further improve adversarial training. In ICML , pages 36246-36263, 2023.

Markus Wulfmeier, Alex Bewley, and Ingmar Posner. Incremental adversarial domain adaptation for continually changing environments. In ICRA , pages 4489-4495, 2018.

Jingyuan Xu and Weiwei Liu. On robust multiclass learnability. In NeurIPS , 2022.

Dong Yin, Kannan Ramchandran, and Peter L. Bartlett. Rademacher complexity for adversarially robust generalization. In ICML , volume 97, pages 7085-7094, 2019.

Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML , pages 7472-7482, 2019.

Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan S. Kankanhalli. Attacks which do not kill training make adversarial learning stronger. In ICML , pages 11278-11287, 2020.

Yuchen Zhang, Tianle Liu, Mingsheng Long, and Michael I. Jordan. Bridging theory and algorithm for domain adaptation. In ICML , pages 7404-7413, 2019.

Zhengyu Zhou and Weiwei Liu. Sample complexity for distributionally robust learning under chi-square divergence. Journal of Machine Learning Research , pages 1-27, 2023.

Xin Zou and Weiwei Liu. Generalization bounds for adversarial contrastive learning. Journal of Machine Learning Research , pages 114:1-114:54, 2023.

Yang Zou, Zhiding Yu, Xiaofeng Liu, BVK Kumar, and Jinsong Wang. Confidence regularized self-training. In ICCV , pages 5982-5991, 2019.

Peer reviews:
comments: SUMMARY:
This paper investigates the adversarial gradual domain adaptation. The authors apply adversarial learning in the self-training approaches in gradual domain adaptation, forming the adversarial self-training approach (AST). Empirically, the authors show that AST improves both adversarial accuracy and clean accuracy on MNIST and Portraits, and further experimentally explore the reason for the improvements in clean accuracy. Theoretically, new bounds of the empirical risk based on Margin Disparity Discrepancy are developed, providing a tighter bound for adversarial self-training than standard self-training and partially explaining the superiority of AST over standard self-training for gradual domain adaptation.

STRENGTHS:
It is appealing that adversarial self-training can improve clean accuracy, for which the authors provide theoretical and empirical analysis. 

The theoretical bounds and analysis are new to me.

The paper is well-written and the method is easy to follow.

WEAKNESSES:
In the Introduction, the contributions could be better summarized. To my understanding, the main contributions are the experimental findings on the performance improvements by AST, and the theoretical bounds and analysis, which should be clearly summarized.

The paper assumes the distribution shifts slightly, which could not be realistic. 

MNIST and Portraits seem to be simple. Experiments on more challenging datasets are encouraged.

QUESTIONS:
Line 46, labeling -> labels.

Why should we prove the two inequalities in Lemma A.1? Is it because $\tilde{R}_{P}^{(\rho)}(f_1,f_2)$ (I abbreviate it as $R12$) is asymmetric? If so, do we need to prove the other two inequalities: $R12 \leq R31 + R32$ and $R12 \leq R31 + R23$.

LIMITATIONS:
Limitations are encouraged to be included.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 4
DATE: 2023-06-25

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes an Adversarial Self-Training method to improve the robustness and clean accuracy under the scenario of gradual domain adaptation. More specifically, the paper uses networks to generate pesudo label for gradually changing domain and update the model with the pesudo label. Experiments on Rotating MNIST and Portraits show that the proposed paper large improves the robustness of the network. Additionally, it can also improves the clean accuracy. The paper also perform theoretical analysis of their method, providing error bound of AST and provide a toy example demonstrating why AST achieves better clean performance.\n\nSTRENGTHS:\n1. The paper proposes a simple but effective method to achieve robustness under the scenario of gradual domain adaptation.\n2. Both theoretical and empirical results are present to show the effectiveness of AST. Particularly, the theoretical analysis in Section 4.1 is clear and useful.\n3. Generally, the paper is easy to follow with clear motivation and good presentation.\n\nWEAKNESSES:\n1. The proposed method, AST, seems to be an application of [1, 2] under the scenario of gradual domain adaptation, which lacks of novelty.\n2. The experiment is also weak. MNIST is too small and simple to prove the effectiveness of AST in practical applications. I will recommend the authors to perform more experiments in the following aspects:\n\n    1). Perform one experiments on gradual domain shift for natural images like CIFAR10.\n\n    2). Enlarging $\\epsilon$ to see whether clean accuracy is still improved for larger adversarial budget.\n3. Theorem 4.9 seems to imply strong assumption that only if adversarial risk is well controlled, then standard training is dominated by adversarial training. But the paper does not give how well should the adversarial risk gets controlled.\n\n[1] Yair Carmon et.al., Unlabeled data improves adversarial robustness, NeurIPS 2019\n\n[2] Jonathan Uesato et.al., Are Labels Required for Improving Adversarial Robustness?, NeurIPS 2019\n\nQUESTIONS:\n1. Can the authors give high level intuition of Definition 4.3? What does Adversarial Margin Hypothesis Class mean?\n\nLIMITATIONS:\nSee Weakness.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-06-29"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes adversarial self-training (AST) that incorporates adversarial training with gradual self-training. Empirical results validate that AST can enhance both adversarial robustness and generalization ability in the scenario of the gradual unsupervised domain adaption. The authors provide empirical and theoretical analyses to interpret this surprising phenomenon.\n\nSTRENGTHS:\n1. This paper is well-organized and well-written.\n\n2. The empirical observation, that AST can improve robust and natural test accuracy simultaneously in gradual domain adaptation, is interesting and surprising. The natural test accuracy achieved by AST is even close to the optimal results, which validates the significance of the empirical results.\n\n3. The authors provide comprehensive empirical analyses to explain the phenomenon that AST improves natural accuracy.\n\n4. The authors present comprehensive theoretical analyses of AST, including the error bound of (gradual) AST and the connection between natural risk and adversarial risk. The theoretical analyses further help to explain the effectiveness of AST.\n\nWEAKNESSES:\n1. The experiments are conducted on a simple network. What if the results were evaluated on a more complex network say ResNet18?\n\n2. I am a bit confused about the term “gradual shifts”. Does this term mean that the test distribution is different from all the training distributions? If so, I am interested in the performance evaluated on the previous training distributions achieved by AST as well to check whether there is a forgetting issue.\n\nQUESTIONS:\n1. Please refer to the comments in the Weaknesses.\n\n2. What kind of adversarial attacks did you use when evaluating adversarial robustness?\n\n3. How can you choose the perturbation bound during AST? What is the performance if using different perturbation bounds?\n\nLIMITATIONS:\nThe authors did not discuss the limitations.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nIn this paper, the authors analyze the adversarial robustness of the gradual self-training method with adversarial self-training (AST). AST first predicts labels on the unlabeled data and then adversarially trains the model on the pseudo-labeled distribution. The authors introduce an adversarial self-training for gradual unsupervised domain adaptation in a multi-class problem. They show that when there is a little domain shift between consecutive intermediate domains, their adversarial self-training works better in performance and generality (more robust in the case of missed or bad pseudo-labeled) in comparison to vanilla gradual self-training.\nThey present the generalization error bounds for gradual AST in a multiclass classification setting and then use the optimal value of the Subset Sum Problem to bridge the standard error on a real distribution and the adversarial error on a pseudo-labeled distribution. Results indicate that AT may obtain a tighter bound than standard training on data with incorrect pseudo-labels. We further present an example of a conditional Gaussian distribution to provide more insights into why gradual AST can improve the clean accuracy for GDA.\n\nSTRENGTHS:\n+ The paper is clearly written and organized, and the key concepts and experimental results are described with enough details to understand. There is a clear discussion on the shortcomings and risks of unsupervised gradual domain adaptation on multi-target classification problems. \n+ The authors tackle an important and challenging problem. They propose using adversarial self-training for pseudo-labeling in the context of gradual domain adaptation. In particular, the authors show analytically that ℓq adversarial perturbation for sampling in unlabeled intermediate domains has lower error bounds compared to standard self-training. \n+ The supplementary material provides many additional proofs and experimental results that help support the paper.  Also, since the codes are also provided in supplementary material, there is less concern that the results in this paper would be difficult for a reader to reproduce.  The paper includes some information that would make it possible to reproduce the methods and experiments.\n\nWEAKNESSES:\n- When comparing to other methods in the literature, the authors claim that their method is based on milder assumptions. They should provide a more detailed discussion of the implications of such assumptions. \n- The experimental validation is limited in some respects. Authors show that gradual AST improves both the clean accuracy and adversarial accuracy of the GDA model. Validation is mostly performed on Rotating MNIST and Portraits datasets. However, experiments should assess in more detail the impact on the performance of growing the number of intermediate domains, using different backbones, and different larger datasets with more classes and class imbalance. \n- There should be an analysis of time and memory complexity for the proposed and SOA methods.\n\nQUESTIONS:\nNone. Please comment on the points described in the weaknesses.\n\nLIMITATIONS:\nLack of comparison with other SOA domain adaptation methods.  Refer to the weaknesses for details.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-09"}