Title: DAT: Improving Adversarial Robustness via Generative Amplitude Mix-up in Frequency Domain
Venue: NeurIPS 2024
Accepted: yes
Keywords: Deep learning

Model robustness
Abstract: To protect deep neural networks (DNNs) from adversarial attacks, adversarial training (AT) is developed by incorporating adversarial examples (AEs) into model training. Recent studies show that adversarial attacks disproportionately impact the patterns within the phase of the sample's frequency spectrum---typically containing crucial semantic information---more than those in the amplitude, resulting in the model's erroneous categorization of AEs. We find that, by mixing the amplitude of training samples' frequency spectrum with those of distractor images for AT, the model can be guided to focus on phase patterns unaffected by adversarial perturbations. As a result, the model's robustness can be improved. Unfortunately, it is still challenging to select appropriate distractor images, which should mix the amplitude without affecting the phase patterns. To this end, in this paper, we propose an optimized **Adversarial Amplitude Generator (AAG)** to achieve a better tradeoff between improving the model's robustness and retaining phase patterns. Based on this generator, together with an efficient AE production procedure, we design a new **Dual Adversarial Training (DAT)** strategy. Experiments on various datasets show that our proposed DAT leads to significantly improved robustness against diverse adversarial attacks. The source code is available at https://github.com/Feng-peng-Li/DAT.

DAT: Improving Adversarial Robustness via Generative Amplitude Mix-up in Frequency Domain

Abstract

To protect deep neural networks (DNNs) from adversarial attacks, adversarial training (AT) is developed by incorporating adversarial examples (AEs) into model training. Recent studies show that adversarial attacks disproportionately impact the patterns within the phase of the sample's frequency spectrum-typically containing crucial semantic information-more than those in the amplitude, resulting in the model's erroneous categorization of AEs. We find that, by mixing the amplitude of training samples' frequency spectrum with those of distractor images for AT, the model can be guided to focus on phase patterns unaffected by adversarial perturbations. As a result, the model's robustness can be improved. Unfortunately, it is still challenging to select appropriate distractor images, which should mix the amplitude without affecting the phase patterns. To this end, in this paper, we propose an optimized Adversarial Amplitude Generator (AAG) to achieve a better tradeoff between improving the model's robustness and retaining phase patterns. Based on this generator, together with an efficient AE production procedure, we design a new Dual Adversarial Training (DAT) strategy. Experiments on various datasets show that our proposed DAT leads to significantly improved robustness against diverse adversarial attacks. The source code is available at https:// github.com/Feng-peng-Li/DAT .

1 Introduction

DNNs have been successfully applied to various tasks [21, 32, 25]. However, recent studies reveal that DNNs are vulnerable to adversarial examples (AEs), created by applying subtle yet deceptive adversarial perturbations to benign samples [40, 51]. Such vulnerabilities have sparked considerable interests, leading to the development of numerous adversarial attacks designed to deceive DNNs [40, 19, 39, 13, 20, 5, 6]. Furthermore, serious concerns about the trustworthiness of artificial intelligence have been raised, due to these fundamental vulnerabilities [47, 37]. To mitigate these threats, adversarial training (AT) has been developed to enhance model robustness by incorporating AEs into training through a min-max strategy [40, 61, 38]. Based on the typical method, PGD-AT [40], a variety of AT strategies have been devised [38, 29, 37] (see Appendix B for related works).

For image signals transformed into the frequency domain using, e.g . the discrete Fourier transform (DFT), several AT works [59, 52, 53, 43] explore the adversarial attacks' behavior on sample's frequency spectrum. Frequency spectra consist of amplitude and phase; the amplitude typically captures stylistic information, whereas the phase encompasses richer semantics [7]. Recent studies [58, 63] find, as shown in Figure 1, that adversarial attacks often severely eliminate some semantics in the phase, making it difficult for models to extract features for correctly predicting AEs, while the

impacts on amplitude are relatively mild. Moreover, by forcing the model to focus on phase patterns, [7, 63] confirm the model can learn more features unaffected by image corruptions, e.g ., Gaussian noise and defocus blur, improving the model's performance on corrupted samples.

To explore the impact of adversarial perturbations on phase and amplitude patterns respectively, we conduct some studies (see Sec. 2 for details). We find that the standard model trained without AT has worse performance on samples with adversarial phase patterns than those with adversarial amplitude ones. Unlike the standard model, AT enhances the model's robustness against both phaseand amplitude-level adversarial perturbations, with a more noticeable improvement against adversarial perturbations on phase patterns. This indicates the potential for improving the model's robust-

Benign

AE

Phase

Patterns

Spectrum

Patterns

Spectrum

Amplitude

ness by focusing on phase patterns unaffected by adversarial perturbations in AT. Then, by mixing the training samples' amplitude with randomly selected distractor, we observe that the robust model performance, particularly at adversarial phase patterns, is further enhanced, without impacting that at adversarial amplitude ones. This demonstrates that training samples with mixed amplitude improve the model's performance on AEs, and maintain the model's robustness on amplitude-level.

Inspired by these observations, we in this work propose a new Dual Adversarial Training (DAT) strategy by focusing on the phase patterns, with two adversarial procedures: adversarial amplitude generation and efficient AE production. Specifically, to guide the model to learn more phase patterns, we first attempt to mix the amplitude of training samples' frequency spectra with randomly selected distractor images. However, when the disparity between the distractor and the original image is too large, the recombined ones tend to disrupt original phase patterns, hindering the model from predicting AE correctly. Conversely, it is difficult for models to focus on phase patterns when the distractor closely resembles the original one [7]. To tackle this challenge, we propose an optimized Adversarial Amplitude Generator (AAG) to synthesize an adversarial amplitude, maximizing the model loss and limiting the model fitting amplitude patterns, thereby the model focusing on phase patterns for convergence. During the training process, the AAG and robust model are optimized jointly with the original and recombined images, together with their AEs. The robust model undergoes training by empirical risk minimization, and maximizes the model loss to update the AAG adversarially. Experiments across various benchmarks against a range of adversarial attacks confirm the superior effectiveness of our proposed DAT, surpassing state-of-the-art methods in robustness with big margins.

Contribution. The contributions of this work can be summarized as:

We verify that adversarial perturbations significantly influence phase patterns, resulting in the model's difficulty for predicting AEs correctly. Moreover, by mixing the amplitude of a training image with that of a distractor, we find that the model robustness against AEs can be enhanced.

We propose the novel DAT strategy with an optimized AAG to synthesize an adversarial amplitude. With the AAG, we enforce the model to better focus on phase patterns, enhancing the model's robustness. Also, an efficient AE generation module is incorporated to improve the AT's efficiency.

Experiments on multiple datasets confirm that DAT significantly enhances the model's robustness against a variety of adversarial attacks. Specifically, DAT increases the model's robustness by ∼ 2.1% on CIFAR-10, ∼ 2.2% on CIFAR-100, and ∼ 2.3% on Tiny ImageNet, on average.

Notation. Let D = { ( x i , y i ) } N i =1 be a benign dataset comprising N samples from c classes, where each sample x i ∈ X ⊆ R C × H × W is an image with C channels, height H , and width W , and its label y i ∈ [ c ] = { 1 , . . . , c } . f θ : X → R c denotes a DNN function parameterized by θ ∈ R d ,

 

































(a) Standard model

 

































(b) Robust model

 

































(c) Perturbed model

and F θ ( x ) = arg max y ∈ [ c ] f θ ( x ) y is the predicted label of x . Moreover, f θ = g ◦ h , where h is the feature extractor and g is the classifier. Let H ⊆ R m be the m -dimensional feature space, h i : X → R be a feature mapping function, and h ( x ) = [ h 1 ( x ) , . . . , h m ( x )] ⊤ ∈ H denote the feature map of x . Specifically, features induced from the amplitude and phase patterns of x are h a ( x ) and h p ( x ) , respectively. Define S ϵ [ x ] = { x ′ : ∥ x ′ -x ∥ ∞ ⩽ ϵ } as an ℓ ∞ -ball centered on x with radius ϵ . Let F ( · ) and F -1 ( · , · ) denote the DFT and inverse DFT (IDFT) functions. Typically, DFT is independently applied to each channel of an image x within the pixel space as:

where ( h, w ) denotes the pixel coordinates of x , and ( u, v ) ∈ [ H ] × [ W ] signifies coordinates in the frequency domain. The real and imaginary parts of F ( x ) are denoted by Re( F ( x )) and Im( F ( x )) , respectively. Then, the amplitude spectrum A ( x ) and phase spectrum P ( x ) are

2 Motivation: On Improving Adversarial Robustness in Frequency Domain

To investigate the approach to enhance the model robustness and show the motivation of DAT, we perform exploration experiments in this section. As shown in Figure 1, adversarial perturbations severely compromise the semantics within phase patterns, resulting in the difficulty of the model predicting AEs correctly. Consequently, we examine the distinct effects of adversarial perturbations on amplitude and phase patterns. To achieve this target, we employ the standard and robust models, trained without and with AT as [40] on D t (the training subset of CIFAR-10). Moreover, on training samples with perturbed amplitude, the model tends to focus on phase patterns, in order to achieve the convergence [7, 58]. Following this line, we discuss the impact of perturbing amplitude by mixing the amplitude of training samples with those of distractors randomly selected from D t . For ( x , y ) ∈ D t , the recombined sample ˆ x is generated by amplitude-level mixing operations and IDFT, namely,

where x 0 is the distractor i.i.d. drawn from D t . We use (ˆ x , y ) to construct a dataset D r and train the perturbed model on it as [40]. Then, for ( x , y ) ∈ D e (the testing subset of CIFAR-10), we generate AE x ′ by four representative adversarial attacks (PGD, C&W, FAB, and Square) and utilize DFT to derive the amplitude and phase of frequency spectra of both x and x ′ . Furthermore, images composed of adversarial amplitude/phase and benign phase/amplitude (denoted by x ′ amp / x ′ pha ) are obtained by

For each ( x , y ) ∈ D e , with every adopted adversarial attack, we use ( x ′ , y ) , ( x ′ amp , y ) and ( x ′ pha , y ) to combine evaluation datasets D AE , D amp and D pha , which are used to evaluate the robustness of

+

+

+

Benign

𝐱

Recombined

ො 𝐱

𝓕 ⋅

𝓕 ⋅

𝓕 ⋅

𝐱3

𝐱2

𝐱1

ො

𝐱1

ො 𝐱2

ො 𝐱3

𝓕 -𝟏

⋅

𝓕 -𝟏

⋅

𝓕 -𝟏

⋅

𝓐 𝐱1

𝓐 𝐱2

𝓐 𝐱3

𝓟 𝐱1

𝓟 𝐱2

𝓟 𝐱3

𝓐𝒎𝒊𝒙(𝐱1)

𝓐𝒎𝒊𝒙(𝐱3)

𝓐𝑮(𝐱1)

𝓐𝑮(𝐱2)

𝓐𝑮(𝐱3)

𝝀

𝟏 - 𝝀

𝟏 - 𝝀

𝝀

𝟏 - 𝝀

𝐱1

′

𝐱2

′

𝐱3

′

𝝀

+𝒔𝒈𝒏

𝝏𝓛𝑨𝑬

𝝏𝐱

+𝒔𝒈𝒏

𝝏𝓛𝑨𝑬

𝝏ො 𝐱

ො

𝐱 𝟏

′

ො 𝐱2

′

ො 𝐱3

′

𝓛𝑫𝑨𝑻

𝝏 -𝓛𝑫𝑨𝑻

𝝏𝝍

Adversarial

Generator

𝑮𝝍

𝝏𝓛𝑫𝑨𝑻

𝝏𝜽

Robust Model

𝒇𝜽

AE

ො

𝐱 ′

𝒛 ∼ 𝑵 𝟎, 𝟏

𝒇𝜽

(

𝐱

)

Ⅰ. Adversarial Amplitude Generation

Ⅱ. AE Generation

Ⅱ. AE Generation

AE

𝐱 ′

Forward

Backward

Ⅲ. Joint Optimization

the standard, robust, and perturbed models, respectively. The experimental outcomes are illustrated in Figure 2, from which we can draw the following conclusion:

Impact of Adversarial Attacks. As shown in Figure 2a, under all four attacks, the standard model completely cannot predict samples in D AE . Moreover, the standard model exhibits higher test accuracy on D amp than that on D pha . These results suggest that adversarial attacks have a more substantial impact on the phase patterns than amplitude ones.

Impact of AT. As depicted in Figure 2b, AT simultaneously enhances the model's performance on D AE and D amp and D pha , in comparison to the standard model. Notably, the robust model exhibits superior performance on D pha over D amp , contrary to the standard model. That indicates the AT helps the model learn more phase patterns unaffected by adversarial attacks, enhancing the model's robustness on both adversarial phase patterns and AEs. The phenomena indicate that by forcing the model to focus on the phase patterns of samples, the model's robustness can be improved further.

Impact of Mixing Amplitude. As shown in Figure 2c, for the perturbed model trained with AT on D r , compared with the robust one, its performance on D AE and D pha is improved further, while the performance on D amp is rarely changed. From these results, we can conclude that mixing the amplitude with that of the randomly selected distractor can force the model to focus on phase patterns, learning more patterns within the phase unaffected by adversarial perturbations. Then, the model's robustness on AEs is improved further, while robustness on amplitude patterns is retained.

Following the insight from these studies, we propose DAT to enhance the model's robustness, mixing training sample's amplitude with an adversarial one, generated by the adversarially optimized AAG.

3 Methodology

In this section, the details of our proposed DAT are introduced and analyzed. As illustrated in Figure 3, DAT consists of three stages. It first adopts the AAG G ψ to generate adversarial amplitude and obtain the recombined data for benign ones in Stage I. With the proposed loss L AE in Stage II, we produce the AEs for both benign and recombined samples. Then, taking both benign and recombined samples, total loss L DAT for DAT are minimized to update robust model f θ , and maximized to optimize G ψ adversarially in Stage III. Stages I and III involve the adversarially trained AAG G ψ and commonly

updated model f θ , both of which share the L DAT and optimized jointly following the objective as:

where ˆ x is the recombined data of x , following a sample-dependent conditional distribution p ( ˆ x | x , ψ ) . Stage II encompasses an efficient AE generation method, optimized using the proposed loss L AE as:

Following the order of these three stages, we introduce (I) AAG in Sec. 3.1 and (II) the efficient AE generation in Sec. 3.2. Subsequently, building on these components, Sec. 3.3 details (III) the joint optimization. Ultimately, Sec. 3.4 theoretically analyzes the mechanism of how the adversarial amplitude spectrum generated by AAG enforces the model to focus on the phase-level patterns.

3.1 Adversarial Amplitude Generator

To explain the proposed AAG, we first introduce some constraints that the recombined ˆ x with perturbed amplitude is expected to meet. With a small ϵ 1 > 0 and an ϵ 2 ≫ ϵ 1 , ideally, we expect ˆ x of ( x , y ) ∈ D based on the generated adversarial amplitude to satisfy the following three conditions:

C1. | h p ( x ) -h p ( ˆ x ) | < ϵ 1 : Ensuring ˆ x retains the same semantics in the phase spectrum as x .

C2. F θ ( x ) = F θ ( ˆ x ) : Ensuring ˆ x remains distinguishable with the same label as x by f θ .

C3. | h a ( x ) -h a ( ˆ x ) | > ϵ 2 : Making ˆ x maximize the L DAT , causing the model's difficulty fitting the amplitude of images, and forcing the model to focus on phase patterns.

Let us first analyze the above conditions C1-C3 when a randomly selected distractor image is used. Since ˆ x is recombined by the mixed amplitude with the distractor and original phase of x , then, C1 can be easily satisfied. As stated in Sec. 1, when the gap between the randomly selected distractor and training sample is too large, the P ( x ) 's information can be damaged, resulting in the inconsistent prediction between the x and ˆ x , destroying the C1 and C2 . Conversely, it is difficult to satisfy C3 , limiting the model's attention to the patterns in P ( x ) . The above statement indicates that it is difficult for ˆ x , using the amplitude of the randomly selected distractor, to meet the above three constraints.

Instead of searching for an appropriate distractor, we here resort to a generative approach, i.e., developing G ψ to generate an adversarial amplitude A G ( x ) as

For efficient training, G ψ is constructed by four linear layers (detailed architecture in Appendix E.2). Moreover, the input with f θ ( x ) can ease the difficulty of G ψ 's convergence. With G ψ , since ˆ x is still recombined by A G ( x ) and the P ( x ) , then, C1 is satisfied. For the outer minimization in Eq. (3), we retain the label of ˆ x same as x , minimizing L DAT to update f θ , meeting the C2 . To meets C3 , G ψ is optimized adversarially by maximizing the L DAT (further details in Sec. 3.3), shown as the inner step in Eq. (3). Thereby, ˆ x can limit f θ to fit amplitude information. To achieve the convergence, f θ has to focus on patterns in P ( x ) , learning more phase patterns unaffected by adversarial perturbations.

Since G ψ is adversarially trained by maximizing the L DAT , A G ( x ) is likely to compromise semantic integrity [63], hindering f θ to retain the prediction consistency between ˆ x and x [31]. Moreover, due to the loss of original amplitude information, using A G ( x ) to replace A ( x ) entirely can also hurt the model's robustness [58]. As shown in Sec. 2, the mix-up operation on amplitude rarely has impact on the amplitude level robustness. That indicates the linear mix-up operation can preserve the energy of the amplitude spectrum and maintain the original amplitude information with less impact on the sample's original information. Otherwise, the original amplitude could be compromised, thereby hindering accurate model predictions. Following this line, a mix-up operation is employed, ensuring that a portion of the original amplitude information is preserved following:

The mix-up operation effectively satisfies C1 and C2 , ensuring ˆ x remains distinguishable by f θ , and keeping P (ˆ x ) 's patterns closer to those in P ( x ) in manifold. Finally, ˆ x is obtained by IDFT as

To elaborate on G ψ , we perform some experiments and provide visual results in Appendixes C and F.7. Now we can use ˆ x as an augmentation of x , introduced to Stage II for generating AEs.

3.2 Efficient Adversarial Example Generation

Since both x and ˆ x are fed into Stage II for generating AE, it doubles the time consumption if we use the same AE generation strategies as existing methods, e.g ., PGD-AT [40] and TRADES [39]. To improve the training efficiency of DAT, we now suggest an efficient AE generation strategy. Since simply reducing the iteration step results in the difficulty of AEs' reaching the actual maximum in the ℓ ∞ -ball [49], we propose the loss L AE to increase adversarial perturbation length in each iteration as

where β is a weighting parameter, and L CE and D KL are cross-entropy (CE) loss and Kullback-Leibler (KL) divergence. According to [49, 50], it is effective to enlarge adversarial perturbation length for each step by maximizing the distance between f θ ( x ) and f θ ( x ′ ) . Following this line, based on PGD-AT maximizing the L CE , the proposed L AE increases the adversarial perturbation step length by maximizing the KL divergence between benign sample and its AE. Then, with L AE , AEs can use fewer iterative steps to achieve the actual maximum in the ℓ ∞ -ball. As shown by experiments in Appendix F.5, DAT only needs 5 steps to generate AEs for both benign x and recombined x ′ , significantly reducing the training time while maintaining the model's robustness. Enlarging the inner step size α (in Eq. (10) of Appendix B.3) can also increase the adversarial perturbation length in each iteration. Due to the fact that the current AT methods typically employ a fixed α , we adopt an extra loss term for fair experimental comparisons. More details on the AE generation procedure, including pseudocodes and experimental analyses, are in Appendixes A.1, F.3 and F.5.

With the AAG and efficient AE generation, Stage III attempts to improve the model's robustness.

3.3 Joint Optimization

After the introduction to Stages I and II, we now delve into specifics of Stage III, joint optimization, where f θ and G ψ are optimized jointly following the objective as Eq. (3). In Stage III, to satisfy C2 in Sec. 3.1, keeping ˆ x with the same label as x by f θ , recombined and benign samples and their AEs are fed into DAT for the model training, also reducing the negative impact of amplitude information loss. Moreover, L DAT needs to be minimized on benign and recombined samples' AEs to enhance the robustness of f θ , enforcing f θ to focus on the phase patterns in the meanwhile. For commonly updating θ and adversarially renewing ψ , we introduce the designed loss terms L DAT as:

where L AT and D JS are adversarial training and consistency regularization losses respectively, and ω is the weighting parameter for D JS . We discuss L AT and D JS below separately.

Adversarial Training Loss L AT . L AT is the loss used to guide f θ to learn robust features on AEs against adversarial attacks. As shown in Figure 1, although adversarial perturbations significantly damage phase patterns, there are still some unaffected features in the phase of AEs, important for f θ to categorize AEs correctly. Since these unaffected phase patterns contain adversarial perturbations, it is difficult for f θ to learn these features only with AEs. Therefore, we utilize benign samples and their AEs in AT, guiding the model to learn their shared features, significant for improving f θ 's robustness. Following this line, L AT for ( x , y ) ∈ D with AE x ′ can be expressed as:

where β is the weighting parameter identical to that in Eq. (5). ˆ x adopts the same AT loss as that of x .

Consistency Regularization Loss D JS . D JS is the loss used to preserve the prediction consistency between x and ˆ x . In DAT, the amplitude of ˆ x 's frequency spectrum is mixed with the adversarial one generated by G ψ , maximizing L DAT , showing the large gap between h a ( x ) and h a ( ˆ x ) . Since ˆ x has the same phase patterns as x , keeping the prediction consistency between x and ˆ x can make the model learn more phase patterns further, enhancing the model's robustness. Inspired by the mechanism, we use the Jensen-Shannon (JS) divergence D JS to ensure the prediction consistency as:

This concludes the introduction to L DAT . Notably, during the model training of DAT, the gap of batch normalization (BN) parameters between x and ˆ x is quite large (details in Appendix D), posing challenges to model's convergence. To remedy this, we adopt different BNs for x and ˆ x during training. Please refer to the pseudocode of DAT in Appendix A.2 for a comprehensive presentation.

3.4 Theoretical Analysis

Through a convergence analysis of the empirical risk, this section theoretically discusses the effects of DAT on the model to focus on phase patterns. Detailed proofs are provided in Appendix G. Concretely, we instantiate g as a linear softmax classifier W = [ w 1 , ..., w c ] ∈ R m × c on top of the learned features h . Generally, for ( x , y ) ∈ D , suppose T ( x ) represents the augmented distribution over data points, where x can be transformed as anyone in { x , x ′ , ˆ x , ˆ x ′ } . Then, the augmented data for x can be denoted as t ( x ) ∼ T ( x ) . Since the augmentation will increase the discrepancy between original and augmented distributions w.h.p., we can establish a common assumption.

Assumption 3.1. Assume E T [ ∥ h ( t ( x )) -h ( x ) ∥ ] > ε 0 , where ε 0 > 0 is a relatively large value. Since only the amplitude spectrum is perturbed in the proposed DAT, it is reasonable that

Theorem 3.2 (Weight Regularization of Amplitude Features) . Grant Assumption 3.1, when the empirical risk ˆ R is minimized with some convex loss function L (e.g. CE loss):

we have w j,a → 0 for all j ∈ [ c ] , where w j,a is the corresponding weights of amplitude features h a

Corollary 3.3. Suppose the predicted probability f w ( x ) = [ p 1 , . . . , p c ] ⊤ , where

For every i, j ∈ [ c ] , we have ( w i,a -w j,a ) h a → 0 .

Remark. Theorem 3.2 suggests that for weights w j,a corresponding to features h a derived from amplitude pattern, minimizing the empirical risk ˆ R regularizes it to 0. As a result, it is difficult for the model to fit the adversarial amplitude generated by AAG. In order to converge, the model needs to reduce the reliance on h a by restricting w j,a . Hence, the model would mitigate the impact of h a on the predicted labels, as shown in Corollary 3.3, and pay more attention to features h p derived from phase patterns, capturing more phase patterns unaffected by adversarial attacks. Therefore, we can verify the effectiveness of DAT in enhancing the model's robustness.

4 Experiments

In this section, we perform experiments to verify the effectiveness of DAT and explore the function of some DAT's parts. Sec. 4.1 shows experimental setups. Sec. 4.2 compares the model's robustness with existing AT methods with fixed ϵ and α . Sec. 4.3 compares DAT with existing AT methods over complex strategy, e.g ., AWP and SWA. Sec. 4.4 presents the analysis of ablation studies.

4.1 Experimental Setup

Experimental and Evaluation Settings. We select three datasets: CIFAR-10, CIFAR-100, and Tiny ImageNet [17]. For all experiments in this work, ResNet-18, WideResNet-28-10 (WRN-28-10), and WideResNet-34-10 (WRN-34-10) are used as model architectures (experiments are attached to Appendix F.1), with β = 15 and ω = 2 (exploration in Appendix F.4). During training, the inner step size is fixed as α = 2 / 255 to generate adversarial perturbation ℓ ∞ -bounded with constant radius ϵ = 8 / 255 following [29, 37, 33] (details in Appendixes E.1 and E.2).

Baselines. We compare results with PGD-AT [40], TRADES [61], MART [54], and recent AT methods with competitive performance: LAS-AT [29], SCARL [33], and ST [37]. We also compare the DAT with OA-AT [2], DAJAT [1], and IDBH [35], which uses extra strategies, e.g ., AWP [56] and SWA [28]. Introduction and details of baselines are attached in Appendixes B.2 and E.3.

4.2 Comparison with Common Methods

In this subsection, we compare the robustness of DAT with common methods that use fixed ϵ and α during the training procedure. Table 1 displays the results on CIFAR-10, CIFAR-100, and

.

Tiny ImageNet using ResNet-18. Compared with existing methods, DAT not only improves the model's robustness but also enhances the natural accuracy. On CIFAR-10, DAT achieves an average improvement of ∼ 2.9% against FGSM, PGD-20, and PGD-100. For challenging C&W ∞ and AA, DAT obtains ∼ 0.66% and ∼ 0.85% improvement, respectively. Specifically, since SCARL adopts a contrastive learning strategy, DAT achieves less improvement against C&W ∞ compared to it. CIFAR-100 contains more classes but fewer samples for each class, thereby making it challenging for AT. DAT enhances the model's robustness by ∼ 2.7% on average against FGSM, PGD-20, and PGD-100 compared to the existing methods. For the demanding C&W ∞ and AA, the model's robustness is improved by ∼ 1.5% and ∼ 1.3%. On the intricate real-world dataset Tiny ImageNet, DAT achieves ∼ 2.9% better performance against FGSM, PGD-20, and PGD-100. For the challenging C&W ∞ and AA, we enhance the model's robustness by ∼ 1.6% and ∼ 1.2%. AWP is proved to be an effective method for protecting the model from robust overfitting. To further improve the model's robustness, we combine DAT with AWP, and compare the performance with the combination of various existing methods and AWP fairly. Since a few methods provide the codes for the combination with AWP, we choose only these methods for comparison. As shown in Table 1, the combination of DAT and AWP improves the model's robustness further and still outperforms previous methods.

Large-capacity models usually have better adversarial robustness. Thus, we also perform comparative experiments using WRN-34-10 on CIFAR-10 and CIFAR-100, as shown in Table 2. Compared to existing methods, DAT still retains better performance and has a lower negative impact on the model's natural accuracy, achieving ∼ 1.51%, ∼ 0.63%, and ∼ 1.31% robust accuracy improvement

on CIFAR-10 with WRN-34-10. On CIFAR-100, the robustness obtained by DAT is enhanced by ∼ 2.56%, ∼ 1.68%, and ∼ 1.27%, showing significant improvement compared to existing methods.

4.3 Comparison with Complex Strategy Based Methods

After the comparison of common methods, we then demonstrate the performance of some existing methods with extra strategies, e.g ., AWP and SWA. Addepalli et al . [1] find that variable ϵ and α can enhance the model's robustness, and some methods using variable ϵ and α ( e.g ., DAJAT, OA-AT, and IDBH) obtain competitive performance against various adversarial attacks. To further verify the effectiveness of DAT, we compare it with the latest competitive methods, e.g ., DAJAT with one augmentation, OA-AT and IDBH, see Appendix B.2. As shown in Table 3, fixing ϵ = 8 / 255 and α = 2 / 255 , we combine DAT with AWP and SWA. Compared with IDBH, on CIFAR-10 with ResNet18 and WRN-34-10, DAT with AWP and SWA achieves robust improvement ∼ 1.36% and ∼ 1.18% against PGD-20, and ∼ 0.45% and ∼ 0.48% against AA. For complex CIFAR-100 with ResNet-18 and WRN-34-10, compared with the previous best method, our method obtain ∼ 1.8% and ∼ 1.54% improvement against PGD-20, and ∼ 0.45% and ∼ 0.30% enhancement against AA. Additionally, we perform with synthesized data and augmentation strategies, attached in Appendixes F.1 and F.2.

4.4 Ablation Study

Through experiments on CIFAR-10 and CIFAR-100, this subsection discusses the impact of different components in DAT on the model's natural accuracy and robustness against PGD-20 and AA. As shown in Table 4, we use the model with the proposed AE generation method without recombined data as the baseline. Compared with complete DAT, the robustness is decreased ∼ 0.3% and ∼ 0.5% on CIFAR-10 and CIFAR-100 without D JS . Due to D JS keeping the predictions consistent between the benign and recombined data, removing D JS makes the model learn less unaffected phase patterns and thus reduces the robust performance. As mentioned in Sec. 3.1, the mix-up operation combines the generated adversarial and original amplitude spectrum. Since the model still needs some original amplitude information, Table 4 shows that replacing the original amplitude spectrum with the generated one drops ∼ 1.6% and ∼ 1.9% model's robustness on CIFAR-10 and CIFAR-100, due to damaging original phase patterns. As mentioned in Sec. 3.3, the gap of BN parameters between original and recombined data is quite large. Without split BNs, the robustness of the model is reduced ∼ 4.6% and ∼ 3.5% on CIFAR-10 and CIFAR-100, showing that the model robustness is significantly affected because of the convergence difficulty. For experiments without AAG, we mix the amplitude of training sample's frequency spectra as Sec. 2. Table 4 shows the selected amplitude does not severely reduce the natural accuracy but significantly decreases robustness ∼ 1.6% and ∼ 2.2% on CIFAR-10 and CIFAR-100, confirming the effectiveness of AAG. To comprehensively

explore the effectiveness of AAG, we combine AAG with some existing AT methods on ResNet-18, see Appendixes F.6 and F.7. Additionally, we compare the time consumption in Appendix F.3.

5 Conclusion

This work presents a novel Dual Adversarial Training (DAT) method to improve adversarial robustness against various adversarial attacks. We first illustrate the motivation through some exploration experiments. Subsequently, we delve into the efficient and effective DAT, discussing both its underlying motivation and detailed mechanics. Additionally, we theoretically validate the functionality of the Adversarial Amplitude Generator (AAG) and the convergence properties of the DAT model. Through experiments across multiple datasets against various adversarial attacks, we verify that the proposed DAT significantly improves model robustness. We also explore the hyper-parameters and discuss the function of specific components of DAT. In the future, we will design a more suitable amplitude generation and augmentation strategy to enhance robustness further.

References

Sravanti Addepalli, Samyak Jain, and Venkatesh Babu R. Efficient and effective augmentation strategy for adversarial training. In Proceedings of NeurIPS, November 28 - December 9, 2022, New Orleans, LA, USA , pages 1488-1501, 2022.

Sravanti Addepalli, Samyak Jain, Gaurang Sriramanan, and R. Venkatesh Babu. Scaling adversarial training to large perturbation bounds. In Proceedings of ECCV, October 23-27, 2022, Tel Aviv, Israel , pages 301-316, 2022.

Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: A query-efficient black-box adversarial attack via random search. In Proceedings of ECCV, August 23-28, 2020, Glasgow, UK , pages 484-501, 2020.

Jiawang Bai, Bin Chen, Yiming Li, Dongxian Wu, Weiwei Guo, Shu-Tao Xia, and En-Hui Yang. Targeted attack for deep hashing based retrieval. In Proceedings of ECCV, August 23-28, 2020, Glasgow, UK , pages 618-634, 2020.

Jiawang Bai, Baoyuan Wu, Yong Zhang, Yiming Li, Zhifeng Li, and Shu-Tao Xia. Targeted attack against deep neural networks via flipping limited weight bits. In Proceedings of ICLR, May 3-7, 2021, Virtual Event, Austria , 2021.

Yang Bai, Yuyuan Zeng, Yong Jiang, Shu-Tao Xia, Xingjun Ma, and Yisen Wang. Improving adversarial robustness via channel-wise activation suppressing. In Proceedings of ICLR, May 3-7, 2021, Virtual Event, Austria , 2021.

Guangyao Chen, Peixi Peng, Li Ma, Jia Li, Lin Du, and Yonghong Tian. Amplitude-phase recombination: Rethinking robustness of convolutional neural networks in frequency domain. In Proceedings of ICCV, October 10-17, 2021, Montreal, QC, Canada , pages 448-457, 2021.

Huanran Chen, Yichi Zhang, Yinpeng Dong, and Jun Zhu. Rethinking model ensemble in transfer-based adversarial attacks. CoRR , abs/2303.09105, 2023.

Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. ZOO: zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In Proceedings of AISec@CCS, November 3, 2017, Dallas, TX, USA , pages 15-26, 2017.

Shuyu Cheng, Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Improving black-box adversarial attacks with a transfer-based prior. In Proceedings of NeurIPS, December 8-14, 2019, Vancouver, BC, Canada , pages 10932-10942, 2019.

Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: a standardized adversarial robustness benchmark. arXiv preprint arXiv:2010.09670 , 2020.

Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with a fast adaptive boundary attack. In Proceedings of ICML, July 13-18, 2020, Virtual Event , pages 2196-2205, 2020.

Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In Proceedings of ICML, July 13-18, 2020, Virtual Event , pages 2206-2216, 2020.

Ekin D. Cubuk, Barret Zoph, Dandelion Mané, Vijay Vasudevan, and Quoc V. Le. Autoaugment: Learning augmentation strategies from data. In Proceedings of CVPR, June 16-20, 2019, Long Beach, CA, USA , pages 113-123, 2019.

Jiequan Cui, Zhuotao Tian, Zhisheng Zhong, Xiaojuan Qi, Bei Yu, and Hanwang Zhang. Decoupled kullback-leibler divergence loss. CoRR , abs/2305.13948, 2023.

Tri Dao, Albert Gu, Alexander Ratner, Virginia Smith, Chris De Sa, and Christopher Ré. A kernel theory of modern data augmentation. In Proceedings of ICML, June 9-15, 2019, Long Beach, California, USA , pages 1528-1537, 2019.

Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In Proceedings of CVPR, June 20-25, 2009, Miami, Florida, USA , pages 248-255, 2009.

Terrance Devries and Graham W. Taylor. Improved regularization of convolutional neural networks with cutout. CoRR , abs/1708.04552, 2017.

Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In Proceedings of CVPR, June 18-22, 2018, Salt Lake City, UT, USA , pages 9185-9193, 2018.

Yanbo Fan, Baoyuan Wu, Tuanhui Li, Yong Zhang, Mingyang Li, Zhifeng Li, and Yujiu Yang. Sparse adversarial attack via perturbation factorization. In Proceedings of ECCV, August 23-28, 2020, Glasgow, UK , pages 35-50, 2020.

Ross Girshick. Fast r-cnn. In Proceedings of the CVPR, June 7-12, 2015, Boston, MA, USA , pages 1440-1448, 2015.

Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Proceedings of ICLR, May 7-9, 2015, San Diego, CA, USA , 2015.

Sven Gowal, Sylvestre-Alvise Rebuffi, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy A. Mann. Improving robustness using generated data. In Proceedings of NeurIPS, December 6-14, 2021, virtual , pages 4218-4233, 2021.

Yiwen Guo, Qizhang Li, and Hao Chen. Backpropagating linearly improves transferability of adversarial examples. In Proceedings of NeurIPS, December 6-12, 2020, virtual , 2020.

Kaiming He, Georgia Gkioxari, Piotr Dollár, and Ross Girshick. Mask r-cnn. In Proceedings of the ICCV, October 22-29, 2017, Venice, Italy , pages 2961-2969, 2017.

Zhuoxun He, Lingxi Xie, Xin Chen, Ya Zhang, Yanfeng Wang, and Qi Tian. Data augmentation revisited: Rethinking the distribution gap between clean and augmented data. CoRR , abs/1909.09148, 2019.

Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. In Proceedings of ICML, July 10-15, 2018, Stockholmsmässan, Stockholm, Sweden , pages 2142-2151, 2018.

Pavel Izmailov, Dmitrii Podoprikhin, Timur Garipov, Dmitry P. Vetrov, and Andrew Gordon Wilson. Averaging weights leads to wider optima and better generalization. In Proceedings of UAI, August 6-10, 2018, Monterey, California, USA , pages 876-885, 2018.

Xiaojun Jia, Yong Zhang, Baoyuan Wu, Ke Ma, Jue Wang, and Xiaochun Cao. LAS-AT: adversarial training with learnable attack strategy. In Proceedings of CVPR, June 18-24, 2022, New Orleans, LA, USA , pages 13388-13398, 2022.

Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine. Elucidating the design space of diffusion-based generative models. In Proceedings of NeurIPS, November 28 - December 9, 2022, New Orleans, LA, USA , pages 26565-26577, 2022.

Minyoung Kim, Da Li, and Timothy M. Hospedales. Domain generalisation via domain adaptation: An adversarial fourier amplitude approach. In Proceedings of ICLR, May 1-5, 2023, Kigali, Rwanda , 2023.

Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks. Commun. ACM , 60(6):84-90, 2017.

Huafeng Kuang, Hong Liu, Yongjian Wu, and Rongrong Ji. Semantically consistent visual representation for adversarial robustness. IEEE Trans. Inf. Forensics Secur. , 18:5608-5622, 2023.

Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial intelligence safety and security , pages 99-112. Chapman and Hall/CRC, 2018.

Lin Li and Michael W. Spratling. Data augmentation alone can improve adversarial training. ArXiv , abs/2301.09879, 2023.

Qizhang Li, Yiwen Guo, and Hao Chen. Practical no-box adversarial attacks against DNNs. In Proceedings of NeurIPS, December 6-12, 2020, virtual , 2020.

Qizhang Li, Yiwen Guo, Wangmeng Zuo, and Hao Chen. Squeeze training for adversarial robustness. In Proceedings of ICLR, May 1-5, 2023, Kigali, Rwanda , 2023.

Xin Li, Yao Qiang, Chengyin Li, Sijia Liu, and Dongxiao Zhu. Saliency guided adversarial training for learning generalizable features with applications to medical imaging classification system. CoRR , abs/2209.04326, 2022.

Yandong Li, Lijun Li, Liqiang Wang, Tong Zhang, and Boqing Gong. NATTACK: learning the distributions of adversarial examples for an improved black-box attack on deep neural networks. In Proceedings of ICML, June 9-15, 2019, Long Beach, California, USA , pages 3866-3876, 2019.

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In Proceedings of ICLR, April 30 - May 3, 2018, Vancouver, BC, Canada , 2018.

Mehdi Mirza and Simon Osindero. Conditional generative adversarial nets. CoRR , abs/1411.1784, 2014.

Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Jonathan Uesato, and Pascal Frossard. Robustness via curvature regularization, and vice versa. In Proceedings of CVPR, June 16-20, 2019, Long Beach, CA, USA , pages 9078-9086, 2019.

Raphaël Olivier, Bhiksha Raj, and Muhammad Shah. High-frequency adversarial defense for speech and audio. In Proceedings of ICASSP, June 6-11, 2021, Toronto, ON, Canada , pages 2995-2999, 2021.

Tianyu Pang, Min Lin, Xiao Yang, Jun Zhu, and Shuicheng Yan. Robustness and accuracy could be reconcilable by (proper) definition. In Proceedings of ICML, July 17-23, 2022, Baltimore, Maryland, USA , pages 17258-17277, 2022.

Nicolas Papernot, Patrick D. McDaniel, Ian J. Goodfellow, Somesh Jha, Z. Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. In Proceedings of AsiaCCS, April 2-6, 2017, Abu Dhabi, United Arab Emirates , pages 506-519, 2017.

Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision. In Proceedings of ICML, July 18-24, 2021, Virtual Event , pages 8748-8763, 2021.

Sylvestre-Alvise Rebuffi, Sven Gowal, Dan A. Calian, Florian Stimberg, Olivia Wiles, and Timothy A. Mann. Fixing data augmentation to improve adversarial robustness. CoRR , abs/2103.01946, 2021.

Leslie Rice, Eric Wong, and J. Zico Kolter. Overfitting in adversarially robust deep learning. In Proceedings of ICML, July 13-18, 2020, Virtual Event , pages 8093-8104, 2020.

Gaurang Sriramanan, Sravanti Addepalli, Arya Baburaj, and Venkatesh Babu R. Guided adversarial attack for evaluating and enhancing adversarial defenses. In Proceedings of NeurIPS, December 6-12, 2020, virtual , pages 20297-20308, 2020.

Gaurang Sriramanan, Sravanti Addepalli, Arya Baburaj, and Venkatesh Babu R. Towards efficient and effective adversarial training. In Proceedings of NeurIPS, December 6-14, 2021, virtual , pages 11821-11833, 2021.

Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In Proceedings of ICLR, April 14-16, 2014, Banff, AB, Canada , 2014.

Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. In Proceedings of ICLR, May 6-9, 2019, New Orleans, LA, USA , 2019.

Haohan Wang, Xindi Wu, Zeyi Huang, and Eric P. Xing. High-frequency component helps explain the generalization of convolutional neural networks. In Proceedings of CVPR, June 13-19, 2020, Seattle, WA, USA , pages 8681-8691, 2020.

Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In Proceedings of ICLR, April 26-30, 2020, Addis Ababa, Ethiopia , 2020.

Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan. Better diffusion models further improve adversarial training. In Proceedings of ICML, July 23-29, 2023, Honolulu, Hawaii, USA , pages 36246-36263, 2023.

Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. In Proceedings of NeurIPS, December 6-12, 2020, virtual , pages 2958-2969, 2020.

Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L. Yuille. Improving transferability of adversarial examples with input diversity. In Proceedings of CVPR, June 16-20, 2019, Long Beach, CA, USA , pages 2730-2739, 2019.

Qinwei Xu, Ruipeng Zhang, Ya Zhang, Yanfeng Wang, and Qi Tian. A fourier-based framework for domain generalization. In Proceedings of CVPR, June 19-25, 2021, virtual , pages 1438314392, 2021.

Dong Yin, Raphael Gontijo Lopes, Jonathon Shlens, Ekin Dogus Cubuk, and Justin Gilmer. A fourier perspective on model robustness in computer vision. In Proceedings of NeurIPS, December 8-14, 2019, Vancouver, BC, Canada , pages 13255-13265, 2019.

Sangdoo Yun, Dongyoon Han, Sanghyuk Chun, Seong Joon Oh, Youngjoon Yoo, and Junsuk Choe. Cutmix: Regularization strategy to train strong classifiers with localizable features. In Proceedings of ICCV, October 27 - November 2, 2019, Seoul, Korea (South) , pages 6022-6031, 2019.

Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. In Proceedings of ICML, June 9-15, 2019, Long Beach, California, USA , volume 97, pages 7472-7482, 2019.

Xinze Zhang, Junzhe Zhang, Zhenhua Chen, and Kun He. Crafting adversarial examples for neural machine translation. In Proceedings of ACL/IJCNLP, August 1-6, 2021, Virtual Event , pages 1967-1977, 2021.

Dawei Zhou, Nannan Wang, Heng Yang, Xinbo Gao, and Tongliang Liu. Phase-aware adversarial defense for improving adversarial robustness. In Proceedings of ICML, July 23-29, 2023, Honolulu, Hawaii, USA , pages 42724-42741, 2023.

Wei Zou, Shujian Huang, Jun Xie, Xinyu Dai, and Jiajun Chen. A reinforced generation of adversarial examples for neural machine translation. In Proceedings of ACL, July 5-10, 2020, Online , pages 3486-3497, 2020.

Appendix

Table of Contents

This appendix provides additional support to the main ideas presented in the submission. The general pipeline is as follows:

§A presents the algorithms of the proposed efficient AE generation and DAT.

§B presents comprehensive related works, including adversarial attack and adversarial training methods.

§C presents additional details of AAG ( e.g ., mix-up operation and λ range).

§D presents the gap of BN parameters for benign and recombined data, showing the reason for the split BN operation in the model training of DAT.

§E presents more information about the training settings and selected datasets.

§F presents omitted experimental results ( e.g ., synthesized methods, data augmentation strategies and training time, iteration K and different inputs of AAG).

§G presents explanation and proof for Theorem 3.2.

A Pseudocodes of AE Generation and DAT

A.1 Pseudocode of the AE Generation Method

Algorithm 1 EFFICIENT ADVERSARIAL EXAMPLE GENERATION (EAEG)

A.2 Pseudocode of DAT

Algorithm 2 DUAL ADVERSARIAL TRAINING (DAT)

B Related Work & Background

B.1 Adversarial Attacks

With the heightened attention on DNN vulnerabilities, numerous adversarial attack methods have developed to study the model's robustness. FGSM [22] generates AEs by applying a gradient on benign samples in a single iteration step. Building upon I-FGSM [34], PGD [40] emerges as the strongest first-order attack, amplifying the adversarial impact of AEs. In order to reduce the difficulty of parameter settings in FGSM, the accurate and efficient Deepfool [42] is developed. To enhance the effect of PGD attack, APGD, and APGD-DLR are proposed [13]. These methods have alternative loss functions and do not require an inner step size in the AEs' generation procedure. However, these white-box attacks require detailed knowledge of the target model to generate AEs, which poses challenges in practical scenarios. To address this challenge, black-box [45, 9, 27, 10, 57, 24] and no-box [45, 36] adversarial attacks are proposed. For a comprehensive evaluation of model robustness, ensemble adversarial attacks consisting of multiple types of adversarial attacks become popular. AutoAttack (AA) [13] stands out as a representative ensemble attack approach, seamlessly integrating white-box attacks including APGD, APGD-DLR, and FAB [12], alongside a black-box attack called Square attack [3]. AA is broadly recognized as a benchmark tool for the robustness evaluation of models.

B.2 Adversarial Training

In an effort to protect models from adversarial attacks, various methodologies have been developed. Adversarial training is one of the most effective methods for countering adversarial attacks [64, 62, 4, 5, 19, 20, 40, 61, 1, 35]. PGD-AT [40] formulates AT as a min-max optimization problem. AEs are first generated via PGD and then fed into the trained model to minimize empirical risk. To address the robust overfitting issues, early stopping of PGD-AT is proposed to further enhance the model's robustness [48]. However, PGD-AT only takes AEs into the training procedure. This approach, due to the data distribution shift between AEs and benign samples, can diminish the model's accuracy. To make a better tradeoff between accuracy and robustness, TRADES [61] takes both benign samples and AEs into the AT procedure. Motivated by weight perturbation methods in standard training, Adversarial Weight Perturbation (AWP) [56] adversarially perturbs both inputs and weights, markedly easing the robust overfitting issues and improving adversarial robustness. Additionally, Stochastic Weight Averaging (SWA) [28] is also a frequently used technology to reduce the negative impact of robust overfitting issues and enhance the model's robustness. Misclassification Aware adveRsarial Training (MART) [54] adopts misclassified training samples as regularizers to enhance the model's robustness against AEs generated by various adversarial attacks. Instead of generating AEs by maximizing the prediction distance between AEs and benign samples as in TRADES, Squeeze Training (ST) [37] selects a better reference target and uses collaborative examples to benign ones, produced by minimizing the prediction distance between collaborative and benign samples. Different from existing hand-crafted strategy based AT, Adversarial Training with Learnable Attack Strategy (LAS-AT) [29] generates AEs by a reinforcement learning network. Motivated by Contrastive Language-Image Pre-training (CLIP) [46], Semantic Constraint Adversarial Robust Learning (SCARL) [33] uses the text information to obtain robust semantic information of training samples, improving the model's robustness. Due to the positive impact of data augmentation on AT, Diverse Augmentation-based Joint Adversarial Training (DAJAT) [1] uses AutoAugment, SWA, and AWP to achieve an effective AT. To reduce the time consumption of AE generation, DAJAT adopts variable adversarial perturbation radius ϵ and inner step size α to reduce the iteration steps. OA-AT [2] uses SWA and variable ϵ and α to protect the model from AEs with large adversarial magnitudes. Li et al . [35] show that the effectiveness of data augmentations on robustness improvement depends on their impacts on the model's robust accuracy on test data, referred to as hardness. Moreover, the work proves that augmentation strategies with moderate hardness can protect the model from robust overfitting issues and enhance the model's robustness. Based on the phenomena, with variable adversarial perturbation radius ϵ , Improved Diversity and Balanced Hardness (IDBH) [35] combines several data augmentation strategies to obtain significant robustness improvement against various adversarial attacks. Recently, motivated by the stable diffusion (SD) model [30], some methods [47, 23, 15, 55, 44] synthesize data by SD to enhance the model's robustness further.

B.3 Generation of Adversarial Example in Adversarial Training

PGD-AT [40] formulates a min-max strategy to inject AEs into AT. The optimization objective is

where x ′ i is the AE for x i , and L CE represents the cross-entropy (CE) loss. To achieve a better tradeoff between natural and robust accuracy, TRADES [61] incorporates both AEs and benign samples into training as

where β is a weight parameter, and D KL represents the Kullback-Leibler (KL) divergence.

For ( x , y ) ∈ D , its corresponding AE x ′ is initialized by adding a random noise ( e.g ., uniform noise in PGD and Gaussian noise in TRADES) on x , then iteratively updated by K steps following

where Π( · ) is the projection operator, α is the projection inner step size, and k ∈ { 0 , ..., K -1 } , with K typically set to 10.

B.4 Discrete Fourier Transform

DFT transforms an image signal from the spatial domain into the frequency domain, while the inverse discrete Fourier transform (IDFT) reverses this process. Let F ( · ) and F -1 ( · , · ) denote the DFT and IDFT functions, respectively. Typically, DFT is independently applied to each channel of an image within the pixel space. An image x can be transformed into the frequency domain as follows:

where ( h, w ) denotes the pixel coordinates of x , and ( u, v ) ∈ [ H ] × [ W ] signifies coordinates in the frequency domain. The real and imaginary parts of F ( x ) are denoted by Re( F ( x )) and Im( F ( x )) , respectively. Then, the amplitude spectrum A ( x ) and phase spectrum P ( x ) are defined as follows:

C Experiments of the Amplitude Spectrum Operation

To better explore the proposed AAG, we present the amplitude spectrum mix-up operation visually and explore the impact of the λ range on the model's robustness in this part. First, we display and explain the visual results of the recombined samples and show the impact of the mix-up operation on the model's performance. Then, the experimental results of DAT with different ranges of λ are shown.

C.1 Visualization of the Mix-up Operation on Amplitude Spectrum

Figure 8 (see page 28) shows the benign samples, amplitude spectrum, phase spectrum, generated amplitude spectrum, and recombined data. Compared to images with mixed amplitude spectrum, data recombined by replacing the original amplitude from the generated one entirely has a great gap for the original benign samples, reducing the natural and robust accuracy of the benign test samples. To better show the impact of the different strategies on the model's performance, we perform experiments with and without the mix-up operation. Table 5 shows the DAT with mix-up has a better performance. That indicates the model still needs some original information on the amplitude spectrum, showing the effectiveness of the mix-up operation.

































(a) Natural accuracy of DAT with different µ .

































(b) Robust accuracy against AA of DAT with different µ .

C.2 Impact of the Range of Amplitude Mixture Parameters

In this subsection, to fully explore the impact of the λ range on the model's robustness, we perform some experiments to show the impact of different λ on the natural and robust accuracy. As shown in the work, the mix-up operation to perturb A ( x ) by the generated A G ( x ) follows

where 0 < λ < 1 , reserving some information of A ( x ) . Suppose that λ ∼ Uniform(0 , µ ) , where 0 < µ < 1 , we perform experiments with different values of µ on CIFAR-10 and CIFAR-100 against AA, where β = 15 and ω = 2 . As shown in Figures 4a and 4b, the test accuracy fluctuations between different values of µ are quite large, and the best settings of µ for natural and robust accuracy for CIFAR-10 and CIFAR-100 are different. For CIFAR-10, the model achieves the best natural performance when µ = 0 . 6 , while its robust accuracy is better with µ = 0 . 8 . For results on CIFAR-100, µ = 0 . 4 makes the best natural accuracy when the model achieves better robustness with µ = 0 . 6 . In the work, there are already two hyper-parameters: ω and β . Moreover, the range of λ is more likely to influence the settings of ω and β . Consequently, we do not discuss the impact of different ranges of λ on the model's robust and natural accuracy in the main paper.

For the real-valued x , it is noticed that F ( · ) need to be even-conjugate, i.e ., F ( x )( -u, -v ) = F ( x )( u, v ) , implying that the amplitude spectrum is symmetric. Conversely, IDFT returns realvalued signals for a symmetric amplitude spectrum. Consequently, G ψ only generates A G with the non-redundant and non-negative part of the amplitude spectrum.

D Batch Normalization Parameter Analysis

In the DAT training procedure, we use different BNs for the benign data and their recombined samples. In the ablation study, we show the model performances with and without a split BN are quite different, showing that the single BN significantly influences the model's performance. To better present the necessity of the split BN in DAT training, we show the cosine similarity of the parameters of each BN layer between benign data and recombined ones. There are 20 BN layers in ResNet-18. From Figures 5a and 5b, on both CIFAR-10 and CIFAR-100, we can see the cosine similarity gaps for BN parameters in different layers. The distance between the mean and variance of each BN layer is small, while the gaps between the γ s and β s are large, especially in the low-level layers and the



















 

















































 

























last layer. Consequently, using a single BN in the training procedure of DAT is likely to result in the difficulty of model convergence, showing as the performance comparisons in the ablation study. To solve the issue, we adopt different BNs for the original data and the recombined ones. In the model training procedure of DAT, we split the BN into two groups: BN-A and BN-B, for each layer with BN, original data and its AE are processed by BN-A, while recombined one and its AE are regularized by BN-B.

E Detailed Experimental Setup

In this section, we add more details about the datasets and experimental settings. Moreover, the information about the robust evaluation is further introduced.

E.1 Datasets

To evaluate the performance of DAT, we select three widely used benchmark datasets for robust evaluation: CIFAR-10, CIFAR-100, and complex Tiny ImageNet [17]. CIFAR-10 and CIFAR-100 contain 50,000 32×32 training samples and 10,000 32×32 test images, categorized into 10 and 100 classes respectively. Tiny ImageNet is a challenge 200-class real-world dataset, where there are 500 training and 50 test images for each category, where the image size is 64×64. Moreover, due to the samples in the test set of Tiny ImageNet without labels, we evaluate the robustness of the validation set following [29, 33].

E.2 Training Settings

We use ResNet-18, WRN-34-10, and WRN-28-10 as model architectures. Experiments with ResNet18 are performed on Ubuntu 20.04.3 LTS GPU server with Intel Xeon 5120 and 5×3090 by PyTorch 2.0, while WRN-34-10 and WRN-28-10 experiments are performed on DGX with a H800 GPU on PyTorch 2.0. In the model training procedure, we adopt an SGD optimizer with momentum 0.9 and weight decay 5e-4. For the common experiments, the model is trained for 150 epochs for CIFAR-10 and CIFAR-100 and 100 epochs for Tiny ImageNet. Moreover, the learning rate follows the schedule [0 . 1 , 0 . 01 , 0 . 001] in decay epoch schedule [100 , 110] in CIFAR-10 and CIFAR-100 and in decay epoch schedule [75 , 80] for Tiny ImageNet. For these datasets, the experiments with AWP or the combination of AWP and SWA use the same learning rate schedule with decay epoch as [100 , 150] .

For the proposed AAG, we use a four-linear layer structure to build it. Since only the non-negative part of the amplitude spectrum is produced, the output of AAG is processed by a Sigmoid function. In the model training procedure, we set the dimension of z as τ = 100 . Due to the input of AAG combined by z and sample logits extracted by f θ , the input dimension of AAG is the sum of τ and class number c of D .

The AAG is optimized by an SGD optimizer with a fixed learning rate 0.1, momentum 0.9, and weight decay 5e-4. For hyper-parameters, β and JS weight parameter ω are set as 15 and 2 respectively. During the training procedure, we adopt the basic data augmentation strategies, Random Crop and Random Horizontal Flip, for all selected datasets. For AE generation, the inner step size α is set to 2 / 255 with K = 5 to generate adversarial perturbation ℓ ∞ -bounded with radius ϵ = 8 / 255 following previous work [29, 37, 33].

E.3 Baselines

For experimental result comparisons in this work, we select two typical PGD-AT and TRADES [40, 61] as baselines. Moreover, we adopt two types of existing methods to perform experimental result comparisons. For common type AT methods, which are trained with fixed ϵ = 8 / 255 and inner step size α = 2 / 255 and without any extra technologies, we select MART [54], ST [37], LAS-AT [29] and SCARL [33]. Additionally, some methods with complex strategies, such as AWP, SWA, variable ϵ , and changeable α are also selected as baselines. For AutoAugment-based DAJAT [1] consisting of AT, SWA, variable ϵ and α , we select it with one augmentation for a fair comparison. OA-AT [2] is a variable ϵ based AT method with SWA. IDBH [35] is an AT method based on the augmentation combination of Cropping, CutOut, and ColorShape, and is combined with AWP and SWA strategies.

E.4 Robustness Evaluation

For the experimental results, we report the model's natural and robust accuracy. We select several widely used types of adversarial attacks to generate AEs for robustness evaluation. FGSM, PGD20, PGD-100, and C&W ∞ are selected as basic methods to evaluate the model's robustness. To better show the model's robust generalization against different adversarial attacks, we also select AA consisting of black-box and white-box methods to evaluate the robustness of the model. The adversarial perturbation of these methods is ℓ ∞ -bounded with radius ϵ = 8 / 255 and inner step size α = 2 / 255 .

F Additional Results and Discussion

Due to the limitation of the pages, we perform some experiments on CIFAR-10 and CIFAR-100 to show the effectiveness of our proposed DAT further. In the first section, we show the experimental results on generated data with WRN-28-10. The experimental comparison between proposed DAT and some data augmentation strategies are presented in the second section. Then, we show the time consumption comparison between DAT and existing methods in the third part. The fourth subsection discusses the impact of different β and ω . Then, the impact of iteration K of AE generation on the model's performance is explored in the fifth subsection. In the sixth part, the AAG is combined with existing methods to verify its effectiveness. Then, we explore the influence of AAG's input. The last two subsections show the results comparison of single and dual AE generation of DAT and limitations of the work.

F.1 Comparison for Different AT Methods with Generated Data

In this subsection, following [47, 23, 15, 55, 44], we take advantage of the diffusion model to synthesize data enhance the model's robustness further. Since these existing methods are combined with strategies such as AWP, SWA, variable ϵ and changed α , we use the DAT with AWP and SWA to show the experimental results comparison. Due to methods only providing single-time results, we just use the one-time test accuracy of DAT to compare with them on WRN-28-10. From Table 6, compared with IKL-AT [15], we can see DAT achieves about ∼ 0.69% and ∼ 0.48% robustness improvement with 1M and 20M generated data on CIFAR-10. On CIFAR-100, as shown in Table 7, for current IKL-AT, the method with the best robustness against AA with WRN-28-10 on the RobustBench [11], the model robustness is enhanced by ∼ 0.29% and ∼ 0.23% with 1M and 50M synthesized samples, respectively.

F.2 Comparison of DAT with Different Augmentations

Since the recombined data based on AAG can be regarded as an augmentation for benign samples, to better present the effectiveness of the proposed strategy, we combine the proposed AE generation method with three widely used augmentation policies in AT, such as CutOut [18], CutMix [60], and AutoAugment [14], and perform experiments on CIFAR-10 and CIFAR-100. The settings of CutMix and CutOut are as [35], while AutoAugment follows [1]. In these experiments, the baseline is AT with the proposed AE generation strategy. These selected data augmentation strategies adopt the same training strategy as DAT. As shown in Table 8, for the baseline, these augmentations enhance the model's robustness against PGD-20 and AA. Compared to other strategies, DAT achieves robustness improvement of ∼ 1% on CIFAR-10 and ∼ 1.2% on CIFAR-100.

F.3 Comparison of Training Time Consumption

In this part, we compare the time consumption of different methods on CIFAR-10 and CIFAR-100. From Table 9, we can obtain the time consumption of DAT is slightly higher than PGD-AT and TRADES because of added AAG. Compared with recently proposed methods, DAT takes less time and achieves better robustness.

F.4 Hyper-parameter Exploration

After the performance comparisons, we then explore the settings of β and ω by experiments on CIFAR-10 and CIFAR-100. Additionally, the λ 's range and the iteration step K of AE generation are also discussed, attached to Appendixes C.2 and F.5.

Setting of β . As shown in Figure 6a of Appendix F.4, we present the model's natural and robust accuracy with different β with ω = 2 and K = 5 . We can see that the curves of robust accuracy rise first and then fall. Meanwhile, natural accuracy keeps decreasing as β increases, indicating that β significantly influences the model's natural and robust accuracy. To achieve a better tradeoff between robust and natural accuracy, we set β = 15 for experiments of DAT on all datasets.

Setting of ω . With β = 15 and K = 5 , we discuss the settings of ω . Figure 6b shows the model's accuracy changes along with ω on both natural and AE. When ω < 2 , the curves of robust accuracy rise. On the contrary, ω > 2 results in the performance decreasing. Unlike the robust accuracy, the model's performance on benign samples grows with the increase of ω . For better model robustness, ω is set as 2 in this work.















































































(a) Impact of β on natural and robust accuracy.

(b) Impact of ω on natural and robust accuracy.

Figure 6: The impact of ω and β on the model's natural (Na.) and robust accuracy (Rob.) against AA on CIFAR-10 (C-10) and CIFAR-100 (C-100) with ResNet-18.

F.5 Iteration Step K of AE Generation

The generation iteration step K has an extremely important impact on the model's robust accuracy. As shown in Figure 7, the larger the iteration step, the adversarial robustness against AA of the model rises with the increase of K . However, the larger K will significantly increase the time consumption of AT. To achieve a tradeoff between the model's robustness and time consumption, we set the iteration step as K = 5 . Then, the time consumption of DAT will not be increased compared with existing methods.

F.6 AAG with Existing AT Methods

To further show the effectiveness of the proposed AAG, we combine AAG with PGD-AT and TRADESandperform experiments on CIFAR-10 and CIFAR-100 against PGD-20 and AA. Compared

















































with PGD-AT and TRADES, the combinations with AAG enhance the model's robust and natural accuracy further.

F.7 Impact of Different Inputs of G ψ

For the Generative Adversarial Nets (GANs), Conditional GANs (CGANs) [41] usually have higher quality generative results than vanilla ones. Consequently, motivated by CGAN, we use a combination of the sample logits from model f θ and stochastic sampling noise vector z ∼ N ( 0 , I ) following a standard Gaussian distribution as input of G ψ , which is different CGAN with one-hot label. To better show the effectiveness, we perform experiments on CIFAR-10 and CIFAR-100 against the PGD-20 and AA. Table 11 shows that the input of G ψ significantly influences the model's natural and robust accuracy. Moreover, the performance of input with logits has a smaller variance than in other cases, indicating the logits make the training runs more stable. As shown in Figure 9 (see page 28), the gaps between the generated amplitude spectrum of different inputs are quite small. However, the recombination from the input with z and logits have a small gap for benign samples, with no significantly changed sample.

F.8 Single AE Generation of DAT

In the training procedure of DAT, we take both benign and recombined samples' AEs into AT. To reduce the time consumption of AE generation, we propose an efficient strategy to produce AEs.

We can also generate AE of recombined data by mixing the generated amplitude spectrum with that in the benign sample's AE. For an example, with ( x , y ) ∈ D , we use the x 's AE x ′ to obtain the amplitude of recombined AE as

Then, ˆ x ′ is obtained by

We call such a procedure to obtain recombined data and AE a single AE DAT, while the process described in the main text is Dual AE DAT. To explore the difference in performance between the two AE generation strategies, we perform experiments with the same experimental settings in Sec. E.2 on CIFAR-10 and CIFAR-100 with ResNet-18. The PGD-20 and AA are selected to evaluate the model's performance with single or dual AE generation. As shown in Table 12, we report the natural and robust results. According to these experiments, the natural accuracy gap for the DAT with single and dual AE is small, while the difference for the robust performance is large. As mentioned in the work, the amplitude spectrum of the sample influences the model's learning of the phase patterns. The single AE of DAT does not reflect the impact of mixed amplitude ˆ x on adversarial perturbation, resulting in a lower robust performance than dual AE for DAT. Additionally, as shown in Table 4, although the model trained with single AE has a lower robust performance than common DAT, it still enhances the model's robustness compared to the baseline. That indicates the single AE for DAT can also enforce the model to learn more robust phase patterns.

F.9 Limitations and Future Works

Although the proposed DAT significantly improves the model's robustness and natural accuracy of the model, there are still some limitations of the work. Since the robust over-fitting issues, DAT without AWP needs to be trained in a limited epoch, restricting its performance. Moreover, our DAT focused on protecting from adversarial attacks. Other types of image corruptions, e.g. , Gaussian noise, and defocus blur, can also influence the model's performance. DAT needs to be developed further to protect the model from various image corruptions. Due to the limitation of page length, we only provide the experimental results on three frequently used datasets and deep models in the main paper. In the future, we will add experiments on more large-scale datasets with different deep models.

G Theoretical Analysis and Proof

Here we restate and prove Theorem 3.2.

Theorem 3.2 (Weight Regularization of Amplitude Features) . Grant Assumption 3.1, when the empirical risk ˆ R is minimized with some convex loss function L (e.g. CE loss):

we have w j,a → 0 for all j ∈ [ c ] , where w j,a is the corresponding weights of amplitude features h a .

We consider a quadratic approximation of the objective in Theorem 3.2, and provide a further and extended analysis following [16, 26]. Using the second-order Taylor expansion, we expand each term of the objective function:

where ¯ h = E t ( x ) ∼T ( x ) [ h ( t ( x ))] , ∆ = W ⊤ ( h ( t ( x )) -¯ h ) , and H is the Hessian matrix with ζ denoting the remainder. We introduce Lemma G.1 to demonstrate the properties of H .

Lemma G.1. For the CE loss with softmax, the Hessian matrix w.r.t. the loss function satisfies

H ⪰ 0 , i.e., H is semi-definite.

H is independent of the true label vector y .

Proof. The CE loss for a single instance x , when given the true label vector y (using one-hot encoding with c -dimension) is defined as

The gradient of L w.r.t. the logits is computed as

for k ∈ [ c ] , where p k = σ ( z ) k is the predicted probability of class k . The Hessian matrix H , which is the matrix of second derivatives of L , has elements given by

Using the derivation properties of the softmax function, the above derivative simplifies to

where δ kj is the Kronecker delta, equal to 1 if k = j and 0 otherwise. Thus, the Hessian matrix H is

Positive Semi-Definiteness. The Hessian matrix can be expressed in matrix form as

where P is a diagonal matrix with diagonal entries p k , and I is the identity matrix. The product of P and I -P , where P is a diagonal matrix with entries between 0 and 1, ensures that H is positive semi-definite.

Independence from Label y . The structure and values of H depend solely on the predicted probabilities p , which are functions of z and not dependent on the specific values of y . This characteristic signifies that the Hessian's form is invariant w.r.t. the true label vector y , thus highlighting its independence.

In the following, we omit the subscript of the expectation in Eq. (15) for simplicity. According to [8], when minimizing ˆ R , the first term in RHS of Eq. (15) may be no room for further improvement because the local optima has nearly the same value as the global optimum in neural networks, and we put our main focus on the second term. We first derive an upper bound for the second term in Lemma G.2, since directly optimizing it which requires a third-order derivative is intractable.

Lemma G.2 (stated informally, cf . Theorem 3.1 in [8]) . Assume that the covariance between ∥ H ∥ F and ∥ ∆ ∥ 2 is zero, we can get the upper bound of the second term as

Proof. By Hölder's inequality, we have

where 1 / p + 1 / q = 1 , ∥ · ∥ r,q is an induced matrix norm. When p = q = r = 2 , we have

Intuitively, since ∥ H ∥ F represents the sharpness/flatness of loss landscape, and ∥ ∆ ∥ 2 describes the translation of landscape, the two terms can be assumed independent, where their covariance can be assumed as zero [8]. Consider the latter item in RHS of Eq. (22):

where Σ is the covariance matrix of h ( t ( x )) . For a model trained well enough, the feature extractor can completely distinguish different features, i.e ., Σ is a diagonal matrix. Then we can obtain

where w j,i is the j -th entry of w i . If the variance of the feature h i ( t ( x )) is large, minimizing the empirical risk ˆ R requires ∑ c j =1 w 2 j,i → 0 = ⇒ w j,i → 0 for all j ∈ [ c ] . By Assumption 3.1, it is trivial that Var[ h a ( t ( x ))] > Var[ h p ( t ( x ))] and therefore w j,a → 0 . Under this circumstance, the model is enforced to learn more phase information. The claim follows.

Original Benign

Samples

Amplitude

Spectrum

Phase

Spectrum

Generated

Amplitude

Spectrum

Spectrum

Recombined

Sample only with

Generated

Amplitude

Recombined

Sample with Mixed

Amplitude

𝒛 ∼ 𝓝 𝟎, 𝟏

+label

Generated

Amplitude

Spectrum

Mixed

Amplitude

Spectrum

Recombined

Image

𝒛 ∼ 𝓝 𝟎, 𝟏

+logits

Generated

Amplitude

Spectrum

Mixed

Amplitude

Spectrum

Recombined

Image

𝒛 ∼ 𝓝 𝟎, 𝟏

Generated

Amplitude

Spectrum

Mixed

Amplitude

Spectrum

Recombined

Image

Benign

Samples

Amplitude

Spectrum

Phase

Spectrum

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: See Abstract in the preamble and Introduction in Sec. 1.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: See Appendix F.9.

3. Theory Assumptions and Proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [Yes]

Justification: See Sec. 3.4 and proof in Appendix G

4. Experimental Result Reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: See Sec. 4

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: See

https://github.com/Feng-peng-Li/DAT .

6. Experimental Setting/Details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: See Sec. 4.1.

7. Experiment Statistical Significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [Yes]

Justification: See Secs. 4.2, 4.4, 4.3, and Appendix F.2.

8. Experiments Compute Resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: See Sec. 4.1 and Appendix F.3.

9. Code Of Ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: following the Code Of Ethics of NeurIPS.

10. Broader Impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [NA]

Justification: Since only open access models, codes, and datasets are used in this work, broader impacts are not applicable.

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: No such risks.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: See the supplemental materials.

13. New Assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [Yes]

Justification: See Sec. 4.1.

14. Crowdsourcing and Research with Human Subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: Not involve crowdsourcing nor research with human subjects.

15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: Not involve crowdsourcing nor research with human subjects.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nMotivated by observation on the difference influence of amplitude and phase of adversarial examples, this paper propose a framework to generate better adversarial examples for adversarial training. Experiments verify the effectiveness of the proposed approach.\n\nSTRENGTHS:\n1. The motivation in Figure is clear and solid.\n2. The experimental improvements are clear and consistent.\n\nWEAKNESSES:\n1. The proposed framework contain many modules, making it complex and difficult to implement.\n2. Some descriptions are unclear and some details are missed.\n\nSee questions for details.\n\nQUESTIONS:\n1. In Figure 1, the authors claim that “The adversarial perturbation severely damages phase pattern and the frequency spectrum, while amplitude patterns are rarely impacted.” However, this comparison is not clear. It seems the amplitude patterns still changes a lot in Figure 1. Both the patterns and spectrum change. Could you provide more proof on this observation (e.g., results on more images and more datasets)?\n2. In Line 88, the features induced from the amplitude and phase patterns of x are denoted as $h_a(\\mathbf{x})$ and $h_p(\\mathbf{x})$ respectively.  Does it indicate an assumption that some parts of the learned $h$ correspond to the amplitude features? Do we need carefully design the network to explicitly accomplish this? It also makes the theoretical analysis in Sec. 3.4 difficult to understand.\n3. As the proposed framework contains multiple modules and optimization steps, it is surprising that the additional time consumptions are small. Could you please kindly provide more explanation on this? Do we need any relatively complex optimization tricks? Furthermore, what is the memory cost during training and could you please present the corresponding comparison with the baseline methods?\n4. It seems the mix-up operation is important in the whole framework. The adversarial amplitude and original amplitude are mixed by linear combination and the proportion is sampled from a uniform distribution. How do you make such a design? Have you ever tried other possible methods?\n\nLIMITATIONS:\nThe authors discuss the limitations of this work in Sec. F.9 and say that the verification may be insufficient. No limitation of the proposed method itself is discussed.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-06-25"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper introduces Dual Adversarial Training (DAT). This method enhances deep neural network resilience against adversarial attacks by employing generative amplitude mix-up in the frequency domain, focusing the model on phase patterns less impacted by such perturbations, and presenting an optimized adversarial amplitude generator for balancing robustness improvements with phase pattern retention. Experiments validate DAT's effectiveness against diverse adversarial attacks.\n\nSTRENGTHS:\n1. The paper is well-organized and easy to follow. \n2. The experimental results show the effectiveness of the proposed method.\n\nWEAKNESSES:\n1. In the experiment, only decision space attacks are used to test the defense capability. Compared with decision space attack, feature space attack can better destroy the semantic information of benign images and obtain more powerful adversarial samples. It is recommended that some feature space attacks be added to further demonstrate the effectiveness of the proposed method, like [a] and [b]. \n\n[a] StyLess: Boosting the Transferability of Adversarial Examples, CVPR 2023\n\n[b] Enhancing the Self-Universality for Transferable Targeted Attacks, CVPR 2023\n\n2. The types of models used in the experiment are not rich enough. Line 258 of this paper states that \"ResNet-18, WideResNet-34-10 (WRN-34-10), and WideResNet-28-10 (WRN-28-10) are used as the backbones\". Line 269 says \"Table 1 displays the results on CIFAR-10, CIFAR-100, and tiny-ImageNet using ResNet-18\". These models are all based on ResNet architecture and have high structural similarities. To show that the method proposed in this paper is generalizable, the proposed method should be able to achieve good results on different surrogate and target models. Therefore, it is recommended to add more surrogate and target models, such as Inception_v3, ViT, etc. \n\n3. This paper uses CIFAR-10, CIFAR-100, and Tiny ImageNet for experiments, but does not use ImageNet. However, ImageNet is the most widely used dataset in the CV field. The authors should provide additional experimental results on ImageNet for this paper's method.\n\nQUESTIONS:\n1. Can the authors provide some results against feature space attacks?\n\n2. Can the authors provide some results on other models and datasets, like ImageNet and ViTs?\n\nLIMITATIONS:\nThe authors have discussed the limitations of the method proposed in this paper. It is suggested that the authors provide some results on other models and datasets, like ImageNet and ViTs.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-13"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper investigates a novel approach to improving adversarial training by performing data augmentation in the frequency domain. The authors propose a unique pipeline that jointly optimizes a classification network and a generator network. The generator is used to create adversarial noise, which is added to the amplitude component of the input to encourage the model to more accurately capture phase patterns. The authors conduct a comprehensive evaluation of their approach across multiple datasets and architectures, demonstrating its competitive performance.\n\nSTRENGTHS:\nComprehensive experiments on several datasets with different architectures.\n\nA novel approach that improves adversarial training by performing data augmentation using a generator network in the frequency domain.\n\nWEAKNESSES:\nIn Table 1 and Table 2, the authors have only compared their approach with a few weak baselines. Since the proposed approach is based on data augmentation, the authors should consider comparing it with other data augmentation-based approaches, such as DAJAT[1] and [47]. Although DAJAT’s results are presented in Table 3, the table does not show the clean accuracy of the models, making it difficult to assess the accuracy-robustness tradeoff. In fact, DAJAT’s clean accuracy is significantly higher than that of the proposed approach. For instance, DAJAT’s clean accuracies on CIFAR-10 and CIFAR-100 (with ResNet-18) are 86.67% and 66.96%, respectively, while the proposed approach’s are 84.17% and 63.28%. [37]’s clean accuracy and AA robust accuracy with WRN-34-10 are 86.18% and 58.09%, respectively, while the proposed approach’s with WRN-34-10 are 86.78% and 56.46%.\n\nThe proposed pipeline is complicated, with a multi-part loss function and a requirement for joint optimization with a generator network. This complexity may necessitate extensive hyperparameter tuning to achieve satisfactory performance, making it a much more complex error-prone solution compared to data augmentation approaches such as [1] and [47].\n\nQUESTIONS:\nNo questions\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-13"}