Characterizing the Impacts of Instances on Robustness
Year: 2023

Abstract:
Building robust deep neural networks (DNNs) against adversarial attacks is an important but challenging task. Previous defense approaches mainly focus on developing new model structures or training algorithms, but they do little to tap the potential of training instances, especially instances with robust patterns carring innate robustness. In this paper, we show that robust and non-robust instances in the training dataset, though are both important for test performance, have contrary impacts on robustness, which makes it possible to build a highly robust model by leveraging the training dataset in a more effective way. We propose a new method that can distinguish robust instances from nonrobust ones according to the model’s sensitivity to perturbations on individual instances during training. Surprisingly, we find that the model under standard training easily overfits the robust instances by relying on their simple patterns before the model completely learns their robust features. Finally, we propose a new mitigation algorithm to further release the potential of robust instances. Experimental results show that proper use of robust instances in the original dataset is a new line to achieve highly robust models. Our codes are publicly available at https://github.com/ruizheng20/robust_data.

heading: 1 Introduction
text: Deep neural networks (DNNs) have made significant progress in a number of fields, such as computer vision (He et al., 2016) and natural language processing (Devlin et al., 2019), but they are susceptible to adversarial examples, which are crafted by adding small, human-imperceptible adversarial perturbations to normal examples (Goodfellow et al., 2015; Alzantot et al., 2018). To improve the robustness of models, many techniques have been developed, such as robust architecture search (Guo
∗Equal contribution. †Corresponding author.
et al., 2020; Huang et al., 2021), model pruning (Sehwag et al., 2020; Zheng et al., 2022), adversarial training (Madry et al., 2018; Zhu et al., 2020) and regularizations (Lyu et al., 2015; Wang et al., 2021). However, most of these defensive approaches focus on developing new model structures or training algorithms, ignoring the fact that training data has a decisive impact on the trained model.
It is widely believed that the more abundant the labeled data, the higher the likelihood of learning diverse features, which in turn leads to well generalized models (Swayamdipta et al., 2020). However, in practice, adversarial robustness remains a challenge that cannot be solved simply by scaling up the dataset (Xie and Yuille, 2020). On the one hand, recent theoretical work argues that training a model invariant to adversarial perturbations requires a much larger dataset than that is required for standard generalization (Schmidt et al., 2018; Alayrac et al., 2019). On the other hand, the model tends to use any available signal to maximize accuracy, and thus, adversarial examples can arise as a result of manipulating highly predictive but fragile features in the data (Ilyas et al., 2019). The above evidences indicate that, adversarial vulnerability is not only associated with the training data size, but is also an inherent property of the data. Most of existing defense methods treat all data equally, which requires us to have a closer look at the dataset whether all instances contribute equally to improving the robustness of the model.
In this paper, we focus on exploring the relationship between training data and adversarial robustness, with the aim of figuring out the following questions:
Q1: Which instances are important for adversarial robustness, and how do we find them? We delve into the training dynamics of each instance and find that instances have different robustness. Even without the help of adversarial training, a portion of the data progressively becomes more robust
2314
to perturbations, and these instances are called robust instances.1 When we train models on these data in isolation, they are more helpful in improving robustness than other subsets of data with the same size. Motivated by this phenomenon, we propose a metric based on the adversarial loss of each instance across the training epochs to indicate the impact of training instances on robustness. As shown in Figure 2, this metric reveals three distinct regions in the dataset: a region with inherently robust instances, a region with non-robust instances, and a region with instances that fluctuate between robust and non-robust. Based on the proposed metrics, a significant portion of robust instances can be selected from the training dataset to significantly improve the robustness of the model.
Q2: Why is the benefit of robust instances held back when mixed with other training instances? How to make the best out of them to improve robustness? DNNs exhibit memorization effects in that they first memorize easy and clean patterns, and then hard and noisy ones (Zhang et al., 2017; Wang et al., 2019). The robust instances have simple and straightforward task patterns that better align with human perception. We find that the model under standard training easily overfits the robust instances by relying on their simple patterns before the model starts to learn their robust features, which limits the power of robust instances. To address this problem, we propose a new mitigation algorithm that impedes overconfident predictions by regularizations for robust instances to avoid overfitting. The proposed method effectively releases the potential of robust instances, while other instances contribute little to robustness improvement. In particular, our contributions are:
• We show that the instances are not equally important to improve the robustness of the model. The robust instances are more critical to robustness than other instances.
• We propose a new approach to distinguish the robust instances from non-robust ones based on their sensitivity to perturbations during training.
• We find that the standard training easily overfits the robust instances relying on their simple patterns rather than learning robust features.
1In this paper, a robust instance means that the model is insensitive to perturbations of this instance. In the later sections, we will show that robust instances also have a positive impact on the robustness of the model.
• We propose a new mitigation algorithm to further release the potential of robust instances. Our analysis and results are verified by extensive experiments.

heading: 2 Characterizing robust instances
text: We find that the model have different sensitivities to perturbations of the instances during the training phase, and this property is strongly correlated with the robustness of the trained models. Based on this, we propose an approach to identify these innately robust instances and demonstrate that they contribute more to robustness when trained in isolation.

heading: 2.1 Adversarial Loss during Training
text: Given a C-class dataset D = {(x0i ,yi)}Ni=1 of size N , x0i denotes the natural input embeddings and yi is the label vector. Our method assumes a model fθ whose parameters θ are optimized to minimize the empirical risk, as in standard training, without any extra regularization. The loss function on the natural input x0i is ℓ(x 0 i ,yi,θ). We use a stochastic gradient-based optimization procedure to optimize the model parameters, with training instances randomly ordered at each epoch, across T epochs.
To measure robustness of the instances during training, we perturb the input word embeddings.2 The goal of an attack method is to find an adversarial example xi that remains in the ϵ-ball centered at x0i (∥xi − x0i ∥F ≤ ϵ) but can fool the model to make an incorrect predication (fθ(xi) ̸= yi). The loss function on adversarial example xi can reflect to what extent the robust and useful features are preserved under adversarial perturbation (Ilyas et al., 2019):
ℓadv(xi,yi,θ) = max ∥xi−x0i ∥F≤ϵ ℓ(xi,yi,θ). (1)
A wide range of attack methods have been proposed to craft adversarial examples. Projected Gradient Descent (PGD) iteratively perturbs normal input x0 for a number of steps K with fixed step size η. If the perturbation goes beyond the ϵ-ball, it is projected back to the ϵ-ball (Madry et al., 2018):
xki = ∏( xk−1i + η · sign(∇xℓ(xk−1i ,yi,θ)) ) ,
where xki is the adversarial example at the k-th step, sign(·) denotes the sign function and ∏(·) is the projection function.
2In our work, the robustness of an instance refers to the robustness of the model on a specific instance.
We characterize the evolution of robustness using statistics of adversarial losses throughout training. The first statistic aims to measure the sensitivity of the model predictions in the face of perturbations. We define sensitivity of individual instance x0i as mean adversarial loss across epochs:
µ̂i = 1
T
T∑
t=1
ℓadv(xi,yi,θt), (2)
where θt denotes the model parameters at the end of t-th epoch. We also consider a more coarse, discrete, and perhaps more intuitive statistic, the rate of times the model provides incorrect predictions when the input is perturbed, referred to as flip rate; this score has only T + 1 possible values.
Finally, we consider variability, i.e., the spread of adversarial loss across epochs as measured by the standard deviation:
σ̂i =
√∑T t=1 (ℓadv(xi,yi,θt)− µ̂i)2
T . (3)
If the model consistently assigns the same prediction to a perturbed instance (whether correct or not), this instance will have low variability. On the contrary, if the model is indecisive, this instance will have high variability.

heading: 2.2 Data Maps
text: In order to better illustrate the differences in instances, we use the above statistics as coordinates to construct a data map (Swayamdipta et al., 2020). We construct data maps for three widely used benchmark datasets: SST-2 (Socher et al., 2013) – a binary classification task that needs to classify movie reviews as positive or negative; QQP (Wang et al., 2017) – a paraphrase identification task to determine if two questions are paraphrases of each other; AGNews (Zhang et al., 2015) is a text classification task that classifies news articles into one of four topics. All data maps are built using results from the models based on the BERT-base (Devlin et al., 2019) architecture.
Figure 1 shows the data map for the SST-2 dataset. It is obvious that the data follow a bellshaped curve with respect to sensitivity and variability. The majority of instances fall within the high sensitivity and moderate variability regions on the map (Figure 1, bottom-right). These instances are always non-robust to perturbations (for the model); therefore, we refer to them as nonrobust instances. The second group is smaller and consists of instances with low sensitivity and low variability (Figure 1, bottom-left). As such instances are robust to perturbations during training,
we refer to them as robust instances. The third group consists of instances with high variability (Figure 1, top); these instances swing between being sensitive or robust to perturbations. Therefore, we refer to them as swing instances.
Robust dynamic. We consider three data subsets, i.e., 10% of the most robust, 10% of the most nonrobust, and 10% of the most swing. Figure 2 shows the adversarial losses of instances from these three regions of the SST-2 dataset during the training procedure. The most significant difference among the three regions is the decline rate of their adversarial losses, which is much faster in the region of robust instances than in the other two regions. This means that robust instances have more robust features and they become more robust to perturbations as training proceeds, without the help of robust learning methods such as adversarial training.
Case study. Table 5 shows instances of SST2 that belong to the different regions mentioned above. Robust instances have more straightforward task patterns, are better aligned with human perception, and are easy to understand. In contrast, most non-robust and swing instances are ambiguous, have no obvious task patterns, and are challenging for humans, which may explain why these instances are vulnerable to perturbations (Tsipras et al., 2019).

heading: 3 Data Selection using Data Maps
text: The data map shows the different regions in the dataset. It is natural to wonder what role instances from different regions play in learning and adversarial robustness. We answer this question empirically by training the model solely on instances selected from each region, and then performing standard
generalization (Accuracy) as well as robustness (accuracy under attack) evaluations.
The training strategy is simple and straightforward – we train the model from scratch on the subsets of the training data selected by ranking instances based on the statistics described above. We hypothesize that robust and swing instances are more important for improving the robustness of the model because they have more robust features and more stable to perturbations as training proceeds. We compare the performance of the models trained on different data regions with other baselines. All considered subsets contain 50% of the training data (to control the effect of training data size on performance).
Baselines. The most natural baseline is using all of the data (100% train). Our data selection baselines consider the subsets of 50% of the most robust (50% robust), 50% of the most non-robust (50% non-robust) and 50% of the most indecisive (50% swing), which is a trade-off between robust and non-robust instances. Finally, we also compare our models trained on data subsets with a textual adversarial training method, Freelb (Zhu et al., 2020), which is a strong defense baseline in NLP (100% FreeLB).
Results. We report accuracy on the test set to evaluate generalization performance, and accuracy under attack using TextFooler (Jin et al., 2020) as the attacker to measure adversarial robustness.
Table 1 shows our results on the SST-2 and QQP datasets. We can observe that: 1) Training on 50% most robust instances results in the best robustness performance among all data selections, ex-
ceeding that of 100% train and even better than 100% FreeLB on QQP. 2) In both datasets, the robustness performance of non-robust instances is lower than all other baselines, which is expected because the features of these instances are non-robust. 3) The generalization performance of non-robust instances is better than that of robust, because well generalized features are more sensitive to adversarial perturbations. 4) The model trained on most swing instances sacrifices a bit of robustness to improve generalization compared with the performance of the model trained on robust instances.
In Figure 3, we show the evolution of generalization performance and adversarial robustness when we change the size of the selected subsets of data. Each point in the figure corresponds to retraining the model from scratch (with the same hyperparameters as the base model) on an increasingly larger subset of the training data. We observe that the generalization performance improves rapidly when we increase the size of non-robust and swing subsets. This means that the original training dataset is redundant to the model, and training the model on a small portion of the data also gives excellent generalization performance. Comparatively, by in-
creasing the number of robust and swing, 50% of the data is sufficient to achieve excellent robustness performance, while more data actually hurts robustness. On the one hand, we require sufficient data to improve the generalization, and on the other hand, excessive well-generalized data will harm the robustness. We cannot rely on data selection alone to get the best generalization and robustness at the same time, and in the next sections we will show how to leverage instances from different regions to achieve win-win results in performance.

heading: 4 Why Do Robust Instances Fail?
text: In the previous section, we observed that robust instances are import for adversarial robustness. This leads us to wonder why robust instances fail in competition with non-robust instances, and is it inevitable when we train these data together? In this section, we provide further insight into the training procedure by investigating the interactions between robust and non-robust instances.

heading: 4.1 Overfitting to Robust Instances
text: As shown in Figure 4, we find that robust instances are easy to learn and converge faster than non-
robust instances. As the training loss of robust instances approaches zero, the test loss is increasing, which means that the model overfits the robust instances. However, the robustness of the model continues to improve, even as the training loss becomes (close to) zero. This suggests that the model under standard training easily overfits the robust instances before the model starts to learn their robust features. We further show the results in Figure 4(c) when we use the Flooding (Ishida et al., 2020) algorithm to mitigate overfitting to robust instances, where Flooding intentionally prevents further reduction of the training loss when it reaches a reasonably small value. Flooding prevents the model from memorizing and being overconfident in these instances. By mitigating the overfitting to robust instances, the benefits of robust data are further demonstrated.
The above analysis leads us to believe that, to some extent, the overfitting to robust instances reduces their ability to improve robustness, especially when competing with non-robust instances. To test this hypothesis, we conduct an experiment inspired by the standard continuous learning setup (Toneva et al., 2019). We created two equally sized datasets by extracting 50% of the most robust and 50% of the most non-robust instances, respectively. Then, we train a model for 2 epochs on each partition in an alternating fashion, while tracking generalization and robustness on the test set. The background color represents which of the two datasets is currently being used for training.
It can be concluded that: 1) Figures 5(a) and 5(d) show that even if we train the non-robust instances first, the robust instances can still improve robustness in the next 2 epochs. However, as the
training loss of the robust instances converges to zero, the model learns less and less from the robust instances. 2) As shown in Figure 5(a), there is a significant conflict in learning between the robust and non-robust instances, which means that the model learns distinct features from them. 3) Figure 5(b) shows the conflict effect between robust and nonrobust instances is reduced by mitigating the overfitting of the model to robust instances. Therefore, mitigating overfitting to robust instances allows the model to better generalize their robust features.

heading: 4.2 Mitigating Overfitting
text: Based on the above analysis, our aim is to mitigate the overfitting to robust instances in the standard training process. While overfitting has been extensively studied in the machine learning community to reduce the generalization gap, few approaches consider the impact of overfitting on adversarial robustness.
To address this problem, we propose to regularize the predictions of robust instances from being over-confident by integrating loss-restricted (LR) methods (Szegedy et al., 2016; Ishida et al., 2020) into the standard training framework. We believe that LR is suitable for standard training because it can be easily implemented by adding a term to the objective function. Specifically, we construct a new dataset Dp%r using the p% most robust instances in the original dataset, and other instances construct D\Dp%r . The training loss on the instance xi with LR can be expressed as:
ℓLR(xi,yi,θ) = { ℓ(xi,yi,θ), xi ∈ D\Dp%r , R(ℓ (xi,yi,θ)) , xi ∈ Dp%r ,
where R(·) denotes regularization term. In our
method, we consider two regularizations, Flooding (Ishida et al., 2020) and Label Smoothing (Szegedy et al., 2016), to control the training loss for alleviating overfitting.
Flooding is a direct solution to the issue that the training loss becomes (near-)zero. When the training loss reaches a reasonably small value, Flooding intentionally prevents further reduction of the training loss, and the flood level corresponds to the level of training loss that the user wants to maintain. The algorithm of Flooding is simple, modifying the training loss as (Liu et al., 2022):
RFL(ℓ(xi, yi,θ)) = |ℓ(xi, yi,θ)− b|+ b, (4)
where b > 0 is the user-specified flood level. By using Flooding, the training loss will oscillate around the flood level. The model will continue to “random walk” with the same non-zero training loss, thus the model will move into a region with a flat loss landscape, leading to better generalization.
Label smoothing is another widely known technique to mitigate the overfitting problem by penalizing overconfident model outputs (Müller et al., 2019). For a model trained with hard labels, we minimize the expected value of the cross-entropy between the true label yi and the model’s output for xi, where yi is a one-hot vector with “1” for correct class and “0” for others. For a model trained with the label smoothing, we minimize the crossentropy between the modified label yLSi and the model’s output:
RLS(ℓ(xi,yi,θ)) = ℓ(xi,yLSi ,θ), (5)
where yLSi = yi(1−α)+α/C, α is the smoothing parameter and C is the number of classes .
From Table 2, we can observe that the above regularizations are valid. The robustness of the model is significantly improved by mitigating the overfitting of robust instances, while also achieving high accuracy. We use two regularizations to prove that the above conclusion does not depend on any specific regularization. In the experimental section, we perform more experiments to verify the effectiveness of the proposed method.

heading: 5 Experiments
text: In this section, we provide experimental results using BERT-base (Devlin et al., 2019) as a backbone model on the SST-2 (Socher et al., 2013), QQP (Wang et al., 2017) and AGNews (Zhang et al.,
2015) datasets to validate and analyze the effectiveness of our proposed approach. Experimental implementation details and hyperparameters are provided in Appendix A.

heading: 5.1 Robust Evaluation
text: The evaluation metrics used in our experimental analyses include: 1) Clean%: the accuracy on the clean test dataset; 2) Aua%: the model’s prediction accuracy under attack; 3) #Query: the average number of times the attacker queries the victim model. For a robust model, higher accuracy under attack and higher query times are expected. The baselines we used and adversarial settings are shown in Appendix A. More experimental results and analysis are presented in Appendix B.
Results. Table 3 shows the results of the proposed method and other baselines under adversarial attack. We can observe that the proposed method achieves a significant improvement in robustness compared to other defense methods. Both Flooding and Label Smoothing work well in our approach. The proposed method improves the robustness without sacrificing accuracy, while robust tickets lose much accuracy on SST-2 despite also having a high robustness. We consistently demonstrate the effectiveness of our approach on different datasets.

heading: 6 Related Work
text: Text attacks typically generate adversarial examples by manipulating characters (Ebrahimi et al., 2018; Gao et al., 2018), words (Ren et al., 2019; Jin et al., 2020; Li et al., 2020; Alzantot et al., 2018; Zang et al., 2020; Maheshwary et al., 2021), phrases (Iyyer et al., 2018) of the original input, or even entire sentences (Wang et al., 2020), to
deceive the model. The most widely used attacks are word-level attacks, which replace words in a sentence with synonyms and maintain a high-level similarity and validity in the semantic (Li et al., 2020) or embedding space (Jin et al., 2020).
To counter adversarial attacks, a number of defense methods have been developed, such as adversarial training (Madry et al., 2018; Zhu et al., 2020; Li and Qiu, 2021), information compression (Wang et al., 2021; Zhang et al., 2022), and model pruning (Zheng et al., 2022; Xi et al., 2022). However, most of these defensive approaches focus on developing new model structures and training algorithms, ignoring the fact that training data has a decisive impact on the robustness of the model. In this paper, we propose a new defense method from a data perspective to improve the robustness of the model by better utilizing the robust instances in the original dataset.
A body of work tends to view the existence of adversarial examples as an inevitable consequence of using high-dimensional inputs and the statistical fluctuations due to data size and data noise (Goodfellow et al., 2015; Gilmer et al., 2018). However, Ilyas et al. (2019) claim that adversarial vulnerability is a direct result of sensitivity to wellgeneralizing features in the data. Data-related studies in the field of robustness focus on improving
the robustness of models using more unlabeled data (Carmon et al., 2019; Alayrac et al., 2019) and data augmentation (Lee et al., 2020; Rebuffi et al., 2021). Dong et al. (2021) find that low-quality data may not be useful or even detrimental to adversarial robustness. To the best of our knowledge, no work has attempted to characterize the impact of each instance in the training dataset on robustness.

heading: 7 Conclusion
text: In this paper, we address the challenge of understanding the impact of training instances on robustness, particularly to improve the robustness of the model. We study the adversarial losses of each instance during training and show how these losses can be used as a metric to identify robust instances. Our empirical results suggest that the proposed metric is a very promising measure for characterizing the contribution of training instances to robustness, and can be used to prune out non-robust instances to construct a dataset that is inherently robust. Furthermore, we show that standard training can easily overfit robust instances by relying on their simple patterns before the model learns the robust features. The robustness of the model can be significantly improved by mitigating the overfitting of the model to robust instances during the standard training. Further investigations in this direction may lead to
new technologies for adversarial defense.

heading: Limitations
text: In this work, we find that robust instances are helpful for model robustness and propose a metric to select them. However, we only applied one single criterion, i.e. the training dynamic of adversarial loss, as selection metric. More instance features can be inspected in terms of the relation with model robustness and further serve as metrics for robust data selection. Moreover, in this work, we use the selected data for standard fine-tuning with simple regularization, while the impact of data robustness on adversarial training is not studied. These two problems will be explored in future work.

heading: Acknowledgements
text: The authors wish to thank the anonymous reviewers for their helpful comments. This work was partially funded by National Natural Science Foundation of China (No.62206057,62076069,61976056), Shanghai Rising-Star Program (23QA1400200), Natural Science Foundation of Shanghai (23ZR1403500), and CCF-Tencent Open Fund, except the third author Qin Liu, who is funded by Graduate Fellowship from University of Southern California.

heading: A Experimental Details
text: A.1 Implementation Details Our implementation of the proposed method is mainly based on BERT, so most of the hyperparameter settings are based on them.3 We use AdamW as our optimizer with the learning rate 2e−5, a batch size 32 and a linear learning rate decay schedule with a warm-up of 0.1. The dropout rate is set to 0.1 for all task-specific layers. We implement three adversarial attack methods using TextAttack framework and follow the default parameter settings.4 The accuracy (Clean%) is tested on the whole test set. Other adversarial robustness evaluation metrics (e.g., Aua% and #Query) are evaluated on the 1000 randomly selected test instances for all datasets. All experiments are conducted using NVIDIA RTX3090 GPUs.

heading: A.2 Hyperparameters
text: Our proposed method consists of two stages; the first stage finds robust instance from the training dataset based on the statistics of adversarial loss, and the second stage, uses regularizations to mitigate the overfitting of the model to robust instances during standard training. Adversarial loss objective introduces four hyperparameters: the perturbation step size η, the initial magnitude of perturbations ϵ0, the number of adversarial steps K, and we do not constrain the bound of perturbations. In addition, we report the flood level b, smoothing parameter α and the p% most robust instances in the proposed overfitting mitigation method.

heading: A.3 Baselines
text: The baseline methods we use include: 1) Fine-tune (Zhang et al., 2015): the official BERT implementation on downstream tasks; 2) PGD (Madry et al.,
3https://github.com/huggingface/transformers 4https://github.com/QData/TextAttack
2018): standard adversarial training with PGD attacks; 3) FreeLB (Zhu et al., 2020): an enhanced adversarial training to generate adversarial examples at low cost; 4) infoBERT (Wang et al., 2021): the information bottleneck-based approach filtering out redundant and noisy information to improve the robustness of the features; 5) RobustT (Zheng et al., 2022): the robust sub-network extracted from the original model with innately better robustness.

heading: A.4 Attack Settings.
text: Three widely accepted attack methods are used to evaluate the robustness of the proposed approach and other baselines. BERT-Attack (Li et al., 2020) and TextFooler (Jin et al., 2020) are two word-level attackers that first identify the important words in a sentence, and then replace them with semantically similar and grammatically correct synonyms. TextBugger (Li et al., 2019) generates adversarial typos by using both character-level and word-level perturbations.

heading: B Additional Results

heading: B.1 Case Study
text: Table 5 shows the case study for the instances selected by the proposed metric. Robust instances have more straightforward task patterns, are better aligned with human perception, and are easy to understand. In contrast, most non-robust and swing instances are ambiguous, have no obvious task patterns, and are challenging for humans.
B.2 Importance of Robust Dynamic
In this paper, we propose a new metric that identifies important instances contributing to adversarial robustness based on the adversarial loss during training. To further understand the role of the adversarial loss in our approach, we compared our method with a metric based on the original training loss. From the results in Table 6, data selection based on training loss statistics can identify instances that play an important role in generalization, rather than robustness.

heading: B.3 Mitigating Overfitting to Other Instances
text: In the proposed method, we use regularization to mitigate the overfitting of model to robust instances. In Table 7, we show the results when regularization is applied on other instances with different sizes. When we use regularization on robust and swing instances, the robustness of the model is significantly
improved, while using regularization on non-robust instances does not improve the robustness. This suggests that the excellent performance of the proposed work is due to our better exploitation of the robust features in the data rather than depending on regularizations. Although previous work finds that the Flooding algorithm can improve the robustness of the model, it cannot obtain a performance comparable to the proposed method. Moreover, there is no evidence to show that the robustness of the model can be improved by using label smoothing alone.
B.4 Instances from More Regions
Table 6 shows the accuracy and robustness evaluation for models trained on instances selected from different regions on the data map. The model trained on robust instances (with low sensitivity and low variability) achieves the best robustness.

heading: B.5 Effect of Regularized Instance Proportion
text: Figure 6 shows the proposed method across all proportions of regularized instances. The adversarial robustness improves as the proportions of regularized instances grows until a certain threshold, then the robustness deteriorates.

heading: B.6 Additional Data Maps
text: The data maps for AGNEWS and QQP are shown in Figure 7 and Figure 8, respectively.
ACL 2023 Responsible NLP Checklist

heading: A For every submission:

heading: 3 A1. Did you describe the limitations of your work?
text: The limitation section is after the conclusion part of the thesis.
7 A2. Did you discuss any potential risks of your work? Our work don’t have potetial risk.

heading: 3 A3. Do the abstract and introduction summarize the paper’s main claims?
text: The abstract is at the beginning of the article and the introduction is Section 1.
7 A4. Have you used AI writing assistants when working on this paper? Left blank.
B 7 Did you use or create scientific artifacts?

heading: Left blank.
text: B1. Did you cite the creators of artifacts you used? No response.
B2. Did you discuss the license or terms for use and / or distribution of any artifacts? No response.
B3. Did you discuss if your use of existing artifact(s) was consistent with their intended use, provided that it was specified? For the artifacts you create, do you specify intended use and whether that is compatible with the original access conditions (in particular, derivatives of data accessed for research purposes should not be used outside of research contexts)? No response.
B4. Did you discuss the steps taken to check whether the data that was collected / used contains any information that names or uniquely identifies individual people or offensive content, and the steps taken to protect / anonymize it? No response.
B5. Did you provide documentation of the artifacts, e.g., coverage of domains, languages, and linguistic phenomena, demographic groups represented, etc.? No response.
B6. Did you report relevant statistics like the number of examples, details of train / test / dev splits, etc. for the data that you used / created? Even for commonly-used benchmark datasets, include the number of examples in train / validation / test splits, as these provide necessary context for a reader to understand experimental results. For example, small differences in accuracy on large test sets may be significant, while on small test sets they may not be. No response.
C 3 Did you run computational experiments? Section 5 (Experimental Settings), Appendix C

heading: 3 C1. Did you report the number of parameters in the models used, the total computational budget
text: (e.g., GPU hours), and computing infrastructure used? Appendix A
The Responsible NLP Checklist used at ACL 2023 is adopted from NAACL 2022, with the addition of a question on AI writing assistance.

heading: 3 C2. Did you discuss the experimental setup, including hyperparameter search and best-found
text: hyperparameter values? Appendix A

heading: 3 C3. Did you report descriptive statistics about your results (e.g., error bars around results, summary
text: statistics from sets of experiments), and is it transparent whether you are reporting the max, mean, etc. or just a single run? Section 5, Appendix C

heading: 3 C4. If you used existing packages (e.g., for preprocessing, for normalization, or for evaluation), did
text: you report the implementation, model, and parameter settings used (e.g., NLTK, Spacy, ROUGE, etc.)? Appendix A
D 7 Did you use human annotators (e.g., crowdworkers) or research with human participants?

heading: Left blank.
text: D1. Did you report the full text of instructions given to participants, including e.g., screenshots, disclaimers of any risks to participants or annotators, etc.? No response.
D2. Did you report information about how you recruited (e.g., crowdsourcing platform, students) and paid participants, and discuss if such payment is adequate given the participants’ demographic (e.g., country of residence)? No response.
D3. Did you discuss whether and how consent was obtained from people whose data you’re using/curating? For example, if you collected data via crowdsourcing, did your instructions to crowdworkers explain how the data would be used? No response.
D4. Was the data collection protocol approved (or determined exempt) by an ethics review board? No response.
D5. Did you report the basic demographic and geographic characteristics of the annotator population that is the source of the data? No response.

heading: Future Work
text: These two problems will be explored in future work