DAT: Improving Adversarial Robustness via Generative Amplitude Mix-up in Frequency Domain

Authors: fengpeng  li
kemou  li
haiwei  wu
jinyu  tian
jiantao  zhou
Venue: NeurIPS_cc_2024_Conference
Published: 2024-04-29 15:37:40

Abstract: To protect deep neural networks (DNNs) from adversarial attacks, adversarial training (AT) is developed by incorporating adversarial examples (AEs) into model training. Recent studies show that adversarial attacks disproportionately impact the patterns within the phase of the sample's frequency spectrum---typically containing crucial semantic information---more than those in the amplitude, resulting in the model's erroneous categorization of AEs. We find that, by mixing the amplitude of training samples' frequency spectrum with those of distractor images for AT, the model can be guided to focus on phase patterns unaffected by adversarial perturbations. As a result, the model's robustness can be improved. Unfortunately, it is still challenging to select appropriate distractor images, which should mix the amplitude without affecting the phase patterns. To this end, in this paper, we propose an optimized **Adversarial Amplitude Generator (AAG)** to achieve a better tradeoff between improving the model's robustness and retaining phase patterns. Based on this generator, together with an efficient AE production procedure, we design a new **Dual Adversarial Training (DAT)** strategy. Experiments on various datasets show that our proposed DAT leads to significantly improved robustness against diverse adversarial attacks. The source code is available at https://github.com/Feng-peng-Li/DAT.

Main paper: 
 introduction: 
 DNNs have been successfully applied to various tasks [21, 32, 25] . However, recent studies reveal that DNNs are vulnerable to adversarial examples (AEs), created by applying subtle yet deceptive adversarial perturbations to benign samples [40, 51] . Such vulnerabilities have sparked considerable interests, leading to the development of numerous adversarial attacks designed to deceive DNNs [40, 19, 39, 13, 20, 5, 6] . Furthermore, serious concerns about the trustworthiness of artificial intelligence have been raised, due to these fundamental vulnerabilities [47, 37] . To mitigate these threats, adversarial training (AT) has been developed to enhance model robustness by incorporating AEs into training through a min-max strategy [40, 61, 38] . Based on the typical method, PGD-AT [40] , a variety of AT strategies have been devised [38, 29, 37] (see Appendix B for related works).For image signals transformed into the frequency domain using, e.g. the discrete Fourier transform (DFT), several AT works [59, 52, 53, 43] explore the adversarial attacks' behavior on sample's frequency spectrum. Frequency spectra consist of amplitude and phase; the amplitude typically captures stylistic information, whereas the phase encompasses richer semantics [7] . Recent studies [58, 63] find, as shown in Figure 1 , that adversarial attacks often severely eliminate some semantics in the phase, making it difficult for models to extract features for correctly predicting AEs, while the impacts on amplitude are relatively mild. Moreover, by forcing the model to focus on phase patterns, [7, 63] confirm the model can learn more features unaffected by image corruptions, e.g., Gaussian noise and defocus blur, improving the model's performance on corrupted samples. To explore the impact of adversarial perturbations on phase and amplitude patterns respectively, we conduct some studies (see Sec. 2 for details). We find that the standard model trained without AT has worse performance on samples with adversarial phase patterns than those with adversarial amplitude ones. Unlike the standard model, AT enhances the model's robustness against both phase-and amplitude-level adversarial perturbations, with a more noticeable improvement against adversarial perturbations on phase patterns. This indicates the potential for improving the model's robustness by focusing on phase patterns unaffected by adversarial perturbations in AT. Then, by mixing the training samples' amplitude with randomly selected distractor, we observe that the robust model performance, particularly at adversarial phase patterns, is further enhanced, without impacting that at adversarial amplitude ones. This demonstrates that training samples with mixed amplitude improve the model's performance on AEs, and maintain the model's robustness on amplitude-level.Inspired by these observations, we in this work propose a new Dual Adversarial Training (DAT) strategy by focusing on the phase patterns, with two adversarial procedures: adversarial amplitude generation and efficient AE production. Specifically, to guide the model to learn more phase patterns, we first attempt to mix the amplitude of training samples' frequency spectra with randomly selected distractor images. However, when the disparity between the distractor and the original image is too large, the recombined ones tend to disrupt original phase patterns, hindering the model from predicting AE correctly. Conversely, it is difficult for models to focus on phase patterns when the distractor closely resembles the original one [7] . To tackle this challenge, we propose an optimized Adversarial Amplitude Generator (AAG) to synthesize an adversarial amplitude, maximizing the model loss and limiting the model fitting amplitude patterns, thereby the model focusing on phase patterns for convergence. During the training process, the AAG and robust model are optimized jointly with the original and recombined images, together with their AEs. The robust model undergoes training by empirical risk minimization, and maximizes the model loss to update the AAG adversarially. Experiments across various benchmarks against a range of adversarial attacks confirm the superior effectiveness of our proposed DAT, surpassing state-of-the-art methods in robustness with big margins.Contribution. The contributions of this work can be summarized as:• We verify that adversarial perturbations significantly influence phase patterns, resulting in the model's difficulty for predicting AEs correctly. Moreover, by mixing the amplitude of a training image with that of a distractor, we find that the model robustness against AEs can be enhanced.• We propose the novel DAT strategy with an optimized AAG to synthesize an adversarial amplitude.With the AAG, we enforce the model to better focus on phase patterns, enhancing the model's robustness. Also, an efficient AE generation module is incorporated to improve the AT's efficiency.• Experiments on multiple datasets confirm that DAT significantly enhances the model's robustness against a variety of adversarial attacks. Specifically, DAT increases the model's robustness by ∼2.1% on CIFAR-10, ∼2.2% on CIFAR-100, and ∼2.3% on Tiny ImageNet, on average.Notation. Let D = {(x i , y i )} N i=1 be a benign dataset comprising N samples from c classes, where each sample x i ∈ X ⊆ R C×H×W is an image with C channels, height H, and width W , and its label y i ∈ [c] = {1, . . . , c} . and F θ (x) = arg max y∈[c] f θ (x) y is the predicted label of x. Moreover, f θ = g • h , where h is the feature extractor and g is the classifier. Let H ⊆ R m be the m-dimensional feature space, h i : X → R be a feature mapping function, andh(x) = [h 1 (x), . . . , h m (x)]⊤ ∈ H denote the feature map of x. Specifically, features induced from the amplitude and phase patterns of x are h a (x) and h p (x), respectively. Define S ϵ [x] = {x ′ : ∥x ′ -x∥ ∞ ⩽ ϵ} as an ℓ ∞ -ball centered on x with radius ϵ. Let F(•) and F -1 (•, •) denote the DFT and inverse DFT (IDFT) functions. Typically, DFT is independently applied to each channel of an image x within the pixel space as:F(x)(u, v) = H h=1 W w=1 x(h, w) e -i2π(u h H +v w W ) ,where (h, w) denotes the pixel coordinates of x, and (u, v) ∈ [H] × [W ] signifies coordinates in the frequency domain. The real and imaginary parts of F(x) are denoted by Re(F(x)) and Im(F(x)), respectively. Then, the amplitude spectrum A(x) and phase spectrum P(x) areEQUATION) 
motivation: on improving adversarial robustness in frequency domain: 
 To investigate the approach to enhance the model robustness and show the motivation of DAT, we perform exploration experiments in this section. As shown in Figure 1 , adversarial perturbations severely compromise the semantics within phase patterns, resulting in the difficulty of the model predicting AEs correctly. Consequently, we examine the distinct effects of adversarial perturbations on amplitude and phase patterns. To achieve this target, we employ the standard and robust models, trained without and with AT as [40] on D t (the training subset of CIFAR-10). Moreover, on training samples with perturbed amplitude, the model tends to focus on phase patterns, in order to achieve the convergence [7, 58] . Following this line, we discuss the impact of perturbing amplitude by mixing the amplitude of training samples with those of distractors randomly selected from D t . For (x, y) ∈ D t , the recombined sample x is generated by amplitude-level mixing operations and IDFT, namely,EQUATIONwhere x 0 is the distractor i.i.d. drawn from D t . We use (x, y) to construct a dataset D r and train the perturbed model on it as [40] . Then, for (x, y) ∈ D e (the testing subset of CIFAR-10), we generate AE x ′ by four representative adversarial attacks (PGD, C&W, FAB, and Square) and utilize DFT to derive the amplitude and phase of frequency spectra of both x and x ′ . Furthermore, images composed of adversarial amplitude/phase and benign phase/amplitude (denoted by x ′ amp /x ′ pha ) are obtained by x ′ amp = F -1 (A(x ′ ), P(x)), x ′ pha = F -1 (A(x), P(x ′ )). For each (x, y) ∈ D e , with every adopted adversarial attack, we use (x ′ , y), (x ′ amp , y) and (x ′ pha , y) to combine evaluation datasets D AE , D amp and D pha , which are used to evaluate the robustness of the standard, robust, and perturbed models, respectively. The experimental outcomes are illustrated in Figure 2 , from which we can draw the following conclusion:Impact of Adversarial Attacks. As shown in Figure 2a , under all four attacks, the standard model completely cannot predict samples in D AE . Moreover, the standard model exhibits higher test accuracy on D amp than that on D pha . These results suggest that adversarial attacks have a more substantial impact on the phase patterns than amplitude ones. Impact of Mixing Amplitude. As shown in Figure 2c , for the perturbed model trained with AT on D r , compared with the robust one, its performance on D AE and D pha is improved further, while the performance on D amp is rarely changed. From these results, we can conclude that mixing the amplitude with that of the randomly selected distractor can force the model to focus on phase patterns, learning more patterns within the phase unaffected by adversarial perturbations. Then, the model's robustness on AEs is improved further, while robustness on amplitude patterns is retained.Following the insight from these studies, we propose DAT to enhance the model's robustness, mixing training sample's amplitude with an adversarial one, generated by the adversarially optimized AAG. 
methodology: 
 In this section, the details of our proposed DAT are introduced and analyzed. As illustrated in Figure 3 EQUATIONwhere x is the recombined data of x, following a sample-dependent conditional distribution p(x|x, ψ).Stage II encompasses an efficient AE generation method, optimized using the proposed loss L AE as: maxEQUATIONFollowing the order of these three stages, we introduce (I) AAG in Sec. 3.1 and (II) the efficient AE generation in Sec. 3.2. Subsequently, building on these components, Sec. 3.3 details (III) the joint optimization. Ultimately, Sec. 3.4 theoretically analyzes the mechanism of how the adversarial amplitude spectrum generated by AAG enforces the model to focus on the phase-level patterns.To explain the proposed AAG, we first introduce some constraints that the recombined x with perturbed amplitude is expected to meet. With a small ϵ 1 > 0 and an ϵ 2 ≫ ϵ 1 , ideally, we expect x of (x, y) ∈ D based on the generated adversarial amplitude to satisfy the following three conditions:• C1. |h p (x) -h p (x)| < ϵ 1 : Ensuring x retains the same semantics in the phase spectrum as x.• C2. F θ (x) = F θ (x): Ensuring x remains distinguishable with the same label as x by f θ .• C3. |h a (x) -h a (x)| > ϵ 2 : Making x maximize the L DAT , causing the model's difficulty fitting the amplitude of images, and forcing the model to focus on phase patterns.Let us first analyze the above conditions C1-C3 when a randomly selected distractor image is used. Since x is recombined by the mixed amplitude with the distractor and original phase of x, then, C1 can be easily satisfied. As stated in Sec. 1, when the gap between the randomly selected distractor and training sample is too large, the P(x)'s information can be damaged, resulting in the inconsistent prediction between the x and x, destroying the C1 and C2. Conversely, it is difficult to satisfy C3, limiting the model's attention to the patterns in P(x). The above statement indicates that it is difficult for x, using the amplitude of the randomly selected distractor, to meet the above three constraints.Instead of searching for an appropriate distractor, we here resort to a generative approach, i.e., developing G ψ to generate an adversarial amplitude A G (x) asA G (x) = G ψ (z, f θ (x)), where z i.i.d.∼ N (0, I). For efficient training, G ψ is constructed by four linear layers (detailed architecture in Appendix E.2). Moreover, the input with f θ (x) can ease the difficulty of G ψ 's convergence. With G ψ , since x is still recombined by A G (x) and the P(x), then, C1 is satisfied. For the outer minimization in Eq. (3), we retain the label of x same as x, minimizing L DAT to update f θ , meeting the C2. To meets C3, G ψ is optimized adversarially by maximizing the L DAT (further details in Sec. 3.3), shown as the inner step in Eq. (3). Thereby, x can limit f θ to fit amplitude information. To achieve the convergence, f θ has to focus on patterns in P(x), learning more phase patterns unaffected by adversarial perturbations.Since G ψ is adversarially trained by maximizing the L DAT , A G (x) is likely to compromise semantic integrity [63] , hindering f θ to retain the prediction consistency between x and x [31] . Moreover, due to the loss of original amplitude information, using A G (x) to replace A(x) entirely can also hurt the model's robustness [58] . As shown in Sec. 2, the mix-up operation on amplitude rarely has impact on the amplitude level robustness. That indicates the linear mix-up operation can preserve the energy of the amplitude spectrum and maintain the original amplitude information with less impact on the sample's original information. Otherwise, the original amplitude could be compromised, thereby hindering accurate model predictions. Following this line, a mix-up operation is employed, ensuring that a portion of the original amplitude information is preserved following:A mix (x) = λ • A G (x) + (1 -λ) • A(x), where λ ∼ U(0, 1). The mix-up operation effectively satisfies C1 and C2, ensuring x remains distinguishable by f θ , and keeping P(x)'s patterns closer to those in P(x) in manifold. Finally, x is obtained by IDFT asx = F -1 (A mix (x), P(x)).To elaborate on G ψ , we perform some experiments and provide visual results in Appendixes C and F.7. Now we can use x as an augmentation of x, introduced to Stage II for generating AEs.Since both x and x are fed into Stage II for generating AE, it doubles the time consumption if we use the same AE generation strategies as existing methods, e.g., PGD-AT [40] and TRADES [39] . To improve the training efficiency of DAT, we now suggest an efficient AE generation strategy. Since simply reducing the iteration step results in the difficulty of AEs' reaching the actual maximum in the ℓ ∞ -ball [49] , we propose the loss L AE to increase adversarial perturbation length in each iteration asEQUATIONwhere β is a weighting parameter, and L CE and D KL are cross-entropy (CE) loss and Kullback-Leibler (KL) divergence. According to [49, 50] , it is effective to enlarge adversarial perturbation length for each step by maximizing the distance between f θ (x) and f θ (x ′ ). Following this line, based on PGD-AT maximizing the L CE , the proposed L AE increases the adversarial perturbation step length by maximizing the KL divergence between benign sample and its AE. Then, with L AE , AEs can use fewer iterative steps to achieve the actual maximum in the ℓ ∞ -ball. As shown by experiments in Appendix F.5, DAT only needs 5 steps to generate AEs for both benign x and recombined x ′ , significantly reducing the training time while maintaining the model's robustness. Enlarging the inner step size α (in Eq. ( 10) of Appendix B.3) can also increase the adversarial perturbation length in each iteration. Due to the fact that the current AT methods typically employ a fixed α, we adopt an extra loss term for fair experimental comparisons. More details on the AE generation procedure, including pseudocodes and experimental analyses, are in Appendixes A.1, F.3 and F.5.With the AAG and efficient AE generation, Stage III attempts to improve the model's robustness.After the introduction to Stages I and II, we now delve into specifics of Stage III, joint optimization, where f θ and G ψ are optimized jointly following the objective as Eq. ( 3). In Stage III, to satisfy C2 in Sec. 3.1, keeping x with the same label as x by f θ , recombined and benign samples and their AEs are fed into DAT for the model training, also reducing the negative impact of amplitude information loss. Moreover, L DAT needs to be minimized on benign and recombined samples' AEs to enhance the robustness of f θ , enforcing f θ to focus on the phase patterns in the meanwhile. For commonly updating θ and adversarially renewing ψ, we introduce the designed loss terms L DAT as:EQUATIONwhere L AT and D JS are adversarial training and consistency regularization losses respectively, and ω is the weighting parameter for D JS . We discuss L AT and D JS below separately.Adversarial Training Loss L AT . L AT is the loss used to guide f θ to learn robust features on AEs against adversarial attacks. As shown in Figure 1 , although adversarial perturbations significantly damage phase patterns, there are still some unaffected features in the phase of AEs, important for f θ to categorize AEs correctly. Since these unaffected phase patterns contain adversarial perturbations, it is difficult for f θ to learn these features only with AEs. Therefore, we utilize benign samples and their AEs in AT, guiding the model to learn their shared features, significant for improving f θ 's robustness. Following this line, L AT for (x, y) ∈ D with AE x ′ can be expressed as:L AT (f θ (x), y) = L CE (f θ (x), y) + β • D KL (f θ (x ′ ), f θ (x)),where β is the weighting parameter identical to that in Eq. ( 5). x adopts the same AT loss as that of x.Consistency Regularization Loss D JS . D JS is the loss used to preserve the prediction consistency between x and x. In DAT, the amplitude of x's frequency spectrum is mixed with the adversarial one generated by G ψ , maximizing L DAT , showing the large gap between h a (x) and h a (x). Since x has the same phase patterns as x, keeping the prediction consistency between x and x can make the model learn more phase patterns further, enhancing the model's robustness. Inspired by the mechanism, we use the Jensen-Shannon (JS) divergence D JS to ensure the prediction consistency as:EQUATIONThis concludes the introduction to L DAT . Notably, during the model training of DAT, the gap of batch normalization (BN) parameters between x and x is quite large (details in Appendix D), posing challenges to model's convergence. To remedy this, we adopt different BNs for x and x during training. Please refer to the pseudocode of DAT in Appendix A.2 for a comprehensive presentation.Through a convergence analysis of the empirical risk, this section theoretically discusses the effects of DAT on the model to focus on phase patterns. Detailed proofs are provided in Appendix G. Concretely, we instantiate g as a linear softmax classifier W = [w 1 , ..., w c ] ∈ R m×c on top of the learned features h. Generally, for (x, y) ∈ D, suppose T (x) represents the augmented distribution over data points, where x can be transformed as anyone in {x, x ′ , x, x′ }. Then, the augmented data for x can be denoted as t(x) ∼ T (x) . Since the augmentation will increase the discrepancy between original and augmented distributions w.h.p., we can establish a common assumption. Assumption 3.1. Assume E T [∥h(t(x)) -h(x)∥] > ε 0 , where ε 0 > 0 is a relatively large value. Since only the amplitude spectrum is perturbed in the proposed DAT, it is reasonable thatE T [|h a (t(x)) -h a (x)|] > E T [|h p (t(x)) -h p (x)|].Theorem 3.2 (Weight Regularization of Amplitude Features). Grant Assumption 3.1, when the empirical risk R is minimized with some convex loss function L (e.g. CE loss):R(W) := 1 |D| (x,y)∈D E t(x)∼T (x) L W ⊤ h(t(x)), y ,we have w j,a → 0 for all j ∈ [c], where w j,a is the corresponding weights of amplitude features h a .Corollary 3.3. Suppose the predicted probability f w (x) = [p 1 , . . . , p c ] ⊤ , wherep i = exp(w ⊤ i h) c j=1 exp(w ⊤ j h) = 1 c j=1 exp((w j -w i ) ⊤ h).For every i, j ∈ [c], we have (w i,a -w j,a )h a → 0 .Remark. Theorem 3.2 suggests that for weights w j,a corresponding to features h a derived from amplitude pattern, minimizing the empirical risk R regularizes it to 0. As a result, it is difficult for the model to fit the adversarial amplitude generated by AAG. In order to converge, the model needs to reduce the reliance on h a by restricting w j,a . Hence, the model would mitigate the impact of h a on the predicted labels, as shown in Corollary 3.3, and pay more attention to features h p derived from phase patterns, capturing more phase patterns unaffected by adversarial attacks. Therefore, we can verify the effectiveness of DAT in enhancing the model's robustness. 
experiments: 
 In this section, we perform experiments to verify the effectiveness of DAT and explore the function of some DAT's parts. Sec. 4.1 shows experimental setups. Sec. 4.2 compares the model's robustness with existing AT methods with fixed ϵ and α. Sec. 4.3 compares DAT with existing AT methods over complex strategy, e.g., AWP and SWA. Sec. 4.4 presents the analysis of ablation studies.Experimental and Evaluation Settings. We select three datasets: CIFAR-10, CIFAR-100, and Tiny ImageNet [17] . For all experiments in this work, ResNet- Baselines. We compare results with PGD-AT [40] , TRADES [61] , MART [54] , and recent AT methods with competitive performance: LAS-AT [29] , SCARL [33] , and ST [37] . We also compare the DAT with OA-AT [2] , DAJAT [1] , and IDBH [35] , which uses extra strategies, e.g., AWP [56] and SWA [28] . Introduction and details of baselines are attached in Appendixes B.2 and E.3.In this subsection, we compare the robustness of DAT with common methods that use fixed ϵ and α during the training procedure.  
conclusion: 
 This work presents a novel Dual Adversarial Training (DAT) method to improve adversarial robustness against various adversarial attacks. We first illustrate the motivation through some exploration experiments. Subsequently, we delve into the efficient and effective DAT, discussing both its underlying motivation and detailed mechanics. Additionally, we theoretically validate the functionality of the Adversarial Amplitude Generator (AAG) and the convergence properties of the DAT model. Through experiments across multiple datasets against various adversarial attacks, we verify that the proposed DAT significantly improves model robustness. We also explore the hyper-parameters and discuss the function of specific components of DAT. In the future, we will design a more suitable amplitude generation and augmentation strategy to enhance robustness further. 
 
 Appendix: A.1 Pseudocode of the AE Generation Method Algorithm 1 EFFICIENT ADVERSARIAL EXAMPLE GENERATION (EAEG)Input: Mini-batch B = {(xi, yi)} M i=1 , model f θ , perturbation radius ϵ, iteration step K, step size α, weight parameter β Output: AEs {x ′ i } M i=1// EAEG Procedure 1: for i = 1, . . . , M (in parallel) do 2:x ′ i ← xi + 0.001 • ξ, where ξ i.i.d.∼ N (0, I) ▷ initialize AE 3:for k = 1 to K do 4:EQUATION5: for each batch B = {(xi, yi)} M i=1 do 3:x ′ i ← Π Sϵ[x ′ i ] x ′ i + α • sign ∇ x ′ i L AE (x ′ i ; xi, yi, θ) ▷ update AE A.2for i = 1, . . . , M (in parallel) do 4:x ′ i = EAEG(xi, yi; θ, ϵ, K, α, β) ▷ generate AE for benign data With the heightened attention on DNN vulnerabilities, numerous adversarial attack methods have developed to study the model's robustness. FGSM [22] generates AEs by applying a gradient on benign samples in a single iteration step. Building upon I-FGSM [34] , PGD [40] emerges as the strongest first-order attack, amplifying the adversarial impact of AEs. In order to reduce the difficulty of parameter settings in FGSM, the accurate and efficient Deepfool [42] is developed. To enhance the effect of PGD attack, APGD, and APGD-DLR are proposed [13] . These methods have alternative loss functions and do not require an inner step size in the AEs' generation procedure. However, these white-box attacks require detailed knowledge of the target model to generate AEs, which poses challenges in practical scenarios. To address this challenge, black-box [45, 9, 27, 10, 57, 24] and no-box [45, 36] adversarial attacks are proposed. For a comprehensive evaluation of model robustness, ensemble adversarial attacks consisting of multiple types of adversarial attacks become popular. AutoAttack (AA) [13] stands out as a representative ensemble attack approach, seamlessly integrating white-box attacks including APGD, APGD-DLR, and FAB [12] , alongside a black-box attack called Square attack [3] . AA is broadly recognized as a benchmark tool for the robustness evaluation of models.In an effort to protect models from adversarial attacks, various methodologies have been developed.Adversarial training is one of the most effective methods for countering adversarial attacks [64,. PGD-AT [40] formulates AT as a min-max optimization problem. AEs are first generated via PGD and then fed into the trained model to minimize empirical risk.To address the robust overfitting issues, early stopping of PGD-AT is proposed to further enhance the model's robustness [48] . However, PGD-AT only takes AEs into the training procedure. This approach, due to the data distribution shift between AEs and benign samples, can diminish the model's accuracy. To make a better tradeoff between accuracy and robustness, TRADES [61] takes both benign samples and AEs into the AT procedure. Motivated by weight perturbation methods in standard training, Adversarial Weight Perturbation (AWP) [56] adversarially perturbs both inputs and weights, markedly easing the robust overfitting issues and improving adversarial robustness. Additionally, Stochastic Weight Averaging (SWA) [28] is also a frequently used technology to reduce the negative impact of robust overfitting issues and enhance the model's robustness. Misclassification Aware adveRsarial Training (MART) [54] [46] , Semantic Constraint Adversarial Robust Learning (SCARL) [33] uses the text information to obtain robust semantic information of training samples, improving the model's robustness. Due to the positive impact of data augmentation on AT, Diverse Augmentation-based Joint Adversarial Training (DAJAT) [1] uses AutoAugment, SWA, and AWP to achieve an effective AT. To reduce the time consumption of AE generation, DAJAT adopts variable adversarial perturbation radius ϵ and inner step size α to reduce the iteration steps. OA-AT [2] uses SWA and variable ϵ and α to protect the model from AEs with large adversarial magnitudes. Li et al. [35] show that the effectiveness of data augmentations on robustness improvement depends on their impacts on the model's robust accuracy on test data, referred to as hardness. Moreover, the work proves that augmentation strategies with moderate hardness can protect the model from robust overfitting issues and enhance the model's robustness. Based on the phenomena, with variable adversarial perturbation radius ϵ, Improved Diversity and Balanced Hardness (IDBH) [35] combines several data augmentation strategies to obtain significant robustness improvement against various adversarial attacks. Recently, motivated by the stable diffusion (SD) model [30] , some methods [47, 23, 15, 55, 44] synthesize data by SD to enhance the model's robustness further.PGD-AT [40] formulates a min-max strategy to inject AEs into AT. The optimization objective isEQUATIONwhere x ′ i is the AE for x i , and L CE represents the cross-entropy (CE) loss. To achieve a better tradeoff between natural and robust accuracy, TRADES [61] incorporates both AEs and benign samples into training asEQUATION)where β is a weight parameter, and D KL represents the Kullback-Leibler (KL) divergence.For (x, y) ∈ D , its corresponding AE x ′ is initialized by adding a random noise (e.g., uniform noise in PGD and Gaussian noise in TRADES) on x, then iteratively updated by K steps followingEQUATIONwhere Π(•) is the projection operator, α is the projection inner step size, and k ∈ {0, ..., K -1}, with K typically set to 10.DFT transforms an image signal from the spatial domain into the frequency domain, while the inverse discrete Fourier transform (IDFT) reverses this process. Let F(•) and F -1 (•, •) denote the DFT and IDFT functions, respectively. Typically, DFT is independently applied to each channel of an image within the pixel space. An image x can be transformed into the frequency domain as follows:F(x)(u, v) = H h=1 W w=1 x(h, w) e -i2π(u h H +v w W ) ,where (h, w) denotes the pixel coordinates of x, and (u, v) ∈ [H] × [W ] signifies coordinates in the frequency domain. The real and imaginary parts of F(x) are denoted by Re(F(x)) and Im(F(x)), respectively. Then, the amplitude spectrum A(x) and phase spectrum P(x) are defined as follows:EQUATION)To better explore the proposed AAG, we present the amplitude spectrum mix-up operation visually and explore the impact of the λ range on the model's robustness in this part. First, we display and explain the visual results of the recombined samples and show the impact of the mix-up operation on the model's performance. Then, the experimental results of DAT with different ranges of λ are shown.Figure 8 (see page 28) shows the benign samples, amplitude spectrum, phase spectrum, generated amplitude spectrum, and recombined data. Compared to images with mixed amplitude spectrum, data recombined by replacing the original amplitude from the generated one entirely has a great gap for the original benign samples, reducing the natural and robust accuracy of the benign test samples. To better show the impact of the different strategies on the model's performance, we perform experiments with and without the mix-up operation. Table 5 shows the DAT with mix-up has a better performance. That indicates the model still needs some original information on the amplitude spectrum, showing the effectiveness of the mix-up operation. In this subsection, to fully explore the impact of the λ range on the model's robustness, we perform some experiments to show the impact of different λ on the natural and robust accuracy. As shown in the work, the mix-up operation to perturb A(x) by the generated A G (x) followsEQUATIONwhere 0 < λ < 1 , reserving some information of A(x). Suppose that λ ∼ Uniform(0, µ) , where 0 < µ < 1 , we perform experiments with different values of µ on CIFAR-10 and CIFAR-100 against AA, where β = 15 and ω = 2. As shown in Figures 4a and 4b , the test accuracy fluctuations between different values of µ are quite large, and the best settings of µ for natural and robust accuracy for CIFAR-10 and CIFAR-100 are different. For CIFAR-10, the model achieves the best natural performance when µ = 0.6, while its robust accuracy is better with µ = 0.8. For results on CIFAR-100, µ = 0.4 makes the best natural accuracy when the model achieves better robustness with µ = 0.6. In the work, there are already two hyper-parameters: ω and β. Moreover, the range of λ is more likely to influence the settings of ω and β. Consequently, we do not discuss the impact of different ranges of λ on the model's robust and natural accuracy in the main paper.For the real-valued x, it is noticed that F(•) need to be even-conjugate, i.e., F(x)(-u, -v) = F(x)(u, v), implying that the amplitude spectrum is symmetric. Conversely, IDFT returns realvalued signals for a symmetric amplitude spectrum. Consequently, G ψ only generates A G with the non-redundant and non-negative part of the amplitude spectrum.In the DAT training procedure, we use different BNs for the benign data and their recombined samples.In In this section, we add more details about the datasets and experimental settings. Moreover, the information about the robust evaluation is further introduced.To evaluate the performance of DAT, we select three widely used benchmark datasets for robust evaluation: CIFAR-10, CIFAR-100, and complex Tiny ImageNet [17] . CIFAR-10 and CIFAR-100 contain 50,000 32×32 training samples and 10,000 32×32 test images, categorized into 10 and 100 classes respectively. Tiny ImageNet is a challenge 200-class real-world dataset, where there are 500 training and 50 test images for each category, where the image size is 64×64. Moreover, due to the samples in the test set of Tiny ImageNet without labels, we evaluate the robustness of the validation set following [29, 33] .We For the proposed AAG, we use a four-linear layer structure to build it. Since only the non-negative part of the amplitude spectrum is produced, the output of AAG is processed by a Sigmoid function.In the model training procedure, we set the dimension of z as τ = 100. Due to the input of AAG combined by z and sample logits extracted by f θ , the input dimension of AAG is the sum of τ and class number c of D.The AAG is optimized by an SGD optimizer with a fixed learning rate 0.1, momentum 0.9, and weight decay 5e-4. For hyper-parameters, β and JS weight parameter ω are set as 15 and 2 respectively. During the training procedure, we adopt the basic data augmentation strategies, Random Crop and Random Horizontal Flip, for all selected datasets. For AE generation, the inner step size α is set to 2 /255 with K = 5 to generate adversarial perturbation ℓ ∞ -bounded with radius ϵ = 8 /255 following previous work [29, 37, 33] .For experimental result comparisons in this work, we select two typical PGD-AT and TRADES [40, 61] as baselines. Moreover, we adopt two types of existing methods to perform experimental result comparisons. For common type AT methods, which are trained with fixed ϵ = 8 /255 and inner step size α = 2 /255 and without any extra technologies, we select MART [54] , ST [37] , LAS-AT [29] and SCARL [33] . Additionally, some methods with complex strategies, such as AWP, SWA, variable ϵ, and changeable α are also selected as baselines. For AutoAugment-based DAJAT [1] consisting of AT, SWA, variable ϵ and α, we select it with one augmentation for a fair comparison. OA-AT [2] is a variable ϵ based AT method with SWA. IDBH [35] is an AT method based on the augmentation combination of Cropping, CutOut, and ColorShape, and is combined with AWP and SWA strategies.For the experimental results, we report the model's natural and robust accuracy. We select several widely used types of adversarial attacks to generate AEs for robustness evaluation. FGSM, PGD-20, PGD-100, and C&W ∞ are selected as basic methods to evaluate the model's robustness. To better show the model's robust generalization against different adversarial attacks, we also select AA consisting of black-box and white-box methods to evaluate the robustness of the model. The adversarial perturbation of these methods is ℓ ∞ -bounded with radius ϵ = 8 /255 and inner step size α = 2 /255.Due to the limitation of the pages, we perform some experiments on CIFAR-10 and CIFAR-100 to show the effectiveness of our proposed DAT further. In the first section, we show the experimental results on generated data with WRN-28-10. The experimental comparison between proposed DAT and some data augmentation strategies are presented in the second section. Then, we show the time consumption comparison between DAT and existing methods in the third part. The fourth subsection discusses the impact of different β and ω. Then, the impact of iteration K of AE generation on the model's performance is explored in the fifth subsection. In the sixth part, the AAG is combined with existing methods to verify its effectiveness. Then, we explore the influence of AAG's input. The last two subsections show the results comparison of single and dual AE generation of DAT and limitations of the work.In this subsection, following [47, 23, 15, 55, 44] , we take advantage of the diffusion model to synthesize data enhance the model's robustness further. Since these existing methods are combined with strategies such as AWP, SWA, variable ϵ and changed α, we use the DAT with AWP and SWA to show the experimental results comparison. Due to methods only providing single-time results, we just use the one-time test accuracy of DAT to compare with them on WRN-28-10. From Table 6 , compared with IKL-AT [15] , we can see DAT achieves about ∼0.69% and ∼0.48% robustness improvement with 1M and 20M generated data on CIFAR-10. On CIFAR-100, as shown in Table 7 , for current IKL-AT, the method with the best robustness against AA with WRN-28-10 on the RobustBench [11] , the model robustness is enhanced by ∼0.29% and ∼0.23% with 1M and 50M synthesized samples, respectively. Since the recombined data based on AAG can be regarded as an augmentation for benign samples, to better present the effectiveness of the proposed strategy, we combine the proposed AE generation method with three widely used augmentation policies in AT, such as CutOut [18] , CutMix [60] , and AutoAugment [14] , and perform experiments on CIFAR-10 and CIFAR-100. The settings of CutMix and CutOut are as [35] , while AutoAugment follows [1] . In these experiments, the baseline is AT with the proposed AE generation strategy. These selected data augmentation strategies adopt the same training strategy as DAT. As shown in Table 8 , for the baseline, these augmentations enhance the model's robustness against PGD-20 and AA. Compared to other strategies, DAT achieves robustness improvement of ∼1% on CIFAR-10 and ∼1.2% on CIFAR-100.In this part, we compare the time consumption of different methods on CIFAR-10 and CIFAR-100.From Table 9 , we can obtain the time consumption of DAT is slightly higher than PGD-AT and TRADES because of added AAG. Compared with recently proposed methods, DAT takes less time and achieves better robustness. Setting of ω. With β = 15 and K = 5, we discuss the settings of ω. Figure 6b shows the model's accuracy changes along with ω on both natural and AE. When ω < 2, the curves of robust accuracy rise. On the contrary, ω > 2 results in the performance decreasing. Unlike the robust accuracy, the model's performance on benign samples grows with the increase of ω. For better model robustness, ω is set as 2 in this work.(a) Impact of β on natural and robust accuracy.(b) Impact of ω on natural and robust accuracy. The generation iteration step K has an extremely important impact on the model's robust accuracy. As shown in Figure 7 , the larger the iteration step, the adversarial robustness against AA of the model rises with the increase of K. However, the larger K will significantly increase the time consumption of AT. To achieve a tradeoff between the model's robustness and time consumption, we set the iteration step as K = 5. Then, the time consumption of DAT will not be increased compared with existing methods.To further show the effectiveness of the proposed AAG, we combine AAG with PGD-AT and TRADES and perform experiments on CIFAR-10 and CIFAR-100 against PGD-20 and AA. Compared with PGD-AT and TRADES, the combinations with AAG enhance the model's robust and natural accuracy further. For the Generative Adversarial Nets (GANs), Conditional GANs (CGANs) [41] usually have higher quality generative results than vanilla ones. Consequently, motivated by CGAN, we use a combination of the sample logits from model f θ and stochastic sampling noise vector z ∼ N (0, I) following a standard Gaussian distribution as input of G ψ , which is different CGAN with one-hot label. To better show the effectiveness, we perform experiments on CIFAR-10 and CIFAR-100 against the PGD-20 and AA. Table 11 shows that the input of G ψ significantly influences the model's natural and robust accuracy. Moreover, the performance of input with logits has a smaller variance than in other cases, indicating the logits make the training runs more stable. As shown in Figure 9 (see page 28), the gaps between the generated amplitude spectrum of different inputs are quite small. However, the recombination from the input with z and logits have a small gap for benign samples, with no significantly changed sample.In the training procedure of DAT, we take both benign and recombined samples' AEs into AT. To reduce the time consumption of AE generation, we propose an efficient strategy to produce AEs.We can also generate AE of recombined data by mixing the generated amplitude spectrum with that in the benign sample's AE. For an example, with (x, y) ∈ D, we use the x's AE x ′ to obtain the amplitude of recombined AE asEQUATIONThen, x′ is obtained by We call such a procedure to obtain recombined data and AE a single AE DAT, while the process described in the main text is Dual AE DAT. To explore the difference in performance between the two AE generation strategies, we perform experiments with the same experimental settings in Sec. E.2 on CIFAR-10 and CIFAR-100 with ResNet-18. The PGD-20 and AA are selected to evaluate the model's performance with single or dual AE generation. As shown in Table 12 , we report the natural and robust results. According to these experiments, the natural accuracy gap for the DAT with single and dual AE is small, while the difference for the robust performance is large. As mentioned in the work, the amplitude spectrum of the sample influences the model's learning of the phase patterns. The single AE of DAT does not reflect the impact of mixed amplitude x on adversarial perturbation, resulting in a lower robust performance than dual AE for DAT. Additionally, as shown in Table 4 , although the model trained with single AE has a lower robust performance than common DAT, it still enhances the model's robustness compared to the baseline. That indicates the single AE for DAT can also enforce the model to learn more robust phase patterns.EQUATIONAlthough the proposed DAT significantly improves the model's robustness and natural accuracy of the model, there are still some limitations of the work. Since the robust over-fitting issues, DAT without AWP needs to be trained in a limited epoch, restricting its performance. Moreover, our DAT focused on protecting from adversarial attacks. Other types of image corruptions, e.g., Gaussian noise, and defocus blur, can also influence the model's performance. DAT needs to be developed further to protect the model from various image corruptions. Due to the limitation of page length, we only provide the experimental results on three frequently used datasets and deep models in the main paper. In the future, we will add experiments on more large-scale datasets with different deep models.Here we restate and prove Theorem 3.2. Theorem 3.2 (Weight Regularization of Amplitude Features). Grant Assumption 3.1, when the empirical risk R is minimized with some convex loss function L (e.g. CE loss): R(W) := 1 |D| (x,y)∈D E t(x)∼T (x) L W ⊤ h(t(x)), y , we have w j,a → 0 for all j ∈ [c], where w j,a is the corresponding weights of amplitude features h a .We consider a quadratic approximation of the objective in Theorem 3.2, and provide a further and extended analysis following [16, 26] . Using the second-order Taylor expansion, we expand each term of the objective function:EQUATIONwhere h = E t(x)∼T (x) [h(t(x))] , ∆ = W ⊤ h(t(x)) -h , and H is the Hessian matrix with ζ denoting the remainder. We introduce Lemma G.1 to demonstrate the properties of H. Lemma G.1. For the CE loss with softmax, the Hessian matrix w.r.t. the loss function satisfies1. H ⪰ 0, i.e., H is semi-definite.2. H is independent of the true label vector y.Proof. The CE loss for a single instance x, when given the true label vector y (using one-hot encoding with c-dimension) is defined asEQUATIONThe gradient of L w.r.t. the logits is computed asEQUATIONfor k ∈ [c], where p k = σ(z) k is the predicted probability of class k. The Hessian matrix H, which is the matrix of second derivatives of L, has elements given byEQUATIONUsing the derivation properties of the softmax function, the above derivative simplifies toEQUATIONwhere δ kj is the Kronecker delta, equal to 1 if k = j and 0 otherwise. Thus, the Hessian matrix H isEQUATION)Positive Semi-Definiteness. The Hessian matrix can be expressed in matrix form asEQUATIONwhere P is a diagonal matrix with diagonal entries p k , and I is the identity matrix. The product of P and I -P, where P is a diagonal matrix with entries between 0 and 1, ensures that H is positive semi-definite.Independence from Label y. The structure and values of H depend solely on the predicted probabilities p, which are functions of z and not dependent on the specific values of y. This characteristic signifies that the Hessian's form is invariant w.r.t. the true label vector y, thus highlighting its independence.In the following, we omit the subscript of the expectation in Eq. ( 15) for simplicity. According to [8] , when minimizing R, the first term in RHS of Eq. ( 15) may be no room for further improvement because the local optima has nearly the same value as the global optimum in neural networks, and we put our main focus on the second term. We first derive an upper bound for the second term in Lemma G.2, since directly optimizing it which requires a third-order derivative is intractable. Lemma G.2 (stated informally, cf . Theorem 3.1 in [8] ). Assume that the covariance between ∥H∥ F and ∥∆∥ 2 is zero, we can get the upper bound of the second term asEQUATION)Proof. By Hölder's inequality, we haveEQUATIONwhere 1 /p + 1 /q = 1, ∥ • ∥ r,q is an induced matrix norm. When p = q = r = 2, we haveEQUATIONIntuitively, since ∥H∥ F represents the sharpness/flatness of loss landscape, and ∥∆∥ 2 describes the translation of landscape, the two terms can be assumed independent, where their covariance can be assumed as zero [8] . Consider the latter item in RHS of Eq. ( 22):EQUATIONwhere Σ is the covariance matrix of h(t(x)). For a model trained well enough, the feature extractor can completely distinguish different features, i.e., Σ is a diagonal matrix. Then we can obtainEQUATIONwhere w j,i is the j-th entry of w i . If the variance of the feature h i (t(x)) is large, minimizing the empirical risk R requires c j=1 w 2 j,i → 0 =⇒ w j,i → 0 for all j ∈ [c]. By Assumption 3.1, it is trivial that Var[h a (t(x))] > Var[h p (t(x))] and therefore w j,a → 0. Under this circumstance, the model is enforced to learn more phase information. The claim follows. 


Decision: **Summary of the paper**

This paper proposes a new adversarial training method that improves adversarial robustness. Specifically, the authors focus on the frequency domain of adversarial perturbations and empirically verify that forcing the model to focus on the phase pattern would make the model more robust against adversarial attacks. Based on this observation, the authors propose an adversarial training strategy in which the model can learn the phase pattern unaffected by the adversarial attack. In particular, the authors suggest using a separate adversarial amplitude generator to keep the phase pattern unaffected by the adversarial attack. The authors provide some theoretical findings and experimental results regarding the proposed strategy.

**Summary of the discussion**

* In general, the reviewers mentioned similar strengths of the paper.
  * The paper is well-organized and easy to read.
  * Experiments show the improvement well. 
* Reviewer 8ttu pointed out two problems with the authors’ method.
  * First, the experiment baselines are weak, and one existing method, DAJAT, performs better. Regarding the first point, the authors emphasized that the proposed method requires fewer augmentations per sample compared to other methods that the reviewer mentioned.
  * Also, the proposed method is so complicated that it might require extensive searching for hyperparameters. Regarding this concern, the authors clarified that their method uses only two hyperparameters, which is much simpler than the existing methods.
  * After the discussion, the reviewer changed the rating from 5 to 6.
* Reviewer KucH pointed out three problems with the authors’ method.
  * First, only decision space attacks are used for performance evaluation.
  * Second, the authors should have used more models for experiments.
  * Third, the experiments were not performed on the ImageNet dataset.
  * The authors referred to their existing results (in the Appendix) regarding all the points.
  * After the discussion, the reviewer stayed at the original rating of 5.
* Reviewer FTsi pointed out two problems.
  * First, the proposed method is too complicated. Regarding the first concern, the authors emphasize that the method contains only two modules to argue that the proposed method is simple enough.
  * Second, some descriptions could be clearer, and some details should be included. The reviewer asked for clarification of the missing details as Questions. Then, the authors answered all four questions from the reviewers, providing more references.
  * After the discussion, the reviewer changed the rating from 5 to 6

**Justification of my evaluation**

* My rating is 6.
* I agree with the strengths the reviewers mentioned. The experiments show improvement, and the performance looks convincing.
* The authors communicated with the reviewers effectively, and as a result, two reviewers increased their ratings.
* All the weaknesses that Reviewer KucH mentioned were covered in the Appendix, so the reviewer should have changed the rating. The reviewer told me it does not fully address the questions, but I disagree with the reviewer's point that the experiments were insufficient.

I’m confident about my evaluation and recommend accepting this work (poster).

Reviews: review: paper_summary: paper_summary: This paper investigates a novel approach to improving adversarial training by performing data augmentation in the frequency domain. The authors propose a unique pipeline that jointly optimizes a classification network and a generator network. The generator is used to create adversarial noise, which is added to the amplitude component of the input to encourage the model to more accurately capture phase patterns. The authors conduct a comprehensive evaluation of their approach across multiple datasets and architectures, demonstrating its competitive performance.
strength_weakness: strength_weakness: In Table 1 and Table 2, the authors have only compared their approach with a few weak baselines. Since the proposed approach is based on data augmentation, the authors should consider comparing it with other data augmentation-based approaches, such as DAJAT[1] and [47]. Although DAJAT’s results are presented in Table 3, the table does not show the clean accuracy of the models, making it difficult to assess the accuracy-robustness tradeoff. In fact, DAJAT’s clean accuracy is significantly higher than that of the proposed approach. For instance, DAJAT’s clean accuracies on CIFAR-10 and CIFAR-100 (with ResNet-18) are 86.67% and 66.96%, respectively, while the proposed approach’s are 84.17% and 63.28%. [37]’s clean accuracy and AA robust accuracy with WRN-34-10 are 86.18% and 58.09%, respectively, while the proposed approach’s with WRN-34-10 are 86.78% and 56.46%.

The proposed pipeline is complicated, with a multi-part loss function and a requirement for joint optimization with a generator network. This complexity may necessitate extensive hyperparameter tuning to achieve satisfactory performance, making it a much more complex error-prone solution compared to data augmentation approaches such as [1] and [47].
questions: questions: No questions
limitations: limitations: Yes
paper_summary: paper_summary: The paper introduces Dual Adversarial Training (DAT). This method enhances deep neural network resilience against adversarial attacks by employing generative amplitude mix-up in the frequency domain, focusing the model on phase patterns less impacted by such perturbations, and presenting an optimized adversarial amplitude generator for balancing robustness improvements with phase pattern retention. Experiments validate DAT's effectiveness against diverse adversarial attacks.
strength_weakness: strength_weakness: 1. In the experiment, only decision space attacks are used to test the defense capability. Compared with decision space attack, feature space attack can better destroy the semantic information of benign images and obtain more powerful adversarial samples. It is recommended that some feature space attacks be added to further demonstrate the effectiveness of the proposed method, like [a] and [b]. 

[a] StyLess: Boosting the Transferability of Adversarial Examples, CVPR 2023

[b] Enhancing the Self-Universality for Transferable Targeted Attacks, CVPR 2023

2. The types of models used in the experiment are not rich enough. Line 258 of this paper states that "ResNet-18, WideResNet-34-10 (WRN-34-10), and WideResNet-28-10 (WRN-28-10) are used as the backbones". Line 269 says "Table 1 displays the results on CIFAR-10, CIFAR-100, and tiny-ImageNet using ResNet-18". These models are all based on ResNet architecture and have high structural similarities. To show that the method proposed in this paper is generalizable, the proposed method should be able to achieve good results on different surrogate and target models. Therefore, it is recommended to add more surrogate and target models, such as Inception_v3, ViT, etc. 

3. This paper uses CIFAR-10, CIFAR-100, and Tiny ImageNet for experiments, but does not use ImageNet. However, ImageNet is the most widely used dataset in the CV field. The authors should provide additional experimental results on ImageNet for this paper's method.
questions: questions: 1. Can the authors provide some results against feature space attacks?

2. Can the authors provide some results on other models and datasets, like ImageNet and ViTs?
limitations: limitations: The authors have discussed the limitations of the method proposed in this paper. It is suggested that the authors provide some results on other models and datasets, like ImageNet and ViTs.
paper_summary: paper_summary: Motivated by observation on the difference influence of amplitude and phase of adversarial examples, this paper propose a framework to generate better adversarial examples for adversarial training. Experiments verify the effectiveness of the proposed approach.
strength_weakness: strength_weakness: 1. The proposed framework contain many modules, making it complex and difficult to implement.
2. Some descriptions are unclear and some details are missed.

See questions for details.
questions: questions: 1. In Figure 1, the authors claim that “The adversarial perturbation severely damages phase pattern and the frequency spectrum, while amplitude patterns are rarely impacted.” However, this comparison is not clear. It seems the amplitude patterns still changes a lot in Figure 1. Both the patterns and spectrum change. Could you provide more proof on this observation (e.g., results on more images and more datasets)?
2. In Line 88, the features induced from the amplitude and phase patterns of x are denoted as $h_a(\mathbf{x})$ and $h_p(\mathbf{x})$ respectively.  Does it indicate an assumption that some parts of the learned $h$ correspond to the amplitude features? Do we need carefully design the network to explicitly accomplish this? It also makes the theoretical analysis in Sec. 3.4 difficult to understand.
3. As the proposed framework contains multiple modules and optimization steps, it is surprising that the additional time consumptions are small. Could you please kindly provide more explanation on this? Do we need any relatively complex optimization tricks? Furthermore, what is the memory cost during training and could you please present the corresponding comparison with the baseline methods?
4. It seems the mix-up operation is important in the whole framework. The adversarial amplitude and original amplitude are mixed by linear combination and the proportion is sampled from a uniform distribution. How do you make such a design? Have you ever tried other possible methods?
limitations: limitations: The authors discuss the limitations of this work in Sec. F.9 and say that the verification may be insufficient. No limitation of the proposed method itself is discussed.

Comments: title: Re: Official Comment by Reviewer KucH
Follow-up on Submission1111 Rebuttal - Urgent Request for Feedback
Follow-up on Submission1111 Rebuttal - Request for Timely Feedback
Request for Timely Reviewer Feedback Before Deadline
(Continued) Re: Type of augmentations
Re: Type of augmentations
Type of augmentations
Follow-up on Submission1111 Rebuttal Response
Follow-up on Submission1111 Rebuttal Response
comment: Dear Reviewer,

We are truly grateful for your continued time and effort in further discussing our submission. Below is our detailed response to the two questions you raised.

---

> ***"For W1. could you please explain why you use a different dataset and a different threat model (a black-box setting) than those of Table 1 in the main paper?"***

+ **Dataset:**  
The training dataset used in [a] and [b] is ImageNet-1k. We understand your concern and would like to clarify that existing adversarial training methods with multiple iteration steps for AE generation do not report results on ImageNet-1K, since AT with a 10-step AE generation on ImageNet-1K requires **approximately one week**. Additionally, these feature space attacks need to be performed on real-world dataset, e.g. ImageNet. Given these considerations, we choose ImageNette, a widely used subset of ImageNet-1K in adversarial training [c], for the experiments in **W1**.

+ **Backbones:**  
In [a] and [b], multiple backbones are adopted, including ResNet-50 and DenseNet-121. To better demonstrate the robust generalization of our method against feature space attacks, we select ViT-S, which **you mentioned in W2**, for experiments in **W1**. It is important to note that baselines in **W1** do not provide experimental results and settings with so many backbones, meaning we need significant time to explore these methods' settings across different backbones. Furthermore, given the rebuttal's **6000 characters** limit, it is challenging to present results for so many backbones. Consequently, to balance these factors and provide a clear comparison, combining the considerations of both **W1** and **W2**, we select **ResNet-50, DenseNet-121, and ViT-S** for **W1**.

---

> ***"For W3, could you please explain why you use different attacks than those of Table 1 (FGSM, PGD-20, PGD-100, C&W, and AA) in the main paper?"***

The adversarial attacks we evaluate in **W3** follow [h]. To ensure a fair and consistent comparison on ImageNet-1K, we use these specific adversarial attacks to provide the results in  **W3**.

---

We sincerely hope these clarifications address your concerns. If there are any further questions or if you require additional explanations, we are more than happy to provide them. We also hope that if our responses sufficiently address your concerns, you might consider reflecting this positively in your review score.
Thank you for your responses! 

For W1. could you please explain why you use a different dataset and a different  threat model (a black-box setting) than those of Table 1 in the main paper? 

For W3, could you please explain why you use different attacks than those of Table 1 (FGSM, PGD-20, PGD-100, C\&W, and AA)  in the main paper?
Dear Reviewer,

We are truly sorry to trouble you again, but with **less than 8 hours** left before the rebuttal discussion period ends at ***11:59 PM AoE today***, we are writing with a humble and heartfelt request for your feedback on our rebuttal. We have put our utmost effort into addressing your invaluable comments and suggestions. We would be deeply grateful if you could take a few moments to review our responses and share any further thoughts. If our responses are satisfactory, we would be sincerely thankful if you might consider reflecting this in your review score.

We greatly value your guidance, and we are genuinely appreciative of your time and consideration.

Thank you so much for your continued support.

Best regards,  
Submission1111 Authors
Dear Reviewer,

We are truly grateful for your prompt response and for adjusting your rating. Your thoughtful feedback has been invaluable in refining our work, and we sincerely appreciate the time and effort you have dedicated to our submission. We will incorporate your suggested experiments and further clarifications in the final version.

Thank you once again for your support.
Thank the authors for the clarifications which have addressed my concerns. I have adjusted my rating accordingly.
Dear Reviewer,

We hope this message finds you well. We apologize for reaching out again, but with the rebuttal discussion period **ending in less than 24 hours** on ***Aug 13, 11:59 PM AoE***, we kindly request your timely feedback on our rebuttal.

To briefly restate our previous points in our rebuttal:

- We conduct additional experiments on **feature space attacks**, including the SMTDI/SMTDSI [a] and DCS/DLS [b] methods that you suggested. These experiments demonstrate the robustness of our approach against more challenging adversarial attacks.

- We expand our experiments to incorporate **diverse backbones**, such as Inception_v3 and ViT-S, showing that our method generalizes well across different network architectures.

- We provide **extensive results on the ImageNet-1K dataset**, which is a critical benchmark in the CV field. Our results show significant improvements in robustness compared to baseline methods.

These comprehensive efforts are made with great care to thoroughly address your concerns and demonstrate the generalization and robustness of our approach across different models and datasets.

If our rebuttal has satisfactorily addressed your concerns, we humbly request that you consider reflecting this positively in your rating score. We would be deeply grateful for your timely input.

Thank you very much for your continued support and thoughtful consideration.

Best regards,  
Submission1111 Authors
Dear Area Chairs and Reviewers,

We sincerely appreciate the time and effort you and the reviewers dedicate to evaluating our submission. We are encouraged that **all reviewers view our work positively**. Following ***Reviewer FTsi***'s feedback, we clarify key technical aspects and conduct additional experiments, which are well received and **result in a score increase**. However, although ***Reviewer 8ttu*** has responded to our rebuttal, we are still awaiting a response to our latest comment, and ***Reviewer KucH*** has not yet responded to our rebuttal.

In response to ***Reviewer 8ttu***'s question regarding the **type of augmentations**, we offer further explanations with a detailed description of the augmentation approach used in DAJAT [1] and our DAT in **Re: Type of augmentations**, and a specific example in **(Continued) Re: Type of augmentations**.

For ***Reviewer KucH***, we expand our experiments to include **feature space attacks**, add **additional backbones like Inception_v3 and ViT-S**, and provide results on the **ImageNet-1K dataset**. These comprehensive experiments demonstrate the generalization and robustness of our method across different models and datasets, providing a thorough response to the reviewer's concerns about the scope and applicability of our approach.

As the rebuttal discussion period ends in **less than 24 hours**, ***Aug 13, 11:59 PM AoE***, we are concerned that we may not have sufficient time to address any potential additional feedback that may arise. We would be deeply grateful if you could kindly remind ***Reviewers 8ttu*** and ***KucH*** to review our responses at their earliest convenience. Your assistance in this matter would be greatly appreciated.

Thank you once again for your continued support and consideration.

Best regards,  
Submission1111 Authors
To provide a clearer understanding of the statements "DAJAT [1] applies 2 and 3 data augmentations" and "we extend our DAT to include 2 and 3 augmentations", we offer a detailed explanation using a benign sample $(\mathbf{x},y)\in\mathcal{D}$ as an example.

---

### **For adversarial training with model $f$ using DAJAT [1], augmented data is generated as follows:**

+ **2 augmentations (#Aug. 2)**:

    + Generate augmented data via AutoAugment:

      $\mathbf{x}_1$=$\mathrm{AutoAugment}(\mathbf{x}),  \quad \mathbf{x}_2$=$\mathrm{AutoAugment}(\mathbf{x})$.

    + Generate adversarial examples for $\mathbf{x}$,  $\mathbf{x}_1$, and $\mathbf{x}_2$ as $\mathbf{x}^{\prime}$,  $\mathbf{x}_1^{\prime}$, and $\mathbf{x}_2^{\prime}$, respectively.

    DAJAT then uses $\mathbf{x}$,  $\mathbf{x}_1$, $\mathbf{x}_2$, $\mathbf{x}^{\prime}$,  $\mathbf{x}_1^{\prime}$, and $\mathbf{x}_2^{\prime}$ for training.

+ **Similarly,  DAJAT with 3 augmentations (#Aug. 3) follows the same procedure.**

---

### **For our DAT with IDFT $\mathcal{F}^{-1}(\cdot)$, model $f$, and adversarial amplitude generator $G$, recombined data  (which can be regarded as augmented data) is generated as follows:**
 
+ **2 recombined data (#Aug. 2)**:

    + Generate adversarial amplitude:
 
      $\mathcal{A_1}(\mathbf{x})=G (f(\mathbf{x}), \mathbf{z}_1),  \quad \mathrm{where}\ \mathbf{z}_1 \sim \mathcal{N}(0,1)$, 

      $\mathcal{A_2}(\mathbf{x})=G (f(\mathbf{x}), \mathbf{z}_2),  \quad \mathrm{where}\ \mathbf{z}_2 \sim \mathcal{N}(0,1)$.

    + Obtain recombined data:

      $\hat{\mathbf{x}}_1=\mathcal{F}^{-1}(\lambda_1 \cdot \mathcal{A_1}(\mathbf{x})+(1-\lambda_1)\cdot \mathcal{A}(\mathbf{x}),\mathcal{P}(\mathbf{x})), \quad \mathrm{where}\ \lambda_1\sim \mathrm{Uniform}(0,1)$,

      $\hat{\mathbf{x}}_2=\mathcal{F}^{-1}(\lambda_2 \cdot {\mathcal{A_2}}(\mathbf{x})+(1-\lambda_2)\cdot \mathcal{A}(\mathbf{x}),\mathcal{P}(\mathbf{x})), \quad \mathrm{where}\ \lambda_2\sim \mathrm{Uniform}(0,1)$.

    + Generate adversarial examples **with the same settings as DAJAT** for $\mathbf{x}$, $\hat{\mathbf{x}}_1$, and $\hat{\mathbf{x}}_2$ as $\mathbf{x}^{\prime}$, $\hat{\mathbf{x}}_1^{\prime}$, and $\hat{\mathbf{x}}_2^{\prime}$, respectively.

    Our DAT then uses $\mathbf{x}$,  $\mathbf{x}_1$, $\mathbf{x}_2$, $\mathbf{x}^{\prime}$,  $\mathbf{x}_1^{\prime}$, and $\mathbf{x}_2^{\prime}$ for training, **following the settings of DAJAT**.

+ **Similarly,  DAT with 3 recombined data (#Aug. 3) follows the same strategy.**

---

We hope this explanation provides greater clarity on the augmentations used in our approach. If there are any further questions or points that require clarification, we would be most grateful for your feedback. If our rebuttal has satisfactorily addressed your concerns, we humbly request that you consider reflecting this positively in your rating score.

Thank you once again for your time, thoughtful consideration, and continued support.

---
Dear Reviewer,

Thank you very much for your prompt response and for your continued engagement with our submission. We appreciate the opportunity to clarify our approach, and below we provide detailed responses to the two points you raised.

---

> ***"DAJAT applies 2 and 3 data augmentations"***

Regarding your question on DAJAT [1], the natural accuracy that you referenced is achieved by generating 2 or 3 augmented data samples for each benign sample using the **AutoAugment** strategy. These benign and augmented samples, along with their corresponding adversarial examples, are then utilized in the training process.

---

> ***"we extend our DAT to include 2 and 3 augmentations"***

In our Dual Adversarial Training (DAT) approach, the recombined data with mixed amplitude spectra serve as augmented samples for each benign sample. **To ensure a fair comparison with DAJAT [1], we employ the adversarial amplitude generator to produce 3 distinct adversarial amplitude spectra. These spectra are subsequently mixed with the amplitude spectrum of the benign sample. By combining the phase spectrum of the benign sample with each of these mixed amplitude spectra, we generate 3 recombined data samples.** These are considered as 3 augmentations of the original benign sample. For a more detailed explanation of the augmentation process, including formulas, please refer to the subsequent comment titled **(Continued) Re: Type of augmentations**.

---

Using these recombined data, we conduct the experiments detailed in **Table A.1**, providing a comparison with DAJAT using 2 and 3 augmentations. Our results indicate that our DAT method offers a superior accuracy-robustness trade-off under identical experimental conditions.

We hope this explanation clarifies your concerns. We greatly appreciate your valuable feedback and look forward to any further questions or comments you may have.

---
Thank the authors for the additional experiments. Could the authors clarify what do they mean by "DAJAT applies 2 and 3 data augmentations"? Additionally, in the statement "we extend our DAT to include 2 and 3 augmentations", what are the specific types of augmentations used?
Dear Reviewer,

We hope you are doing well. We sincerely appreciate the detailed feedback and the time you have devoted to reviewing our submission.

In our recent rebuttal, we carefully address your concerns and provide detailed responses:

- **Additional Experiments on Feature Space Attacks**: We conduct experiments on several **feature space attacks**, specifically including methods like **SMTDI/SMTDSI [a] and DCS/DLS [b]** as you suggested, to demonstrate the robustness of our approach against more challenging adversarial attacks. These results show that our method performs better than previous SOTA techniques in most scenarios, despite being originally designed for pixel space attacks.

- **Incorporating Diverse Backbones**: We expand our experiments to include **additional backbones such as Inception_v3 and ViT-S**, demonstrating that our method generalizes well across different network architectures. The results confirm that our approach maintains its effectiveness and robustness across these diverse models.

- **Extensive Experiments on ImageNet-1K**: We also provide **extensive results on the ImageNet-1K dataset**, a critical benchmark in the CV field. Given the time constraints, we combine our method with fast adversarial training techniques like FGSM-PGK and FGSM-PGI, achieving significant improvements in robustness compared to the baseline methods.

These comprehensive experiments are conducted with great care to address your concerns about the scope and applicability of our approach, and to demonstrate its generalization and robustness across different models and datasets.

With the rebuttal discussion period closing tomorrow, ***Aug 13, 11:59 PM AoE***, we would deeply appreciate your input if there are any further questions or points that you feel need clarification. If our rebuttal has satisfactorily addressed your concerns, we humbly request that you consider reflecting this positively in your rating score.

Thank you very much for your continued support and thoughtful consideration.

Best regards,  
Submission1111 Authors
Dear Reviewer,

I hope this message finds you well. We sincerely appreciate the time and effort you invest in reviewing our submission.

In our recent rebuttal, we carefully address your feedback and provide detailed responses to your concerns:

- **Expanded Comparison with Data Augmentation-Based Approaches**: We conduct additional experiments to ensure a **fair comparison** with more data augmentation-based methods, specifically including **DAJAT and Rebuffi et al. [47]**. We provide an in-depth analysis demonstrating that our approach not only **enhances robustness** but also achieves **comparable or better natural accuracy** under similar conditions.

- **Comprehensive Analysis of Accuracy-Robustness Trade-off**: We offer a detailed examination of both **natural and robust accuracy**, showing how our method **balances these two metrics effectively**. For instance, our method **outperforms DAJAT in robustness** while maintaining **competitive natural accuracy**, as outlined in our comparison tables.

- **Clarification on Pipeline Complexity**: We clarify concerns regarding the **complexity of our pipeline**, explaining that while our method involves multiple components, it is designed to require **fewer hyperparameters and simpler optimization steps** than comparable methods. We also demonstrate that our approach is **more efficient** in terms of **training time and computational cost**, particularly when compared to methods like **[47]**, which require longer iteration steps for adversarial example generation.

As the rebuttal discussion period ends tomorrow, ***Aug 13, 11:59 PM AoE***, we would be truly grateful if you could let us know if there are any remaining questions or concerns regarding our submission. If our responses have satisfactorily addressed your concerns, we kindly hope you might consider reflecting this in your review score by raising it.

Thank you once again for your thoughtful feedback and for considering our request.

Best regards,  
Submission1111 Authors
Dear Reviewer，

We greatly appreciate your responses and score improvements. Also, the final version of the paper will be revised based on your comments.
The rebuttal mostly addresses my concerns. Therefore, I decide to increase the score.