Improving Adversarial Robust Fairness via Anti-Bias Soft Label  Distillation

Authors: shiji  zhao
ranjie  duan
xizhe  wang
xingxing  wei
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-10 09:42:07

Abstract: Adversarial Training (AT) has been widely proved to be an effective method to improve the adversarial robustness against adversarial examples for Deep Neural Networks (DNNs). As a variant of AT, Adversarial Robustness Distillation (ARD) has demonstrated its superior performance in improving the robustness of small student models with the guidance of large teacher models. However, both AT and ARD encounter the robust fairness problem: these models exhibit strong robustness when facing part of classes (easy class), but weak robustness when facing others (hard class). In this paper, we give an in-depth analysis of the potential factors and argue that the smoothness degree of samples' soft labels for different classes (i.e., hard class or easy class) will affect the robust fairness of DNNs from both empirical observation and theoretical analysis. Based on the above finding, we propose an Anti-Bias Soft Label Distillation (ABSLD) method to mitigate the adversarial robust fairness problem within the framework of Knowledge Distillation (KD). Specifically, ABSLD adaptively reduces the student's error risk gap between different classes to achieve fairness by adjusting the class-wise smoothness degree of samples' soft labels during the training process, and the smoothness degree of soft labels is controlled by assigning different temperatures in KD to different classes. Extensive experiments demonstrate that ABSLD outperforms state-of-the-art AT, ARD, and robust fairness methods in the comprehensive metric (Normalized Standard Deviation) of robustness and fairness.

Main paper: 
 introduction: 
 Deep neural networks (DNNs) have achieved great success in various tasks, e.g., classification [10] , detection [6] , and segmentation [24] . However, DNNs are vulnerable to adversarial attacks [30; 35; 33; 34] , where adding small perturbations to the input examples will lead to misclassification. To enhance the robustness of DNNs, Adversarial Training (AT) [20; 41; 32; 14] is proposed and has been proven to be an effective method to defend against adversarial examples. To further improve the robustness, Adversarial Robustness Distillation (ARD) [7] as a variant of AT is proposed and aims to transfer the robustness of the large models into the small models based on Knowledge Distillation (KD), and further researches [44; 45; 43; 12; 42] show the excellent performance of ARD.Although AT and ARD can remarkably improve the adversarial robustness, some researches [2; 31; 39; 19; 28; 38] demonstrate the robust fairness problem: these models perform strong robustness on part of classes (easy class) but show high vulnerability on others (hard class). This phenomenon will raise further attention to class-wise security. Specifically, an overall robust model appears to be relatively safe for model users, however, the robust model with poor robust fairness will lead to attackers targeting vulnerable classes of the model, which leads to significant security risks to potential applications. Different from simply improving the overall robustness, some methods are proposed to address the robust fairness problem in AT and ARD [39; 36; 38; 19; 28] (i.e., improving the worst-class robustness as much as possible without sacrificing too much overall robustness). However, the robust fairness problem still exists and requires further to be explored.For that, we give an in-depth analysis of the potential factors to influence robust fairness in the optimization objective function. From the perspective of the training sample, the sample itself has a certain degree of biased behavior, which is mainly reflected in the different learning difficulties and various vulnerabilities to adversarial attacks. For this reason, previous works apply the reweighting ideology to achieve robust fairness for different types of classes in the optimization process [39; 36; 38] . However, as another important factor in the optimization objective function, the role of the labels applied to guide the model's training is ignored. Labels can be divided into two types, including one-hot labels and soft labels, where the soft labels are widely studied [29; 11] and have been proven effective in improving the performance of DNNs. Inspired by this, we try to explore robust fairness from the perspective of samples' soft labels. Interestingly, we first find that the smoothness degree of soft labels for different classes (i.e., hard and easy class) can affect the robust fairness of DNNs from both empirical observation and theoretical analysis. Intuitively speaking, sharper soft labels mean larger supervision intensity, while smoother soft labels mean smaller supervision intensity, so it is helpful to improve robust fairness by assigning sharp soft labels for hard classes and smooth soft labels for easy classes.Based on the above finding, we further propose an Anti-Bias Soft Label Distillation (ABSLD) method to mitigate the adversarial robust fairness problem within the framework of knowledge distillation. ABSLD can adaptively adjust the smoothness degree of soft labels by re-temperating the teacher's soft labels for different classes, and each class has its own teacher's temperatures based on the student's error risk. For instance, when the student performs more error risk in some classes, ABSLD will compute sharp soft labels by assigning lower temperatures, and the student's learning intensity for these classes will relatively increase compared with other classes. After the optimization, the student's robust error risk gap between different classes will be reduced. The code can be found in https://github.com/zhaoshiji123/ABSLD.Our contribution can be summarized as follows:• We explore the labels' effects on the adversarial robust fairness of DNNs, which is different from the existing sample perspective. To the best of our knowledge, we are the first one to find that the smoothness degree of samples' soft labels for different types of classes can affect the robust fairness from both empirical observation and theoretical analysis.• We propose the Anti-Bias Soft Label Distillation (ABSLD) to enhance the adversarial robust fairness within the framework of knowledge distillation. Specifically, we re-temperate the teacher's soft labels to adjust the class-wise smoothness degree and further reduce the student's error risk gap between different classes in the training process.• We empirically verify the effectiveness of ABSLD. Extensive experiments on different datasets and models demonstrate that our ABSLD can outperform state-of-the-art methods against a variety of attacks in the comprehensive metric (Normalized Standard Deviation) of robustness and fairness.2 Related WorkQuestion: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?Answer: [Yes] Justification: See Sec. 1.Guidelines:• The answer NA means that the abstract and introduction do not include the claims made in the paper. • The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers. • The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings. • It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper. 
adversarial training: 
 To defend against the adversarial examples, Adversarial Training (AT) [20; 41; 32; 13; 25] is regarded as an effective method to obtain robust models. AT can be formulated as a min-max optimization problem as follows:EQUATIONwhere f (•; θ) represents a deep neural network with weight θ, D represents a data distribution with clean example x and the ground truth label y. L represents the optimization loss function, e.g. the cross-entropy loss. δ represents the adversarial perturbation, and Ω represents a bound, which can be defined as Ω = {δ : ||δ|| ≤ ϵ} with the maximum perturbation scale ϵ. To further improve the performance, some variant methods of AT appear including regularization [21; 41; 32] , using additional data [27; 22] , and optimizing iteration process [15; 23] . Different from the above methods for improving the overall robustness, in this paper, we focus on solving the robust fairness problem.Knowledge Distillation [11] as a training method can effectively transfer the large model's knowledge into the small model's knowledge, which has been widely applied in different areas. To enhance the adversarial robustness of small DNNs, Goldblum et al. [7] first propose Adversarial Robustness Distillation (ARD) by applying the clean prediction distribution of strong robust teacher models to guide the adversarial training of student models. Zhu et al. [44] argue that the prediction of the teacher model is not so reliable, and composite with unreliable teacher guidance and student introspection during the training process. RSLAD [45] applies the teacher clean prediction distribution as the guidance to train both clean examples and adversarial examples. MTARD [43; 42] applies clean teacher and adversarial teacher to enhance both accuracy and robustness, respectively. AdaAD [12] adaptively searches for optimal match points by directly applying the teacher adversarial prediction distribution in the inner maximization. In this paper, we explore how to enhance robust fairness within the framework of knowledge distillation.Some researchers address the robust fairness problem from different views [39; 18; 36; 38; 19; 37; 28] and improve the fairness without losing too much robustness. The most intuitive idea is to give different weights to the sample of different classes in the optimization process, and Xu et al. [39] propose Fair Robust Learning (FRL), which adjusts the loss weight and the adversarial margin based on the prediction accuracy of different classes. [37] argue that the maximum entropy regularization for the model's prediction distribution can help to achieve robust fairness. Wei et al. [36] propose Class-wise Calibrated Fair Adversarial Training (CFA) to address fairness by dynamically customizing adversarial configurations for different classes and modifying the weight averaging operation. To enhance the ARD robust fairness, Yue et al. [38] propose Fair-ARD by re-weighting different classes based on the vulnerable degree. Different from these sample-based fairness methods, we try to solve this problem from the perspective of samples' labels, by adjusting the class-wise smoothness degree of samples' soft labels in the optimization process. For the soft labels with different smoothness degrees, we use sharper soft labels for hard classes and use smoother soft labels for easy classes. We select two DNNs (ResNet-18 and MobileNet-v2) trained by SAT [20] on CIFAR-10. The robust accuracy is evaluated based on PGD. The checkpoint is selected based on the best checkpoint of the highest mean value of all-class average robustness and the worst class robustness following [36] . We see that blue lines and red lines have similar average robustness, but the worst robustness of blue lines are remarkably improved compared with red lines.Question: Does the paper discuss the limitations of the work performed by the authors?Answer: [Yes] Justification: See Appendix A.8.Guidelines:• The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper. • The authors are encouraged to create a separate "Limitations" section in their paper.• The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be. • The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated. • The authors should reflect on the factors that influence the performance of the approach.For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon. • The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size. • If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness. • While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations. 
robust fairness via smoothness degree of soft labels: 
 As an important part of the model optimization, label information used to guide the model plays an important role. The label can be divided into one-hot labels and soft labels, where one-hot labels only contain one class's information and soft labels can be considered as an effective way to alleviate over-fitting and improve the performance [29] . Previous methods usually ignore the class-wise smoothness degree of soft labels, either applying the same smoothness degree [29] , or uniformly changing the smoothness degree of soft labels for all the classes without deliberate adjustments [11] . Different from previous methods, we are curious about if we adjust the class-wise smoothness degree of soft labels, will it influence the class-wise robust fairness of the trained model? Intuitively speaking, different smoothness degree of soft labels denote different supervision intensity, which means that it is possible to achieve fairness by adjusting the smoothness degree of soft labels. Here we try to explore the relationship between class-wise smoothness degree of soft labels and the robust fairness from both empirical observation and theoretical analysis.Here, we focus on the impact of the class-wise smoothness degree of soft labels on adversarial training. First, we train the model with soft labels that have the same smoothness degree for all types of classes (smoothing coefficient2 is 0.2). Then we assign different smoothness degrees of soft labels for hard classes and easy classes: specifically, we manually use sharper soft labels for hard classes (smoothing coefficient is 0.05) and smoother soft labels for easy classes (smoothing coefficient is 0.35). We conduct the experiment based on the SAT [20] shown in Figure 2 .The result shows that the class-wise smoothness degree of soft labels has an impact on class-wise robust fairness. When we apply the sharper smoothness degree of soft labels for hard classes and the smoother smoothness degree of soft labels for easy classes, the class-wise robust fairness problem can be alleviated. More specifically, for the two worst classes (class 4, 5), the robust accuracy of ResNet-18 guided by the soft label distribution with the same smoothness degree is 24.2%, and 30.9%, and the robust accuracy of ResNet-18 guided by the soft label distribution with different smoothness degree is 30.2%, and 39.1%, which exists an obvious improvement for the class-wise robust fairness, and the average robust accuracy has a slight improvement (52.12% vs 52.36%). Similar performance can also be observed in MobileNet-v2. This phenomenon indicates that appropriately assigning class-wise smoothness degrees of soft labels can be beneficial to achieve robust fairness.Here we try to theoretically analyze the impact of the smoothness degree of soft labels on class-wise fairness. Firstly, we want to analyze the model bias performance with the guidance of the soft label distribution with the same smoothness degree. Then we give Corollary 1 by extending the prediction distribution of binary linear classifier into the prediction distribution of DNNs based on the theoretical analysis in [39] and [19] .Corollary 1. A dataset (x, y) ∼ D contains 2 classes (hard class c + and easy class c -). Based on the label distribution y, the soft label distribution with same smoothness degree P λ1 = {p λ1 c+ , p λ1 c-} can be generated and satisfies:EQUATIONIf a DNN model f is optimized by minimizing the average optimization error risk in D with the guidance of the equal soft labels P λ1 = {p λ1 c+ , p λ1 c-}, and obtain the relevant parameter θ λ1 , where the optimization error risk is measured by Kullback-Leibler divergence loss (KL):EQUATIONthen the error risks (the expectation that samples are wrongly predicted by the model) for classes c + and c -have a relationship as follows:EQUATIONwhere the error risks can be defined:EQUATIONCorollary 1 demonstrates that when optimizing hard and easy classes with equal intensity, the model will inevitably be biased, and this bias mainly comes from the characteristics of the sample itself and is not related to the optimization method. Based on the Corollary 1, we can further analyze the performance differences with the guidance of the different types of soft labels. Here we provide Theorem 1 about the relationship between class-wise smoothness degree of soft labels and fairness.Theorem 1. Following the setting in Corollary 1, for a dataset D containing 2 classes (c + and c -), two soft label distribution (P λ1 = {p λ1 c+ , p λ1 c-} and P λ2 = {p λ2 c+ , p λ2 c-}) exist, where P λ2 have a correct prediction distribution but have a limited different class-wise smoothness degree of soft labels (v 1 > 0, v 2 > 0):EQUATIONthen the model is trained with the guidance of the soft label distribution P λ1 and soft label distribution P λ2 and obtains the trained model parameters θ λ1 and θ λ2 , respectively. If the model parameter θ λ2 still satisfies: R(f (x c+ ; θ λ2 )) > R(f (x c-; θ λ2 )), then the model's error risk for hard classes c + and easy classes c -has a relationship as follows:EQUATIONThe proof of Theorem 1 can be found in Appendix A.1. Based on Theorem 1, the class-wise smoothness degree of soft labels theoretically has an impact on class-wise robust fairness. If the soft label distribution with different smoothness degree P λ2 is applied to guide the model training, where the sharper smoothness degree of soft labels for hard classes and smoother smoothness degree of soft labels for easy classes, the model will appear smaller error risk gap between easy and hard class compared with the soft label distribution with same smoothness degree P λ1 , which demonstrates better robust fairness. The Theorem 1 theoretically demonstrates that if we appropriately adjust the class-wise smoothness degree of soft labels, the model can achieve class-wise robust fairness.4 Anti-Bias Soft Label DistillationQuestion: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?Answer Guidelines:• The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.• If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics. • The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction). 
overall framework: 
 Based on the above finding, adjusting the class-wise smoothness degree of soft labels can be regarded as a potential way to obtain robust fairness. Then we consider introducing this ideology into Knowledge Distillation (KD), which has been proven to be an effective method to improve the robustness of small models [44; 45; 43; 12; 42] . Since the core idea of KD is to use the teacher's soft labels to guide the student's optimization process, we can adjust the class-wise smoothness degree of soft labels and obtain the student with both strong robustness and fairness.Here we propose the Anti-Bias Soft Label Distillation (ABSLD) to obtain a student with adversarial robust fairness. We formulate the optimization objective function for ABSLD as follows:EQUATIONEQUATIONwhere x i and xi are the clean examples and adversarial examples of the i-th class, f s denotes the student model, f ′ t denotes the teacher model with Anti-Bias Soft Labels, C is the total number of classes, L absld is the loss function, and R(f s (x k )) denotes the robust error risk of k-th class in student model f s . Here we apply the Cross-Entropy loss CE(f s (x k ), y) as the evaluation criterion of the optimization error risk R(f s (x k )) following [19] .In order to adjust the class-wise smoothness degree of soft labels in ARD, two options exist: one is to use student feedback to update the teacher parameter in the process of optimizing students, but this option requires retraining the teacher model, which may bring the pretty optimization difficulty and computational overhead; the other is to directly adjust the smoothness degree of soft labels for different classes. Inspired by [42] , we apply the temperature as a means of directly controlling the smoothness degree of soft labels during the training process. Here, we provide Theorem 2 about the relationship between the teacher's temperature and the student's class-wise error risk gap.Theorem 2. If the teacher f ′ t has a correct prediction distribution, the teacher temperature τ t c+ of hard class c+ is positively correlated with the error risk gap for student f s , and the teacher temperature τ t c-of easy class cis negatively correlated with the error risk gap for student f s .The proof of Theorem 2 can be found in Appendix A.2. In particular, just as the conclusion in [38] :The teacher has a more correct prediction distribution than the student even in the worst classes, which means Theorem 2 holds in most cases. Theorem 2 demonstrates that the different temperatures can influence the student robust fairness: when the student's error risk of k-th class is larger than the average error risk, we think that this type of class is relatively hard compared with others, then the teacher temperature for k-th class will reduce and the smoothness degree of soft labels will be sharper, and the optimization gap between teacher distribution and student distribution in k-th class will corresponding increase, leading to stronger learning intensity for k-th class and final reduce the student's class-wise optimization error risk gap.To achieve the above optimization goal, we adjust the teacher's k-th class temperature τ t k for the guidance of adversarial examples as follows:EQUATION)where β is the learning rate, max(.) denotes taking the maximum value, and |.| represents taking the absolute value, max(|.|) is applied for regularization to maintain the stability of optimization. The update operation in Eq.( 10) can change the teacher temperature τ t k based on the gap between the student's k-th class error risk R(f s (x k )) and the average error risk1 C C i=1 R(f s (x i )).Meanwhile, according to [39] , both clean and adversarial examples exist the fairness problems and can affect each other, so it is necessary to achieve fairness for both types of data. Since clean and for Every minibatch(x, y) in D do Here we simultaneously optimize the student's clean error risk R(f s (x k )) and the student's robust error risk R(f s (x k )), in other words, we apply two different sets of teacher temperatures: τ t k and τ t k , for the adjustment of the teacher's soft labels for clean and adversarial examples, respectively.Then we extend the Anti-Bias Soft Label Distillation based on [45] and the loss function L absld in Eq.( 8) can be formulated as follows:EQUATIONwhere KL represents Kullback-Leibler divergence loss, α is the trade-off parameter between accuracy and robustness, f (x; τ ) denotes model f predicts the output probability of x with temperature τ in the final softmax layer. It should be mentioned that the teacher is frozen and we apply the teacher's predicted soft labelsEQUATIONand the complete process can be viewed in Algorithm 1. 
experimental settings: 
 We conduct our experiments on three datasets: CIFAR-10 [16], CIFAR-100, and Tiny-ImageNet [17] .The results about CIFAR-100 and Tiny-ImageNet are in Appendix A.4 and A.5, respectively.Baselines. We consider the standard training method and eight state-of-the-art methods as comparison methods: AT methods: SAT [20] , and TRADES [41] ; ARD methods: RSLAD [45] , and AdaAD [12] ; Robust Fairness methods: FRL [39] , BAT [28] , CFA [36] , and Fair-ARD [38] .Student and Teacher Networks. For the student model, here we consider two networks for CIFAR-10 and CIFAR-100 including ResNet-18 [10] and MobileNet-v2 [26] . For the teacher model, we follow the setting in [45] , and we select WiderResNet- 34-10 [40] trained by [41] for CIFAR-10 and WiderResNet-70-16 trained by [9] for CIFAR-100. The teacher's performance is in Appendix A.7.Training Setting. For ABSLD, we train the model using the Stochastic Gradient Descent (SGD) optimizer with an initial learning rate of 0.1, a momentum of 0.9, and a weight decay of 2e-4. The Metrics. We apply two metrics to evaluate the robust fairness: Normalized Standard Deviation (NSD3 ) [38] and the worst-class robustness [36] . NSD can reflect robust fairness while also considering the average robustness. The smaller standard deviation means better fairness, and the larger average means better robustness, so the smaller NSD means better comprehensive performance in terms of fairness and robustness. The worst-class robustness is easy to understand, and a larger value means better fairness. For CIFAR-10, we directly report the worst class robust accuracy; For CIFAR-100 and Tiny-ImageNet, due to the poor performance of the worst class robustness and only 100 images (CIFAR-100) or 50 images (Tiny-ImageNet) for each class in the test set, we follow the operation in CFA [36] and report the worst 10% class robust accuracy. Besides, we also report the average robustness as a reference. The attack setting for evaluation can be found in Appendix A.3.The performances of ResNet-18 and MobileNet-v2 trained by our ABSLD and other baseline methods under the various attacks are shown in Table 1 , Table 2 for CIFAR-10. The results demonstrate that ABSLD achieves the state-of-the-art worst-class robustness on CIFAR-10. For ResNet-18 on CIFAR-10, ABSLD improves the worst class robustness by 2.0%, 3.2%, 2.4%, and 2.9% compared with the best baseline method against the FGSM, PGD, CW ∞ , and AA. Moreover, ABSLD shows relevant superiority on MobileNet-v2 compared with other methods.Moreover, ABSLD can also show the best comprehensive performance of fairness and robustness (NSD) on CIFAR-10. For ResNet-18 on CIFAR-10, ABSLD reduces the NSD by 0.028, 0.032, 0.017, and 0.024 compared with the best baseline method against the FGSM, PGD, CW ∞ , and AA. The result indicates that although the trade-off between robustness and fairness still exists as [19] say, we obtain the highest robust fairness while sacrificing the least average robustness.Meanwhile, we visualize the class-wise robustness in Figure 3 , and the result shows that the robustness of harder classes (class 3, 4, 5, 6) have different levels of improvement, which demonstrates that our method is beneficial to the overall robust fairness but not only to the worst class. Moreover, combined with Figure 2 , we can find that the trend of class-wise bias is similar in different training strategies, indicating that the bias may be sourced from the dataset itself, which further confirms Corollary 1.In particular, we compare ABSLD with Fair-ARD [38] , which is an adaptive re-weighting method on ARD. From the results, ABSLD has better robust fairness performance, which means that our proposed re-temperating method has superiority compared to the re-weighting method. To certify the effectiveness of our method, we perform ablation experiments on every component of ABSLD. Meanwhile, to verify the optimization effect of our method, we visualize the standard deviation of class-wise optimization error risk in the training process (the optimization error risk is normalized by dividing the mean), which can reflect the optimization gap between different classes. We visualize the standard deviation of both the clean and adversarial optimization error risk, and the results are shown in Figure 5 and Figure 6 . We can notice that the standard deviation of the baseline increases as the training epoch increases, which demonstrates that the baseline pays more attention to reducing the error risk of easy class, but the error risk of hard class is ignored, eventually leading to robust unfairness. On the contrary, our ABSLD can remarkably reduce the standard deviation of student's class-wise optimization error risk, which demonstrates the effectiveness of our method. 
conclusion: 
 In this paper, we comprehensively explored the potential factors that influence robust fairness in the model optimization process. We first found that the smoothness degrees of soft labels for different classes can be applied to eliminate the robust fairness based on empirical observation and theoretical analysis. Then we proposed Anti-Bias Soft Label Distillation (ABSLD) to address the robust fairness problem by adjusting the class-wise smoothness degree of soft labels. We adjusted the teacher's soft labels by assigning different temperatures to different classes based on the performance of student's class-wise error risk. A series of experiments proved that ABSLD was superior to state-of-the-art methods in the comprehensive metric (NSD) of robustness and fairness. 
broader impacts: 
 Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?Answer: [Yes] Justification: See Sec. 6.Guidelines:• The answer NA means that there is no societal impact of the work performed.• If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact. • Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.• The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 
safeguards: 
 Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?Answer: [NA] Justification: The paper poses no such risks.Guidelines:• The answer NA means that the paper poses no such risks.• Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. • We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?Answer: [Yes] Justification: We cite the original paper that produced the code package or dataset.Guidelines:• The answer NA means that the paper does not use existing assets.• The authors should cite the original paper that produced the code package or dataset.• The authors should state which version of the asset is used and, if possible, include a URL. • The name of the license (e.g., CC-BY 4.0) should be included for each asset.• For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided. • If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. • For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.• If this information is not available online, the authors are encouraged to reach out to the asset's creators. 13. New Assets Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets? Answer: [Yes] Justification: The code (new assets) can be found in supplemental material. Guidelines:• The answer NA means that the paper does not release new assets.• Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc. • The paper should discuss whether and how consent was obtained from people whose asset is used. • We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution. • For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review. 
 
 Appendix: A.1 The proof of Theorems 1 in Sec. 3For the initial state of the DNN model f with random distribution I, the DNN model has no preference for any examples. So for the dataset containing hard class c + and easy class c -, we have a relationship between class-wise error risk as follows:EQUATIONin other words, the model has the same error risk for easy class c -and hard class c + , so we set the model's prediction distribution f (x; θ I ) = {p I c-(x), p I c+ (x)} and has the relationship as follows:EQUATION)Then we analyze the process of knowledge distillation, we assume that DNN model f is optimized with the guidance of the soft label distribution with the same smoothness degree P λ1 , which satisfies:EQUATIONAnd the updated parameter θ λ1 guided by the soft label distribution P λ1 can formulated as follows:EQUATIONhere we divide the partial derivative of the optimization function KL with respect to the student parameter θ into two parts:EQUATIONwhere z c (x) denotes the c-th dimension output logits of the model before the softmax layer (denote the prediction logits of c-th class).The first part ∂zc(x) ∂θ can be regarded as the impact of the class itself on model weight optimization, in a practical sense, this part reflects the inner relationship between DNN and sample, more specifically, it can reflect the difficulty of the sample itself for the model and not relate to the optimization object.The second part ∂KL(f (x;θ I ),P λ1 ) ∂zc(x) can be regarded as the impact of the optimization object on the different classes. Although adjusting the optimization goal is not enough to change the bias derived from the sample itself, it can be adjusted to make the model perform as fair as possible.Here we further extend the partial derivative of optimization object KL(f (x; θ I ), P λ1 ) toward the prediction logit z c (x) of class c and obtain:EQUATIONso we can easily obtain:EQUATIONEQUATIONBased on the Corollary 3.1, the DNN model with parameter θ λ1 has different the error risk of the hard class c+ and the easy class c-, so we have:EQUATIONfrom the optimization perspective, the optimization gradient toward the model parameter for different classes directly influences the class error risk, more specifically, the easy class error risk is less than the hard class error risk, so the gradient expectation of the easy class is higher than the gradient expectation of hard class, and the proof is as follows:In the initial state, we assume that the model is a uniform distribution, and in this case, the error optimization risk is the same for the easy and hard classes:EQUATIONthen we will simplify the optimization of the model into a one-step gradient iteration process, which means we only consider the initial state before optimization and the last state after optimization. The model parameter is updated from initial θ I to optimized θ opt , since easy classes perform better than hard classes after the optimization process, the easy class error risk is smaller than hard class error risk:EQUATIONbased on the above result, we can have the result as follows:EQUATIONat this time, we assume that model's parameter θ is differentiable and continuous, then we can approximate the gradient expectation of the partial derivative E( ∂KL(f (xc-;θ I ),P λ1 )) and E( ∂KL(f (xc+;θ I ),P λ1 ) ∂θ ) as follows:EQUATIONEQUATIONcombined with the relationship between easy class error risk and hard class error risk, we can obtain the result that the gradient absolute value expectation of partial derivative about the easy class's optimization goal toward the model parameter (E(| ∂KL(f (xc-;θ I ),P λ1 ) ∂θ |)) is higher than the gradient absolute value expectation of partial derivative about the hard class's optimization goal toward the model parameter (E(| ∂KL(f (xc+;θ I ),P λ1 ) ∂θ |)) as follows:EQUATIONso we can obtain the assumption: If the model is a uniform distribution before the optimization process and the easy class error risk is less than the hard class error risk after optimization process, then the gradient expectation absolute value of partial derivative about the easy class's optimization goal toward the model parameter is higher than the gradient expectation absolute value of partial derivative about the hard class's optimization goal toward the model parameter.Then we can decouple the gradient into two parts based on the class types: ∂KL(f (xc-;θ I ),P λ1 ) ∂θ and ∂KL(f (xc+;θ I ),P λ1 ) ∂θ .Here we take the hard class as an example, the gradient can be divided into two parts: , where the first part represents the ability to make hard class's samples more like hard class, and the second part represents the ability to make hard class's samples less like easy class. The final prediction performance of hard class c+ is influenced by both parts of the optimization gradient due to the softmax operation.Based on the above analysis, the relationship between the sum value of the above two parts of gradient for hard class (∇ + f ∼λ1 ) and easy class (∇ - f ∼λ1 ) can be assumed under a more stringent condition as follows:EQUATIONCombined with Eq.( 19), Eq.( 20) and Eq.( 28), we have a relationship about the derivative of z c toward model parameter θ, which can reflect the bias of sample for the model:EQUATIONAfter the analysis of the model characteristic with the guidance of soft label distribution P λ1 , we try to compare the model characteristic difference between soft label distribution P λ1 and soft label distribution P λ2 . Initially, we can obtain the following relationship for the probabilities of different distributions:EQUATIONthen we further analyze the model class-wise error risk gap guided by label distribution. The total optimization gradient for different classes can reflect the bias degree, so we get the class optimization gradient gap guided by label distribution P λ1 and label distribution P λ2 , respectively:EQUATIONEQUATIONif the model parameter θ λ2 still satisfies: R(f (x c+ ; θ λ2 )) > R(f (x c-; θ λ2 )), then we can obtain B f ∼λ2 > 0, and the relationship between B f ∼λ1 and B f ∼λ2 is as follows:EQUATIONso we can have the following conclusion:EQUATION)Based on the above results, the model total gradient expectation gap of different classes trained by soft label distribution P λ1 is larger than gradient expectation gap between different classes trained by soft label distribution P λ2 , so the bias degree of model trained by the soft label distribution P λ1 is greater than by the bias degree of model trained by the guidance of soft label distribution P λ2 , we can get the conclusion as follows:EQUATION)Then the Theorem 1 is proved.A.2 The proof of Theorems 2 in Sec. 4Based on the correct prediction distribution assumption about the teacher model, we can obtain the relationship of probability toward k-th class as follows:EQUATIONThen we extend the temperature into the mathematical formula of the prediction probability, we can obtain:EQUATION)where z k (x) denotes the k-th dimension output logits of model before softmax layer. Since C j=1 exp(z j (x k )/τ t k ) is applied as a normalization application, here we mainly focus the change exp(z(x k )/τ t k ) with the temperature τ t k . exp(•) is a monotonic increasing function, so based on the Eq.( 36), we can easily obtain:EQUATIONhere we mainly focus the change exp(z(x k )/τ t k ) with the temperature τ t k . We assume theEQUATIONso we have the conclusion as follows:EQUATIONthen we can have relationship between the prediction distribution of different temperature as follows:EQUATION)Based on the above analysis, we assume that the teacher's temperature of the easy class and hard class increase into τ t c-+ ∆ τ c-and τ t c+ + ∆ τ c+ and obtain teacher model with soft label prediction f ′ t , then following the Derivation in Theorem 1, we can obtain:EQUATION)Then we can further analyze the relationship between the temperature and the error risk gap. Here we assume that the teacher's temperature of easy class τ k c-is unchanged (∆ τ c-= 0), the teacher's temperature of hard class τ k c+ increases into τ k c+ + ∆ τ c+ (∆ τ c+ > 0), we can obtain:EQUATIONfollowing the analysis in Appendix A.1, DNN model f s is optimized with the guidance of the teacher's soft label distribution f t and f ′ t , and can obtain the model parameter θ t and θ ′ t , respectively. We can get the conclusion as follows:EQUATIONThen we assume that the teacher's temperature of hard class τ k c+ is unchanged (∆ τ c+ = 0), the teacher's temperature of easy class τ k c-increases intoEQUATIONand following the analysis in Appendix A.1, we can get the conclusion as follows:EQUATION)Based on the above results, we can obtain the teacher temperature τ t c+ of hard class c+ is positively correlated with the error risk gap for student f s , and the teacher temperature τ t c-of easy class cis negatively correlated with the error risk gap for student f s .Then the Theorem 2 is proved.As discussed in [36] , the worst class robust accuracy changes drastically when the average robustness convergence, so we follow [36] and select the best checkpoint of the highest mean value of all-class average robustness and the worst class robustness (where the worst class for CIFAR-10 and the worst 10% class for CIFAR-100) in all baselines and our method for a fair comparison.For ABSLD, to maintain stability when adjusting the teacher prediction distribution, we hold the student temperature τ s constant, and the student's optimization error risk for each class can be compared under the same standard. The teacher temperature of τ t k and τ t k are initially set as 1 for all the classes. The student temperature τ s is set to constant 1 without additional adjustment. With additional instruction, the maximum and minimum values of temperature are 5 and 0.5, respectively; For ResNet-18 on CIFAR-100, the maximum and minimum values of temperature are 3 and 0.8, respectively. All the experiments are conducted in a single GeForce RTX 3090, and our ABSLD takes approximately one GPU day for training a model.For the baselines, we strictly follow original setting if without additional instruction. For FRL [39] , we use the Reweight+Remargin under the threshold of 0.05. For CFA [36] , we select the best version (TRADES+CFA) as reported in the original article. For the training of CFA on CIFAR-100, we set the fairness threshold to 0.02 for FAWA operation based on the worst-10% class robustness. For Fair-ARD [38] , we select the best version (Fair-ARD on CIFAR-10 and Fair-RSLAD on CIFAR-100) as reported in the original article. Due to the different strategy of selecting checkpoint, the baselines may have slight differences from the results in their original papers.Following previous studies [45; 42; 38] , we evaluate the trained model against white-box adversarial attacks: FGSM [8] , PGD [20] , CW ∞ [3] . For PGD, we apply 20 steps with a step size of 2/255; For CW ∞ , we apply 30 steps with a step size of 2/255. Meanwhile, we apply a strong attack: AutoAttack (AA) [5] to evaluate the robustness, which includes four attacks: Auto-PGD (APGD), Difference of Logits Ratio (DLR) attack, FAB-Attack [4] , and the black-box Square Attack [1] . The maximum perturbation of all generated adversarial examples is 8/255.The performances of ResNet-18 and MobileNet-v2 trained by our ABSLD and other baseline methods under the various attacks are shown in Table 3 , Table 4 for CIFAR-100.The results demonstrate that ABSLD achieves the state-of-the-art worst-class robustness on CIFAR-100. For ResNet-18 on CIFAR-100, ABSLD improves the worst-10% class robustness by 2.1%, 2.1%, 1.2%, and 0.7% compared with the best baseline method against the FGSM, PGD, CW ∞ , and AA. Moreover, ABSLD shows relevant superiority on MobileNet-v2 compared with other methods.Moreover, ABSLD can also show the best comprehensive performance of fairness and robustness (NSD) on CIFAR-100. For ResNet-18 on CIFAR-100, ABSLD reduces the NSD by 0.05, 0.063, 0.077, and 0.078 compared with the best baseline method against the FGSM, PGD, CW ∞ , and AA.We select the subset of ImageNet: Tiny-ImageNet as the additional dataset. We train with PreActResNet-18 with 100 epochs, while other settings are the same as CIFAR-100. For our ABSLD, the teacher model is PreActResNet-34 trained by TRADES [41] , and the maximum and minimnum values of temperature are 1.1 and 0.9. We select RSLAD [45] (the baseline method)and CFA [36] (the second-best method proven in Table 1 and Table 3 ) as the comparison method. The results in Table 5 show ABSLD has the best performance under the metric of the worst class robustness and NSD under different attacks, verifying our effectiveness and generalization. To demonstrate the effectiveness of our self-adaptive temperature adjustment strategy, we manually retemperate with the static temperature for different classes based on the prior knowledge. Specifically, We set the teacher temperature for difficult class to be small (τ t k = 0.5) and set the teacher temperature for easy class to be large (τ t k = 5), which is the minimum and maximum values of temperature, respectively. The experiment in Table 6 shows that our adaptive strategy has a better performance than this manual strategy on CIFAR-10. Moreover, the manual strategy needs to be carefully designed and lacks operability for more complex datasets, e.g., 100 classes on CIFAR-100 or 200 classes on Tiny-ImageNet, so we finally apply the adaptive adjustment strategy for ABSLD. Here we report the performance of Teacher models, we select WiderResNet- 34-10 [40] trained by [41] for CIFAR-10 and WiderResNet-70-16 trained by [9] for CIFAR-100 following [45; 43] . For Tiny-ImageNet, the teacher model is PreActResNet-34 trained by TRADES [41] . The performance is shown in Table 7 . At present, although we have improved the fairness of model adversarial robustness with minimal cost, the overall robustness remains unchanged or slightly decreases compared to previous methods in some cases, and how to solve the trade-off between robustness and fairness is one of the directions that will be further explored in the future. Meanwhile, our method is based on the adjustment towards the smoothness degree of soft labels, and cannot be directly applied to adversarial training methods based on one-hot labels but needs to be combined with label smoothing operations.NeurIPS Paper ChecklistFor N-class one-hot ground truth labels, after processing by the smoothing coefficient γ, the highest probability (correct class) decreases from 1 to 1 -γ, and the other probability (wrong class) increases from 0 to γ n-1 .NSD is a metric applied in[38] to measure the robust fairness. NSD = SD/Avg., where SD is the Standard Deviation of class-wise robustness and Avg. is the average robustness. 


Decision: The submitted manuscript addresses the problem of adversarial fairness, i.e. the problem that there is a severe trade-off between adversarial robustness and model fairness. The paper has received four reviews, three of which, after discussion, agree on the merits of the paper. Although the proposed approach recombines existing techniques to improve adversarial fairness, it shows overall promising results on an important topic. This is an overall sound paper which offers a step towards advancing an important field of research, adversarial fairness. This is different from the research question regarding the trade-off between clean and robust accuracy, but equally valuable.

Reviews: review: paper_summary: paper_summary: This paper discusses the robust fairness problem, which is essential to solve for reducing concerns surrounding class-based security. The paper majorly analyzed the inheritance of robust fairness during adversarial robustness distillation (ARD). It is found that student models only partially inherit robust fairness from teacher models. To solve this, authors have examined how the degree of smoothness of samples' soft labels influences class-wise fairness in (ARD). They empirically and theoretically prove that appropriately assigning class-wise smoothness degrees of soft labels during ARD can be beneficial to achieve robust fairness.

Therefore, as a solution to the fairness problem associated with ARD, they propose the Anti-Bias Soft Label Distillation (ABSLD), a knowledge distillation framework designed to reduce error risk gaps between student classes by adjusting the class-specific smoothness degree of teacher's soft labels during training, controlled by assigning temperatures. The authors provided experiments to demonstrate their method's effectiveness.
strength_weakness: strength_weakness: - The evaluations on common corruptions is missing. (Does this method transfers robustness and fairness towards common corruptions as well?)
- The evaluations on related fairness works, Wat [1] and FAT[2] is missing. 
- Most of the works mentioned as baselines focusing on fairness (CFA, BAT, FRL), in the paper are trained using PRN-18. May be better to evaluate the current approach using the PRN-18 as well (Optional).
- The authors should explore if their method is also fair and robust in ViTs. The architectures suitable for training ARD and AT approaches are available in robustness benchmark [3].
- Few ARD related evaluations  like IAD, MTARD  in combination with Fair-ARD approach as mentioned in Fair-ARD [4] needs to be evaluated. 
- Comparison of ABSLD with Fair-ARD in writing can be improved. How different is approaches from each other, what benefits ABSLD the most over Fair-ARD? 


[1] Li, B., Liu, W.: Wat: improve the worst-class robustness in adversarial training. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 37, pp. 14982–14990 (2023)
[2] Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankanhalli. Attacks which do not kill training make adversarial learning stronger. In International conference on machine learning, pages 11278–11287. PMLR, 2020.
[3] Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: a standardized adversarial robustness benchmark. 
[4] Xinli, Y., Mou, N., Qian, W., Lingchen, Z.: Revisiting adversarial robustness distillation from the perspective of robust fairness. NeurIPS (2023)
questions: questions: How is the smoothness degree of different classes (easy & hard) during the training?
limitations: limitations: Broader Impact : Potential positive societal impacts and negative societal impacts of the work is missing but its mentioned as included.
paper_summary: paper_summary: This paper explores the issue of robust fairness in deep neural networks (DNNs), particularly focusing on the disparity in robustness between different classes in adversarial training (AT) and adversarial robustness distillation (ARD) methods. The authors propose a novel method called Anti-Bias Soft Label Distillation (ABSLD) that aims to mitigate this problem by adjusting the smoothness degree of soft labels for different classes during the knowledge distillation process. ABSLD adaptively reduces the error risk gap between classes by re-tempering the teacher's soft labels with different temperatures, which are determined based on the student's error risk. Extensive experiments demonstrate that ABSLD outperforms existing AT, ARD, and robust fairness methods in terms of a comprehensive metric that combines robustness and fairness, known as the Normalized Standard Deviation. The paper contributes to the literature by providing both empirical observations and theoretical analysis on the impact of soft label smoothness on robust fairness and by advancing a new technique within the knowledge distillation framework to achieve better adversarial robust fairness.
strength_weakness: strength_weakness: 1.  In my humble opinion, I do not regard adversarial "fairness" is a critical problem. It is different from other fairness problem (e.g. demographic features) which brings social impacts.
2.  For technical contribution, soft-label, knowledge distillation, as well as retemperature are well-known techniques. This paper applies the these techniques on the specific problem, but does not provide specific designs with respect to the problem.
3. According to the experiment results, this method also suffers the trade-off between clean acc and robustness, which indicates not to solve the critical issue with respect to the adversarial training.
questions: questions: Please help to check weaknesses.
limitations: limitations: Also in weaknesses
paper_summary: paper_summary: The paper introduces Anti-Bias Soft Label Distillation (ABSLD), a method aimed at improving robust fairness in deep neural networks. This paper identifies the smoothness degree of soft labels as a critical factor influencing this imbalance. ABSLD mitigates the robust fairness problem by adjusting the class-wise smoothness degree of soft labels during the knowledge distillation process. By assigning sharper soft labels to harder classes and smoother ones to easier classes, ABSLD reduces the error risk gap between classes. Extensive experiments on datasets like CIFAR-10 and CIFAR-100 demonstrate that ABSLD outperforms state-of-the-art methods in achieving both robustness and fairness.
strength_weakness: strength_weakness: 1. The paper provides many implementation details, but some aspects, such as the choice of hyperparameters (e.g., learning rate, temperature adjustments), could be discussed more thoroughly. Clarifying these details can help replicate the results and understand the method's practical implications.

2. Lack of more related works and SOTA methods, e.g.[1][2].

3. What is the advantage of using Knowledge Distillation (KD)? The baselines used in the paper do not seem strong enough, and current state-of-the-art approaches [1][2] appear to offer better performance. Additionally, employing a teacher model increases the practical costs of time and memory.

4. How about re-weighting + re-temperating? or using re-temperating directly via label smoothing without a teacher model.

5. I am concerned that the comparison between ABSLD and Fair-ARD is due to the hyper-parameter used.


[1] WAT: improve the worst-class robustness in adversarial training, AAAI 2023.

[2] Towards Fairness-Aware Adversarial Learning, CVPR 2024
questions: questions: See the weaknesses above.
limitations: limitations: N/A
paper_summary: paper_summary: This paper aims to improve robust fairness in the adversarial distillation setting.
The proposed method adaptively assigns a smaller temperature for hard classes and a larger temperature for easy classes during the adversarial distillation training.
The smaller temperature means stronger supervision intensity for hard classes, realizing dynamic re-weighting in the training.

Experiments on CIFAR100 and CIFAR-10 show some improvements in the worst-class performance at the cost of overall robustness degradation.
strength_weakness: strength_weakness: (1) The proposed algorithm is to allow stronger supervision for hard classes with a smaller temperature during adversarial knowledge distillation. 
It seems to have similar effects to re-weighting, i.e., assigning a smaller class weight on hard classes for the KL loss during the knowledge distillation.
What's the difference between the proposed method and such a baseline in nature? Why could the proposed method achieve better results?

(2) Though the proposed method improves the worst class robustness, the overall robustness can't be maintained.

(3) Regarding the proof of theorem 1, 
      how do we get the conclusion in Eq. (19) with Eq. (18)? 
         From my point of view, the two terms should be the opposites of each other in Eq. (19).

(4) In the proof, the assumption that "the easy class error risk is less than the hard class error risk, so the gradient expectation of the easy class is higher than the gradient expectation of the hard class" is used multiple times.
          However, Why is it established?
          What's the relationship between the gradients and the error risk mathematically?
questions: questions: (1) The proposed method has close relations with re-weighting.     
      The authors should clarify the differences between the proposed method and the re-weighting. Why could the proposed method achieve better performance than re-weighting?

(2) There seem to be some problems in the proof of theorem 1.
     What's the relationship between the gradients and the error risk mathematically?

(3) The proposed method can achieve better worst-class performance. However, the overall robustness degrades.
limitations: limitations: Limitations are discussed in the Appendix.

Comments: title: Thanks for the responses from the authors
Thanks for the responses from the authors
comment: Thank you again for your valuable comments. 

**Comment10: For Q8, although your experiments show the advantages of re-temperating over re-weighting. But why is it? Where do the benefits come from?**

**Answer10:**

Actually, we have explained it in the Q8, the explanation is as follows:

''From a theoretical analysis, soft label methods can be applied to reduce the overfitting of unnecessary information by introducing smoothness degree for one-hot labels. **We believe that the re-temperating method fully utilizes the superiority of soft labels and reasonably decouples the superiority from smoothing the labels of the entire data to smoothing the labels of each class.** 

Under the premise of effective model capabilities, **the re-tempering method improves the information quality that the model needs to learn, leading to better performance for the model**: for the easy class, model can easily overfit the noise in the training data, so re-temperating introduce more uncertainty or noise in label level by increasing the smoothness degree to avoid the above overfitting; for the hard class, due to the relatively complex characteristics of its samples, the model tends to converge slowly and underfit, so re-temperating introduce less uncertainty or noise in label level by reducing the smoothness degree and give the model a clearer supervision signal to promote its learning of key semantic information. 

**The re-weighting method is more like a process of redistributing knowledge information based on class performance, but information quality does not change in this process**, and the model may still overfit some noise in the training data for easy class and underfit some key semantic information for the hard class.''

**Comment11: it seems that whether the conclusion is established also depends on the sign of $\theta_{opt}-\theta_{I}$**

**Answer11:**

Since we have added an **absolute value to the value** of this item, its sign of $\theta_{opt}-\theta_{I}$ will not have a final impact on the result:
$$
\mathbb{E}(|\frac{\partial KL(f(x_{c-};\theta_{I}),P_{\lambda1})}{\partial \theta}|)>\mathbb{E}(|\frac{\partial KL(f(x_{c+};\theta_{I}),P_{\lambda1})}{\partial \theta}|),
$$
Actually, we apply the above conclusion about the absolute value for the later derivative. Therefore, it does not affect any subsequent conclusions.
Thanks for your responses.

For Q8, although your experiments show the advantages of re-temperating over re-weighting. But why is it? Where do the benefits come from?
 
For Q9, it seems that whether the conclusion is established also depends on the sign of ($\theta\_{opt} - \theta\_{I}$)

Based on the authors's responses, I will keep my initial rating.
Thank you again for your valuable comments.

**Comment9: It seems that the authors try to bridge the loss value and the gradients with Taylor's Formula. Apply Taylor's Formula to the function $f(x)$, we get that $f(x) = f(0) + xf^{'}(x)$. However, it is still not obvious to draw the conclusion that $\mathbb{E}(f^{'}(x))>\mathbb{E}(f^{'}(y))$ when $\mathbb{E}(f(x))>\mathbb{E}(f(y))$.**

**Answer9:**

Just as you say, we derive our results similar to the Taylor's Formula $f^{'}(x)=\frac{f(x)-f(0)}{x}$. We definely can not get the result $\mathbb{E}(f^{'}(x))>\mathbb{E}(f^{'}(y))$ when $\mathbb{E}(f(x))>\mathbb{E}(f(y))$. However, we can obtain the $\mathbb{E}(|f(x)-f(0)|)>\mathbb{E}(|f(y)-f(0)|)$ if  $\mathbb{E}(f(0)) >\mathbb{E}(f(y))>\mathbb{E}(f(x))>0$, then we can further obtain $\mathbb{E}(|f^{'}(x)|)>\mathbb{E}(|f^{'}(y)|)$.

**Here we further explain the detailed derivatives and correct the error derivation as follows:**

In the initial state, we assume that the model is a uniform distribution, and in this case, the error optimization risk is the same for the easy and hard classes:
$$
\mathbb{E}(KL(f(x_{c-};\theta_{I}),P_{\lambda1}))=\mathbb{E}(KL(f(x_{c+};\theta_{I}),P_{\lambda1})),
$$

then we will simplify the optimization of the model into a one-step gradient iteration process, which means we only consider the initial state before optimization and the last state after optimization. The model parameter is updated from initial $\theta_{I}$ to optimized $\theta_{opt}$, since easy classes perform better than hard classes after the optimization process, the easy class error risk is smaller than hard class error risk:
$$
0<\mathbb{E}(KL(f(x_{c-};\theta_{opt}),P_{\lambda1}))<\mathbb{E}(KL(f(x_{c+};\theta_{opt}),P_{\lambda1}))<\mathbb{E}(KL(f(x_{c-};\theta_{I}),P_{\lambda1}))=\mathbb{E}(KL(f(x_{c+};\theta_{I}),P_{\lambda1})),
$$

based on the above result, we can have the result as follows:
$$
\mathbb{E}(|KL(f(x_{c-};\theta_{opt}),P_{\lambda1})-KL(f(x_{c-};\theta_{I}),P_{\lambda1})|) > \mathbb{E}(|KL(f(x_{c+};\theta_{opt}),P_{\lambda1})-KL(f(x_{c+};\theta_{I}),P_{\lambda1})|)
$$

at this time, we assume that model's parameter $\theta$ is differentiable and continuous, then we can approximate the gradient expectation of the partial derivative $\mathbb{E}(\frac{\partial KL(f(x_{c-};\theta_{I}),P_{\lambda1})}{\partial \theta})$ and $\mathbb{E}(\frac{\partial KL(f(x_{c+};\theta_{I}),P_{\lambda1})}{\partial \theta})$ as follows:
$$
\mathbb{E}(\frac{\partial KL(f(x_{c-};\theta_{I}),P_{\lambda1})}{\partial \theta})\approx\mathbb{E}(\frac{KL(f(x_{c-};\theta_{opt}),P_{\lambda1})-KL(f(x_{c-};\theta_{I}),P_{\lambda1})}{\theta_{opt}-\theta_{I}}),
$$

$$
\mathbb{E}(\frac{\partial KL(f(x_{c+};\theta_{I}),P_{\lambda1})}{\partial \theta})\approx\mathbb{E}(\frac{KL(f(x_{c+};\theta_{opt}),P_{\lambda1})-KL(f(x_{c+};\theta_{I}),P_{\lambda1})}{\theta_{opt}-\theta_{I}}),
$$

combined with the relationship between easy class error risk and hard class error risk, we can obtain the result that the **gradient absolute value expectation** of partial derivative about the easy class’s optimization goal toward the model parameter ($\mathbb{E}(|\frac{\partial KL(f(x_{c-};\theta_{I}),P_{\lambda1})}{\partial \theta}|)$) is higher than the **gradient absolute value expectation** of partial derivative about the hard class’s optimization goal toward the model parameter ($\mathbb{E}(|\frac{\partial KL(f(x_{c+};\theta_{I}),P_{\lambda1})}{\partial \theta}|)$) as follows: 
$$
\mathbb{E}(|\frac{\partial KL(f(x_{c-};\theta_{I}),P_{\lambda1})}{\partial \theta}|)>\mathbb{E}(|\frac{\partial KL(f(x_{c+};\theta_{I}),P_{\lambda1})}{\partial \theta}|),
$$

so we can obtain the above assumption. Actually, the **gradient absolute value expectation** of partial derivative about the class’s optimization goal toward the model parameter denotes the difficulty of the model learning this type of class: the easier the class, the larger the gradient absolute value expectation.
Thank you again for your valuable comments.

**Comment8:The most important thing is why the re-temperating is better than re-weighting. The conclusion is a little bit wired to me that re-temperating can fundamentally solve the fairness problem while re-weighting just alleviates the problem. There should be rigorous analysis.**

**Answer8:**

For the study of soft labels, the researcher usually explores and explains their effectiveness from an experimental perspective [1], [2]. Following the previous study, **to demonstrate that our method can suppress the overfitting of the easy class**, we directly compare the class-wise error risk gap between the train set and test set for the re-weighting method (Fair-RSLAD) and the re-temperating method (ABSLD) on easy class (1-th, 2-th, 9-th, 10-th class). The larger error risk gap denotes the less serious the overfitting. The experimental settings of Fair-RSLAD and ABSLD methods are exactly the same except for the re-weight and re-temperate operations. The error risk is obtained based on Cross Entropy Loss. Since the risk change curve cannot be displayed in the form of a picture, we select several typical checkpoints on CIFAR-10 of ResNet-18 in different training periods (the checkpoint in the 200-th, 250-th, and 300-th training epoch). The results are shown in the following Table-A8-1: It can be seen that compared with the re-weighting method, the re-temperating method has a smaller error risk gap between the train set and test set for all the classes, which shows that re-temperating can bring better generalization and can effectively suppress overfitting of easy class. 

Meanwhile, **to demonstrate that our method can suppress underfitting of the hard class**, we also list the error risk in the test set (Table-A8-2) for the hard class (3-th, 4-th, 5-th class), the less class-wise error risk denotes the less serious the underfitting. The results denote that the re-temperating method has a smaller error risk in the test set for hard classes, which shows that re-temperating can effectively suppress the underfitting of the hard class. 

**So the results directly and effectively illustrate the correctness of our explanation at the experimental level.**

**Table-A8-1: the error risk gap beween the train set and test set for easy class.**
|method|checkpoint|Class1|Class2|Class9|Class10|
|:-----:|:----:|:------:|:----:|:----:|:----:|
|reweight(Fair-RSLAD)|200-th|0.2812|0.2756|0.3317|0.3162|
|**retemperate(ABSLD)**|200-th|**0.1061**|**0.1075**|**0.1414**|**0.1359**|
|reweight(Fair-RSLAD)|250-th|0.4252|0.3971|0.4401|0.4481|
|**retemperate(ABSLD)**|250-th|**0.1560**|**0.1587**|**0.1971**|**0.1914**|
|reweight(Fair-RSLAD)|300-th|0.4559|0.4174|0.4326|0.4553|
|**retemperate(ABSLD)**|300-th|**0.1691**|**0.1654**|**0.2012**|**0.1937**|

**Table-A8-2: the error risk in test set for hard class.**
|method|checkpoint|Class3|Class4|Class5|
|:-----:|:-----:|:----:|:----:|:----:|
|reweight(Fair-RSLAD)|200-th|1.571|1.861|1.503|
|**retemperate(ABSLD)**|200-th|**1.511**|**1.734**|**1.394**|
|reweight(Fair-RSLAD)|250-th|1.485|1.814|1.358|
|**retemperate(ABSLD)**|250-th|**1.480**|**1.658**|**1.324**|
|reweight(Fair-RSLAD)|300-th|1.498|1.780|1.455|
|**retemperate(ABSLD)**|300-th|**1.483**|**1.613**|**1.360**|

From a theoretical analysis, soft label methods can be applied to reduce the overfitting of unnecessary information by introducing smoothness degree for one-hot labels. **We believe that the re-temperating method fully utilizes the superiority of soft labels and reasonably decouples the superiority from smoothing the labels of the entire data to smoothing the labels of each class.** 

Under the premise of effective model capabilities, **the re-tempering method improves the information quality that the model needs to learn, leading to better performance for the model**: for the easy class, model can easily overfit the noise in the training data, so re-temperating introduce more uncertainty or noise in label level by increasing the smoothness degree to avoid the above overfitting; for the hard class, due to the relatively complex characteristics of its samples, the model tends to converge slowly and underfit, so re-temperating introduce less uncertainty or noise in label level by reducing the smoothness degree and give the model a clearer supervision signal to promote its learning of key semantic information. 

**The re-weighting method is more like a process of redistributing knowledge information based on class performance, but information quality does not change in this process**, and the model may still overfit some noise in the training data for easy class and underfit some key semantic information for the hard class.

1.Szegedy, C., Vanhoucke, V., Ioffe, S., Shlens, J. and Wojna, Z.. Rethinking the inception architecture for computer vision. CVPR(2016).

2.Müller, Rafael, Simon Kornblith, and Geoffrey E. Hinton. "When does label smoothing help?." NeurIPS(2019).
Thanks for the responses from the authors.

It seems that the authors try to bridge the loss value and the gradients with Taylor's Formula.
Apply Taylor's Formula to the function f(x), we get that f(x) = f(0) + x $f^{'}(x)$.

However, it is still not obvious to draw the conclusion that E($f^{'}(x)$) > E($f^{'}(y)$) when E(f(x)) > E(f(y)).
I know the differences between re-weighting and re-temperating regarding their implementation. The most important thing is why the re-temperating is better than re-weighting.
The conclusion is a little bit wired to me that re-temperating can fundamentally solve the fairness problem while re-weighting just alleviates the problem. There should be rigorous analysis.
**Comment6： Fairness is important but the overall robustness is also important.**

**Answer6:**
Here we also believe that both overall robustness and fairness are important, and we try to improve fairness while maintaining the overall robustness as much as possible. Although our method obtains the highest robust fairness with sacrificing the least overall robustness and we can achieve the best performance of Normalized Standard Deviation(NSD), e.g., ABSLD reduces the NSD by 0.028, 0.032, 0.017, and 0.024 compared with the best baseline method against the FGSM, PGD, CW, and AA for ResNet-18 on CIFAR-10 (Table 1 in the paper), this trade-off phenomenon does exist similar to other fairness researches [1], [2], [3], [4]. We believe how to solve the trade-off between overall robustness and fairness is one of the directions that should be further explored in the future.

1.Xu, H., Liu, X., Li, Y., Jain, A., Tang, J.: To be robust or to be fair: Towards fairness inadversarial training. ICML (2021).

2.Ma, X., Wang, Z., Liu, W.: On the tradeoff between robustness and fairness. NeurIPS (2022).

3.Li, B., Liu, W.: Wat: improve the worst-class robustness in adversarial training. AAAI (2023).

4.Zhang, Y., Zhang, T., Mu, R., Huang, X., & Ruan, W.: Towards Fairness-Aware Adversarial Learning. CVPR (2024).

**Comment7: I still can't follow the logic that the larger the loss value the larger the gradients in Answer 4. Could you show the detailed derivatives between the loss value and the gradients?**

**Answer7:**

**Here we further explain the detailed derivatives as follows:**

In the initial state, we assume that the model is a uniform distribution, and in this case, the error optimization risk is the same for the easy and hard classes:
$$
\mathbb{E}(KL(f(x_{c-};\theta_{I}),P_{\lambda1}))=\mathbb{E}(KL(f(x_{c+};\theta_{I}),P_{\lambda1})),
$$

then we will simplify the optimization of the model into a one-step gradient iteration process, which means we only consider the initial state before optimization and the last state after optimization. The model parameter is updated from initial $\theta_{I}$ to optimized $\theta_{opt}$, since easy classes perform better than hard classes after the optimization process, the easy class error risk is smaller than hard class error risk:
$$
\mathbb{E}(KL(f(x_{c-};\theta_{opt}),P_{\lambda1}))>\mathbb{E}(KL(f(x_{c+};\theta_{opt}),P_{\lambda1})),
$$

at this time, we assume that model's parameter $\theta$ is differentiable and continuous, then we can approximate the gradient expectation of the partial derivative $\mathbb{E}(\frac{\partial KL(f(x_{c-};\theta_{I}),P_{\lambda1})}{\partial \theta})$ and $\mathbb{E}(\frac{\partial KL(f(x_{c+};\theta_{I}),P_{\lambda1})}{\partial \theta})$ as follows:
$$
\mathbb{E}(\frac{\partial KL(f(x_{c-};\theta_{I}),P_{\lambda1})}{\partial \theta})\approx\mathbb{E}(\frac{KL(f(x_{c-};\theta_{opt}),P_{\lambda1})-KL(f(x_{c-};\theta_{I}),P_{\lambda1})}{\theta_{opt}-\theta_{I}}),
$$

$$
\mathbb{E}(\frac{\partial KL(f(x_{c+};\theta_{I}),P_{\lambda1})}{\partial \theta})\approx\mathbb{E}(\frac{KL(f(x_{c+};\theta_{opt}),P_{\lambda1})-KL(f(x_{c+};\theta_{I}),P_{\lambda1})}{\theta_{opt}-\theta_{I}}),
$$

combined with the relationship between easy class error risk and hard class error risk, we can obtain the result that the gradient value expectation of partial derivative about the easy class’s optimization goal toward the model parameter ($\mathbb{E}(|\frac{\partial KL(f(x_{c-};\theta_{I}),P_{\lambda1})}{\partial \theta}|)$) is higher than the gradient value expectation of partial derivative about the hard class’s optimization goal toward the model parameter ($\mathbb{E}(|\frac{\partial KL(f(x_{c+};\theta_{I}),P_{\lambda1})}{\partial \theta}|)$) as follows: 
$$
\mathbb{E}(|\frac{\partial KL(f(x_{c-};\theta_{I}),P_{\lambda1})}{\partial \theta}|)>\mathbb{E}(|\frac{\partial KL(f(x_{c+};\theta_{I}),P_{\lambda1})}{\partial \theta}|),
$$

so we can obtain the above assumption.
Thank you again for your valuable comments.

**Comment5： The proposed algorithm is to allow stronger supervision for hard classes with a smaller temperature during adversarial knowledge distillation. It seems to have similar effects to re-weighting. The re-temperating method adjusts the strength of optimization by assigning different temperatures while the re-weighting can directly adjust the weights for each class. Could the authors provide any theoretical analysis to show the differences in nature between them? I don't see any advantages of re-temperating over re-weighting.**

**Answer5:**

Here we re-think and re-explain the advantages of our method and hope for your better understanding:

Although both methods can play the role of adjusting the optimization strength, the obvious difference exists: **The re-temperating method is directly used to solve the fairness problem by avoiding overfitting of easy class and underfitting of hard class, while the re-weighting method can only alleviate overfitting or underfitting by adjusting the optimization strength, but cannot fundamentally avoid it.** 

Specifically, the fairness problem is essentially that the model overfits the easy class and underfits the hard class, leading to the low error risk for the easy class, and the high error risk for the hard class. Here we formulate the loss function without fairness constraints as follows:
$$
L(x^{adv},x;f _ s,f _ {t}) = \frac{1}{C _ {hard}} \sum_{j=1}^{C _ {hard}} \underbrace{KL(f_{s}(x_{j}^{adv}), f _ {t}({x} _ {j}))} _ {\text{underfitting to hard class}}+\frac{1}{C _ {easy}} \sum_{i=1}^{C _ {easy}} \underbrace{KL(f _ s(x _ i^{adv}), f _ {t}({x} _ i))} _ {\text{overfitting to easy class}},
$$


for example, as shown in Figures 6 and 7 in the paper, without additional constraints, the error risk gap between different classes increases as the optimization process continues, which means the error risk of easy class will decrease more and more compared to the error risk of hard class. The results demonstrate that overfitting to easy classes and underfitting to hard classes definitely happen and have a direct relationship with the fairness problem. 


The re-weighting method only controls the optimization strength via assigning different weights of different classes, generally speaking, the weights $w_j$ of the hard class are larger than weights $w_i$ of the easy class. However, since the final optimization term $KL(f_s(x^{adv}), f_{t}({x}))$ has not changed, it just alleviates but does not solve the phenomenon of overfitting easy classes and underfitting hard classes and cannot fundamentally solve the fairness problem. We formulate the loss function with re-weighting constraints as follows:
$$
L _ {re-weight}(x^{adv},x;f _ s,f _ {t}) = \frac{1}{C _ {hard}} \sum _ {j=1}^{C _ {hard}} w _ j * \underbrace{KL(f _ s(x _ j^{adv}), f _ {t}({x} _ j))} _ {\text{underfitting to hard class}}+\frac{1}{C_{easy}} \sum_{i=1}^{C _ {easy}} w _ i *\underbrace{KL(f _ s(x _ i^{adv}), f _ {t}({x} _ i))} _ {\text{overfitting to easy class}},
$$

different from the re-weighting method, the re-temperating method directly changes the label smoothness degree via the larger temperature $\tau_{i}^t$ for easy class and smaller temperature $\tau_{j}^t$ for hard class to design a new optimization term $KL(f_s(x^{adv};\tau^s), f_{t}^{'}({x};\tau^t))$: we increase the smoothness degree for easy classes to alleviate the overfitting, and reduce the smoothness degree for hard classes to alleviate the underfitting. In this way, we can achieve a relatively normal-fitting for both easy and hard classes and fundamentally solve the fairness problem. We formulate the loss function with re-temperating constraints as follows:
$$
L _ {re-temperate}(x^{adv},x;f _ s,f _ {t}^{'}) = \frac{1}{C _ {hard}} \sum _ {j=1}^{C _ {hard}}  \underbrace{KL(f _ s(x _ j^{adv};\tau^s), f _ {t}^{'}({x} _ j;\tau _ {j}^t))} _ {\text{normal-fitting to hard class}}+\frac{1}{C _ {easy}} \sum_{i=1}^{C _ {easy}} \underbrace{KL(f _ s(x_i^{adv};\tau^s), f _ {t}^{'}({x} _ i;\tau_{i}^t))} _ {\text{normal-fitting to easy class}}.
$$
Thanks for the feedback from the authors. Some problems still make me confused.

(1) The proposed algorithm is to allow stronger supervision for hard classes with a smaller temperature during adversarial knowledge distillation. It seems to have similar effects to re-weighting. 

The re-temperating method adjusts the strength of optimization by assigning different temperatures while the re-weighting can directly adjust the weights for each class.  Could the authors provide any theoretical analysis to show the differences in nature between them? I don't see any advantages of re-temperating over re-weighting.

(2) Fairness is important but the overall robustness is also important.

(3) I still can't follow the logic that the larger the loss value the larger the gradients in Answer 4. Could you show the detailed derivatives between the loss value and the gradients?