Exploring Adversarial Robustness of Deep State Space Models

Authors: biqing  qi
yiang  luo
junqi  gao
pengfei  li
kai  tian
zhiyuan  ma
bowen  zhou
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-15 16:29:08

Abstract: Deep State Space Models (SSMs) have proven effective in numerous task scenarios but face significant security challenges due to Adversarial Perturbations (APs) in real-world deployments. Adversarial Training (AT) is a mainstream approach to enhancing Adversarial Robustness (AR) and has been validated on various traditional DNN architectures. However, its effectiveness in improving the AR of SSMs remains unclear.
While many enhancements in SSM components, such as integrating Attention mechanisms and expanding to data-dependent SSM parameterizations, have brought significant gains in Standard Training (ST) settings, their potential benefits in AT remain unexplored. To investigate this, we evaluate existing structural variants of SSMs with AT to assess their AR performance. We observe that pure SSM structures struggle to benefit from AT, whereas incorporating Attention yields a markedly better trade-off between robustness and generalization for SSMs in AT compared to other components. Nonetheless, the integration of Attention also leads to Robust Overfitting (RO) issues.
To understand these phenomena, we empirically and theoretically  analyze the output error of SSMs under AP. We find that fixed-parameterized SSMs have output error bounds strictly related to their parameters, limiting their AT benefits, while input-dependent SSMs may face the problem of error explosion. Furthermore, we show that the Attention component effectively scales the output error of SSMs during training, enabling them to benefit more from AT, but at the cost of introducing RO due to its high model complexity.
Inspired by this, we propose a simple and effective Adaptive Scaling (AdS) mechanism that brings AT performance close to Attention-integrated SSMs without introducing the issue of RO.

Main paper: 
 introduction: 
 Deep State Space Models (SSMs) represent a promising emerging model architecture inspired by traditional linear state space models [1] . These models capture temporal dependencies in sequences via structured state space transitions [2, 3, 4] . By leveraging their inherent recurrent nature and linear discretized transmission form, SSMs excel in long-sequence modeling with linear computational complexity [3, 5] . This makes SSMs highly competitive in various downstream tasks, with the potential to surpass classical architectures like convolutional networks and Transformers [6, 7, 8] . While the superior performance of SSMs on clean data has been well established across various tasks, these models may face significant security risks from meticulously crafted Adversarial Perturbations (APs) [9, 10, 11, 12, 13] in real-world scenarios. Therefore, it is essential to thoroughly explore and discuss the Adversarial Robustness (AR) of SSMs. Previous work [14] has conducted preliminary robustness evaluations on visual SSMs. However, their assessment was limited to the VMamba structure. More importantly, they did not specifically evaluate and analyze the performance of SSMs under Adversarial Training (AT) [10, 15, 16] . This aspect is crucial for enhancing the AR of SSMs, as AT is the mainstream approach for improving a model's AR [16, 17, 18] . To bridge the current research gap, we aim to answer the following questions:1. Do many component designs that have proven effective in boosting SSM performance under Standard Training (ST) [19, 20] similarly enhance SSMs when subjected to AT? Adversarial attacks aim to induce erroneous predictions by adding meticulously crafted small perturbations [9, 10] , which may cause a more pronounced negative impact on SSM models. This is because SSMs heavily rely on sequential dependencies in inputs, causing errors to accumulate through state propagation. Consequently, it remains uncertain whether commonly employed AT frameworks, such as PGD-AT [16] and TRADES [21] , can effectively improve the AR of SSMs.2. How do various components influence the robustness-generalization trade-off in AT? Due to the trade-off between robustness and generalization [22, 23] , AT often leads to a decrease in the accuracy of deep learning models on clean data, thus hindering their generalization. Additionally, deep learning models are prone to Robust Overfitting (RO) [24, 25] , where models trained adversarially overfit to the AT samples but fail to generalize to adversarial test samples, significantly limiting the effectiveness of AT. We aim to investigate how existing structural variants of SSMs, such as diagonalized [26] and Multi-Input Multi-Output (MIMO) SSM [27] , affect the robustness-generalization trade-off and RO issues in SSMs, thereby providing insights for designing more robust SSM structures.3. Can the analysis of various SSM components' performance in AT provide valuable insights for the design of more robust SSM structures? Our objective is to analyze how components of different SSM variants influence model behavior during AT and to identify those that contribute positively. This analysis aims to inform adjustments that enhance the robustness and performance of SSMs under AT.To response Q1 and Q2, we employ AT using common AT frameworks on various structural variants of SSMs. These include implementations such as Normal Plus Low-Rank (NPLR) decomposition (S4) [3] , diagonalization (DSS) [28, 26] , MIMO extension (S5) [27] , integration of attention mechanisms (Mega) [19] , and data-dependent SSM extension (Mamba) [20] . Subsequently, we conduct comprehensive robustness evaluations to assess their performance. Specifically, we obtain the following observations: 1)A Clear Robustness-Generalization Trade-off in SSM Structures. We observe a significant decrease in the Clean Accuracy (CA) of SSMs following AT. Specifically, for the S4 model on the CIFAR-10 dataset, the CA dropped by nearly 15% compared to ST. This indicates a pronounced robustness-generalization trade-off in SSM structures. 2) Pure SSM structure struggles in benefit from AT. Despite expanded to data-dependent SSM, Mamba fails to show distinct superiority over the fixed-parameterized counterparts (S4 and DSS) under AT, even though all are SISO systems. 3) Only the incorporation of attention mechanisms significantly enhances both the CA and RA of SSMs after AT. However, this improvement also introduces a significant issue of RO.To response Q3, we conduct both empirical and theoretical analyses of the output error of SSMs under AP. Our findings demonstrate that fixed-parameterized SSMs have bounded output errors strictly related to their parameters, which limits their ability to reduce output errors during AT. In contrast, data-dependent SSMs may encounter an explosion of output errors. Furthermore, incorporating attention mechanisms provides additional adaptive scaling of the SSM's output error, facilitating better alignment of outputs corresponding to adversarial and clean inputs. However, this also increases complexity, raising the risk of RO. Inspired by this, we explore whether a low-complexity adaptive scaling operation could assist SSMs in output alignment while avoiding RO issues. To this end, we designed a simple Adaptive Scaling (AdS) mechanism to aid in output alignment. Our results indicate that this design effectively enhances the AT performance of SSMs and reduces output errors without introducing RO issues. We hope that our responses to the above three questions will inspire further research and development of robust SSM structures. 
preliminaries of ssms: 
 Given the input signal u(•) ∈ R + → R d and time t ∈ R + , the general linear SSM, parametrized by an state matrix A ∈ R h×h , an input matrix B ∈ R h×d , an output matrix C ∈ R d×h and a direct transmission matrix D ∈ R d×d can be formalized as follows:EQUATIONEQUATIONwhere x(t) ∈ R h and y(t) ∈ R o represents respectively represent the hidden state and the output signal at time t.For the discretized input sequence u ∈ R L×d , S4 [3] broadcasts the same SSM parameters to each input dimension for state propagation, instantiating a SISO system. Specifically, they employ a bilinear method [29] for discretization to obtain discretized approximations of the parameters:EQUATIONEQUATIONwhere u(i)k and y(i)k represents the i-th element in the k-th token of u and y respectively. ∆t ∈ R + is a fixed step size that remains constant for each time step. S4 parameterizes the matrix A using NPLR decomposition for efficient optimization. By setting x 0 = 0, the output can take the following form:EQUATIONThis can be achieved by a parallelized efficient convolution computation:y (i) = K * u (i), where the convolution kernel K = CB, CAB, . . . , CA L-1 B , resulting in a complexity of O(Lh).DSS Instead of employ bilinear discretization, DSS [28] uses the Zero-Order Hold (ZOH) discretization:EQUATIONBased on this, they diagonalize A to instantiate the SSM parameters:EQUATIONwhere exp λ i is the i-th diagonal element of A.S5 S5 [27] still employs ZOH discretization, but with a distinction, they utilize a MIMO setup, meaning all hidden dimensions of each token are jointly involved in state transition as in eq.( 1) and(2) and employs parallel scanning for computation. To ensure efficiency, they set A = V -1 ΛV for diagonal reparameterization:EQUATIONthis reduces the complexity of parallel scanning from O(h 3 L) to O(hL).Mamba (S6) Similar to DSS and S5, Mamba [20] utilizes ZOH for discretization and performs diagonal instantiation of A, with computations carried out through parallel scanning. It is noteworthy that Mamba sets adaptive B k (u k ), C k (u k ) and ∆t k (u k ), 1 ≤ k ≤ L for each step through learnable linear transformation (meaning that they adpoted a data-dependent SSM parameters setting), while still maintaining a SISO configuration.Mega Mega's SSM component is implemented in the form of Exponential Moving Average (EMA) [19] . Specifically, their Multi-dimensional Damped EMA is given by:EQUATIONwhere the expansion parametersβ i ∈ R h , projection parameters η i ∈ R h , α i , δ i ∈ R h representthe weighting and damping factors, respectively. This can be formalized equivalently as a SISO SSM with parametersA i = diag(1 -α i ⊙ δ i ), B i = α i ⊙ β i and C = η ⊤ i .Following the execution of SSM, Mega introduces Attention mechanism between the SSM output y and input sequence u, which made it the most competitive Attention-based SSM structure [27] . In this section, we empirically assess the natural AR of various SSM structures and their AR post AT to explore the AR enhancement provided by mainstream AT frameworks for SSMs and the generalization behavior of SSM variants under AT.Training Setup. We adopt the ST and two most commonly used AT frameworks, PGD-AT [16] and TRADES [21] , as well as two more efficient and advanced adversarial training frameworks, FreeAT [30] and YOPO [31] , to conduct experiments on the MNIST, CIFAR-10, and Tiny-ImageNet datasets. For AT, we utilize a 10-step ℓ ∞ PGD (PGD-10) as the attack method. Following [21] , on MNIST, we set the adversarial budget to ∥ϵ∥ ∞ = 0. Evaluation Setting. We record the CA and adversarial test accuracy (i.e. Robust Accuracy, RA) [10, 33] of each model at their best and final checkpoints across three training schemes to evaluate robustness and examine the robustness-generalization trade-off as well as the issue of RO. The results are presented in Table 1 . Beyond adversarial testing with PGD-10, we incorporate AutoAttack (AA) [34] for a rigorous robustness evaluation. AA integrates four attack strategies: APGD-CE [34] , APGD-DLR [34] , FAB [35] , and Square [36] , serving as a powerful adversarial attack baseline widely used in AR evaluation [25, 33] .For SSMs trained with ST, almost all models exhibit no adversarial robustness, and the adversarial test loss for all models shows a continuous increase during the training process, as depicted in Fig. 5 in Appendix D, consistent with the conclusions drawn for convolutional networks [16] . However, it is noteworthy that the RA of Mega and Mamba trained standardly are higher than the rest of the SSM structures, especially on MNIST where this performance is particularly pronounced. This suggests that the flexibility introduced by Attention [19] and data-dependent SSM structures also helps the models to some extent in adapting to adversarial examples. Compared to the ST scenario, we are more interested in understanding the AR improvement of AT for SSMs and the dynamic behavior of SSMs during AT. To this end, we plot the training, testing, AT, and adversarial test loss and accuracy changes of various SSM variants on both datasets for PGD-AT (Fig. 1 ) and TRADES (Fig. 2 ). In conjunction with Table 1 , we have the following observations:1) AT remains an effective strategy for enhancing the AR of SSMs, yet different SSM structures exhibit a clear trade-off between robustness and generalization. All models benefit from AT, achieving higher RA with both PGD-AT and TRADES frameworks. Some intriguing phenomenons occurs on the MNIST dataset, where models trained under the PGD-AT framework exhibit a marked decrease in CA and almost no RA under AA. In contrast, TRADES does not lead to a significant reduction in CA and substantially improves robust accuracy under AA. This disparity is not observed on CIFAR-10 and Tiny-Imagenet. The phenomenon can be elucidated by findings from [37] , which indicate that MNIST's limited semantic information may lead PGD-AT to fit to spurious rather than causal features, resulting in overfitting to ℓ ∞ PGD attacks. On the other hand, TRADES explicitly constrains the KL divergence between clean and adversarial sample logits, ensuring that the model learns causal features from clean data while adapting to adversarial distributions. Besides, on the MNIST dataset, all model architectures fail to converge when trained with YOPO. This advanced adversarial training strategy relies on the parameters of the model's input layer for auxiliary calculations, making it difficult to simply extend and be effective on non-convolutional structures. However, on the CIFAR-10 dataset, a noticeable decrease in CA is observed across all SSM structures after AT, particularly for S5, which experienced a 16.62% drop in CA under PGD-AT, with other structures also showing approximately a 10% reduction in CA, a similar phenomenon is observed on Tiny-ImageNet. This indicates a clear trade-off between robustness and generalization for SSM structures.2) The incorporation of Attention indeed yields a better trade-off between robustness and generalization, yet it also introduces a significant issue of RO. Compared to other SSM structures, Mega exhibits the least CA degradation after AT, while compared to DSS, the model with the sec- ond least CA degradation, Mega achieves improvements of 4.21% and 2.68% in CA degradation under PGD-AT and TRADES, respectively. Moreover, Mega attains the highest adversarial accuracy against PGD-10 and AA attacks post-AT (in the best sense). This indicates that the introduction of Attention can indeed lead to a better robustness-generalization trade-off. However, from Fig. 1 and 2, it is observed that on CIFAR-10, both under PGD-AT and TRADES, Mega demonstrates a continuous decrease in AT loss and an increase in AT accuracy, but the RA in adversarial testing shows almost no growth trend in the middle and late stages of training, resulting in a difference of over 40% (PGD-AT) and over 20% (TRADES) between AT and test accuracy at the end of training. Particularly for PGD-AT, after achieving the best RA of 40.53% at the 39th epoch, Mega's RA begins to gradually decline, eventually falling to 30.68%, showing a very evident RO issue. Additionally, Mamba also exhibits a clear RO issue during the TRADE training process, as depicted in Fig. 2 , resulting in a difference of over 20% between AT and test accuracy.3) The pure SSM structure exhibits a significant disadvantage in AT, and the data-dependent parametrization does not aid in the AT of SSMs. S4, DSS and Mamba, due to their SISO characteristics, require the addition of linear layers after SSM calculation to aid in the interaction between different feature elements. While S5 that expanded with MIMO capabilities can be equivalent to a linear combination of multiple SISO SSMs, thus obviating the need for extra position-wise linear layers [27] . This makes the S5 block consist solely of a MIMO SSM. Nonetheless, on CIFAR-10, S5 demonstrates a marked disadvantage in RA and a worse robustness-generalization trade-off compared to other SSMs after training with both PGD-AT and TRADES (Tab. 1). Furthermore, we also observe that, despite the inclusion of linear layers, Mamba still exhibits a reduction in CA and RA compared to S4 and DSS, indicating that the extension of the data-dependent SSM does not contribute to the model's AT.Based on the observations, we give an answer to the questions Q1 and Q2. SSMs alone seem to struggle to perform well in AT, while SSMs integrated with linear layers or Attention demonstrate a significant enhancement in AR compared to the pure SSM structure. However, SSMs with Attention, although showing the greatest gain in both robust and clean accuracy, exhibit a much more pronounced RO issue compared to SSMs with only linear layers integrated.Based on these findings, we consider the following: Does the inherent nature of SSMs limit their benefit in AT? Is it the Attention mechanism itself causing overfitting to AT data? Can formal analysis of Attention's behavior in AT provide insights for finding ways to improve SSMs' AR while avoiding RO issues? We will delve deeper into these questions in the following section. 
component-wise attribution: theoretical and experimental analysis: 
 In this section, we first theoretically investigate the stability boundaries of various SSMs under APs to understand why SSMs alone do not benefit significantly from AT. This theoretical analysis aims to uncover the reasons behind the limited effectiveness of AT on pure SSM structures. Next, we experimentally validate each component integrated with SSMs to further elucidate their roles in enhancing AT performance. Finally, we conduct a formal analysis of why incorporating attention mechanisms aids in AT, aiming to provide insights for improving the robustness and performance of SSMs during AT.We consider a generalized scenario where the SSM input is denoted asu = (u 1 , u 2 , • • • , u L ) T ∈ R L×1, and the input after AP isu ′ = (u ′ 1 , u ′ 2 , • • • , u ′ L ) T ∈ R L×1 . Let ε = u ′ -u = (ε 1 , ε 2 , • • • , ε L ) T ∈ R L×1 , and assume E[ε] = µ, E[ε 2 k ] ≤ M , for k = 1, 2, .. . , L (such assumptions are reasonable due to the perturbation budget constraints inherent to AP). Considering the generalized SSM setup:EQUATION)The form in eq. ( 10) encompasses both the fixed-parameterized and the data-dependent scenario, where when 10) represents a fixedparameterized SISO SSM. It is reasonable to consider only the SISO case here, as after diagonal reparameterization, each hidden dimension of the state transition equation in S5 can still be regarded as an independent SISO system. Based on the above settings, we have the following theorem:A i = A, B i = B, C i = C (i = 1, . . . ), Equation (Theorem 4.1.1 Given the SSM formalized as in eq. ( 10), the output error before and after perturbation, E ε ∥y ′ -y∥ 2 , has the following upper and lower bounds: This implies that even when fixed-parameterized SSMs aim to stabilize the output of adversarial examples during AT by minimizing output error, they are constrained by a fixed lower bound on the error. This constraint leads to inevitable error accumulation, making it challenging for pure SSM structures to effectively benefit from AT. While Mamba can avoid the issue of a fixed error lower bound through adaptive SSM parameterization, it may also introduce more severe negative impacts. Notice that during the ZOH discretization process, as ∆t k → 0, the eigenvalues ofµ 2 c 1 L j=1 j-1 i=1 | λmin i | (C j B j ) 2 ≤ E ε ∥y ′ -y∥ 2 2 ≤ c 2 M L i=1 j-1 i=1 | λmax i | (C j B j )∆ t A in B k = (A k -I)(∆t k A k ) -1 ∆t k (u k )B tend towards 0.This results in an ill-conditioned problem when computing the inverse operation(∆ t A) -1 , causing ∥B k ∥ → ∞. Consequently, this leads to max u C k (u k )B k (u k ) 2 ≤ ∥C k (u k )∥ 2 2 ∥B k (u k )∥ 2 2→ ∞ in Mamba, potentially resulting in an almost infinite error bound. In contrast, training stable fixed-parameterized SSMs ensures a fixed upper bound on output error, thereby avoiding such error explosion issues.To validate our theoretical analysis with quantitative metric and to deeply investigate the specific roles of components within various SSM structures during AT, we record the relative change in feature sequence differences d(f ′ , f )/∥f ∥ (%) on CIFAR-10 for each model post-AT, where f ′ , f ∈ R L×d represent the feature sequences corresponding to adversarial and clean inputs, respectively. We measure the differences using two metrics: the Mean Squared Error (MSE)1 T ∥f ′ -f ∥ 2 2, to quantify the absolute discrepancy between f and f ′ , and the Kullback-Leibler (KL) divergence [38] KL(S(f )∥S(f ′ )), to evaluate the distributional divergence between f ′ and f , where S represents the Softmax operation over the sequence dimension, given by S(f) [k,j] = exp(f ) [k,j] / T i=1 exp(f ) [i,j]. We average the statistical results from both the training and test sets, analyzing the performance differences between them to attribute the issue of RO. For each component, we calculate the average results across all layers. As shown in Fig. 3 , there is an increase in both MSE and KL divergence before and after the SSM in all models. Notably, Mamba exhibits an over 40 times increase in KL and MSE on both the training and test sets after training with TRADES, significantly higher than the changes observed in other fixed-parameterized SSMs. These findings are consistent with our theoretical analysis, indicating that SSMs inherently struggle to reduce output discrepancies through AT, while data-dependent SSMs may experience an explosion of output errors during AT.It is noteworthy that both the linear layers and the Attention mechanism exhibit a significant reduction in MSE and KL divergence, implying that they indeed serve to diminish the discrepancy between feature sequences of clean and adversarial input during AT. This explains why SSMs integrated with Attention and linear layers achieve higher CA and Robust RA in AT. Compared to linear layers, Attention induces a more pronounced reduction in MSE and KL divergence. However, while Attention after PGD-AT achieves more than a 90% decrease in MSE and KL divergence on the training data, it only yields about a 60% reduction on the test set, which is significantly weaker than the improvements observed on the training set. In contrast, other components do not exhibit such a notable degradation in difference reduction on the test set, indicating that the RO issue essentially stems from Attention itself, rather than other components. In fact, the incorporation of Attention introduces excessive model complexity, which, according to the conclusions in previous work [39] , also limits the model's RG. According to eq. ( 11), the introduction of Attention effectively allows the model to adaptively scale the output error: E ∥A(y ′ )y -A(y)y∥ 2 2 , where A denotes the Self-Attention operation. This inspires us to consider: whether incorporating an Ads to the SSM's output sequence y with minimal added complexity could enable fixed-parameterized SSMs to approach the AT performance of Attention while avoiding the introduction of RO?To answer this question, we introduced an AdS module after the SSM of S4 and DSS, to adaptively scale the SSM output y:y k = σ(L 1 (y k )) ⊙ y k + σ(L 2 (y k )), where L 1 and L 2 are learnable linear mappings, L 2 (y k ) is used to assist in adaptive scaling to adjust the output bias, and σ is an activation function, which includes ReLU, Tanh, or Sigmoid. We conduct AT on SSMs with AdS integrated with different activations on CIFAR-10 and MNIST using PGD-AT and TRADES, and record the best and final CA and RA. As shown in the results in Table 2 , regardless of the type of activation integrated, S4 and DSS with AdS showed more than a 3% improvement in CA and over a 2% improvement in RA. In particular, the AdS with ReLU as activation brought a 4.1% improvement in CA and a 3.97% improvement in RA for DSS when trained with TRADES, nearly matching Mega's performance in terms of CA and RA under PGD-10 and AA, without exhibiting RO issues observed in Mega with PGD-AT. The experimental results on Tiny-ImageNet (Tab. 6) also support the same conclusion. To further confirm that AdS can indeed help reduce SSM output discrepancies, similar to the effect of Attention, we also quantify the differences in the intermediate layer feature sequences for each component of S4 and DSS after integrating AdS, as shown in Fig. 4 . The feature sequence differences before and after AdS, in terms of both KL divergence and MSE, shows a decrease, indicating that the introduction of AdS does help in reducing the disparity between clean and adversarial feature sequences. This provides an affirmative answer to our question, suggesting that the primary advantage of Attention in enhancing SSM's performance in AT is due to its adaptive sequence scaling. Incorporating a low-complexity adaptive scaling module can improve the SSM model's CA and RA in AT while preventing RO issues.Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)? Answer: [Yes] Justification: We report all settings and details of the reproducible experiments in Section 3 and Appendix C. Guidelines:• The answer NA means that the paper does not include experiments.• If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not. • If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable. • Depending on the contribution, reproducibility can be accomplished in various ways.For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed. • While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. , with an open-source dataset or instructions for how to construct the dataset). (d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility.In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results. 
conclusion: 
 In this study, we evaluate the performance of various SSMs structures in AT and investigate which components positively assist SSMs in this context. Our findings reveal the robustness-generalization trade-off inherent in SSMs during AT. Although the integration of Attention improves both the CA and RA of SSMs, it also increases model complexity, leading to RO issues. Through experimental and theoretical analyses, we demonstrate that pure SSM structures hardly benefit from AT, whereas Attention facilitates further reduction of output error through sequence scaling. Inspired by this, we show that introducing a simple and effective AdS module to SSMs effectively enhances their AT performance and prevents RO. This provides valuable guidance and insights for the future design of more robust SSM structures.Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material? Answer: [Yes] Guidelines:• The answer NA means that paper does not include experiments requiring code. Guidelines:• The answer NA means that there is no societal impact of the work performed.• If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.• Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations. • The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 
safeguards: 
 Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?Answer: [NA] Justification: The paper poses no such risks.Guidelines:• The answer NA means that the paper poses no such risks.• Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. • We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?Answer: [Yes] Justification: The creators or original owners of assets used in the paper, properly credited and the license and terms of use explicitly are mentioned and properly respected.Guidelines:• The answer NA means that the paper does not use existing assets.• The authors should cite the original paper that produced the code package or dataset.• The authors should state which version of the asset is used and, if possible, include a URL. • The name of the license (e.g., CC-BY 4.0) should be included for each asset.• For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.• We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution. • For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review. 
 
 Appendix: A.1 The Proof of Theorem 4.1.1EQUATIONwhere1 = (1, 1, • • • , 1) T . Denote H ≜ [h 1 , h 2 , • • • , h L ], where h 1 , h 2 , • • • , h L are column vectors of H, i.e. h 1 = C 1 B 1 , C 2 A 1 B 2 , • • • , C L L-1 i=1 A i B L , h 2 = 0, C 1 B 1 , • • • , C L-1 L-2 i=1 A i B L-1 , • • • , h L = 0, 0, • • • , C 1 B 1 ,then the inequality 12 can be written as :EQUATION)whereE =         1 1 1 1 1 1 1 1 1 1 . . . . . . . . . . . . . . . 1 1 1 1 • • • 1        is a lower triangular matrix with all elements being 1.Therefore, E T E is a real symmetric positive definite matrix and is full rank, then there exists an orthogonal matrix Q and a diagonal matrixΛ = diag(λ 1 , λ 2 , • • • , λ L ), where λ i are eigenvalues of E T E, and λ i must satisfy λ i > 0, denote λ max = max{λ 1 , λ 2 , . . . , λ L } = c 2 and λ min = min{λ 1 , λ 2 , . . . , λ L } = c 1 , we have,EQUATION)(ii) Perform a similar derivation for the upper boundEQUATIONwhereE ε =     ε 1 ε 1 ε 2 . . . . . . . . . ε 1 ε 2 • • • ε L     = E • diag(ε 1 , ε 2 , • • • , ε L ) ≜ EΛ ε . Let the eigenvaluewith the maximum absolute value of matrix A i be denoted as λmax i and the eigenvalue with the minimum absolute value as λmin i note thatj-1 i=1 | λmin i |(C j B j ) 2 ≤ (C j j-1 i=1 A i B j ) 2 ≤ j-1 i=1 | λmax i |(C j B j ) 2, which means:EQUATIONTable 3 : Specific architecture of models with different SSM structures on each dataset. such as computer vision [50, 51] and natural language processing [20] . [1] was the first to integrate state-space models from modern control theory with deep learning, initiating extensive research on SSMs within the deep learning community. Early research on SSMs was limited by issues such as the computational complexity of training and the exponential decay of memory [52] , which restricted their application. S4 [3] optimized the parameterization scheme of SSMs to reduce the computational requirements for training, while S5 [27] further extended S4's SISO system to a MIMO system. Mamba [20] introduced a selective scanning mechanism to more flexibly adapt to the input, significantly enhancing the performance of SSM models. Additionally, a series of works aimed to integrate SSM models with attention mechanisms [6, 53, 19] to mitigate the flexibility limitations imposed by the inherent fixed structure bias of SSMs.Despite the widespread attention on the superior performance of SSMs, the adversarial robustness of such models has not been thoroughly investigated. This is an urgent issue that needs to be explored before SSMs can be widely applied. To the best of our knowledge, [54] is the only work that has investigated the adversarial robustness of SSMs. This study shows that VMamba is more susceptible to adversarial attacks compared to convolutional networks on 2D image data, indicating that the robustness of SSMs requires more attention. However, this work only studied VMamba in the visual The specific structures of different SSM architectures on each datasets are shown in Table 3 . And the training parameters and details used for each dataset are shown in Table 4 . All experiments were implemented on multiple NVIDIA RTX A6000 GPUs.In this section, we report additional experimental results, including the ST training process, testing process, and the PGD-10 attack test results on the test datasets of CIFAR-10 and MNIST (Fig. 5 ), the CA and RA of five SSM structures on Tiny-ImageNet under different adversarial training frameworks (Tab. 5), and the related comparison of results with and without the AdSS mechanism (Tab. 6).While this paper offers a componential analysis and exploration of SSM performance in AT, with the goal of informing the design of more robust SSM structures, there are several limitations to our study. Due to space constraints, our explorations have been limited to fundamental visual classification tasks. Future research will need to extend this analysis to a wider array of modalities and downstream tasks to fully understand and enhance the robustness of SSMs in diverse applications.Answer: [Yes] Justification: The complete mathematical derivations are provided in the Appendix A. Guidelines:• The answer NA means that the paper does not include theoretical results.• All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced. • All assumptions should be clearly stated or referenced in the statement of any theorems. • The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition. • Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material. • Theorems and Lemmas that the proof relies upon should be properly referenced. 


Decision: This paper presents a study of adversarial robustness of the state space models (SSMs), including both theoretical and empirical analysis. Through the analysis of different components of SSMs, the authors show that incorporation of the attention mechanism helps enhance their robustness due to its input-dependent nature, while there could be a risk of robust overfitting. Then, the authors proposed a simple mechanism to enhance the adversarial training performance while avoiding robust overfitting, and validated this on multiple small-scale benchmarks.

The paper received borderline ratings, with the reviewers leaning toward acceptance. The reviewers initially had concerns over the small-scale experiments, lack of experimental results with stronger attacks, underdeveloped method, and unclear claim over robust overfitting. However, these concerns were partly addressed during the rebuttal period as the authors provided clarification and additional results with more attacks and an additional dataset (TinyImageNet). 

I believe that the paper proposes an interesting study that could be of interest to researchers working on SSMs, and the findings could lead to many follow-up studies in this direction. However, the problem addressed in this work seems niche, which may limit its potential impact.

Reviews: review: paper_summary: paper_summary: This paper presents a comprehensive analysis of the adversarial robustness of Deep State Space Models (SSMs). The authors evaluate various SSM structures under different adversarial training (AT) frameworks, specifically examining how different components contribute to adversarial robustness. They observe that pure SSM structures struggle to benefit from AT, while the incorporation of attention mechanisms yields better trade-offs between robustness and generalization, albeit with the introduction of robust overfitting issues. The authors provide theoretical and empirical analyses to explain these phenomena and propose a simple Adaptive Scaling (AdS) mechanism to enhance SSM performance in AT.
strength_weakness: strength_weakness: - I don’t quite understand the claim about robust overfitting: based on Table 1, using AutoAttack, the “Diff” is always very small, almost always <1%. Why is there robust overfitting then?
- Limited scope of experiments: While the paper provides comprehensive evaluations on MNIST and CIFAR-10 datasets, it lacks experiments on more complex datasets (e.g., at least Tiny ImageNet or some dataset with a higher image resolution) or real-world scenarios. This limitation somewhat restricts the generalizability of the findings.
- [Less important] Comparison with non-SSM models: The paper focuses exclusively on SSM variants without comparing their adversarial robustness to other popular model architectures like CNNs or Transformers. Such comparisons could provide valuable context for the robustness of SSMs relative to other widely-used architectures.

I would be willing to increase the score if the first 2 points are addressed.
questions: questions: - It’s a bit surprising to see that PGD-AT doesn’t work on MNIST (according to AutoAttack), while TRADES does. Were the hyperparameters properly tuned?
- Have you considered exploring the interaction between SSM robustness and other aspects of model design, such as depth or width of the network?
limitations: limitations: Yes.
paper_summary: paper_summary: This paper investigate the adversarial robustness in deep state space models (SSMs). They provide both empirical and theoretical analysis of the SSMs' performance under the adversarial perturbation. They find that fixed-parameterized SSMs are limited in their adversarial training benefits due to output error bounds strictly tied to their parameters, whereas input-dependent SSMs risk experiencing error explosion.
strength_weakness: strength_weakness: 1. Tested dataset size is small.
2. Better to add a result of without AdS in Table 2 so we can better observe the improvement.
3. Lack of analysis why different activation function in AdS influence performance.
questions: questions: 1. Have you tested proposed AdS performance on larger dataset (e.g, ImageNet-1k, ImageNet-tiny)?
2. The proposed AdS is more like a naive try. Is that possible to propose a new SSM architecture based your observation?
limitations: limitations: See weaknesses and questions.
paper_summary: paper_summary: The paper investigates and evaluates the effectiveness of traditional Adversarial Training (AT) methods on recently emerged State Space Models (SSMs). The paper finds that pure SSM is not a suitable choice for AT and attention-based SSM learns the adversarial feature more effectively. Based on such insights, theoretical proof is developed and the Adaptive Scaling is applied to SSM for better robust generalization. The experiments are mainly on MNIST and CIFAR-10.
strength_weakness: strength_weakness: 1. The evaluation dataset is not sufficiently scaled up to be representative. It would be more convincing if the paper developed similar findings on larger datasets such as CIFAR-100 and Tiny-ImageNet. 

2. The involved adversarial training methods lack novelty. While PGD-AT and TRADES are classic AT methods, other representative variants can significantly improve AT efficiency and its robust performance. To name a few, Free-AT [1] substantially improves the training efficiency, and YOPO [2] boosts the robustness with fewer computations. Will SSMs be able to adopt these variants other than classic PGD-AT?

[1] Adversarial Training for Free. NeurIPS 2019.

[2] You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle. NeurIPS 2019.
questions: questions: Please address my concerns stated in the weakness section. Given the current version of the submission, I rate it as a borderline rejection considering the lack of sufficient empirical evaluation and the limited novelty of the adversarial training methods. However, I look forward to the authors' response, and I will consider revising the rating based on the soundness of the response.
limitations: limitations: The paper has stated the limitations in Appendix E.

Comments: title: Follow-up Response to Reviewer eBVC
Follow-up comments
Response to Reviewer a6wJ
Response to Reviewer PGjA
Response to Reviewer eBVC
comment: Most of my concern has been addressed. I have increased my score to 6.
Dear Reviewer a6wJ:

We are honored by your thorough review. Your valuable suggestions have greatly enhanced our thinking and significantly improved the quality and depth of our research.

Your insightful feedback has helped further elevate the quality of the paper. Additionally, your recommendation to include a discussion on more AT methods has been instrumental in refining the experimental evaluation of our work.

We are particularly grateful for the professionalism and constructive feedback you demonstrated during the rebuttal phase. Your suggestions enabled us to improve the paper and ultimately gain your approval. This has been both encouraging and inspiring for us, and we believe these improvements will make our work more compelling.

Sincerely,

Authors of Paper #18034
Dear Reviewer PGjA,

Thank you for taking the time out of your busy schedule to review our paper and provide valuable feedback. We greatly appreciate the issues you raised and have addressed them in detail. We have also made the following revisions to our manuscript based on your suggestions:
Thank you for taking the time to review our paper and provide valuable feedback. We greatly appreciate the issues you raised and have addressed them in detail. Based on your suggestions, we have made the following revisions to our manuscript:

**Evaluation on Larger Dataset**: Following your suggestion, we evaluated various SSM structures under different AT methods on the Tiny Imagenet dataset, which includes more categories and larger image sizes. The supplementary evaluation results are consistent with the conclusions observed on MNIST and CIFAR-10, further validating our findings.

**Detailed Discussion of Theorem 1**: Based on Theorem 1, we have discussed the impact of the eigenvalues of the state matrix on error accumulation during state-space transformation. We also analyzed the influence of different activation functions on the model's expressive capacity, and have included this analysis in our paper.

**Testing AdS Performance on Larger Dataset**: As per your suggestion, we tested the performance of AdS on the larger Tiny Imagenet dataset. The results demonstrate that AdS provides general improvements in CA and RA for data-dependent SSMs.

**Table Refinement**: We have added the AT results without AdS to Table 2, as previously reported in Table 1.

We believe these revisions contribute to improving the quality of our paper. If you have any further suggestions or questions, we would be happy to continue discussing and refining our work. Once again, thank you for the time and effort you have invested in this review.

Sincerely,

Authors of Paper #18034
Thanks for the reviewers' feedback. We apologize for any doubts caused by our presentation and will address your questions point by point.

**Q1: About the particularly interesting/unexpected messages in the paper**.

**R1**: Apologize for any confusion caused by our presentation again. Our paper indeed reached some unexpected conclusions, and we will further elaborate on our conclusions:

**Intuitive Understanding 1**: **Intuitively, Mamba's AT performance should be significantly better than that of S4 and DSS**. Mamba incorporates adaptive parameterization, allowing it to adjust SSM parameters adaptively according to the input, and thus should be more easily adaptable to perturbed inputs. Our conclusion contradicts such intuitive understanding.

**Conclusion 1**: **Adaptive parameterization is detrimental to the AR of SSMs**.

**Finding 1**: **The adaptive parameterization design of SSM in Mamba did not yield a performance gain over S4 and DSS in AT and even showed a negative gain** (See Table 1).

**Analysis 1** (L240-L246): Our theoretical analysis (Lines 240-246), corroborated by validation experiments (See Fig.3), elucidates the reason behind the aforementioned finding: **adaptive parameterization design cannot ensure a bounded upper limit on the perturbation error of the SSM, while fixed parameterization can**. Therefore, the adaptive parameterization setting is detrimental to the AR of the SSM.

**Intuitive Understanding 2**: **Intuitively, the AT performance after introducing Attention should be better than that of other models**. Since Mega with Attention has the best natural accuracy, and models with better natural accuracy generally perform better in AT [1][2], Mega's AT performance should be the best. However, our conclusion does not align with this intuition.

**Conclusion 2**: **The introduction of Attention into SSM has brought about RO issues, which hinder the robust generalization capability of SSM**.

**Finding 2**: **The incorporation of Attention has led to significant RO problems, greatly limiting the benefits that Attention could provide**. Particularly when using PGD-AT, the AT performance after introduced the Attention mechanism is lower than that of S4 and DSS (See Table 1).

**Analysis 2**: The analysis from L249 to L291 indicates that the scaling effect of the Attention mechanism provides SSM with the ability to regulate perturbation errors, thereby improving AR. However, the integration of Attention introduces excessive model complexity, leading to RO issues that limit the gains brought by Attention.

More importantly, **the findings and analysis above can also provide new insights for designing robust SSM architectures**, such as: 
1) Introducing regularization into the design of adaptive SSM parameterization to prevent the unbounded growth of perturbation error brought by adaptive parameters. 
2) Considering the introduction of adaptive scaling strategies with the lowest possible model complexity to replace the integration of Attention into SSM, thereby avoiding RO issues and further improving the AR of SSM.

We will refine the presentation of our paper to more clearly convey the novelty and value of our conclusions.

**Q2：RO should be assessed with the best possible attack**.

**R2**: Thank you for the insightful comments from the reviewer. We fully agree with your suggestion to use AA for assessing AR. Accordingly, we conducted AR evaluations using AA attacks on various checkpoints of the models Mega and Mamba, which have RO issues, trained under the PGD-AT and TRADES frameworks, to measure the robust accuracy difference between the best and last checkpoints. The results are presented in the table below. The experimental outcomes indicate that both Mamba and Mega exhibit RO issues, with Mega showing a significant RO problem, especially when trained with TRADES on MNIST, where the robust accuracy difference between the best and last checkpoints reached $19.31$%. This is consistent with the conclusions provided in our paper. We will include the complete experimental information in the revised version.

| Method | Model | MNIST (Best/Last/Diff) | CIFAR10 (Best/Last/Diff) | Tiny Imagenet (Best/Last/Diff) |
|--------|-------|------------------------|--------------------------|--------------------------------|
| PGD-AT | Mega  | 4.54/0.00/4.54          | 34.52/25.26/9.26          | 6.38/1.08/5.30                 |
|        | Mamba | 2.13/0.00/2.13          | 37.29/32.28/5.01          | 4.15/1.92/2.23                 |
| TRADES | Mega  | 30.21/10.90/19.31       | 41.48/36.97/4.51          | 6.44/4.88/1.56                 |
|        | Mamba | 62.56/52.85/9.71        | 31.26/29.07/2.19          | 2.92/2.36/0.56                 |

We believe that the above responses will fully resolve your concerns

[1] Bag of Tricks For Adversarial Training.

[2] Towards Efficient Adversarial Training on Vision  Transformers.
Thank the authors for the discussion. The response is sufficient and valid. The arguments are reasonable with clear explanations. I revise the rating to 5 (Borderline Accept).
Thanks for the new experiments and clarifications. The accuracy numbers on Tiny ImageNet seem quite low, though (e.g., best robust _accuracy_ with AutoAttack doesn't exceed 6%), but this is probably expected for non-convolutional architectures that are less sample-efficient compared to CNNs.

As for robust overfitting, it should be assessed with the best possible attack (and AutoAttack is a decent proxy for that), not with the attack used for training. This affects many claims that you've made in your paper.

I appreciate the new results, so I increase my score from 4 to 5. Overall, I feel like the paper provides a detailed study on Lp adversarial robustness in state-space models, but I'm not sure if there are some particularly interesting/unexpected messages in the paper, which is why I'm hesitant to increase my score above 5.
**Response to W1**:

Really greatful for the valuable comments from the reviewer. To ensure a more comprehensive and thorough assessment, we introduced a dataset with a larger size and more classes, Tiny Imagenet, for evaluation. The results are shown in the **Table 1 of the supplementary pdf**. The findings continue to support our discoveries on MNIST and CIFAR10, namely:
1) All SSM structures exhibit a significant drop in CA after AT, highlighting **the Robustness-Generalization Trade-Off present in SSM structures**.
2) Even the Data-Dependent Mamba model did not show a significant performance improvement compared to Data-Independent SSM structures like S4 and DSS after AT, indicating that **pure SSM structures struggle to benefit from adversarial training**.
3) **Although the incorporation of the attention mechanism has a positive effect on improving the model's CA and RA, our experiments on Tiny Imagenet also revealed potential RO issues it may bring**. For instance, the Mega model showed a significant drop in RA (8.56%) after PGD-AT, indicating noticeable RO in AT. 
4) More importantly, **the addition of AdS still led to improvements in CA and RA for Data-Independent SSMs S4 and DSS on Tiny Imagenet, supporting the effectiveness of our AdS design**.

Appreciate the reviewer once again for the valuable suggestions, and we believe this will further enrich the experimental evaluation of our paper and enhance its quality.

**Response to W2**:

We appreciate the constructive suggestions from the reviewer. **The purpose of this work is not to propose an AT strategy but to evaluate the AR of various SSM structures, analyze the component factors affecting SSM's benefit from AT, and guide the construction of corrective strategies**. Of course, incorporating more AT frameworks would help to refine the assessment of this work. Following the reviewer's suggestions, we introduced FreeAT[1] and YOPO[2], two more efficient AT frameworks, and conducted experiments on MNIST, CIFAR10, and Tiny ImageNet, with results shown in **Table 2 of the supplementary pdf**. The conclusions remain similar to our findings with PGD-AT and TRADES:
1) SSM structures under the FreeAT and YOPO AT frameworks also exhibit a decline in CA, **reflecting a clear trade-off between robustness and generalization**, especially on the CIFAR10 and Tiny Imagenet datasets, where this Trade-Off is more pronounced.
2) **Under the FreeAT and YOPO frameworks, pure SSM structures still struggle to benefit in terms of RA**. This result is consistent with our previous observations using PGD-AT and TRADES, indicating that these AT frameworks may not be optimized for SSM structures, or SSM structures themselves find it difficult to achieve effective robustness under these frameworks. Moreover, on the MNIST dataset, we noticed that all models had difficulty converging under the YOPO framework, which may suggest that certain characteristics of the YOPO framework are not fully compatible with the sequential image classification tasks of SSM structures. This finding indicates that the design of AT frameworks needs to consider the match between model structure and data characteristics more delicately.
3) Although the Mega model, which introduced an attention mechanism, showed higher CA and RA under the FreeAT and YOPO frameworks, its final RA decline compared to the best RA is also more significant, still **revealing the RO issues brought about by the introduction of the Attention mechanism**.
4) **When applying our AdS strategy under the FreeAT and YOPO frameworks, Data-Dependent SSMs S4 and DSS showed consistent improvements in both CA and RA**. This result further confirms the effectiveness and universality of the AdS strategy across different adversarial training frameworks.

Thanks to the reviewer once again for the valuable suggestions, which are of great significance in enhancing the quality of our paper.

[1] Adversarial Training for Free. NeurIPS 2019.

[2] You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle. NeurIPS 2019.
**Response to W1**:

Really appreciate the valuable feedback from the reviewer. To facilitate a more comprehensive assessment, we conducted evaluations on the tiny imagenet dataset, which has more classes and larger image sizes. The results, as shown in **Table 1 of the supplementary pdf**, are consistent with the conclusions observed on MNIST and CIFAR-10. Namely:
1) There is a clear Robustness-Generalization Trade-Off in SSMs. After AT, the CA of all SSM structures has significantly decreased. Particularly, the DSS showed a notably sharp decline in CA after PGD-AT, exceeding 10%, which significantly indicates the presence of a Robustness-Generalization Trade-Off.
2) Even the Data-Dependent SSM Mamba did not exhibit better robustness gains after AT compared to Data-Independent SSMs like S4 and DSS. This suggests that pure SSM structures struggle to benefit from AT.
3) While the introduction of the attention mechanism can improve the model's CA and RA, it also introduces the risk of RO issues. For instance, the Mega model showed an 8.56% decrease in final RA after PGD-AT compared to the best RA, which clearly indicates the existence of RO issues. 

We appreciate the constructive feedback from the reviewer once again. 

**Response to W2**:

Very greatful for the constructive suggestions from the reviewer. In the revised version, we will report the results w/o AdS from Table 1 again in Table 2. Appreciate the reviewer's suggestions once again.

**Response to W3**:

Greatly appreciate the insightful comments from the reviewer. According to Theorem 1, when the eigenvalues of the state matrix $A$ are too large or too small, they can both lead to error accumulation during the state space transition: larger eigenvalues can increase the lower bound of the error, while smaller eigenvalues limit the model's expressive ability (for example, if the absolute value of the largest eigenvalue of $A$ is still close to 0, then the state transition will hardly preserve any sequence features). The sigmoid and tanh activations only have a shrinking regulatory effect, that is, when large eigenvalues of $A$ lead to excessive output errors, the use of AdS with Sigmoid or Tanh activation can reduce the error, but they do not have an amplifying function, so they are relatively limited in expressive power. On the other hand, AdS with ReLU activation has both shrinking and amplifying functions, thus it can achieve error reduction and alleviate the limitation of expressive power caused by small eigenvalues of $A$. We believe the above response addresses your concerns.

**Response to Q1**:

Greatful for the valuable question from the reviewer. Following the reviewer's suggestion, we have tested the performance of AdS on the larger dataset Tiny Imagenet, with the results also reported in **Table 1 of the supplementary pdf**. Specifically, even on the larger dataset, our AdS continues to provide universal improvements in CA and RA for Data-Dependent SSMs S4 and DSS. 

We appreciate the reviewer's suggestions once again, and we believe this will significantly enhancing the quality of our paper.


**Response to Q2**:

We appreciate the insightful questions from the reviewer. In this work, our aim is to explore the adversarial robustness of SSMs, to analyze the performance of SSMs in AT, to investigate the role of various SSM components in AT, and to provide further improvement measures based on the analysis.
Specifically, by conducting a comprehensive comparison of the performance of various SSMs under AT, we:
1) First revealed the Robustness-Generalization Trade-Off in SSMs.
2) Further theoretical and experimental analysis explained why pure SSMs struggle to benefit from AT: the model's inherent state transition form leads to error accumulation, and the introduced attention mechanism plays a role in rescaling, thereby helping to mitigate errors introduced by perturbations.
3) Inspired by the above valuable conclusions and analysis, we considered introducing a low-complexity rescaling mechanism and proposed AdS. Further experiments on multiple datasets also demonstrated the universality and effectiveness of AdS.
Therefore, the AdS we propose is not just a simple attempt; it is based on rigorous experiments and analysis.
We believe that these findings and designs will provide insights for constructing more robust SSMs. However, the focus of this work is to explore the AR of SSMs and to analyze and provide improvement mechanisms, rather than proposing a new model structure. Of course, we think it could indeed help in designing new SSM architectures, but it requires 1) more refined design, including considering how to implicitly incorporate the idea of AdS into the SSM training framework (e.g. regularizing the state matrix with singular values) 2) extensive evaluation, including whether it can bring improvements to various vision and language tasks. 

We would express our gratitude to the reviewer once again for the valuable questions.
**Response to W1**: 

Really appreciate the insightful comments from the reviewer. To ensure a fair evaluation, RO should be assessed under the same attack strategy, so we primarily judge RO based on RA on PGD-10. Our "Best" checkpoint is determined by the RA under PGD attacks. This aligns with the standard settings for exploring RO issues [1][2]. However, AA is a completely different attack strategy from PGD-10, making the "Diff" metric on AA inadequate for effectively measuring RO. 

We believe the above response will satisfactorily resolve the reviewer's questions.

**Response to W2**: 

Greatly appreciate the insightful comments from the reviewer. To conduct a more comprehensive evaluation, we have performed ST and AT on various SSMs using the Tiny-Imagenet dataset, which offers more classes and larger image sizes. The results, as shown in **Table 1 of the supplementary pdf**, are consistent with the conclusions observed on MNIST and CIFAR10. Namely:
1)  All SSM structures experienced a decrease in CA on undisturbed data after AT. Notably, the DSS saw a CA drop of over 10% after PGD-AT, revealing a clear trade-off between robustness and generalization capabilities.
2) Even Data-Dependent SSMs like Mamba did not demonstrate a significant robustness improvement after AT compared to Data-Independent SSMs such as S4 and DSS. This indicates that pure SSM structures struggle to benefit from AT.
3) Incorporating attention mechanisms did indeed significantly enhance the model's CA and RA, but it also introduced RO issues. For example, the final RA of the Mega model decreased by 8.56% after PGD-AT compared to its optimal RA.
4) By integrating our AdS strategy, we were still able to universally improve the CA and RA for Data-Independent SSMs like S4 and DSS.

We are grateful once again for the reviewer's insightful suggestions.

**Response to W3**: 

We appreciate the insightful suggestions from the reviewer. The focus of this paper is to investigate the AR of SSMs based on their inherent structure and properties. To align with the research motivation of this paper, we have primarily conducted adversarial attack experiments on SSMs and their variants, and inspired by the experimental conclusions and theoretical analysis, we have designed mechanisms to enhance the robustness of SSMs. Therefore, we did not include baselines for CNNs and Transformers in the manuscript. Additionally, unlike traditional convolutional models such as ResNet that consider 2-D image classification, our setting is for sequential image classification, which precludes 2-D image classification CNNs from our comparison.

Considering the aforementioned factors and the valuable input from the reviewer, we will include a set of experiments using Transformers for sequential image classification as a baseline in the revised version, to help readers better understand the performance of SSMs as sequence models. Thank the reviewer once again for the valuable suggestions.

**Response to Q1**: 

Grateful for the insightful questions from the reviewer. We adopted the standard AT experimental setup, aligning with the configurations in [3][4]. In fact, we have experimented with adjusting the training hyperparameters (including learning rate, weight decay coefficient, etc.) but this did not alter the results. Since PGD-AT uses adversarial samples generated solely by PGD for AT, this could lead to overfitting to the distribution of adversarial samples produced by PGD, resulting in a significant decrease in RA against other attack strategies (such as AA), or even ineffectiveness. Similar experimental phenomena and conclusions are also found in [5]. We believe our response has adequately addressed your concerns.

**Response to Q2**:

We appreciate the valuable questions from the reviewer. Exploring the robustness of SSM across different scales of width and depth is an excellent question. As the focus of this work is to understand the behavior of SSM in AT from its inherent structure and to conduct an attribution analysis based on the impact of various SSM components, we have not considered the aspects of SSM width and depth. However, based on the theorems and experimental results of the paper, we also have some intuitive speculations: the error accumulation during the forward process of SSM, and due to the error accumulation effect of SSM, an increase in depth might actually constrain the robust generalization capability of SSM. We appreciate the insightful questions from the reviewer once again.

[1] Overfitting in adversarially robust deep learning.

[2] Exploring memorization in adversarial training.  

[3] Theoretically Principled Trade-off between Robustness and Accuracy.

[4] Single-step Adversarial training with Dropout Scheduling. 

[5] Adversarial Training and Robustness for Multiple Perturbations.