Paper: DataFreeShield: Defending Adversarial Attacks without Training Data (ICLR-2024)

Reviewer comment (Reproducibility):
It is not clear how you synthesize the samples. Especially, how can you adopt Eq (8) to generate the samples?

Author response:
$\to$ In essence, random Gaussian noise is fed to a pretrained teacher, and its output/intermediate values are used to compute the loss terms in Eq (8). Then, the computed loss is backpropagated with respect to the input noise, where the pixels are updated using Adam optimizer. Please also see the red arrows depicted in figure2, and the pseudocode in section B of the appendix for more details.

Reviewer comment (Experiments):
Apart from adversarial training, there are also some defense techniques which does not need training data. For instance, random transforms the input data before feeding them into the model [1]. Also, I am curious if the purifier trained on open datasets, such as ImageNet, can effectively eliminate the adversarial perturbation. There might be other ways that do not need training data to defend against adversarial attacks.

Author response:
$\to$ It is important to note that while different adversarial defense techniques have been suggested in the past, only adversarial training(AT) and its variants have survived. Others have been shown to be ineffective or weak, often unable to defend against strong attacks. For example, multiple quantization and randomization techniques have been proposed as viable defense methods, but were quickly deprived of their efficacy and found to be a false sense of defense that can easily be circumvented [1]. For now, AT has become the dominant approach that is shown to be most effective. Thus we adopt the same AT approach in our problem. 
To support our argument, we provide comparison against test time defense methods, DAD and TTE, in the table below. Notice how they are not competitive against ours in all cases. We will add the following results to Table2 in the revised manuscript.

| Dataset | Method | Clean(%) | PGD(%) | AutoAttack(%) |
|:-------:|:------:|:--------:|:------:|:-------------:|
|  Tissue |   DAD  |    53.90 |   3.53 |          3.12 |
|         |   TTE  |    67.23 |   8.34 |          7.22 |
|         |  **Ours**  |    32.07 |  31.93 |         31.83 |
|  Blood  |   DAD  |    81.18 |   6.40 |          6.05 |
|         |   TTE  |    95.79 |   9.09 |          9.09 |
|         |  **Ours**  |    49.34 |  19.24 |         18.77 |
|  Derma  |   DAD  |    67.53 |  11.02 |          6.98 |
|         |   TTE  |    74.21 |  18.15 |         23.54 |
|         |  **Ours**  |    66.98 |  66.83 |         66.63 |
|  OrganC |   DAD  |    72.87 |  38.46 |         34.62 |
|         |   TTE  |    87.76 |  36.05 |         35.90 |
|         |  **Ours**  |    76.89 |  46.92 |         45.18 |

[1] Athalye, Anish, Nicholas Carlini, and David Wagner. "Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples." International conference on machine learning, 2018.

Reviewer comment (Theory):
The explanation of the gradient refinement strategy seems rushed. The authors say that targeting a smoother loss landscape will make it more likely that there is alignment between minima achieved using real and synthetic data. Then, the authors describe the design of their gradient refinement strategy. There is no connection presented between the initial idea (smoother loss landscape) and the proposed method to implement/enforce said idea (gradient refinement). As a result, it is not clear how the gradient refinement strategy will lead to smoother loss landscape.

Author response:
$\to$  The two methods essentially hold the same objective, but achieves it in a distinct way. Their ultimate goal is to learn adversarial robustness from synthetic samples that can be applied to real attacks. The third term in the training loss penalizes the model when it is highly sensitive to small perturbations. Implicitly, this would make the model favor a set of parameters that have a smoother loss surface with respect to the input. On the other hand, the gradient refinement method explicitly ignores gradients of parameters that are highly fluctuating, pushing the model towards a smoother loss landscape where loss does not fluctuate with small changes in the parameters. The ablation study in Table7 shows that improvement from both the loss term and the gradient refinement method are distinct and best when used together.

Reviewer comment (Theory):
There is already a term in the training objective (3rd term) that enforces smoother loss landscape. Then, how does the gradient refinement strategy and the third loss term differ in what they are trying to achieve? The distinction between the two is not clear.

Author response:
$\to$  The two methods essentially hold the same objective, but achieves it in a distinct way. Their ultimate goal is to learn adversarial robustness from synthetic samples that can be applied to real attacks. The third term in the training loss penalizes the model when it is highly sensitive to small perturbations. Implicitly, this would make the model favor a set of parameters that have a smoother loss surface with respect to the input. On the other hand, the gradient refinement method explicitly ignores gradients of parameters that are highly fluctuating, pushing the model towards a smoother loss landscape where loss does not fluctuate with small changes in the parameters. The ablation study in Table7 shows that improvement from both the loss term and the gradient refinement method are distinct and best when used together.

Reviewer comment (Evaluation):
There are several glaring issues in Table 3, that makes it hard to trust the numbers presented in this table.  
a. SVHN/DFARD/ResNet-20: A_pgd (weaker attack) is lower than A_aa (stronger attack)  
b. SVHN/DaST/ResNet-50: A_pgd is lower than A_aa  
c. Cifar10/DFARD/WRN28-10: A_clean is lower than A_pgd

Author response:
$\to$ a & c: are possible outcomes of synthetic data training, and possible signs of gradient obfuscation[1]. The signs of gradient obfuscation include increasing attack strength not necessarily leading to better attack success rate, which is what we can observe from Table 3. We agree the phenomenon is rarely observed in real-data adversarial training, where the train dataset is reliable and does not contain any outliers in terms of distribution or quality. However, all the baseline methods are data-free (See Appendix A.4 for explanation on baseline methods and how we adapt them to our problem), and use synthetic data for training. Learning from these data is tricky and adding adversarial perturbation only makes it harder. Thus, the model often diverges, or simply learns to circumvent gradient-based attacks in an unintended way. 

$\to$ b: We found that for SVHN ResNet56 DaST, there has been an error, where 20.20 was written as 0.20. We apologize for the mistake and causing confusion to the reviewers.

[1] Athalye, Anish, Nicholas Carlini, and David Wagner. "Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples." International conference on machine learning, 2018.

Reviewer comment (Novelty):
The authors claim that their work is the "first data-free adversarial defense". This is clearly not true as one of the papers that authors cite (Nayak, 2022) proposes a similar method, i.e., DAD. The authors acknowledge that the only difference between their method and DAD is that DAD assumes availability of an auxiliary dataset which is from the same domain as the training dataset of the target model. Irrespective, DAD does not require access to the original dataset, making it a data-free defense.

Author response:
$\to$ We respectfully argue that both DAD and TTE are not ‘data-free’ for the following reasons. DAD heavily relies on the existence of similar dataset (which we think is already not data-free), and it also uses the **original test data** to tune their model, which is a far extreme assumption and could be regarded as data leak. Also, it is difficult to view TTE as “data-free” because they propose TTE as an enhancement method applied to already robust models trained using the original data. 

Despite the unfairness, we compare DAD and TTE with ours. DAD does not perform well and there exists a large performance gap to ours in all cases. Note that DAD is evaluated on the same test set that is used to finetune/adapt the detector module, and yet shows poor results. While TTE is advantageous in preserving clean accuracy, the overall robust accuracy is low and not comparable to ours. Both approaches do not directly train the target model, which makes it vulnerable to gradient-based attacks. Thus, comparison against test time defense methods only enhances our assertion that existing methods are insufficient to guarantee robustness when the train data is unavailable.

We used the official code provided by the authors. For DAD, we follow their method and retrain a Cifar-10 pretrained detector on MedMNIST-v2 test set. For TTE, where we used +flip+4crops+4 flipped-crops as it is reported as the best setting in the original paper. We will add this comparison to Table 2  in the revision.

| Dataset | Method | Clean(%) | PGD(%) | AutoAttack(%) |
|:-------:|:------:|:--------:|:------:|:-------------:|
|  Tissue |   DAD  |    53.90 |   3.53 |          3.12 |
|         |   TTE  |    67.23 |   8.34 |          7.22 |
|         |  **Ours**  |    32.07 |  31.93 |         31.83 |
|  Blood  |   DAD  |    81.18 |   6.40 |          6.05 |
|         |   TTE  |    95.79 |   9.09 |          9.09 |
|         |  **Ours**  |    49.34 |  19.24 |         18.77 |
|  Derma  |   DAD  |    67.53 |  11.02 |          6.98 |
|         |   TTE  |    74.21 |  18.15 |         23.54 |
|         |  **Ours**  |    66.98 |  66.83 |         66.63 |
|  OrganC |   DAD  |    72.87 |  38.46 |         34.62 |
|         |   TTE  |    87.76 |  36.05 |         35.90 |
|         |  **Ours**  |    76.89 |  46.92 |         45.18 |

Reviewer comment (Experiments):
Continuing from the previous point, authors do not compare their method with DAD. I understand the benefit of adapting other data-free methods to the adversarial training regime and comparing against them. But this is not more useful than comparing against a method that already tackles the exact same problem as the one studied in this paper (i.e., no adaptation needed). This comparison is crucial for the paper.

Author response:
$\to$ We respectfully argue that both DAD and TTE are not ‘data-free’ for the following reasons. DAD heavily relies on the existence of similar dataset (which we think is already not data-free), and it also uses the **original test data** to tune their model, which is a far extreme assumption and could be regarded as data leak. Also, it is difficult to view TTE as “data-free” because they propose TTE as an enhancement method applied to already robust models trained using the original data. 

Despite the unfairness, we compare DAD and TTE with ours. DAD does not perform well and there exists a large performance gap to ours in all cases. Note that DAD is evaluated on the same test set that is used to finetune/adapt the detector module, and yet shows poor results. While TTE is advantageous in preserving clean accuracy, the overall robust accuracy is low and not comparable to ours. Both approaches do not directly train the target model, which makes it vulnerable to gradient-based attacks. Thus, comparison against test time defense methods only enhances our assertion that existing methods are insufficient to guarantee robustness when the train data is unavailable.

We used the official code provided by the authors. For DAD, we follow their method and retrain a Cifar-10 pretrained detector on MedMNIST-v2 test set. For TTE, where we used +flip+4crops+4 flipped-crops as it is reported as the best setting in the original paper. We will add this comparison to Table 2  in the revision.

| Dataset | Method | Clean(%) | PGD(%) | AutoAttack(%) |
|:-------:|:------:|:--------:|:------:|:-------------:|
|  Tissue |   DAD  |    53.90 |   3.53 |          3.12 |
|         |   TTE  |    67.23 |   8.34 |          7.22 |
|         |  **Ours**  |    32.07 |  31.93 |         31.83 |
|  Blood  |   DAD  |    81.18 |   6.40 |          6.05 |
|         |   TTE  |    95.79 |   9.09 |          9.09 |
|         |  **Ours**  |    49.34 |  19.24 |         18.77 |
|  Derma  |   DAD  |    67.53 |  11.02 |          6.98 |
|         |   TTE  |    74.21 |  18.15 |         23.54 |
|         |  **Ours**  |    66.98 |  66.83 |         66.63 |
|  OrganC |   DAD  |    72.87 |  38.46 |         34.62 |
|         |   TTE  |    87.76 |  36.05 |         35.90 |
|         |  **Ours**  |    76.89 |  46.92 |         45.18 |

Reviewer comment (Evaluation):
Authors do not properly explore adaptive attacks. If a defense flattens/smoothens the loss landscape, it makes gradient-based attacks harder to converge (and as result, less effective). AutoAttack circumvents this issue to some extent by including a black-box attack, but this is not enough to establish the true robustness of such defenses in my opinion. Using a latent space attack [a] that doesn't rely on the (flattened) outputs of the final layer will be a more effective attack than something like PGD.

Author response:
$\to$ Our method is effective against adaptive attacks as well. As the table below shows, none of the adaptive attack methods were stronger than PGD(CE) and AutoAttack. As far as we know, showing robust accuracy under PGD(CE) and AutoAttack are considered de facto standard to demonstrate method’s robustness [1-5]. 
As the reviewer requested, we compared latent space attack [6] and three different combinations of the training loss. Notice that none of the adaptive attack methods fare against AutoAttack and PGD.

|  Dataset |   Model   | Clean | PGD(CE(S(x'),y) | AutoAttack | latent [6] | PGD(KL(S(x')\|\|S(x)) | PGD(KL(S(x')\|\|T(x)) | PGD(KL(S(x')\|\|T(x)) + KL(S(x')\|\|S(x))) |
|:--------:|:---------:|:-----:|-----------------|------------|--------|-----------------------|-----------------------|--------------------------------------------|
|   SVHN   | ResNet-20 | 91.83 | 54.82           | 47.55      | 74.38  | 71.95                 | 55.84                 | 55.24                                      |
|          | ResNet-56 | 88.66 | 62.05           | 57.54      | 77.99  | 77.04                 | 62.95                 | 62.58                                      |
|          | WRN28-10  | 94.14 | 69.60           | 62.66      | 87.68  | 81.39                 | 70.64                 | 70.08                                      |
| Cifar-10 | ResNet-20 | 74.79 | 29.29           | 22.65      | 65.63  | 54.64                 | 31.05                 | 30.46                                      |
|          | ResNet-56 | 81.30 | 35.55           | 30.51      | 67.73  | 60.61                 | 36.94                 | 36.43                                      |
|          | WRN28-10  | 86.74 | 51.13           | 43.73      | 79.38  | 70.40                 | 51.82                 | 51.21                                      |

| Dataset |   Model   | Clean | PGD(CE(S(x'),y) | AutoAttack | latent [6] | PGD(KL(S(x')\|\|T(x)) | PGD(KL(S(x')\|\|S(x)) | PGD(KL(S(x')\|\|T(x)) + KL(S(x')\|\|S(x))) |
|:-------:|:---------:|:-----:|-----------------|------------|-------------|-----------------------|-----------------------|--------------------------------------------|
|  Tissue | ResNet-18 | 32.07 | 31.93           | 31.83      | 32.07       | 31.98                 | 31.95                 | 31.95                                      |
|  Blood  |           | 49.34 | 19.24           | 18.77      | 20.32       | 29.87                 | 24.70                 | 24.12                                      |
| Derma   |           | 66.98 | 66.83           | 66.63      | 66.98       | 66.53                 | 66.98                 | 66.93                                      |
| OrganC  |           | 76.89 | 46.92           | 45.18      | 76.60       | 65.47                 | 48.40                 | 48.10                                      |

For [6], we followed the original implementation, and used output from the penultimate layer (before flattening), L-BFGS for attack optimization with $\epsilon$=10/255 for perturbation bound. 

[1] Wang, Zekai, et al. "Better diffusion models further improve adversarial training." International Conference on Machine Learning, 2023.    
[2] Xu, Yuancheng, et al. "Exploring and Exploiting Decision Boundary Dynamics for Adversarial Robustness." International Conference on Learning Representations, 2023.     
[3] Gowal, Sven, et al. "Improving robustness using generated data." Advances in Neural Information Processing Systems, 2021.     
[4] Pang, Tianyu, et al. "Bag of Tricks for Adversarial Training." International Conference on Learning Representations, 2020.     
[5] Sehwag, Vikash, et al. "Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?." International Conference on Learning Representations. 2021.    
[6] Sabour, S., Cao, Y., Faghri, F., and Fleet, D. J. Adversarial manipulation of deep representations. International Conference on Learning Representations, 2016.

Reviewer comment (Experiments):
Continuing my point regarding adaptive attacks, there are no results using an attack that targets all the loss terms used during training collectively. Based on my understanding, the authors perform attacks using the cross-entropy loss only. Performing an exploration regarding how the attack effectiveness changes using different combinations of the training loss terms is important in terms of developing an adaptive attack.

Author response:
$\to$ Our method is effective against adaptive attacks as well. As the table below shows, none of the adaptive attack methods were stronger than PGD(CE) and AutoAttack. As far as we know, showing robust accuracy under PGD(CE) and AutoAttack are considered de facto standard to demonstrate method’s robustness [1-5]. 
As the reviewer requested, we compared latent space attack [6] and three different combinations of the training loss. Notice that none of the adaptive attack methods fare against AutoAttack and PGD.

|  Dataset |   Model   | Clean | PGD(CE(S(x'),y) | AutoAttack | latent [6] | PGD(KL(S(x')\|\|S(x)) | PGD(KL(S(x')\|\|T(x)) | PGD(KL(S(x')\|\|T(x)) + KL(S(x')\|\|S(x))) |
|:--------:|:---------:|:-----:|-----------------|------------|--------|-----------------------|-----------------------|--------------------------------------------|
|   SVHN   | ResNet-20 | 91.83 | 54.82           | 47.55      | 74.38  | 71.95                 | 55.84                 | 55.24                                      |
|          | ResNet-56 | 88.66 | 62.05           | 57.54      | 77.99  | 77.04                 | 62.95                 | 62.58                                      |
|          | WRN28-10  | 94.14 | 69.60           | 62.66      | 87.68  | 81.39                 | 70.64                 | 70.08                                      |
| Cifar-10 | ResNet-20 | 74.79 | 29.29           | 22.65      | 65.63  | 54.64                 | 31.05                 | 30.46                                      |
|          | ResNet-56 | 81.30 | 35.55           | 30.51      | 67.73  | 60.61                 | 36.94                 | 36.43                                      |
|          | WRN28-10  | 86.74 | 51.13           | 43.73      | 79.38  | 70.40                 | 51.82                 | 51.21                                      |

| Dataset |   Model   | Clean | PGD(CE(S(x'),y) | AutoAttack | latent [6] | PGD(KL(S(x')\|\|T(x)) | PGD(KL(S(x')\|\|S(x)) | PGD(KL(S(x')\|\|T(x)) + KL(S(x')\|\|S(x))) |
|:-------:|:---------:|:-----:|-----------------|------------|-------------|-----------------------|-----------------------|--------------------------------------------|
|  Tissue | ResNet-18 | 32.07 | 31.93           | 31.83      | 32.07       | 31.98                 | 31.95                 | 31.95                                      |
|  Blood  |           | 49.34 | 19.24           | 18.77      | 20.32       | 29.87                 | 24.70                 | 24.12                                      |
| Derma   |           | 66.98 | 66.83           | 66.63      | 66.98       | 66.53                 | 66.98                 | 66.93                                      |
| OrganC  |           | 76.89 | 46.92           | 45.18      | 76.60       | 65.47                 | 48.40                 | 48.10                                      |

For [6], we followed the original implementation, and used output from the penultimate layer (before flattening), L-BFGS for attack optimization with $\epsilon$=10/255 for perturbation bound. 

[1] Wang, Zekai, et al. "Better diffusion models further improve adversarial training." International Conference on Machine Learning, 2023.    
[2] Xu, Yuancheng, et al. "Exploring and Exploiting Decision Boundary Dynamics for Adversarial Robustness." International Conference on Learning Representations, 2023.     
[3] Gowal, Sven, et al. "Improving robustness using generated data." Advances in Neural Information Processing Systems, 2021.     
[4] Pang, Tianyu, et al. "Bag of Tricks for Adversarial Training." International Conference on Learning Representations, 2020.     
[5] Sehwag, Vikash, et al. "Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?." International Conference on Learning Representations. 2021.    
[6] Sabour, S., Cao, Y., Faghri, F., and Fleet, D. J. Adversarial manipulation of deep representations. International Conference on Learning Representations, 2016.

Reviewer comment (Evaluation):
Although this setup is interesting, we have doubts about its actual performance. Compared with the adversarial training model, the adversarial robustness obtained in Table 3 is very low and difficult to use in practice. Especially on CIFAR100, the robust accuracy of ResNet-20 under AA is only 5.97, and the clean accuracy is significantly lower than the normal model (60%+).

Author response:
$\to$ We respectfully disagree with the reviewer’s comment on the amount of robustness and the practicality of the proposal. The reviewer compares our results against the conventional approach where the original train set is available. We gently remind the reviewer that the purpose of studying this particular setup is not to propose data-free approach’s superiority against data-driven ones, but to provide an alternative solution when none is available. (And currently, there is no known solution to make a neural network robust without using the original dataset.) 
We provide a few examples from other tasks to show that data-free methods have an inevitable gap with data-driven ones. For knowledge distillation, data-free approach[1] compares up to -10% to the data-driven one by Hinton[6]. This gap is larger for quantization, where data-free approaches show degradation up to -42.67% compared to data-driven quantization work[7] of the same year. 

**Table 1 : Data-free vs Data-driven in Knowledge Distillation**
| | | |  Data-driven | Data-free | |
|-----------|--------------|-------------|-------------|--------|---|
| **Dataset** | **Model**| **Teacher Acc.** | **KD (2015)** | **ZSKD (2019)** | **Perf. Gap** |
| CIFAR-10 | AlexNet | 83.03 | 80.08 | 69.56 | ***-10.52*** |


**Table 2 : Data-free vs Data-driven in 4-bit Quantization**
|             |           |                  | Data-driven         | Data-free      |                  |                 |
|-------------|-----------|------------------|---------------------|----------------|------------------|-----------------|
| **Dataset** | **Model** | **Teacher Acc.** | **Adaround (2020)** | **DFQ (2019)** | **ZeroQ (2020)** | **GDFQ (2020)** |
| ImageNet    | ResNet-18 | 69.68            | 68.71               | 38.98          | 26.04            | 60.60           |
|             |           |                  | **Perf. Gap**       | ***-29.73***   | ***-42.67***     | ***-8.11***     |



[1] Nayak, G.K. et al. "Zero-Shot Knowledge Distillation in Deep Networks. In International Conference on Machine Learning, 2019.     
[2] Chen, H. et al. DAFL:Data-Free Learning of Student Networks. In Proceedings of the IEEE International Conference on Computer Vision, 2019.     
[3] Nagel, M. et al. Data-free quantization through weight equalization and bias correction. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 2019.      
[4] Cai, Y. et al. ZeroQ: A novel zero shot quantization framework. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020.      
[5] Xu, S. et al. Generative low- bitwidth data free quantization. In European Conference on Computer Vision, 2020.     
[6] Hinton, G. et al. Distilling the Knowledge in a Neural Network. In Advances in Neural Information Processing Systems, Deep Learning Workshop, 2015.     
[7] Nagel, M. et al. Up or Down? Adaptive Rounding for Post-Training Quantization. In International Conference on Machine Learning, 2020.

Reviewer comment (Evaluation):
Please analyze the time complexity of the compared methods, which is important for practical applications.

Author response:
$\to$ Time complexity for our method is O(N*(F+B)) for data synthesis and another O(N*(F+B)) for student training. The baseline methods take O(N*(Fg+Bg+F+B)) and O(Fg+F+B) for data synthesis and student training, respectively. We have omitted the number of iterations for each process for clarity.
Let F,B denote time complexity for each forward and backward computation. In our method, data synthesis requires additional forward and backward computation for optimizing each batch of pixels. Using the same notations, the baseline methods take N*(Fg+Bg+F+B) where Fg and Bg denote forward and backward computation to train the generator. Each generator update requires forward and backward computation of the teacher model, hence (Fg+Bg+F+B). Then, (Fg+F+B) is required to generate the samples, and train the student model. 
We also report wall clock time in Appendix A.2, where our method takes 0.6 hrs on ResNet-20, 2.6 hrs on ResNet-56, and 3.6 hrs on WRN28-10. The compared methods (DaST, DFME, AIT, DFARD) take 1.5hrs using ResNet-20, 2.75hrs using ResNet-56, and 10hrs using WRN28-10 on RTX3090 under the same environment. The time is measured for generating 10000 synthetic samples on a single GPU.

Reviewer comment (Theory):
How to extract robust knowledge from clean images is not clearly expressed in this paper. The adversarial robustness of previous work relies on pre-trained robust models, but why can adversarial robustness be obtained using only loss constraints? If this is the case, can it be used in any adversarial training? We believe that this section needs to be described in detail.

Author response:
$\to$ In our method we do not extract robust knowledge from clean images. Instead, we extract knowledge from a pretrained teacher to generate synthetic samples, which are then used in adversarial training. To be specific, we use a pretrained network as guidance to optimize pixels from random Gaussian noise to image-like distributions. First, a set of random Gaussian noise is forwarded through the teacher network. Then, a set of optimization terms is computed using its output and/or intermediate features and statistics. Lastly, the computed loss is backpropagated all the way up to the input, where the gradient is used to update each pixel using Adam optimizer. Then, the generated samples are used in adversarial training. 

> **If this is the case, can it be used in any confrontation training?**

$\to$ Yes. As shown in Table 6 of the main manuscript, the set of generated images can be used in any adversarial training methods that require a set of input images.  (Is ‘confrontation’ referring to adversarial? If not, please clarify the meaning of “confrontation”.) The table shows results for using different variations of adversarial training methods with our generated images.

Reviewer comment (Experiments):
What is the relationship between adversarial robustness and the amount of generated data?

Author response:
$\to$ As described in Appendix C, adding more generated training samples increases the robust accuracy, but saturates at some point (5-60,000 samples for CIFAR-10), where further increment in data size does not lead to meaningful performance boost. We have the sample quantity-accuracy plot in Appendix C for the suggested study. Thank you!