Original: I MPROVING H IERARCHICAL A DVERSARIAL R OBUSTNESS OF D EEP N EURAL N ETWORKS
Revised: I MPROVING H IERARCHICAL A DVERSARIAL R OBUSTNESS OF D EEP N EURAL N ETWORKS

Original: Anonymous authors
Revised: Anonymous authors

Original: Paper under double-blind review
Revised: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: Do all adversarial examples have the same consequences?
Revised: Do all adversarial examples have the same consequences?

Original: An autonomous driving system misclassifying a pedestrian as a car may induce a far more dangerous —and even potentially lethal—behavior than, for instance, a car as a bus.
Revised: An autonomous driving system misclassifying a pedestrian as a car may induce a far more dangerous —and even potentially lethal—behavior than, for instance, a car as a bus.

Original: In order to better tackle this important problematic, we introduce the concept of hierarchical adversarial robustness.
Revised: In order to better tackle this important problematic, we introduce the concept of hierarchical adversarial robustness.

Original: Given a dataset whose classes can be grouped into coarse-level labels, we deﬁne hierarchical adversarial examples as the ones leading to a misclassiﬁcation at the coarse level.
Revised: Given a dataset whose classes can be grouped into coarse-level labels, we deﬁne hierarchical adversarial examples as the ones leading to a misclassiﬁcation at the coarse level.

Original: To improve the resistance of neural networks to hierarchical attacks, we introduce a hierarchical adversarially robust (HAR) network design that decomposes a single classiﬁcation task into one coarse and multiple ﬁne classiﬁcation tasks, before being speciﬁcally trained by adversarial defense techniques.
Revised: To improve the resistance of neural networks to hierarchical attacks, we introduce a hierarchical adversarially robust (HAR) network design that decomposes a single classiﬁcation task into one coarse and multiple ﬁne classiﬁcation tasks, before being speciﬁcally trained by adversarial defense techniques.

Original: As an alternative to an end-to-end learning approach, we show that HAR signiﬁcantly improves the robustness of the network against (cid:96) 2 and (cid:96) ∞ bounded hierarchical attacks on the CIFAR-100 dataset.
Revised: As an alternative to an end-to-end learning approach, we show that HAR signiﬁcantly improves the robustness of the network against (cid:96) 2 and (cid:96) ∞ bounded hierarchical attacks on the CIFAR-100 dataset.

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Deep neural networks (DNNs) are highly vulnerable to attacks based on small modiﬁcation of the input to the network at test time (Szegedy et al., 2013).
Revised: Deep neural networks (DNNs) are highly vulnerable to attacks based on small modiﬁcation of the input to the network at test time (Szegedy et al., 2013).

Original: Those adversarial perturbations are carefully crafted in a way that they are imperceptible to human observers, but when added to clean images, can severely degrade the accuracy of the neural network classiﬁer.
Revised: Those adversarial perturbations are carefully crafted in a way that they are imperceptible to human observers, but when added to clean images, can severely degrade the accuracy of the neural network classiﬁer.

Original: Since their discovery, there has been a vast literature proposing various attack and defence techniques for the adversarial settings (Szegedy et al., 2013; Goodfellow et al., 2014; Kurakin et al., 2016; Madry et al., 2017; Wong et al., 2020).
Revised: Since their discovery, there has been a vast literature proposing various attack and defence techniques for the adversarial settings (Szegedy et al., 2013; Goodfellow et al., 2014; Kurakin et al., 2016; Madry et al., 2017; Wong et al., 2020).

Original: These methods constitute important ﬁrst steps in studying adversarial robustness of neural networks.
Revised: These methods constitute important ﬁrst steps in studying adversarial robustness of neural networks.

Original: However, there exists a fundamental ﬂaw in the way we assess a defence or an attack mechanism.
Revised: However, there exists a fundamental ﬂaw in the way we assess a defence or an attack mechanism.

Original: That is, we overly generalize the mistakes caused by attacks.
Revised: That is, we overly generalize the mistakes caused by attacks.

Original: Particularly, the current approaches focuses on the scenario where different mistakes caused by the attacks are treated equally.
Revised: Particularly, the current approaches focuses on the scenario where different mistakes caused by the attacks are treated equally.

Original: We argue that some context do not allow mistakes to be considered equal.
Revised: We argue that some context do not allow mistakes to be considered equal.

Original: In CIFAR-100 (Krizhevsky et al., 2009), it is less problematic to misclassify a pine tree as a oak tree than a ﬁsh as a truck.
Revised: In CIFAR-100 (Krizhevsky et al., 2009), it is less problematic to misclassify a pine tree as a oak tree than a ﬁsh as a truck.

Original: As such, we are motivated to propose the concept of hierarchical adversarial robustness to capture this notion.
Revised: As such, we are motivated to propose the concept of hierarchical adversarial robustness to capture this notion.

Original: Given a dataset whose classes can be grouped into coarse labels, we deﬁne hierarchical adversarial examples as the ones leading to a misclassiﬁcation at the coarse level; and we present a variant of the projected gradient descent (PGD) adversaries (Madry et al., 2017) to ﬁnd hierarchical adversarial examples.
Revised: Given a dataset whose classes can be grouped into coarse labels, we deﬁne hierarchical adversarial examples as the ones leading to a misclassiﬁcation at the coarse level; and we present a variant of the projected gradient descent (PGD) adversaries (Madry et al., 2017) to ﬁnd hierarchical adversarial examples.

Original: Finally, we introduce a simple and principled hierarchical adversarially robust (HAR) network which decompose the end-to-end robust learning task into a single classiﬁcation task into one coarse and multiple ﬁne classiﬁcation tasks, before being trained by adversarial defence techniques.
Revised: Finally, we introduce a simple and principled hierarchical adversarially robust (HAR) network which decompose the end-to-end robust learning task into a single classiﬁcation task into one coarse and multiple ﬁne classiﬁcation tasks, before being trained by adversarial defence techniques.

Original: Our contribution are
Revised: Our contribution are

Original: • We introduce the concept of hierarchical adversarial examples: a special case of the standard adversarial examples which causes mistakes at the coarse level (Section 2).
Revised: • We introduce the concept of hierarchical adversarial examples: a special case of the standard adversarial examples which causes mistakes at the coarse level (Section 2).

Original: • We present a worst-case targeted PGD attack to ﬁnd hierarchical adversarial examples.
Revised: • We present a worst-case targeted PGD attack to ﬁnd hierarchical adversarial examples.

Original: The attack iterates through all candidate ﬁne labels until a successful misclassiﬁcation into the desired target (Section 2.1).
Revised: The attack iterates through all candidate ﬁne labels until a successful misclassiﬁcation into the desired target (Section 2.1).

Original: • We propose a novel architectural approach, HAR network, for improving the hierarchical adversarial robustness of deep neural networks (Section 3).
Revised: • We propose a novel architectural approach, HAR network, for improving the hierarchical adversarial robustness of deep neural networks (Section 3).

Original: We empirically show that HAR networks signiﬁcantly improve the hierarchical adversarial robustness against (cid:96) ∞ attacks ( (cid:15)
Revised: We empirically show that HAR networks signiﬁcantly improve the hierarchical adversarial robustness against (cid:96) ∞ attacks ( (cid:15)

Original: = 8 255 ) (Section 4) and (cid:96) 2 attacks ( (cid:15) =
Revised: = 8 255 ) (Section 4) and (cid:96) 2 attacks ( (cid:15) =

Original: 5 ) (Appendix A.4) on CIFAR-100.
Revised: 5 ) (Appendix A.4) on CIFAR-100.

Original: • We benchmark using untargeted PGD20 attacks as well as the proposed iterative targeted PGD attack.
Revised: • We benchmark using untargeted PGD20 attacks as well as the proposed iterative targeted PGD attack.

Original: In particular, we include an extensive empirical study on the improved hierarchical robustness of HAR by evaluating against attacks with varying PGD iterations and (cid:15) .
Revised: In particular, we include an extensive empirical study on the improved hierarchical robustness of HAR by evaluating against attacks with varying PGD iterations and (cid:15) .

Original: We ﬁnd that a vast majority of the misclassiﬁcations from the untargeted attack are within the same coarse label, resulting a failed hierarchical attack.
Revised: We ﬁnd that a vast majority of the misclassiﬁcations from the untargeted attack are within the same coarse label, resulting a failed hierarchical attack.

Original: The proposed iterative targeted attacks provides a better empirical representation of the hierarchical adversarial robustness of the model (Section 4.2).
Revised: The proposed iterative targeted attacks provides a better empirical representation of the hierarchical adversarial robustness of the model (Section 4.2).

Original: • We show that the iterative targeted attack formulated based on the coarse network are weaker hierarchical adversarial examples compared to the ones generated using the entire HAR network (Section 4.3).
Revised: • We show that the iterative targeted attack formulated based on the coarse network are weaker hierarchical adversarial examples compared to the ones generated using the entire HAR network (Section 4.3).

Original:  H IERARCHICAL A DVERSARIAL E XAMPLES
Revised:  H IERARCHICAL A DVERSARIAL E XAMPLES

Original: The advancement in DNN image classiﬁers is accompanied by the increasing complexity of the network design (Szegedy et al., 2016;
Revised: The advancement in DNN image classiﬁers is accompanied by the increasing complexity of the network design (Szegedy et al., 2016;

Original: He et al., 2016), and those intricate networks has provided state-of-the-art results on many benchmark tasks (Deng et al., 2009; Geiger et al., 2013; Cordts et al., 2016; Everingham et al., 2015).
Revised: He et al., 2016), and those intricate networks has provided state-of-the-art results on many benchmark tasks (Deng et al., 2009; Geiger et al., 2013; Cordts et al., 2016; Everingham et al., 2015).

Original: Unfortunately, the discovery of adversarial examples has revealed that neural networks are extremely vulnerable to maliciously perturbed inputs at test time (Szegedy et al., 2013).
Revised: Unfortunately, the discovery of adversarial examples has revealed that neural networks are extremely vulnerable to maliciously perturbed inputs at test time (Szegedy et al., 2013).

Original: This makes it difﬁcult to apply DNN-based techniques in mission-critical and safetycritical areas.
Revised: This makes it difﬁcult to apply DNN-based techniques in mission-critical and safetycritical areas.

Original: Another important develeopment along with the advancement of DNN is the growing complexity of the dataset, both in size and in number of classes: i.e. from the 10-class MNIST dataset to the 1000-class ImageNet dataset.
Revised: Another important develeopment along with the advancement of DNN is the growing complexity of the dataset, both in size and in number of classes: i.e. from the 10-class MNIST dataset to the 1000-class ImageNet dataset.

Original: As the complexity of the dataset increases exponentially, dataset can often be divided into several coarse classes where each coarse class consists of multiple ﬁne classes.
Revised: As the complexity of the dataset increases exponentially, dataset can often be divided into several coarse classes where each coarse class consists of multiple ﬁne classes.

Original: In this paper, we use the term label and class interchangeably.
Revised: In this paper, we use the term label and class interchangeably.

Original: The concept of which an input image is ﬁrst classiﬁed into coarse labels and then into ﬁne labels are referred to as hierarchical classiﬁcation (Tousch et al., 2012).
Revised: The concept of which an input image is ﬁrst classiﬁed into coarse labels and then into ﬁne labels are referred to as hierarchical classiﬁcation (Tousch et al., 2012).

Original: Intuitively, the visual separability between groups of ﬁne labels can be highly uneven within a given dataset, and thus some coarse labels are more difﬁcult to distinguish than others.
Revised: Intuitively, the visual separability between groups of ﬁne labels can be highly uneven within a given dataset, and thus some coarse labels are more difﬁcult to distinguish than others.

Original: This motivates the use of more dedicated classiﬁers for speciﬁc groups of classes, allowing the coarse labels to provide information on similarities between the ﬁne labels at an intermediate stage.
Revised: This motivates the use of more dedicated classiﬁers for speciﬁc groups of classes, allowing the coarse labels to provide information on similarities between the ﬁne labels at an intermediate stage.

Original: The class hierarchy can be formed in different ways, and it can be learned strategically for optimal performance of the downstream task (Deng et al., 2011).
Revised: The class hierarchy can be formed in different ways, and it can be learned strategically for optimal performance of the downstream task (Deng et al., 2011).

Original: Note that it is also a valid strategy to create a customized class hierarchy and thus be able to deal with sensitive missclassiﬁcation.
Revised: Note that it is also a valid strategy to create a customized class hierarchy and thus be able to deal with sensitive missclassiﬁcation.

Original: To illustrate our work, we use the predeﬁned class hierarchy of the
Revised: To illustrate our work, we use the predeﬁned class hierarchy of the

Original: CIFAR-10 and the CIFAR-100 dataset (Krizhevsky et al., 2009): ﬁne labels are grouped into coarse labels by semantic similarities.
Revised: CIFAR-10 and the CIFAR-100 dataset (Krizhevsky et al., 2009): ﬁne labels are grouped into coarse labels by semantic similarities.

Original: All prior work on adversarial examples for neural networks, regardless of defences or attacks, focuses on the scenario where all misclassiﬁcations are considered equally (Szegedy et al., 2013;
Revised: All prior work on adversarial examples for neural networks, regardless of defences or attacks, focuses on the scenario where all misclassiﬁcations are considered equally (Szegedy et al., 2013;

Original: Goodfellow et al., 2014; Kurakin et al., 2016; Madry et al., 2017; Wong et al., 2020).
Revised: Goodfellow et al., 2014; Kurakin et al., 2016; Madry et al., 2017; Wong et al., 2020).

Original: However, in practice, this notion overly generalizes the damage caused by different types of attacks.
Revised: However, in practice, this notion overly generalizes the damage caused by different types of attacks.

Original: For example, in an autonomous driving system, confusing a perturbed image of a trafﬁc sign as a pedestrian should not be treated the same way as confusing a bus as a pickup truck.
Revised: For example, in an autonomous driving system, confusing a perturbed image of a trafﬁc sign as a pedestrian should not be treated the same way as confusing a bus as a pickup truck.

Original: The former raises a major security threat for practical machine learning applications, whereas the latter has very little impact to the underlying task.
Revised: The former raises a major security threat for practical machine learning applications, whereas the latter has very little impact to the underlying task.

Original: Moreover, misclassiﬁcation across different coarse labels poses potential ethical concerns when the dataset involves sensitive features such as different ethnicities, genders, people with disabilities and age groups.
Revised: Moreover, misclassiﬁcation across different coarse labels poses potential ethical concerns when the dataset involves sensitive features such as different ethnicities, genders, people with disabilities and age groups.

Original: Mistakes across coarse classes leads to much more severe consequences compared to mistakes within coarse classes.
Revised: Mistakes across coarse classes leads to much more severe consequences compared to mistakes within coarse classes.

Original: As such, to capture this different notion of attacks, we propose the term hierarchical adversarial examples.
Revised: As such, to capture this different notion of attacks, we propose the term hierarchical adversarial examples.

Original: They are a speciﬁc case of adversarial examples where the resulting misclassiﬁcation occurs between ﬁne labels that come from different coarse labels.
Revised: They are a speciﬁc case of adversarial examples where the resulting misclassiﬁcation occurs between ﬁne labels that come from different coarse labels.

Original: Here, we provide a clear deﬁnition of the hierarchical adversarial examples to differentiate it from the standard adversarial examples.
Revised: Here, we provide a clear deﬁnition of the hierarchical adversarial examples to differentiate it from the standard adversarial examples.

Original: We begin with the notation for the classiﬁer.
Revised: We begin with the notation for the classiﬁer.

Original: Consider a neural network F ( x ) :
Revised: Consider a neural network F ( x ) :

Original: R d → R c with a softmax as its last layer (Hastie et al., 2009), where d and c denote the input dimension and the number of classes, respectively.
Revised: R d → R c with a softmax as its last layer (Hastie et al., 2009), where d and c denote the input dimension and the number of classes, respectively.

Original: The prediction is given by arg max i F ( x ) i .
Revised: The prediction is given by arg max i F ( x ) i .

Original: In the hierarchical classiﬁcation framework, the classes are categorized (e.g. by the user) into ﬁne classes and coarse classes 1 .
Revised: In the hierarchical classiﬁcation framework, the classes are categorized (e.g. by the user) into ﬁne classes and coarse classes 1 .

Original: The dataset consists of image and ﬁne label pairs: { x, y } n .
Revised: The dataset consists of image and ﬁne label pairs: { x, y } n .

Original: In the later, we use the set theory symbol ∈ to characterize the relationship between a ﬁne and a coarse label:
Revised: In the later, we use the set theory symbol ∈ to characterize the relationship between a ﬁne and a coarse label:

Original: y ∈
Revised: y ∈

Original: z if the ﬁne label y is part of the coarse class z .
Revised: z if the ﬁne label y is part of the coarse class z .

Original: Note that this relation holds for both disjoint and overlapping coarse classes.
Revised: Note that this relation holds for both disjoint and overlapping coarse classes.

Original: Given an input data x , suppose its true coarse and ﬁne labels are z ∗ and y ∗ respectively.
Revised: Given an input data x , suppose its true coarse and ﬁne labels are z ∗ and y ∗ respectively.

Original: Under the setting deﬁned above, a hierarchical adversarial example must satisfy all the following properties:
Revised: Under the setting deﬁned above, a hierarchical adversarial example must satisfy all the following properties:

Original: • the unperturbed input data x is correctly classiﬁed by the classiﬁer: arg max i F ( x ) i = y ∗ ; • the perturbed data x (cid:48)
Revised: • the unperturbed input data x is correctly classiﬁed by the classiﬁer: arg max i F ( x ) i = y ∗ ; • the perturbed data x (cid:48)

Original: =
Revised: =

Original: x + δ is perceptually indistinguishable from the original input x ; • the perturbed data x (cid:48) is classiﬁed incorrectly: arg max i F ( x (cid:48) )
Revised: x + δ is perceptually indistinguishable from the original input x ; • the perturbed data x (cid:48) is classiﬁed incorrectly: arg max i F ( x (cid:48) )

Original: i =
Revised: i =

Original: y (cid:48) where y (cid:48) (cid:54) =
Revised: y (cid:48) where y (cid:48) (cid:54) =

Original: y ∗ ; • the misclassiﬁed label belongs to a different coarse class: y (cid:48)
Revised: y ∗ ; • the misclassiﬁed label belongs to a different coarse class: y (cid:48)

Original: (cid:54)∈ z ∗ .
Revised: (cid:54)∈ z ∗ .

Original: Notice that satisfying the ﬁrst three properties is sufﬁcient to deﬁne a standard adversarial examples, and that hierarchical adversarial examples are special cases of adversarial examples.
Revised: Notice that satisfying the ﬁrst three properties is sufﬁcient to deﬁne a standard adversarial examples, and that hierarchical adversarial examples are special cases of adversarial examples.

Original: It is worth mentioning that measuring perceptual distance can be difﬁcult (Li et al., 2003), thus the second property is often replaced by limiting that the adversary can only modify any input x to x + δ with δ ∈ ∆ .
Revised: It is worth mentioning that measuring perceptual distance can be difﬁcult (Li et al., 2003), thus the second property is often replaced by limiting that the adversary can only modify any input x to x + δ with δ ∈ ∆ .

Original: Commonly used constraints are (cid:15) -balls w.r.t.
Revised: Commonly used constraints are (cid:15) -balls w.r.t.

Original: (cid:96) p -norms, though other constraint sets have been used too (Wong et al., 2019).
Revised: (cid:96) p -norms, though other constraint sets have been used too (Wong et al., 2019).

Original: In this work, we focus on (cid:96) ∞ - and (cid:96) 2 -norm attacks.
Revised: In this work, we focus on (cid:96) ∞ - and (cid:96) 2 -norm attacks.

Original: 2. G ENERATING HIERARCHICAL ADVERSARIAL PERTURBATIONS
Revised: 2. G ENERATING HIERARCHICAL ADVERSARIAL PERTURBATIONS

Original: A common class of attack techniques are gradient-based attacks, such as FGSM (Goodfellow et al., 2014), BIM (Kurakin et al., 2016) and PGD (Madry et al., 2017), that utilize gradient (ﬁrst-order) information of the network to compute perturbations.
Revised: A common class of attack techniques are gradient-based attacks, such as FGSM (Goodfellow et al., 2014), BIM (Kurakin et al., 2016) and PGD (Madry et al., 2017), that utilize gradient (ﬁrst-order) information of the network to compute perturbations.

Original: Such methods are motivated by linearizing the loss function and solving for the perturbation that optimizes the loss subject to the (cid:96) p -norm constraint.
Revised: Such methods are motivated by linearizing the loss function and solving for the perturbation that optimizes the loss subject to the (cid:96) p -norm constraint.

Original: Their popularity is largely due to its simplicity, because the optimization objective can be accomplished in closed form at the cost of one back-propagation.
Revised: Their popularity is largely due to its simplicity, because the optimization objective can be accomplished in closed form at the cost of one back-propagation.

Original: The main idea of gradient-based attacks can be summarized as follows.
Revised: The main idea of gradient-based attacks can be summarized as follows.

Original: Given the prediction of
Revised: Given the prediction of

Original: F ( x ) and a target label y , the loss function of the model is denoted by (cid:96) ( x, y ) (cid:44) (cid:96) ( F ( x ) , y ) , e.g., a cross-entropy loss.
Revised: F ( x ) and a target label y , the loss function of the model is denoted by (cid:96) ( x, y ) (cid:44) (cid:96) ( F ( x ) , y ) , e.g., a cross-entropy loss.

Original: Here, we omit the network parameter w in the loss because it is assumed to be ﬁxed while generating adversarial perturbations.
Revised: Here, we omit the network parameter w in the loss because it is assumed to be ﬁxed while generating adversarial perturbations.

Original: Note that the choice of y and whether to maximize or minimize the loss depend on if the attack is targeted or untargeted.
Revised: Note that the choice of y and whether to maximize or minimize the loss depend on if the attack is targeted or untargeted.

Original: For a targeted (cid:96) ∞ attack, gradient-based methods rely on the opposite direction of the loss gradient, − sign ∇ x (cid:96) ( x, y ) , to solve for the perturbation that minimizes the loss with respect to a non-true target label ( y (cid:54) =
Revised: For a targeted (cid:96) ∞ attack, gradient-based methods rely on the opposite direction of the loss gradient, − sign ∇ x (cid:96) ( x, y ) , to solve for the perturbation that minimizes the loss with respect to a non-true target label ( y (cid:54) =

Original: y ∗ ).
Revised: y ∗ ).

Original: Despite its simplicity, gradient-based attacks are highly effective at ﬁnding (cid:96) p -bounded perturbations that lead to misclassiﬁcations.
Revised: Despite its simplicity, gradient-based attacks are highly effective at ﬁnding (cid:96) p -bounded perturbations that lead to misclassiﬁcations.

Original: In our work, we introduce a simple variant of the projected gradient descent (PGD) adversary to ﬁnd hierarchical adversarial examples.
Revised: In our work, we introduce a simple variant of the projected gradient descent (PGD) adversary to ﬁnd hierarchical adversarial examples.

Original: Given an input image with true coarse and ﬁne labels z ∗ and y ∗ respectively.
Revised: Given an input image with true coarse and ﬁne labels z ∗ and y ∗ respectively.

Original: Let x
Revised: Let x

Original: j
Revised: j

Original: denote
Revised: denote

Original: the perturbed input at iteration j , we deﬁne:
Revised: the perturbed input at iteration j , we deﬁne:

Original: [Equation]
Revised: [Equation]

Original: 1) where the target label ˆ y comes from a different coarse class: ˆ y (cid:54)∈ z ∗ .
Revised: 1) where the target label ˆ y comes from a different coarse class: ˆ y (cid:54)∈ z ∗ .

Original: Algorithm 1 summarize the procedures for generating an (cid:96) ∞ -constrained hierarchical adversarial examples.
Revised: Algorithm 1 summarize the procedures for generating an (cid:96) ∞ -constrained hierarchical adversarial examples.

Original: The projection operator Π after each iteration ensures that the perturbation is in an (cid:15) -neighbourhood of the original image.
Revised: The projection operator Π after each iteration ensures that the perturbation is in an (cid:15) -neighbourhood of the original image.

Original: We also adopt the random initialization in PGD attacks (Madry et al., 2017): x 0 = x + η , where η = ( η 1 , η 2 , . . .
Revised: We also adopt the random initialization in PGD attacks (Madry et al., 2017): x 0 = x + η , where η = ( η 1 , η 2 , . . .

Original: , η d ) (cid:62) and η i ∼ U ( − (cid:15), (cid:15) ) .
Revised: , η d ) (cid:62) and η i ∼ U ( − (cid:15), (cid:15) ) .

Original: There are several approaches to choose the target class (Carlini & Wagner, 2017).
Revised: There are several approaches to choose the target class (Carlini & Wagner, 2017).

Original: The target class can be chosen in an average-case approach where the class is selected uniformly at random among all eligible labels.
Revised: The target class can be chosen in an average-case approach where the class is selected uniformly at random among all eligible labels.

Original: Alternatively, they can be chosen in a strategic way, a best-case attack, to ﬁnd the target class which requires the least number of PGD iterations for misclassiﬁcations.
Revised: Alternatively, they can be chosen in a strategic way, a best-case attack, to ﬁnd the target class which requires the least number of PGD iterations for misclassiﬁcations.

Original: In our work, we consider a worst-case attack by iterating through all candidate target labels, i.e., ﬁne labels that do not belong in the same coarse class.
Revised: In our work, we consider a worst-case attack by iterating through all candidate target labels, i.e., ﬁne labels that do not belong in the same coarse class.

Original: This iterative targeted attack process terminates under two conditions: 1.
Revised: This iterative targeted attack process terminates under two conditions: 1.

Original: perturbation results in a successful targeted misclassiﬁcation; 2.
Revised: perturbation results in a successful targeted misclassiﬁcation; 2.

Original: all candidate ﬁne labels have been used as targets.
Revised: all candidate ﬁne labels have been used as targets.

Original: 2. R ELATED W ORK ON H IERARCHICAL C LASSIFICATION
Revised: 2. R ELATED W ORK ON H IERARCHICAL C LASSIFICATION

Original: In image classiﬁcation domain, there is a sizable body of work exploiting class hierarchy of the dataset (Tousch et al., 2012).
Revised: In image classiﬁcation domain, there is a sizable body of work exploiting class hierarchy of the dataset (Tousch et al., 2012).

Original: For classiﬁcation with a large number of classes, it is a common technique to divide the end-to-end learning task into multiple classiﬁcations based on the semantic hierarchy of the labels (Marszałek & Schmid, 2008;
Revised: For classiﬁcation with a large number of classes, it is a common technique to divide the end-to-end learning task into multiple classiﬁcations based on the semantic hierarchy of the labels (Marszałek & Schmid, 2008;

Original: Liu et al., 2013; Deng et al., 2012).
Revised: Liu et al., 2013; Deng et al., 2012).

Original: They are motivated by the intuition that some coarse labels are more difﬁcult to distinguish than others, and speciﬁc category of classes requires more dedicated classiﬁers.
Revised: They are motivated by the intuition that some coarse labels are more difﬁcult to distinguish than others, and speciﬁc category of classes requires more dedicated classiﬁers.

Original: A popular hierarchy structure is to divide the ﬁne labels into a label tree with root nodes and leaf nodes.
Revised: A popular hierarchy structure is to divide the ﬁne labels into a label tree with root nodes and leaf nodes.

Original: Deng et al.
Revised: Deng et al.

Original: (2011) propose an efﬁcient technique to simultaneously determine the structure of the tree as well as learning the classiﬁer for each node in the tree.
Revised: (2011) propose an efﬁcient technique to simultaneously determine the structure of the tree as well as learning the classiﬁer for each node in the tree.

Original: Instead of learning the optimal tree structure, it is also common to use the predeﬁned hierarchy of the dataset Deng et al.
Revised: Instead of learning the optimal tree structure, it is also common to use the predeﬁned hierarchy of the dataset Deng et al.

Original:  H IERARCHICAL A DVERSARIALLY R OBUST (HAR) N ETWORK
Revised:  H IERARCHICAL A DVERSARIALLY R OBUST (HAR) N ETWORK

Original: To improve the hierarchical adversarial robustness of neural networks, we propose a simple and principled hierarchical adversarially robust (HAR) network which decompose the end-to-end robust learning task into two parts.
Revised: To improve the hierarchical adversarial robustness of neural networks, we propose a simple and principled hierarchical adversarially robust (HAR) network which decompose the end-to-end robust learning task into two parts.

Original: First, we initialize a neural network for the coarse classiﬁcation task, along with multiple networks for the ﬁne classiﬁcation tasks.
Revised: First, we initialize a neural network for the coarse classiﬁcation task, along with multiple networks for the ﬁne classiﬁcation tasks.

Original: Next, all the networks are trained using adversarial defence techniques to improve the robustness of their task at hand.
Revised: Next, all the networks are trained using adversarial defence techniques to improve the robustness of their task at hand.

Original: The ﬁnal probability distribution of all the ﬁne classes are computed based on Bayes Theorem.
Revised: The ﬁnal probability distribution of all the ﬁne classes are computed based on Bayes Theorem.

Original: For brevity, we use coarse neural network (CNN) and ﬁne neural network (FNN) to denote the two different types of networks.
Revised: For brevity, we use coarse neural network (CNN) and ﬁne neural network (FNN) to denote the two different types of networks.

Original: Intuitively, the HAR network design beneﬁts from a single robustiﬁed CNN with improved robustness between coarse classes, and multiple robustiﬁed FNN with improved the robustness between visually similar ﬁne classes.
Revised: Intuitively, the HAR network design beneﬁts from a single robustiﬁed CNN with improved robustness between coarse classes, and multiple robustiﬁed FNN with improved the robustness between visually similar ﬁne classes.

Original: 3. A RCHITECTURE D ESIGN OF HAR
Revised: 3. A RCHITECTURE D ESIGN OF HAR

Original: Instead of the traditional ﬂat design of the neural network, HAR consists of one CNN for the coarse labels and several FNNs for the ﬁne labels.
Revised: Instead of the traditional ﬂat design of the neural network, HAR consists of one CNN for the coarse labels and several FNNs for the ﬁne labels.

Original: Note that there is a one-to-one correspondence between
Revised: Note that there is a one-to-one correspondence between

Original: [Figure]
Revised: [Figure]

Original: a particular FNN and a speciﬁc group of ﬁne labels.
Revised: a particular FNN and a speciﬁc group of ﬁne labels.

Original: Such a module design mimics the hierarchical structure of the dataset where the ﬁne classes are grouped into coarse classes.
Revised: Such a module design mimics the hierarchical structure of the dataset where the ﬁne classes are grouped into coarse classes.

Original: Recall that our deﬁnition of the neural network F ( x ) includes the softmax function as its last layer, so the output of the network can be interpreted as the probability distribution of the classes: P ( y | x ) .
Revised: Recall that our deﬁnition of the neural network F ( x ) includes the softmax function as its last layer, so the output of the network can be interpreted as the probability distribution of the classes: P ( y | x ) .

Original: Conditioned on the probability of the coarse class, we can deﬁne the ﬁne class probability as
Revised: Conditioned on the probability of the coarse class, we can deﬁne the ﬁne class probability as

Original: [Equation]
Revised: [Equation]

Original: Here, the probability distribution of the ﬁne classes are computed as the product of two terms.
Revised: Here, the probability distribution of the ﬁne classes are computed as the product of two terms.

Original: Given an input x , the ﬁrst term P ( y | x, z ) represents the probability of x being a ﬁne label y where y belongs to a coarse class z .
Revised: Given an input x , the ﬁrst term P ( y | x, z ) represents the probability of x being a ﬁne label y where y belongs to a coarse class z .

Original: This is essentially FNNs’ prediction of the ﬁne classes within a coarse category.
Revised: This is essentially FNNs’ prediction of the ﬁne classes within a coarse category.

Original: The second term P ( z | x ) represents the probability of x being a coarse label z , and it can be understood as the prediction from the CNN.
Revised: The second term P ( z | x ) represents the probability of x being a coarse label z , and it can be understood as the prediction from the CNN.

Original: With this decomposition of the original learning task, we can reconstruct the ﬁne label distribution by probabilistically combining the predictions from the different networks.
Revised: With this decomposition of the original learning task, we can reconstruct the ﬁne label distribution by probabilistically combining the predictions from the different networks.

Original: An important advantage of this ﬂexible modular network design is that it allows us to train the component networks using adversarial defence techniques to improve the robustness of their associated task.
Revised: An important advantage of this ﬂexible modular network design is that it allows us to train the component networks using adversarial defence techniques to improve the robustness of their associated task.

Original: Especially, a robustiﬁed coarse neural network leads to improved hierarchical adversarial robustness between coarse labels.
Revised: Especially, a robustiﬁed coarse neural network leads to improved hierarchical adversarial robustness between coarse labels.

Original: During training, each component of the HAR network is trained independently, allowing them to be trained in parallel.
Revised: During training, each component of the HAR network is trained independently, allowing them to be trained in parallel.

Original: We use the entire dataset with the coarse labels, { x, z } , to train the coarse class network G ( x ) , followed by training multiple ﬁne class network
Revised: We use the entire dataset with the coarse labels, { x, z } , to train the coarse class network G ( x ) , followed by training multiple ﬁne class network

Original: H ( x ) using only a portion of the dataset.
Revised: H ( x ) using only a portion of the dataset.

Original: The inference procedure can be described as follows.
Revised: The inference procedure can be described as follows.

Original: Suppose the number of coarse classes in a dataset is C , and each coarse class contains j number of ﬁne classes.
Revised: Suppose the number of coarse classes in a dataset is C , and each coarse class contains j number of ﬁne classes.

Original: Similar to the deﬁnition of
Revised: Similar to the deﬁnition of

Original: F ( x ) , we use G ( x ) to denote the output of the CNN: G ( x ) =
Revised: F ( x ) , we use G ( x ) to denote the output of the CNN: G ( x ) =

Original: [ g 1 , . .
Revised: [ g 1 , . .

Original: , g c ] .
Revised: , g c ] .

Original: We use H i ( x ) to denote the output of the FNN: H i ( x ) = (cid:2) h i 1 , . . .
Revised: We use H i ( x ) to denote the output of the FNN: H i ( x ) = (cid:2) h i 1 , . . .

Original: , h ij (cid:3) , where j is an positive integer indicating the number of ﬁne classes in the coarse class i .
Revised: , h ij (cid:3) , where j is an positive integer indicating the number of ﬁne classes in the coarse class i .

Original: In this setting, the output of the combined neural network is:
Revised: In this setting, the output of the combined neural network is:

Original: [Equation]
Revised: [Equation]

Original: 3. R ELATED W ORK ON A DVERSARIAL D EFENCE METHODS
Revised: 3. R ELATED W ORK ON A DVERSARIAL D EFENCE METHODS

Original: A plethora of defence mechanisms have been proposed for the adversarial setting.
Revised: A plethora of defence mechanisms have been proposed for the adversarial setting.

Original: Adversarial training (Szegedy et al., 2013) is one of the standard approaches for improving the robustness of deep neural networks against adversarial examples.
Revised: Adversarial training (Szegedy et al., 2013) is one of the standard approaches for improving the robustness of deep neural networks against adversarial examples.

Original: It is a data augmentation method that replaces unperturbed training data with adversarial examples and updates the network with the replaced data points.
Revised: It is a data augmentation method that replaces unperturbed training data with adversarial examples and updates the network with the replaced data points.

Original: Intuitively, this procedure encourages the DNN not to make the same mistakes against an adversary.
Revised: Intuitively, this procedure encourages the DNN not to make the same mistakes against an adversary.

Original: By adding sufﬁciently enough adversarial examples, the network gradually becomes robust to the attack it was trained on.
Revised: By adding sufﬁciently enough adversarial examples, the network gradually becomes robust to the attack it was trained on.

Original: Existing adversarial training methods (Szegedy et al., 2013;
Revised: Existing adversarial training methods (Szegedy et al., 2013;

Original: Goodfellow et al., 2014; Kurakin et al., 2016; Madry et al., 2017; Wong et al., 2020) differ in
Revised: Goodfellow et al., 2014; Kurakin et al., 2016; Madry et al., 2017; Wong et al., 2020) differ in

Original: [Equation]
Revised: [Equation]

Original: the adversaries used in the training.
Revised: the adversaries used in the training.

Original: Another related line of adversarial defence methods focuses on regularizing the loss function instead of data augmentation.
Revised: Another related line of adversarial defence methods focuses on regularizing the loss function instead of data augmentation.

Original: TRADES (Zhang et al., 2019) introduces a regularization term that penalizes the difference between the output of the model on a training data and its corresponding adversarial example.
Revised: TRADES (Zhang et al., 2019) introduces a regularization term that penalizes the difference between the output of the model on a training data and its corresponding adversarial example.

Original: The regularized loss consists of a standard crossentropy loss on the unperturbed data and a KL-divergence term measuring the difference between the distribution of clean training data and adversarially perturbed training data.
Revised: The regularized loss consists of a standard crossentropy loss on the unperturbed data and a KL-divergence term measuring the difference between the distribution of clean training data and adversarially perturbed training data.

Original:  E XPERIMENTS
Revised:  E XPERIMENTS

Original: In this section, we evaluate the hierarchical adversarial robustness of the HAR network design, incorporating two popular adversarial defence methods: adversarial training with PGD10 adversaries (Madry et al., 2017) and TRADES (Zhang et al., 2019).
Revised: In this section, we evaluate the hierarchical adversarial robustness of the HAR network design, incorporating two popular adversarial defence methods: adversarial training with PGD10 adversaries (Madry et al., 2017) and TRADES (Zhang et al., 2019).

Original: In this section, we focus on evaluations based on (cid:96) ∞ norm attacks, and defer evaluations on (cid:96) 2 in Appendix A.4.
Revised: In this section, we focus on evaluations based on (cid:96) ∞ norm attacks, and defer evaluations on (cid:96) 2 in Appendix A.4.

Original: Compared to the traditional ﬂat design of neural network, our experiments show that HAR leads to a signiﬁcant improvement in hierarchical adversarial robustness under various targeted and untargeted (cid:96) ∞ attacks.
Revised: Compared to the traditional ﬂat design of neural network, our experiments show that HAR leads to a signiﬁcant improvement in hierarchical adversarial robustness under various targeted and untargeted (cid:96) ∞ attacks.

Original: 4. E VALUATION S ETUP
Revised: 4. E VALUATION S ETUP

Original: We use network architectures from the ResNet family (He et al., 2016) on the CIFAR-100 dataset.
Revised: We use network architectures from the ResNet family (He et al., 2016) on the CIFAR-100 dataset.

Original: The hierarchical structure of classes within the two dataset is illustrated in Table 6.
Revised: The hierarchical structure of classes within the two dataset is illustrated in Table 6.

Original: To establish a baseline, we train ResNet50 networks using the following methods: (1) Standard: training with unperturbed data; (2) ADV: training with 10-step untargeted PGD examples (2) ADV-T: training with 10-step randomly targeted PGD examples and (4) TRADES.
Revised: To establish a baseline, we train ResNet50 networks using the following methods: (1) Standard: training with unperturbed data; (2) ADV: training with 10-step untargeted PGD examples (2) ADV-T: training with 10-step randomly targeted PGD examples and (4) TRADES.

Original: ADV-T is a targeted-version of the PGD adversarial training.
Revised: ADV-T is a targeted-version of the PGD adversarial training.

Original: Speciﬁcally, given an input pair from the training set ( x, y ) and y ∈ z ∗ , the perturbation is computed based on a targeted 10-step PGD attack where the target label is uniformly random sampled from { y | y (cid:54)∈ z ∗ } .
Revised: Speciﬁcally, given an input pair from the training set ( x, y ) and y ∈ z ∗ , the perturbation is computed based on a targeted 10-step PGD attack where the target label is uniformly random sampled from { y | y (cid:54)∈ z ∗ } .

Original: We refer the ﬂat models as vanilla models.
Revised: We refer the ﬂat models as vanilla models.

Original: For training HAR networks, we use ResNet10 for both the coarse network and the ﬁne network.
Revised: For training HAR networks, we use ResNet10 for both the coarse network and the ﬁne network.

Original: We use models with a lower capacity to reduce the difference in the order of magnitude of parameters between a single ResNet50 model and multiple ResNet10 models.
Revised: We use models with a lower capacity to reduce the difference in the order of magnitude of parameters between a single ResNet50 model and multiple ResNet10 models.

Original: This is to eliminate the concern of which the improved hierarchical adversarial robustness is obtained due to the increasing network complexity.
Revised: This is to eliminate the concern of which the improved hierarchical adversarial robustness is obtained due to the increasing network complexity.

Original: A comparison between the number of trainable parameters is included in Appendix A.1.
Revised: A comparison between the number of trainable parameters is included in Appendix A.1.

Original: Note that in the HAR network, all component networks (CNN and FNNs) are trained using the same adversarial defence approach.
Revised: Note that in the HAR network, all component networks (CNN and FNNs) are trained using the same adversarial defence approach.

Original: As a concrete example, a HAR network trained with TRADES on
Revised: As a concrete example, a HAR network trained with TRADES on

Original: CIFAR100 consists of one coarse classiﬁer and twenty ﬁne classiﬁers where they are all trained using TRADES.
Revised: CIFAR100 consists of one coarse classiﬁer and twenty ﬁne classiﬁers where they are all trained using TRADES.

Original: For all four methods (Standard, ADV, ADV-T and TRADES), networks are trained for a total of 200 epochs, with an initial learning rate of 0.1.
Revised: For all four methods (Standard, ADV, ADV-T and TRADES), networks are trained for a total of 200 epochs, with an initial learning rate of 0.1.

Original: The learning rate decays by an order of magnitude at epoch 100 and 150.
Revised: The learning rate decays by an order of magnitude at epoch 100 and 150.

Original: We used a minibatch size of 128 for testing and training.
Revised: We used a minibatch size of 128 for testing and training.

Original: We used SGD optimizer with momentum of 0.9 and a weight decay of 2e-4.
Revised: We used SGD optimizer with momentum of 0.9 and a weight decay of 2e-4.

Original: For TRADES, we performed a hyperparameter sweep on the strength of the regularization term β and selected one that resulted in the highest accuracy against untargeted (cid:96) ∞ bounded PGD20 attacks.
Revised: For TRADES, we performed a hyperparameter sweep on the strength of the regularization term β and selected one that resulted in the highest accuracy against untargeted (cid:96) ∞ bounded PGD20 attacks.

Original: The optimization procedure is used for both the vanilla models and all component models in the HAR network.
Revised: The optimization procedure is used for both the vanilla models and all component models in the HAR network.

Original: 4. H IERARCHICAL R OBUSTNESS UNDER U NTARGETED AND T ARGETED A TTACKS
Revised: 4. H IERARCHICAL R OBUSTNESS UNDER U NTARGETED AND T ARGETED A TTACKS

Original: There are several threat models to consider while evaluating adversarial robustness, regardless of standard or hierarchical robustness.
Revised: There are several threat models to consider while evaluating adversarial robustness, regardless of standard or hierarchical robustness.

Original: The white-box threat model speciﬁes that the model architecture and network parameters are fully transparent to the attacker (Goodfellow et al., 2014).
Revised: The white-box threat model speciﬁes that the model architecture and network parameters are fully transparent to the attacker (Goodfellow et al., 2014).

Original: Despite many white-box attack methods exist, perturbations generated using iterations of PGD remain as one of the most common benchmarks for evaluating adversarial robustness under the white-box setting.
Revised: Despite many white-box attack methods exist, perturbations generated using iterations of PGD remain as one of the most common benchmarks for evaluating adversarial robustness under the white-box setting.

Original: As such, we use PGD as the main method to generate both untargeted and targeted attacks.
Revised: As such, we use PGD as the main method to generate both untargeted and targeted attacks.

Original: Speciﬁcally, we perform 20, 50, 100 and 200 iterations of PGD for the untargeted attacks in Table 1.
Revised: Speciﬁcally, we perform 20, 50, 100 and 200 iterations of PGD for the untargeted attacks in Table 1.

Original: Due to the large number of ﬁne labels in CIFAR-100, we randomly selected 1000 test set input and perform the iterative, worst-case hierarchical adversarial perturbations introduced in Section 2.1.
Revised: Due to the large number of ﬁne labels in CIFAR-100, we randomly selected 1000 test set input and perform the iterative, worst-case hierarchical adversarial perturbations introduced in Section 2.1.

Original: Note that the evaluation on untargeted attacks uses the entire test set.
Revised: Note that the evaluation on untargeted attacks uses the entire test set.

Original: The results on the worst-case targeted attack is included in Table 2.
Revised: The results on the worst-case targeted attack is included in Table 2.

Original: Note that, besides (cid:15) = 8 / 255 , we also evaluated HAR against attacks with
Revised: Note that, besides (cid:15) = 8 / 255 , we also evaluated HAR against attacks with

Original: [Table] [Table]
Revised: [Table] [Table]

Original: (cid:15)
Revised: (cid:15)

Original: = 4 / 255 .
Revised: = 4 / 255 .

Original: All (cid:96) ∞ -PGD adversarial examples used for all evaluations are generated a step size of (cid:15)/ 4 (pixel values are normalized to [0 , 1] ).
Revised: All (cid:96) ∞ -PGD adversarial examples used for all evaluations are generated a step size of (cid:15)/ 4 (pixel values are normalized to [0 , 1] ).

Original: Along with the two attacks
Revised: Along with the two attacks

Original: [Table]
Revised: [Table]

Original: we also include results on unperturbed testset data (Clean).
Revised: we also include results on unperturbed testset data (Clean).

Original: For clean and untargeted attacks, we report the percentage of correct ﬁne class prediction as ﬁne accuracy, and the percentage of ﬁne class prediction belonging to the correct coarse class as coarse accuracy.
Revised: For clean and untargeted attacks, we report the percentage of correct ﬁne class prediction as ﬁne accuracy, and the percentage of ﬁne class prediction belonging to the correct coarse class as coarse accuracy.

Original: For targeted, its accuracy refers to the percentage of the testset data where the targeted attack fails to alter the ﬁnal prediction to the desired target, even after iterating through all eligible target labels.
Revised: For targeted, its accuracy refers to the percentage of the testset data where the targeted attack fails to alter the ﬁnal prediction to the desired target, even after iterating through all eligible target labels.

Original: It is important to realize that a successful targeted attack implies misclassiﬁcation for both coarse and ﬁne classes.
Revised: It is important to realize that a successful targeted attack implies misclassiﬁcation for both coarse and ﬁne classes.

Original: Table 1 summarize the accuracy of the HAR model and vanilla models on standard unperturbed data, and against untargeted and targeted attacks.
Revised: Table 1 summarize the accuracy of the HAR model and vanilla models on standard unperturbed data, and against untargeted and targeted attacks.

Original: [Table]
Revised: [Table]

Original: D ISCUSSIONS
Revised: D ISCUSSIONS

Original: Before making the comparison between the HAR model and the vanilla model, we make an interesting observation: untargeted attacks often results in misclassiﬁcation within the same coarse class, shown by the high coarse accuracy under Untargeted.
Revised: Before making the comparison between the HAR model and the vanilla model, we make an interesting observation: untargeted attacks often results in misclassiﬁcation within the same coarse class, shown by the high coarse accuracy under Untargeted.

Original: In particular, vanilla networks trained with unperturbed training data have 0% ﬁne accuracy under Untargeted, while a vast majority of the misclassiﬁed classes still belong to the correct coarse class.
Revised: In particular, vanilla networks trained with unperturbed training data have 0% ﬁne accuracy under Untargeted, while a vast majority of the misclassiﬁed classes still belong to the correct coarse class.

Original: This shows that the untargeted attacks do not provide a good representation of the hierarchical adversarial robustness as an empirical evaluation.
Revised: This shows that the untargeted attacks do not provide a good representation of the hierarchical adversarial robustness as an empirical evaluation.

Original: On the other hand, the iterative targeted attack leads to a severe damage in hierarchical adversarial robustness for vanilla models trained with all three methods.
Revised: On the other hand, the iterative targeted attack leads to a severe damage in hierarchical adversarial robustness for vanilla models trained with all three methods.

Original: On Standard trained models, despite the high hierarchical robustness under untargeted attacks, nearly all of the CIFAR10 and
Revised: On Standard trained models, despite the high hierarchical robustness under untargeted attacks, nearly all of the CIFAR10 and

Original: CIFAR100 testset data can be perturbed into a desired target class from another coarse class.
Revised: CIFAR100 testset data can be perturbed into a desired target class from another coarse class.

Original: As such, we emphasize the use of the iterative worst-case targeted attack for a more accurate evaluations for the hierarchical adversarial robustness of the model.
Revised: As such, we emphasize the use of the iterative worst-case targeted attack for a more accurate evaluations for the hierarchical adversarial robustness of the model.

Original: For vanilla models trained with ADV and TRADES, we notice that the improved adversarial robustness on ﬁne classes also translates to an improvement on hierarchical adversarial robustness.
Revised: For vanilla models trained with ADV and TRADES, we notice that the improved adversarial robustness on ﬁne classes also translates to an improvement on hierarchical adversarial robustness.

Original: We observed that vanilla models trained using ADV-T shows improved robustness against untargeted PGD attacks compared to the original adversarial training method.
Revised: We observed that vanilla models trained using ADV-T shows improved robustness against untargeted PGD attacks compared to the original adversarial training method.

Original: However, we noticed that there is a signiﬁcant decrease in the hierarchical robustness of ADV-T models against the hierarchical adversarial examples, leading to a worse hierarchical robust accuracy compared to ADV.
Revised: However, we noticed that there is a signiﬁcant decrease in the hierarchical robustness of ADV-T models against the hierarchical adversarial examples, leading to a worse hierarchical robust accuracy compared to ADV.

Original: Finally, we observe that HAR network trained with
Revised: Finally, we observe that HAR network trained with

Original: ADV and TRADES signiﬁcantly improves the robustness against iterative targeted attacks compared to the vanilla counterparts.
Revised: ADV and TRADES signiﬁcantly improves the robustness against iterative targeted attacks compared to the vanilla counterparts.

Original: On CIFAR-100, HAR network achieves a 1 . 2% improvement on PGD adversaries ( (cid:15) = 8 / 255 ) when trained with ADV.
Revised: On CIFAR-100, HAR network achieves a 1 . 2% improvement on PGD adversaries ( (cid:15) = 8 / 255 ) when trained with ADV.

Original: H IERARCHICAL R OBUSTNESS UNDER T ARGETED A TTACKS BASED ON THE C OARSE N ETWORK
Revised: H IERARCHICAL R OBUSTNESS UNDER T ARGETED A TTACKS BASED ON THE C OARSE N ETWORK

Original: Under the white-box threat model, attackers with a complete knowledge of the internal structure of
Revised: Under the white-box threat model, attackers with a complete knowledge of the internal structure of

Original: HAR can also generate perturbations based on the coarse network.
Revised: HAR can also generate perturbations based on the coarse network.

Original: During evaluations, we investigate whether the targeted PGD adversaries based on the coarse network are stronger hierarchical adversarial examples compared to the ones generated using the entire network.
Revised: During evaluations, we investigate whether the targeted PGD adversaries based on the coarse network are stronger hierarchical adversarial examples compared to the ones generated using the entire network.

Original: Such attacks can be understood as ﬁnding a more general perturbation which alters the probability distribution of the coarse class: P ( z | x ) .
Revised: Such attacks can be understood as ﬁnding a more general perturbation which alters the probability distribution of the coarse class: P ( z | x ) .

Original: Similar to the attack proposed in Section 2.1, we perform an iterative, worstcase targeted PGD20 attack based on the coarse neural network.
Revised: Similar to the attack proposed in Section 2.1, we perform an iterative, worstcase targeted PGD20 attack based on the coarse neural network.

Original: Speciﬁcally, we replace (cid:96) ( F ( x ) , y ) with (cid:96) ( G ( x ) , z ) in Eq. 1, and iterate through all eligible coarse classes as target labels.
Revised: Speciﬁcally, we replace (cid:96) ( F ( x ) , y ) with (cid:96) ( G ( x ) , z ) in Eq. 1, and iterate through all eligible coarse classes as target labels.

Original: For example, to generate such attacks for HAR with ADV-trained component networks, the iterative targeted attack is performed based on the ADV-trained coarse network in the original HAR network.
Revised: For example, to generate such attacks for HAR with ADV-trained component networks, the iterative targeted attack is performed based on the ADV-trained coarse network in the original HAR network.

Original: Note that there is a distinction between the above attack procedure and a transfer-based attack where the perturbation is transferred from an independently trained source model (Papernot et al., 2017).
Revised: Note that there is a distinction between the above attack procedure and a transfer-based attack where the perturbation is transferred from an independently trained source model (Papernot et al., 2017).

Original: Since the perturbation is generated using part of the HAR network, such attacks still belongs in the whitebox setting.
Revised: Since the perturbation is generated using part of the HAR network, such attacks still belongs in the whitebox setting.

Original: Our results in Table 3 show that the perturbations generated using the coarse network are weaker attacks compared to the ones generated using the entire network.
Revised: Our results in Table 3 show that the perturbations generated using the coarse network are weaker attacks compared to the ones generated using the entire network.

Original:  C ONCLUSION
Revised:  C ONCLUSION

Original: In this work, we introduced a novel concept called hierarchical adversarial examples.
Revised: In this work, we introduced a novel concept called hierarchical adversarial examples.

Original: For dataset which classes can be further categorized into ﬁne and coarse classes, we deﬁned hierarchical adversarial examples as the ones leading to a misclassication at the coarse level.
Revised: For dataset which classes can be further categorized into ﬁne and coarse classes, we deﬁned hierarchical adversarial examples as the ones leading to a misclassication at the coarse level.

Original: To improve the hierarchical adversarial robustness of the neural network, we proposed the HAR network design, a composite of a coarse network and ﬁne networks where each component network is trained independently by adversarial defence techniques.
Revised: To improve the hierarchical adversarial robustness of the neural network, we proposed the HAR network design, a composite of a coarse network and ﬁne networks where each component network is trained independently by adversarial defence techniques.

Original: We empirically showed that HAR leads to a signiﬁcant increase in hierarchical adversarial robustness under white-box untargeted/targeted attacks on CIFAR-10 and
Revised: We empirically showed that HAR leads to a signiﬁcant increase in hierarchical adversarial robustness under white-box untargeted/targeted attacks on CIFAR-10 and

Original: CIFAR-100-5x5.
Revised: CIFAR-100-5x5.

Original: The rapid adoption of machine learning applications has also led to an increasing importance in improving the robustness and reliability of such techniques.
Revised: The rapid adoption of machine learning applications has also led to an increasing importance in improving the robustness and reliability of such techniques.

Original: Mission-critical and safety-critical systems which rely on DNN in their decision-making process shall incorporate robustness, along with accuracy, in their development process.
Revised: Mission-critical and safety-critical systems which rely on DNN in their decision-making process shall incorporate robustness, along with accuracy, in their development process.

Original: The introduction of the hierarchical adversarial examples and ways to defend against them is an important step towards a more safe and trustworthy AI system.
Revised: The introduction of the hierarchical adversarial examples and ways to defend against them is an important step towards a more safe and trustworthy AI system.

Original: A A PPENDIX A. C OMPARISON OF TRAINABLE MODEL PARAMETERS
Revised: A A PPENDIX A. C OMPARISON OF TRAINABLE MODEL PARAMETERS

Original: In our evaluations, we use ResNet50 for the vanilla models, and use multiple ResNet10 for the HAR network.
Revised: In our evaluations, we use ResNet50 for the vanilla models, and use multiple ResNet10 for the HAR network.

Original: We use models with a lower capacity to reduce the difference in the order of magnitude of parameters between a single ResNet50 model and multiple ResNet10 models.
Revised: We use models with a lower capacity to reduce the difference in the order of magnitude of parameters between a single ResNet50 model and multiple ResNet10 models.

Original: This helps to address the concern of which the improved hierarchical adversarial robustness is obtained due to the increasing network complexity.
Revised: This helps to address the concern of which the improved hierarchical adversarial robustness is obtained due to the increasing network complexity.

Original: [Table]
Revised: [Table]

Original: A. H YPERPARAMETER SWEEP FOR TRADES ON R ES N ET
Revised: A. H YPERPARAMETER SWEEP FOR TRADES ON R ES N ET

Original: The following results show the hyperparameter sweep on TRADES.
Revised: The following results show the hyperparameter sweep on TRADES.

Original: We include the one with the highest PGD20 accuracy in Section 4.
Revised: We include the one with the highest PGD20 accuracy in Section 4.

Original: [Table]
Revised: [Table]

Original: A. H IERARCHICAL STRUCTURE OF CLASSES WITHIN THE CIFAR10 DATASET
Revised: A. H IERARCHICAL STRUCTURE OF CLASSES WITHIN THE CIFAR10 DATASET

Original: [Table]
Revised: [Table]

Original: A. R ESULTS ON CIFAR100 WITH (cid:96) 2 ATTACKS
Revised: A. R ESULTS ON CIFAR100 WITH (cid:96) 2 ATTACKS

Revised: Overall, we observe a similar robustness improvement with the HAR network.

Revised: Note that we were not able to achieve reasonable robustness results with TRADES against (cid:96) 2 attacks.

Revised: One possible reason is that the hyper-parameter sweet was based on the (cid:96) ∞ results, as such not suitable for (cid:96)attacks.

Revised: For this reason, we omit TRADES in this section.

Revised: [Table]

Revised: [Table]