Original: ROPUST: Improving Robustness through Fine-tuning with Photonic Processors and Synthetic Gradients
Revised: ROPUST: Improving Robustness through Fine-tuning with Photonic Processors and Synthetic Gradients

Original: Abstract
Revised: Abstract

Original: Robustness to adversarial attacks is typically obtained through expensive adversarial training with
Revised: Robustness to adversarial attacks is typically obtained through expensive adversarial training with

Original: Projected Gradient Descent.
Revised: Projected Gradient Descent.

Original: We introduce ROPUST, a remarkably simple and efﬁcient method to leverage robust pre-trained models and further increase their robustness, at no cost in natural accuracy.
Revised: We introduce ROPUST, a remarkably simple and efﬁcient method to leverage robust pre-trained models and further increase their robustness, at no cost in natural accuracy.

Original: Our technique relies on the use of an
Revised: Our technique relies on the use of an

Original: Optical Processing Unit (OPU), a photonic coprocessor, and a ﬁne-tuning step performed with
Revised: Optical Processing Unit (OPU), a photonic coprocessor, and a ﬁne-tuning step performed with

Original: Direct Feedback Alignment, a synthetic gradient training scheme.
Revised: Direct Feedback Alignment, a synthetic gradient training scheme.

Original: We test our method on nine different models against four attacks in RobustBench, consistently improving over state-of-theart performance.
Revised: We test our method on nine different models against four attacks in RobustBench, consistently improving over state-of-theart performance.

Original: We also introduce phase retrieval attacks, speciﬁcally designed to target our own defense.
Revised: We also introduce phase retrieval attacks, speciﬁcally designed to target our own defense.

Original: We show that even with state-of-the-art phase retrieval techniques, ROPUST is effective.
Revised: We show that even with state-of-the-art phase retrieval techniques, ROPUST is effective.

Original: 1. Introduction
Revised: 1. Introduction

Original: Adversarial examples (Goodfellow et al., 2015) threaten the safety and reliability of machine learning models deployed in the wild.
Revised: Adversarial examples (Goodfellow et al., 2015) threaten the safety and reliability of machine learning models deployed in the wild.

Original: Because of the sheer number of attack and defense scenarios, robustness can be difﬁcult to evaluate (Bubeck et al., 2019).
Revised: Because of the sheer number of attack and defense scenarios, robustness can be difﬁcult to evaluate (Bubeck et al., 2019).

Original: Standardized benchmarks, such as
Revised: Standardized benchmarks, such as

Original: RobustBench (Croce et al., 2020) with AutoAttack (Croce & Hein, 2020b), have helped better evaluate progress in the ﬁeld.
Revised: RobustBench (Croce et al., 2020) with AutoAttack (Croce & Hein, 2020b), have helped better evaluate progress in the ﬁeld.

Original: The development of defense-speciﬁc attacks is also crucial (Tram`er & Boneh, 2019).
Revised: The development of defense-speciﬁc attacks is also crucial (Tram`er & Boneh, 2019).

Original: To date, one of the most effective defense techniques remains adversarial training with
Revised: To date, one of the most effective defense techniques remains adversarial training with

Original: Projected Gradient Descent (PGD) (Madry et al., 2018).
Revised: Projected Gradient Descent (PGD) (Madry et al., 2018).

Original: Adversarial training can be resource-consuming, but robust networks pre-trained with PGD are now widely available, motivating their use as a foundation for simple and widely applicable defenses that further enhance their robustness
Revised: Adversarial training can be resource-consuming, but robust networks pre-trained with PGD are now widely available, motivating their use as a foundation for simple and widely applicable defenses that further enhance their robustness.

Original: To this end, we introduce ROPUST , a drop-in replacement for the classiﬁer of already robust models.
Revised: To this end, we introduce ROPUST , a drop-in replacement for the classiﬁer of already robust models.

Original: Our defense leverages a photonic co-processor (the Optical Processing
Revised: Our defense leverages a photonic co-processor (the Optical Processing

Original: Unit, OPU) for physical parameter obfuscation (Cappelli et al., 2021): because the ﬁxed random parameters are optically implemented, they remain unknown at training and inference time.
Revised: Unit, OPU) for physical parameter obfuscation (Cappelli et al., 2021): because the ﬁxed random parameters are optically implemented, they remain unknown at training and inference time.

Original: Additionally, a synthetic gradient method,
Revised: Additionally, a synthetic gradient method,

Original: Direct Feedback Alignment (DFA) (Nøkland, 2016), is used to ﬁne-tune the ROPUST classiﬁer.
Revised: Direct Feedback Alignment (DFA) (Nøkland, 2016), is used to ﬁne-tune the ROPUST classiﬁer.

Original: We evaluate our method against AutoAttack on nine different models in RobustBench, and consistently improve robust accuracies over the state-of-the-art (Fig. 1).
Revised: We evaluate our method against AutoAttack on nine different models in RobustBench, and consistently improve robust accuracies over the state-of-the-art (Fig. 1).

Original: We also develop a phase retrieval attack targeting our parameter obfuscation, and show that ROPUST remains effective.
Revised: We also develop a phase retrieval attack targeting our parameter obfuscation, and show that ROPUST remains effective.

Original: 1.1. Related work
Revised: 1.1. Related work

Original: Attacks.
Revised: Attacks.

Original: Adversarial attacks have been framed in a variety of settings: white-box, where the attacker is assumed to have unlimited access to the model, including its parameters (e.g. FGSM (Goodfellow et al., 2015), PGD (Madry et al., 2018; Kurakin et al., 2016), Carlini & Wagner (Carlini &
Revised: Adversarial attacks have been framed in a variety of settings: white-box, where the attacker is assumed to have unlimited access to the model, including its parameters (e.g. FGSM (Goodfellow et al., 2015), PGD (Madry et al., 2018; Kurakin et al., 2016), Carlini & Wagner (Carlini &

Original: Wagner, 2017)); black-box, assuming only limited access to the network for the attacker, with methods attempting to estimate the gradients (Chen et al., 2017; Ilyas et al., 2018a;b), or derived from genetic algorithms (Andriushchenko et al., 2019; Meunier et al., 2019) and combinatorial optimization (Moon et al., 2019); transfer attacks, where an attack is crafted on a model that is accessible to the attacker, and then applied to the target network (Papernot et al., 2016).
Revised: Wagner, 2017)); black-box, assuming only limited access to the network for the attacker, with methods attempting to estimate the gradients (Chen et al., 2017; Ilyas et al., 2018a;b), or derived from genetic algorithms (Andriushchenko et al., 2019; Meunier et al., 2019) and combinatorial optimization (Moon et al., 2019); transfer attacks, where an attack is crafted on a model that is accessible to the attacker, and then applied to the target network (Papernot et al., 2016).

Original: Automated schemes, such as AutoAttack (Croce & Hein, 2020b), have been proposed to autonomously select attacks and tune their hyperparameters.
Revised: Automated schemes, such as AutoAttack (Croce & Hein, 2020b), have been proposed to autonomously select attacks and tune their hyperparameters.

Original: Defenses.
Revised: Defenses.

Original: Adversarial training adds adversarial robustness as an explicit training objective (Goodfellow et al., 2015;
Revised: Adversarial training adds adversarial robustness as an explicit training objective (Goodfellow et al., 2015;

Original: Madry et al., 2018), by incorporating adversarial examples during the training.
Revised: Madry et al., 2018), by incorporating adversarial examples during the training.

Original: Theoretically grounded defenses have been proposed (Lecuyer et al., 2018; Cohen et al.;
Revised: Theoretically grounded defenses have been proposed (Lecuyer et al., 2018; Cohen et al.;

Original: Alexandre Araujo & Negrevergne, 2020; Pinot et al., 2019;
Revised: Alexandre Araujo & Negrevergne, 2020; Pinot et al., 2019;

Original: Wong et al., 2018; Wong & Kolter, 2018), but these fail to match the clean accuracy of state-of-the-art networks.
Revised: Wong et al., 2018; Wong & Kolter, 2018), but these fail to match the clean accuracy of state-of-the-art networks.

Original: Many empirical defenses have been criticized for providing a false sense of security (Athalye et al., 2018; Tram`er & Boneh, 2019), by not evaluating on attacks adapted to the defense.
Revised: Many empir- ical defenses have been criticized for providing a false sense of security (Athalye et al., 2018; Tram`er & Boneh, 2019), by not evaluating on attacks adapted to the defense.

Original: Gradient obfuscation, through the use of a non-differentiable activation function, has been proposed as a way to protect against white-box attacks (Papernot et al., 2017).
Revised: Gradient obfuscation, through the use of a non-differentiable activation function, has been proposed as a way to protect against white-box attacks (Papernot et al., 2017).

Original: However, it can be easily bypassed by Backward Pass Differentiable
Revised: However, it can be easily bypassed by Backward Pass Differentiable

Original: Approximation (BPDA) (Athalye et al., 2018), where the defense is replaced by a differentiable relaxation.
Revised: Approximation (BPDA) (Athalye et al., 2018), where the defense is replaced by a differentiable relaxation.

Original: Parameter obfuscation has been proposed with dedicated photonic co-processor (Cappelli et al., 2021).
Revised: Parameter obfuscation has been proposed with dedicated photonic co-processor (Cappelli et al., 2021).

Original: However, by itself, this kind of defense falls short of adversarial training.
Revised: However, by itself, this kind of defense falls short of adversarial training.

Original: Fine-tuning and analog computing.
Revised: Fine-tuning and analog computing.

Original: Previous work introduced adversarial ﬁne-tuning (Jeddi et al., 2020): ﬁnetuning a non-robust model with an adversarial objective.
Revised: Previous work introduced adversarial ﬁne-tuning (Jeddi et al., 2020): ﬁnetuning a non-robust model with an adversarial objective.

Original: In this work instead we ﬁne-tune a robust model without adversarial training.
Revised: In this work instead we ﬁne-tune a robust model without adversarial training.

Original:  The advantage of non-ideal analog computations in terms of robustness has been investigated in the context of NVM crossbars (Roy et al., 2020), while we here focus on a photonic technology, readily available to perform computations at scale.
Revised: Additionally, it was shown that robustness improves transfer performance (Salman et al., 2020) and that robustness transfers across datasets (Shafahi et al., 2020). The advantage of non-ideal analog computations in terms of robustness has been investigated in the context of NVM crossbars (Roy et al., 2020).

Original: 1.2. Motivations and contributions
Revised: 1.2. Motivations and contributions

Original: We propose to simplify and extend the applicability of photonic-based parameter obfuscation defenses.
Revised: We propose to simplify and extend the applicability of photonic-based parameter obfuscation defenses.

Original: The use of dedicated hardware to perform the random projection physically guarantees parameter obfuscation (Cappelli et al., 2021).
Revised: The use of dedicated hardware to perform the random projection physically guarantees parameter obfuscation (Cappelli et al., 2021).

Original: Our defense, ROPUST, can be dropped-in to supplement any robust pre-trained model and ﬁne-tuning its classiﬁer is fast.
Revised: Our defense, ROPUST, can be dropped-in to supplement any robust pre-trained model and ﬁne-tuning its classiﬁer is fast.

Original: In contrast with existing parameterobfuscation methods, it leverages pre-trained robust models, and achieves state-of-the-art performance.
Revised: In contrast with existing parameterobfuscation methods, it leverages pre-trained robust models, and achieves state-of-the-art performance.

Original: Drawing inspiration from the ﬁeld of phase retrieval, we introduce a new kind of attack against defenses relying on parameter obfuscation, phase retrieval attacks .
Revised: Drawing inspiration from the ﬁeld of phase retrieval, we introduce a new kind of attack against defenses relying on parameter obfuscation, phase retrieval attacks .

Original: We show that ROPUST remains robust even against state-of-the-art retrieval methods.
Revised: We show that ROPUST remains robust even against state-of-the-art retrieval methods.

Original: 2. Methods 2.1. Automated adversarial attacks
Revised: 2. Methods 2.1. Automated adversarial attacks

Original: We evaluate our model against the four attacks implemented in RobustBench: APGD-CE and APGD-T (Croce &
Revised: We evaluate our model against the four attacks implemented in RobustBench: APGD-CE and APGD-T (Croce &

Original: Hein, 2020b), Square attack (Andriushchenko et al., 2019), and Fast Adaptive Boundary (FAB) attack (Croce & Hein, 2020a).
Revised: Hein, 2020b), Square attack (Andriushchenko et al., 2019), and Fast Adaptive Boundary (FAB) attack (Croce & Hein, 2020a).

Original: We describe these attacks more in detail in the supplementary.
Revised: We describe these attacks more in detail in the supplementary.

Original: In RobustBench, using AutoAttack, given a batch of samples, these are ﬁrst attacked with APGD-CE.
Revised: In RobustBench, using AutoAttack, given a batch of samples, these are ﬁrst attacked with APGD-CE.

Original: Then, the samples that were successfully attacked are discarded, and the remaining ones are attacked with APGD-T.
Revised: Then, the samples that were successfully attacked are discarded, and the remaining ones are attacked with APGD-T.

Original: This procedure continues with Square and FAB attack.
Revised: This procedure continues with Square and FAB attack.

Original: 2.2. Our defense 
Revised: 2.2. Our defense Optical Processing Units. Optical Processing Units

Original: Optical Processing Units Optical Processing

Original: (OPU) 1 are photonic co-processors dedicated to efﬁcient large-scale random projections (Ohana et al., 2020).
Revised: (OPU) 1 are photonic co-processors dedicated to efﬁcient large-scale random projections (Ohana et al., 2020).

Original: Assuming an input vector x , the OPU computes the following operation using light scattering through a diffusive medium:
Revised: Assuming an input vector x , the OPU computes the following operation using light scattering through a diffusive medium:

Original: [Equation]
Revised: [Equation]

Original: With U a ﬁxed complex Gaussian random matrix of size up to 10 6 × 10 6 , which entries are not readily known.
Revised: With U a ﬁxed complex Gaussian random matrix of size up to 10 6 × 10 6 , which entries are not readily known.

Original: In the following, we sometimes refer to U as the transmission matrix (TM).
Revised: In the following, we sometimes refer to U as the transmission matrix (TM).

Original: The inputx is binary(1 bit – 0/1) and the outputy isquantized in 8-bit.
Revised: The input is binary and the output is in 8 bits.

Original: The matrix U is physically implemented through the diffusive medium.
Revised: The matrix U is physically implemented through the diffusive medium.

Original: As only the non-linear intensity | Ux | 2 can be measured and not Ux directly, an attacker has to perform phase retrieval to retrieve the coefﬁcients of U .
Revised: As only the non-linear intensity | Ux | 2 can be measured, an attacker has to perform phase retrieval to retrieve the coefﬁcients of U .

Original: We develop  an attack scenariobased on this method in Section 4.
Revised: We develop such an attack scenario in Section 4.

Original: Direct Feedback Alignment.
Revised: Direct Feedback Alignment.

Original: Because the ﬁxed random parameters implemented by the OPU are unknown, it is impossible to backpropagate through it.
Revised: Because the ﬁxed random parameters implemented by the OPU are unknown, it is impossible to backpropagate through it.

Original: We bypass this limitation by training layers upstream of the OPU using
Revised: We bypass this limitation by training layers upstream of the OPU using

Original: Direct Feedback Alignment (DFA) (Nøkland, 2016).
Revised: Direct Feedback Alignment (DFA) (Nøkland, 2016).

Original: In a fully connected network, at layer i out of N , neglecting biases, with W i its weight matrix, f i its non-linearity, and h i its activations, the forward pass can be written as a i =
Revised: In a fully connected network, at layer i out of N , neglecting biases, with W i its weight matrix, f i its non-linearity, and h i its activations, the forward pass can be written as a i =

Original: W i h
Revised: W i h

Original: i − 1 , h i =
Revised: i − 1 , h i =

Original: f i ( a i ) .
Revised: f i ( a i ) .

Original: h 

Revised: h

Original: = X is the input data, and h N = f ( a N ) =
Revised: = X is the input data, and h N = f ( a N ) =

Original: ˆy are the predictions.
Revised: ˆy are the predictions.

Original: A task-speciﬁc cost function L ( ˆy , y ) is computed to quantify the quality of the predictions with respect to the targets y .
Revised: A task-speciﬁc cost function L ( ˆy , y ) is computed to quantify the quality of the predictions with respect to the targets y .

Original: The weight updates are obtained through:
Revised: The weight updates are obtained through:

Original: [Equation]
Revised: [Equation]

Original: where (cid:12) is the Hadamard product.
Revised: where (cid:12) is the Hadamard product.

Original: With DFA, the gradient signal W Ti +

Revised: With DFA, the gradient signal W Ti +

Original: δ a
Revised: δ a

Original: i +1 of the (i+1)-th layer is replaced with a random projection of the gradient of the loss at the top layer δ a y –which is the error e = ˆy − y for the cross-entropy loss:
Revised: i +1 of the (i+1)-th layer is replaced with a random projection of the gradient of the loss at the top layer δ a y –which is the error e = ˆy − y for the cross-entropy loss:

Original: [Equation]
Revised: [Equation]

Original: ROPUST We propose to replace their classiﬁer with the
Revised: ROPUST We propose to replace their classiﬁer with the

Original: ROPUST module to enhance the adversarial robustness of pretrained robust models (Fig. 2).
Revised: ROPUST module to enhance the adversarial robustness of pretrained robust models (Fig. 2).

Original: We use robust models from the RobustBench model zoo, extracting and freezing their convolutional stack.
Revised: We use robust models from the RobustBench model zoo, extracting and freezing their convolutional stack.

Original: The robust convolutional features go through a fully connected layer and a sign function, preparing them for the OPU.
Revised: The robust convolutional features go through a fully connected layer and a sign function, preparing them for the OPU.

Original: The OPU then performs a nonlinear random projection, with ﬁxed unknown parameters.
Revised: The OPU then performs a nonlinear random projection, with ﬁxed unknown parameters.

Original: The predictions are obtained through a ﬁnal fully-connected layer.
Revised: The predictions are obtained through a ﬁnal fully-connected layer.

Original: While the convolutional layers are frozen, we train the ROPUST module on natural data using DFA to bypass the non-differentiable photonic hardware.
Revised: While the convolutional layers are frozen, we train the ROPUST module on natural data using DFA to bypass the non-differentiable photonic hardware.

Original: Attacking ROPUST.
Revised: Attacking ROPUST.

Original: Previous work has shown that methods devoid of weight transport are not effective in generating compelling adversarial examples (Akrout, 2019).
Revised: Previous work has shown that methods devoid of weight transport are not effective in generating compelling adversarial examples (Akrout, 2019).

Original: Therefore, we use backward pass differentiable approximation (BPDA) in place of DFA when attacking our defense: we relax nondifferentiable layers to a differentiable version.
Revised: Therefore, we use backward pass differentiable approximation (BPDA) in place of DFA when attacking our defense: we relax nondifferentiable layers to a differentiable version.

Original: For the binarization function, we simply use the derivative of tanh in the backward pass, while we approximate the transpose of the obfuscated parameters with a different ﬁxed random matrix drawn at initialization of the module.
Revised: For the binarization function, we simply use the derivative of tanh in the backward pass, while we approximate the transpose of the obfuscated parameters with a different ﬁxed random matrix drawn at initialization of the module.

Original: 3. Evaluating ROPUST on RobustBench
Revised: 3. Evaluating ROPUST on RobustBench

Original: All of the attacks are performed on CIFAR-10 (Krizhevsky, 2009), using a differentiable backward pass approximation (Athalye et al., 2018) as explained in Section 2.2.
Revised: All of the attacks are performed on CIFAR-10 (Krizhevsky, 2009), using a differentiable backward pass approximation (Athalye et al., 2018) as explained in Section 2.2.

Original: For our ex- periments, we use OPU input size 512 and output size 8000 .
Revised: For our experiments, we use OPU input size 512 and output size 8000 .

Original: We use the Adam optimizer (Kingma & Ba, 2014), with learning rate 0 .
Revised: We use the Adam optimizer (Kingma & Ba, 2014), with learning rate 0 .

Original: 001 , for 10 epochs.
Revised: 001 , for 10 epochs.

Original: The process typically takes 10 minutes on a single NVIDIA V100 GPU.
Revised: The process typically takes 10 minutes on a single NVIDIA V100 GPU.

Original: We show our results on nine different models in RobustBench in Fig.
Revised: We show our results on nine different models in RobustBench in Fig.

Original: The performance of the original pretrained models from the RobustBench leaderboard is reported as
Revised: The performance of the original pretrained models from the RobustBench leaderboard is reported as

Original: Base .
Revised: Base .

Original: ROPUST represents the same models equipped with our defense.
Revised: ROPUST represents the same models equipped with our defense.

Original: Finally, Transfer indicates the performance of attacks created on the original model and transferred to fool the ROPUST defense.
Revised: Finally, Transfer indicates the performance of attacks created on the original model and transferred to fool the ROPUST defense.

Original: For all models considered, ROPUST improves the robustness signiﬁcantly, even under transfer.
Revised: For all models considered, ROPUST improves the robustness signiﬁcantly, even under transfer.

Original: For transfer, we also tested crafting the attacks on the Base model while using the loss of the ROPUST model for the learning rate schedule of APGD.
Revised: For transfer, we also tested crafting the attacks on the Base model while using the loss of the ROPUST model for the learning rate schedule of APGD.

Original: We also tried to use the predictions of ROPUST, instead of the base model, to remove the samples that were successfully attacked from the next stage of the ensemble; however, these modiﬁcations did not improve transfer performance.
Revised: We also tried to use the predictions of ROPUST, instead of the base model, to remove the samples that were successfully attacked from the next stage of the ensemble; however, these modiﬁcations did not improve transfer performance.

Original: We remark that the robustness increase typically comes at no cost in natural accuracy; we show the accuracy on natural data of the Base and the ROPUST models in Fig.
Revised: We remark that the robustness increase typically comes at no cost in natural accuracy; we show the accuracy on natural data of the Base and the ROPUST models in Fig.

Original: We ablate our defense against white-box attacks in the supplementary.
Revised: We ablate our defense against white-box attacks in the supplementary.

Original: 4. Phase retrieval attack
Revised: 4. Phase retrieval attack

Original: Our defense leverages parameter obfuscation to achieve robustness.
Revised: Our defense leverages parameter obfuscation to achieve robustness.

Original: Yet, however demanding, it is still technically possible to recover the parameters through phase retrieval schemes (Gupta et al., 2019; 2020).
Revised: Yet, however demanding, it is still technically possible to recover the parameters through phase retrieval schemes (Gupta et al., 2019; 2020).

Original: To provide a thorough and fair evaluation of our attack, we study in this section phase retrieval attacks.
Revised: To provide a thorough and fair evaluation of our attack, we study in this section phase retrieval attacks.

Original: We ﬁrst consider an idealized setting, and then confront this setting with a real-world phase retrieval algorithm from (Gupta et al., 2020).
Revised: We ﬁrst consider an idealized setting, and then confront this setting with a real-world phase retrieval algorithm from (Gupta et al., 2020).

Original: Ideal retrieval model.
Revised: Ideal retrieval model.

Original: We build an idealized phase retrieval attack, where the attacker knows a certain fraction of columns, up to a certain precision.
Revised: We build an idealized phase retrieval attack, where the attacker knows a certain fraction of columns, up to a certain precision.

Original: We model the retrieved matrix U (cid:48) as a linear interpolation of the real transmission matrix U and a completely different random matrix R .
Revised: We model the retrieved matrix U (cid:48) as a linear interpolation of the real transmission matrix U and a completely different random matrix R .

Original: In practice, this model is valid only for a certain fraction of columns, and the remaining ones are modeled as independent random vectors.
Revised: In practice, this model is valid only for a certain fraction of columns, and the remaining ones are modeled as independent random vectors.

Original: We can model this with a Boolean mask matrix M , so our retrieval model in the end is:
Revised: We can model this with a Boolean mask matrix M , so our retrieval model in the end is:

Original: [Equation]
Revised: [Equation]

Original: In this setting, we vary the knowledge of the attacker from the minimum to the maximum by varying α and the percentage of retrieved columns, and we show how the performance of our defense changes in Fig.
Revised: In this setting, we vary the knowledge of the attacker from the minimum to the maximum by varying α and the percentage of retrieved columns, and we show how the performance of our defense changes in Fig.

Original: In this simpliﬁed model only a crude knowledge of the parameters seems sufﬁcient, given the sharp phase transition.
Revised: In this simpliﬁed model only a crude knowledge of the parameters seems sufﬁcient, given the sharp phase transition.

Original: We now need to chart where state-of-the-art retrieval methods are on this graph to estimate their ability to break our defense.
Revised: We now need to chart where state-of-the-art retrieval methods are on this graph to estimate their ability to break our defense.

Original: Real -world retrieval performance.
Revised: performance.

Original: State-of-the-art phase retrieval methods seek to maximize output correlation, i.e. the correlation on y in Eq.
Revised: State-of-the-art phase retrieval methods seek to maximize output correlation, i.e. the correlation on y in Eq.

Original: 1, in place of the correlation with respect to the parameters of the transmission matrix, i.e. U in Eq.
Revised: 1, in place of the correlation with respect to the parameters of the transmission matrix, i.e. U in Eq.

Original: We ﬁnd this is a signiﬁcant limitation for attackers.
Revised: We ﬁnd this is a signiﬁcant limitation for attackers.

Original: In Fig.
Revised: In Fig.

Original: 4, following numerical experiments, we highlight with a white contour the operating region of a state-of-the-art phase retrieval algorithm (Gupta et al., 2020), showing that it can manage to only partially reduce the robustness of ROPUST.
Revised: 4, following numerical experiments, we highlight with a white contour the operating region of a state-of-the-art phase retrieval algorithm (Gupta et al., 2020), showing that it can manage to only partially reduce the robustness of ROPUST.

Original: 5. Conclusion
Revised: 5. Conclusion

Original: We introduced ROPUST, a drop-in module to enhance the adversarial robustness of pretrained already robust models.
Revised: We introduced ROPUST, a drop-in module to enhance the adversarial robustness of pretrained already robust models.

Original: Our technique relies on parameter obfuscation guaranteed by a photonic co-processor, and a synthetic gradient method: it is simple, fast and widely applicable.
Revised: Our technique relies on parameter obfuscation guaranteed by a photonic co-processor, and a synthetic gradient method: it is simple, fast and widely applicable.

Original: We thoroughly evaluated our defense on nine different models in the standardized RobustBench benchmark, reaching state-of-the-art performance.
Revised: We thoroughly evaluated our defense on nine different models in the standardized RobustBench benchmark, reaching state-of-the-art performance.

Original: In light of these results, we encourage to extend RobustBench to include parameter obfuscation methods.
Revised: In light of these results, we encourage to extend RobustBench to include parameter obfuscation methods.

Original: Finally, we developed a new kind of attacks, phase retrieval attacks , speciﬁcally suited to parameter obfuscation defense such as ours, and we tested their effectiveness.
Revised: Finally, we developed a new kind of attacks, phase retrieval attacks , speciﬁcally suited to parameter obfuscation defense such as ours, and we tested their effectiveness.

Original: We found that the typical precision regime of even state-of-the-art phase retrieval methods is not enough to completely break
Revised: We found that the typical precision regime of even state-of-the-art phase retrieval methods is not enough to completely break

Original: ROPUST.
Revised: ROPUST.

Revised: arXiv preprint

Revised: PMLR.

Revised: URL http://proceedings.mlr.

Revised: press/v97/moon19a.html .

Original: Appendix Description of the attacks in AutoAttack
Revised: Appendix Description of the attacks in AutoAttack

Original: APGD-CE is a standard PGD where the step size is tuned using the loss trend information, squeezing the best performance out of a limited iterations budget.
Revised: APGD-CE is a standard PGD where the step size is tuned using the loss trend information, squeezing the best performance out of a limited iterations budget.

Original: APGD-T, on top of the step size schedule, substitutes the cross-entropy loss with the Difference of Logits Ratio (DLR) loss, reducing the risk of vanishing gradients.
Revised: APGD-T, on top of the step size schedule, substitutes the cross-entropy loss with the Difference of Logits Ratio (DLR) loss, reducing the risk of vanishing gradients.

Original: Square attack is based on a random search.
Revised: Square attack is based on a random search.

Original: Random updates δ are sampled from an attack-norm dependent distribution at each iteration: if they improve the objective function they are kept, otherwise they are discarded.
Revised: Random updates δ are sampled from an attack-norm dependent distribution at each iteration: if they improve the objective function they are kept, otherwise they are discarded.

Original: FAB attack aims at ﬁnding adversarial samples with minimal distortion with respect to the attack point.
Revised: FAB attack aims at ﬁnding adversarial samples with minimal distortion with respect to the attack point.

Original: With respect to PGD, it does not need to be restarted and it achieves fast good quality results.
Revised: With respect to PGD, it does not need to be restarted and it achieves fast good quality results.

Original: Ablation study: white-box setting
Revised: Ablation study: white-box setting

Original: We perform an ablation study and ﬁnd that the robustness of our defense against white-box attacks comes from both parameter obfuscation and DFA.
Revised: We perform an ablation study and ﬁnd that the robustness of our defense against white-box attacks comes from both parameter obfuscation and DFA.

Original: We use the model from (Wong et al., 2020) available in the RobustBench model zoo.
Revised: We use the model from (Wong et al., 2020) available in the RobustBench model zoo.

Original: It consists in a PreAct ResNet-18 (He et al., 2016), pretrained with a ”revisited” FGSM of increased effectiveness.
Revised: It consists in a PreAct ResNet-18 (He et al., 2016), pretrained with a ”revisited” FGSM of increased effectiveness.

Original: We conduct the ablation study by removing a single component of our defense at a time in simulation: binarization, DFA, parameter obfuscation, and non-linearity | .
Revised: We conduct the ablation study by removing a single component of our defense at a time in simulation: binarization, DFA, parameter obfuscation, and non-linearity | .

Original: | 2 of the random projection.
Revised: | 2 of the random projection.

Original: To remove DFA, we also remove the binarization step and train the ROPUST module with backpropagation, since we have access to the transpose of the transmission matrix in the simulated setting of the ablation study.
Revised: To remove DFA, we also remove the binarization step and train the ROPUST module with backpropagation, since we have access to the transpose of the transmission matrix in the simulated setting of the ablation study.

Original: We show the results in Fig. 5: removing the non-linearity | .
Revised: We show the results in Fig. 5: removing the non-linearity | .

Original: | 

Revised: |

Original: and the binarization does not have an effect, with the robustness given by parameter obfuscation and DFA.
Revised: and the binarization does not have an effect, with the robustness given by parameter obfuscation and DFA.

Original: Impact statement
Revised: Impact statement

Original: Adversarial attacks have been identiﬁed as a signiﬁcant threat to applications of machine learning in-the-wild.
Revised: Adversarial attacks have been identiﬁed as a signiﬁcant threat to applications of machine learning in-the-wild.

Original: Developing simple and accessible ways to make neural networks more robust is key to mitigating some of the risks and making machine learning applications safer.
Revised: Developing simple and accessible ways to make neural networks more robust is key to mitigating some of the risks and making machine learning applications safer.

Original: More robust models would enable a wider range of business applications, especially in safety-critical sectors.
Revised: More robust models would enable a wider range of business applications, especially in safety-critical sectors.

Original: We do not foresee negative societal impacts of our work, beyond the risk of our defense being broken by future developments in adversarial attacks.
Revised: We do not foresee negative societal impacts of our work, beyond the risk of our defense being broken by future developments in adversarial attacks.

Original: A limit of our work is that we prove increased robustness only empirically and not theoretically.
Revised: A limit of our work is that we prove increased robustness only empirically and not theoretically.

Original: However, theoretically grounded defense methods typically fall short of other techniques more used in practice.
Revised: However, theoretically grounded defense methods typically fall short of other techniques more used in practice.

Original: We rely on photonic hardware accessible by anyone, similarly to GPUs or
Revised: We rely on photonic hardware accessible by anyone, similarly to GPUs or

Original: TPUs on commercial cloud providers.
Revised: TPUs on commercial cloud providers.

Original: We performed all of our experiments on single-GPU nodes with NVIDIA V100, and an OPU, on a cloud provider.
Revised: We performed all of our experiments on single-GPU nodes with NVIDIA V100, and an OPU, on a cloud provider.

Original: We estimate a total of ∼ 500 GPU hours was spent.
Revised: We estimate a total of ∼ 500 GPU hours was spent.