Original:  Reducing Conﬁdence Along Adversarial Directions: Maximizing Entropy on Self-Generated Perturbations
Revised: Adversarial Unlearning: Reducing Conﬁdence Along Adversarial Directions

Original: Abstract
Revised: Abstract

Original: Supervised learning methods trained with maximum likelihood objectives oftenoverﬁt on training data.
Revised: Supervised learning methods trained with maximum likelihood objectives often overﬁt on training data.

Original: Most regularizers that prevent overﬁtting look to increaseconﬁdence on additional examples (e.g., data augmentation, adversarial training),or reduce it on training data (e.g., label smoothing).
Revised: Most regularizers that prevent overﬁtting look to increase conﬁdence on additional examples (e.g., data augmentation, adversarial training), or reduce it on training data (e.g., label smoothing).

Original: In this work we propose acomplementary regularization strategy that reduces conﬁdence on self-generatedexamples.
Revised: In this work we propose a complementary regularization strategy that reduces conﬁdence on self-generated examples.

Original: We call our regularizer RCAD: Reducing Conﬁdence along Adversarial Directions, and the key idea behind it is to reduce conﬁdence on out-of-distributionexamples lying along directions adversarially chosen to increase training loss.
Revised: The method, which we call RCAD (Reducing Conﬁdence along Adversarial Directions), aims to reduce conﬁdence on out-of-distribution examples lying along directions adversarially chosen to increase training loss.

Original: Incontrast to adversarial training, our method does not try to robustify the model tooutput the original label, but rather regularizes it to have reduced conﬁdence onpoints generated using much larger perturbations than in conventional adversarialtraining.
Revised: In contrast to adversarial training, RCAD does not try to robustify the model to output the original label, but rather regularizes it to have reduced conﬁdence on points generated using much larger perturbations than in conventional adversarial training.

Original: RCAD can be easily integrated into training pipelines with a few linesof code.
Revised: RCAD can be easily integrated into training pipelines with a few lines of code.

Original: Despite its simplicity, we ﬁnd on many classiﬁcation benchmarks that RCAD can be added to existing techniques (e.g., label smoothing, MixUp training)to increase test accuracy by 1–3 % in absolute value, with more signiﬁcant gains inthe low data regime.
Revised: Despite its simplicity, we ﬁnd on many classiﬁcation benchmarks that RCAD can be added to existing techniques (e.g., label smoothing, MixUp training) to increase test accuracy by 1–3 % in absolute value, with more signiﬁcant gains in the low data regime.

Original: We also provide a theoretical analysis that helps to explainthese beneﬁts in simpliﬁed settings, showing that RCAD can provably help themodel unlearn spurious features in the training data.
Revised: We also provide a theoretical analysis that helps to explain these beneﬁts in simpliﬁed settings, showing that RCAD can provably help the model unlearn spurious features in the training data.

Original:  Introduction
Revised:  Introduction

Original: The standard supervised learning formulation aims to train models to make accurate predictionson fresh test examples drawn from the same distribution as training data.
Revised: Supervised learning techniques typically consider training models to make accurate predictions on fresh test examples drawn from the same distribution as training data.

Original: Unfortunately, it is wellknown that maximizing the likelihood of the training data alone may result in overﬁtting.
Revised: Unfortunately, it is well known that maximizing the likelihood of the training data alone may result in overﬁtting.

Original: Prior workbroadly considers two approaches to combat this issue.
Revised: Prior work broadly considers two approaches to combat this issue.

Original: Some methods train on additional examples,e.g., generated via augmentations [53, 10, 66] or adversarial updates [14, 36, 4].
Revised: Some methods train on additional examples, e.g., generated via augmentations [53, 10, 66] or adversarial updates [14, 36, 4].

Original: Others modifythe objective by using alternative losses and/or regularization terms (e.g., label smoothing [56, 39],
Revised: Others modify the objective by using alternative losses and/or regularization terms (e.g., label smoothing [56, 39],

Original: MixUp [69], robust objectives [65, 22]).
Revised: MixUp [69], robust objectives [65, 22]).

Original: In effect, these prior approaches either make the model’spredictions more certain on new training examples or make the distribution over potential modelsless certain.
Revised: In effect, these prior approaches either make the model’s predictions more certain on new training examples or make the distribution over potential models less certain.

Original: Existing regularization methods can be seen as providing a certain inductive bias for the model, e.g.,the model’s weights should be small (i.e., weight decay), the model’s predictions should vary linearlybetween training examples (i.e., MixUp).
Revised: Existing regularization methods can be seen as providing a certain inductive bias for the model, e.g., the model’s weights should be small (i.e., weight decay), the model’s predictions should vary linearly between training examples (i.e., MixUp).

Original: In this paper we identify a different inductive bias: themodel’s predictions should be less conﬁdent on out-of-distribution inputs that look nothing like thetraining examples.
Revised: In this paper we identify a different inductive bias: the model’s predictions should be less conﬁdent on out-of-distribution inputs that look nothing like the training examples.

Original: We turn this form of inductive bias into a simple regularizer, whose beneﬁts arecomplementary to existing regularization strategies.
Revised: We turn this form of inductive bias into a simple regularizer, whose beneﬁts are complementary to existing regularization strategies.

Original: To instantiate such a method, we must be able tosample out-of-distribution examples.
Revised: To instantiate such a method, we must be able to sample out-of-distribution examples.

Original: For this, we propose a simple approach: generating adversarialexamples [38, 14] using very large step sizes (orders-of-magnitude larger than traditional adversarialtraining [36]).
Revised: For this, we propose a simple approach: generating adversarial examples [38, 14] using very large step sizes (orders-of-magnitude larger than traditional adversarial [Figure] training [36]).

Original: Hence, we ﬁrst perturb the training points using the training loss gradient, and thenmaximize predictive entropy on these adversarially perturbed examples.
Revised: Hence, we ﬁrst perturb the training points using the training loss gradient, and then maximize predictive entropy on these adversarially perturbed examples.

Original: [Figure] In contrast to adversarial training, our method does not try to robustify the model to output the originallabel, but rather regularizes it to have reduced conﬁdence on examples generated via a large stepsize (Figure 1a).
Revised: In contrast to adversarial training, our method does not try to robustify the model to output the original label, but rather regularizes it to have reduced conﬁdence on examples generated via a large step size (Figure 1a).

Original: As shown in Figure 1b, this can lead to signiﬁcant improvements in in-distributiontest accuracy unlike adversarial training [36, 37, 5, 4], which tends to decrease in-distribution testperformance [48, 70, 61].
Revised: As shown in Figure 1b, this can lead to signiﬁcant improvements in in-distribution test accuracy unlike adversarial training [36, 37, 5, 4], which tends to decrease in-distribution test performance [48, 70, 61].

Original: Compared with semi-supervised learning methods [15, 64], our methodwill not require an additional unlabeled dataset (it generates one automatically), and different fromprior works [64, 74] itwill also train the model to be less conﬁdent on these examples.
Revised: Compared with semi-supervised learning methods [15, 64], our method does not require an additional unlabeled dataset (it generates one automatically), and different from prior works [64, 74] it also trains the model to be less conﬁdent on these examples.

Original: As the self-generated samples in our procedure no longer resemble in-distribution data, we areuncertain of their labels and train the model to predict a uniform distribution over labels on them,following the principle of maximum entropy [25].
Revised: As the self-generated samples in our procedure no longer resemble in-distribution data, we are uncertain of their labels and train the model to predict a uniform distribution over labels on them, following the principle of maximum entropy [25].

Original: A few prior works [56, 43, 52, 11] have alsoconsidered using the same principle to prevent the memorization of training examples, but onlyincrease entropy on iid sampled in-distribution labeled/unlabeled data.
Revised: A few prior works [56, 43, 52, 11] have also considered using the same principle to prevent the memorization of training examples, but only increase entropy on iid sampled in-distribution labeled/unlabeled data.

Original: In contrast, we study the effectof maximizing entropy on self-generated out-of-distribution examples along adversarial directions.
Revised: In contrast, we study the effect of maximizing entropy on self-generated out-of-distribution examples along adversarial directions.

Original: The main contribution of this work is a training procedure we call RCAD: Reducing Conﬁdence along
Revised: The main contribution of this work is a training procedure we call RCAD: Reducing Conﬁdence along

Original: Adversarial Directions.
Revised: Adversarial Directions .

Original: RCAD improves test accuracy (for classiﬁcation) and log-likelihood (forregression) across multiple supervised learning benchmarks.
Revised: RCAD improves test accuracy (for classiﬁcation) and log-likelihood (for regression) across multiple supervised learning benchmarks.

Original: Importantly, we ﬁnd that the beneﬁts of
Revised: Importantly, we ﬁnd that the beneﬁts of

Original: RCAD are complementary to prior methods: Combining RCAD with alternative regularizers (e.g.,augmentation [53, 66], label smoothing [56], MixUp training [69]) further improves performance.
Revised: RCAD are complementary to prior methods: Combining RCAD with alternative regularizers (e.g., augmentation [53, 66], label smoothing [56], MixUp training [69]) further improves performance.

Original: Our method requires adding ⇠ 5 lines of code and is computationally efﬁcient (with training timeat most 1 . 3 ⇥ standard).
Revised: Our method requires adding ⇠ 5 lines of code and is computationally efﬁcient (with training time at most 1 . 3 ⇥ standard).

Original: We provide a theoretical analysis that helps to explain RCAD’s beneﬁtsin a simpliﬁed setting, showing that RCAD unlearns spurious features in the training data, therebyimproving accuracy on unseen examples.
Revised: We provide a theoretical analysis that helps to explain RCAD’s beneﬁts in a simpliﬁed setting, showing that RCAD can unlearn spurious features in the training data, thereby improving accuracy on unseen examples.

Original:  Related Work
Revised:  Related Work

Original: Below we survey common regularization techniques in machine learning, as well as other methodsthat utilize entropy maximization in training for various purposes (differing from our own).
Revised: Below we survey common regularization techniques in machine learning, as well as other methods that utilize entropy maximization in training for various purposes (differing from our own).

Original: Data augmentation.
Revised: Data augmentation.

Original: A common strategy to improve test accuracy (particularly on image tasks) is toaugment the training data with corruptions [53] or surface level variations [10, 66]
Revised: A common strategy to improve test accuracy (particularly on image tasks) is to augment the training data with corruptions [53] or surface level variations [10, 66]

Original: (e.g., rotations,random crops).
Revised: (e.g., rotations, random crops).

Original: Some methods [37, 36, 14] further augment data with imperceptibly differentadversarial examples or interpolated samples [69].
Revised: Some methods [37, 36, 14] further augment data with imperceptibly different adversarial examples or interpolated samples [69].

Original: Others [46, 42] sample new examples fromgenerative models that model the marginal density of the input distribution.
Revised: Others [46, 42] sample new examples from generative models that model the marginal density of the input distribution.

Original: Also related are semisupervised methods, which assume access to an extra set of unlabeled data and train the model tohave more conﬁdent predictions on them [15, 37].
Revised: Also related are semisupervised methods, which assume access to an extra set of unlabeled data and train the model to have more conﬁdent predictions on them [15, 37].

Original: All these methods minimize entropy [16] on theaugmented or unlabeled data to improve generalization [69, 73].
Revised: All these methods minimize entropy [16] on the augmented or unlabeled data to improve generalization [69, 73].

Original: In contrast, our method maximizesentropy on perturbed samples along the adversarial direction.
Revised: In contrast, our method maximizes entropy on perturbed samples along the adversarial direction.

Revised: [Table]

Original: Adversarial training.
Revised: Adversarial training.

Original: Deep learning models are vulnerable to worst-case perturbations that canﬂip the model’s predictions [14, 50].
Revised: Deep learning models are vulnerable to worst-case perturbations that can ﬂip the model’s predictions [14, 50].

Original: Adversarial training was proposed to improve robustness tosuch attacks by reducing worst-case loss in small regions around the training samples [36, 33, 48].
Revised: Adversarial training was proposed to improve robustness to such attacks by reducing worst-case loss in small regions around the training samples [36, 33, 48] [Table]

Original: More recently, Zhao et al.
Revised: More recently, Zhao et al.

Original: [73] proposed maximum entropy adversarial data augmentation (MEADA), which uses an information bottleneck principle to identify worst-case perturbations thatboth maximize training loss and predictive entropy. Similar to adversarial training, ME-ADA still
Revised: [73] proposed maximum entropy adversarial data augmentation (MEADA)

Original: [Table]
Revised: [Table]

Revised: which uses an information bottleneck principle to identify worst-case perturbations that both maximize training loss and predictive entropy.

Original:  minimizes cross-entropy to output the same label on new points.
Revised: Similar to adversarial training ME-ADA still minimizes cross-entropy to output the same label on new points.

Original: There are two key differencesbetween above methods and RCAD; (i) rather than minimizing cross entropy loss on adversarialexamples, we increase model’s uncertainty on the self-generated examples; and (ii) we take muchlarger steps—so large that unlike adversarial images, the generated example is no longer similarto the original one (Figure 1a).
Revised: There are two key differences between above methods and RCAD; (i) rather than minimizing cross entropy loss on adversarial examples, we increase model’s uncertainty on the self-generated examples; and (ii) we take much larger steps—so large that unlike adversarial images, the generated example is no longer similar to the original one (Figure 1a).

Original: While prior work has successfully used adversarial examples toimprove OOD detection [2] or adversarial robustness [36, 33, 48], we show that these changes allowour method to improve the standard test accuracy, a metric that adversarial training typically makesworse [48, 60, 70].
Revised: While prior work has successfully used adversarial examples to improve OOD detection [2] or adversarial robustness [36, 33, 48], we show that these changes allow our method to improve the standard test accuracy, a metric that adversarial training typically makes worse [48, 60, 70].

Original: Further, RCAD has a lower (at most 1 / 5 th ) computational cost compared to multistep adversarial training procedures [73, 70].
Revised: Further, RCAD has a lower (at most 1 / 5 th ) computational cost compared to multistep adversarial training procedures [73, 70].

Original: Robust objectives.
Revised: Robust objectives.

Original: In order to improve robustness to noise and outliers in the data, a commonapproach is to modify the objective by considering risk averse loss functions [e.g., 22, 49, 57] orincorporating regularization terms such as the l 2 /l 1 norms [31, 59].
Revised: In order to improve robustness to noise and outliers in the data, a common approach is to modify the objective by considering risk averse loss functions [e.g., 22, 49, 57] or incorporating regularization terms such as the l 2 /l 1 norms [31, 59].

Original: Our method is similar to theseapproaches in that we propose a new regularization term.
Revised: Our method is similar to these approaches in that we propose a new regularization term.

Original: However, whereas most regularization termsare applied to the model’s weights or activations, ours is directly applied to the model’s predictions.
Revised: However, whereas most regularization terms are applied to the model’s weights or activations, ours is directly applied to the model’s predictions.

Original: Another effective loss function for classiﬁcation problems is label smoothing [56, 8, 26], whichuniformly increases model’s predictive uncertainty in a region around training samples [12].
Revised: Another effective loss function for classiﬁcation problems is label smoothing [56, 8, 26], which uniformly increases model’s predictive uncertainty in a region around training samples [12].

Original: Incontrast, RCAD increases entropy only on examples generated along the adversarial direction thathas been shown to comprise of spurious features [23, 7], thereby unlearning them.
Revised: In contrast, RCAD increases entropy only on examples generated along the adversarial direction that has been shown to comprise of spurious features [23, 7], thereby unlearning them.

Original: Entropy maximization.
Revised: Entropy maximization.

Original: Finally, we note that our work builds upon prior work that draws connectionsbetween entropy maximization in supervised [52, 11, 43] and reinforcement learning [17].
Revised: Finally, we note that our work builds upon prior work that draws connections between entropy maximization in supervised [52, 11, 43] and reinforcement learning [17].

Original: Forexample, Pereyra et al.
Revised: For example, Pereyra et al.

Original: [43] apply a hinge form of conﬁdence penalty directly on training datawhich is similar to label smoothing in principle and performance (Table 2 in [43]).
Revised: [43] apply a hinge form of conﬁdence penalty directly on training data which is similar to label smoothing in principle and performance (Table 2 in [43]).

Original: Other workslike [11, 52] also adapt the principle of entropy maximization but do so either on additional unlabeleddata or a subset of the training samples.
Revised: Other works like [11, 52] also adapt the principle of entropy maximization but do so either on additional unlabeled data or a subset of the training samples.

Original: More recently [45] show that maximizing entropy oninterpolated samples from the same class improves out-of-distribution uncertainty quantiﬁcation.
Revised: More recently [45] show that maximizing entropy on interpolated samples from the same class improves out-of-distribution uncertainty quantiﬁcation.

Original: Incontrast to the above, we  minimize cross-entropy loss on training data and only maximize entropy onsamples generated along the adversarial direction.
Revised: While we also minimize cross-entropy loss on training data, in contrast to the above we maximize entropy on samples generated along the adversarial direction.

Original: Our experimental results also span a wider set ofbenchmarks and presents signiﬁcant gains +1 – 3% complementary to methods like label smoothing.
Revised: Our experimental results also span a wider set of benchmarks and presents signiﬁcant gains (+1 – 3%) complementary to methods like label smoothing.

Original: We also theoretically analyze our objective for the class of linear predictors and show how RCADcan mitigate vulnerability to spurious correlations.
Revised: We also theoretically analyze our objective for the class of linear predictors and show how RCAD can mitigate vulnerability to spurious correlations.

Original:  RCAD: Reducing Conﬁdence Along Adversarial Directions
Revised:  RCAD: Reducing Conﬁdence Along Adversarial Directions

Original: We now introduce our regularization technique of reducing conﬁdence along adversarial directions(RCAD).
Revised: We now introduce our regularization technique for reducing conﬁdence along adversarial directions (RCAD).

Original: This section will only describe the objective and an algorithm for optimizing it; Section 5presents a more formal discussion of RCAD and in Section 4 we provide our empirical study.
Revised: This section describes the objective and an algorithm for optimizing it; Section 5 presents a more formal discussion of RCAD and in Section 4 we provide our empirical study.

Original: Notation.
Revised: Notation.

Original: We are given a training dataset ˆ D ,  [Equation] x ( i ) , y ( i ) )
Revised: We are given a training dataset ˆ D ,  ( x ( i ) , y ( i ) )

Original: N i =1 where x ( i ) 2 X ,
Revised: N i =1 where x ( i ) 2 X ,

Original: y i 2 Y , aresampled iid from a joint distribution D over X ⇥ Y .
Revised: y i 2 Y , are sampled iid from a joint distribution D over X ⇥ Y .

Original: We use ˆ D to denote both the training dataset and114 an empirical measure over it.
Revised: We use ˆ D to denote both the training dataset and an empirical measure over it.

Original: The aim is to learn a parameterized distribution p w ( y | [Equation] ) , w 2 Wwhere the learnt model is typically obtained by maximizing the log-likelihood over ˆ D .
Revised: The aim is to learn a parameterized distribution p w ( y | x ) , w 2 W where the learnt model is typically obtained by maximizing the log-likelihood over ˆ D .

Original: Such a solutionis referred to as the maximum likelihood estimate (MLE): ˆ w mle , [Equation] W [Equation]
Revised: Such a solution is referred to as the maximum likelihood estimate (MLE): ˆ w mle , arg max w 2 W E

Original: ˆ [Equation] | x ) .
Revised: ˆ D log p w ( y | x ) .

Original: In the classiﬁcation setting, we measure the performance of any learned solution ˆ w using its accuracyon the test (population) data: E D
Revised: In the classiﬁcation setting, we measure the performance of any learned solution ˆ w using its accuracy on the test (population) data: E D

Original: [Equation]
Revised: [Equation]

Original: Solely optimizing the log-likelihood over the training data can lead to poor test accuracy, since theestimate ˆ w mle can overﬁt on noise in ˆ D and fail to generalize to unseen samples.
Revised: Solely optimizing the log-likelihood over the training data can lead to poor test accuracy, since the estimate ˆ w mle can overﬁt on noise in ˆ D and fail to generalize to unseen samples.

Original: Many algorithmsaim to mitigate overﬁtting by either designing suitable loss functions replacing the log-likelihood objective, or by augmenting the training set with additional data (see Section 2).
Revised: Many algorithms aim to mitigate overﬁtting by either designing suitable loss functions replacing the log-likelihood objective, or by augmenting the training set with additional data (see Section 2).

Original: Our main contributionis a new data-dependent regularization term that will depend not just on the model parameters butalso on the training dataset.
Revised: Our main contribution is a new data-dependent regularization term that will depend not just on the model parameters but also on the training dataset.

Original: We reduce conﬁdence on out-of-distribution samples that are obtained byperturbing the original inputs along the direction that adversarially maximizes training loss.
Revised: We reduce conﬁdence on out-of-distribution samples that are obtained by perturbing the original inputs along the direction that adversarially maximizes training loss.

Original: In the paragraphs that follow we describe the methodology and rationale behind our objective thatuses the following deﬁnition of model’s predictive entropy when Y is a discrete set:H w ( x ) ,
Revised: In the paragraphs that follow we describe the methodology and rationale behind our objective that uses the following deﬁnition of model’s predictive entropy when Y is a discrete set:

Original: P y Y p w ( y | x ) log p w ( y | x ) .
Revised: [Equation]

Original: In cases where Y is continuous, for example in regression tasks,we will use the differential form of predictive entropy: 
Revised: In cases where Y is continuous, for example in regression tasks, we will use the differential form of predictive entropy:

Original: R Y p w ( y | x ) log p w ( y | x ) dy .
Revised: [Equation] [Table]

Original: RCAD: Reducing Conﬁdence along Adver- sarial Directions def rcad_loss(x, y, ↵ ,  ): loss = 
Revised: def rcad_ [Equation] : loss = [Equation]

Original:  model(x).log_prob(y)
Revised: model [Equation] x [Equation]

Revised: loss

Revised: [Equation]

Revised: grad

Original: x_adv = x + ↵ * loss.grad(x) entropy = model(x_adv).entropy() return loss - * entropy
Revised: [Equation] ) entropy = model( [Equation] .entropy() return loss -

Revised: [Table]

Revised: * entropy

Original: Reducing Conﬁdence Along Adversarial Directions.
Revised: Reducing Conﬁdence Along Adversarial Directions.

Original: The key idea behind RCAD is that models should not onlymake accurate predictions on the sampled data, but alsomake uncertain predictions on examples that are very different from training data.
Revised: The key idea behind RCAD is that models should not only make accurate predictions on the sampled data, but also make uncertain predictions on examples that are very different from training data.

Original: We use directions that adversarially maximize the training loss locally around the training points to construct these out-of-distribution examplesthat are different from the training data.
Revised: We use directions that adversarially maximize the training loss locally around the training points to construct these out-of-distribution examples that are different from the training data.

Original: This is mainly because adversarial directions have been known to compriseof spurious features [23] and we want to regularize the model in a way that makes it uncertain onthese features.
Revised: This is mainly because adversarial directions have been known to comprise of spurious features [23] and we want to regularize the model in a way that makes it uncertain on these features.

Original: We ﬁrst describe how these examples are generated, and then describe how we trainthe model to be less conﬁdent.
Revised: We ﬁrst describe how these examples are generated, and then describe how we train the model to be less conﬁdent.

Original: We generate an out-of-distribution example ˜ x by taking a large gradient of the MLE objective withrespect to the input x , using a step size of ↵ > 0 :
Revised: We generate an out-of-distribution example ˜ x by taking a large gradient of the MLE objective with respect to the input x , using a step size of ↵ > 0 :

Original: [Equation]
Revised: [Equation]

Original: We train the model to make unconﬁdent predictions on these self-generated examples by maximizingthe model’s predictive entropy.
Revised: We train the model to make unconﬁdent predictions on these self-generated examples by maximizing the model’s predictive entropy.

Original: We add this entropy term H w (˜ x ) to the standard MLE objective,weighted by scalar  > 0 , yielding the ﬁnal RCAD objective:
Revised: We add this entropy term H w (˜ x ) to the standard MLE objective, weighted by scalar  > 0 , yielding the ﬁnal RCAD objective:

Original: [Equation]
Revised: [Equation]

Original: In adversarial training, adversarial examples are generated by solving a constrained optimizationproblem [36, 48].
Revised: In adversarial training, adversarial examples are generated by solving a constrained optimization problem [36, 48].

Original: Using a ﬁrst-order approximation, the adversarial example ˜ x generated by one ofthe simplest solvers [14] has a closed form resembling Equation 1.
Revised: Using a ﬁrst-order approximation, the adversarial example ˜ x generated by one of the simplest solvers [14] has a closed form resembling Equation 1.

Original: We note that RCAD is differentfrom the above form of adversarial training in two ways.
Revised: We note that RCAD is different from the above form of adversarial training in two ways.

Original: First, RCAD takes a  step size that is 10 ⇥larger, so that the resulting example no longer resembles the training examples (Figure 1a).
Revised: First, RCAD uses a much larger step size ( 10 ⇥ larger), so that the resulting example no longer resembles the training examples (Figure 1a).

Original: Second,whereas adversarial training updates the model to be more conﬁdent on the new example, RCADtrains the model to be less conﬁdent.
Revised: Second, whereas adversarial training updates the model to be more conﬁdent on the new example, RCAD trains the model to be less conﬁdent.

Original: Our experiments in Section 4 (Figure 4b) show that thesedifferences are important for improving test accuracy.
Revised: Our experiments in Section 4 (Figure 4b) show that these differences are important for improving test accuracy.

Original: Informal understanding of RCAD.
Revised: Informal understanding of RCAD.

Original: For image classiﬁcation, image features that are pure noise andindependent of the true label can still be spuriously correlated with the labels for a ﬁnite set of iiddrawn examples [54].
Revised: For image classiﬁcation, image features that are pure noise and independent of the true label can still be spuriously correlated with the labels for a ﬁnite set of iid drawn examples [54].

Original: Such features are usually termed spurious features [72].
Revised: Such features are usually termed spurious features [72].

Original: Overparameterizedneural networks have a tendency to overﬁt on spurious features in the training examples [68, 51].
Revised: Overparameterized neural networks have a tendency to overﬁt on spurious features in the training examples [68, 51].

Original: Inorder to generate unrealistic out-of-distribution samples, we pick examples that are far away fromthe true data point along the adversarial direction because (i) adversarial directions are comprised ofnoisy features that are spuriously correlated with the label on a few samples [23]; and (ii) maximizingentropy on samples with an ampliﬁed feature forces the model to quickly unlearn that feature.
Revised: In order to generate unrealistic out-of-distribution samples, we pick examples that are far away from the true data point along the adversarial direction because (i) adversarial directions are comprised of noisy features that are spuriously correlated with the label on a few samples [23]; and (ii) maximizing entropy on samples with an ampliﬁed feature forces the model to quickly unlearn that feature.

Original: Thus,by taking large step size ↵ we exacerbate the spurious features in our self-generated example ˜ x .
Revised: By using a large step size ↵ we exacerbate the spurious features in our self-generated example ˜ x .

Original: When we maximize predictive entropy over our generated examples we  force the model to unlearnthe spurious correlations.
Revised: When we maximize predictive entropy over our generated examples we then force the model to unlearn these spurious correlations.

Original: Hence, the trained model generalizes better and achieves higher predictionperformance on unseen test examples.
Revised: Hence, the trained model can generalize better and achieve higher prediction performance on unseen test examples.

Original: In Section 5 we build on this informal understanding to presenta more formal analysis on the beneﬁts of RCAD.
Revised: In Section 5 we build on this informal understanding to present a more formal analysis on the beneﬁts of RCAD.

Original:  Experiments: Does RCAD Improve Test Performance?
Revised:  Experiments: Does RCAD Improve Test Performance?

Original: Our experiments aim to study the effect that RCAD has on test accuracy, both in comparison to andin addition to existing regularization techniques and adversarial methods, so as to understand thedegree to which its effect is complementary to existing methods.
Revised: Our experiments aim to study the effect that RCAD has on test accuracy, both in comparison to and in addition to existing regularization techniques and adversarial methods, so as to understand the degree to which its effect is complementary to existing methods.

Original: Benchmark datasets.
Revised: Benchmark datasets.

Original: We use six image classiﬁcation benchmarks.
Revised: We use six image classiﬁcation benchmarks.

Original: In addition to CIFAR-10,
Revised: In addition to CIFAR-10,

Original: CIFAR-100 [30], SVHN [41] and Tiny Imagenet [34], we modify CIFAR-100 by randomly subsampling 2,000 and 10,000 training examples (from the original 50,000) to create CIFAR-100-2kand CIFAR-100-10k.
Revised: CIFAR-100 [30], SVHN [41] and Tiny Imagenet [34], we modify CIFAR-100 by randomly subsampling 2,000 and 10,000 training examples (from the original 50,000) to create CIFAR-100-2k and CIFAR-100-10k.

Original: These smaller datasets allow us to study low-data settings where we expect thegeneralization gap to be larger.
Revised: These smaller datasets allow us to study low-data settings where we expect the generalization gap to be larger.

Original: CIFAR-100(-2k/10k) share the same test sets.
Revised: CIFAR-100(-2k/10k) share the same test sets.

Original: If the validation split isnot provided by the benchmark, we hold out 10% of our training examples for validation.
Revised: If the validation split is not provided by the benchmark, we hold out 10% of our training examples for validation.

Original: Implementation details 1 .
Revised: Implementation details 2 .

Original: Unless speciﬁed otherwise, we train all methods using the ResNet-18 [19]backbone, and to accelerate training loss convergence we clip gradients in the l 2 norm (at 1 . 0 ) [71, 18].
Revised: Unless speciﬁed otherwise, we train all methods using the ResNet-18 [19] backbone, and to accelerate training loss convergence we clip gradients in the l 2 norm (at 1 . 0 ) [71, 18].

Original: We train all models for 200 epochs and use SGD with an initial learning rate of 0 . 1 and Nesterovmomentum of 0 . 9 , and decay the learning rate by a factor of 0 . 1 at epochs 100 , 150 and 180 [10].
Revised: We train all models for 200 epochs and use SGD with an initial learning rate of 0 . 1 and Nesterov momentum of 0 . 9 , and decay the learning rate by a factor of 0 . 1 at epochs 100 , 150 and 180 [10].

Original: Weselect the model checkpoint corresponding to the epoch with the best accuracy on validation samplesas the ﬁnal model representing a given training method.
Revised: We select the model checkpoint corresponding to the epoch with the best accuracy on validation samples as the ﬁnal model representing a given training method.

Original: For all datasets (except CIFAR-100-2k and
Revised: For all datasets (except CIFAR-100-2k and

Original: CIFAR-100-10k for which we used 32 and 64 respectively)
Revised: CIFAR-100-10k for which we used 32 and 64 respectively)

Original: the methods were trained with a batchsize of 128 .
Revised: the methods were trained with a batch size of 128 .

Original: For details on algorithm speciﬁc hyperparameter choices refer to Appendix B.
Revised: For details on algorithm speciﬁc hyperparameter choices refer to Appendix B.

Original: Baselines.
Revised: Baselines.

Original: The primary aim of our experiments is to study whether entropy maximization alongthe adversarial direction shrinks the generalization gap.
Revised: The primary aim of our experiments is to study whether entropy maximization along the adversarial direction shrinks the generalization gap.

Original: Hence, we explore baselines commonplacein deep learning that either (i) directly constrain the model’s predictive distribution on observedsamples (label smoothing [39]) or (ii) implicitly regularize the model by training on additional imagesgenerated in an adversarial manner.
Revised: Hence, we explore baselines commonplace in deep learning that either (i) directly constrain the model’s predictive distribution on observed samples (label smoothing [39]) or (ii) implicitly regularize the model by training on additional images generated in an adversarial manner.

Original: For the ﬁrst, our main comparisons are to label smoothing [56]),standard data augmentation [53], cutout data augmentation [66, 10], and MixUp [69] training.
Revised: For the ﬁrst, our main comparisons are to label smoothing [56]), standard data augmentation [53], cutout data augmentation [66, 10], and MixUp [69] training.

Original: Forthe second, we compare with adversarial training[36] that uses FGSM [14] to perturb the inputs.
Revised: For the second, we compare with adversarial training[36] that uses FGSM [14] to perturb the inputs.

Original: Additionally, we compare RCAD with two recent approaches that use adversarial examples indifferent ways: adversarial data augmentation (ADA) [62] and maximum entropy adversarial dataaugmentation (ME-ADA)[73].
Revised: Additionally, we compare RCAD with two recent approaches that use adversarial examples in different ways: adversarial data augmentation (ADA) [62] and maximum entropy adversarial data augmentation (ME-ADA)

Original: We summarize these baselines in Table 1.
Revised: We summarize these baselines in Table 1.

Original:  4.1 How much does RCAD improve test accuracy in comparison and in addition to otherregularization methods?
Revised: [Figure] 4.1 How much does RCAD improve test accuracy in comparison and in addition to other regularization methods?

Original: Figure 2 presents the main empirical ﬁndings of RCAD over six image classiﬁcation benchmarksand across four baseline regularizers.
Revised: Figure 2 presents the main empirical ﬁndings of RCAD over six image classiﬁcation benchmarks and across four baseline regularizers.

Original: Across all datasets, we observe that training with the RCADobjective improves the test accuracy over the baseline method in 22 / 24 cases.
Revised: Across all datasets, we observe that training with the RCAD objective improves the test accuracy over the baseline method in 22 / 24 cases.

Original: The effects are morepronounced on datasets with fewer training samples.
Revised: The effects are more pronounced on datasets with fewer training samples.

Original: For example, on CIFAR-100-2k, adding RCADon top of label smoothing boosts the performance by ⇡ 3% .
Revised: For example, on CIFAR-100-2k, adding RCAD on top of label smoothing boosts the performance by ⇡ 3% .

Original: These results also show that the beneﬁtsof RCAD are complementary to prior methods—RCAD + MixUp outperforms MixUp, and RCAD +augmentation/smoothing outperforms both.
Revised: These results also show that the beneﬁts of RCAD are complementary to prior methods—RCAD + MixUp outperforms MixUp and RCAD + augmentation/smoothing outperforms both.

Original: We test for statistical signiﬁcance using a 1-sided p -value,ﬁnding that p ⌧ 1 e  3 in 22 / 24 comparisons.
Revised: We test for statistical signiﬁcance using a 1-sided p -value, ﬁnding that p ⌧ 1 e  3 in 22 / 24 comparisons.

Original: In summary, these results show that our proposedregularizer is complementary to prior regularization techniques.
Revised: In summary, these results show that our proposed regularizer is complementary to prior regularization techniques.

Original: [Figure] 4.2 How effectively does RCAD improve test accuracy compared to adversarial training?
Revised: 4.2 How effectively does RCAD improve test accuracy compared to adversarial training?

Original: Our next set of experiments compares different ways of using adversarial examples.
Revised: Our next set of experiments compares different ways of using adversarial examples.

Original: RCAD maximizesthe model’s predictive entropy on unlabeled examples along the adversarial direction (obtained witha large step-size ⇡ 0 . 5 ).
Revised: RCAD maximizes the model’s predictive entropy on unlabeled examples along the adversarial direction (obtained with a large step-size ⇡ 0 . 5 ).

Original: In contrast, other methods we compare against (Adversarial Training [36],
Revised: In contrast, other methods we compare against (Adversarial Training [36],

Original: ADA [62], ME-ADA [62]) minimize the cross entropy loss on examples obtained by adversariallyperturbing the inputs without changing the original labels (using a much smaller step size ⇡ 0 . 05 ).
Revised: ADA [62], ME-ADA [62]) minimize the cross entropy loss on examples obtained by adversarially perturbing the inputs without changing the original labels (using a much smaller step size ⇡ 0 . 05 ).

Original: Additionally, we look at the baseline that performs label smoothing on these adversarial samples (LSon Adv) – a relaxed version of RCAD.
Revised: Additionally, we look at the baseline that performs label smoothing on these adversarial samples (LS on Adv) – a relaxed version of RCAD.

Original: We evaluate all methods by measuring their test accuracyimprovement over empirical risk minimization (ERM), noting that some of these methods wereproposed to optimize robustness, a different metric.
Revised: We evaluate all methods by measuring their test accuracy improvement over empirical risk minimization (ERM), noting that some of these methods were proposed to optimize robustness, a different metric.

Original: We show results in Figure 3a and note that
Revised: We show results in Figure 3a and note that

Original: RCAD outperforms adversarial training and LS on Adv with small step-sizes ( ↵ = 0 . 02) , ADA and
Revised: RCAD outperforms adversarial training and LS on Adv with small step-sizes ( ↵ = 0 . 02) , ADA and

Original: ME-ADA by signiﬁcant margins on all benchmarks.
Revised: ME-ADA by signiﬁcant margins on all benchmarks.

Original: We numerically verify that RCAD statisticallyoutperforms the best baseline ME-ADA by computing 1 -sided p -values ( p = 0 .
Revised: We numerically verify that RCAD statistically outperforms the best baseline ME-ADA by computing 1 -sided p -values ( p = 0 .

Original: 009 on CIFAR-10,p < 1 e  4 on others).
Revised: on CIFAR-10, p < 1 e  4 on others).

Original: Next, we look at LS on Adv with large ↵ = 0 .
Revised: Next, we look at LS on Adv with large ↵ = 0 .

Original: Since this is the same valueof ↵ used by RCAD for most datasets, this method is equivalent to performing label smoothing onexamples generated by RCAD.
Revised: Since this is the same value of ↵ used by RCAD for most datasets, this method is equivalent to performing label smoothing on examples generated by RCAD.

Original: Since label smoothing is a relaxed form of entropy maximization itis not surprising that the performance of this method is similar to (if not better than) RCAD on afew benchmarks.
Revised: Since label smoothing is a relaxed form of entropy maximization it is not surprising that the performance of this method is similar to (if not better than) RCAD on a few benchmarks.

Original: Finally, when both RCAD and ME-ADA are equipped with label smoothing, bothmethods improve, but the beneﬁt of RCAD persists ( p = 0 .
Revised: Finally, when both RCAD and ME-ADA are equipped with label smoothing, both methods improve, but the beneﬁt of RCAD persists ( p = 0 .

Original: 0478 on CIFAR-10, p < 1 e  4 on others).
Revised: 0478 on CIFAR-10, p < 1 e  4 on others).

Original: 4.3 How effective is RCAD in  low training data regime?
Revised: 4.3 How effective is RCAD in the low training data regime?

Original: Since supervised learning methods are more susceptible to overﬁtting when training samples arelimited [13], we analyze the effectiveness of RCAD in  low-data regime.
Revised: Since supervised learning methods are more susceptible to overﬁtting when training samples are limited [13], we analyze the effectiveness of RCAD in the low-data regime.

Original: To verify this, we samplesmall training datasets of size 0.5k, 1k, 2k, 5k and 10k from the 50,000 training samples in CIFAR100.
Revised: To verify this, we sample [Figure] small training datasets of size 0.5k, 1k, 2k, 5k and 10k from the 50,000 training samples in CIFAR100.

Original: The test set for each is the same as that of CIFAR-100.
Revised: The test set for each is the same as that of CIFAR-100.

Original: We train the baseline regularizersand RCAD on each of these datasets and compare the observed improvements in test accuraciesrelative to ERM.
Revised: We train the baseline regularizers and RCAD on each of these datasets and compare the observed improvements in test accuracies relative to ERM.

Original: We show our results for this experiment in Figure 3b.
Revised: We show our results for this experiment in Figure 3b.

Original: Straight away we observethat RCAD yields positive improvements in test accuracy for any training dataset size.
Revised: Straight away we observe that RCAD yields positive improvements in test accuracy for any training dataset size.

Original: In contrast, inline with the robust overﬁtting phenomena described in Raghunathan et al.
Revised: In contrast, in line with the robust overﬁtting phenomena described in Raghunathan et al.

Original: [48, 47], Zhang et al.
Revised: [48, 47], Zhang et al.

Original: [70],adversarial training (with FGSM [14]) is found to be hurtful in some settings.
Revised: [70], adversarial training (with FGSM [14]) is found to be hurtful in some settings.

Original: Next we observethatcompared to typical regularizers for supervised learning like label smoothing and data augmentation,the regularization effect of RCAD has a stronger impact as the size of the training data reduces. Notice thatRCAD has a steeper upward trend (right ! left) compared to the next best method labelsmoothing, while outperforming each baseline in terms of absolute performance values.
Revised: Next we observe that

Original: 4.4 Additional Results and Ablations
Revised: 4.4 Additional Results and Ablations

Original: In addition to the experiments below on wider architectures, effect of step size ↵ , and regression tasks,we conduct more analysis and experiments for RCAD (e.g., evaluating its robustness to adversarialperturbations and distribution shifts).
Revised: In addition to the experiments below on wider architectures, effect of step size ↵ , and regression tasks, we conduct more analysis and experiments for RCAD (e.g., evaluating its robustness to adversarial perturbations and distribution shifts).

Original: For these and other experimental details refer to Appendix B, C.
Revised: For these and other experimental details refer to Appendix B, C.

Original: Results on a larger architecture.
Revised: Results on a larger architecture.

Original: We compare the test accuracies of RCAD and ME-ADA (mostcompetitive baseline from ResNet-18 experiments) when trained with the larger backbone Wide
Revised: We compare the test accuracies of RCAD and ME-ADA (most competitive baseline from ResNet-18 experiments) when trained with the larger backbone Wide

Original: ResNet 28-10 [67] (WRN) on CIFAR-100 and its derivatives.
Revised: ResNet 28-10 [67] (WRN) on CIFAR-100 and its derivatives.

Original: We plot these test accuracies relative to
Revised: We plot these test accuracies relative to

Original: [Figure] ERM trained with WRN in Figure 4a.
Revised: ERM trained with WRN in Figure 4a.

Original: Clearly, the beneﬁt of RCAD over ME-ADA still persists albeitwith slightly diminished absolute performance differences compared to ResNet-18 in Figure 3a.
Revised: Clearly, the beneﬁt of RCAD over ME-ADA still persists albeit with slightly diminished absolute performance differences compared to ResNet-18 in Figure 3a.

Original: Effect of step size ↵ on test accuracy.
Revised: Effect of step size ↵ on test accuracy.

Original: In Figure 4b we plot the test accuracy of RCAD on CIFAR100-2k as we vary the step size ↵ .
Revised: In Figure 4b we plot the test accuracy of RCAD on CIFAR100-2k as we vary the step size ↵ .

Original: We see that RCAD is effective only when the step size is sufﬁcientlylarge ( > 0 . 5 ), so that new examples do not resemble the original ones.
Revised: We see that RCAD is effective only when the step size is sufﬁciently large ( > 0 . 5 ), so that new examples do not resemble the original ones.

Original: When the step size is small( < 0 . 5) , the perturbations are small and the new example is indistinguishable from the original, as inadversarial training.
Revised: When the step size is small ( < 0 . 5) , the perturbations are small and the new example is indistinguishable from the original, as in adversarial training.

Original: Our theory in Section 5 also agrees with this observation.
Revised: Our theory in Section 5 also agrees with this observation.

Original: Results on regression tasks.
Revised: Results on regression tasks.

Original: On ﬁve regression datasets from the UCI repository we compare theperformance of RCAD with ERM and ME-ADA in terms of test negative log-likelihood (NLL) ( # isbetter).
Revised: On ﬁve regression datasets from the UCI repository we compare the performance of RCAD with ERM and ME-ADA in terms of test negative log-likelihood (NLL) ( # is better).

Original: To be able to compute NLL, we model the predictive distribution p w ( y | x ) as a Gaussianand each method outputs two parameters (mean, variance of p w ( y | x ) ) at each input x .
Revised: To be able to compute NLL, we model the predictive distribution p w ( y | x ) as a Gaussian and each method outputs two parameters (mean, variance of p w ( y | x ) ) at each input x .

Original: For the
Revised: For the

Original: RCAD regularizer we use the differential form of entropy.
Revised: RCAD regularizer we use the differential form of entropy.

Original: Results are shown in Figure 4c from whichwe see that RCAD matches/improves over baselines on 4/5 regression datasets.
Revised: Results are shown in Figure 4c from which we see that RCAD matches/improves over baselines on 4/5 regression datasets.

Original:  Analysis: Why Does RCAD Improve Test Performance?
Revised:  Analysis: Why Does RCAD Improve Test Performance?

Original: In this section, we present theoretical results that provide a more formal explanation as to why wesee a boost in test accuracy when we regularize a classiﬁer using RCAD.
Revised: In this section, we present theoretical results that provide a more formal explanation as to why we see a boost in test accuracy when we regularize a classiﬁer using RCAD.

Original: We analyze the simpliﬁedproblem of learning l 2 -regularized linear predictors in a fully speciﬁed binary classiﬁcation setting.
Revised: We analyze the simpliﬁed problem of learning l 2 -regularized linear predictors in a fully speciﬁed binary classiﬁcation setting.

Original: Speciﬁcally, our analysis will show that, while linear predictors trained with standard ERM can havea high dependence on spurious features, further optimization with the RCAD objective will cause theclassiﬁer to unlearn these spurious features.
Revised: Speciﬁcally, our analysis will show that, while linear predictors trained with standard ERM can have [Figure] a high dependence on spurious features, further optimization with the RCAD objective will cause the classiﬁer to unlearn these spurious features.

Original: The intuition behind our result can be summarized as follows: when RCAD generates examples aftertaking a large step along adversarial directions, a majority of the generated examples end up lyingclose to the decision boundary along the true feature, and yet a portion of them would signiﬁcantlydepend on the noisy spurious features.
Revised: The intuition behind our result can be summarized as follows: when RCAD generates examples after taking a large step along adversarial directions, a majority of the generated examples end up lying close to the decision boundary along the true feature, and yet a portion of them would signiﬁcantly depend on the noisy spurious features.

Original: Thus, when RCAD maximizes the predictive entropy onthese new examples, the classiﬁer weights that align with the spurious components are driven towardsmaller values.
Revised: Thus, when RCAD maximizes the predictive entropy on these new examples, the classiﬁer weights that align with the spurious components are driven toward smaller values.

Original: Detailed proofs for the analysis that follows can be found in Appendix A.
Revised: Detailed proofs for the analysis that follows can be found in Appendix A.

Original: Setup.
Revised: Setup.

Original: We consider a binary classiﬁcation problem with a joint distribution D over ( x , y )[-
-]
Revised: We consider a binary classiﬁcation problem with a joint distribution D over ( x , y )[-
-]

Original: X ⇥ { 0 , 1 } where X ✓ R d +1 with x = [ x 1 , x 2 ] > , x 1 2 R , x 2 2 R d and for some  > 0 , D is:y ⇠ Unif {  1 , 1 } , x 1 ⇠ N (  · y ,  21 ) , x 2 ⇠ N ( 0 , ⌃ 2 ) , and let ˜ ⌃ , 
Revised: X ⇥ { 0 , 1 } where X ✓ R d +1 with x = [ x 1 , x 2 ] > , x 1 2 R , x 2 2 R d and for some  > 0 , D is: y ⇠ Unif {  1 , 1 } , x 1 ⇠ N (  · y ,  21 ) , x 2 ⇠ N ( 0 , ⌃ 2 ) , and let ˜ ⌃ , [Equation]

Original: [Equation]
Revised: [Equation]

Original: We borrow this setup from Chen et al.
Revised: We borrow this setup from Chen et al.

Original: [7] which analyzes self-training/entropy minimization onunlabeled out-of-distribution samples.
Revised: [7] which analyzes self-training/entropy minimization on unlabeled out-of-distribution samples.

Original: While their objective is very different from RCAD, their setupis relevant for our analysis since it captures two kinds of features: x 1 , which is the true univariatefeature that is predictive of the label y, and x 2 , which is the high dimensional noise , that is notcorrelated with the label under the true distribution D , but w.h.p. is correlated with the label on ﬁnitesampled training dataset
Revised: While their objective is very different from RCAD, their setup is relevant for our analysis since it captures two kinds of features: x 1 , which is the true univariate feature that is predictive of the label y, and x 2 , which is the high dimensional noise , that is not correlated with the label under the true distribution D , but w.h.p. is correlated with the label on ﬁnite sampled training dataset

Original: ˆ D = { ( x ( i ) , y ( i ) ) }
Revised: ˆ D = { ( x ( i ) , y ( i ) ) }

Original: ni =1 ⇠ D n .
Revised: ni =1 ⇠ D n .

Original: We wish to learn the class of homogeneouslinear predictors W , { w 2 R d +1 : h w , x i = w 1 · x 1 + w 2 · x 2 , k w k 2 6 1 } .
Revised: We wish to learn the class of homogeneous linear predictors W , { w 2 R d +1 : h w , x i = w 1 · x 1 + w 2 · x 2 , k w k 2 6 1 } .

Original: For mathematical282 convenience we make three modiﬁcations to the RCAD objective in Equation 2 that are commonin works analyzing logistic classiﬁers and entropy based objectives [55, 7]: (i) we minimize the[Figure] margin loss l  ( w ; ( x , y )) , max(0 ,   y · h w , x i ) (instead of the negative log-likelihood) over D 0with some  > 0 ; (ii) we consider the constrained optimization problem in Equation 4 as opposedto the Lagrangian form of RCAD in Equation 2 [35]; and (iii) we use Lemma 5.1 and replace
Revised: For mathematical convenience we make three modiﬁcations to the RCAD objective in Equation 2 that are common in works analyzing logistic classiﬁers and entropy based objectives [55, 7]: (i) we minimize the margin loss l  ( w ; ( x , y )) , max(0 ,   y · h w , x i ) (instead of the negative log-likelihood) over Dwith some  > 0 ; (ii) we consider the constrained optimization problem in Equation 4 as opposed to the Lagrangian form of RCAD in Equation 2 [35]; and (iii) we use Lemma 5.1 and replace

Original: H w ( x + ↵ · r x l  ( w ; ( x , y ))) with exp(  | h w , x + ↵ · r x l  ( w ; ( x , y ))
Revised: H w ( x + ↵ · r x l  ( w ; ( x , y ))) with exp(  | h w , x + ↵ · r x l  ( w ; ( x , y ))

Original: i | ) .
Revised: i | ) .

Original: Note that the optimal w ⇤[-
-]
Revised: Note that the optimal w ⇤[-
-]

Original: W that has the best test accuracy and lowest population margin loss is given by w ⇤ , [1 , 0 , . . .
Revised: W that has the best test accuracy and lowest population margin loss is given by w ⇤ , [1 , 0 , . . .

Original: , 0] > .
Revised: , 0] > .

Revised: [Equation]

Original: [Equation]
Revised: [Equation]

Original: Lemma 5.1 ([6, 55], informal) .
Revised: Lemma 5.1 ([6, 55], informal) .

Original: H w ( x ) =
Revised: H w ( x ) =

Original: H bin ((1 + exp( h w , x i ))  1 ) where H bin ( p ) is theentropy of Bern( p ) distribution.
Revised: H bin ((1 + exp( h w , x i ))  1 ) where H bin ( p ) is the entropy of Bern( p ) distribution.

Original: Thus H w ( x ) ⇡ exp(  | h w , x i | ) , as both exhibit same tail behavior.
Revised: Thus H w ( x ) ⇡ exp(  | h w , x i | ) , as both exhibit same tail behavior.

Original: We analyze the RCAD estimate ˆ w rcad , w ( T ) returned after T iterations of projected gradientascent on the non-convex objective in Equation 4, initialized with w (0) satisfying the constraints in Equation 4.
Revised: We analyze the RCAD estimate ˆ w rcad , w ( T ) returned after T iterations of projected gradient ascent on the non-convex objective in Equation 4, initialized with w (0) satisfying the constraints in Equation 4.

Original: Given the projection ⇧ S onto the convex set S , and learning rate ⌘ > 0 , the update rulefor w ( t ) is as follows:
Revised: Given the projection ⇧ S onto the convex set S , and learning rate ⌘ > 0 , the update rule for w ( t ) is as follows:

Original: ˜ w ( t +1) =
Revised: ˜ w ( t +1) =

Original: w ( t ) + ⌘ · r w ( t ) M ˆ D ( w ) , and w ( t +1)
Revised: w ( t ) + ⌘ · r w ( t ) M ˆ D ( w ) , and w ( t +1)

Original: =
Revised: =

Original: ⇧ k w k 2 6 1 ˜ w ( t +1) .
Revised: ⇧ k w k 2 6 1 ˜ w ( t +1) .

Original: Since theinitialization w (0) satisﬁes the constraint in Equation 4, it has a low margin loss on training samplesand usinga margin based generalization gap [27]stated in Lemma 5.2 we can conclude w.h.p.
Revised: Since the initialization w (0) satisﬁes the constraint in Equation 4, it has a low margin loss on training samples and using margin based generalization gaps [27] we can conclude w.h.p.

Original: w (0)has low test error ( 6 ⇢ ) .
Revised: w (0) has low test error ( 6 ⇢ ) .

Original: This, in turn tells us that w (0) should have learnt the true feature x 1 to someextent (Lemma 5.3).
Revised: This, in turn tells us that w (0) should have learnt the true feature x 1 to some extent (Lemma 5.2).

Original: Intuitively, if the classiﬁer is not trained at all, then adversarial directions wouldbe less meaningful since they may include a higher component of the true feature x 1 , as opposed tonoisy x 2 .
Revised: Intuitively, if the classiﬁer is not trained at all, then adversarial directions would be less meaningful since they may include a higher component of the true feature x 1 , as opposed to noisy x 2 .

Original: To obtain w (0) , we simply minimize loss l  on ˆ D using projected (onto k w k 2 6 1 ) gradientdescent and the ERM solution ˆ w erm serves as the initialization w (0) for RCAD’s gradient ascentiterations.
Revised: To obtain w (0) , we simply minimize loss l  on ˆ D using projected (onto k w k 2 6 1 ) gradient descent and the ERM solution ˆ w erm serves as the initialization w (0) for RCAD’s gradient ascent iterations.

Original: Note that ˆ w erm still signiﬁcantly depends on spurious features (see Figure 5).
Revised: Note that ˆ w erm still signiﬁcantly depends on spurious features (see Figure 5).

Original: Furthermore,this dependence is unavoidable and worse when n is small, or when the noise dimension d is large.
Revised: Furthermore, this dependence is unavoidable and worse when n is small, or when the noise dimension d is large.

Original: Lemma 5.2 (generalization gap) .

Original: With probability 1   over ˆ D , 8 w 2 W , E D

Original: [-[ ( y · h w , x i < 0)] 
-]
Revised: [-[ ( y · h w , x i < 0)] 
-]

Original: [Equation]

Original: [Equation]

Original: [Equation]

Original: ◆

Original: [Equation]

Original: hides poly-log factors in  ,  , k ˜ ⌃ k .

Original: Lemma 5.3 (true feature is partially learnt before RCAD) .
Revised: Lemma 5.2 (true feature is partially learnt before RCAD) .

Original: If w (0) satisﬁes constraint in Equation 4,and when n >
Revised: If w (0) satisﬁes constraint in Equation 4, and when n >

Original: [Equation]
Revised: [Equation]

Original: , with probability1   [Equation] ˆ D ,
Revised: probability

Original: [Equation]
Revised: [Equation]

Original: We are now ready to present our main results in Theorem 5.4 which states that after T
Revised: We are now ready to present our main results in Theorem 5.3 which states that after T

Original: = O (log(1 / ✏ ))
Revised: = O (log(1 / ✏ ))

Original: gradient ascent iterations of optimizing the RCAD objective ˆ w rcad is ✏ close to w ⇤ , since it unlearnsthe spurious feature ( k w ( T ) 2 k 2 6 ✏ ) and ampliﬁes the true feature ( | w ( T ) 1 | > p 1  ✏ 2 ) .
Revised: gradient ascent iterations of optimizing the RCAD objective ˆ w rcad is ✏ close to w ⇤ , since it unlearns the spurious feature ( k w ( T ) 2 k 2 6 ✏ ) and ampliﬁes the true feature ( | w ( T ) 1 | > p 1  ✏ 2 ) .

Original: Note that
Revised: Note that

Original: Theorem 5.4 suggests a minimum step size ↵ in arriving at a sufﬁcient condition for RCAD to unlearnspuriousness and improve test performance This is also in line with our empirical ﬁndings (Figure 4b).
Revised: Theorem 5.3 suggests a minimum step size ↵ in arriving at a sufﬁcient condition for RCAD to unlearn spuriousness and improve test performance This is also in line with our empirical ﬁndings (Figure 4b).

Original: Since ↵ = ⇥ (  ) , most of the points generated by RCAD lie close to the decision boundary along x 1 ,except for the ones with noisy features that are correlated with the classiﬁer weights.
Revised: Since ↵ = ⇥ (  ) , most of the points generated by RCAD lie close to the decision boundary along x 1 , except for the ones with noisy features that are correlated with the classiﬁer weights.

Original: Theorem 5.4 ( ˆ w rcad !
Revised: Theorem 5.3 ( ˆ w rcad !

Original: w ⇤ ) .
Revised: w ⇤ ) .

Original: If  = ⌦ ( k ˜ ⌃ k op ) and 9 c 0 , K > 0 , such that  > ⇠ ↵ > ⇠ max(  , k ˜ ⌃ k op )and  + c 0 ·  min (˜ ⌃ ) >  , then with n > ⇠ [Equation]
Revised: If  = ⌦ ( k ˜ ⌃ k op ) and 9 c 0 , K > 0 , such that  > ⇠ ↵ > ⇠ max(  , k ˜ ⌃ k op ) and  + c 0 ·  min (˜ ⌃ ) >  , then with n > ⇠  2 +log(1 /  ) · k ˜ ⌃

Original: p 2  min [Equation]
Revised: k op + k ˜ ⌃ k

Original: ⌃ )
Revised: ⇤  2 erfc ⇣

Original:  ⌘ 2 + [Equation] /  ✏ 4 , after T 
Revised: K ↵ / p 2  min (˜ ⌃ ) ⌘ 2 + log1 /  ✏ 4 , after T =

Original: = O (log(1 / ✏ )) gradient ascent iterations, | w ( T ) 1 | > p 1  ✏ 2 and k w ( T ) 2 k 2 6 ✏ , with probability 1   over D 0 .
Revised: O (log(1 / ✏ )) gradient ascent iterations, | w ( T ) 1 | > p 1  ✏ 2 and k w ( T ) 2 k 2 6 ✏ , with probability 1   over D 0 .

Original: The key idea behind our guarantee above is an inductive argument.
Revised: The key idea behind our guarantee above is an inductive argument.

Original: We show that, if the classseparation  and step size ↵ are sufﬁciently larger than any noise variance, then RCAD monotonicallyincreases the weight norm along the true feature and monotonically decreases it along the noisydimensions with each gradient ascent update.
Revised: We show that, if the class separation  and step size ↵ are sufﬁciently larger than any noise variance, then RCAD monotonically increases the weight norm along the true feature and monotonically decreases it along the noisy dimensions with each gradient ascent update.

Original: This is because at any given instant the gradient of
Revised: This is because at any given instant the gradient of

Original: RCAD objective M D ( w ) with respect to w 1 always points in the same direction, while the one withrespect to w 2 is sufﬁciently anti-correlated with the direction of w 2 .
Revised: RCAD objective M D ( w ) with respect to w 1 always points in the same direction, while the one with respect to w 2 is sufﬁciently anti-correlated with the direction of w 2 .

Original: We formalize this argumentin Lemma 5.5.
Revised: We formalize this argument in Lemma 5.4.

Original: It is also easy to see why the update will improve test accuracy monotonically, thussatisfying the constraint in Equation 4 with high probability.
Revised: It is also easy to see why the update will improve test accuracy monotonically, thus satisfying the constraint in Equation 4 with high probability.

Original: Lemma 5.5 ( w 1 , w 2 update) .
Revised: Lemma 5.4 ( w 1 , w 2 update) .

Original: If ↵ ,  ,  and sample size n satisfy the noise conditions in Theorem 5.4, then h @ M D ( w ) @
Revised: If ↵ ,  ,  and sample size n satisfy the noise conditions in Theorem 5.3, then h @ M D ( w ) @

Original: w ( t ), w ( t ) 1 i > 0 , and | ˜ w ( t +1)| > | w ( t ) 1 | .
Revised: w ( t ), w ( t ) 1 i > 0 , and | ˜ w ( t +1)| > | w ( t ) 1 | .

Original: On the other hand, 9 c 1 > 0 such thathr w ( t ) 2 M D ( w ( t ) ) , w ( t ) 2 i 6  c 1 · k w ( t ) 2 k 22 .
Revised: On the other hand, 9 c 1 > 0 such that [Equation] i 6  c 1 · k w ( t ) 2 k 22 .

Original: Consequently 9 ⌘ , such that k ˜ w ( t +1)k 2 / k w ( t ) 2 k 2 < 1 .
Revised: Consequently 9 ⌘ , such that k ˜ w ( t +1) [Equation]

Original: Empirically validating our theoretical results in the toy setup.
Revised: Empirically validating our theoretical results in the toy setup.

Original: Now, using the same setup as ourtheoretical study, we check if taking the ERM solution and updating it with RCAD truly helps inunlearning the spurious feature x 2 and amplifying the true feature x 1 .
Revised: Now, using the same setup as our theoretical study, we check if taking the ERM solution and updating it with RCAD truly helps in unlearning the spurious feature x 2 and amplifying the true feature x 1 .

Original: With d = 8 ,  = 2 . 0 ,  =0 .
Revised: With d = 8 ,  = 2 . 0 ,  = 0 .

Original: 5 ,  1 = 0 .
Revised: 5 ,  1 = 0 .

Original: 1 , ⌃ =
Revised: 1 , ⌃ =

Original: I d we collect training dataset ˆ D of size 20 according to the data distributionin Equation 3.
Revised: I d we collect training dataset ˆ D of size 20 according to the data distribution in Equation 3.

Original: First, we obtain the ERM solution ˆ w erm by optimizing the margin loss on ˆ D for100 projected gradient descent iterations.
Revised: First, we obtain the ERM solution ˆ w erm by optimizing the margin loss on ˆ D for 100 projected gradient descent iterations.

Original: Then, with ˆ w erm as initialization we optimize the RCADobjective in Equation 4 for 100 additional projected gradient ascent iterations to obtain RCADestimate ˆ w rcad .
Revised: Then, with ˆ w erm as initialization we optimize the RCAD objective in Equation 4 for 100 additional projected gradient ascent iterations to obtain RCAD estimate ˆ w rcad .

Original: For RCAD, we try both small ( ↵ = 0 . 01) and large ( ↵ = 0 . 7) values of the step size.
Revised: For RCAD, we try both small ( ↵ = 0 . 01) and large ( ↵ = 0 . 7) values of the step size.

Original: Using the results of this study in Figure 5 we shall now verify our main theoretical claims:
Revised: Using the results of this study in Figure 5 we shall now verify our main theoretical claims:

Original: (i) RCAD unlearns spurious features learnt by ERM (Theorem 5.4): RCAD training with largestep size ↵ = 0 .
Revised: (i) RCAD unlearns spurious features learnt by ERM (Theorem 5.3): RCAD training with large step size ↵ = 0 .

Original: 7 corrects ERM’s decision boundaries across all noisy dimensions i.e., ˆ w rcad hasalmost no dependence on noisy dimensions { x i } i =8 i [-=
-] (Figure 5a
Revised: 7 corrects ERM’s decision boundaries across all noisy dimensions i e., ˆ w rcad has almost no dependence on noisy dimensions { x i } i =8 i [-=
-]=2 (Figure 5a).

Original: On the other hand, the ERM solution has a signiﬁcant non-zero component across all noisy dimensions (except x 7 ).
Revised: On the other hand, the ERM solution has a signiﬁcant non-zero component across all noisy dimensions (except x 7 ).

Original: (ii) RCAD is helpful only when step size is large enough (Theorem 5.4): In Figure 5a we seethat RCAD estimate with small step size ↵ = 0 .
Revised: (ii) RCAD is helpful only when step size is large enough (Theorem 5.3): In Figure 5a we see that RCAD estimate with small step size ↵ = 0 .

Original: 01 has a higher dependence on spurious featurescompared to ERM
Revised: 01 has a higher dependence on spurious features compared to ERM.

Original: Thus optimizing RCAD with a very small ↵ leads to an even poor solution than ERM
Revised: Thus optimizing RCAD with a very small ↵ leads to an even poor solution than ERM.

Original: This is because, the perturbed data point still has a signiﬁcant component of the true 
Revised: This is because, the perturbed data point still has a signiﬁcant component of the true feature, which the model is forced to unlearn when RCAD tries to maximize

Original: feature, which the model is forced to unlearn when RCAD tries to maximize entropy over the perturbed point.
Revised: entropy over the perturbed point.

Original: (iii)
Revised: (iii)

Original: The weight norms | w 1 | and k w 2 k 2 change monotonically through RCAD iterations Lemma
Revised: The weight norms | w 1 | and k w 2 k 2 change monotonically through RCAD iterations (Lemma 5.

Original: In Figure 5b we seethat
Revised: In Figure 5b we see

Original:  the norm along the true feature
Revised: that the norm along the true feature

Original: | w 1 | increases monotonically through
Revised: | w 1 | increases monotonically through

Original: RCAD
Revised: RCAD

Original: iterations whereas k w 2 k 2 decreases monotonically, until | w 1 | ⇡ 1 and k w 2 k 2 ⇡ 0 .
Revised: iterations, whereas k w 2 k 2 decreases monotonically, until | w 1 | ⇡ 1 and k w 2 k 2 ⇡ 0 .

Original: Thus, RCAD successfully recovers optimal w ⇤ .
Revised: Thus, RCAD successfully recovers optimal w ⇤ .

Original: Based on this, we also see the test accuracy increasemonotonically through RCAD iterations; reaching 100% by the end of it (Figure 5c).
Revised: Based on this, we also see the test accuracy increase monotonically through RCAD iterations; reaching 100% by the end of it (Figure 5c).

Original: In contrast,since the ERM solution depends on spurious features, its accuracy does not improve beyond 70% inthe ﬁrst 100 iterations.
Revised: In contrast, since the ERM solution depends on spurious features, its accuracy does not improve beyond 70% in the ﬁrst 100 iterations.

Original: We ﬁnd that training ERM for more iterations only improves training accuracy.
Revised: We ﬁnd that training ERM for more iterations only improves training accuracy.

Original: The analysis above explains why RCAD improves test performance in the linear setting and it isinline with our intuition of RCAD’s ability to unlearn spurious features.
Revised: The analysis above explains why RCAD improves test performance in the linear setting and it is inline with our intuition of RCAD’s ability to unlearn spurious features.

Original: To check if our intuition alsogeneralizes to deeper networks we further study RCAD’s behaviour in a non-linear setting using adifferent toy example in Appendix D. Furthermore, while our analysis is restricted to linear classiﬁers,linear models can provide a rough proxy for neural network learning dynamics via the neural tangentkernel (NTK) approximation [24].
Revised: To check if our intuition also generalizes to deeper networks we further study RCAD’s behaviour in a non-linear setting using a different toy example in Appendix D. Furthermore, while our analysis is restricted to linear classiﬁers, linear models can provide a rough proxy for neural network learning dynamics via the neural tangent kernel (NTK) approximation [24].

Original: This strategy has been used in a number of prior works [40, 58, 3]and extending the analysis to the NTK setting may be possible in future work.
Revised: This strategy has been used in a number of prior works [40, 58, 3] and extending the analysis to the NTK setting may be possible in future work.

Original:  Conclusion
Revised:  Conclusion

Original: In this paper we propose RCAD, a regularization technique that maximizes a model’s predictiveentropy on out-of-distribution examples.
Revised: In this paper we propose RCAD, a regularization technique that maximizes a model’s predictive entropy on out-of-distribution examples.

Original: These samples lie along the directions that adversariallymaximize the loss locally around the training points.
Revised: These samples lie along the directions that adversarially maximize the loss locally around the training points.

Original: Our experiments on image classiﬁcationbenchmarks show that RCAD not only improves test accuracy by a signiﬁcant margin, but that itcan also seamlessly compose with prior regularization methods.
Revised: Our experiments on image classiﬁcation benchmarks show that RCAD not only improves test accuracy by a signiﬁcant margin, but that it can also seamlessly compose with prior regularization methods.

Original: We ﬁnd that RCAD is particularlyeffective when learning from limited data.
Revised: We ﬁnd that RCAD is particularly effective when learning from limited data.

Original: Finally, we present analyses in a simpliﬁed setting to showthat RCAD can help the model unlearn noisy features.
Revised: Finally, we present analyses in a simpliﬁed setting to show that RCAD can help the model unlearn noisy features.

Original: Some current limitations of our work are that
Revised: Some current limitations of our work are that

Original: RCAD slows training by 30% and our theoretical analysis is limited to the linear case, which wouldbe interesting directions to address/expand on in future work—particularly in light of the signiﬁcantempirical beneﬁts of RCAD for improving generalization.Checklist The checklist follows the references.
Revised: RCAD slows training by 30% and our theoretical analysis is limited to the linear case, which would be interesting directions to address/expand on in future work—particularly in light of the signiﬁcant empirical beneﬁts of RCAD for improving generalization.

Original: Please read the checklist guidelines carefully for information onhow to answer these questions.

Original: For each question, change the default [TODO] to [Yes] , [No] , or[N/A] .

Original: You are strongly encouraged to include a justiﬁcation to your answer , either by referencingthe appropriate section of your paper or providing a brief inline description.

Original: For example:

Original: • Did you include the license to the code and datasets?

Original: • Did you include the license to the code and datasets?

Original: [No] The code and the data are

Original: proprietary.

Original: • Did you include the license to the code and datasets?

Original: [N/A]

Original: Please do not modify the questions and only use the provided macros for your answers.

Original: Note that the

Original: Checklist section does not count towards the page limit.

Original: In your paper, please delete this instructions block and only keep the Checklist section heading above along with the questions/answers below.

Original: (a) Do the main claims made in the abstract and introduction accurately reﬂect the paper’s

Original: contributions and scope?

Original: [Yes]

Original: (b) Did you describe the limitations of your work?

Original: [Yes] See Sec. 6.

Original: (c) Did you discuss any potential negative societal impacts of your work?

Original: [No] While su-

Original: pervised learning might be used in applications with both positive and negative societal

Original: impacts, our empirical and theoretical contributions do not dictate these potential appli-

Original: cations.

Original: (d) Have you read the ethics review guidelines and ensured that your paper conforms to

Original: them?

Original: [Yes]

Original: If you are including theoretical results...

Original: (a) Did you state the full set of assumptions of all theoretical results?

Original: [Yes]

Original: (b) Did you include complete proofs of all theoretical results?

Original: [Yes] We provide them in

Original: the Appendix, as part of the supplementary submission.

Original: If you ran experiments...

Original: (a) Did you include the code, data, and instructions needed to reproduce the main experi-

Original: mental results (either in the supplemental material or as a URL)?

Original: [Yes]

Original: (b) Did you specify all the training details (e

Original: g., data splits, hyperparameters, how theywere chosen)? [Yes] We document these in the Appendix, as part of the supplementary submission. (c) Did you report error bars (e
Revised: Acknowledgements.

Original: g., with respect to the random seed after running experi-

Original: ments multiple times)?

Original: [Yes] For our results in Section 4, we provide error bars for the

Original: estimated test performance.

Original: (d) Did you include the total amount of compute and the type of resources used (e

Original: g., typeof GPUs, internal cluster, or cloud provider)?

Original: [Yes] Details in Appendix.

Original: If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...

Original: (a) If your work uses existing assets, did you cite the creators?

Original: [Yes] We use public datasets

Original: and cite the creators. (b) Did you mention the license of the assets? [N/A]
Revised: The authors would like to thank Oscar Li, Ziyu Liu, Saurabh Garg at Carnegie

Original: (c) Did you include any new assets either in the supplemental material or as a URL?

Original: [No]

Original: (d) Did you discuss whether and how consent was obtained from people whose data you’re

Original: using/curating?

Original: [N/A]

Original: (e) Did you discuss whether the data you are using/curating contains personally identiﬁable

Original: information or offensive content?

Original: [N/A]

Original: If you used crowdsourcing or conducted research with human subjects...

Original: (a) Did you include the full text of instructions given to participants and screenshots, if

Original: applicable?

Original: [N/A] (b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, if applicable? [N/A]
Revised: Mellon University and members of the RAIL lab at UC Berkeley for helpful feedback and discussion.

Original: (c) Did you include the estimated hourly wage paid to participants and the total amount

Original: spent on participant compensation?

Original: [N/A]