Original: Ensemble-in-One: Learning Ensemble within Random Gated Networks for Enhanced Adversarial Robustness
Revised: Ensemble-in-One: Learning Ensemble within Random Gated Networks for Enhanced Adversarial Robustness

Original: Anonymous authors

Original: Abstract
Revised: Abstract

Original: Adversarial attacks have threatened modern deep learning systems by crafting adversarial examples with small perturbations to fool the convolutional neural networks (CNNs).
Revised: Adversarial attacks have threatened modern deep learning systems by crafting adversarial examples with small perturbations to fool the convolutional neural networks (CNNs).

Original: Ensemble training methods are promising to facilitate better adversarial robustness by diversifying the vulnerabilities among the sub-models, simultaneously maintaining comparable accuracy as standard training.
Revised: Ensemble training methods are promising to facilitate better adversarial robustness by diversifying the vulnerabilities among the sub-models, simultaneously maintaining comparable accuracy as standard training.

Original: Previous practices also demonstrate that enlarging the ensemble can improve the robustness.
Revised: Previous practices also demonstrate that enlarging the ensemble can improve the robustness.

Original: However, existing ensemble methods are with poor scalability, owing to the rapid complexity increase when including more sub-models in the ensemble.
Revised: However, existing ensemble methods are with poor scalability, owing to the rapid complexity increase when including more sub-models in the ensemble.

Original: Moreover, it is usually infeasible to train or deploy an ensemble with substantial sub-models, owing to the tight hardware resource budget and latency requirement.
Revised: Moreover, it is usually infeasible to train or deploy an ensemble with substantial sub-models, owing to the tight hardware resource budget and latency requirement.

Original: In this work, we propose
Revised: In this work, we propose

Original: Ensemble-in-One (EIO), a simple but effective method to enlarge the ensemble within a random gated network (RGN).
Revised: Ensemble-in-One (EIO), a simple but effective method to enlarge the ensemble within a random gated network (RGN).

Original: EIO augments the original model by replacing the parameterized layers with multi-path random gated blocks (RGBs) to construct an RGN.
Revised: EIO augments the original model by replacing the parameterized layers with multi-path random gated blocks (RGBs) to construct an RGN.

Original: By diversifying the vulnerability of the numerous paths through the super-net, it provides high scal- ability because the paths within an RGN exponentially increase with the network depth.
Revised: By diversifying the vulnerability of the numerous paths through the super-net, it provides high scal- ability because the paths within an RGN exponentially increase with the network depth.

Original: Our experiments demonstrate that EIO consistently outperforms previous ensemble training methods with even less computational overhead, simulta- neously achieving better accuracy-robustness trade-offs than adversarial training.
Revised: Our experiments demonstrate that EIO consistently outperforms previous ensemble training methods with even less computational overhead, simulta- neously achieving better accuracy-robustness trade-offs than adversarial training.

Original: Introduction
Revised: Introduction

Original: With the convolutional neural networks (CNNs) becoming ubiquitous, the security and robustness of neural networks is attracting increasing interests.
Revised: With the convolutional neural networks (CNNs) becoming ubiquitous, the security and robustness of neural networks is attracting increasing interests.

Original: Recent studies find that
Revised: Recent studies find that

Original: CNN models are inherently vulnerable to adversarial attacks (Goodfellow, Shlens and Szegedy 2014), which craft imperceptible perturbations on the images, referred to as adversarial examples, to mislead the neural network models.
Revised: CNN models are inherently vulnerable to adversarial attacks (Goodfellow, Shlens, and Szegedy 2014), which craft imperceptible perturbations on the images, referred to as adversarial examples, to mislead the neural network models.

Original: Even without accessing the target model, an adversary can still generate adversarial examples from other surrogate models to attack the target model by exploiting the adversarial transferability among them.
Revised: Even without accessing the target model, an adversary can still generate adversarial examples from other surrogate models to attack the target model by exploiting the adversarial transferability among them.

Original: Such vulnerability of CNN models has spurred extensive researches on improving the robustness against adversarial attacks.
Revised: Such vulnerability of CNN models has spurred extensive researches on improving the robustness against adversarial attacks.

Original: One stream of approaches targets on learning robust features for an individual model (Madry et al. 2017; Brendel et al. 2020).
Revised: One stream of approaches targets on learning robust features for an individual model (Madry et al. 2017; Brendel et al. 2020).

Original: Informally, robust features are defined as the features that are less sensitive to the adversarial perturbations added on the inputs.
Revised: Informally, robust features are defined as the features that are less sensitive to the adversarial perturbations added on the inputs.

Original: A representative approach, referred to as adversarial training (Madry et al. 2017), on-line generates adversarial examples on which the model minimizes the training loss.
Revised: A representative approach, referred to as adversarial training (Madry et al. 2017), on-line generates adversarial examples on which the model minimizes the training loss.

Original: As a result, adversarial training encourages the model to learn the features that are less sensitive to the adversarial perturbations, thereby alleviating the model’s vulnerability.
Revised: As a result, adversarial training encourages the model to learn the features that are less sensitive to the adversarial perturbations, thereby alleviating the model’s vulnerability.

Original: However, such adversarial training methods often have to sacrifice the clean accuracy for enhanced robustness (Zhang et al. 2019), since they exclude the non-robust features and become less distinguishable for the examples with high similarity in the feature space.
Revised: However, such adversarial training methods often have to sacrifice the clean accuracy for enhanced robustness (Zhang et al. 2019), since they exclude the non-robust features and become less distinguishable for the examples with high similarity in the feature space.

Original: Besides empowering improved robustness for an individual model, another stream of researches focuses on forming strong ensembles to improve the robustness (Yang et al.
Revised: Besides empowering improved robustness for an individual model, another stream of researches focuses on forming strong ensembles to improve the robustness (Yang et al.

Original: 2020; Bagnall, Bunescu, and Stewart 2017; Pang et al. 2019;
Revised: 2020; Bagnall, Bunescu, and Stewart 2017; Pang et al. 2019;

Original: Kariyappa and Qureshi 2019).
Revised: Kariyappa and Qureshi 2019).

Original: Generally speaking, an ensemble is constructed by aggregating multiple sub-models.
Revised: Generally speaking, an ensemble is constructed by aggregating multiple sub-models.

Original: Intuitively, an ensemble is promising to facilitate better robustness than an individual model because a successful attack needs to mislead the majority of the sub-models rather than just one.
Revised: Intuitively, an ensemble is promising to facilitate better robustness than an individual model because a successful attack needs to mislead the majority of the sub-models rather than just one.

Original: While the robustness of an ensemble highly relies on the diversity of the sub-models, recent study finds that CNN models trained independently on the same dataset are with highly-overlapped adversarial subspaces (Tram`er et al. 2017).
Revised: While the robustness of an ensemble highly relies on the diversity of the sub-models, recent study finds that CNN models trained independently on the same dataset are with highly-overlapped adversarial subspaces (Tram ` er et al. 2017).

Original: Therefore, many studies propose ensemble training methods to diversify the sub-models.
Revised: Therefore, many studies propose ensemble training methods to diversify the sub-models.

Original: For example,
Revised: For example,

Original: DVERGE (Yang et al. 2020) proposes to distill non-robust features corresponding to each sub-model’s vulnerability, then isolates the vulnerabilities of the sub-models by mutual learning such that impeding the adversarial transferability among them.
Revised: DVERGE (Yang et al. 2020) proposes to distill non-robust features corresponding to each sub-model’s vulnerability, then isolates the vulnerabilities of the sub-models by mutual learning such that impeding the adversarial transferability among them.

Original: There is another learned insight that the ensembles composed by more sub-models tend to capture greater robustness improvement.
Revised: There is another learned insight that the ensembles composed by more sub-models tend to capture greater robustness improvement.

Original: Table 1 shows the robustness trend of the ensembles trained with various ensemble training methods.
Revised: Table 1 shows the robustness trend of the ensembles trained with various ensemble training methods.

Original: Robustness improvement can be obtained by including more sub-models within the ensemble.
Revised: Robustness improvement can be obtained by including more sub-models within the ensemble.

Original: This drives us to further explore whether the trend will continue when keeping enlarging the ensemble.
Revised: This drives us to further explore whether the trend will continue when keeping enlarging the ensemble.

Original: However, existing ensemble construction methods are with poor scalability because of the rapidlyincreasing overhead, especially with mutual learning which
Revised: However, existing ensemble construction methods are with poor scalability because of the rapidly

Original: [Table]
Revised: [Table]

Original:  trains the sub-models in a round-robin manner, the complexity will rise at a speed of O ( n 2 ) .
Revised: increasing overhead, especially with mutual learning which trains the sub-models in a round-robin manner, the complexity will rise at a speed of O ( n 2 ) .

Original: We propose Ensemble-in-One , a novel approach that can improve the scalability of ensemble training and introduce randomness mechanism for enhanced generalization, simultaneously obtaining better robustness and higher efficiency.
Revised: We propose Ensemble-in-One , a novel approach that can improve the scalability of ensemble training and introduce randomness mechanism for enhanced generalization, simultaneously obtaining better robustness and higher efficiency.

Original: For a dedicated CNN model, we conduct a Random Gated
Revised: For a dedicated CNN model, we conduct a Random Gated

Original: Network (RGN) by substituting each parameterized layer with a Random Gated Block (RGB) on top of the neural architecture.
Revised: Network (RGN) by substituting each parameterized layer with a Random Gated Block (RGB) on top of the neural architecture.

Original: Through this, the network can instantiate numerous sub-models by controlling the gates in each block.
Revised: Through this, the network can instantiate numerous sub-models by controlling the gates in each block.

Original: Ensemble-in-One substantially reduces the complexity when scaling up the ensemble.
Revised: Ensemble-in-One substantially reduces the complexity when scaling up the ensemble.

Original: In summary, the contributions of this work are listed as below:
Revised: In summary, the contributions of this work are listed as below:

Original: • Ensemble-in-One is a simple but effective method that learns adversarially robust ensembles within one overparametrized random gated network.
Revised: • Ensemble-in-One is a simple but effective method that learns adversarially robust ensembles within one overparametrized random gated network.

Original: The EIO enables us to employ ensemble learning techniques to learn more robust individual models with minimal computational overheads and no extra inference overhead.
Revised: The EIO enables us to employ ensemble learning techniques to learn more robust individual models with minimal computational overheads and no extra inference overhead.

Original: • Extensive experiments demonstrate the effectiveness of EIO.
Revised: • Extensive experiments demonstrate the effectiveness of EIO.

Original: It consistently outperforms the previous ensemble training methods with even less computational overhead.
Revised: It consistently outperforms the previous ensemble training methods with even less computational overhead.

Original: Moreover, EIO also achieves better accuracy-robustness trade-offs than adversarial training method.
Revised: Moreover, EIO also achieves better accuracy-robustness trade-offs than adversarial training method.

Original: Related Work Adversarial attacks and countermeasures.
Revised: Related Work Adversarial attacks and countermeasures.

Original: The inherent vulnerability of CNN models poses challenges on the security of deep learning systems.
Revised: The inherent vulnerability of CNN models poses challenges on the security of deep learning systems.

Original: An adversary can apply an additive perturbation on an original input to generate an adversarial example that induces wrong prediction in
Revised: An adversary can apply an additive perturbation on an original input to generate an adversarial example that induces wrong prediction in

Original: CNN models (Goodfellow, Shlens, and Szegedy 2014).
Revised: CNN models (Goodfellow, Shlens, and Szegedy 2014).

Original: Denoting an input as x , the goal of adversarial attacks is to find a perturbation δ s.t.
Revised: Denoting an input as x , the goal of adversarial attacks is to find a perturbation δ s.t.

Original: x adv = x
Revised: x adv = x

Original: + δ can mislead the model,
Revised: + δ can mislead the model,

Original: where || δ ||
Revised: where || δ ||

Original: p satisfies the intensity constraint
Revised: p satisfies the intensity constraint

Original: ||
Revised: ||

Original: δ || p ≤ ϵ .
Revised: δ || p ≤ ϵ .

Original: To formulate that, the adversarial attack aims at maximizing the loss L for the model with parameters θ on the input-label pair ( x, y ) , i.e. δ = argmax δ L θ ( x + δ, y ) , under the constraint that the ℓ p norm of the perturbation should not exceed the bound ϵ .
Revised: To formulate that, the adversarial attack aims at maximizing the loss L for the model with parameters θ on the input-label pair ( x, y ) , i.e. δ = argmax δ L θ ( x + δ, y ) , under the constraint that the ℓ p norm of the perturbation should not exceed the bound ϵ .

Original: Usually, we use ℓ ∞ norm (Goodfellow, Shlens, and Szegedy 2014; Madry et al. 2017) of the perturbations to measure the attack’s effectiveness or model’s robustness.
Revised: Usually, we use ℓ ∞ norm (Goodfellow, Shlens, and Szegedy 2014; Madry et al. 2017) of the perturbations to measure the attack’s effectiveness or model’s robustness.

Original: An attack that requires smaller perturbation to successfully deceive the model is regarded to be stronger.
Revised: An attack that requires smaller perturbation to successfully deceive the model is regarded to be stronger.

Original: Correspondingly, a defense that enforces the attacks to enlarge perturbation intensity is regarded to be more robust.
Revised: Correspondingly, a defense that enforces the attacks to enlarge perturbation intensity is regarded to be more robust.

Original: Various adversarial attack methods have been investigated to strengthen the attack effectiveness.
Revised: Various adversarial attack methods have been investigated to strengthen the attack effectiveness.

Original: The fast gradient sign method (FGSM) (Goodfellow, Shlens, and Szegedy 2014) exploits the gradient descent method to generate adversarial examples.
Revised: The fast gradient sign method (FGSM) (Goodfellow, Shlens, and Szegedy 2014) exploits the gradient descent method to generate adversarial examples.

Original: As an improvement, many studies further show the attack can be strengthened through multi-step projected gradient descent (PGD) (Madry et al.
Revised: As an improvement, many studies further show the attack can be strengthened through multi-step projected gradient descent (PGD) (Madry et al.

Original: 2017) generation, random-starting strategy, and momentum mechanism (Dong et al. 2017).
Revised: 2017) generation, random-starting strategy, and momentum mechanism (Dong et al. 2017).

Original: Then SGM (Wu et al. 2020) further finds that adding weight to the gradients going through the skip connections can make the attacks more effective.
Revised: Then SGM (Wu et al. 2020) further finds that adding weight to the gradients going through the skip connections can make the attacks more effective.

Original: Other prevalent attack approaches include C&W losses (Carlini and
Revised: Other prevalent attack approaches include C&W losses (Carlini and

Original: Wagner 2017b) , M-DI 2 -FGSM (Xie et al. 2019), etc.
Revised: Wagner 2017b) , M-DI 2 -FGSM (Xie et al. 2019), etc.

Original: These attacks provide strong and effective ways to generate adversarial examples, rendering a huge threat to real-world deep learning systems.
Revised: These attacks provide strong and effective ways to generate adversarial examples, rendering a huge threat to real-world deep learning systems.

Original: To improve the robustness of CNN systems, there are also extensive countermeasures for adversarial attacks.
Revised: To improve the robustness of CNN systems, there are also extensive countermeasures for adversarial attacks.

Original: One active research direction targets improving the robustness of individual models.
Revised: One active research direction targets improving the robustness of individual models.

Original: Adversarial training (Madry et al. 2017) optimizes the model on the adversarial examples generated in every step of the training stage.
Revised: Adversarial training (Madry et al. 2017) optimizes the model on the adversarial examples generated in every step of the training stage.

Original: Therefore, the optimized model will tend to drop non-robust features to converge better on the adversarial data.
Revised: Therefore, the optimized model will tend to drop non-robust features to converge better on the adversarial data.

Original: However, adversarial training encourages the model to fit the adversarial examples, thereby reducing the generalization on the clean data and causing significant degradation of the clean accuracy.
Revised: However, adversarial training encourages the model to fit the adversarial examples, thereby reducing the generalization on the clean data and causing significant degradation of the clean accuracy.

Original: Test-time randomness for adversarial defense
Revised: Test-time randomness for adversarial defense

Original: Besides the aforementioned training techniques, there exist studies that introduce test-time randomness to improve the robustness.
Revised: Besides the aforementioned training techniques, there exist studies that introduce test-time randomness to improve the robustness.

Original: Feinman et.
Revised: Feinman et.

Original: al.
Revised: al.

Original: (Feinman et al. 2017) utilize the uncertainty measure in dropout networks to detect adversarial examples.
Revised: (Feinman et al. 2017) utilize the uncertainty measure in dropout networks to detect adversarial examples.

Original: Dhillon et.
Revised: Dhillon et.

Original: al.
Revised: al.

Original: (Dhillon et al. 2018) and Xie et.
Revised: (Dhillon et al. 2018) and Xie et.

Original: al.
Revised: al.

Original: (Xie et al. 2017) incorporate layer-wise weighted dropout and random input transformations during test time to improve the robustness.
Revised: (Xie et al. 2017) incorporate layer-wise weighted dropout and random input transformations during test time to improve the robustness.

Original: Test-time randomness is found to be effective in increasing the required distortion on the model, since test-time randomness makes generating white-box adversarial examples almost as difficult as generating transferable black-box ones (Carlini and Wagner 2017a).
Revised: Test-time randomness is found to be effective in increasing the required distortion on the model, since test-time randomness makes generating white-box adversarial examples almost as difficult as generating transferable black-box ones (Carlini and Wagner 2017a).

Original: Nevertheless, test-time randomness increases the inference cost and can be circumvented to some extent with the expectationover-transformation technique (Athalye, Carlini, and Wagner 2018).
Revised: Nevertheless, test-time randomness increases the inference cost and can be circumvented to some extent with the expectationover-transformation technique (Athalye, Carlini, and Wagner 2018).

Original: Ensemble training for adversarial defense.
Revised: Ensemble training for adversarial defense.

Original: Besides improving the robustness of individual models, another recent research direction is to investigate the robust-
Revised: Besides improving the robustness of individual models, another recent research direction is to investigate the robust-

Original: [Figure]
Revised: [Figure]

Original: ness of model ensembles in which multiple sub-models work together.
Revised: ness of model ensembles in which multiple sub-models work together.

Original: The basic idea is that multiple sub-models can provide diverse decisions.
Revised: The basic idea is that multiple sub-models can provide diverse decisions.

Original: Ensemble methods can combine multiple weak models to jointly make decisions, thereby assembling as a stronger entirety.
Revised: Ensemble methods can combine multiple weak models to jointly make decisions, thereby assembling as a stronger entirety.

Original: However, it is demonstrated that independent training of multiple models tends to capture similar features, which would not provide diversities among them (Kariyappa and Qureshi 2019).
Revised: However, it is demonstrated that independent training of multiple models tends to capture similar features, which would not provide diversities among them (Kariyappa and Qureshi 2019).

Original: Therefore, several studies propose ensemble training methods to fully diversify the sub-models to improve the ensemble robustness.
Revised: Therefore, several studies propose ensemble training methods to fully diversify the sub-models to improve the ensemble robustness.

Original: For example, Pan et.
Revised: For example, Pang et.

Original: al. treat the distribution of output predictions as a diversity measurement and they propose an adaptive diversity promoting (ADP) regularizer (Pang et al. 2019) to diversify the non-max predictions of sub-models.
Revised: al. treat the distribution of output predictions as a diversity measurement and they propose an adaptive diversity promoting (ADP) regularizer (Pang et al. 2019) to diversify the non-max predictions of sub-models.

Original: Sanjay et.
Revised: Sanjay et.

Original: al.
Revised: al.

Original: regard the gradients w.r.t.
Revised: regard the gradients w.r.t.

Original: the inputs as a discrimination of different models, thus they propose a gradient alignment loss (GAL) (Kariyappa and Qureshi 2019) which takes the cosine similarity of the gradients as a criterion to train the sub-models.
Revised: the inputs as a discrimination of different models, thus they propose a gradient alignment loss (GAL) (Kariyappa and Qureshi 2019) which takes the cosine similarity of the gradients as a criterion to train the sub-models.

Original: The very recent work DVERGE (Yang et al. 2020) claims that the similar non-robust features captured by the sub-models cause high adversarial transferability among them.
Revised: The very recent work DVERGE (Yang et al. 2020) claims that the similar non-robust features captured by the sub-models cause high adversarial transferability among them.

Original: Therefore, the authors exploit non-robust feature distillation and adopt mutual learning to diversify and isolate the vulnerabilities among the sub-models, such that the within-ensemble transferability is highly impeded.
Revised: Therefore, the authors exploit non-robust feature distillation and adopt mutual learning to diversify and isolate the vulnerabilities among the sub-models, such that the within-ensemble transferability is highly impeded.

Original: However, as mentioned before, such ensemble methods are overwhelmed by the fast-increasing overhead when scaling up the ensemble.
Revised: However, as mentioned before, such ensemble methods are overwhelmed by the fast-increasing overhead when scaling up the ensemble.

Original: For example, DVERGE takes 11 hours to train an ensemble with three sub-models while needs approximately 50 hours when the sub-model count increases to eight.
Revised: For example, DVERGE takes 11 hours to train an ensemble with three sub-models while needs approximately 50 hours when the sub-model count increases to eight.

Original: Therefore, a more efficient ensemble construction method is highly demanded to tackle the scaling problem.
Revised: Therefore, a more efficient ensemble construction method is highly demanded to tackle the scaling problem.

Original: Ensemble-in-One Basic Motivation
Revised: Ensemble-in-One Basic Motivation

Original: The conventional way to construct ensembles is to simply aggregate multiple sub-models by averaging their predictions, which is inefficient and hard to scale up.
Revised: The conventional way to construct ensembles is to simply aggregate multiple sub-models by averaging their predictions, which is inefficient and hard to scale up.

Original: An intuitive way to enhance the scalability of the ensemble construction is to introduce an ensemble for each layer in the network.
Revised: An intuitive way to enhance the scalability of the ensemble construction is to introduce an ensemble for each layer in the network.

Original: As shown in Fig.1, we can augment a dynamic network by augmenting each parameterized layer with an npath gated block.
Revised: As shown in Fig.1, we can augment a dynamic network by augmenting each parameterized layer with an npath gated block.

Original: Then by selecting the paths along the augmented layer, the dynamic network can instantiate n L varied sub-models ideally.
Revised: Then by selecting the paths along the augmented layer, the dynamic network can instantiate n L varied sub-models ideally.

Original: Taking ResNet-20 as an example, by replacing each convolution layer (ignoring the skip connection branch) with a two-path gated module, the overall path count will approach 2 19 = 524288 .
Revised: Taking ResNet-20 as an example, by replacing each convolution layer (ignoring the skip connection branch) with a two-path gated module, the overall path count will approach 2 19 = 524288 .

Original: Such augmentation way provides an approximation to training a very large ensemble of sub-models.
Revised: Such augmentation way provides an approximation to training a very large ensemble of sub-models.

Original: Then through vulnerability diversification mutual learning, each path tends to capture better robustness.
Revised: Then through vulnerability diversification mutual learning, each path tends to capture better robustness.

Original: Following this idea, we propose Ensemble-in-One to further improve the robustness of both individual models and ensembles.
Revised: Following this idea, we propose Ensemble-in-One to further improve the robustness of both individual models and ensembles.

Original: Construction of the Random Gated Network
Revised: Construction of the Random Gated Network

Original: Denote a candidate neural network as N ( o 1 , o 2 , ..., o m ) , where o i represents an operator in the network.
Revised: Denote a candidate neural network as N ( o 1 , o 2 , ..., o m ) , where o i represents an operator in the network.

Original: To transform the original network into a random gated network (RGN), we first extract the neural architecture to obtain the connection topology and layer types.
Revised: To transform the original network into a random gated network (RGN), we first extract the neural architecture to obtain the connection topology and layer types.

Original: On top of that, we replace each parameterized layer (mainly convolutional layer, optionally followed by a batch normalization layer) with a random gated block (RGB).
Revised: On top of that, we replace each parameterized layer (mainly convolutional layer, optionally followed by a batch normalization layer) with a random gated block (RGB).

Original: As shown in Fig.
Revised: As shown in Fig.

Original: 2, each RGB simply repeats the original layer by n times, and leverages binary gates with uniform probabilities to control the open or mutation of corresponding sub-layers.
Revised: 2, each RGB simply repeats the original layer by n times, and leverages binary gates with uniform probabilities to control the open or mutation of corresponding sub-layers.

Original: These repeated sublayers are with different weight parameters.
Revised: These repeated sublayers are with different weight parameters.

Original: We denote the
Revised: We denote the

Original: RGN as N ( d 1 , d 2 , ..., d m ) , where d i =
Revised: RGN as N ( d 1 , d 2 , ..., d m ) , where d i =

Original: ( o i 1 , ..., o in ) .
Revised: ( o i 1 , ..., o in ) .

Original: Let g i be the gate information in the i th RGB, then a specific path derived from the RGN can be expressed as P =
Revised: Let g i be the gate information in the i th RGB, then a specific path derived from the RGN can be expressed as P =

Original: ( g 1 · d 1 , g 2 · d 2 , ..., g m · d m ) .
Revised: ( g 1 · d 1 , g 2 · d 2 , ..., g m · d m ) .

Original: For each RGB, when performing the computation, only one of the n gates is opened at a time, and the others will be temporarily muted.
Revised: For each RGB, when performing the computation, only one of the n gates is opened at a time, and the others will be temporarily muted.

Original: Thus by, only one path of activation is active in memory during training, which reduces the memory occupation of training an RGN to the same level of training an individual model.
Revised: Thus by, only one path of activation is active in memory during training, which reduces the memory occupation of training an RGN to the same level of training an individual model.

Original: Moreover, to ensure that all paths can be equally sampled and trained, each gate in a RGB is chosen with identical probability, i.e. 1 /n if each RGB consists of n sub-operators.
Revised: Moreover, to ensure that all paths can be equally sampled and trained, each gate in a RGB is chosen with identical probability, i.e. 1 /n if each RGB consists of n sub-operators.

Original: Therefore, the binary gate function can be expressed as:
Revised: Therefore, the binary gate function can be expressed as:

Original: [Equation]
Revised: [Equation]

Original: An RGN is analogous to the super network in parametersharing neural architecture search, and the forward process of an RGN is similar to evaluating a sub-architecture (Pham et al.
Revised: An RGN is analogous to the super network in parametersharing neural architecture search, and the forward process of an RGN is similar to evaluating a sub-architecture (Pham et al.

Original: Cai, Zhu, and Han 2018).
Revised: Cai, Zhu, and Han 2018).

Original: Compared to conventional ensemble training methods, our method is easier to scale up the ensemble.
Revised: Compared to conventional ensemble training methods, our method is easier to scale up the ensemble.

Original: It only incurs n × memory occupation for the weight storage, while still keeping the same memory requirement for activation as an individual model.
Revised: It only incurs n × memory occupation for the weight storage, while still keeping the same memory requirement for activation as an individual model.

Original: [Figure]
Revised: [Figure]

Original: [Figure]
Revised: [Figure]

Original: Learning Ensemble in One
Revised: Learning Ensemble-in-One

Original: The goal of learning ensemble-in-one is to encourage the vulnerabilities diversity of all the paths within the RGN by mutually learning from each other.
Revised: The goal of learning ensemble-in-one is to encourage the vulnerabilities diversity of all the paths within the RGN by mutually learning from each other.

Original: Let P i and P j be two different paths, where we define two paths as different when at least one of their gates is different.
Revised: Let P i and P j be two different paths, where we define two paths as different when at least one of their gates is different.

Original: To diversify the vulnerabilities, we need first distill the non-robust features of the paths so that the optimization process can isolate them.
Revised: To diversify the vulnerabilities, we need first distill the non-robust features of the paths so that the optimization process can isolate them.

Original: We adopt the same non-robust feature distillation strategy as previous work (Ilyas et al. 2019;
Revised: We adopt the same non-robust feature distillation strategy as previous work (Ilyas et al. 2019;

Original: Yang et al. 2020).
Revised: Yang et al. 2020).

Original: Consider two randomly-sampled independent input-label pairs ( x t , y t ) and ( x s , y s ) from the training dataset, the distilled feature of x t corresponding to x s by the l th layer of path P i can be achieved by:
Revised: Consider two randomly-sampled independent input-label pairs ( x t , y t ) and ( x s , y s ) from the training dataset, the distilled feature of x t corresponding to x s by the l th layer of path P i can be achieved by:

Original: [Equation]
Revised: [Equation]

Original: which s.t. ||
Revised: which s.t. ||

Original: z − x s || ∞ ≤ ϵ d .
Revised: z − x s || ∞ ≤ ϵ d .

Original: Such feature distillation aims to construct a sample x ′P li by adding perturbations on x s so that the response in l th layer of P i of x ′P li is similar as that of x t , while the two inputs x t and x s are completely different and independent.
Revised: Such feature distillation aims to construct a sample x ′P li by adding perturbations on x s so that the response in l th layer of P i of x ′P li is similar as that of x t , while the two inputs x t and x s are completely different and independent.

Original: This exposes the vulnerability of path P i on classifying x s .
Revised: This exposes the vulnerability of path P i on classifying x s .

Original: Therefore, for another different path P j , it can learn on the distilled data to correctly classify them to circumvent the vulnerability.
Revised: Therefore, for another different path P j , it can learn on the distilled data to correctly classify them to circumvent the vulnerability.

Original: The optimization objective for path P
Revised: The optimization objective for path P

Original: j is to minimize:
Revised: j is to minimize:

Original: [Equation]
Revised: [Equation]

Original: As it is desired that each path can learn from the vulnerabilities of all the other paths, the objective of training the ensemble-in-one RGN is to minimize:
Revised: As it is desired that each path can learn from the vulnerabilities of all the other paths, the objective of training the ensemble-in-one RGN is to minimize:

Original: [Equation]
Revised: [Equation]

Original: where N is the set of all paths in the RGN.
Revised: where N is the set of all paths in the RGN.

Original: While it is obviously impossible to involve all the paths in a training iteration, we randomly sample a certain number of paths by stochastically set the binary gates according to Eq.1.
Revised: While it is obviously impossible to involve all the paths in a training iteration, we randomly sample a certain number of paths by stochastically set the binary gates according to Eq.1.

Original: We denote the number of paths sampled in each iteration as p .
Revised: We denote the number of paths sampled in each iteration as p .

Original: Then the selected paths can temporarily combine as a subset
Revised: Then the selected paths can temporarily combine as a subset

Revised: [Table]

Original: 0: # randomly sample p paths 0:
Revised: [1 , L ] 12: # randomly sample p paths 13:

Original: S =[ P 1 , P 2 , ..., P p ], s.t. ∀
Revised: S =[ P 1 , P 2 , ..., P p ], s.t. ∀

Original: i, j, ∃ k ∈ [1 , l ] , s.t. P i [ k ] ̸ =P j [ k ] 0:
Revised: i, j, ∃ k ∈ [1 , l ] , [Table] .t. P i [ k ] ̸ =

Original: Get data ( X t , Y t ) , ( X s , Y s ) ← D 0:
Revised: [Table] [Table] [Table] [Table]

Original: # Get distilled data 0: for i = 1, 2, ..., p do 0: X ′ i = x ′P li ( X t , X s ) 0: end for 0: ∇ N ← 0 0: for i = 1, 2, ..., p do 0: ∇ P i = ∇ ( (cid:80) j ̸ = i
Revised: [Table]

Original: L f P i ( f P i ( X ′ j ) , Y s )) 0: ∇ N = ∇ N + ∇ P i 0: end for 0:
Revised: for [Table] do [Table]

Revised: for

Revised: [Table]

Revised: [Table]

Revised: for

Revised: [Table]

Revised: do

Revised: [Table]

Revised: [Table]

Revised: [Table]

Revised: for

Revised: [Table]

Original: N = N − lr ∗ ∇ N 0: end for 0: end for= of the RGN, referred to as S .
Revised: [Table] for [Table] end for of the RGN, referred to as S .

Original: The paths in the set S keep changing throughout the whole training process, such that all paths will have equal opportunities to be trained.
Revised: The paths in the set S keep changing throughout the whole training process, such that all paths will have equal opportunities to be trained.

Original: The training process of the RGN is summarized by the pseudo-code in Algorithm 1.
Revised: The training process of the RGN is summarized by the pseudo-code in Algorithm 1.

Original: Before starting vulnerability 
Revised: Before starting vulnerability diversification training, we pre-train the RGN based on stan-

Original: [Figure]
Revised: [Figure]

Original: diversification training, we pre-train the RGN based on standard training settings to help the RGN obtain basic capabilities.
Revised: dard training settings to help the RGN obtain basic capabilities.

Original: The process is simple, where a random path will be sampled in each iteration and trained on clean data.
Revised: The process is simple, where a random path will be sampled in each iteration and trained on clean data.

Original: Then for each batched data, the process of vulnerability diversification contains three basic steps.
Revised: Then for each batched data, the process of vulnerability diversification contains three basic steps.

Original: First, randomly sample p paths to be involved in the iteration.
Revised: First, randomly sample p paths to be involved in the iteration.

Original: Note that the sampled paths should be varied, i
Revised: Note that the sampled paths should be varied, i

Original: [Figure]
Revised: [Figure]

Original: e. if the distilling layer is set to l , for any P i , P j in S , there must be at least one different gate among the top l gates, i.e. ∃ k ∈ [1 , l ] , s.t.
Revised: e. if the distilling layer is set to l , for any P i , P j in S , there must be at least one different gate among the top l gates, i.e. ∃ k ∈ [1 , l ] , s.t.

Original: P i
Revised: P i

Original: [ k ] ̸ = P j [ k ] .
Revised: [ k ] ̸ = P j [ k ] .

Original: Second, distilling the vulnerable features of the sampled paths according to Eq. 2.
Revised: Second, distilling the vulnerable features of the sampled paths according to Eq. 2.

Original: The distillation process is the same as proposed in DVERGE, by applying a PGD scheme for approximating the optimal perturbations.
Revised: The distillation process is the same as proposed in DVERGE, by applying a PGD scheme for approximating the optimal perturbations.

Original: Third, mutually train each path with the distilled data from the other paths in a round-robin manner.
Revised: Third, mutually train each path with the distilled data from the other paths in a round-robin manner.

Original: Because the paths unavoidably share a proportion of weights owing to the weight sharing mechanism in super-net, the gradients of the weights will not be updated until all sampled paths are included.
Revised: Because the paths unavoidably share a proportion of weights owing to the weight sharing mechanism in super-net, the gradients of the weights will not be updated until all sampled paths are included.

Original: Model Derivation and Deployment
Revised: Model Derivation and Deployment

Original: Once the training of RGN is finished, we can then derive and deploy the model in two ways.
Revised: Once the training of RGN is finished, we can then derive and deploy the model in two ways.

Original: One way is to deploy the entire RGN, then in inference stage, the gates throughout the network will be randomly selected to process an input.
Revised: One way is to deploy the entire RGN, then in inference stage, the gates throughout the network will be randomly selected to process an input.

Original: The advantage is that the computation is randomized, which may beneficial for improving the robustness under white-box attacks, because the transferability among different paths was impeded during diversity training.
Revised: The advantage is that the computation is randomized, which may beneficial for improving the robustness under white-box attacks, because the transferability among different paths was impeded during diversity training.

Original: However, the disadvantage is that the accuracy is unstable owing to the dynamic choice of inference path, where the fluctuation reaches 1percentage.
Revised: However, the disadvantage is that the accuracy is unstable owing to the dynamic choice of inference path, where the fluctuation reaches 1percentage.

Original: Another way is to derive individual models from the
Revised: Another way is to derive individual models from the

Original: RGN.
Revised: RGN.

Original: By sampling a random path and eliminating the other redundant modules, an individual model can be rolled out.
Revised: By sampling a random path and eliminating the other redundant modules, an individual model can be rolled out.

Original: We can also sample multiple paths and derive multiple models to combine as an ensemble.
Revised: We can also sample multiple paths and derive multiple models to combine as an ensemble.

Original: Deploying models in this way ensures the stability of the prediction as the randomness is eliminated.
Revised: Deploying models in this way ensures the stability of the prediction as the randomness is eliminated.

Original: In addition, the derived models can be slightly finetuned with small learning rate for a few epochs to compensate for the under-convergence, as the training process of
Revised: In addition, the derived models can be slightly finetuned with small learning rate for a few epochs to compensate for the under-convergence, as the training process of

Original: RGN cannot fully train all paths as the probability of each specific path being sampled is relatively low.
Revised: RGN cannot fully train all paths as the probability of each specific path being sampled is relatively low.

Original: In our implementation, we exploit the latter method to derive an individual model for deployment.
Revised: In our implementation, we exploit the latter method to derive an individual model for deployment.

Original: Experimental Results Experiment Settings
Revised: Experimental Results Experiment Settings

Original: Benchmark.
Revised: Benchmark.

Original: The experiments are constructed on the
Revised: The experiments are constructed on the

Original: ResNet-20 (He et al. 2016) and VGG-16 networks with the
Revised: ResNet-20 (He et al. 2016) and VGG-16 networks with the

Original: CIFAR dataset (Krizhevsky, Hinton et al. 2009).
Revised: CIFAR dataset (Krizhevsky, Hinton et al. 2009).

Original: Specifically, we construct the ResNet-20 and VGG-16 based RGNs by substituting each convolution layer to a n -path RGB (in default n = 2 ).
Revised: Specifically, we construct the ResNet-20 and VGG-16 based RGNs by substituting each convolution layer to a n -path RGB (in default n = 2 ).

Original: Overall, there are 19 RGBs (containing 19 convolution layers in the straight-through branch) for ResNet-20, and 14 RGBs for VGG-16 (containing the 14 convolution layers).
Revised: Overall, there are 19 RGBs (containing 19 convolution layers in the straight-through branch) for ResNet-20, and 14 RGBs for VGG-16 (containing the 14 convolution layers).

Original: To evaluate the effectiveness of our method, we compare Ensemble-in-One with multiple counterparts, including the Baseline which trains the models in a standard way and three previous ensemble training methods: ADP (Pang et al. 2019), GAL (Kariyappa and Qureshi 2019), and DVERGE (Yang et al. 2020).
Revised: To evaluate the effectiveness of our method, we compare Ensemble-in-One with multiple counterparts, including the Baseline which trains the models in a standard way and three previous ensemble training methods: ADP (Pang et al. 2019), GAL (Kariyappa and Qureshi 2019), and DVERGE (Yang et al. 2020).

Original: Meanwhile, we also add the adversarial training ( AdvT ) method into the comparison.
Revised: Meanwhile, we also add the adversarial training ( AdvT ) method into the comparison.

Original: Training Details.
Revised: Training Details.

Original: The trained ensemble models of Baseline, ADP, GAL, and DVERGE are referred to the implementation which is publicly released in (Yang et al. 2020) 1 .
Revised: The trained ensemble models of Baseline, ADP, GAL, and DVERGE are referred to the implementation which is publicly released in (Yang et al. 2020) * .

Original: We train the Ensemble-in-One networks for 200 epochs using SGD with momentum 0.9 and weight decay 0.0001.
Revised: We train the Ensemble-in-One networks for 200 epochs using SGD with momentum 0.9 and weight decay 0.0001.

Original: The initial learning rate is 0.1, and decayed by 10x at the 100-th and the 150-th epochs respectively.
Revised: The initial learning rate is 0.1, and decayed by 10x at the 100-th and the 150-th epochs respectively.

Original: When deriving the individual models, we fine-tune the derived models for 0epochs using SGD with learning rate 0.001, momentum 0.
Revised: When deriving the individual models, we fine-tune the derived models for 0epochs using SGD with learning rate 0.001, momentum 0.

Original: and weight decay 0.0001.
Revised: and weight decay 0.0001.

Original: Note that the fine-tuning process is optional and can adjust the epochs for a dedicated model.
Revised: Note that the fine-tuning process is optional and can adjust the epochs for a dedicated model.

Original: In default, for an RGN training, we sample 3 paths to construct temporary sub-ensemble per iteration.
Revised: In default, for an RGN training, we sample 3 paths to construct temporary sub-ensemble per iteration.

Original: The augmenta-
Revised: The augmentation factor n for each RGB is set to 2, and the PGD-based * https://

Original: [Figure]
Revised: .com/

Revised: zjysteven/

Original: [Figure]
Revised: [Figure]

Original: The distillation perturbation strength of VGG-16-based EIOis setas ϵ d = 0 . tion factor n for each RGB is set to 2, and the PGD-based perturbation strength ϵ d for feature distillation is set to 0.
Revised: distillation perturbation strength of VGG 16-based EIO set perturbation strength ϵ d for feature distillation is set to 0.

Original: with 10 iterative steps and each step size of ϵ d / 10 .
Revised: with 10 iterative steps and each step size of ϵ d / 10 .

Original: Attack Models.
Revised: Attack Models.

Original: We categorize the adversarial attacks as black-box transfer attacks and white-box attacks.
Revised: We categorize the adversarial attacks as black-box transfer attacks and white-box attacks.

Original: The whitebox attack assumes the adversary has full knowledge of the model parameters and architectures, and the black-box attack assumes the adversary cannot access the target model and can only generate adversarial examples from surrogate models to launch the attacks.
Revised: The whitebox attack assumes the adversary has full knowledge of the model parameters and architectures, and the black-box attack assumes the adversary cannot access the target model and can only generate adversarial examples from surrogate models to launch the attacks.

Original: For fair comparison, we adopt exactly the same attack methodologies and the same surrogate models as DVERGE to evaluate the robustness.
Revised: For fair comparison, we adopt exactly the same attack methodologies and the same surrogate models as DVERGE to evaluate the robustness.

Original: For black-box transfer attacks, the involved attack methods include: (1) PGD with momentum and with three random starts (Madry et al. 2017); (2) M-DI 2 -FGSM (Xie et al.
Revised: For black-box transfer attacks, the involved attack methods include: (1) PGD with momentum and with three random starts (Madry et al. 2017); (2) M-DI 2 -FGSM (Xie et al.

Original: ; and (3) SGM (Wu et al. 2020).
Revised: ; and (3) SGM (Wu et al. 2020).

Original: The attacks are with different perturbation strength and the iterative steps are set to 100 with the step size of ϵ /5.
Revised: The attacks are with different perturbation strength and the iterative steps are set to 100 with the step size of ϵ /5.

Original: Besides the cross-entropy loss, we also apply the C&W loss to incorporate with the attacks.
Revised: Besides the cross-entropy loss, we also apply the C&W loss to incorporate with the attacks.

Original: Therefore, there will be 3 (surrogate models) × 5 (attack methods, PGD with three random starts, M-DI 2 -FGSM, and SGM) × 2 (losses) =
Revised: Therefore, there will be 3 (surrogate models) × 5 (attack methods, PGD with three random starts, M-DI 2 -FGSM, and SGM) × 2 (losses) =

Original: 30 adversarial versions.
Revised: 30 adversarial versions.

Original: For whitebox attacks, we apply 50-step PGD with the step size of ϵ/with five random starts.
Revised: For whitebox attacks, we apply 50-step PGD with the step size of ϵ/with five random starts.

Original: Both the black-box and white-box adversarial accuracy is reported in an all-or-nothing fashion: a sample is judged to be correctly classified only if its 30 (for black-box attack) or 5 (for white-box attack) adversarial versions are all corrected classified by the model.
Revised: Both the black-box and white-box adversarial accuracy is reported in an all-or-nothing fashion: a sample is judged to be correctly classified only if its 30 (for black-box attack) or 5 (for white-box attack) adversarial versions are all corrected classified by the model.

Original: In default, we randomly sample 1000 instances from the test dataset for evaluation.
Revised: In default, we randomly sample 1000 instances from the test dataset for evaluation.

Original: We believe the attacks are powerful and can identify the robustness of the various models.
Revised: We believe the attacks are powerful and can identify the robustness of the various models.

Original: Robustness Evaluation
Revised: Robustness Evaluation

Original: Hyper-parameter Exploration.
Revised: Hyper-parameter Exploration.

Original: Recall that three important hyper-parameters are involved in the training procedure.
Revised: Recall that three important hyper-parameters are involved in the training procedure.

Original: One is the count of sampled paths p to participate in each training iteration, one is the strength of feature distillation perturbation ϵ d as illustrated in Eq.2, and the other is the augmentation factor n for constructing the RGN, i.e. how many times will an operator be repeated to build a RGB.
Revised: One is the count of sampled paths p to participate in each training iteration, one is the strength of feature distillation perturbation ϵ d as illustrated in Eq.2, and the other is the augmentation factor n for constructing the RGN, i.e. how many times will an operator be repeated to build a RGB.

Original: We make experiments to investigate the impact of these hyperparameters on the clean accuracy and the adversarial robustness.
Revised: We make experiments to investigate the impact of these hyperparameters on the clean accuracy and the adversarial robustness.

Original: Fig.3 (Left) shows the curves of black-box adversarial accuracy under different sampled path count p per training iteration.
Revised: Fig.3 (Left) shows the curves of black-box adversarial accuracy under different sampled path count p per training iteration.

Original: As is observed, when the sampled paths increase, the robustness of the derived individual model also improves.
Revised: As is observed, when the sampled paths increase, the robustness of the derived individual model also improves.

Original: The underlying reason is that more samples of paths participating in each iteration allows more paths to be mutually trained, thereby each path is expected to learn from more diverse vulnerabilities.
Revised: The underlying reason is that more samples of paths participating in each iteration allows more paths to be mutually trained, thereby each path is expected to learn from more diverse vulnerabilities.

Original: However, the clean accuracy drops with the increasing of path sample count, because a single operator has to adapt to diverse paths simultaneously.
Revised: However, the clean accuracy drops with the increasing of path sample count, because a single operator has to adapt to diverse paths simultaneously.

Original: Moreover, the training time will also increase as the training complexity satisfies
Revised: Moreover, the training time will also increase as the training complexity satisfies

Original: O ( p 2 ) .
Revised: O ( p 2 ) .

Original: Fig.3 (Middle) shows the curves of black-box adversarial accuracy under different feature distillation ϵ d .
Revised: Fig.3 (Middle) shows the curves of black-box adversarial accuracy under different feature distillation ϵ d .

Original: We find similar conclusions as presented in DVERGE.
Revised: We find similar conclusions as presented in DVERGE.

Original: A larger ϵ d can push the distilled data x ′ P l i ( x t , x s ) share more similar internal representation as x t .
Revised: A larger ϵ d can push the distilled data x ′ P l i ( x t , x s ) share more similar internal representation as x t .

Original: While the objective is to reduce the loss of P j on classifying x ′P li , the larger loss will boost the effectiveness of learning the vulnerability, thereby
Revised: While the objective is to reduce the loss of P j on classifying x ′P li , the larger loss will boost the effectiveness of learning the vulnerability, thereby

Original: [Figure]
Revised: [Figure]

Revised: [Table]

Original: achieving better robustness.
Revised: achieving better robustness.

Original: However, we also find the clean accuracy drops with the increase of ϵ d .
Revised: However, we also find the clean accuracy drops with the increase of ϵ d .

Original: And there exists a switching point where it will stop obtaining robustness improvement from continually increasing ϵ d .
Revised: And there exists a switching point where it will stop obtaining robustness improvement from continually increasing ϵ d .

Original: The experimental results suggest ϵ d = 0 .
Revised: The experimental results suggest ϵ d = 0 .

Original: 07 to achieve higher robustness and clean accuracy simultaneously.
Revised: 07 to achieve higher robustness and clean accuracy simultaneously.

Original: Fig.3 (Right) shows the comparison of adversarial accuracy when applying different augmentation factor n for constructing the RGN.
Revised: Fig.3 (Right) shows the comparison of adversarial accuracy when applying different augmentation factor n for constructing the RGN.

Original: Observe that increasing the factor n brings no benefit on either the clean accuracy or adversarial accuracy.
Revised: Observe that increasing the factor n brings no benefit on either the clean accuracy or adversarial accuracy.

Original: It stands to reason that augmenting 2 × operators for each RGB has already provided sufficient candidate paths.
Revised: It stands to reason that augmenting 2 × operators for each RGB has already provided sufficient candidate paths.

Original: Moreover, increasing the n leads to more severe under-convergence of training because each path has a decreased probability of being sampled.
Revised: Moreover, increasing the n leads to more severe under-convergence of training because each path has a decreased probability of being sampled.

Original: Therefore, we suggest the augmentation factor as n = 2 for each convolution layer.
Revised: Therefore, we suggest the augmentation factor as n = 2 for each convolution layer.

Original: Comparison with Ensemble Methods.
Revised: Comparison with Ensemble Methods.

Original: Fig.4 shows the overall adversarial accuracy of the models trained by different methods with a wide range of attack perturbation strength.
Revised: Fig.4 shows the overall adversarial accuracy of the models trained by different methods with a wide range of attack perturbation strength.

Original: ResNet-20 and VGG-16 are selected as the basic network to construct the ensembles and the EIO supernetworks.
Revised: ResNet-20 and VGG-16 are selected as the basic network to construct the ensembles and the EIO supernetworks.

Original: The results show that through our Ensemble-inOne method, an individual model derived from the RGN can significantly outperform the heavy ensembles trained by previous ensemble training methods with higher adversarial accuracy under both black-box and white-box attacks, simultaneously achieving comparable clean accuracy.
Revised: The results show that through our Ensemble-inOne method, an individual model derived from the RGN can significantly outperform the heavy ensembles trained by previous ensemble training methods with higher adversarial accuracy under both black-box and white-box attacks, simultaneously achieving comparable clean accuracy.

Original: These results demonstrate that we successfully train an ensemble within one RGN network and improves the robustness of an individual model to outperform the ensembles such that the deployment overhead can be substantially reduced.
Revised: These results demonstrate that we successfully train an ensemble within one RGN network and improves the robustness of an individual model to outperform the ensembles such that the deployment overhead can be substantially reduced.

Original: Comparison with Adversarial Training.
Revised: Comparison with Adversarial Training.

Original: AdvT has been demonstrated as a promising approach on enhancing the robustness.
Revised: AdvT has been demonstrated as a promising approach on enhancing the robustness.

Original: Prior work attributes the enhancement to the exclusion of non-robust features during AdvT. However, these non-robust features might be useful to the classification accuracy, resulting in trade-offs between the clean accuracy and the robustness.
Revised: Prior work attributes the enhancement to the exclusion of non-robust features during AdvT. However, these non-robust features might be useful to the classification accuracy, resulting in trade-offs between the clean accuracy and the robustness.

Original: One can adjust the perturbation strength in the AdvT to acquire different combinations of clean accuracy and adversarial robustness, as shown in Fig.5.
Revised: One can adjust the perturbation strength in the AdvT to acquire different combinations of clean accuracy and adversarial robustness, as shown in Fig.5.

Original: It can be figured out that EIO significantly outperforms AdvT when aligning their clean accuracy (AdvT w/ ϵ = 0 .
Revised: It can be figured out that EIO significantly outperforms AdvT when aligning their clean accuracy (AdvT w/ ϵ = 0 .

Original: 005 ), which suggests that EIO learns more useful, robust features while excluding more useless, non-robust features than AdvT. 
Revised: 005 ), which suggests that EIO learns more useful, robust features while excluding more useless, non-robust features than AdvT. Training Cost.

Revised: We summarize the training time cost of different methods in Fig.2.

Revised: Because a PGD-based data distillation is applied for training and sample 3 paths per training iteration, the training time cost of an EIO network is approximately 2.5× than AdvT. While the training time is substantially reduced compared to the DVERGE when scaling up the ensemble.

Original: Discussion & Future Work
Revised: Discussion & Future Work

Original: There are also several points that are worthy further exploration while we leave to future work.
Revised: There are also several points that are worthy further exploration while we leave to future work.

Original: First, current implementation of augmenting the RGN is simple, by repeating the convolution layers for multiple times.
Revised: First, current implementation of augmenting the RGN is simple, by repeating the convolution layers for multiple times.

Original: Nevertheless, as observed in Fig.3 (Right), enlarging the augmentation factor brings no benefit on improving the robustness.
Revised: Nevertheless, as observed in Fig.3 (Right), enlarging the augmentation factor brings no benefit on improving the robustness.

Original: Hence, there might be better ways of constructing RGNs that can compose stronger randomized network, e.g. subtracting some of the unnecessary RGBs or augmenting by diverse operators instead of simply repeating.
Revised: Hence, there might be better ways of constructing RGNs that can compose stronger randomized network, e.g. subtracting some of the unnecessary RGBs or augmenting by diverse operators instead of simply repeating.

Original: Second, although black-box attacks are more prevalent in real world, defending against white-box attacks is still in demand because recent research warns the high risks of exposing the private models to the adversary (Hua, Zhang, and Suh 2018;
Revised: Second, although black-box attacks are more prevalent in real world, defending against white-box attacks is still in demand because recent research warns the high risks of exposing the private models to the adversary (Hua, Zhang, and Suh 2018;

Original: Hu et al. 2020).
Revised: Hu et al. 2020).

Original: Randomized multi-path network can provide promising solutions to alleviating the white-box threats.
Revised: Randomized multi-path network can provide promising solutions to alleviating the white-box threats.

Original: If the adversarial transferability among the different paths can be impeded, the adversarial example generated from one path will be ineffective for another path.
Revised: If the adversarial transferability among the different paths can be impeded, the adversarial example generated from one path will be inef- fective for another path.

Original: Hence, it will make the white-box attacks as difficult as black-box transfer attacks.
Revised: Hence, it will make the white-box attacks as difficult as black-box transfer attacks.

Original: We believe it is a valuable direction to explore defensive method based on randomized multi-path network.
Revised: We believe it is a valuable direction to explore defensive method based on randomized multi-path network.

Original: Conclusions
Revised: Conclusions

Original: In this work, we propose Ensemble-in-One, a novel approach that constructs random gated network (RGN) and learns adversarially robust ensembles within the network.
Revised: In this work we propose Ensemble-in-One, a novel approach that constructs random gated network (RGN) and learns adversarially robust ensembles within the network.

Original: The method is inherently scalable, which can ideally instantiate numerous sub-models by sampling different paths within the RGN.
Revised: The method is inherently scalable, which can ideally instantiate numerous sub-models by sampling different paths within the RGN.

Original: By diversifying the vulnerabilities of different paths, the Ensemble-in-One method can efficiently obtain models with higher robustness, simultaneously reducing the overhead of model training and deployment.
Revised: By diversifying the vulnerabilities of different paths, the Ensemble-in-One method can efficiently obtain models with higher robustness, simultaneously reducing the overhead of model training and deployment.

Original: The individual model derived from the RGN shows much better robustness than previous ensemble training methods and achieves better trade-offs than adversarial training.
Revised: The individual model derived from the RGN shows much better robustness than previous ensemble training methods and achieves better trade-offs than adversarial training.