Original: P ART -B ASED M ODELS I MPROVE A DVERSARIAL R OBUSTNESS
Revised: P ART -B ASED M ODELS I MPROVE A DVERSARIAL R OBUSTNESS

Original: Anonymous authors

Original: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: We show that combining human prior knowledge with end-to-end learning can improve the robustness of deep neural networks by introducing a part-based model for object classification.
Revised: We show that combining human prior knowledge with end-to-end learning can improve the robustness of deep neural networks by introducing a part-based model for object classification.

Original: We believe that the richer form of annotation helps guide neural networks to learn more robust features without requiring more samples or larger models.
Revised: We believe that the richer form of annotation helps guide neural networks to learn more robust features without requiring more samples or larger models.

Original: Our model combines a part segmentation model with a tiny classifier and is trained end-to-end to simultaneously segment objects into parts and then classify the segmented object.
Revised: Our model combines a part segmentation model with a tiny classifier and is trained end-to-end to simultaneously segment objects into parts and then classify the segmented object.

Original: Empirically, our part-based models achieve both higher accuracy and higher adversarial robustness than a ResNet-50 baseline on all three datasets.
Revised: Empirically, our part-based models achieve both higher accuracy and higher adversarial robustness than a ResNet-50 baseline on all three datasets.

Original: For instance, the clean accuracy of our part models is up topercentage points higher than the baseline’s , given the same level of robustness.
Revised: For instance, the clean accuracy of our part models is up topercentage points higher than the baseline’s, given the same level of robustness.

Original: Our experiments indicate that these models also reduce texture bias and yield better robustness against common corruptions and spurious correlations.
Revised: Our experiments indicate that these models also reduce texture bias and yield better robustness against common corruptions and spurious correlations.

Original: The code is included in the supplementary material
Revised: The code is publicly available at https://github.com/chawins/adv-part-model .

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: As machine learning models are increasingly deployed in security or safety-critical settings, robustness becomes an essential property.
Revised: As machine learning models are increasingly deployed in security or safety-critical settings, robustness becomes an essential property.

Original: Adversarial training (Madry et al., 2018) is the state-of-the-art method for improving the adversarial robustness of deep neural networks.
Revised: Adversarial training (Madry et al., 2018) is the state-of-the-art method for improving the adversarial robustness of deep neural networks.

Original: Recent work has made substantial progress in robustness by scaling adversarial training to very large datasets.
Revised: Recent work has made substantial progress in robustness by scaling adversarial training to very large datasets.

Original: For instance, some defenses rely on aggressive data augmentation (Rebuffi et al., 2021) while others utilize a large quantity of extra data (Carmon et al., 2019) or even larger models (Gowal et al., 2021a).
Revised: For instance, some defenses rely on aggressive data augmentation (Rebuffi et al., 2021) while others utilize a large quantity of extra data (Carmon et al., 2019) or even larger models (Gowal et al., 2021a).

Original: These works fall in line with a recent trend of deep learning on “scaling up,” i.e., training large models on massive datasets (Kaplan et al., 2020).
Revised: These works fall in line with a recent trend of deep learning on “scaling up,” i.e., training large models on massive datasets (Kaplan et al., 2020).

Original: Unfortunately, progress has begun to stagnate here as we have reached a point of diminishing returns: for example, Gowal et al.
Revised: Unfortunately, progress has begun to stagnate here as we have reached a point of diminishing returns: for example, Gowal et al.

Original: (2021a) show that an exponential increase in model size and training samples will only yield a linear increase in robustness.
Revised: (2021a) show that an exponential increase in model size and training samples will only yield a linear increase in robustness.

Original: Our work presents a novel alternative to improve adversarial training: we propose to utilize additional supervision that allows for a richer learning signal .
Revised: Our work presents a novel alternative to improve adversarial training: we propose to utilize additional supervision that allows for a richer learning signal .

Original: We hypothesize that an auxiliary human-aligned learning signal will guide the model to learn more robust and more generalized features.
Revised: We hypothesize that an auxiliary human-aligned learning signal will guide the model to learn more robust and more generalized features.

Original: To demonstrate this idea, we propose to classify images with a part-based model that makes predictions by recognizing the parts of the object in a bottom-up manner.
Revised: To demonstrate this idea, we propose to classify images with a part-based model that makes predictions by recognizing the parts of the object in a bottom-up manner.

Original: We make use of images that are annotated with part segmentation masks.
Revised: We make use of images that are annotated with part segmentation masks.

Original: We propose a simple two-stage model that combines a segmentation model with a classifier .
Revised: We propose a simple two-stage model that combines a segmentation model with a classifier .

Original: An image is first fed into the segmenter which outputs a pixel-wise segmentation of the object parts in a given input; this mask is then passed to a tiny classifier which predicts the class label based solely on this segmentation mask.
Revised: An image is first fed into the segmenter which outputs a pixel-wise segmentation of the object parts in a given input; this mask is then passed to a tiny classifier which predicts the class label based solely on this segmentation mask.

Original: The entire part-based model is trained end-to-end with a combination of segmentation and classification losses.
Revised: The entire part-based model is trained end-to-end with a combination of segmentation and classification losses.

Original: Fig.
Revised: Fig.

Original: 1 illustrates our model.
Revised: 1 illustrates our model.

Original: The idea is that this approach may guide the model to attend more to global shape than to local fine-grained texture, hopefully yielding better robustness.
Revised: The idea is that this approach may guide the model to attend more to global shape than to local fine-grained texture, hopefully yielding better robustness.

Original: We then combine this part-based architecture with adversarial training to encourage it to be robust against adversarial examples.
Revised: We then combine this part-based architecture with adversarial training to encourage it to be robust against adversarial examples.

Original: We show that our model achieves strong levels of robustness on three realistic datasets: PartImageNet (He et al., 2021), Cityscapes (Meletis et al., 2020), and PASCAL-Part (Chen et al., 2014).
Revised: We show that our model achieves strong levels of robustness on three realistic datasets: PartImageNet (He et al., 2021), Cityscapes (Meletis et al., 2020), and PASCAL-Part (Chen et al., 2014).

Original: Our part-based models outperform the ResNet-50 baselines on both clean and adversarial accuracy simultaneously.
Revised: Our part-based models outperform the ResNet-50 baselines on both clean and adversarial accuracy simultaneously.

Original: For any given value of clean accuracy, our part models achieve more thanpercentage points higher adversarial accuracy compared to the baseline on Part-ImageNet (see Fig. 2).
Revised: For any given value of clean accuracy, our part models achieve more than [Figure] percentage points higher adversarial accuracy compared to the baseline on Part-ImageNet (see Fig. 2).

Original: This improvement can be up to 25 percentage points in the other datasets we evaluate[Figure] on (see Fig. 4).
Revised: This improvement can be up to 25 percentage points in the other datasets we evaluate on (see Fig. 4).

Original: Alternatively, given the same level of adversarial robustness, our part models outperform the baseline by up to 15 percentage points on clean accuracy (see Table 1).
Revised: Alternatively, given the same level of adversarial robustness, our part models outperform the baseline by up to 15 percentage points on clean accuracy (see Table 1).

Original: Our part-based models also improve non-adversarial robustness, without any specialized training or data augmentation.
Revised: Our part-based models also improve non-adversarial robustness, without any specialized training or data augmentation.

Original: Compared to a ResNet-50 baseline, our part models are more robust to synthetic corruptions (Hendrycks & Dietterich, 2019) as well as less biased toward non-robust “texture features” (Geirhos et al., 2019).
Revised: Compared to a ResNet-50 baseline, our part models are more robust to synthetic corruptions (Hendrycks & Dietterich, 2019) as well as less biased toward non-robust “texture features” (Geirhos et al., 2019).

Original: Additionally, since our part models can distinguish between the background and the foreground of an image, they are less vulnerable to distribution shifts in the background (Xiao et al., 2021).
Revised: Additionally, since our part models can distinguish between the background and the foreground of an image, they are less vulnerable to distribution shifts in the background (Xiao et al., 2021).

Original: These three robustness properties are all highly desirable and enabled by the part-level supervision.
Revised: These three robustness properties are all highly desirable and enabled by the part-level supervision.

Original: We believe that our part-based model is the first promising example of how a richer supervised training signal can substantially improve the robustness of neural networks.
Revised: We believe that our part-based model is the first promising example of how a richer supervised training signal can substantially improve the robustness of neural networks.

Original:  R ELATED W ORK 2. A DVERSARIAL R OBUSTNESS
Revised:  R ELATED W ORK 2. A DVERSARIAL R OBUSTNESS

Original: Adversarial training (Madry et al., 2018) has become a standard method for training robust neural networks against adversarial examples.
Revised: Adversarial training (Madry et al., 2018) has become a standard method for training robust neural networks against adversarial examples.

Original: Many improvements on this technique have been proposed (Zhang et al., 2019; Xie et al., 2019; Pang et al., 2019; Huang et al., 2020; Qin et al., 2019;
Revised: Many improvements on this technique have been proposed (Zhang et al., 2019; Xie et al., 2019; Pang et al., 2019; Huang et al., 2020; Qin et al., 2019;

Original: Rice et al., 2020; Wong et al., 2020; Hendrycks et al., 2019;
Revised: Rice et al., 2020; Wong et al., 2020; Hendrycks et al., 2019;

Original: Kireev et al., 2021).
Revised: Kireev et al., 2021).

Original: Among these,
Revised: Among these,

Original: TRADES (Zhang et al., 2019) improves the trade-off between robustness and clean accuracy of adversarial training.
Revised: TRADES (Zhang et al., 2019) improves the trade-off between robustness and clean accuracy of adversarial training.

Original: More recent state-of-the-art methods focus on improving the adversarial robustness through scales.
Revised: More recent state-of-the-art methods focus on improving the adversarial robustness through scales.

Original: Carmon et al.
Revised: Carmon et al.

Original: (2019) and Gowal et al.
Revised: (2019) and Gowal et al.

Original: (2021a) rely on a large number of unlabeled training data while others utilize large generative models for data augmentation (Rebuffi et al., 2021) or synthetically generating more training samples (Gowal et al., 2021b; Sehwag et al., 2022).
Revised: (2021a) rely on a large number of unlabeled training data while others utilize large generative models for data augmentation (Rebuffi et al., 2021) or synthetically generating more training samples (Gowal et al., 2021b; Sehwag et al., 2022).

Original: These works follow a recent trend of “large-scale learning from weak signals,” which stemmed from recent progress on vision language models such as CLIP (Radford et al., 2021).
Revised: These works follow a recent trend of “large-scale learning from weak signals,” which stemmed from recent progress on vision language models such as CLIP (Radford et al., 2021).

Original: The improvement from scaling up, however, has started to reach its limit (Gowal et al., 2021a).
Revised: The improvement from scaling up, however, has started to reach its limit (Gowal et al., 2021a).

Original: We take a different route to improve robustness.
Revised: We take a different route to improve robustness.

Original: Our part-based models utilize supervision and high-quality part segmentation annotations to improve robustness without using more training samples or complex data augmentation.
Revised: Our part-based models utilize supervision and high-quality part segmentation annotations to improve robustness without using more training samples or complex data augmentation.

Original: 2. P ART -B ASED M ODELS
Revised: 2. P ART -B ASED M ODELS

Original: Part models generally refer to hierarchical models that recognize objects from their parts in a bottomup manner, e.g., Deformable Part Models (Endres et al., 2013; Felzenszwalb et al., 2010; Chen et al., 2014; Girshick et al., 2015; Cho et al., 2015).
Revised: Part models generally refer to hierarchical models that recognize objects from their parts in a bottomup manner, e.g., Deformable Part Models (Endres et al., 2013; Felzenszwalb et al., 2010; Chen et al., 2014; Girshick et al., 2015; Cho et al., 2015).

Original: Historically, they are most often used in human recognition (Chen & Yuille, 2014; Gkioxari et al., 2015; Xia et al., 2017; Ruan et al., 2019) and have shown success in fine-grained classification (Zhang et al., 2018;
Revised: Historically, they are most often used in human recognition (Chen & Yuille, 2014; Gkioxari et al., 2015; Xia et al., 2017; Ruan et al., 2019) and have shown success in fine-grained classification (Zhang et al., 2018;

Original: Bai et al., 2019) as well as pose estimation (Lorenz et al., 2019; Georgakis et al., 2019).
Revised: Bai et al., 2019) as well as pose estimation (Lorenz et al., 2019; Georgakis et al., 2019).

Original: We revisit part-based models from the robustness perspective and design a general model that can be trained end-to-end without any feature engineering.
Revised: We revisit part-based models from the robustness perspective and design a general model that can be trained end-to-end without any feature engineering.

Original: Our technique is also agnostic to a particular type of object.
Revised: Our technique is also agnostic to a particular type of object.

Original: The most relevant work on adversarial robustness and part-based models are Freitas et al. (2020) and Chandrasekaran et al.
Revised: Several works have explored part-based models in the context of adversarial robustness.

Original: Freitas et al.
Revised: Freitas et al.

Original: (2020) detect adversarial examples by using a Mask R-CNN to extract object parts and verify that they align with the predicted label.
Revised: (2020) detect adversarial examples by using a Mask R-CNN to extract object parts and verify that they align with the predicted label.

Original: If the predicted and the expected parts do not align, the input is regarded as an attack.
Revised: If the predicted and the expected parts do not align, the input is regarded as an attack.

Original: However, unlike our work, their scheme is not evaluated against an adaptive adversary.
Revised: However, unlike our work, their scheme is not evaluated against an adaptive adversary.

Original: Chandrasekaran et al.
Revised: Chandrasekaran et al.

Original: (2019) propose a robust classifier with a hierarchical structure where each node separates inputs into multiple groups, each sharing a certain feature (e.g., object shape).
Revised: (2019) propose a robust classifier with a hierarchical structure where each node separates inputs into multiple groups, each sharing a certain feature (e.g., object shape).

Original: Unlike our part model, its structure depends heavily on the objects being classified and does not utilize part segmentation or richer supervision.
Revised: Unlike our part model, its structure depends heavily on the objects being classified and does not utilize part segmentation or richer supervision.

Revised: A concurrent work by Li et al.

Revised: (2023) also investigates segmentation-based part-based models for robustness.

Original:  P ART -B ASED M ODELS 3. G ENERAL D ESIGN
Revised:  P ART -B ASED M ODELS 3. G ENERAL D ESIGN

Original: Data samples.
Revised: Data samples.

Original: Each sample ( x, y ) contains an image x ∈ R 3 × H × W and a class label y ∈ Y , where H and W are the image’s height and width.
Revised: Each sample ( x, y ) contains an image x ∈ R 3 × H × W and a class label y ∈ Y , where H and W are the image’s height and width.

Original: The training dataset for part models are also accompanied by segmentation masks M ∈ { 0 , 1 } ( K +1)
Revised: The training dataset for part models are also accompanied by segmentation masks M ∈ { 0 , 1 } ( K +1)

Original: × H × W , corresponding to K +1 binary masks for the K object parts ( M 1 , . .
Revised: × H × W , corresponding to K +1 binary masks for the K object parts ( M 1 , . .

Original: , M k ) and one for the background ( M 0 ).
Revised: , M k ) and one for the background ( M 0 ).

Original: Architecture.
Revised: Architecture.

Original: Our part-based model has two stages: the segmenter f seg : R 3 × H × W →
Revised: Our part-based model has two stages: the segmenter f seg : R 3 × H × W →

Original: R ( K +1)
Revised: R ( K +1)

Original: × H × W and a tiny classifier f cls : R ( K +1)
Revised: × H × W and a tiny classifier f cls : R ( K +1)

Original: × H × W → R C .
Revised: × H × W → R C .

Original: The overall model is denoted by f :=
Revised: The overall model is denoted by f :=

Original: f cls ◦ f seg .
Revised: f cls ◦ f seg .

Original: More specifically, the segmenter takes the original image x as the input and outputs logits for the K + 1 masks, denoted by ˆ M := f seg ( x ) , of the same dimension as M .
Revised: More specifically, the segmenter takes the original image x as the input and outputs logits for the K + 1 masks, denoted by ˆ M := f seg ( x ) , of the same dimension as M .

Original: The second-stage classifier then processes ˆ M and returns the predicted class probability f ( x ) =
Revised: The second-stage classifier then processes ˆ M and returns the predicted class probability f ( x ) =

Original: f cls ( ˆ M ) =
Revised: f cls ( ˆ M ) =

Original: f cls ( f seg ( x )) .
Revised: f cls ( f seg ( x )) .

Original: The predicted label is given by ˆ y := arg max i ∈
Revised: The predicted label is given by ˆ y := arg max i ∈

Original: [ C ] f ( x ) i .
Revised: [ C ] f ( x ) i .

Original: Fig.visually summarizes our design.
Revised: Fig.visually summarizes our design.

Original: We use DeepLabv3+ (Chen et al., 2018) with ResNet-50 backbone (He et al., 2016) as the segmenter, but our part-based model is agnostic to the choice of segmenter architecture.
Revised: We use DeepLabv3+ (Chen et al., 2018) with ResNet-50 backbone (He et al., 2016) as the segmenter, but our part-based model is agnostic to the choice of segmenter architecture.

Original: Additionally, all of the classifiers are designed to be end-to-end differentiable.
Revised: Additionally, all of the classifiers are designed to be end-to-end differentiable.

Original: This facilitates the evaluation process as well making our models compatible with adversarial training.
Revised: This facilitates the evaluation process as well making our models compatible with adversarial training.

Original: Classifier design principles.
Revised: Classifier design principles.

Original: We experimented with various classifier architectures, each of which processes the predicted masks differently.
Revised: We experimented with various classifier architectures, each of which processes the predicted masks differently.

Original: Our design criteria were:
Revised: Our design criteria were:

Original: Part-based classification : The classifier should only predict based on the output of the segmenter.
Revised: Part-based classification : The classifier should only predict based on the output of the segmenter.

Original: It does not see the original image.
Revised: It does not see the original image.

Original: If the segmenter is correct and robust, the class label can be easily obtained from the masks alone.
Revised: If the segmenter is correct and robust, the class label can be easily obtained from the masks alone.

Original: Disentangle irrelevant features : The background is not part of the object being classified so the segmenter should separate it from the foreground pixels.
Revised: Disentangle irrelevant features : The background is not part of the object being classified so the segmenter should separate it from the foreground pixels.

Original: Sometimes, background features could result in spurious correlation (Xiao et al., 2021; Sagawa et al., 2020).
Revised: Sometimes, background features could result in spurious correlation (Xiao et al., 2021; Sagawa et al., 2020).

Original: Thus, we could simply drop the predicted background pixels or leave it to the second-stage classifier to correctly utilize them.
Revised: Thus, we could simply drop the predicted background pixels or leave it to the second-stage classifier to correctly utilize them.

Original: This design choice is explored further in Appendix D.6.
Revised: This design choice is explored further in Appendix D.7.

Original: Location-aware : The second-stage classifier should utilize the location and the size of the parts, in addition to their existence.
Revised: Location-aware : The second-stage classifier should utilize the location and the size of the parts, in addition to their existence.

Original: Following these principles, we designed four part-based classifiers, Downsampled , Bounding-Box ,
Revised: Following these principles, we designed four part-based classifiers, Downsampled , Bounding-Box ,

Original: Two-Headed , and Pixel .
Revised: Two-Headed , and Pixel .

Original: The first two perform as well or better than the others, so we focus only on them in the main text of the paper.
Revised: The first two perform as well or better than the others, so we focus only on them in the main text of the paper.

Original: Appendix C has details on the others.
Revised: Appendix C has details on the others.

Original: 3. D OWNSAMPLED P ART - BASED M ODEL
Revised: 3. D OWNSAMPLED P ART - BASED M ODEL

Original: This model first applies softmax on the predicted mask logits ˆ M . The softmax normalizes the masks pixel-wiseand restricts them to be between 0 and 1.
Revised: This model first applies softmax on the predicted mask logits ˆ M to normalize the masks pixel-wise to a number between 0 and 1.

Original: This potentially benefits robustness: if the masks were not normalized, a few pixels could be manipulated to have a very large value and outweigh the benign pixels.
Revised: This potentially benefits robustness: if the masks were not normalized, a few pixels could be manipulated to have a very large value and outweigh the benign pixels.

Original: Empirically, this softmax doesn’t lead to gradient obfuscation (Athalye et al., 2018)
Revised: Empirically, this softmax doesn’t lead to gradient obfuscation (Athalye et al., 2018)

Original: (Appendix D.3).
Revised: (Appendix D.3).

Original: After that, the masks are downsampled to size 4 × 4 ( R K × 4 × 4 ) by an adaptive average pooling layer before being passed to a tiny neural network with one convolution layer and two fully-connected layers.
Revised: After that, the masks are downsampled to size 4 × 4 ( R K × 4 × 4 ) by an adaptive average pooling layer before being passed to a tiny neural network with one convolution layer and two fully-connected layers.

Original: Fig.
Revised: Fig.

Original: 3a illustrates this model.
Revised: 3a illustrates this model.

Original: Downsampling maintains coarse-grained spatial information[Figure] about each part’s rough shape and location while compressing high-dimensional masks to a lowdimensional feature vector.
Revised: Downsampling maintains coarse-grained spatial information about each part’s rough shape and location while compressing high-dimensional masks to a lowdimensional feature vector.

Original: This keeps the classifier small, making the part-based model comparable  to the normal ResNet-50 in size.
Revised: This keeps the classifier small, making the part-based model comparable [Figure] to the normal ResNet-50 in size.

Original: We find that the particular size of the downsampled mask has little effect on the accuracy of the model (see Appendix D.7 for the comparison).
Revised: We find that the particular size of the downsampled mask has little effect on the accuracy of the model (see Appendix D.8 for the comparison).

Original: 3. B OUNDING -B OX P ART - BASED M ODEL
Revised: 3. B OUNDING -B OX P ART - BASED M ODEL

Original: Similar to the downsampled classifier, the bounding-box classifier also compresses ˆ M to a lowerdimensional representation, but instead of downsampling, it uses bounding boxes.
Revised: Similar to the downsampled classifier, the bounding-box classifier also compresses ˆ M to a lowerdimensional representation, but instead of downsampling, it uses bounding boxes.

Original: Specifically, it processes each of the logit segmentation masks, ˆ M i , into K “soft” bounding boxes, one for each object part, excluding the background channel (see Fig. 3b).
Revised: Specifically, it processes each of the logit segmentation masks, ˆ M i , into K “soft” bounding boxes, one for each object part, excluding the background channel (see Fig. 3b).

Original: Each bounding box is represented by five features: a logit score ( s i ∈
Revised: Each bounding box is represented by five features: a logit score ( s i ∈

Original: [0 , 1] ), a centroid ( c 1 i , c 2 i ∈ [ − 1 , 1] ) representing the (normalized) 2D coordinates of the center of the bounding box, and a standard deviation ( σ 1 i , σ 2 i ∈ [0 , 1] ) capturing the height and the width of the box.
Revised: [0 , 1] ), a centroid ( c 1 i , c 2 i ∈ [ − 1 , 1] ) representing the (normalized) 2D coordinates of the center of the bounding box, and a standard deviation ( σ 1 i , σ 2 i ∈ [0 , 1] ) capturing the height and the width of the box.

Original: We describe how these features are computed below.
Revised: We describe how these features are computed below.

Original: This gives us a dense feature vector v =
Revised: This gives us a dense feature vector v =

Original: [ v 1 , . . .
Revised: [ v 1 , . . .

Original: , v K ] ∈ R 5 K where v i =
Revised: , v K ] ∈ R 5 K where v i =

Original: [ s i , c 1 i , c 2 i , σ 1 i , σ 2 i ] ∈ R 5 .
Revised: [ s i , c 1 i , c 2 i , σ 1 i , σ 2 i ] ∈ R 5 .

Original: Finally, a tiny fully-connected neural network predicts the class label given v and no other information.
Revised: Finally, a tiny fully-connected neural network predicts the class label given v and no other information.

Original: Crucially, we ensure that the computation of these features is differentiable to enable effective training as well as reliable evaluation of adversarial robustness.
Revised: Crucially, we ensure that the computation of these features is differentiable to enable effective training as well as reliable evaluation of adversarial robustness.

Original: First, we compute a mask ˆ F that for all foreground pixels.
Revised: First, we compute a mask ˆ F that for all foreground pixels.

Original: Then, the confidence score for each part mask, s i , is the weighted average of the part logit mask ˆ M i over all pixels, weighted by ˆ F .
Revised: Then, the confidence score for each part mask, s i , is the weighted average of the part logit mask ˆ M i over all pixels, weighted by ˆ F .

Original: [Equation]
Revised: [Equation]

Original: where
Revised: where

Original: [Equation]
Revised: [Equation]

Original: The other four bounding-box features are computed as follows:
Revised: The other four bounding-box features are computed as follows:

Original: [Equation]
Revised: [Equation]

Original:  p [Equation] ( w ) 
Revised: where p i ( h ′ ) =

Original: [Equation]

Original: ( w − c 2 i )

Original: [Equation]

Original: 3) where p i ( h ′ )

Original: = (cid:80) Ww =1 ¯ M ( h ′ ,w ) i [Equation] Hh
Revised: (cid:80) Ww =1 ¯ M ( h ′ ,

Original: [Equation]

Original: Ww

Original: [Equation]
Revised: [Equation]

Original: h
Revised: i

Original: [Equation]
Revised: [Equation]

Original: and ¯ M ( h,w ) =
Revised: and ¯ M ( h,w ) =

Original: Softmax (cid:16) ˆ M ( h,w ) (cid:17) [1 ,...,K ] is the softmax mask with the background channel removed.
Revised: Softmax (cid:16) ˆ M ( h,w ) (cid:17) [1 ,...,K ] is the softmax mask with the background channel removed.

Original: Note that p i ( h ) and p i ( w ) can be interpreted as the (normalized) density of the i -th object part in row h or column w , and
Revised: Note that p i ( h ) and p i ( w ) can be interpreted as the (normalized) density of the i -th object part in row h or column w , and

Original: ˆ M ( h,w ) i as its mass.
Revised: ˆ M ( h,w ) i as its mass.

Original: Hence, c 1 i and c 2 i are simply the centroid of the i -th part.
Revised: Hence, c 1 i and c 2 i are simply the centroid of the i -th part.

Original: σ 1 i and σ 2 i measure the spread of mass so we use them as a proxy for the height and the width of the part.
Revised: σ 1 i and σ 2 i measure the spread of mass so we use them as a proxy for the height and the width of the part.

Original: 3. T RAINING L OSSES
Revised: 3. T RAINING L OSSES

Original: Normal loss.
Revised: Normal loss.

Original: These part-based models are trained end-to-end with a combined segmentationclassification loss, i.e., a weighted sum of two cross-entropy losses, one for the classification task and one for the pixel-wise segmentation task.
Revised: These part-based models are trained end-to-end with a combined segmentationclassification loss, i.e., a weighted sum of two cross-entropy losses, one for the classification task and one for the pixel-wise segmentation task.

Original: A hyperparameter, c seg ∈ [0 , 1] , balances these two losses. 
Revised: A hyperparameter, c seg ∈ [0 , 1] , balances these two losses. [Equation]

Original: [Equation]
Revised: [Equation]

Original: where
Revised: where

Revised: L

Original: [Equation]
Revised: [Equation]

Original: and
Revised: and

Original: [Equation]
Revised: [Equation]

Original: Adversarial loss.
Revised: Adversarial loss.

Original: We construct an adversarial version of this loss, that measures susceptibility to adversarial examples.
Revised: We construct an adversarial version of this loss, that measures susceptibility to adversarial examples.

Original: The adversary’s goal is to maximize the classification loss (since it is the main task we evaluate on).
Revised: The adversary’s goal is to maximize the classification loss (since it is the main task we evaluate on).

Original: The same adversarial example x ∗ generated from the classification loss is also used to compute the segmentation loss.
Revised: The same adversarial example x ∗ generated from the classification loss is also used to compute the segmentation loss.

Original: [Equation]
Revised: [Equation]

Original: where
Revised: where

Original: [Equation]
Revised: [Equation]

Original: TRADES loss.
Revised: TRADES loss.

Original: We combine this with TRADES loss (Zhang et al., 2019) which introduces an extra term, a Kullback–Leibler divergence ( D KL ) between the clean and the adversarial probability output.
Revised: We combine this with TRADES loss (Zhang et al., 2019) which introduces an extra term, a Kullback–Leibler divergence ( D KL ) between the clean and the adversarial probability output.

Original: [Equation]
Revised: [Equation]

Original: where
Revised: where

Original: [Equation]
Revised: [Equation]

Original: 3. E XPERIMENT S ETUP 3.5. D ATASET P REPARATION
Revised: 3. E XPERIMENT S ETUP 3.5. D ATASET P REPARATION

Original: We demonstrate our part models on three datasets where part-level annotations are available: PartImageNet (He et al., 2021), Cityscapes (Meletis et al., 2020), and PASCAL-Part (Chen et al., 2014).
Revised: We demonstrate our part models on three datasets where part-level annotations are available: PartImageNet (He et al., 2021), Cityscapes (Meletis et al., 2020), and PASCAL-Part (Chen et al., 2014).

Original: Cityscapes and PASCAL-Part were originally created for segmentation, so we construct a classification task from them.
Revised: Cityscapes and PASCAL-Part were originally created for segmentation, so we construct a classification task from them.

Original: For Cityscapes, we create a human-vs-vehicle classification task.
Revised: For Cityscapes, we create a human-vs-vehicle classification task.

Original: For each human or vehicle instance with part annotations, we crop a square patch around it with some random amount of padding and assign the appropriate class label.
Revised: For each human or vehicle instance with part annotations, we crop a square patch around it with some random amount of padding and assign the appropriate class label.

Original: PASCAL-Part samples do not require cropping because each image contains only a few objects, so we simply assign a label to each image based on the largest object in that image.
Revised: PASCAL-Part samples do not require cropping because each image contains only a few objects, so we simply assign a label to each image based on the largest object in that image.

Original: To deal with the class imbalance problem, we select only the top five most common classes.
Revised: To deal with the class imbalance problem, we select only the top five most common classes.

Original: Appendix A presents additional detail on the datasets.
Revised: Appendix A presents additional detail on the datasets.

Original: 3.5. N ETWORK A RCHITECTURE AND T RAINING P ROCESS
Revised: 3.5. N ETWORK A RCHITECTURE AND T RAINING P ROCESS

Original: ResNet-50 (He et al., 2016) is our baseline.
Revised: ResNet-50 (He et al., 2016) is our baseline.

Original: Our part-based models (which use DeepLabv3+ with
Revised: Our part-based models (which use DeepLabv3+ with

Original: ResNet-50 backbone) have a similar size to the baseline: our part-based models have 26.7M parameters, compared to 25.6M parameters for ResNet-50.
Revised: ResNet-50 backbone) have a similar size to the baseline: our part-based models have 26.7M parameters, compared to 25.6M parameters for ResNet-50.

Original: All models are trained with SGD and a batch size of 128, using either adversarial training or TRADES, with 10-step ℓ ∞ -PGD with ϵ = 8 /and step size of 2 / 255 .
Revised: All models are trained with SGD and a batch size of 128, using either adversarial training or TRADES, with 10-step ℓ ∞ -PGD with ϵ = 8 /and step size of 2 / 255 .

Original: Training is early stopped according to adversarial accuracy computed on the held-out validation set.
Revised: Training is early stopped according to adversarial accuracy computed on the held-out validation set.

Original: All models, both ResNet-50 and part-based models, are pre-trained on unperturbed images for 50 epochs to speed up adversarial training (Gupta et al., 2020).
Revised: All models, both ResNet-50 and part-based models, are pre-trained on unperturbed images for 50 epochs to speed up adversarial training (Gupta et al., 2020).

Original: 3.5. H YPERPARAMETERS
Revised: 3.5. H YPERPARAMETERS

Original: Since our experiments are conducted on new datasets, we take particular care in tuning the hyperparameters (e.g, learning rate, weight decay factor, TRADES’ β , and c seg ) for both the baseline and our part-based models.
Revised: Since our experiments are conducted on new datasets, we take particular care in tuning the hyperparameters (e.g, learning rate, weight decay factor, TRADES’ β , and c seg ) for both the baseline and our part-based models.

Original: For all models, we use grid search on the learning rate ( 0 . 1 , 0 . 05 , 0 . 02 ) and the weight decay ( 1 × 10 − 4 , 5 × 10 − 4 ) during PGD adversarial training.
Revised: For all models, we use grid search on the learning rate ( 0 . 1 , 0 . 05 , 0 . 02 ) and the weight decay ( 1 × 10 − 4 , 5 × 10 − 4 ) during PGD adversarial training.

Original: For the part-based models, after obtaining the best learning rate and weight decay, we then further tune c seg by sweeping[Table] [Figure] values 0 .
Revised: For the part-based models, after obtaining the best learning rate and weight decay, we then further tune c seg by sweeping values 0 .

Original: . , 0 . 9 and report on the model with comparable adversarial accuracy to the baseline.
Revised: . , 0 . 9 and report on the model with comparable adversarial accuracy to the baseline.

Original: Results for other values of c seg are included in Section D.2.
Revised: Results for other values of c seg are included in Section D.2.

Original: For TRADES, we reuse the best hyperparameters obtained previously and sweep a range of the
Revised: For TRADES, we reuse the best hyperparameters obtained previously and sweep a range of the

Original: TRADES parameter β , from 0 .
Revised: TRADES parameter β , from 0 .

Original: 05 to 2 , to generate the accuracy-robustness trade-off curve.
Revised: 05 to 2 , to generate the accuracy-robustness trade-off curve.

Original: However,  we do not tune c seg here and keep it fixed at 0 .
Revised: However, [Table] [Figure] we do not tune c seg here and keep it fixed at 0 .

Original: 5 which puts equal weight on the classification and the segmentation losses.
Revised: 5 which puts equal weight on the classification and the segmentation losses.

Original: The same hyperparameter tuning strategy is used on both the baseline and our part models.
Revised: The same hyperparameter tuning strategy is used on both the baseline and our part models.

Original: We include our code along with the data preparation scripts in the supplementary material.
Revised: We include our code along with the data preparation scripts in the supplementary material.

Original: Appendix B contains a detailed description of the experiment.
Revised: Appendix B contains a detailed description of the experiment.

Original:  R OBUSTNESS E VALUATION
Revised:  R OBUSTNESS E VALUATION

Original: We compare the adversarial robustness and the clean accuracy of the part-based models to the ResNet50 baseline.
Revised: We compare the adversarial robustness and the clean accuracy of the part-based models to the ResNet50 baseline.

Original: We must examine both metrics at the same time since there is a known trade-off between them (Tsipras et al., 2019).
Revised: We must examine both metrics at the same time since there is a known trade-off between them (Tsipras et al., 2019).

Original: We use AutoAttack (Croce & Hein, 2020), a standard and reliable ensemble of attacks, to compute the adversarial accuracy of all models.
Revised: We use AutoAttack (Croce & Hein, 2020), a standard and reliable ensemble of attacks, to compute the adversarial accuracy of all models.

Original: We also follow the suggested procedures from Carlini et al.
Revised: We also follow the suggested procedures from Carlini et al.

Original: (2019) to ensure that our evaluation is free from the notorious gradient obfuscation problem.
Revised: (2019) to ensure that our evaluation is free from the notorious gradient obfuscation problem.

Original: For further discussion, see Appendix D.3.
Revised: For further discussion, see Appendix D.3.

Original: Table 1 compares the part-based models to the baseline ResNet-50 under two training methods: PGD adversarial training (Madry et al., 2018) and TRADES (Zhang et al., 2019).
Revised: Table 1 compares the part-based models to the baseline ResNet-50 under two training methods: PGD adversarial training (Madry et al., 2018) and TRADES (Zhang et al., 2019).

Original: For PGD-trained models, both of the part-based models achieve about 3–15 percentage points higher clean accuracy than the baseline with similar adversarial accuracy.
Revised: For PGD-trained models, both of the part-based models achieve about 3–15 percentage points higher clean accuracy than the baseline with similar adversarial accuracy.

Original: The models trained on Cityscapes show the largest improvement, followed by ones on Part-ImageNet and PASCAL-Part.
Revised: The models trained on Cityscapes show the largest improvement, followed by ones on Part-ImageNet and PASCAL-Part.

Original: TRADES allows controlling the tradeoff between clean vs adversarial accuracy, so we choose models with similar clean accuracy and compare their robustness.
Revised: TRADES allows controlling the tradeoff between clean vs adversarial accuracy, so we choose models with similar clean accuracy and compare their robustness.

Original: The part models outperform the baseline by about 16, 11, andpercentage points on Part-ImageNet, Cityscapes, and PASCAL-Part, respectively.
Revised: The part models outperform the baseline by about 16, 11, andpercentage points on Part-ImageNet, Cityscapes, and PASCAL-Part, respectively.

Original: These results show that part-based models significantly improve adversarial robustness.
Revised: These results show that part-based models significantly improve adversarial robustness.

Original: Fig.
Revised: Fig.

Original: 4 plots the robustness-accuracy trade-off curves for all three datasets, generated by sweeping the
Revised: 4 plots the robustness-accuracy trade-off curves for all three datasets, generated by sweeping the

Original: TRADES hyperparameter
Revised: TRADES hyperparameter

Original: β
Revised: β

Original: (see Section 3.5.3).
Revised: (see Section 3.5.3).

Original: Our part-based models are closer to the top-right corner of the plot, indicating that they outperform the baseline on both clean and adversarial accuracy.
Revised: Our part-based models are closer to the top-right corner of the plot, indicating that they outperform the baseline on both clean and adversarial accuracy.

Original: Fig.
Revised: Fig.

Original: 5 shows ten randomly chosen test samples from Part-ImageNet along with their predictions from the adversarially trained bounding-box part model, with and without the attack.
Revised: 5 shows ten randomly chosen test samples from Part-ImageNet along with their predictions from the adversarially trained bounding-box part model, with and without the attack.

Original: Most of the part-based models, including this one, achieve above 80% pixel-wise segmentation accuracy on clean samples and about 70% on adversarial ones.
Revised: Most of the part-based models, including this one, achieve above 80% pixel-wise segmentation accuracy on clean samples and about 70% on adversarial ones.

Original: Successful attacks can change most, but not all, foreground pixels to the wrong class, but the shape and foreground-vs-background prediction for each part remains correct; the attack changes only the predicted class for each part.
Revised: Successful attacks can change most, but not all, foreground pixels to the wrong class, but the shape and foreground-vs-background prediction for each part remains correct; the attack changes only the predicted class for each part.

Original: This suggests that part-based models may learn shape features that are more difficult to manipulate, an observation that aligns with our quantitative results on shape-vs-texture bias in Section 5.1.
Revised: This suggests that part-based models may learn shape features that are more difficult to manipulate, an observation that aligns with our quantitative results on shape-vs-texture bias in Section 5.1.

Original: We suspect the robustness of these part shapes might account for the model’s improved robustness.
Revised: We suspect the robustness of these part shapes might account for the model’s improved robustness.

Original: Attacking the segmenter model.
Revised: Attacking the segmenter model.

Original: To ensure that we evaluate our models with the strongest attack possible, we come up with two additional attacks that target the segmenter.
Revised: To ensure that we evaluate our models with the strongest attack possible, we come up with two additional attacks that target the segmenter.

Original: First is the single-staged attack which optimizes a combination of the classification and the segmentation losses as in Eqn. 8.
Revised: First is the single-staged attack which optimizes a combination of the classification and the segmentation losses as in Eqn. 8.

Original: The second attack is the two-staged attack where the first stage attacks the segmenter alone to produce the worst-case mask.
Revised: The second attack is the two-staged attack where the first stage attacks the segmenter alone to produce the worst-case mask.

Original: This step generates “guiding samples” which are then used to initialize the second stage that attacks the part model end-to-end.
Revised: This step generates “guiding samples” which are then used to initialize the second stage that attacks the part model end-to-end.

Original: For this attack, we experiment with four variations that differ in how the target masks are chosen in the first stage.
Revised: For this attack, we experiment with four variations that differ in how the target masks are chosen in the first stage.

Original: We find that the single-stage attack is always worse than the normal PGD attack.
Revised: We find that the single-stage attack is always worse than the normal PGD attack.

Original: A small subset of the two-stage attacks performs better than PGD, but all of them are worse than AutoAttack.
Revised: A small subset of the two-stage attacks performs better than PGD, but all of them are worse than AutoAttack.

Original: For more details, see Appendix D.3.
Revised: For more details, see Appendix D.3.

Original: [Table]

Original: [Table]

Original: [Table]

Original: [Table]

Original: [Table]

Original:  U NDERSTANDING THE P ART -B ASED M ODELS 5. E VALUATING N ON - ADVERSARIAL R OBUSTNESS
Revised:  U NDERSTANDING THE P ART -B ASED M ODELS 5. E VALUATING N ON - ADVERSARIAL R OBUSTNESS

Original: Part-based models improve adversarial robustness, but what about robustness to non-adversarial distribution shift?
Revised: Part-based models improve adversarial robustness, but what about robustness to non-adversarial distribution shift?

Original: We evaluate the models on three scenarios: common corruptions, foreground-vsbackground spurious correlation, and shape-vs-texture bias.
Revised: We evaluate the models on three scenarios: common corruptions, foreground-vsbackground spurious correlation, and shape-vs-texture bias.

Original: We generate benchmarks from PartImageNet following the same procedure as ImageNet-C (Hendrycks & Dietterich, 2019) for common corruptions, ImageNet-9 (Xiao et al., 2021) for foreground-vs-background spurious correlation, and
Revised: We generate benchmarks from PartImageNet following the same procedure as ImageNet-C (Hendrycks & Dietterich, 2019) for common [Table] [Table] [Table]

Revised: [Table]

Revised: corruptions, ImageNet-9 (Xiao et al., 2021) for foreground-vs-background spurious correlation, and

Original: Stylized ImageNet (Geirhos et al., 2019) for shape-vs-texture bias.
Revised: Stylized ImageNet (Geirhos et al., 2019) for shape-vs-texture bias.

Original: For the common corruptions, the benchmark is composed of 15 corruption types and five severity levels.
Revised: For the common corruptions, the benchmark is composed of 15 corruption types and five severity levels.

Original: The spurious correlation benchmark is generated from a subset of foreground (“Only-FG”) and background (“Only-BG-T”) of ImageNet-9, filtering out classes not present in Part-ImageNet.
Revised: The spurious correlation benchmark is generated from a subset of foreground (“Only-FG”) and background (“Only-BG-T”) of ImageNet-9, filtering out classes not present in Part-ImageNet.

Original: Each foreground image is paired with a randomly chosen background image of another class.
Revised: Each foreground image is paired with a randomly chosen background image of another class.

Original: For shape-vs-texture bias, the data are generated by applying styles/textures using neural style transfer.
Revised: For shape-vs-texture bias, the data are generated by applying styles/textures using neural style transfer.

Original: We train a ResNet-50 model and two part-based models using conventional training (not adversarial training) on clean Part-ImageNet samples.
Revised: We train a ResNet-50 model and two part-based models using conventional training (not adversarial training) on clean Part-ImageNet samples.

Original: We tune the hyperparameters as described in Section 3.5.3.
Revised: We tune the hyperparameters as described in Section 3.5.3.

Original: For each benchmark, the best-performing set of hyperparameters is used to train 10 randomly initialized models to compute the confidence interval.
Revised: For each benchmark, the best-performing set of hyperparameters is used to train 10 randomly initialized models to compute the confidence interval.

Original: On all of the benchmarks, the part-based models outperform the baseline by 3–7 percentage points (see Tables 2, 3, and 4).
Revised: On all of the benchmarks, the part-based models outperform the baseline by 3–7 percentage points (see Tables 2, 3, and 4).

Original: The improvement over the ResNet-50 baseline is statistically significant (two-sample t -test, p -values below 10 − 6 ).
Revised: The improvement over the ResNet-50 baseline is statistically significant (two-sample t -test, p -values below 10 − 6 ).

Original: We note that these robustness gains do not come at a cost of clean accuracy as the clean accuracy of our part models is about 1% higher on average than that of the ResNet-50.
Revised: We note that these robustness gains do not come at a cost of clean accuracy as the clean accuracy of our part models is about 1% higher on average than that of the ResNet-50.

Original: This suggests that part-based models are more robust to common corruptions, better disentangle foreground and background information, and have higher shape bias compared to typical convolutional neural networks.
Revised: This suggests that part-based models are more robust to common corruptions, better disentangle foreground and background information, and have higher shape bias compared to typical convolutional neural networks.

Original: 5. E FFECTS OF P ART S EGMENTATION L ABELS VS A RCHITECTURE
Revised: 5. E FFECTS OF P ART S EGMENTATION L ABELS VS A RCHITECTURE

Original: Where does the robustness improvement come from?
Revised: Where does the robustness improvement come from?

Original: Does it come from the additional information provided by part annotations, or from the new architecture we introduce?
Revised: Does it come from the additional information provided by part annotations, or from the new architecture we introduce?

Original: To answer these questions, we train part-based models on Part-ImageNet without using the part segmentation labels while keeping the model architecture and hyperparameters fixed (i.e., setting L seg in Eqn. 5 to zero).
Revised: To answer these questions, we train part-based models on Part-ImageNet without using the part segmentation labels while keeping the model architecture and hyperparameters fixed (i.e., setting L seg in Eqn. 5 to zero).

Original: We found that most of the improvement comes from the additional supervision[Table] provided by part annotations.
Revised: We found that most of the improvement comes from the additional supervision provided by part annotations.

Original: In particular, the architecture provides 2–4 percentage points of improvement over ResNet-50, while the additional supervision provides another 8–9 points of improvement in clean accuracy (see Table 5).
Revised: In particular, the architecture provides 2–4 percentage points of improvement over ResNet-50, while the additional supervision provides another 8–9 points of improvement in clean accuracy (see Table 5).

Original: This experiment confirms that most of the gain comes from the additional information provided by fine-grained segmentation labels.
Revised: This experiment confirms that most of the gain comes from the additional information provided by fine-grained segmentation labels.

Revised: We also extend this ablation study and consider other backbone architectures.

Revised: We replace ResNetwith EfficientNet-B4 and ResNeXt-50-32x4d.

Revised: We find that the part-level supervision still improves the model’s accuracy and robustness by a large margin (see Appendix D.8.1 and Table 18).

Revised: [Table]

Revised: when only a fraction of training samples are accompanied by a segmentation label.

Original: 5. T RAINING WITH F EWER P ART S EGMENTATION L ABELS
Revised: 5. T RAINING WITH F EWER P ART S EGMENTATION L ABELS

Original: The main limitation of our approach is the extra labeling cost to obtain part segmentation labels.
Revised: The main limitation of our approach is the extra labeling cost to obtain part segmentation labels.

Original: We investigate how the performance of our models changes when fewer part annotations are available.
Revised: We investigate how the performance of our models changes when fewer part annotations are available.

Original: We train part models with the same number of training samples and class labels but a reduced number of segmentation labels, so some (10–90%) of training samples have both class and segmentation labels while the rest have only the class label.
Revised: We train part models with the same number of training samples and class labels but a reduced number of segmentation labels, so some (10–90%) of training samples have both class and segmentation labels while the rest have only the class label.

Original: As expected, the clean accuracy degrades when the model receives less part-level supervision; see Fig. 6.
Revised: As expected, the clean accuracy degrades when the model receives less part-level supervision; see Fig. 6.

Original: Adversarial accuracy, however, remains more or less the same, and all of the part models still outperform the ResNet-50. 
Revised: Adversarial accuracy, however, remains more or less the same, and all of the part models still outperform the ResNet-50. Given this observation [Table]

Original: We leave it to future work to improve performance when only a small fraction of training samples are part-annotated.
Revised: we attempt to reduce the reliance on the part segmentation labels. Surprisingly, we find that simple pseudo-labeling can reduce the required training labels down by 90%! Using labels generated by another segmentation model results in part models with almost the same accuracy and robustness as the fully-supervised models. See Appendix D.6 and Table 15 for more details.

Original: 5. A LTERNATIVES TO P ART S EGMENTATION L ABELS
Revised: 5. A LTERNATIVES TO P ART S EGMENTATION L ABELS

Original: We additionally explore two labeling strategies for reducing labelling costs: (1) bounding box segmentations for each part, or (2) keypoints or centroids for each part (Fig. 10, Appendix D.4).
Revised: We additionally explore two labeling strategies for reducing labelling costs: (1) bounding box segmentations for each part, or (2) keypoints or centroids for each part (Fig. 10, Appendix D.4).

Original: These annotations provide less precise spatial information about each part but are much faster to label.
Revised: These annotations provide less precise spatial information about each part but are much faster to label.

Original: Bounding-box labels are nearly as effective as segmentation masks on Part-ImageNet and
Revised: Bounding-box labels are nearly as effective as segmentation masks on Part-ImageNet and

Original: Cityscapes (within ∼ 1% difference in accuracy; see Table 6).
Revised: Cityscapes (within ∼ 1% difference in accuracy; see Table 6).

Original: However, the difference is much larger on PASCAL-Part where the clean accuracy is 11% lower.
Revised: However, the difference is much larger on PASCAL-Part where the clean accuracy is 11% lower.

Original: Models trained on centroid labels perform slightly worse than the ones trained on bounding-box labels, which is unsurprising as centroids are even more coarse-grained.
Revised: Models trained on centroid labels perform slightly worse than the ones trained on bounding-box labels, which is unsurprising as centroids are even more coarse-grained.

Original: Nonetheless, all part models trained on any kind of part label still outperform the ResNet-50 baseline.
Revised: Nonetheless, all part models trained on any kind of part label still outperform the ResNet-50 baseline.

Original: We hope our work draws attention to the opportunity for stronger robustness through rich supervision and stimulates research into reducing the labelling cost.
Revised: We hope our work draws attention to the opportunity for stronger robustness through rich supervision and stimulates research into reducing the labeling cost.

Original: We also conduct an ablation study by replacing part segmentation labels with object segmentation labels.
Revised: We also conduct an ablation study by replacing part segmentation labels with object segmentation labels.

Original: Models trained on object segmentation labels are less effective than ones trained on part labels (Appendix D.5).
Revised: Models trained on object segmentation labels are less effective than ones trained on part labels (Appendix D.5).

Original: Even though models trained with object-level labels outperform the baseline, this implies that part-level annotation is still important.
Revised: Even though models trained with object-level labels outperform the baseline, this implies that part-level annotation is still important.

Original:  C ONCLUSION
Revised:  C ONCLUSION

Original: In this work, we propose a new approach to improve adversarial training by leveraging a richer learning signal.
Revised: In this work, we propose a new approach to improve adversarial training by leveraging a richer learning signal.

Original: We materialize this concept through part-based models that are trained simultaneously on object class labels and part segmentation.
Revised: We materialize this concept through part-based models that are trained simultaneously on object class labels and part segmentation.

Original: Our models outperform the baseline, improving the accuracy-robustness trade-off, while also benefiting non-adversarial robustness.
Revised: Our models outperform the baseline, improving the accuracy-robustness trade-off, while also benefiting non-adversarial robustness.

Original: This work suggests a new direction for work on robustness, based on richer supervision rather than larger training sets. 
Revised: This work suggests a new direction for work on robustness, based on richer supervision rather than larger training sets. A CKNOWLEDGEMENTS

Revised: The authors would like to thank Vikash Sehwag and Jacob Steinhardt for their feedback on the paper.

Revised: We also thank the anonymous ICLR reviewers for their helpful comments and suggestions.

Revised: This research was supported by the Hewlett Foundation through the Center for Long-Term Cybersecurity (CLTC), by the Berkeley Deep Drive project and by generous gifts from Open Philanthropy and Google Cloud Research Credits program under Award GCP19980904.

Revised: Jacob Steinhardt also generously lent us the computing resources used in this research

Original: A D ATASETS
Revised: A D ATASETS

Original: Part-ImageNet.
Revised: Part-ImageNet.

Original: Proposed by He et al.
Revised: Proposed by He et al.

Original: (2021), this dataset is a subset of ImageNet-1K where the 158 of the original classes are grouped into 11 coarse-grained classes, e.g., “Quadruped,” “Biped,” “Reptile,” etc.
Revised: (2021), this dataset is a subset of ImageNet-1K where the 158 of the original classes are grouped into 11 coarse-grained classes, e.g., “Quadruped,” “Biped,” “Reptile,” etc.

Original: Each object is accompanied by pixel-wise annotation of 2–5 parts.
Revised: Each object is accompanied by pixel-wise annotation of 2–5 parts.

Original: For instance, a quadruped may have up to four segmentation masks for its head, body, feet, and tail.
Revised: For instance, a quadruped may have up to four segmentation masks for its head, body, feet, and tail.

Original: The dataset is originally proposed for part segmentation or part discovery tasks and is publicly available to download.
Revised: The dataset is originally proposed for part segmentation or part discovery tasks and is publicly available to download.

Original: We note that the Part-ImageNet dataset splits the data by their original ImageNet-1K classes, i.e., 109, 19, and 30 classes for training, validation, and test sets, respectively.
Revised: We note that the Part-ImageNet dataset splits the data by their original ImageNet-1K classes, i.e., 109, 19, and 30 classes for training, validation, and test sets, respectively.

Original: This allows one to measure generalization across sub-population under the same group.
Revised: This allows one to measure generalization across sub-population under the same group.

Original: However, our focus is different; we want to evaluate the robustness under a similar setting to CIFAR-10 whose samples are split i.i.d.
Revised: However, our focus is different; we want to evaluate the robustness under a similar setting to CIFAR-10 whose samples are split i.i.d.

Original: Hence, for this paper, we ignore the original ImageNet class and re-partition the dataset randomly, independent of its original class.
Revised: Hence, for this paper, we ignore the original ImageNet class and re-partition the dataset randomly, independent of its original class.

Original: The Part-ImageNet dataset has 24,095 samples in total.
Revised: The Part-ImageNet dataset has 24,095 samples in total.

Original: Cityscapes.
Revised: Cityscapes.

Original: The Cityscapes dataset is a driving-oriented image dataset whose data were collected from a dashboard camera (Cordts et al., 2016).
Revised: The Cityscapes dataset is a driving-oriented image dataset whose data were collected from a dashboard camera (Cordts et al., 2016).

Original: We use the part-aware panoptic annotations on
Revised: We use the part-aware panoptic annotations on

Original: Cityscapes from Meletis et al.
Revised: Cityscapes from Meletis et al.

Original: (2020) to create our classification dataset.
Revised: (2020) to create our classification dataset.

Original: The Cityscapes dataset is available under a non-commercial license 3 , and the annotation is available under Apache-2.0.
Revised: The Cityscapes dataset is available under a non-commercial license 3 , and the annotation is available under Apache-2.0.

Original: 4 Five kinds of objects are part-annotated, and we group them into two classes.
Revised: 4 Five kinds of objects are part-annotated, and we group them into two classes.

Original: Specifically, “person” and “rider” are grouped as “human,” and “car,” “truck,” and “bus” as “vehicle.”
Revised: Specifically, “person” and “rider” are grouped as “human,” and “car,” “truck,” and “bus” as “vehicle.”

Original: We use the same part labels as Meletis et al.
Revised: We use the same part labels as Meletis et al.

Original: (2020) where humans are annotated with “torso,” “head,” “arms,” and “legs,” and vehicles with “windows,” “wheels,” “lights,” “license plate,” and “chassis.”
Revised: (2020) where humans are annotated with “torso,” “head,” “arms,” and “legs,” and vehicles with “windows,” “wheels,” “lights,” “license plate,” and “chassis.”

Original: Since the samples in Cityscapes are wide-angle photos containing numerous objects, we crop each annotated object out to create a classification dataset.
Revised: Since the samples in Cityscapes are wide-angle photos containing numerous objects, we crop each annotated object out to create a classification dataset.

Original: In particular, we crop each patch into a square and then add a small amount of extra random padding (0–10% of the image size).
Revised: In particular, we crop each patch into a square and then add a small amount of extra random padding (0–10% of the image size).

Original: Additionally, we also filter out small objects that have the total area, determined from the segmentation mask of the entire object, less than 1000 pixels.
Revised: Additionally, we also filter out small objects that have the total area, determined from the segmentation mask of the entire object, less than 1000 pixels.

Original: After filtering, we are left with 29,728 samples in the dataset.
Revised: After filtering, we are left with 29,728 samples in the dataset.

Original: PASCAL-Part.
Revised: PASCAL-Part.

Original: The PASCAL-Part dataset (Chen et al., 2014) provides part-aware segmentation annotation of the PASCAL VOC (2010)
Revised: The PASCAL-Part dataset (Chen et al., 2014) provides part-aware segmentation annotation of the PASCAL VOC (2010)

Original: dataset (Everingham et al., 2010) which is an object recognition and detection dataset.
Revised: dataset (Everingham et al., 2010) which is an object recognition and detection dataset.

Original: Both the annotations and the original dataset are available to the public.
Revised: Both the annotations and the original dataset are available to the public.

Original: The original PASCAL-Part dataset comprises 20 classes, but most of them have 500 or fewer samples.
Revised: The original PASCAL-Part dataset comprises 20 classes, but most of them have 500 or fewer samples.

Original: To ensure that we have a sufficient number of samples per class and avoid the class imbalance problem, we opt to select only the top-five most common classes: “aeroplane,” “bird,” “car,” “cat,” and “dog.”
Revised: To ensure that we have a sufficient number of samples per class and avoid the class imbalance problem, we opt to select only the top-five most common classes: “aeroplane,” “bird,” “car,” “cat,” and “dog.”

Original: In PASCAL-Part, the parts are annotated in a more fine-grained manner, compared to the other two datasets.
Revised: In PASCAL-Part, the parts are annotated in a more fine-grained manner, compared to the other two datasets.

Original: For example, the legs of a dog are labeled as front or back and left or right.
Revised: For example, the legs of a dog are labeled as front or back and left or right.

Original: To make the number of parts per object manageable and comparable to the other two datasets, we group multiple parts of the same type together, e.g., all legs are labeled as “legs.”
Revised: To make the number of parts per object manageable and comparable to the other two datasets, we group multiple parts of the same type together, e.g., all legs are labeled as “legs.”

Original: Our
Revised: Our

Original: PASCAL-Part dataset has 3,662 samples in total.
Revised: PASCAL-Part dataset has 3,662 samples in total.

Original: We also emphasize that we do not use a common benchmark dataset such as CIFAR-10 since it is not part-annotated and is too low-resolution to be useful in practice.
Revised: We also emphasize that we do not use a common benchmark dataset such as CIFAR-10 since it is not part-annotated and is too low-resolution to be useful in practice.

Original: The datasets we use are more realistic and have much higher resolution.
Revised: The datasets we use are more realistic and have much higher resolution.

Original: For training and testing the models, we use the same preprocessing and data augmentation as commonly used for the ImageNet dataset.
Revised: For training and testing the models, we use the same preprocessing and data augmentation as commonly used for the ImageNet dataset.

Original: Specifically, the training samples are randomly cropped and resized to 224 × 224 pixels, using PyTorch’s RandomResizedCrop function with the default hyperparameters, and applied a random horizontal flip.
Revised: Specifically, the training samples are randomly cropped and resized to 224 × 224 pixels, using PyTorch’s RandomResizedCrop function with the default hyperparameters, and applied a random horizontal flip.

Original: Test and validation samples are center cropped to 256 × 256 pixels and then resize to 224 × 224 pixels html .
Revised: Test and validation samples are center cropped to 256 × 256 pixels and then resize to 224 × 224 pixels html .

Original: B D ETAILED E XPERIMENT S ETUP
Revised: B D ETAILED E XPERIMENT S ETUP

Original: Here, we provide information regarding the model implementation in addition to Section 3.5.
Revised: Here, we provide information regarding the model implementation in addition to Section 3.5.

Original: All models are adversarially trained for 50 epochs.
Revised: All models are adversarially trained for 50 epochs.

Original: To help the training converge faster, we also pre-train every model on clean data for 50 epochs before tuning on adversarial training as suggested by Gupta et al.
Revised: To help the training converge faster, we also pre-train every model on clean data for 50 epochs before tuning on adversarial training as suggested by Gupta et al.

Original: We save the weights with the highest accuracy on the held-out validation data which does not overlap with the training or the test set.
Revised: We save the weights with the highest accuracy on the held-out validation data which does not overlap with the training or the test set.

Original: We use the cosine annealing schedule to adjust the learning rate as done in Loshchilov & Hutter (2017).
Revised: We use the cosine annealing schedule to adjust the learning rate as done in Loshchilov & Hutter (2017).

Original: Our experiments are conducted on Nvidia
Revised: Our experiments are conducted on Nvidia

Original: GeForce RTX 2080 TI and V100 GPUs.
Revised: GeForce RTX 2080 TI and V100 GPUs.

Original: To evaluate all the models, we rely on both the strong ensemble AutoAttack and the popular PGD attack.
Revised: To evaluate all the models, we rely on both the strong ensemble AutoAttack and the popular PGD attack.

Original: However, the AutoAttack is always stronger than the PGD attack in all of the cases we experiment with so we only report the adversarial accuracy corresponding to the AutoAttack in the main paper.
Revised: However, the AutoAttack is always stronger than the PGD attack in all of the cases we experiment with so we only report the adversarial accuracy corresponding to the AutoAttack in the main paper.

Original: AutoAttack comprises four different attacks: adaptive PGD with cross-entropy loss ( apgd-ce ), targeted adaptive PGD with DLR loss ( apgd-t ), targeted FAB attack ( fab-t ), and
Revised: AutoAttack comprises four different attacks: adaptive PGD with cross-entropy loss ( apgd-ce ), targeted adaptive PGD with DLR loss ( apgd-t ), targeted FAB attack ( fab-t ), and

Original: Square attack ( square ) (Croce & Hein, 2020).
Revised: Square attack ( square ) (Croce & Hein, 2020).

Original: However, since the DLR loss requires that there are four or more classes, we have to adapt the AutoAttack on the Cityscapes dataset which has two classes.
Revised: However, since the DLR loss requires that there are four or more classes, we have to adapt the AutoAttack on the Cityscapes dataset which has two classes.

Original: As a result, we use only three attacks and remove the targeted ones which leave adaptive
Revised: As a result, we use only three attacks and remove the targeted ones which leave adaptive

Original: PGD with cross-entropy loss ( apgd-ce ), FAB attack ( fab ), and Square attack ( square ).
Revised: PGD with cross-entropy loss ( apgd-ce ), FAB attack ( fab ), and Square attack ( square ).

Original: We use the default hyperparameters for all of the attacks in AutoAttack.
Revised: We use the default hyperparameters for all of the attacks in AutoAttack.

Original: For the PGD attack, we use a step size of 0.001 with 100 iterations and five random restarts.
Revised: For the PGD attack, we use a step size of 0.001 with 100 iterations and five random restarts.

Original: C D ESCRIPTIONS AND R ESULTS ON THE R EMAINING C LASSIFIER A RCHITECTURE
Revised: C D ESCRIPTIONS AND R ESULTS ON THE R EMAINING C LASSIFIER A RCHITECTURE

Original: [Figure]
Revised: [Figure]

Original: The two-headed part model uses a similar architecture to multi-task models with multiple heads.
Revised: The two-headed part model uses a similar architecture to multi-task models with multiple heads.

Original: Here, there are two heads, one for segmentation and one for classification, sharing the same dense representation from the bottleneck layer of DeepLabv3+, as illustrated by Fig.
Revised: Here, there are two heads, one for segmentation and one for classification, sharing the same dense representation from the bottleneck layer of DeepLabv3+, as illustrated by Fig.

Original: It is important to note that the two-headed part model does not explicitly use the predicted segmentation masks in classification.
Revised: It is important to note that the two-headed part model does not explicitly use the predicted segmentation masks in classification.

Original: Instead, the classifier only sees the dense representation that will later be turned into the segmentation mask by the remaining layers of the segmenter.
Revised: Instead, the classifier only sees the dense representation that will later be turned into the segmentation mask by the remaining layers of the segmenter.

Original: From an information-theoretic standpoint, the classifier of the two-headed part model should receive equal or more information than the classifier in the bounding box or the downsampled part model.
Revised: From an information-theoretic standpoint, the classifier of the two-headed part model should receive equal or more information than the classifier in the bounding box or the downsampled part model.

Original: The difference is that this information is represented as dense vectors in the two-headed part model.
Revised: The difference is that this information is represented as dense vectors in the two-headed part model.

Original: However, in the other two models, the information is more human-interpretable and more compressed.
Revised: However, in the other two models, the information is more human-interpretable and more compressed.

Original: C. P IXEL P ART M ODEL
Revised: C. P IXEL P ART M ODEL

Original: The pixel part model is arguably the simplest among all of our part-based models.
Revised: The pixel part model is arguably the simplest among all of our part-based models.

Original: It does not use a small neural network classifier and involves only two simple steps.
Revised: It does not use a small neural network classifier and involves only two simple steps.

Original: First, for each pixel, it sums together the part logits belonging to the same object class.
Revised: First, for each pixel, it sums together the part logits belonging to the same object class.

Original: In other words, the part segmentation mask is turned into the object segmentation mask, i.e., R ( K +1)
Revised: In other words, the part segmentation mask is turned into the object segmentation mask, i.e., R ( K +1)

Original: × H × W
Revised: × H × W

Original: → R C × H × W where K and C are the numbers of parts and classes, respectively.
Revised: → R C × H × W where K and C are the numbers of parts and classes, respectively.

Original: Then, the object scores are averaged across all pixels in the segmentation mask to obtain the final class logits.
Revised: Then, the object scores are averaged across all pixels in the segmentation mask to obtain the final class logits.

Original: This model is summarized in Fig. 8.
Revised: This model is summarized in Fig. 8.

Original: It is also possible to treat the pixel part model as a specific case of the downsampled one where the
Revised: It is also possible to treat the pixel part model as a specific case of the downsampled one where the

Original: [Table]
Revised: [Table]

Original: convolution layer with a kernel size of 1 × 1 mimics the first step, and the classifier represents the average function in the second.
Revised: convolution layer with a kernel size of 1 × 1 mimics the first step, and the classifier represents the average function in the second.

Original: Importantly, averaging the logits across pixels means that the spatial information is ignored completely in the classification process.
Revised: Importantly, averaging the logits across pixels means that the spatial information is ignored completely in the classification process.

Original: This eventually results in a minor reduction in the accuracy compared to the downsampled or the bounding-box model as shown in Appendix D.8 and Table 16.
Revised: This eventually results in a minor reduction in the accuracy compared to the downsampled or the bounding-box model as shown in Appendix D.9 and Table 19.

Original: We do not recommend this model in practice, and it partially serves as an ablation study in our work.
Revised: We do not recommend this model in practice, and it partially serves as an ablation study in our work.

Original: D A DDITIONAL R OBUSTNESS R ESULTS D. H YPERPARAMETER S WEEP R ESULTS
Revised: D A DDITIONAL R OBUSTNESS R ESULTS D. H YPERPARAMETER S WEEP R ESULTS

Original: In this section, we include detailed results from our hyperparameter sweep on the ResNet-50 baseline (Table 7), the downsampled (Table 8), and the bounding-box part models (Table 9).
Revised: In this section, we include detailed results from our hyperparameter sweep on the ResNet-50 baseline (Table 7), the downsampled (Table 8), and the bounding-box part models (Table 9).

Original: The results suggest that all of the adversarially trained models are, to some degree, sensitive to the training hyperparameters, e.g., learning rate and weight decay.
Revised: The results suggest that all of the adversarially trained models are, to some degree, sensitive to the training hyperparameters, e.g., learning rate and weight decay.

Original: Nevertheless, the best setting is rather consistent across most of the models as well as the datasets, i.e., a learning rate of 0 . 1 and weight decay of 5 × 10 − 4 .
Revised: Nevertheless, the best setting is rather consistent across most of the models as well as the datasets, i.e., a learning rate of 0 . 1 and weight decay of 5 × 10 − 4 .

Original: [Table] [Table]
Revised: [Table] [Table]

Original: D. E FFECTS OF THE c seg HYPERPARAMETER
Revised: D. E FFECTS OF THE c seg HYPERPARAMETER

Original: To test the effect of the segmentation loss
Revised: To test the effect of the segmentation loss

Original: [Table]
Revised: [Table]

Original: we train multiple part-based models with c seg varied from 0 to 1.
Revised: we train multiple part-based models with c seg varied from 0 to 1.

Original: With c seg closer to 1, the loss function prioritizes the pixel-wise segmentation accuracy.
Revised: With c seg closer to 1, the loss function prioritizes the pixel-wise segmentation accuracy.

Original: With c seg closer to 0, less emphasis is put on the accuracy of segmentation masks.
Revised: With c seg closer to [Table] less emphasis is put on the accuracy of segmentation masks.

Original: Fig.
Revised: Fig.

Original: 9 shows the accuracy with respect to different c seg values for both downsampled and bounding-box part models.
Revised: 9 shows the accuracy with respect to different c seg values for both downsampled and bounding-box part models.

Original: It is, however, inconclusive whether the smaller or the larger value of c seg is most preferable in this case.
Revised: It is, however, inconclusive whether the smaller or the larger value of c seg is most preferable in this case.

Original: There is a vague trend that larger c seg improves the clean accuracy but reduces the adversarial accuracy, exhibiting some form of trade-off.
Revised: There is a vague trend that larger c seg improves the clean accuracy but reduces the adversarial accuracy, exhibiting some form of trade-off.

Original: This overall trend can be explained by the fact that smaller c seg places more weight on the adversarial classification loss and hence, improves the robustness.
Revised: This overall trend can be explained by the fact that smaller c seg places more weight on the adversarial classification loss and hence, improves the robustness.

Original: [Table]
Revised: [Table]

Original: D. O PTIMALITY OF THE A TTACKS
Revised: D. O PTIMALITY OF THE A TTACKS

Original: Gradient Obfuscation.
Revised: Gradient Obfuscation.

Original: We do not believe our models suffer from gradient obfuscation.
Revised: We do not believe our models suffer from gradient obfuscation.

Original: First, our models do not use any non-differentiable operations or randomization; they use only standard neural network layers.
Revised: First, our models do not use any non-differentiable operations or randomization; they use only standard neural network layers.

Original: Second
Revised: Second

Original: [Table]
Revised: [Table]

Original: we conduct a sanity check suggested by Carlini et al.
Revised: we conduct a sanity check suggested by Carlini et al.

Original: by making sure that a simple
Revised: by making sure that a simple

Original: PGD attack can reduce the accuracy close to zero when the perturbation norm increases.
Revised: PGD attack can reduce the accuracy close to zero when the perturbation norm increases.

Original: Our new experiment, reported in Table
Revised: Our new experiment, reported in Table

Original: [Table]
Revised: [Table]

Original: confirms this as the adversarial accuracy of our part-based models does drop to < 2% at ϵ = 32 / 255 .
Revised: confirms this as the adversarial accuracy of our part-based models does drop to < 2% at ϵ = 32 / 255 .

Original: Third, we have also experimented with decision-based black-box attacks that do not rely on gradient information.
Revised: Third, we have also experimented with decision-based black-box attacks that do not rely on gradient information.

Original: We use AutoAttack (Croce & Hein, 2020), which incorporates Square Attack (Andriushchenko et al., 2020) which does not rely on gradients and only uses the output scores.
Revised: We use AutoAttack (Croce & Hein, 2020), which incorporates Square Attack (Andriushchenko et al., 2020) which does not rely on gradients and only uses the output scores.

Original: We also use the state-of-the-art ℓ ∞ -attack, RayS (Chen & Gu, 2020), to evaluate our Downsampled part model on the Part-ImageNet dataset.
Revised: We also use the state-of-the-art ℓ ∞ -attack, RayS (Chen & Gu, 2020), to evaluate our Downsampled part model on the Part-ImageNet dataset.

Original: RayS manages to reduce the accuracy to 71.0 (at 10k steps), which is still much higher than that achieved by the PGD attack and AutoAttack (45.4 and 39.4).
Revised: RayS manages to reduce the accuracy to 71.0 (at 10k steps), which is still much higher than that achieved by the PGD attack and AutoAttack (45.4 and 39.4).

Original: This confirms that the non-gradient attacks are not better than the gradient-based ones, suggesting that there is no gradient obfuscation problem.
Revised: This confirms that the non-gradient attacks are not better than the gradient-based ones, suggesting that there is no gradient obfuscation problem.

Original: Single-staged attack.
Revised: Single-staged attack.

Original: We have experimented with multiple ways to attack the part models, including attempts to fool the segmenter by using both losses in the attack objective.
Revised: We have experimented with multiple ways to attack the part models, including attempts to fool the segmenter by using both losses in the attack objective.

Original: However, these alternatives
Revised: However, these alternatives

Original: [Table] [Table]
Revised: [Table] [Table]

Original: actually decrease the attack success rate.
Revised: actually decrease the attack success rate.

Original: In our experiments, using only classification loss always yields the strongest attack
Revised: In our experiments, using only classification loss always yields the strongest attack

Original: [Table]
Revised: [Table]

Original: In particular, we consider PGD attack with an objective that is a linear combination of the classification loss and the segmentation loss, i.e., L =
Revised: In particular, we consider PGD attack with an objective that is a linear combination of the classification loss and the segmentation loss, i.e., L =

Original: (1 − c seg )
Revised: (1 − c seg )

Original: L clf + c seg L seg , as in Eqn. 7.
Revised: L clf + c seg L seg , as in Eqn. 7.

Original: Table 11 reports the adversarial accuracy under this attack with varying values of c seg .
Revised: Table 11 reports the adversarial accuracy under this attack with varying values of c seg .

Original: This shows that using the segmentation loss does not improve the attack.
Revised: This shows that using the segmentation loss does not improve the attack.

Original: In fact, a larger c seg (more weight on the segmentation loss) actually results in a worse attack.
Revised: In fact, a larger c seg (more weight on the segmentation loss) actually results in a worse attack.

Original: Two-staged attack.
Revised: Two-staged attack.

Original: Since we previously found that optimizing over both losses at the same time results in a worse attack, we separate the attack into two stages and make sure that the second stage only optimizes over the classification loss.
Revised: Since we previously found that optimizing over both losses at the same time results in a worse attack, we separate the attack into two stages and make sure that the second stage only optimizes over the classification loss.

Original: The difference now lies in the first stage which we use to generate a “guiding sample” to initialize the second attack by focusing on fooling the segmenter first.
Revised: The difference now lies in the first stage which we use to generate a “guiding sample” to initialize the second attack by focusing on fooling the segmenter first.

Original: We experiment with four strategies for the first-stage attack:
Revised: We experiment with four strategies for the first-stage attack:

Original: Untargeted : Maximize the loss of the segmenter directly with an untargeted PGD.
Revised: Untargeted : Maximize the loss of the segmenter directly with an untargeted PGD.

Original: Random :
Revised: Random :

Original: Pick a random target mask from a random incorrect class and run PGD to fool the segmenter into predicting this target mask.
Revised: Pick a random target mask from a random incorrect class and run PGD to fool the segmenter into predicting this target mask.

Original: Most-confident (random) :
Revised: Most-confident (random) :

Original: Similar to the random strategy, but instead of sampling from a random class, only sample target masks from the most-confident class predicted by the part model, excluding the ground-truth class.
Revised: Similar to the random strategy, but instead of sampling from a random class, only sample target masks from the most-confident class predicted by the part model, excluding the ground-truth class.

Original: Most-confident (sorted) :
Revised: Most-confident (sorted) :

Original: Similar to the most-confident (random) strategy, but instead of randomly choosing the masks, we run each mask in the test set through the classifier and choose the ones that the model assigns the highest score/confidence to the target class.
Revised: Similar to the most-confident (random) strategy, but instead of randomly choosing the masks, we run each mask in the test set through the classifier and choose the ones that the model assigns the highest score/confidence to the target class.

Original: We note that similarly to PGD, we repeat all the two-staged attacks five times with different random seeds and select only the best out of five.
Revised: We note that similarly to PGD, we repeat all the two-staged attacks five times with different random seeds and select only the best out of five.

Original: This means that the first stage of the attacks uses five different target masks, apart from the untargeted strategy, and produces five different initialization points.
Revised: This means that the first stage of the attacks uses five different target masks, apart from the untargeted strategy, and produces five different initialization points.

Original: Table 12 demonstrates that the two-staged attacks are about as effective as the normal PGD.
Revised: Table 12 demonstrates that the two-staged attacks are about as effective as the normal PGD.

Original: The untargeted and the random strategies usually perform the best and can be slightly ( ∼ 1% lower  adversarial accuracy) better than the normal PGD attack.
Revised: The untargeted and the random strategies usually perform the best and can be slightly ( ∼ 1% lower [Table] adversarial accuracy) better than the normal PGD attack.

Original: Nevertheless, no attack beats AutoAttack in any setting.
Revised: Nevertheless, no attack beats AutoAttack in any setting.

Original: This suggests that it is likely sufficient to use the AutoAttack alone for evaluation.
Revised: This suggests that it is likely sufficient to use the AutoAttack alone for evaluation.

Original: D. C HEAPER F ORMS OF A UXILIARY L ABELS
Revised: Why is this attack ineffective when Xie et al. (2017) have shown that it is possible to attack segmentation and detection models? The answer to this lies in the fact that our segmenter has been adversarially trained (end-to-end together with the classifier) whereas the models used in Xie et al. (2017) are only normally trained.

Original: Here, we provided additional details on the experiments introduced in Section 5.4.
Revised: To confirm this, we run PGD attacks on the segmenter part of our part models. Table 13 shows that without adversarial training, it is easy to attack the part model and reduce the segmentation accuracy to under 10% (the right-most column). This is in line with Xie et al. On the other hand, once adversarial training is used, we have a much more robust segmenter with over 60% adversarial accuracy.

Revised: Since our segmenter is robust, the part model as a whole is also robust.

Revised: D. C HEAPER F ORMS OF A UXILIARY L ABELS

Revised: The main limitation of our approach is the need for part segmentation labels.

Revised: Our primary goal in this paper is to demonstrate that it is possible to achieve significant improvements in robust accuracy using additional supervision.

Revised: This result is particularly important since progress in the field has somewhat stagnated, and recent improvements through more training samples show diminishing returns (Gowal et al., 2021b).

Revised: It is an open question whether the most cost-effective way to gain robustness is with more training samples or with richer supervision; our paper provides evidence for the first time that richer (segmentation-like) labels might be a cost-effective route to stronger robustness.

Revised: We hope our findings will stimulate follow-on research that explores how to achieve these benefits as cheaply as possible.

Revised: That said, we have tried a few approaches to reduce the labeling cost as already mentioned in Section 5.4.

Revised: Here, we expand on the experiments that use the bounding-box labels and the centroid labels.

Original: Bounding-box labels.
Revised: Bounding-box labels.

Original: The part bounding boxes are generated directly from the part segmentation by drawing a tight box around all the pixels that belong to each part.
Revised: The part bounding boxes are generated directly from the part segmentation by drawing a tight box around all the pixels that belong to each part.

Original: Fig.
Revised: Fig.

Original: 10 provides examples of the bounding box labels from the Part-ImageNet dataset.
Revised: 10 provides examples of the bounding box labels from the Part-ImageNet dataset.

Original: We want to keep the segmenter unchanged so we train the Downsampled part models with unmodified L seg , as described in Eqn.
Revised: We want to keep the segmenter unchanged so we train the Downsampled part models with unmodified L seg , as described in Eqn.

Original: 7, on the new bounding-box labels.
Revised: 7, on the new bounding-box labels.

Original: We note that our bounding-box labels are still pixel-wise masks unlike the typical bounding boxes used in the object detection task.
Revised: We note that our bounding-box labels are still pixel-wise masks unlike the typical bounding boxes used in the object detection task.

Original: In practice, it is likely more efficient to replace the segmenter with an object detection model that outputs bounding boxes directly.
Revised: In practice, it is likely more efficient to replace the segmenter with an object detection model that outputs bounding boxes directly.

Original: Centroid labels.
Revised: Centroid labels.

Original: Similarly to the bounding boxes, the centroid labels are also directly derived from the segmentation mask.
Revised: Similarly to the bounding boxes, the centroid labels are also directly derived from the segmentation mask.

Original: We go through the same calculation in Eqn.
Revised: We go through the same calculation in Eqn.

Original: 2 to generate the centroids from the ground-truth, instead of predicted, segmentation masks.
Revised: 2 to generate the centroids from the ground-truth, instead of predicted, segmentation masks.

Original: Here, we train the bounding-box part model on the centroid labels, but instead of calculating the segmentation loss, we compute the loss directly on the dense features excluding the standard deviations.
Revised: Here, we train the bounding-box part model on the centroid labels, but instead of calculating the segmentation loss, we compute the loss directly on the dense features excluding the standard deviations.

Original: More precisely, the loss function,
Revised: More precisely, the loss function,

Original: [Table]

Original: [Table]

Original: L cen , can be written as follows:
Revised: L cen , can be written as follows:

Original: [Equation]
Revised: [Equation]

Original: [Equation]
Revised: [Table]

Original: The first term is the mean squared error of the predicted centroids and the ground truth.
Revised: The first term is the mean squared error of the predicted centroids and the ground truth.

Original: The second ensures that the segmenter predicts masks of the correct class.
Revised: The second ensures that the segmenter predicts masks of the correct class.

Original: For this, we use the cross-entropy loss with the logits being the sum of pixel-wise predictions across all parts of each object class.
Revised: For this, we use the cross-entropy loss with the logits being the sum of pixel-wise predictions across all parts of each object class.

Original: D. P ART S EGMENTATION VS O BJECT S EGMENTATION
Revised: D. P ART S EGMENTATION VS O BJECT S EGMENTATION

Original: We conduct an ablation study to test whether the part-level annotation is necessary to improve the adversarial training.
Revised: We conduct an ablation study to test whether the part-level annotation is necessary to improve the adversarial training.

Original: Can it be substituted with an object-level annotation which is cheaper to label?
Revised: Can it be substituted with an object-level annotation which is cheaper to label?

Original: To answer this question, we train downsampled “part” models using the object-segmentation labels instead of the part-level annotation.
Revised: To answer this question [Table] we train downsampled “part” models using the object-segmentation labels instead of the part-level annotation.

Original: Table 13 clearly indicates that the models trained on the object-level annotation achieve lower clean and adversarial accuracy compared to ones trained on the part-level annotation.
Revised: Table 14 clearly indicates that the models trained on the object-level annotation achieve lower clean and adversarial accuracy compared to ones trained on the [Table] [Table]

Original:  This experiment suggests that training with object segmentation does improve adversarial training compared to the baseline, but using part segmentation can achieve even better results.
Revised: part-level annotation. This experiment suggests that training with object segmentation does improve adversarial training compared to the baseline, but using part segmentation can achieve even better results.

Original: Intuitively, the part annotation is more fine-grained and contains more information than the object one.
Revised: Intuitively, the part annotation is more fine-grained and contains more information than the object one.

Original: So it is likely that stronger learning signals lead to higher robustness.
Revised: So it is likely that stronger learning signals lead to higher robustness.

Original: D. E FFECTS OF B ACKGROUND R EMOVAL
Revised: D. E XTENDED E XPERIMENTS ON T RAINING WITH F EWER P ART S EGMENTATION L ABELS

Revised: In this section [Table] we attempt to further reduce the labeling costs

Revised: [Table]

Revised: using semi-supervised learning.

Revised: We show that using only 10% of all the segmentation labels (~2K samples) yields a model almost as good as the one using all the labels.

Revised: Specifically, we first train a part segmentation model on those 10% of images (~2K images or 175 per class) and use that model to generate pseudo-labels (predicted segmentation masks) on the remaining 90% of images.

Revised: Then, we combine these pseudo-labels and the ground-truth labels to train a new part model.

Revised: As shown in Table 15, this model performs about as well as the one trained with segmentation labels for 100% of training images (3rd vs 4th row or 84.9%/39.8% clean/robust accuracy vs 85.6%/39.4%) and performs significantly better than a model trained with no segmentation labels (3rd vs 1st row or 84.9%/39.8% vs 74.7%/37.7%).

Revised: Next, to test scaling, we double the training set size (from 20K to 40K) of PartImageNet by drawing additional samples from ImageNet, with class labels but no additional segmentation labels.

Revised: The two bottom rows of Table 15 compares our part model to the baseline where a model is trained with this extra data but no segmentation labels.

Revised: It shows that our part model scales well with more training data: it benefits from extra training data similarly to the normal model and still outperforms it by a large margin (10% clean and 3% adversarial accuracy).

Revised: Here, the effective number of part segmentation labels is only 5% of all training samples (2K of 40K).

Revised: D. E FFECTS OF B ACKGROUND R EMOVAL

Original: We repeat the same experiments, measuring both adversarial and generalized robustness, on the
Revised: We repeat the same experiments, measuring both adversarial and generalized robustness, on the

Original: Downsampled part models that remove the background.
Revised: Downsampled part models that remove the background.

Original: Specifically, we drop the background channel of the predicted segmentation mask by the segmenter before passing it to the second-stage classifier.
Revised: Specifically, we drop the background channel of the predicted segmentation mask by the segmenter before passing it to the second-stage classifier.

Original: In summary, our results show that whether the predicted background channel is included or not has little effect on the accuracy.
Revised: In summary, our results show that whether the predicted background channel is included or not has little effect on the accuracy.

Original: The model without background has 0.8% lower clean accuracy and the same adversarial accuracy as the one with the background channel.
Revised: The model without background has 0.8% lower clean accuracy and the same adversarial accuracy as the one with the background channel.

Original: The result on the generalized robustness benchmarks in Table 14 also portrays a similar story: the Downsampled part models with and without the background perform similarly (within margins of error) but are still clearly better
Revised: The result on the generalized robustness benchmarks in Table 16 also portrays a similar story: the Downsampled part models with and without the background perform similarly (within margins of error) but are still clearly better

Original: [Table] [Table]
Revised: [Table] [Table]

Original: than ResNet-50.
Revised: than ResNet-50.

Original: This experiment suggests that the second-stage classifier can learn to ignore the background pixels automatically.
Revised: This experiment suggests that the second-stage classifier can learn to ignore the background pixels automatically.

Original: So there is no clear benefit to dropping them.
Revised: So there is no clear benefit to dropping them

Original:  D. E FFECTS OF THE D OWNSAMPLED S IZE
Revised: . D. E FFECTS OF THE D OWNSAMPLED S IZE

Original: Table 15 shows the performance of the downsampled part model when the output size of the pooling layer changes.
Revised: Table 17 shows the performance of the downsampled part model when the output size of the pooling layer changes.

Original: Across all the sizes from 1 to 128, both the clean and the adversarial accuracy barely change; the gap between the largest and the smallest numbers is under 1.3 percentage points.
Revised: Across all the sizes from 1 to 128, both the clean and the adversarial accuracy barely change; the gap between the largest and the smallest numbers is under 1.3 percentage points.

Original: This suggests that the performance of the downsampled part model is insensitive to the choice of the downsampling output size.
Revised: This suggests that the performance of the downsampled part model is insensitive to the choice of the downsampling output size.

Original: We use the downsampling size of 4 × 4 throughout this paper, but almost any other number can be used since the difference is not significant.
Revised: We use the downsampling size of 4 × 4 throughout this paper [Table] but almost any other number can be used since the difference is not significant.

Revised: D.8. E FFECTS OF THE B ACKBONE A RCHITECTURE

Revised: We train both the baseline and our part models with two additional backbone architectures with a similar size to ResNet-50 (EfficientNet-B4 and ResNeXt-50-32x4d).

Revised: We find that our part model consistently improves over the baseline across all architectures (5-9% increase in clean and 3-4% in adversarial accuracy).

Original: D. A DVERSARIAL R OBUSTNESS R ESULTS ON THE R EMAINING P ART M ODELS
Revised: D. A DVERSARIAL R OBUSTNESS R ESULTS ON THE R EMAINING P ART M ODELS

Original: In this section, we include the robustness results on the other two part-based models we omit from the main text, i.e., the two-headed and the pixel part models.
Revised: In this section, we include the robustness results on the other two part-based models we omit from the main text, i.e., the two-headed and the pixel part models.

Original: We report the accuracy of the models trained with five different values of c seg for completeness and for displaying a minor trade-off between the clean and the adversarial accuracy.
Revised: We report the accuracy of the models trained with five different values of c seg for completeness and for displaying a minor trade-off between the clean and the adversarial accuracy.

Original: However, comparing the best models alone would be sufficient.
Revised: However, comparing the best models alone would be sufficient.

Original: Table 16 suggests that the two-headed part models perform similarly to the downsampled variant and slightly worse than the bounding-box one when all of them are adversarially trained with PGD.
Revised: Table 19 suggests that the two-headed part models perform similarly to the downsampled variant and slightly worse than the bounding-box one when all of them are adversarially trained with PGD.

Original: On the other hand, the pixel part models have consistently lower accuracy than the other part models by roughly 1–2 percentage points.
Revised: On the other hand, the pixel part models have consistently lower accuracy than the other part models by roughly 1–2 percentage points.

Original: This result confirms our hypothesis on the importance of the spatial information as mentioned in Section 3.1 as well as Appendix C.2.
Revised: This result confirms our hypothesis on the importance of the spatial information as mentioned in Section 3.1 as well as Appendix C.2.

Original: [Table] [Table]
Revised: [Table] [Table]

Original: D. F EEDING I NPUT I MAGES TO THE P ART M ODEL
Revised: D. F EEDING I NPUT I MAGES TO THE P ART M ODEL

Original: In Section 3.1, we suggest that the classifier stage of the part models should not see the input image directly.
Revised: In Section 3.1, we suggest that the classifier stage of the part models should not see the input image directly.

Original: We hypothesize that doing so opens up an opportunity for the attacker to bypass the more robust segmenter and influence the small and less robust classifier.
Revised: We hypothesize that doing so opens up an opportunity for the attacker to bypass the more robust segmenter and influence the small and less robust classifier.

Original: This essentially defeats the purpose of the segmentation and the part model overall.
Revised: This essentially defeats the purpose of the segmentation and the part model overall.

Original: However, there is also a counterargument to this hypothesis.
Revised: However, there is also a counterargument to this hypothesis.

Original: In theory, if the model is fed with both the image and the predicted segmentation mask, it strictly receives more information.
Revised: In theory, if the model is fed with both the image and the predicted segmentation mask, it strictly receives more information.

Original: When adversarially trained, the model can then learn to ignore the image if it is deemed non-robust.
Revised: When adversarially trained, the model can then learn to ignore the image if it is deemed non-robust.

Original: Hence, this model should be strictly better or at least the same as the one that sees only the segmentation mask.
Revised: Hence, this model should be strictly better or at least the same as the one that sees only the segmentation mask.

Original: To find out which hypothesis holds, we create a variant of the downsampled part model by concatenating the input image to the predicted segmentation mask before being fed to the classifier stage.
Revised: To find out which hypothesis holds, we create a variant of the downsampled part model by concatenating the input image to the predicted segmentation mask before being fed to the classifier stage.

Original: We then compare this model to the original downsampled part model.
Revised: We then compare this model to the original downsampled part model.

Original: The empirical results support our hypothesis.
Revised: The empirical results support our hypothesis.

Original: Table 17 shows that this input-concatenated downsampled part model performs slightly worse compared to the original version.
Revised: Table 20 shows that this input-concatenated downsampled part model performs slightly worse compared to the original version.

Original: We leave it to future work to unveil the underlying reasons that make the model less robust when more information is presented to it.
Revised: We leave it to future work to unveil the underlying reasons that make the model less robust when more information is presented to it.

Original: D. D ETAILED R ESULTS ON THE G ENERALIZED R OBUSTNESS
Revised: D. D ETAILED R ESULTS ON THE G ENERALIZED R OBUSTNESS

Original: We also evaluate adversarially-trained models on the generalized robustness datasets, in addition to the normally trained ones reported in Section 5.1.
Revised: We also evaluate adversarially-trained models on the generalized robustness datasets, in addition to the normally trained ones reported in Section 5.1.

Original: Fig.
Revised: Fig.

Original: 11 shows the robust accuracy 6 on the three benchmarks with respect to the clean accuracy of the models.
Revised: 11 shows the robust accuracy 6 on the three benchmarks with respect to the clean accuracy of the models.

Original: The number next to each data point  represents the adversarial accuracy, and due to the (adversarial) robustness-accuracy trade-off, the points on the top right corner generally have higher clean accuracy but lower adversarial accuracy.
Revised: The number next to each data point [Table] [Table] represents the adversarial accuracy, and due to the (adversarial) robustness-accuracy trade-off, the points on the top right corner generally have higher clean accuracy but lower adversarial accuracy.

Original: It is clear that there is a strong correlation between the clean accuracy and the robust accuracy on all three benchmarks.
Revised: It is clear that there is a strong correlation between the clean accuracy and the robust accuracy on all three benchmarks.

Original: A similar trend is also observed in Taori et al.
Revised: A similar trend is also observed in Taori et al.

Original: In contrast, we do not find[Figure] that adversarial training improves the common corruption robustness, spurious correlation robustness, or shape bias.
Revised: In contrast, we do not find that adversarial training improves the common corruption robustness, spurious correlation robustness, or shape bias.

Original: Nonetheless, we emphasize that the part models still outperform the ResNet-50 at almost all levels of clean accuracy across all types of robustness studied.
Revised: Nonetheless, we emphasize that the part models still outperform the ResNet-50 at almost all levels of clean accuracy across all types of robustness studied.

Original: Table 18 depicts the full results of the generalized robustness evaluations on the part-based models and the baseline.
Revised: Table 21 depicts the full results of the generalized robustness evaluations on the part-based models and the baseline.

Original: As mentioned in Section 5.1, we conduct a hyperparameter search in order to find the best model for each of the benchmarks we test on.
Revised: As mentioned in Section 5.1, we conduct a hyperparameter search in order to find the best model for each of the benchmarks we test on.

Original: In this section, we report the robust accuracy of these models on all the benchmarks, not only the one that they perform the best in.
Revised: In this section, we report the robust accuracy of these models on all the benchmarks, not only the one that they perform the best in.

Original: Generally, we would have three rows per model architecture, one per dataset.
Revised: Generally, we would have three rows per model architecture, one per dataset.

Original: However, interestingly, the best-performing models on the spurious correlation benchmark and the best-performing models on the corruption robustness benchmark are coincidentally the same models, i.e., model (B) in Table 18.
Revised: However, interestingly, the best-performing models on the spurious correlation benchmark and the best-performing models on the corruption robustness benchmark are coincidentally the same models, i.e., model (B) in Table 21.

Original: On the other hand, the models (A) are only the best in the shape-vs-texture bias benchmark.
Revised: On the other hand, the models (A) are only the best in the shape-vs-texture bias benchmark.

Original: This trend is consistent on the ResNet-50 as well as our part models.
Revised: This trend is consistent on the ResNet-50 as well as our part models.

Original: This phenomenon could be some sort of trade-off behavior.
Revised: This phenomenon could be some sort of trade-off behavior.

Original: However, more experiments are needed to make further conclusions.
Revised: However, more experiments are needed to make further conclusions.

Original: Table 19 shows a breakdown of the corruption robustness accuracy for each corruption type.
Revised: Table 22 shows a breakdown of the corruption robustness accuracy for each corruption type.

Original: This result confirms that the two part-based models outperform the ResNet-50 baseline on all corruption [Table] [Figure] [Table]
Revised: This result confirms that the two part-based models outperform the ResNet-50 baseline on all corruption types , not only the mean.

Original: [Figure] types , not only the mean. The bounding-box part model also achieves very slightly higher robust accuracy than the downsampled one across most of the corruption types. 
Revised: The bounding-box part model also achieves very slightly higher robust accuracy than the downsampled one across most of the corruption types. [Figure]

Original: D. A DDITIONAL V ISUALIZATION OF THE P ART M ODELS
Revised: D. A DDITIONAL V ISUALIZATION OF THE P ART M ODELS

Original: We provide additional visualization of the outputs of our part-based models on all three datasets.
Revised: We provide additional visualization of the outputs of our part-based models on all three datasets.

Original: Fig.
Revised: Fig.

Original: 12 shows a similar visualization to Fig.
Revised: 12 shows a similar visualization to Fig.

Original: 5 but for the downsampled part model.
Revised: 5 but for the downsampled part model.

Original: The same visualization for Cityscapes (resp.
Revised: The same visualization for Cityscapes (resp.

Original: PASCAL-Part) on the downsampled and the bounding-box part models can be found in Fig.
Revised: PASCAL-Part) on the downsampled and the bounding-box part models can be found in Fig.

Original: 13 (resp.
Revised: 13 (resp.

Original: Fig. 14).
Revised: Fig. 14).

Original: [Figure]

Original: Segmentation masks corresponding to misclassified samples are indicated by a red box.

Original: Apart from the ones trained on PASCAL-Part, our part-based models segment the object part fairly well even though some amount of detail and small parts are sometimes missed.
Revised: Apart from the ones trained on PASCAL-Part, our part-based models segment the object part fairly well even though some amount of detail and small parts are sometimes missed.

Original: In most of the misclassified samples, the predicted segmentation masks are also incorrect.
Revised: In most of the misclassified samples, the predicted segmentation masks are also incorrect.

Original: This is particularly true for the PGD adversarial images.
Revised: This is particularly true for the PGD adversarial images.

Original: This observation qualitatively confirms that the classifier stage of the part model depends on and agrees with the segmentation mask as expected.
Revised: This observation qualitatively confirms that the classifier stage of the part model depends on and agrees with the segmentation mask as expected.

Original: We suspect that the poor prediction of the segmentation on the PASCAL-Part dataset may be attributed to the small number of training samples.
Revised: We suspect that the poor prediction of the segmentation on the PASCAL-Part dataset may be attributed to the small number of training samples.

Original: PASCAL-Part has about one order of magnitude fewer training samples compared to the other two datasets.
Revised: PASCAL-Part has about one order of magnitude fewer training samples compared to the other two datasets.

Original: Nevertheless, the segmentation labels still prove to be very helpful in improving the adversarial training, potentially also due to the fact that the  number of training data is small.
Revised: Nevertheless, the segmentation labels still prove to be very helpful in improving the adversarial training, potentially also due to the fact that the [Figure] number of training data is small.

Original: One interesting future direction is to study the relationship between the numbers of class labels and segmentation labels with respect to robustness.
Revised: One interesting future direction is to study the relationship between the numbers of class labels and segmentation labels with respect to robustness.

Original: E S OCIETAL I MPACT
Revised: E S OCIETAL I MPACT

Original: Our work focuses on improving the adversarial robustness of neural networks with the goal of creating secure and reliable models.
Revised: Our work focuses on improving the adversarial robustness of neural networks with the goal of creating secure and reliable models.

Original: We strictly propose a new “defense” technique and do not contribute to any attack algorithm.
Revised: We strictly propose a new “defense” technique and do not contribute to any attack algorithm.

Original: We believe that our work will benefit not only the research community but also machine learning practitioners and eventually, society overall.
Revised: We believe that our work will benefit not only the research community but also machine learning practitioners and eventually, society overall.

Original: We hope that our work will be 
Revised: We hope that our work will be extended to improve the effectiveness of adversarial training in practice, leading to broader adoption of deep learning as well as preventing potential vulnerabilities and failures in the future.

Original: [Figure]
Revised: [Figure]

Original: Segmentation masks corresponding to misclassified samples are indicated by a red box. extended to improve the effectiveness of adversarial training in practice, leading to broader adoption of deep learning as well as preventing potential vulnerabilities and failures in the future.
Revised: [Figure]