Original: R OBUST T RAINING THROUGH A DVERSARIALLY S ELECTED D ATA S UBSETS
Revised: R OBUST T RAINING THROUGH A DVERSARIALLY S ELECTED D ATA S UBSETS

Original: Anonymous authors
Revised: Anonymous authors

Original: Paper under double-blind review
Revised: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: Robustness to adversarial perturbations often comes at the cost of a drop in accuracy on unperturbed or clean instances.
Revised: Robustness to adversarial perturbations often comes at the cost of a drop in accuracy on unperturbed or clean instances.

Original: Most existing defense mechanisms attempt to defend the learner from attack on all possible instances, which often degrades the accuracy on clean instances signiﬁcantly.
Revised: Most existing defense mechanisms attempt to defend the learner from attack on all possible instances, which often degrades the accuracy on clean instances signiﬁcantly.

Original: However, in practice, an attacker might only select a small subset of instances to attack, e.g. , in facial recognition systems an adversary might aim to target speciﬁc faces.
Revised: However, in practice, an attacker might only select a small subset of instances to attack, e.g. , in facial recognition systems an adversary might aim to target speciﬁc faces.

Original: Moreover, the subset selection strategy of the attacker is seldom known to the defense mechanism a priori, making it challenging to attune the mechanism beforehand.
Revised: Moreover, the subset selection strategy of the attacker is seldom known to the defense mechanism a priori, making it challenging to attune the mechanism beforehand.

Original: This motivates designing defense mechanisms which can (i) defend against attacks on subsets instead of all instances to prevent degradation of clean accuracy and, (ii) ensure good overall performance for attacks on any selected subset.
Revised: This motivates designing defense mechanisms which can (i) defend against attacks on subsets instead of all instances to prevent degradation of clean accuracy and, (ii) ensure good overall performance for attacks on any selected subset.

Original: In this work, we take a step towards solving this problem.
Revised: In this work, we take a step towards solving this problem.

Original: We cast the training problem as a min-max game involving worst-case subset selection along with optimization of model parameters, rendering the problem NP-hard.
Revised: We cast the training problem as a min-max game involving worst-case subset selection along with optimization of model parameters, rendering the problem NP-hard.

Original: To tackle this, we ﬁrst show that, for a given learner’s model, the objective can be expressed as a difference between a γ -weakly submodular and a modular function.
Revised: To tackle this, we ﬁrst show that, for a given learner’s model, the objective can be expressed as a difference between a γ -weakly submodular and a modular function.

Original: We use this property to propose R OGET , an iterative algorithm, which admits approximation guarantees for a class of loss functions.
Revised: We use this property to propose R OGET , an iterative algorithm, which admits approximation guarantees for a class of loss functions.

Original: Our experiments show that R OGET obtains better overall accuracy compared to several state-of-the-art defense methods for different adversarial subset selection techniques.
Revised: Our experiments show that R OGET obtains better overall accuracy compared to several state-of-the-art defense methods for different adversarial subset selection techniques.

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Recent years have witnessed a dramatic improvement in the predictive power of the machine learning models across several applications such as computer vision, natural language processing, speech processing, etc.
Revised: Recent years have witnessed a dramatic improvement in the predictive power of the machine learning models across several applications such as computer vision, natural language processing, speech processing, etc.

Original: This has led to their widespread usage in several safety critical systems like autonomous car driving (Janai et al., 2020; Alvarez et al., 2010; Sallab et al., 2017), face recognition (Hu et al., 2015; Kemelmacher-Shlizerman et al., 2016; Wang & Deng, 2021), voice recognition (Myers, 2000; Yuan et al., 2018), etc. , which in turn requires the underlying models to be security complaint.
Revised: This has led to their widespread usage in several safety critical systems like autonomous car driving (Janai et al., 2020; Alvarez et al., 2010; Sallab et al., 2017), face recognition (Hu et al., 2015; Kemelmacher-Shlizerman et al., 2016; Wang & Deng, 2021), voice recognition (Myers, 2000; Yuan et al., 2018), etc. , which in turn requires the underlying models to be security complaint.

Original: However, most existing machine learning models suffer from signiﬁcant vulnerability in the face of adversarial attacks (Szegedy et al., 2014; Carlini & Wagner, 2017; Goodfellow et al., 2015; Baluja & Fischer, 2018; Xiao et al., 2018; Kurakin et al., 2017; Xie & Yuille, 2019; Kannan et al., 2018;
Revised: However, most existing machine learning models suffer from signiﬁcant vulnerability in the face of adversarial attacks (Szegedy et al., 2014; Carlini & Wagner, 2017; Goodfellow et al., 2015; Baluja & Fischer, 2018; Xiao et al., 2018; Kurakin et al., 2017; Xie & Yuille, 2019; Kannan et al., 2018;

Original: Croce & Hein, 2020; Yuan et al., 2019; Tramèr et al., 2018), where instances are contaminated with small and often indiscernible perturbations to delude the model at the test time.
Revised: Croce & Hein, 2020; Yuan et al., 2019; Tramèr et al., 2018), where instances are contaminated with small and often indiscernible perturbations to delude the model at the test time.

Original: This may result in catastrophic consequences when the underlying ML model is deployed in practice.
Revised: This may result in catastrophic consequences when the underlying ML model is deployed in practice.

Original: Driven by this motivation, a ﬂurry of recent works (Madry et al., 2017; Zhang et al., 2019b; 2021b;
Revised: Driven by this motivation, a ﬂurry of recent works (Madry et al., 2017; Zhang et al., 2019b; 2021b;

Original: Athalye et al., 2018; Andriushchenko & Flammarion, 2020; Shafahi et al., 2019;
Revised: Athalye et al., 2018; Andriushchenko & Flammarion, 2020; Shafahi et al., 2019;

Original: Rice et al., 2020) have focused on designing adversarial training methods, whose goal is to maintain the accuracy of
Revised: Rice et al., 2020) have focused on designing adversarial training methods, whose goal is to maintain the accuracy of

Original: ML models in presence of adversarial attacks.
Revised: ML models in presence of adversarial attacks.

Original: In principle, they are closely connected to robust machine learning methods that seek to minimize the worst-case performance of the ML models with adversarial perturbations.
Revised: In principle, they are closely connected to robust machine learning methods that seek to minimize the worst-case performance of the ML models with adversarial perturbations.

Original: In general, these approaches assume equal likelihood of adversarial attack across each instance.
Revised: In general, these approaches assume equal likelihood of adversarial attack across each instance.

Original: However, in several applications, an adversary might selectively wish to attack a speciﬁc subset of instances, which may be unknown to the learner.
Revised: However, in several applications, an adversary might selectively wish to attack a speciﬁc subset of instances, which may be unknown to the learner.

Original: For example, an adversary can only be interested in perturbing images of speciﬁc persons to evade facial recognition systems (Xiao et al., 2021; Vakhshiteh et al., 2021; Zhang et al., 2021b; Sarkar et al., 2021; Venkatesh et al., 2021); in trafﬁc signs classiﬁcation, the adversary may like to perturb only the stop signs, which can have more adverse impact during deployment.
Revised: For example, an adversary can only be interested in perturbing images of speciﬁc persons to evade facial recognition systems (Xiao et al., 2021; Vakhshiteh et al., 2021; Zhang et al., 2021b; Sarkar et al., 2021; Venkatesh et al., 2021); in trafﬁc signs classiﬁcation, the adversary may like to perturb only the stop signs, which can have more adverse impact during deployment.

Original: Therefore, the existing adversarial training methods can be overly pessimistic in terms of their predictive power, since they consider adversarial perturbation for each instance.
Revised: Therefore, the existing adversarial training methods can be overly pessimistic in terms of their predictive power, since they consider adversarial perturbation for each instance.

Original: We discuss the related works in more detail in Appendix B.
Revised: We discuss the related works in more detail in Appendix B.

Original: 1. O UR CONTRIBUTIONS
Revised: 1. O UR CONTRIBUTIONS

Original: Responding to the above limitations, we propose a novel robust learning framework, which is able to defend adversarial attacks targeted at any chosen subset of examples.
Revised: Responding to the above limitations, we propose a novel robust learning framework, which is able to defend adversarial attacks targeted at any chosen subset of examples.

Original: Speciﬁcally, we make the following contributions.
Revised: Speciﬁcally, we make the following contributions.

Original: Learning in presence of perturbation on adversarially selected subset.
Revised: Learning in presence of perturbation on adversarially selected subset.

Original: We consider an attack model, where the adversary selectively perturbs a subset of instances, rather than drawing them uniformly at random.
Revised: We consider an attack model, where the adversary selectively perturbs a subset of instances, rather than drawing them uniformly at random.

Original: However, the exact choice of the subset or its property remains unknown to the learner during training and validation.
Revised: However, the exact choice of the subset or its property remains unknown to the learner during training and validation.

Original: Consequently, a learner cannot adapt to such speciﬁc attack well in advance through training or cross-validation.
Revised: Consequently, a learner cannot adapt to such speciﬁc attack well in advance through training or cross-validation.

Original: To defend these attacks, we introduce a novel adversarial training method, where the learner aims at minimizing the worst-case loss across all the data subsets.
Revised: To defend these attacks, we introduce a novel adversarial training method, where the learner aims at minimizing the worst-case loss across all the data subsets.

Original: Our defense strategy is agnostic to any speciﬁc selectivity of the attacked subset.
Revised: Our defense strategy is agnostic to any speciﬁc selectivity of the attacked subset.

Original: Its key goal is to maintain high accuracy during attacks on any selected subset, rather than providing optimal accuracy for any speciﬁc subset.
Revised: Its key goal is to maintain high accuracy during attacks on any selected subset, rather than providing optimal accuracy for any speciﬁc subset.

Original: To this end, we posit our adversarial training task as an instance of min-max optimization problem, where the inner optimization problem seeks the data subset that maximizes the training loss and, the outer optimization problem then minimizes this loss with respect to the model parameters.
Revised: To this end, we posit our adversarial training task as an instance of min-max optimization problem, where the inner optimization problem seeks the data subset that maximizes the training loss and, the outer optimization problem then minimizes this loss with respect to the model parameters.

Original: While training the model, the outer problem also penalizes the loss on the unperturbed instances.
Revised: While training the model, the outer problem also penalizes the loss on the unperturbed instances.

Original: This allows us to optimize for the overall accuracy across both perturbed and unperturbed instances.
Revised: This allows us to optimize for the overall accuracy across both perturbed and unperturbed instances.

Original: Theoretical characterization of our defense objective.
Revised: Theoretical characterization of our defense objective.

Original: Existing adversarial training methods (Madry et al., 2017; Zhang et al., 2019b; Robey et al., 2021) involve only continuous optimization variables— the model parameters and the amount of perturbation.
Revised: Existing adversarial training methods (Madry et al., 2017; Zhang et al., 2019b; Robey et al., 2021) involve only continuous optimization variables— the model parameters and the amount of perturbation.

Original: In contrast, the inner maximization problem in our proposal searches over the worst-case data subset.
Revised: In contrast, the inner maximization problem in our proposal searches over the worst-case data subset.

Original: This translates our optimization task into a parameter estimation problem in conjunction with a subset selection problem, which renders it NP-hard.
Revised: This translates our optimization task into a parameter estimation problem in conjunction with a subset selection problem, which renders it NP-hard.

Original: We provide a useful characterization of the underlying training objective that would help us design approximation algorithm to solve the problem.
Revised: We provide a useful characterization of the underlying training objective that would help us design approximation algorithm to solve the problem.

Original: Given a ﬁxed ML model, we show that the training objective can be expressed as the difference between a monotone γ -weakly submodular function and a modular function (Theorem 2).
Revised: Given a ﬁxed ML model, we show that the training objective can be expressed as the difference between a monotone γ -weakly submodular function and a modular function (Theorem 2).

Original: This allows us to leverage distorted greedy algorithm
Revised: This allows us to leverage distorted greedy algorithm

Original: (Harshaw et al., 2019) to optimize the underlying objective.
Revised: (Harshaw et al., 2019) to optimize the underlying objective.

Original: Approximation algorithms.
Revised: Approximation algorithms.

Original: We provide R OGET (RObust aGainst adversarial subsETs), a family of algorithms to solve our optimization problem, by building upon the proposal of (Adibi et al., 2021), that admits approximation guarantees.
Revised: We provide R OGET (RObust aGainst adversarial subsETs), a family of algorithms to solve our optimization problem, by building upon the proposal of (Adibi et al., 2021), that admits approximation guarantees.

Original: In each iteration, R OGET ﬁrst applies gradient descent (GD) or stochastic gradient descent step to update the estimate of the model parameters and then applies distorted greedy algorithm to update the estimate of attacked subset of instances.
Revised: In each iteration, R OGET ﬁrst applies gradient descent (GD) or stochastic gradient descent step to update the estimate of the model parameters and then applies distorted greedy algorithm to update the estimate of attacked subset of instances.

Original: We show that
Revised: We show that

Original: R OGET admits approximation guarantees for convex and non-convex training objective (Thoerem 5), where in the latter case we require that the objective satisﬁes Polyak-Lojasiewicz (PL) condition (Theorem 4).
Revised: R OGET admits approximation guarantees for convex and non-convex training objective (Thoerem 5), where in the latter case we require that the objective satisﬁes Polyak-Lojasiewicz (PL) condition (Theorem 4).

Original: Our analysis can be applied in any min-max optimization setup where the inner optimization problem seeks to maximize the difference between a monotone γ -weakly submodular and a modular function and therefore, is of independent interest.
Revised: Our analysis can be applied in any min-max optimization setup where the inner optimization problem seeks to maximize the difference between a monotone γ -weakly submodular and a modular function and therefore, is of independent interest.

Original: Finally, we provide a comprehensive experimental evaluation of R OGET , by comparing them against seven state-of-the-art defense methods.
Revised: Finally, we provide a comprehensive experimental evaluation of R OGET , by comparing them against seven state-of-the-art defense methods.

Original: Here, in addition to hyperparameter set by the baselines in their papers, we also use a new hyperparameter selection method, which is more suited in our setup.
Revised: Here, in addition to hyperparameter set by the baselines in their papers, we also use a new hyperparameter selection method, which is more suited in our setup.

Original: Unlike our proposal, the baselines are not trained to optimize for the worst case accuracy.
Revised: Unlike our proposal, the baselines are not trained to optimize for the worst case accuracy.

Original: To reduce this gap between the baselines and our method, we tune the hyperparameters of the baselines, which would maximize the minimum accuracy across a large number of subsets chosen for attack.
Revised: To reduce this gap between the baselines and our method, we tune the hyperparameters of the baselines, which would maximize the minimum accuracy across a large number of subsets chosen for attack.

Original: We observe that, R OGET is able to outperform the state-of-the-art defense methods in terms of the overall accuracy across different hyperparameter selection and different subset selection strategies.
Revised: We observe that, R OGET is able to outperform the state-of-the-art defense methods in terms of the overall accuracy across different hyperparameter selection and different subset selection strategies.

Original:  P ROBLEM FORMULATION
Revised:  P ROBLEM FORMULATION

Original: Instances, learner’s model and the loss function.
Revised: Instances, learner’s model and the loss function.

Original: We consider a classiﬁcation setup where x ∈
Revised: We consider a classiﬁcation setup where x ∈

Original: X =
Revised: X =

Original: R d are the features, y ∈ Y are the discrete labels.
Revised: R d are the features, y ∈ Y are the discrete labels.

Original: We denote { ( x i , y i ) } i ∈
Revised: We denote { ( x i , y i ) } i ∈

Original: D
Revised: D

Original: to be the training instances where D denotes the training dataset.
Revised: to be the training instances where D denotes the training dataset.

Original: We use h θ ∈ H to indicate the learner’s model, where H is the hypothesis class and θ ∈ Θ is the parameter vector of the model.
Revised: We use h θ ∈ H to indicate the learner’s model, where H is the hypothesis class and θ ∈ Θ is the parameter vector of the model.

Original: We use the cross entropy loss (cid:96) ( h θ ( x ) , y ) in the paper.
Revised: We use the cross entropy loss (cid:96) ( h θ ( x ) , y ) in the paper.

Original: Adversarial perturbation on selected subset.
Revised: Adversarial perturbation on selected subset.

Original: We assume that the adversary’s goal is to selectively attack a speciﬁc subset of instances S latent — instead of every possible instances in the data or drawing instances uniformly at random.
Revised: We assume that the adversary’s goal is to selectively attack a speciﬁc subset of instances S latent — instead of every possible instances in the data or drawing instances uniformly at random.

Original: The adversary then uses an adversarial perturbation method to generate x adv i using x i for all for i ∈ S latent such that x
Revised: The adversary then uses an adversarial perturbation method to generate x adv i using x i for all for i ∈ S latent such that x

Original: adv i is close to x i , but the model misclassiﬁes x adv i .
Revised: adv i is close to x i , but the model misclassiﬁes x adv i .

Original: Now, it is important to note that neither the strategy behind selecting S latent nor the adversarial perturbation method is known to the learner.
Revised: Now, it is important to note that neither the strategy behind selecting S latent nor the adversarial perturbation method is known to the learner.

Original: Hence, during training, we use a φ : X → X as the learner’s belief about the adversarial network or the perturbation method with parameter vector φ ∈ Φ similar to (Baluja & Fischer, 2018; Xiao et al., 2018; Mopuri et al., 2018), where Φ is domain of φ .
Revised: Hence, during training, we use a φ : X → X as the learner’s belief about the adversarial network or the perturbation method with parameter vector φ ∈ Φ similar to (Baluja & Fischer, 2018; Xiao et al., 2018; Mopuri et al., 2018), where Φ is domain of φ .

Original: Many popular attacks like FGSM (Goodfellow et al., 2015), PGD (Madry et al., 2017) are un-parameterized and they induce perturbation of one point independently of others.
Revised: Many popular attacks like FGSM (Goodfellow et al., 2015), PGD (Madry et al., 2017) are un-parameterized and they induce perturbation of one point independently of others.

Original: Still, we assume a parameterized adversary model (Baluja & Fischer, 2018; Xiao et al., 2018; Mopuri et al., 2018) to make the formulation more generalized as one can always overparameterize such a model to induce enough capacity and mimic pointwise attacks.
Revised: Still, we assume a parameterized adversary model (Baluja & Fischer, 2018; Xiao et al., 2018; Mopuri et al., 2018) to make the formulation more generalized as one can always overparameterize such a model to induce enough capacity and mimic pointwise attacks.

Original: Proposed adversarial training problem.
Revised: Proposed adversarial training problem.

Original: Let us assume, for instance, that the subset selection strategy of the adversary is revealed to the learner.
Revised: Let us assume, for instance, that the subset selection strategy of the adversary is revealed to the learner.

Original: Following this strategy, the learner can easily compute the underlying subset S ⊂ D to mimic the adversary and minimize the sum of the loss on the perturbed instances i ∈ S and the unperturbed instances j ∈ D \ S .
Revised: Following this strategy, the learner can easily compute the underlying subset S ⊂ D to mimic the adversary and minimize the sum of the loss on the perturbed instances i ∈ S and the unperturbed instances j ∈ D \ S .

Original: However, in practice, the learner may not have any knowledge about the underlying subset selection strategy.
Revised: However, in practice, the learner may not have any knowledge about the underlying subset selection strategy.

Original: In such a case, the goal of a defense algorithm should be to ensure high overall accuracy in the face of attacks on all possible subsets.
Revised: In such a case, the goal of a defense algorithm should be to ensure high overall accuracy in the face of attacks on all possible subsets.

Original: To this end, we design an adversarial training framework, which attempts to minimize the worst case loss across all subsets, as described below.
Revised: To this end, we design an adversarial training framework, which attempts to minimize the worst case loss across all subsets, as described below.

Original: Given a set of training instances { ( x i , y i ) } i ∈ D , we defend the attacks on selected subset of instances by training a new model h θ which minimizes the highest possible loss on the perturbed instances a φ ( x i ) with i ∈ S across subsets S ⊂ D of size at most b , while ensuring that the new predictions h θ ( x j ) and the labels y j remain close on the unperturbed instances j (cid:54)∈ S .
Revised: Given a set of training instances { ( x i , y i ) } i ∈ D , we defend the attacks on selected subset of instances by training a new model h θ which minimizes the highest possible loss on the perturbed instances a φ ( x i ) with i ∈ S across subsets S ⊂ D of size at most b , while ensuring that the new predictions h θ ( x j ) and the labels y j remain close on the unperturbed instances j (cid:54)∈ S .

Original: Given the the learner’s belief about the adversarial network a φ , we deﬁne the learner’s loss function as follows:
Revised: Given the the learner’s belief about the adversarial network a φ , we deﬁne the learner’s loss function as follows:

Original: [Equation]
Revised: [Equation]

Original: The parameter ρ is a regularization parameter which gives additional ﬂexibility to control the trade-off between accuracy on clean examples and perturbed examples.
Revised: The parameter ρ is a regularization parameter which gives additional ﬂexibility to control the trade-off between accuracy on clean examples and perturbed examples.

Original: Then, we formulate our adversarial training problem as the following bi-level discrete-continuous optimization task.
Revised: Then, we formulate our adversarial training problem as the following bi-level discrete-continuous optimization task.

Original: [Equation]
Revised: [Equation]

Original: where, φ ∗ ( θ , S
Revised: where, φ ∗ ( θ , S

Original: [Equation]
Revised: [Equation]

Original: =
Revised: =

Original: [Equation]
Revised: [Equation]

Original: The optimization problem (2) is a min-max game where the inner optimization problem aims to ﬁnd the subset S of size which provides the highest loss and the outer minimization problem aims to ﬁnd the model h θ that minimizes this loss.
Revised: The optimization problem (2) is a min-max game where the inner optimization problem aims to ﬁnd the subset S of size which provides the highest loss and the outer minimization problem aims to ﬁnd the model h θ that minimizes this loss.

Original: The optimization problem (3) is the learner’s belief about the adversary’s strategy .
Revised: The optimization problem (3) is the learner’s belief about the adversary’s strategy .

Original: It need not be true in practice.
Revised: It need not be true in practice.

Original: In Section 4, we perform experiments when the true adversary’s models differ from a φ during test.
Revised: In Section 4, we perform experiments when the true adversary’s models differ from a φ during test.

Original: Eq.
Revised: Eq.

Original: (3) provides the learner’s estimate about the parameters of the adversarial network.
Revised: (3) provides the learner’s estimate about the parameters of the adversarial network.

Original: Here, C ( a φ ( x i ) , x i ) is cost of perturbing x
Revised: Here, C ( a φ ( x i ) , x i ) is cost of perturbing x

Original: i to a φ ( x i ) often measured using different notions of distances, e.g. , normed differences or their squares, etc.
Revised: i to a φ ( x i ) often measured using different notions of distances, e.g. , normed differences or their squares, etc.

Original: In such a case, this optimization problem (3) can also be seen as the dual of the constrained optimization problem (Madry et al., 2017;
Revised: In such a case, this optimization problem (3) can also be seen as the dual of the constrained optimization problem (Madry et al., 2017;

Original: Robey et al., 2021) given by max φ (cid:80) i ∈ S (cid:96) ( h θ ( a φ ( x i )) , y i ) such that C ( a φ ( x i ) , x i ) ≤ ξ ( µ ) where ξ is dependent on µ .
Revised: Robey et al., 2021) given by max φ (cid:80) i ∈ S (cid:96) ( h θ ( a φ ( x i )) , y i ) such that C ( a φ ( x i ) , x i ) ≤ ξ ( µ ) where ξ is dependent on µ .

Original: Note that, the adversary can select the subset S in both deterministic or probabilistic manner.
Revised: Note that, the adversary can select the subset S in both deterministic or probabilistic manner.

Original: For example, it can attack images of speciﬁc persons in facial recognition systems, perturb the instances with stop-signs in trafﬁc signs classiﬁcation system, etc.
Revised: For example, it can attack images of speciﬁc persons in facial recognition systems, perturb the instances with stop-signs in trafﬁc signs classiﬁcation system, etc.

Original: On the other hand, it can select instances with probability proportional to the uncertainty of a classiﬁer.
Revised: On the other hand, it can select instances with probability proportional to the uncertainty of a classiﬁer.

Original: Similar to the optimization problems (2)– (3), one can derive a continuous min-max optimization problem when S is drawn from a probability distribution.
Revised: Similar to the optimization problems (2)– (3), one can derive a continuous min-max optimization problem when S is drawn from a probability distribution.

Original: We show the connection between this continuous optimization problem and our discrete continuous optimization problem in Appendix C.
Revised: We show the connection between this continuous optimization problem and our discrete continuous optimization problem in Appendix C.

Original: Hardness analysis.
Revised: Hardness analysis.

Original: The inner optimization problem in Eq.
Revised: The inner optimization problem in Eq.

Original: (2) involves combinatorial search over S for a ﬁxed θ .
Revised: (2) involves combinatorial search over S for a ﬁxed θ .

Original: However, while doing so, it requires to compute φ ∗ ( θ , S ) .
Revised: However, while doing so, it requires to compute φ ∗ ( θ , S ) .

Original: This makes our adversarial training problem
Revised: This makes our adversarial training problem

Original: NP-Hard
Revised: NP-Hard

Original: (see Apppendix C for a proof).
Revised: (see Apppendix C for a proof).

Original:  P ROPOSED APPROACH
Revised:  P ROPOSED APPROACH

Original: In this section, we provide algorithms to solve the optimization problem (2).
Revised: In this section, we provide algorithms to solve the optimization problem (2).

Original: We ﬁrst characterize it as a difference between a γ -weakly submodular function and a modular function.
Revised: We ﬁrst characterize it as a difference between a γ -weakly submodular function and a modular function.

Original: Next, we design
Revised: Next, we design

Original: R OGET , a family of algorithms to solve our adversarial training problem (2).
Revised: R OGET , a family of algorithms to solve our adversarial training problem (2).

Original: 3. S ET FUNCTION THEORETIC CHARACTERIZATION OF F
Revised: 3. S ET FUNCTION THEORETIC CHARACTERIZATION OF F

Original: Here, we provide a characterization of the objective function F ( h θ , S | a φ ) using the notions of monotonicity and γ -weak submodularity, which would lead us to design an approximation algorithm to solve our training problem (2).
Revised: Here, we provide a characterization of the objective function F ( h θ , S | a φ ) using the notions of monotonicity and γ -weak submodularity, which would lead us to design an approximation algorithm to solve our training problem (2).

Original: To do so, we ﬁrst formally state the deﬁnitions of these notions.
Revised: To do so, we ﬁrst formally state the deﬁnitions of these notions.

Original: Deﬁnition 1.
Revised: Deﬁnition 1.

Original: Given a set function Q : 2 D → R , we deﬁne the marginal gain of Q as Q ( k | S ) :=
Revised: Given a set function Q : 2 D → R , we deﬁne the marginal gain of Q as Q ( k | S ) :=

Original: Q ( S ∪ { k } ) − Q ( S ) .
Revised: Q ( S ∪ { k } ) − Q ( S ) .

Original: The function Q is monotone (non-decreasing) if Q ( k | S ) ≥ 0 for all k ∈ D \ S .
Revised: The function Q is monotone (non-decreasing) if Q ( k | S ) ≥ 0 for all k ∈ D \ S .

Original: The function Q is called γ -weakly submodular if for some γ ∈ (0 , 1] , we have (cid:80)
Revised: The function Q is called γ -weakly submodular if for some γ ∈ (0 , 1] , we have (cid:80)

Original: k ∈ T \ S Q ( k | S ) ≥ γ [ Q ( T ∪ S ) − Q ( S )]
Revised: k ∈ T \ S Q ( k | S ) ≥ γ [ Q ( T ∪ S ) − Q ( S )]

Original: whenever S ⊂ T ⊆ D .
Revised: whenever S ⊂ T ⊆ D .

Original: Here, γ is called the submodularity ratio of Q .
Revised: Here, γ is called the submodularity ratio of Q .

Original: The function Q is modular if Q ( k | S )
Revised: The function Q is modular if Q ( k | S )

Original: =
Revised: =

Original: Q ( k | T ) for all S ⊂ T ⊂ D and k ∈ D \ T .
Revised: Q ( k | T ) for all S ⊂ T ⊂ D and k ∈ D \ T .

Original: Alternative representation of F ( h θ , S | a φ ∗ ( θ ,S ) ) .
Revised: Alternative representation of F ( h θ , S | a φ ∗ ( θ ,S ) ) .

Original: Given a regularization function R ( θ ) and a regularization parameter λ > 0 , we deﬁne two set functions G ( θ , S ) and m ( θ , S ) as follows:
Revised: Given a regularization function R ( θ ) and a regularization parameter λ > 0 , we deﬁne two set functions G ( θ , S ) and m ( θ , S ) as follows:

Original: [Equation]
Revised: [Equation]

Original: Then, we represent F ( h θ , S | a φ ∗ ( θ ,S ) ) as the difference between the above functions, i.e. ,
Revised: Then, we represent F ( h θ , S | a φ ∗ ( θ ,S ) ) as the difference between the above functions, i.e. ,

Original: [Equation]
Revised: [Equation]

Original: Here, m λ is a modular function.
Revised: Here, m λ is a modular function.

Original: Note that the above equality holds for any value of λ > 0 .
Revised: Note that the above equality holds for any value of λ > 0 .

Original: However, as we shall see next, the submodularity ratio of G λ depends on λ which affects the performance of the approximation algorithm designed in Section 3.2.
Revised: However, as we shall see next, the submodularity ratio of G λ depends on λ which affects the performance of the approximation algorithm designed in Section 3.2.

Original: Next, we present some assumptions which would be used to characterize the above representation of F .
Revised: Next, we present some assumptions which would be used to characterize the above representation of F .

Original: Assumptions 1.
Revised: Assumptions 1.

Original: (1) Lipschitz continuity : (a) The loss function (cid:96) ( h ( x ) , y ) is L h -Lipschitz with respect to h , (b) h θ ( x ) is L x -Lipschitz with respect to x , (c) the adversarial network a φ ( . )
Revised: (1) Lipschitz continuity : (a) The loss function (cid:96) ( h ( x ) , y ) is L h -Lipschitz with respect to h , (b) h θ ( x ) is L x -Lipschitz with respect to x , (c) the adversarial network a φ ( . )

Original: is L φLipschitz with respect to φ .
Revised: is L φLipschitz with respect to φ .

Original: (2) Stability of φ ∗ ( θ , S ) :
Revised: (2) Stability of φ ∗ ( θ , S ) :

Original: The learner’s estimate about the parameter for the adversarial network is stable (Bousquet & Elisseeff, 2002; Charles & Papailiopoulos, 2018; Hardt et al., 2016), i.e. , the solution φ ∗ ( θ , S ) of the optimization (3) satisﬁes (cid:107) φ ∗ ( θ , S ∪ k ) − φ ∗ ( θ , S ) (cid:107) ≤ β/ | S | for some β > 0 and all θ .
Revised: The learner’s estimate about the parameter for the adversarial network is stable (Bousquet & Elisseeff, 2002; Charles & Papailiopoulos, 2018; Hardt et al., 2016), i.e. , the solution φ ∗ ( θ , S ) of the optimization (3) satisﬁes (cid:107) φ ∗ ( θ , S ∪ k ) − φ ∗ ( θ , S ) (cid:107) ≤ β/ | S | for some β > 0 and all θ .

Original: Stability holds for a wide variety of loss functions including convex losses Bousquet & Elisseeff (2002), a class of neural models called Polyak-Lojasiewicz (PL) losses Charles & Papailiopoulos (2018), etc. .
Revised: Stability holds for a wide variety of loss functions including convex losses Bousquet & Elisseeff (2002), a class of neural models called Polyak-Lojasiewicz (PL) losses Charles & Papailiopoulos (2018), etc. .

Original: (3) Metric property of the cost of perturbation C :
Revised: (3) Metric property of the cost of perturbation C :

Original: The cost of perturbation C used in Eq.
Revised: The cost of perturbation C used in Eq.

Original: (3) is a distance metric.
Revised: (3) is a distance metric.

Original: Speciﬁcally, it follows the triangle inequality, i.e. , C ( x (cid:48) , x ) ≤ C ( x (cid:48) , x (cid:48)(cid:48) )
Revised: Speciﬁcally, it follows the triangle inequality, i.e. , C ( x (cid:48) , x ) ≤ C ( x (cid:48) , x (cid:48)(cid:48) )

Original: + C ( x (cid:48)(cid:48) , x ) .
Revised: + C ( x (cid:48)(cid:48) , x ) .

Original: (4) Norm-boundedness of C :
Revised: (4) Norm-boundedness of C :

Original: The cost of perturbation C is a bounded by an (cid:96) 2 norm, i.e. , C ( x (cid:48) , x ) ≤ q || x (cid:48) − x || .
Revised: The cost of perturbation C is a bounded by an (cid:96) 2 norm, i.e. , C ( x (cid:48) , x ) ≤ q || x (cid:48) − x || .

Original: In the context of several prior works (Goodfellow et al., 2015; Madry et al., 2017) use (cid:96) ∞ distance which is bounded by (cid:96)norm.
Revised: In the context of several prior works (Goodfellow et al., 2015; Madry et al., 2017) use (cid:96) ∞ distance which is bounded by (cid:96)norm.

Original: (5) Boundeness of Θ and Φ : We assume that the parameter space of both the learning model and adversarial network are bounded, i.e. , || θ || 2 ≤ θ max
Revised: (5) Boundeness of Θ and Φ : We assume that the parameter space of both the learning model and adversarial network are bounded, i.e. , || θ || 2 ≤ θ max

Original: and
Revised: and

Original: || φ
Revised: || φ

Original: || 2 ≤ φ max .
Revised: || 2 ≤ φ max .

Original: Monotonicity and γ -weakly submodularity of G λ .
Revised: Monotonicity and γ -weakly submodularity of G λ .

Original: We now present our results on monotonicity and γ -weak submodularity of G λ (see Appendix E.1 for a proof).
Revised: We now present our results on monotonicity and γ -weak submodularity of G λ (see Appendix E.1 for a proof).

Original: Theorem 2.
Revised: Theorem 2.

Original: Given Assumptions 1 let there be a value of minimum non-zero constant λ min > 0 such that (cid:96) ∗ = min x ∈X ,y ∈Y min θ [ λ min R ( θ ) + (cid:96) ( h θ ( x ) , y ) − 2 qµβL φ ] > 0 where q and β are given in
Revised: Given Assumptions 1 let there be a value of minimum non-zero constant λ min > 0 such that (cid:96) ∗ = min x ∈X ,y ∈Y min θ [ λ min R ( θ ) + (cid:96) ( h θ ( x ) , y ) − 2 qµβL φ ] > 0 where q and β are given in

Original: Assumptions 1.
Revised: Assumptions 1.

Original: Then, for λ > λ min , we have the following statements:
Revised: Then, for λ > λ min , we have the following statements:

Original: (1) G λ ( S ) is monotone in S .
Revised: (1) G λ ( S ) is monotone in S .

Original: (2) G λ ( S ) γ -weakly submodular with γ > γ ∗ =
Revised: (2) G λ ( S ) γ -weakly submodular with γ > γ ∗ =

Original: ∗
Revised: ∗

Original: ∗ + 2 L h
Revised: ∗ + 2 L h

Original: L x L φ φ max + 3 qµβL
Revised: L x L φ φ max + 3 qµβL

Original: 3. R OGET : P ROPOSED ALGORITHM TO SOLVE THE ADVERSARIAL TRAINING PROBLEM (2)
Revised: 3. R OGET : P ROPOSED ALGORITHM TO SOLVE THE ADVERSARIAL TRAINING PROBLEM (2)

Original: In this section, we develop R OGET to solve our optimization problem (2) by building upon the proposal of Adibi et al.
Revised: In this section, we develop R OGET to solve our optimization problem (2) by building upon the proposal of Adibi et al.

Original: However, they design algorithms to solve the min-max problem on those functions that are submodular in S and convex in θ .
Revised: However, they design algorithms to solve the min-max problem on those functions that are submodular in S and convex in θ .

Original: In contrast, R OGET applies to the proposed objective F ( h θ , S | a φ ∗ ( θ ,S ) ) (1) which is the difference between a γ -weakly submodular function
Revised: In contrast, R OGET applies to the proposed objective F ( h θ , S | a φ ∗ ( θ ,S ) ) (1) which is the difference between a γ -weakly submodular function

Original: Require:
Revised: Require:

Original: Training set D , regularization parameter λ , budget b , # of iterations T , learning rate η .
Revised: Training set D , regularization parameter λ , budget b , # of iterations T , learning rate η .

Original: 1: I NIT ( h θ ), (cid:98) S 0 ← ∅ 2: for t = 0 to T − 1 do 3: (cid:98) θ t +1 ← T RAIN ( (cid:98) θ t , (cid:98) S t , η t ) 4: (cid:98) S t +1 ← SDG ( G λ , m λ , (cid:98) θ t +1 , b ) .
Revised: 1: I NIT ( h θ ), (cid:98) S 0 ← ∅ 2: for t = 0 to T − 1 do 3: (cid:98) θ t +1 ← T RAIN ( (cid:98) θ t , (cid:98) S t , η t ) 4: (cid:98) S t +1 ← SDG ( G λ , m λ , (cid:98) θ t +1 , b ) .

Original: 5: (cid:98) θ
Revised: 5: (cid:98) θ

Original: = θ T 6: return (cid:98) θ , (cid:98) S T 1: procedure SDG ( G λ , m λ , (cid:98) θ , b ) 2:
Revised: = θ T 6: return (cid:98) θ , (cid:98) S T 1: procedure SDG ( G λ , m λ , (cid:98) θ , b ) 2:

Original: S ← ∅ 3: for s ∈ [ b ] do 4: γ (cid:48) ← (1 − γ/b ) b − s −5:
Revised: S ← ∅ 3: for s ∈ [ b ] do 4: γ (cid:48) ← (1 − γ/b ) b − s −5:

Original: Randomly draw a subset B from D 6:
Revised: Randomly draw a subset B from D 6:

Original: M ← [ γ (cid:48)
Revised: M ← [ γ (cid:48)

Original: G λ ( θ , e | S ) − m λ
Revised: G λ ( θ , e | S ) − m λ

Original: ( θ , { e } )]
Revised: ( θ , { e } )]

Original: e ∈ B 7: e ∗ = argmax e ∈ B
Revised: e ∈ B 7: e ∗ = argmax e ∈ B

Original: M [ e ] 8: if γ (cid:48)
Revised: M [ e ] 8: if γ (cid:48)

Original: G λ ( θ , e ∗ | S ) − m λ
Revised: G λ ( θ , e ∗ | S ) − m λ

Original: ( θ , { e ∗ } ) ≥ 

Revised: ( θ , { e ∗ } ) ≥

Original: then 9:
Revised: then 9:

Original: S ← S ∪ { e } 10: return S 1: procedure T RAIN ( (cid:98) θ , S, η ) 2: //SGD for k steps 3: for i ∈ [ k ] do 4:
Revised: S ← S ∪ { e } 10: return S 1: procedure T RAIN ( (cid:98) θ , S, η ) 2: //SGD for k steps 3: for i ∈ [ k ] do 4:

Original: Draw i ∼ D uniformly at random 5: if i ∈ S then 6: (cid:98) θ ← (cid:98) θ − η ∂(cid:96) ( h θ ( a φ ( x i )) ,y i ) ∂ θ (cid:12)(cid:12) θ = (cid:98) θ 7: else 8: (cid:98) θ ← (cid:98) θ − η ρ∂(cid:96)
Revised: Draw i ∼ D uniformly at random 5: if i ∈ S then 6: (cid:98) θ ← (cid:98) θ − η ∂(cid:96) ( h θ ( a φ ( x i )) ,y i ) ∂ θ (cid:12)(cid:12) θ = (cid:98) θ 7: else 8: (cid:98) θ ← (cid:98) θ − η ρ∂(cid:96)

Original: ( h θ ( x i ) ,y i )
Revised: ( h θ ( x i ) ,y i )

Original: ∂ θ (cid:12)(cid:12) θ = (cid:98) θ 9: return (cid:98) θ and a modular function, and may also be nonconvex in θ .
Revised: ∂ θ (cid:12)(cid:12) θ = (cid:98) θ 9: return (cid:98) θ and a modular function, and may also be nonconvex in θ .

Original: In the following, we describe them in details beginning with an outline of the proposed algorithm.
Revised: In the following, we describe them in details beginning with an outline of the proposed algorithm.

Original: Development of R OGET .
Revised: Development of R OGET .

Original: Our key goal is to optimize min θ max S F ( h θ , S | a φ ∗ ( θ ,S ) ) .
Revised: Our key goal is to optimize min θ max S F ( h θ , S | a φ ∗ ( θ ,S ) ) .

Original: Now, we aim to develop an algorithm which would iterate over the inner and outer optimization problem and gradually reﬁne S and θ .
Revised: Now, we aim to develop an algorithm which would iterate over the inner and outer optimization problem and gradually reﬁne S and θ .

Original: Iterative method for the inner optimization on
Revised: Iterative method for the inner optimization on

Original: S :
Revised: S :

Original: Now, given a ﬁxed θ , the inner maximization problem becomes a set function optimization problem.
Revised: Now, given a ﬁxed θ , the inner maximization problem becomes a set function optimization problem.

Original: If F were a monotone submodular function, then we could have applied the well known greedy algorithm (Nemhauser et al., 1978).
Revised: If F were a monotone submodular function, then we could have applied the well known greedy algorithm (Nemhauser et al., 1978).

Original: At each step, such a greedy algorithm would seek for an element e that would maximize the marginal gain F ( h θ , S ∪ e | a φ ∗ ( θ ,S ∪ e ) )
Revised: At each step, such a greedy algorithm would seek for an element e that would maximize the marginal gain F ( h θ , S ∪ e | a φ ∗ ( θ ,S ∪ e ) )

Original: − F ( h θ , S | a φ ∗ ( θ ,S ) ) and update
Revised: − F ( h θ , S | a φ ∗ ( θ ,S ) ) and update

Original: S → S ∪ { e } .
Revised: S → S ∪ { e } .

Original: However, in our context, the function F may neither be monotone nor submodular and thus, we cannot apply the greedy algorithm for iterating over the inner optimization loop Nevertheless, we note that it can be expressed as difference between the γ -weakly submodular function G λ ( θ , S ) and the modular function m λ ( θ , S ) , as suggested by Eq.
Revised: However, in our context, the function F may neither be monotone nor submodular and thus, we cannot apply the greedy algorithm for iterating over the inner optimization loop Nevertheless, we note that it can be expressed as difference between the γ -weakly submodular function G λ ( θ , S ) and the modular function m λ ( θ , S ) , as suggested by Eq.

Original: As a result, we can adopt the stochastic distorted greedy algorithm
Revised: As a result, we can adopt the stochastic distorted greedy algorithm

Original: (Harshaw et al., 2019) which, instead of maximizing exact marginal gain, maximizes a distorted marginal gain (1 − γ ) b − s − 1 G λ ( θ , e | S ) − m λ
Revised: (Harshaw et al., 2019) which, instead of maximizing exact marginal gain, maximizes a distorted marginal gain (1 − γ ) b − s − 1 G λ ( θ , e | S ) − m λ

Original: ( θ , { e } ) for all e (cid:54)∈ S at each step (procedure SDG in Algorithm 1).
Revised: ( θ , { e } ) for all e (cid:54)∈ S at each step (procedure SDG in Algorithm 1).

Original: If this distorted marginal gain is positive, we update S → S ∪ { e } .
Revised: If this distorted marginal gain is positive, we update S → S ∪ { e } .

Original: This method gives an approximation guarantee for the inner optimization problem (due to Harshaw et al.
Revised: This method gives an approximation guarantee for the inner optimization problem (due to Harshaw et al.

Original: Theorem 3 (Harshaw et al.
Revised: Theorem 3 (Harshaw et al.

Original: Given a ﬁxed θ and that the size of the set B is | B | = ( | D | /b ) log(1 /δ ) in line 5 of the procedure SDG .
Revised: Given a ﬁxed θ and that the size of the set B is | B | = ( | D | /b ) log(1 /δ ) in line 5 of the procedure SDG .

Original: If the procedure SDG returns S as the output, then we have
Revised: If the procedure SDG returns S as the output, then we have

Original: [Equation]
Revised: [Equation]

Original: where OPT is the optimal solution of the inner optimization problem.
Revised: where OPT is the optimal solution of the inner optimization problem.

Original: Here, expectation is carried out over the randomness of selection of B .
Revised: Here, expectation is carried out over the randomness of selection of B .

Original: Iterative routine for outer optimization on θ : Having updated S using the distorted greedy algorithm described above, we minimize the F ( h θ , S | a φ ∗ ( θ ,S ) ) with respect to θ using few steps of gradient descent (called as k -SGD) per each round of update.
Revised: Iterative routine for outer optimization on θ : Having updated S using the distorted greedy algorithm described above, we minimize the F ( h θ , S | a φ ∗ ( θ ,S ) ) with respect to θ using few steps of gradient descent (called as k -SGD) per each round of update.

Original: Outline of R OGET : We sketch the pseudocode of R OGET in Algorithm 1.
Revised: Outline of R OGET : We sketch the pseudocode of R OGET in Algorithm 1.

Original: It updates θ and S in an iterative manner.
Revised: It updates θ and S in an iterative manner.

Original: During iteration t , R OGET updates (cid:98) θ t → (cid:98) θ t +1 by running few steps of gradient descent (line 3)— where we ﬁx S at (cid:98) S t and attempt to reduce the loss F ( h θ , (cid:98) S t | a φ ∗ ( θ , (cid:98) S t ) ) with respect to θ .
Revised: During iteration t , R OGET updates (cid:98) θ t → (cid:98) θ t +1 by running few steps of gradient descent (line 3)— where we ﬁx S at (cid:98) S t and attempt to reduce the loss F ( h θ , (cid:98) S t | a φ ∗ ( θ , (cid:98) S t ) ) with respect to θ .

Original: In the next step, we ﬁx (cid:98) θ t and update (cid:98) S t
Revised: In the next step, we ﬁx (cid:98) θ t and update (cid:98) S t

Original: →
Revised: →

Original: (cid:98) S t +1 using stochastic distorted greedy algorithm (SDG, line 4).
Revised: (cid:98) S t +1 using stochastic distorted greedy algorithm (SDG, line 4).

Original: Note that during each time t , we compute S t for a ﬁxed (cid:98) θ sequentially in b steps.
Revised: Note that during each time t , we compute S t for a ﬁxed (cid:98) θ sequentially in b steps.

Original: Having obtained S at s < b , we update it such that it has highest positive distorted marginal gain (1 − γ ) b − s − 1 G λ ( θ , e | S ) − m λ ( θ | { e } ) and then, it is included into the set S to have S ∪ { e } .
Revised: Having obtained S at s < b , we update it such that it has highest positive distorted marginal gain (1 − γ ) b − s − 1 G λ ( θ , e | S ) − m λ ( θ | { e } ) and then, it is included into the set S to have S ∪ { e } .

Original: Approximation guarantees.
Revised: Approximation guarantees.

Original: In general, F is a highly non-convex function of θ and therefore, obtaining an approximation guarantee for any general F is extremely challenging.
Revised: In general, F is a highly non-convex function of θ and therefore, obtaining an approximation guarantee for any general F is extremely challenging.

Original: Hence, we derive approximation guarantee for a restrictive class of loss functions, called Polyak-Lojasiewicz (PL) loss functions.
Revised: Hence, we derive approximation guarantee for a restrictive class of loss functions, called Polyak-Lojasiewicz (PL) loss functions.

Original: A function f is Polyak-Lojasiewicz if ||∇ θ f ( θ ) || ≥ σ [ f ( θ ) − min θ (cid:48)
Revised: A function f is Polyak-Lojasiewicz if ||∇ θ f ( θ ) || ≥ σ [ f ( θ ) − min θ (cid:48)

Original: f ( θ (cid:48) )]
Revised: f ( θ (cid:48) )]

Original: In
Revised: In

Original: Appendix E.2, we also present our results when F is convex in θ .
Revised: Appendix E.2, we also present our results when F is convex in θ .

Original: Next, we initiate our discussion with a few more assumptions in addition to Assumptions 1.
Revised: Next, we initiate our discussion with a few more assumptions in addition to Assumptions 1.

Original: Assumptions 2.
Revised: Assumptions 2.

Original: (1) L-smoothness of F .
Revised: (1) L-smoothness of F .

Original: For all θ ∈ Θ and for all S ∈ 2 V , we have ||∇ θ F ( h θ , S | a φ ∗ ( θ ,S ) )
Revised: For all θ ∈ Θ and for all S ∈ 2 V , we have ||∇ θ F ( h θ , S | a φ ∗ ( θ ,S ) )

Original: − ∇ θ (cid:48)
Revised: − ∇ θ (cid:48)

Original: F
Revised: F

Original: ( h θ (cid:48) , S | a φ ∗ ( θ (cid:48) ,S ) )
Revised: ( h θ (cid:48) , S | a φ ∗ ( θ (cid:48) ,S ) )

Original: || ≤ L || θ − θ (cid:48) || .
Revised: || ≤ L || θ − θ (cid:48) || .

Original: (2) Boundedness of gradients of F .
Revised: (2) Boundedness of gradients of F .

Original: We have ||∇ θ F ( h θ , S | a φ ∗ ( θ ,S ) )
Revised: We have ||∇ θ F ( h θ , S | a φ ∗ ( θ ,S ) )

Original: || ≤ ∇ max for all θ ∈ Θ and for all S ∈ 2 V .
Revised: || ≤ ∇ max for all θ ∈ Θ and for all S ∈ 2 V .

Original: Boundedness of loss (cid:96) and model h θ .
Revised: Boundedness of loss (cid:96) and model h θ .

Original: For all θ ∈ Θ , | (cid:96) ( h θ ( x i ) , y i ) | < (cid:96) max and || h
Revised: For all θ ∈ Θ , | (cid:96) ( h θ ( x i ) , y i ) | < (cid:96) max and || h

Original: θ
Revised: θ

Original: || <
Revised: || <

Original: h max .
Revised: h max .

Original: Size of B in SDG procedure.
Revised: Size of B in SDG procedure.

Original: The size of the set B k is | B k | =
Revised: The size of the set B k is | B k | =

Original: ( | D | /b ) log(1 /δ )
Revised: ( | D | /b ) log(1 /δ )

Original: (line 5 in procedure
Revised: (line 5 in procedure

Original: SDG used in Algorithm 1).
Revised: SDG used in Algorithm 1).

Original: (5) Adversarial network always perturbs a feature.
Revised: (5) Adversarial network always perturbs a feature.

Original: The cost of perturbation C ( a φ ∗ ( θ ,S ) ( x i ) , x i ) > C min > 0 .
Revised: The cost of perturbation C ( a φ ∗ ( θ ,S ) ( x i ) , x i ) > C min > 0 .

Original: Moreover, C min > λθ 2 max ( e − γ ∗ + δ ) / (1 − e − γ ∗ − δ ) where γ ∗ is the submodularity ratio (Theorem 2).
Revised: Moreover, C min > λθ 2 max ( e − γ ∗ + δ ) / (1 − e − γ ∗ − δ ) where γ ∗ is the submodularity ratio (Theorem 2).

Original: We provide justiﬁcation for all the assumptions in Appendix D.
Revised: We provide justiﬁcation for all the assumptions in Appendix D.

Original: Now we state the approximation guarantee of Algorithm 1 for Polyak-Lojasiewicz (PL) loss (see Appendix E.2 for proof).
Revised: Now we state the approximation guarantee of Algorithm 1 for Polyak-Lojasiewicz (PL) loss (see Appendix E.2 for proof).

Original: Theorem 4.
Revised: Theorem 4.

Original: Given the conditions of Theorem 2 and Assumptions 2, let F ( h θ , S | a φ ∗ ( θ ,S ) ) be a PL function in θ for all S , i.e. , ||∇ θ F ( h θ , S | a φ ∗ ( θ ,S ) )
Revised: Given the conditions of Theorem 2 and Assumptions 2, let F ( h θ , S | a φ ∗ ( θ ,S ) ) be a PL function in θ for all S , i.e. , ||∇ θ F ( h θ , S | a φ ∗ ( θ ,S ) )

Original: || ≥ σ [ F ( h θ , S | a φ ∗ ( θ ,S ) )
Revised: || ≥ σ [ F ( h θ , S | a φ ∗ ( θ ,S ) )

Original: − min θ (cid:48) F ( h θ (cid:48) , S | a φ ∗ ( θ (cid:48) ,S ) )] for some constant σ .
Revised: − min θ (cid:48) F ( h θ (cid:48) , S | a φ ∗ ( θ (cid:48) ,S ) )] for some constant σ .

Original: If we set the learning rate η = 1 /kT in Algorithm 1, then for T
Revised: If we set the learning rate η = 1 /kT in Algorithm 1, then for T

Original: = O (1 /k(cid:15) ) iterations, δ < (1 − e − γ ∗ ) and ρ <
Revised: = O (1 /k(cid:15) ) iterations, δ < (1 − e − γ ∗ ) and ρ <

Original: [ C min (( e − γ ∗ + δ ) − 1 − 1) − λθ 2max ] /(cid:96) max , we have the following approximation guarantee for Algorithm 1:
Revised: [ C min (( e − γ ∗ + δ ) − 1 − 1) − λθ 2max ] /(cid:96) max , we have the following approximation guarantee for Algorithm 1:

Original: [Equation]
Revised: [Equation]

Original: where θ t is the iterate in Line 3 in Algorithm 1, OPT is the value at the optimum solution of our adversarial training problem (2) , κ = C min / ( λθ 2max + ρ(cid:96) max + C min ) .
Revised: where θ t is the iterate in Line 3 in Algorithm 1, OPT is the value at the optimum solution of our adversarial training problem (2) , κ = C min / ( λθ 2max + ρ(cid:96) max + C min ) .

Original: Here θ max is deﬁned in
Revised: Here θ max is deﬁned in

Original: Assumption 1 and (cid:96) max , C min are deﬁned in Assumptions 2.
Revised: Assumption 1 and (cid:96) max , C min are deﬁned in Assumptions 2.

Original: Note that, due to non-convexity, we do not provide guarantee on ﬁnal (cid:98) θ
Revised: Note that, due to non-convexity, we do not provide guarantee on ﬁnal (cid:98) θ

Original: = θ T , but on the iterates (cid:98) θ t ; and, the approximation factor suffers from an additional offset 2 L 2 h max /σ , even as (cid:15) → 0 .
Revised: = θ T , but on the iterates (cid:98) θ t ; and, the approximation factor suffers from an additional offset 2 L 2 h max /σ , even as (cid:15) → 0 .

Original: In
Revised: In

Original: Appendix E.2, we present our results when F is convex, where this bound becomes stronger.
Revised: Appendix E.2, we present our results when F is convex, where this bound becomes stronger.

Original:  E XPERIMENTS
Revised:  E XPERIMENTS

Original: In this section, we conduct experiments with real world datasets which show that R OGET achieves a better overall accuracy than the state-of-the-art methods for both white-box and black-box attacks.
Revised: In this section, we conduct experiments with real world datasets which show that R OGET achieves a better overall accuracy than the state-of-the-art methods for both white-box and black-box attacks.

Original: Appendix H contains additional results.
Revised: Appendix H contains additional results.

Original: 4. E XPERIMENTAL SETUP
Revised: 4. E XPERIMENTAL SETUP

Original: Datasets and state-of-the art competitors.
Revised: Datasets and state-of-the art competitors.

Original: We experiment with CIFAR10 (Krizhevsky et al., 2014) and Fashion MNIST (Xiao et al., 2017) (FMNIST) in this section.
Revised: We experiment with CIFAR10 (Krizhevsky et al., 2014) and Fashion MNIST (Xiao et al., 2017) (FMNIST) in this section.

Original: In Appendix H, we also report results on CIFAR100.
Revised: In Appendix H, we also report results on CIFAR100.

Original: We consider seven state-of-the-art methods to compare our method– they are: GAT (Sriramanan et al., 2020), FBF (Wong et al., 2019), TRADES (Zhang et al., 2019b),
Revised: We consider seven state-of-the-art methods to compare our method– they are: GAT (Sriramanan et al., 2020), FBF (Wong et al., 2019), TRADES (Zhang et al., 2019b),

Original: Nu-AT (Sriramanan et al., 2021), MART (Wang et al., 2019), PGD-AT (Madry
Revised: Nu-AT (Sriramanan et al., 2021), MART (Wang et al., 2019), PGD-AT (Madry

Original: et al., 2017)
Revised: et al., 2017)

Original: and
Revised: and

Original: RFGSM-AT (Tramèr et al., 2018).
Revised: RFGSM-AT (Tramèr et al., 2018).

Original: Appendix G contains more details about the baselines.
Revised: Appendix G contains more details about the baselines.

Original: Evaluation protocol.
Revised: Evaluation protocol.

Original: We split the datasets into training ( D Tr ), validation ( D Val ), and test set ( D Test ) in the ratio of 4:1:1 and 5:1:1 for CIFAR10 and FMNIST respectively.
Revised: We split the datasets into training ( D Tr ), validation ( D Val ), and test set ( D Test ) in the ratio of 4:1:1 and 5:1:1 for CIFAR10 and FMNIST respectively.

Original: We use the validation set for hyperparameter selection (mentioned later), early stopping (See Appendix G for details), etc.
Revised: We use the validation set for hyperparameter selection (mentioned later), early stopping (See Appendix G for details), etc.

Original: We report three types of accuracies, viz.
Revised: We report three types of accuracies, viz.

Original: , (i) accuracy on clean examples
Revised: , (i) accuracy on clean examples

Original: A clean = P ( y = ˆ y | x is not chosen for attack ) , (ii) robustness to adversarial perturbations measured using the accuracy
Revised: A clean = P ( y = ˆ y | x is not chosen for attack ) , (ii) robustness to adversarial perturbations measured using the accuracy

Original: Models for the learner.
Revised: Models for the learner.

Original: We consider two candidates for a φ , which model the learner’s belief about the adversary during training.
Revised: We consider two candidates for a φ , which model the learner’s belief about the adversary during training.

Original: Speciﬁcally, we set either a φ = PGD (Madry et al., 2017) or a φ = AdvGAN (Xiao et al., 2018).
Revised: Speciﬁcally, we set either a φ = PGD (Madry et al., 2017) or a φ = AdvGAN (Xiao et al., 2018).

Original: This gives rise to two variants of our model, viz.
Revised: This gives rise to two variants of our model, viz.

Original: , R OGET ( a φ = PGD) and R OGET ( a φ = AdvGAN).
Revised: , R OGET ( a φ = PGD) and R OGET ( a φ = AdvGAN).

Original: We use ResNet-18 (He et al., 2016) and LeNet-5 (LeCun et al., 2015) architectures for CIFAR10 and FMNIST datasets respectively.
Revised: We use ResNet-18 (He et al., 2016) and LeNet-5 (LeCun et al., 2015) architectures for CIFAR10 and FMNIST datasets respectively.

Original: Model for the adversarial perturbation.
Revised: Model for the adversarial perturbation.

Original: We consider two white-box attacks, viz. , PGD (Madry et al., 2017) and Auto Attack (AA) (Croce & Hein, 2020) as well as three black-box attacks, viz. , Square (Andriushchenko et al., 2020) and black-box MI-FGSM (Dong et al., 2018) and AdvGAN (Xiao et al., 2018) to perturb test samples.
Revised: We consider two white-box attacks, viz. , PGD (Madry et al., 2017) and Auto Attack (AA) (Croce & Hein, 2020) as well as three black-box attacks, viz. , Square (Andriushchenko et al., 2020) and black-box MI-FGSM (Dong et al., 2018) and AdvGAN (Xiao et al., 2018) to perturb test samples.

Original: The exact details of the attacks are given in
Revised: The exact details of the attacks are given in

Original: Appendix G.
Revised: Appendix G.

Original: The subset selection strategy of the adversary.
Revised: The subset selection strategy of the adversary.

Original: In addition to the adversarial perturbation mechanism, the adversary also has a strategy to select a subset S latent of test instances to attack on.
Revised: In addition to the adversarial perturbation mechanism, the adversary also has a strategy to select a subset S latent of test instances to attack on.

Original: We experiment with two latent subset selection mechanisms.
Revised: We experiment with two latent subset selection mechanisms.

Original: (1) Uncertainty based subset selection:
Revised: (1) Uncertainty based subset selection:

Original: Here, the adversary selects the top- 10% instances in terms of the prediction uncertainty of a classiﬁer trained on clean examples from D Tr .
Revised: Here, the adversary selects the top- 10% instances in terms of the prediction uncertainty of a classiﬁer trained on clean examples from D Tr .

Original: Here, the prediction uncertainty for an instance x is computed as u ( x ) =
Revised: Here, the prediction uncertainty for an instance x is computed as u ( x ) =

Original: 1 − max y h ( x )[ y ] .
Revised: 1 − max y h ( x )[ y ] .

Original: (2) Label based subset selection: Here, the adversary selects instances who have a speciﬁc label y ∈ Y to perform attack, e.g. , S latent =
Revised: (2) Label based subset selection: Here, the adversary selects instances who have a speciﬁc label y ∈ Y to perform attack, e.g. , S latent =

Original: { i | y i = aeroplane } .
Revised: { i | y i = aeroplane } .

Original: Note that, the underlying subset selection strategy is realized only during test— it is not revealed to the learner during training and validation, in practice.
Revised: Note that, the underlying subset selection strategy is realized only during test— it is not revealed to the learner during training and validation, in practice.

Original: Appendix H also presents other strategies.
Revised: Appendix H also presents other strategies.

Original: Hyperparameter selection.
Revised: Hyperparameter selection.

Original: Suppose, for instance, that the adversary’s latent strategy of selecting a subset to perform attack is known during validation stage.
Revised: Suppose, for instance, that the adversary’s latent strategy of selecting a subset to perform attack is known during validation stage.

Original: Then one could easily simulate such strategy to create the perturbed instances in the validation set and use the resulting validation set to cross validate the underlying hyperparameters.
Revised: Then one could easily simulate such strategy to create the perturbed instances in the validation set and use the resulting validation set to cross validate the underlying hyperparameters.

Original: However, the subset selection strategy is never revealed to the learner during both training and validation stage.
Revised: However, the subset selection strategy is never revealed to the learner during both training and validation stage.

Original: Thus, the selection of hyperparameters becomes challenging and it completely depends on the underlying assumption about the adversary.
Revised: Thus, the selection of hyperparameters becomes challenging and it completely depends on the underlying assumption about the adversary.

Original: In such a situation, we experiment with two methods for hyperparameter selection.
Revised: In such a situation, we experiment with two methods for hyperparameter selection.

Original: (1) Default selection:
Revised: (1) Default selection:

Original: Here, we use the hyperparameters of the baselines directly used in their original papers and codes (details in Appendix G).
Revised: Here, we use the hyperparameters of the baselines directly used in their original papers and codes (details in Appendix G).

Original: (2) Worst case selection: The key goal of R OGET is to learn a model which minimizes the worst case loss across all data subsets.
Revised: (2) Worst case selection: The key goal of R OGET is to learn a model which minimizes the worst case loss across all data subsets.

Original: In a similar spirit, here we aim to select the hyperparameters which would maximize the minimum accuracy across a large number of subsets that underwent attacks.
Revised: In a similar spirit, here we aim to select the hyperparameters which would maximize the minimum accuracy across a large number of subsets that underwent attacks.

Original: Formally, if we denote A ( β , S ) to be the overall accuracy of the trained model on the subset S , with hyperparameters β , we aim to estimate β ∗ = argmax β min S A ( β , S ) .
Revised: Formally, if we denote A ( β , S ) to be the overall accuracy of the trained model on the subset S , with hyperparameters β , we aim to estimate β ∗ = argmax β min S A ( β , S ) .

Original: To this aim, we draw R = 10000 subsets { S j } Rj =1 uniformly at random from D Val having size | S j | = 0 .
Revised: To this aim, we draw R = 10000 subsets { S j } Rj =1 uniformly at random from D Val having size | S j | = 0 .

Original: | D Val | and search over the hyperparameters β that maximizes the minimum accuracy across these R subets.
Revised: | D Val | and search over the hyperparameters β that maximizes the minimum accuracy across these R subets.

Original: In our case as well, we tune ρ in similar manner to obtain ρ ∗ .
Revised: In our case as well, we tune ρ in similar manner to obtain ρ ∗ .

Original: Hence, the goal of this type of hyperparameter selection is same as the key goal of R OGET .
Revised: Hence, the goal of this type of hyperparameter selection is same as the key goal of R OGET .

Original: Thus, it will provide a fair comparison between all the methods.
Revised: Thus, it will provide a fair comparison between all the methods.

Original: 4. R ESULTS
Revised: 4. R ESULTS

Original: Uncertainty based subset selection with default hyperparameters.
Revised: Uncertainty based subset selection with default hyperparameters.

Original: Here we compare our method against all the state-of-the-art defense methods under the default hyperparameter selection on CIFAR10 and FMNIST, where all the hyperparameters of the baselines are set as what is reported in their respective work and for our method, we experiment with different values of ρ .
Revised: Here we compare our method against all the state-of-the-art defense methods under the default hyperparameter selection on CIFAR10 and FMNIST, where all the hyperparameters of the baselines are set as what is reported in their respective work and for our method, we experiment with different values of ρ .

Original: Moreover, the adversary adopts uncertainty based subset selection, where it selects top 10% of the test set based on the uncertainty of a classiﬁer trained on all clean examples.
Revised: Moreover, the adversary adopts uncertainty based subset selection, where it selects top 10% of the test set based on the uncertainty of a classiﬁer trained on all clean examples.

Original: We report the results in Table 1 and make the following observations.
Revised: We report the results in Table 1 and make the following observations.

Original: (1) R OGET ( a φ = PGD) and R OGET ( a φ = AdvGAN) achieve better overall accuracy A than the existing methods for all attacks on both the datasets (except for
Revised: (1) R OGET ( a φ = PGD) and R OGET ( a φ = AdvGAN) achieve better overall accuracy A than the existing methods for all attacks on both the datasets (except for

Original: Square attack on CIFAR10).
Revised: Square attack on CIFAR10).

Original: Among the two variants of R OGET , R OGET ( a φ = AdvGAN) is the predominant winner.
Revised: Among the two variants of R OGET , R OGET ( a φ = AdvGAN) is the predominant winner.

Original: (2) On CIFAR10, R OGET outperforms the baselines (except RFGSM-AT) in terms of the clean accuracy A clean .
Revised: (2) On CIFAR10, R OGET outperforms the baselines (except RFGSM-AT) in terms of the clean accuracy A clean .

Original: This is because, R OGET is trained to defend much better when the adversary plans to attack a subset of instances rather than every instance.
Revised: This is because, R OGET is trained to defend much better when the adversary plans to attack a subset of instances rather than every instance.

Original: In contrast, the baselines are often trained in a pessimistic manner— they assume attack on every possible instance and consequently show sub-optimal accuracy on the clean examples.
Revised: In contrast, the baselines are often trained in a pessimistic manner— they assume attack on every possible instance and consequently show sub-optimal accuracy on the clean examples.

Original: (3) There is no consistent winner among the baselines in terms of the robustness A robust .
Revised: (3) There is no consistent winner among the baselines in terms of the robustness A robust .

Original: Robust accuracy of R OGET is often
Revised: Robust accuracy of R OGET is often

Original: [Table]
Revised: [Table]

Original: [Table]
Revised: [Table]

Original: competitive, e.g. , in CIFAR10, R OGET ( a φ = AdvGAN) is the best performer for AdvGAN attack and R OGET ( a φ = PGD) is the second best performer for Square attack.
Revised: competitive, e.g. , in CIFAR10, R OGET ( a φ = AdvGAN) is the best performer for AdvGAN attack and R OGET ( a φ = PGD) is the second best performer for Square attack.

Original: In FMNIST, R OGET ( a φ = AdvGAN) is the second best performer for MIFGSM and AdvGAN attack.
Revised: In FMNIST, R OGET ( a φ = AdvGAN) is the second best performer for MIFGSM and AdvGAN attack.

Original: Uncertainty based subset selection with worst case hyperparameter setup.
Revised: Uncertainty based subset selection with worst case hyperparameter setup.

Original: Next, we tune the hyperparameters of all the methods using the worst case hyperparameter tuning, where we select the hyperparameters that would maximize the minimum accuracy across a large number of subsets of the validation set.
Revised: Next, we tune the hyperparameters of all the methods using the worst case hyperparameter tuning, where we select the hyperparameters that would maximize the minimum accuracy across a large number of subsets of the validation set.

Original: For R OGET , we tune ρ in the same manner to obtain ρ ∗ .
Revised: For R OGET , we tune ρ in the same manner to obtain ρ ∗ .

Original: We present the results in
Revised: We present the results in

Original: Table 2 for CIFAR100 and make the following observations.
Revised: Table 2 for CIFAR100 and make the following observations.

Original: (1) R OGET ( a φ = PGD, ρ = ρ ∗ ) and
Revised: (1) R OGET ( a φ = PGD, ρ = ρ ∗ ) and

Original: R OGET ( a φ = AdvGAN, ρ = ρ ∗ ) outperform all the baselines in terms of the overall accuracy A .
Revised: R OGET ( a φ = AdvGAN, ρ = ρ ∗ ) outperform all the baselines in terms of the overall accuracy A .

Original: In most of the cases, the overall accuracy A of R OGET with the worst case hyperparameter ρ
Revised: In most of the cases, the overall accuracy A of R OGET with the worst case hyperparameter ρ

Original: =
Revised: =

Original: ρ ∗ is better than A with the default hyperparameter ρ = 1 .
Revised: ρ ∗ is better than A with the default hyperparameter ρ = 1 .

Original: In contrast, the worst case hyperparameter selection improves A only for Nu-AT and TRADES among the baselines, from its performance with the default hyperparameter setup (Table 1 vs. Table 2).
Revised: In contrast, the worst case hyperparameter selection improves A only for Nu-AT and TRADES among the baselines, from its performance with the default hyperparameter setup (Table 1 vs. Table 2).

Original: Evaluation on label based subset selection strategy.
Revised: Evaluation on label based subset selection strategy.

Original: We now consider label based subset selection strategy of the adversary.
Revised: We now consider label based subset selection strategy of the adversary.

Original: We report the results for AA attack in Table 3, where we also consider class focused online learning (CFOL) (Anonymous, 2022) as an additional baseline which provides guarantee on worst class loss in presence of adversarial attack.
Revised: We report the results for AA attack in Table 3, where we also consider class focused online learning (CFOL) (Anonymous, 2022) as an additional baseline which provides guarantee on worst class loss in presence of adversarial attack.

Original: We observe that R OGET ( a φ =
Revised: We observe that R OGET ( a φ =

Original: AdvGAN) performs the best followed by R OGET ( a φ = PGD) for all classes.
Revised: AdvGAN) performs the best followed by R OGET ( a φ = PGD) for all classes.

Original: Additional results can be found in Appendix H.
Revised: Additional results can be found in Appendix H.

Original: Impact of revealing the true subset selection strategy during validation.
Revised: Impact of revealing the true subset selection strategy during validation.

Original: In practice, the learner does not know the adversary’s true (uncertainty based) subset selection strategy during training and validation.
Revised: In practice, the learner does not know the adversary’s true (uncertainty based) subset selection strategy during training and validation.

Original: Here, we leak this information to the learner during validation.
Revised: Here, we leak this information to the learner during validation.

Original: Then, we mimic the adversary’s true strategy to select the subsets from the validation set and perform attack on them.
Revised: Then, we mimic the adversary’s true strategy to select the subsets from the validation set and perform attack on them.

Original: [Table] [Table]
Revised: [Table] [Table]

Original: Next, we select the hyperparameters resulting in highest overall validation accuracy.
Revised: Next, we select the hyperparameters resulting in highest overall validation accuracy.

Original: Table 4 compares this strategy ("oracle") with previous hyperparameter selection strategies (default and worse).
Revised: Table 4 compares this strategy ("oracle") with previous hyperparameter selection strategies (default and worse).

Original: We make the following observations.
Revised: We make the following observations.

Original: (1) R OGET shows very stable performance across different hyperparameter selection methods.
Revised: (1) R OGET shows very stable performance across different hyperparameter selection methods.

Original: (2) GAT, TRADES, Nu-AT and MART signiﬁcantly improve the performance and Nu-AT outperforms R OGET by a small margin.
Revised: (2) GAT, TRADES, Nu-AT and MART signiﬁcantly improve the performance and Nu-AT outperforms R OGET by a small margin.

Original: (3) R OGET ’s focus is to maintain good accuracy across all subsets.
Revised: (3) R OGET ’s focus is to maintain good accuracy across all subsets.

Original: Hence, the performance of R OGET , in absence of any knowledge about the adversary’s selected subset, becomes very close to or even better than the baselines having full knowledge of oracle selection.
Revised: Hence, the performance of R OGET , in absence of any knowledge about the adversary’s selected subset, becomes very close to or even better than the baselines having full knowledge of oracle selection.

Original: [Figure]
Revised: [Figure]

Original: Variation of A vs | S latent | .
Revised: Variation of A vs | S latent | .

Original: The learner’s estimate about | S latent | , the number of instances chosen for perturbation, can indeed be heavily inaccurate.
Revised: The learner’s estimate about | S latent | , the number of instances chosen for perturbation, can indeed be heavily inaccurate.

Original: In this context, we train both the variants of
Revised: In this context, we train both the variants of

Original: R OGET using b = 0 .
Revised: R OGET using b = 0 .

Original: 1 | D Tr | and evaluate using different number of instances | S latent | perturbed during test.
Revised: 1 | D Tr | and evaluate using different number of instances | S latent | perturbed during test.

Original: In Figure 5, we observe that the performances of all the models deteriorate; and our model performs better than the baselines for | S latent | / | D test | ≤ 30% .
Revised: In Figure 5, we observe that the performances of all the models deteriorate; and our model performs better than the baselines for | S latent | / | D test | ≤ 30% .

Original: Comparing robustness subject to a minimum overall accuracy.
Revised: Comparing robustness subject to a minimum overall accuracy.

Original: In Tables 1- 3, we reported robust and overall accuracy for ﬁxed set of hyperparameters.
Revised: In Tables 1- 3, we reported robust and overall accuracy for ﬁxed set of hyperparameters.

Original: By tuning these hyperparameters, one can improve robust accuracy by sacriﬁcing overall accuracy.
Revised: By tuning these hyperparameters, one can improve robust accuracy by sacriﬁcing overall accuracy.

Original: Therefore, here we aim to compare the robust accuracy, subject to the condition that the overall accuracy for all methods crosses some threshold.
Revised: Therefore, here we aim to compare the robust accuracy, subject to the condition that the overall accuracy for all methods crosses some threshold.

Original: Speciﬁcally, we ﬁrst tune the hyperparameters of all the methods
Revised: Speciﬁcally, we ﬁrst tune the hyperparameters of all the methods

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: to ensure that the overall accuracy of all methods reaches a given threshold and then compare their robustness.
Revised: to ensure that the overall accuracy of all methods reaches a given threshold and then compare their robustness.

Original: If P indicates the hyperparameters, then we ﬁnd max P
Revised: If P indicates the hyperparameters, then we ﬁnd max P

Original: A robust ( P ) such that A ( P ) ≥ a for some given a .
Revised: A robust ( P ) such that A ( P ) ≥ a for some given a .

Original: Results on CIFAR10 for a = 0 .
Revised: Results on CIFAR10 for a = 0 .

Original: 81 are shown in Table 6.
Revised: 81 are shown in Table 6.

Original: We observe that R OGET (PGD) is the best performer in terms of robust accuracy and R OGET (AdvGAN) is the best performer in terms of overall accuracy.
Revised: We observe that R OGET (PGD) is the best performer in terms of robust accuracy and R OGET (AdvGAN) is the best performer in terms of overall accuracy.

Original: R OGET (AdvGAN) is the second-best performer in terms of robust accuracy.
Revised: R OGET (AdvGAN) is the second-best performer in terms of robust accuracy.

Original: More related results are in Appendix H.
Revised: More related results are in Appendix H.

Original:  C ONCLUSION
Revised:  C ONCLUSION

Original: In this paper we motivated a novel setting in adversarial attacks—where an attacker aims to perturb only a subset of the dataset instead of the entire dataset.
Revised: In this paper we motivated a novel setting in adversarial attacks—where an attacker aims to perturb only a subset of the dataset instead of the entire dataset.

Original: We presented a defense strategy, R OGET which trains a robust model as a min-max game involving worst-case subset selection along with optimization of model parameters.
Revised: We presented a defense strategy, R OGET which trains a robust model as a min-max game involving worst-case subset selection along with optimization of model parameters.

Original: To solve the optimization problem we designed a framework of efﬁcient algorithms, which admits approximation guarantees for convex and Polyak-Lojasiewicz loss functions.
Revised: To solve the optimization problem we designed a framework of efﬁcient algorithms, which admits approximation guarantees for convex and Polyak-Lojasiewicz loss functions.

Original: Finally, our experiments showed that R OGET achieves better overall accuracy as compared to several state-of-the-art defense methods across several subset selection strategies.
Revised: Finally, our experiments showed that R OGET achieves better overall accuracy as compared to several state-of-the-art defense methods across several subset selection strategies.

Original: Our work opens several avenues of future research.
Revised: Our work opens several avenues of future research.

Original: We can extend our work to a slightly different setting where each instance has some importance score assigned to it.
Revised: We can extend our work to a slightly different setting where each instance has some importance score assigned to it.

Original: Another extension is to design a differentiable method for computing the worst-case attacked set, instead of using a greedy selection algorithm.
Revised: Another extension is to design a differentiable method for computing the worst-case attacked set, instead of using a greedy selection algorithm.

Original:  E THICS STATEMENT
Revised:  E THICS STATEMENT

Original: Our work tries to help ML models in achieving a better trade-off between robustness against adversarial attacks and performance on unperturbed/clean instances.
Revised: Our work tries to help ML models in achieving a better trade-off between robustness against adversarial attacks and performance on unperturbed/clean instances.

Original: Due to the vulnerability of ML models against adversarial perturbations, they have not been widely used in high-stake real world scenarios.
Revised: Due to the vulnerability of ML models against adversarial perturbations, they have not been widely used in high-stake real world scenarios.

Original: Furthermore, the defense methods proposed so far to achieve robustness against attacks, face a considerable drop in accuracy on clean (unperturbed) instances.
Revised: Furthermore, the defense methods proposed so far to achieve robustness against attacks, face a considerable drop in accuracy on clean (unperturbed) instances.

Original: Here, our framework takes a step towards improving the performance on clean instances, while being robust against attacks on any subset of the dataset.
Revised: Here, our framework takes a step towards improving the performance on clean instances, while being robust against attacks on any subset of the dataset.

Original: On the ﬂip side our method discusses a different type of adversarial attack, where the attacks are made on a subset of instances.
Revised: On the ﬂip side our method discusses a different type of adversarial attack, where the attacks are made on a subset of instances.

Original: If one uses such attacks in practice, the attacked ML systems can become vulnerable.
Revised: If one uses such attacks in practice, the attacked ML systems can become vulnerable.

Original: However, these systems can use the defense method proposed in this paper, which can provide notable defense irrespective of the subset selection strategy of the adversary.
Revised: However, these systems can use the defense method proposed in this paper, which can provide notable defense irrespective of the subset selection strategy of the adversary.

Original: The capability of our method to achieve good performance without being aware of adversary’s strategy makes it suitable to be applied in a wide range of applications.
Revised: The capability of our method to achieve good performance without being aware of adversary’s strategy makes it suitable to be applied in a wide range of applications.

Original:  R EPRODUCIBILITY STATEMENT
Revised:  R EPRODUCIBILITY STATEMENT

Original: We have provided our code in supplementary material and provide the implementation details in
Revised: We have provided our code in supplementary material and provide the implementation details in

Original: Appendix G.
Revised: Appendix G.

Original: B R ELATED W ORK
Revised: B R ELATED W ORK

Original: Adversarial attacks.
Revised: Adversarial attacks.

Original: The attack methods (Szegedy et al., 2014; Kurakin et al., 2018; Madry et al., 2017; Goodfellow et al., 2015; Kurakin et al., 2017; Carlini & Wagner, 2017) discussed in the main paper can be broadly classiﬁed in three different settings i) white-box attacks, ii) black-box attacks, and iii) transfer-based attacks.
Revised: The attack methods (Szegedy et al., 2014; Kurakin et al., 2018; Madry et al., 2017; Goodfellow et al., 2015; Kurakin et al., 2017; Carlini & Wagner, 2017) discussed in the main paper can be broadly classiﬁed in three different settings i) white-box attacks, ii) black-box attacks, and iii) transfer-based attacks.

Original: In white-box attacks, the attacker assumes full knowledge about the defense model, and hence can access the gradients of the defense model.
Revised: In white-box attacks, the attacker assumes full knowledge about the defense model, and hence can access the gradients of the defense model.

Original: This led to the design of several gradient-based attacks (Szegedy et al., 2014; Madry et al., 2017; Goodfellow et al., 2015).
Revised: This led to the design of several gradient-based attacks (Szegedy et al., 2014; Madry et al., 2017; Goodfellow et al., 2015).

Original: Speciﬁcally, Szegedy et al.
Revised: Speciﬁcally, Szegedy et al.

Original: (2014) use constrained optimization, Carlini & Wagner (2017) use special regularization in the optimization.
Revised: (2014) use constrained optimization, Carlini & Wagner (2017) use special regularization in the optimization.

Original: However, in black-box setting the attacker can only query the defense model being attacked (Ilyas et al., 2018).
Revised: However, in black-box setting the attacker can only query the defense model being attacked (Ilyas et al., 2018).

Original: This led to the design of score-based attacks (Chen et al., 2017) which use the scores output by the defense model to approximate gradients, and craft adversarial perturbations.
Revised: This led to the design of score-based attacks (Chen et al., 2017) which use the scores output by the defense model to approximate gradients, and craft adversarial perturbations.

Original: Additionally, to tackle this setting, researchers came up with transfer-based attacks (Papernot et al., 2017; 2016; Liu et al., 2017) where the attacker computes adversarial examples on a completely different model, in order to attack the defense model.
Revised: Additionally, to tackle this setting, researchers came up with transfer-based attacks (Papernot et al., 2017; 2016; Liu et al., 2017) where the attacker computes adversarial examples on a completely different model, in order to attack the defense model.

Original: Defense methods.
Revised: Defense methods.

Original: Apart from Adversarial training methods (Wang et al., 2019; Zhang et al., 2019b;
Revised: Apart from Adversarial training methods (Wang et al., 2019; Zhang et al., 2019b;

Original: Robey et al., 2021; Shafahi et al., 2019; Zhang et al., 2019a;
Revised: Robey et al., 2021; Shafahi et al., 2019; Zhang et al., 2019a;

Original: Kim et al., 2021; Andriushchenko & Flammarion, 2020) already discussed in the main paper, there are several other approaches to designing robust defense models.
Revised: Kim et al., 2021; Andriushchenko & Flammarion, 2020) already discussed in the main paper, there are several other approaches to designing robust defense models.

Original: One of them leverages randomness to defend against adversarial examples (Xie et al., 2018;
Revised: One of them leverages randomness to defend against adversarial examples (Xie et al., 2018;

Original: Cohen et al., 2019; Liu et al., 2018).
Revised: Cohen et al., 2019; Liu et al., 2018).

Original: These works introduce randomness either in the inputs or in the model parameters which makes the model robust against crafted-instances.
Revised: These works introduce randomness either in the inputs or in the model parameters which makes the model robust against crafted-instances.

Original: Yet another line of work (Ilyas et al., 2017; Meng & Chen, 2017; Samangouei et al., 2018) tries to use generative models to ﬁrst project the input using an encoder, and then use the output of the encoder for classiﬁcation.
Revised: Yet another line of work (Ilyas et al., 2017; Meng & Chen, 2017; Samangouei et al., 2018) tries to use generative models to ﬁrst project the input using an encoder, and then use the output of the encoder for classiﬁcation.

Original: The projection step is claimed to reduce the impact of adversarial perturbations.
Revised: The projection step is claimed to reduce the impact of adversarial perturbations.

Original: Another popular approach (Gong et al., 2017; Metzen et al., 2017; Li & Li, 2017; Zheng & Hong, 2018) is to detect the presence of adversarial perturbations, before attempting to classify the input.
Revised: Another popular approach (Gong et al., 2017; Metzen et al., 2017; Li & Li, 2017; Zheng & Hong, 2018) is to detect the presence of adversarial perturbations, before attempting to classify the input.

Original: The idea is motivated by the assumption that adversarial perturbed instances follow a different distribution as compared to natural (unperturbed) instances.
Revised: The idea is motivated by the assumption that adversarial perturbed instances follow a different distribution as compared to natural (unperturbed) instances.

Original: Recent works have considered assigning different weights to different classes based on the underlying loss to ensure robustness against adversarial perturbation (Anonymous, 2022; Tian et al., 2021;
Revised: Recent works have considered assigning different weights to different classes based on the underlying loss to ensure robustness against adversarial perturbation (Anonymous, 2022; Tian et al., 2021;

Original: Wang et al., 2021; Leavitt & Morcos, 2020).
Revised: Wang et al., 2021; Leavitt & Morcos, 2020).

Original: Tian et al.
Revised: Tian et al.

Original: (2021) pointed out that accuracy across different classes signiﬁcantly vary during adversarial training.
Revised: (2021) pointed out that accuracy across different classes signiﬁcantly vary during adversarial training.

Original: Leavitt & Morcos (2020) showed that increasing class selectivity improves worst case perturbation while decreasing class selectivity improves average case perturbation.
Revised: Leavitt & Morcos (2020) showed that increasing class selectivity improves worst case perturbation while decreasing class selectivity improves average case perturbation.

Original: Wang et al.
Revised: Wang et al.

Original: (2021) proposed Separable Reweighted Adversarial Training (SRAT) assign weights to different instances to learn separable features for imbalanced dataset.
Revised: (2021) proposed Separable Reweighted Adversarial Training (SRAT) assign weights to different instances to learn separable features for imbalanced dataset.

Original: Recent work (Anonymous, 2022) develop adversarial training approaches that attempt to control the worst possible loss across different classes.
Revised: Recent work (Anonymous, 2022) develop adversarial training approaches that attempt to control the worst possible loss across different classes.

Original: Data subset selection.
Revised: Data subset selection.

Original: There is a rich literature of work proposed for data subset selection in conjunction with model training (Campbell & Broderick, 2018;
Revised: There is a rich literature of work proposed for data subset selection in conjunction with model training (Campbell & Broderick, 2018;

Original: Lucic et al., 2017; Durga et al., 2021;
Revised: Lucic et al., 2017; Durga et al., 2021;

Original: Killamsetty et al., 2021; De et al., 2020; 2021).
Revised: Killamsetty et al., 2021; De et al., 2020; 2021).

Original: As mentioned in the main paper, these existing works focus more towards efﬁcient learning (Durga et al., 2021; Mirzasoleiman et al., 2020),
Revised: As mentioned in the main paper, these existing works focus more towards efﬁcient learning (Durga et al., 2021; Mirzasoleiman et al., 2020),

Original: human-centric learning (De et al., 2020; 2021) and active learning (Wei et al., 2015; Kaushal et al., 2019).
Revised: human-centric learning (De et al., 2020; 2021) and active learning (Wei et al., 2015; Kaushal et al., 2019).

Original: As a results these works operate in a completely different setting, and consequently require different solution techniques.
Revised: As a results these works operate in a completely different setting, and consequently require different solution techniques.

Original: For example, De et al.
Revised: For example, De et al.

Original: (2020) employ data subset selection in order to distribute instances between human and machine to generate semi-automated ML models.
Revised: (2020) employ data subset selection in order to distribute instances between human and machine to generate semi-automated ML models.

Original: Also, the works in (Durga et al., 2021; Mirzasoleiman et al., 2020) uses subset selection to reduce training time of
Revised: Also, the works in (Durga et al., 2021; Mirzasoleiman et al., 2020) uses subset selection to reduce training time of

Original: ML models by reducing the size of the effective training dataset.
Revised: ML models by reducing the size of the effective training dataset.

Original: C I LLUSTRATION OF OUR ADVERSARIAL TRAINING SETUP AND THE HARDNESS ANALYSIS
Revised: C I LLUSTRATION OF OUR ADVERSARIAL TRAINING SETUP AND THE HARDNESS ANALYSIS

Original: Probabilistic generation of S .
Revised: Probabilistic generation of S .

Original: Let us assume that the adversary follows a probabilistic strategy, i.e. , π ( x i , y i )
Revised: Let us assume that the adversary follows a probabilistic strategy, i.e. , π ( x i , y i )

Original: =
Revised: =

Original: P ( i ∈ S ) .
Revised: P ( i ∈ S ) .

Original: Thus π ( x i , y i ) indicates the probability that the instance x i is chosen for attack.
Revised: Thus π ( x i , y i ) indicates the probability that the instance x i is chosen for attack.

Original: Here, one may wish to minimize the following loss:
Revised: Here, one may wish to minimize the following loss:

Original: [Equation]
Revised: [Equation]

Original: such that, (cid:88) i ∈
Revised: such that, (cid:88) i ∈

Original: [Equation]
Revised: [Equation]

Original: π ( x i , y i
Revised: π ( x i , y i

Original: [Equation]
Revised: [Equation]

Original: ≤ b, π ( x i , y
Revised: ≤ b, π ( x i , y

Original: [Equation]
Revised: [Equation]

Original: ∈ [0 , 1]
Revised: ∈ [0 , 1]

Original: [Equation]
Revised: [Equation]

Original: The inner optimization problem is a linear optimization problem in each π ( x i , y i ) , so π ( x i , y i ) ∈ { 0 , 1 } .
Revised: The inner optimization problem is a linear optimization problem in each π ( x i , y i ) , so π ( x i , y i ) ∈ { 0 , 1 } .

Original: Then, if we deﬁne S = { i | π ( x i , y i
Revised: Then, if we deﬁne S = { i | π ( x i , y i

Original: [Equation]
Revised: [Equation]

Original: = 1 } ,
Revised: = 1 } ,

Original: [Equation]
Revised: [Equation]

Original: Hardness analysis.
Revised: Hardness analysis.

Original: Let us consider a speciﬁc instance of the problem where y ∈ { 0 , +1 , − 1 } and h θ is a ﬁxed function independent of θ given as
Revised: Let us consider a speciﬁc instance of the problem where y ∈ { 0 , +1 , − 1 } and h θ is a ﬁxed function independent of θ given as

Original: [Equation]
Revised: [Equation]

Original: where, Λ << 1 , θ 0 is a constant vector, x is bounded such that 1 − (cid:80)
Revised: where, Λ << 1 , θ 0 is a constant vector, x is bounded such that 1 − (cid:80)

Original: y ∈{−
Revised: y ∈{−

Original: [Equation]
Revised: [Equation]

Original: +
Revised: +

Original: [Equation]
Revised: [Equation]

Original: Λ
Revised: Λ

Original: [Equation]
Revised: [Equation]

Original: > 0 .
Revised: > 0 .

Original: Similar (not exact) distributions were also used for instantiating anecdotal examples in (Zhang et al., 2021a).
Revised: Similar (not exact) distributions were also used for instantiating anecdotal examples in (Zhang et al., 2021a).

Original: Let us further assume that the training set D consists of only instances with y ∈ { +1 , − 1 } and no instance with y = 0 .
Revised: Let us further assume that the training set D consists of only instances with y ∈ { +1 , − 1 } and no instance with y = 0 .

Original: Additionally, let a φ ( x ) =
Revised: Additionally, let a φ ( x ) =

Original: φ (cid:12) x , where (cid:12) denotes element-wise multiplication operation.
Revised: φ (cid:12) x , where (cid:12) denotes element-wise multiplication operation.

Original: Here, φ is restricted to a set, such that 1 − (cid:80) y ∈{− 1 , +1 } Λ e (1 − y · θ T 0 a φ ( x )) 2 > 0 .
Revised: Here, φ is restricted to a set, such that 1 − (cid:80) y ∈{− 1 , +1 } Λ e (1 − y · θ T 0 a φ ( x )) 2 > 0 .

Original: Also, consider that ρ = 0 and C = 0 in this speciﬁc setting.
Revised: Also, consider that ρ = 0 and C = 0 in this speciﬁc setting.

Original: Since h θ is independent of θ , the optimization problem (2) in this setting reduces to
Revised: Since h θ is independent of θ , the optimization problem (2) in this setting reduces to

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: [Equation]
Revised: [Equation]

Original: Thus, the solution of above optimization (17) is equal to the following optimization problem:
Revised: Thus, the solution of above optimization (17) is equal to the following optimization problem:

Original: [Equation]
Revised: [Equation]

Original: which is equivalent to the following optimization problem:
Revised: which is equivalent to the following optimization problem:

Original: [Equation]
Revised: [Equation]

Original: The next steps follow directly from ((De et al., 2021), Proof of Theorem 1).
Revised: The next steps follow directly from ((De et al., 2021), Proof of Theorem 1).

Original: We describe the steps below to make the proof self-contained.
Revised: We describe the steps below to make the proof self-contained.

Original: Assume that X
Revised: Assume that X

Original: =
Revised: =

Original: [( θ 0 (cid:12) x 1 ) T ; . .
Revised: [( θ 0 (cid:12) x 1 ) T ; . .

Original: ; ( θ 0 (cid:12) x | D | ) T ] has full row rank | D | .
Revised: ; ( θ 0 (cid:12) x | D | ) T ] has full row rank | D | .

Original: Now, let y =
Revised: Now, let y =

Original: [ y 1 , . . .
Revised: [ y 1 , . . .

Original: , y i , . .
Revised: , y i , . .

Original: , y | D | ] , r ∈ R | D | be an arbitrary vector of real numbers and X − 1 R be the right inverse of X (exists because X has full row rank).
Revised: , y | D | ] , r ∈ R | D | be an arbitrary vector of real numbers and X − 1 R be the right inverse of X (exists because X has full row rank).

Original: By deﬁnition, ( X − 1 R ) T ( θ 0 (cid:12) x i ) =
Revised: By deﬁnition, ( X − 1 R ) T ( θ 0 (cid:12) x i ) =

Original: e Ti , where e i is a column vector with entry 1 at position i , and 0 elsewhere.
Revised: e Ti , where e i is a column vector with entry 1 at position i , and 0 elsewhere.

Original: Further, let φ (cid:48)
Revised: Further, let φ (cid:48)

Original: =
Revised: =

Original: φ − X − 1 R ( y − r ) .
Revised: φ − X − 1 R ( y − r ) .

Original: We rewrite the objective of the optimization (19) in terms of φ (cid:48) to obtain (cid:88)
Revised: We rewrite the objective of the optimization (19) in terms of φ (cid:48) to obtain (cid:88)

Original: [Equation]
Revised: [Equation]

Original: Hence, our optimization problem reduces to the following optimization problem:
Revised: Hence, our optimization problem reduces to the following optimization problem:

Original: [Equation]
Revised: [Equation]

Original: Since the above optimization (24) is known to be NP-hard (Bhatia et al., 2017), we have successfully proven that our optimization problem 2 is also NP-hard.
Revised: Since the above optimization (24) is known to be NP-hard (Bhatia et al., 2017), we have successfully proven that our optimization problem 2 is also NP-hard.

Original: D E XPLANATION OF THE A SSUMPTIONS
Revised: D E XPLANATION OF THE A SSUMPTIONS

Original: In this section, we justify the assumptions mentioned in Sections 3.1 and 3.2.
Revised: In this section, we justify the assumptions mentioned in Sections 3.1 and 3.2.

Original: A SSUMPTIONS
Revised: A SSUMPTIONS

Original: (1, 5) Lipschitz continuity and boundedness of the parameters:
Revised: (1, 5) Lipschitz continuity and boundedness of the parameters:

Original: We think that Lipschitz continuity of loss and models are very prevalent.
Revised: We think that Lipschitz continuity of loss and models are very prevalent.

Original: In most practical and well behaved ML algorithms, these assumptions hold.
Revised: In most practical and well behaved ML algorithms, these assumptions hold.

Original: For any differentiable networks that have bounded parameters and no singularity, we
Revised: For any differentiable networks that have bounded parameters and no singularity, we

Original: usually
Revised: usually

Original: have these conditions.
Revised: have these conditions.

Original: If we do not have such conditions, gradients may blow up during training.
Revised: If we do not have such conditions, gradients may blow up during training.

Original: (2) Stability: Algorithmic stability is also a desirable property in ML.
Revised: (2) Stability: Algorithmic stability is also a desirable property in ML.

Original: It ensures that if we make changes in one instance, the parameters do not change.
Revised: It ensures that if we make changes in one instance, the parameters do not change.

Original: L2 Regularization, drop-out and even SGD algorithm itself encourages stability.
Revised: L2 Regularization, drop-out and even SGD algorithm itself encourages stability.

Original: (3, 4) Metric
Revised: (3, 4) Metric

Original: property
Revised: property

Original: and norm boundedness of cost of
Revised: and norm boundedness of cost of

Original: perturbation
Revised: perturbation

Original: Most existing works have used L ∞ distance as
Revised: Most existing works have used L ∞ distance as

Original: the
Revised: the

Original: cost of perturbation
Revised: cost of perturbation

Original: Our method considers a general set of metrics which is not limited to L • distances.
Revised: Our method considers a general set of metrics which is not limited to L • distances.

Original: L • space norms are bounded by each other by a factor, i.e., k 1 L c <
Revised: L • space norms are bounded by each other by a factor, i.e., k 1 L c <

Original: L a < k 2 L b .
Revised: L a < k 2 L b .

Original: We bounded our metric norm by the L2 norm for standardization of analysis.
Revised: We bounded our metric norm by the L2 norm for standardization of analysis.

Original: We do not foresee the deviation of such a condition in a practical scenario.
Revised: We do not foresee the deviation of such a condition in a practical scenario.

Original: A SSUMPTIONS
Revised: A SSUMPTIONS

Original: (1) L-smoothness of F: This just ensures that gradients of F are Lipschitz too.
Revised: (1) L-smoothness of F: This just ensures that gradients of F are Lipschitz too.

Original: Indeed this is a bit stronger condition than Lipschitzness of F itself.
Revised: Indeed this is a bit stronger condition than Lipschitzness of F itself.

Original: A wide variety of smooth activation functions like Linear, Sigmoid are L-smooth.
Revised: A wide variety of smooth activation functions like Linear, Sigmoid are L-smooth.

Original: Even the discontinuous functions like ReLU are often L-smooth almost everywhere.
Revised: Even the discontinuous functions like ReLU are often L-smooth almost everywhere.

Original: (2,3) Boundedness of F, h and (cid:96) :
Revised: (2,3) Boundedness of F, h and (cid:96) :

Original: As long as there is no inherent singularity in the interior of these functions (e.g., unlike 1/(x-a)), this is a redundant condition, given the boundedness of θ .
Revised: As long as there is no inherent singularity in the interior of these functions (e.g., unlike 1/(x-a)), this is a redundant condition, given the boundedness of θ .

Original: We simply keep it to make our notations simple during analysis.
Revised: We simply keep it to make our notations simple during analysis.

Original: But this condition does not put any additional restriction, if the underlying function does not have a singularity in the interior.
Revised: But this condition does not put any additional restriction, if the underlying function does not have a singularity in the interior.

Original: (4) Size of B: This is a parameter used in
Revised: (4) Size of B: This is a parameter used in

Original: our algorithm— it does not put any restriction of the underlying setup, neither the loss function nor the models.
Revised: our algorithm— it does not put any restriction of the underlying setup, neither the loss function nor the models.

Original: (5) Adversarial network always perturbs a feature: This imposes the notion of a very strong adversary.
Revised: (5) Adversarial network always perturbs a feature: This imposes the notion of a very strong adversary.

Original: Even if we deviate, the theoretical bounds would be stronger.
Revised: Even if we deviate, the theoretical bounds would be stronger.

Original: We keep this condition for the sake of brevity.
Revised: We keep this condition for the sake of brevity.

Original: E P ROOFS OF THE TECHNICAL RESULTS IN S ECTIONE. M ONOTONICITY AND γ - WEAK SUBMODULARITY OF G λ : T HEOREM
Revised: E P ROOFS OF THE TECHNICAL RESULTS IN S ECTIONE. M ONOTONICITY AND γ - WEAK SUBMODULARITY OF G λ : T HEOREM

Original: Theorem 2.
Revised: Theorem 2.

Original: Given Assumption 1 let there be a value of minimum non-zero constant λ min > 0 such that (cid:96) ∗ = min x ∈X ,y ∈Y min θ [ λ min R ( θ ) + (cid:96) ( h θ ( x ) , y ) − 2 qµβL φ ] > 0 where q and β are given in
Revised: Given Assumption 1 let there be a value of minimum non-zero constant λ min > 0 such that (cid:96) ∗ = min x ∈X ,y ∈Y min θ [ λ min R ( θ ) + (cid:96) ( h θ ( x ) , y ) − 2 qµβL φ ] > 0 where q and β are given in

Original: Assumption 1.
Revised: Assumption 1.

Original: Then, for λ > λ min , we have the following statements:
Revised: Then, for λ > λ min , we have the following statements:

Original: (1) G λ ( S ) is monotone in S (2)
Revised: (1) G λ ( S ) is monotone in S (2)

Original: G λ ( S )
Revised: G λ ( S )

Original: γ -weakly submodular with γ > γ ∗ =
Revised: γ -weakly submodular with γ > γ ∗ =

Original: (cid:96) ∗ [ (cid:96) ∗ + 2 L
Revised: (cid:96) ∗ [ (cid:96) ∗ + 2 L

Original: h L x L φ φ max + 3 qµβL φ ] − 1 .
Revised: h L x L φ φ max + 3 qµβL φ ] − 1 .

Original: Proof sketch.
Revised: Proof sketch.

Original: To prove monotonicity, we ﬁrst show that G λ ( k | S ) > (cid:96) ( h θ ( a φ ∗ ( θ ,S ) ( x k )) , y k )
Revised: To prove monotonicity, we ﬁrst show that G λ ( k | S ) > (cid:96) ( h θ ( a φ ∗ ( θ ,S ) ( x k )) , y k )

Original: + (cid:80) i ∈ S
Revised: + (cid:80) i ∈ S

Original: [ ρ C ( a φ ∗ ( θ ,S ∪ k ) ( x i ) , x i ) − ρ C ( a φ ∗ ( θ ,S ) ( x i ) , x i )]
Revised: [ ρ C ( a φ ∗ ( θ ,S ∪ k ) ( x i ) , x i ) − ρ C ( a φ ∗ ( θ ,S ) ( x i ) , x i )]

Original: + λR ( θ ) which is more than λR ( θ ) + (cid:96) ( h θ ( a φ ∗ ( θ ,S ) ( x k )) , y k ) − βρ | S ||| φ ∗ ( θ , S ∪ k ) − φ ∗ ( θ , S ) || .
Revised: + λR ( θ ) which is more than λR ( θ ) + (cid:96) ( h θ ( a φ ∗ ( θ ,S ) ( x k )) , y k ) − βρ | S ||| φ ∗ ( θ , S ∪ k ) − φ ∗ ( θ , S ) || .

Original: Next, we use Assumptions 1 to show that this quantity is more than (cid:96) ∗ .
Revised: Next, we use Assumptions 1 to show that this quantity is more than (cid:96) ∗ .

Original: To prove γ -weak submodularity, we ﬁrst show that G λ ( k | T ) ≤ (cid:96) ∗ + 2 φ max + 3 qµβL φ .
Revised: To prove γ -weak submodularity, we ﬁrst show that G λ ( k | T ) ≤ (cid:96) ∗ + 2 φ max + 3 qµβL φ .

Original: To that aim, we show that G λ ( k | T ) ≤ λR ( θ ) + (cid:96) ( h θ ( a φ ∗ ( θ ,T ∪ k ) ( x k )) , y k )
Revised: To that aim, we show that G λ ( k | T ) ≤ λR ( θ ) + (cid:96) ( h θ ( a φ ∗ ( θ ,T ∪ k ) ( x k )) , y k )

Original: + qµβ ≤ λR ( θ ) + (cid:96) ( h θ ( a φ ∗ ( θ ,S ) ( x k )) , y k )
Revised: + qµβ ≤ λR ( θ ) + (cid:96) ( h θ ( a φ ∗ ( θ ,S ) ( x k )) , y k )

Original: + | (cid:96) ( h θ ( a φ ∗ ( θ ,T ∪ k ) ( x k )) , y k ) − (cid:96) ( h θ ( a φ ∗ ( θ ,S ) ( x k )) , y k ) | + qµβ .
Revised: + | (cid:96) ( h θ ( a φ ∗ ( θ ,T ∪ k ) ( x k )) , y k ) − (cid:96) ( h θ ( a φ ∗ ( θ ,S ) ( x k )) , y k ) | + qµβ .

Original: Next we use the Lipschitzness of different functions to show that it is less than (cid:96) ∗ +

Revised: Next we use the Lipschitzness of different functions to show that it is less than (cid:96) ∗ +

Original: L h
Revised: L h

Original: L x L φ φ max
Revised: L x L φ φ max

Original: +3 qµβL φ .
Revised: +3 qµβL φ .

Original: This, together with the fact that G λ ( k | S ) > (cid:96) ∗ derived during the proof of monotonicity, results in the inequality G λ ( k | S ) /G
Revised: This, together with the fact that G λ ( k | S ) > (cid:96) ∗ derived during the proof of monotonicity, results in the inequality G λ ( k | S ) /G

Original: λ ( k | T ) ≥ (cid:96) ∗ [ (cid:96) ∗ + 2 L
Revised: λ ( k | T ) ≥ (cid:96) ∗ [ (cid:96) ∗ + 2 L

Original: h
Revised: h

Original: L x L φ φ max + 3 qµβL φ ] − 1 .
Revised: L x L φ φ max + 3 qµβL φ ] − 1 .

Original: Finally, we use the result of Proposition 6 (in Appendix F) to complete the proof.
Revised: Finally, we use the result of Proposition 6 (in Appendix F) to complete the proof.

Original: Proof.
Revised: Proof.

Original: Monotonicity of G λ .
Revised: Monotonicity of G λ .

Original: Let S ⊂ D and let k ∈ D \ S .
Revised: Let S ⊂ D and let k ∈ D \ S .

Original: For any θ ∈ Θ ,
Revised: For any θ ∈ Θ ,

Original: G λ ( θ , S ∪ k ) − G λ ( θ , S ) =
Revised: G λ ( θ , S ∪ k ) − G λ ( θ , S ) =

Original: [Equation]
Revised: [Equation]

Original: D
Revised: D

Original: [Equation]
Revised: [Equation]

Original: λR
Revised: λR

Original: [Equation]
Revised: [Equation]

Original: λR
Revised: λR

Original: [Equation]
Revised: [Equation]

Original: (cid:21) =|
Revised: (cid:21) =|

Original: D |
Revised: D |

Original: [Equation]
Revised: [Equation]

Original: i
Revised: i

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: ( a
Revised: ( a

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: k ) ( x
Revised: k ) ( x

Original: [Equation]
Revised: [Equation]

Original: )) , y i )
Revised: )) , y i )

Original: [Equation]
Revised: [Equation]

Original: (cid:88) i ∈ S (cid:96) ( h θ ( a φ ∗ ( θ ,S ) (
Revised: (cid:88) i ∈ S (cid:96) ( h θ ( a φ ∗ ( θ ,S ) (

Original: [Equation]
Revised: [Equation]

Original: We now derive a bound on (cid:80) i ∈ S ∪ k (cid:96) ( h θ ( a φ ∗ ( θ ,S
Revised: We now derive a bound on (cid:80) i ∈ S ∪ k (cid:96) ( h θ ( a φ ∗ ( θ ,S

Original: [Equation]
Revised: [Equation]

Original: k ) ( x i )) , y i ) − (cid:80) i ∈ S (cid:96) ( h θ ( a φ ∗ ( θ ,S ) ( x i )) , y i ) .
Revised: k ) ( x i )) , y i ) − (cid:80) i ∈ S (cid:96) ( h θ ( a φ ∗ ( θ ,S ) ( x i )) , y i ) .

Original: Us-
Revised: Us-

Original: ing the deﬁnition of a φ ∗ ( S ∪ k ) from Eq.
Revised: ing the deﬁnition of a φ ∗ ( S ∪ k ) from Eq.

Original: (3), we obtain:
Revised: (3), we obtain:

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: Substituting inequality (27) in Eq.
Revised: Substituting inequality (27) in Eq.

Original: (25), we obtain:
Revised: (25), we obtain:

Original: [Equation]
Revised: [Equation]

Original: [Equation]
Revised: [Equation]

Original: Here, inequality (31) follows from using triangle inequality of Assumption 1 and inequality (32) follows from the stability assumption in Assumption 1.
Revised: Here, inequality (31) follows from using triangle inequality of Assumption 1 and inequality (32) follows from the stability assumption in Assumption 1.

Original: We use the assumption on (cid:96) ∗ to conclude that the right hand side of inequality (33) is non-negative.
Revised: We use the assumption on (cid:96) ∗ to conclude that the right hand side of inequality (33) is non-negative.

Original: This shows that G λ is monotone in S .
Revised: This shows that G λ is monotone in S .

Original: [Table]
Revised: [Table]

Original: We ﬁrst provide an upper
Revised: We ﬁrst provide an upper

Original: G λ
Revised: G λ

Original: [Equation]
Revised: [Equation]

Original: θ ,
Revised: θ ,

Original: [Equation]
Revised: [Equation]

Original: Here
Revised: Here

Original: [Equation]
Revised: [Equation]

Original: the last inequality is due to the fact that:
Revised: the last inequality is due to the fact that:

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: since φ ∗ ( θ , T ) provides the maximum of the second term and the fact that: µ (cid:88)
Revised: since φ ∗ ( θ , T ) provides the maximum of the second term and the fact that: µ (cid:88)

Original: i
Revised: i

Original: [Equation]
Revised: [Equation]

Original: Lower bounding the ratio.
Revised: Lower bounding the ratio.

Original: Using inequality (33) and inequality (36), we get the following
Revised: Using inequality (33) and inequality (36), we get the following

Original: G
Revised: G

Original: [Equation]
Revised: [Equation]

Original: λR
Revised: λR

Original: [Equation]
Revised: [Equation]

Original: ≥ λR
Revised: ≥ λR

Original: [Equation]
Revised: [Equation]

Original: λR (
Revised: λR (

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: (cid:96) (
Revised: (cid:96) (

Original: [Equation]
Revised: [Equation]

Original: ( a φ
Revised: ( a φ

Original: [Equation]
Revised: [Equation]

Original: ( θ ,S ) (
Revised: ( θ ,S ) (

Original: [Equation]
Revised: [Equation]

Original: k )
Revised: k )

Original: [Equation]
Revised: [Equation]

Original: y
Revised: y

Original: [Equation]
Revised: [Equation]

Original: ) + (cid:96) ( h
Revised: ) + (cid:96) ( h

Original: [Equation]
Revised: [Equation]

Original: ( a φ ∗ ( θ
Revised: ( a φ ∗ ( θ

Original: [Equation]
Revised: [Equation]

Original: T
Revised: T

Original: [Equation]
Revised: [Equation]

Original: k ) ( x k ))
Revised: k ) ( x k ))

Original: [Equation]
Revised: [Equation]

Original: y k )
Revised: y k )

Original: [Equation]
Revised: [Equation]

Original: (cid:96) ( h θ ( a φ ∗ ( θ ,S ) ( x k )) , y k )
Revised: (cid:96) ( h θ ( a φ ∗ ( θ ,S ) ( x k )) , y k )

Original: + qµβL φ ≥ (cid:96) ∗ (cid:96) ∗ + 2 L h L x
Revised: + qµβL φ ≥ (cid:96) ∗ (cid:96) ∗ + 2 L h L x

Original: [Equation]
Revised: [Equation]

Original: [Equation]
Revised: [Equation]

Original: Above inequality (41) follows from Lipschitz continuity assumption, and upper boundedness of Φ mentioned in Assumptions 1.
Revised: Above inequality (41) follows from Lipschitz continuity assumption, and upper boundedness of Φ mentioned in Assumptions 1.

Original: This together with Proposition 6 gives us the result.
Revised: This together with Proposition 6 gives us the result.

Original: E. A PPROXIMATION GUARANTEES
Revised: E. A PPROXIMATION GUARANTEES

Original: Theorem 4.
Revised: Theorem 4.

Original: Given the conditions of Theorem 2 and Assumptions 2, let F ( h θ , S | a φ ∗ ( θ ,S ) ) be a PL function in θ for all S , i.e. , ||∇ θ F ( h θ , S | a φ ∗ ( θ ,S ) )
Revised: Given the conditions of Theorem 2 and Assumptions 2, let F ( h θ , S | a φ ∗ ( θ ,S ) ) be a PL function in θ for all S , i.e. , ||∇ θ F ( h θ , S | a φ ∗ ( θ ,S ) )

Original: || ≥ σ [ F ( h θ , S | a φ ∗ ( θ ,S ) )
Revised: || ≥ σ [ F ( h θ , S | a φ ∗ ( θ ,S ) )

Original: − min θ (cid:48) F ( h θ (cid:48) , S | a φ ∗ ( θ (cid:48) ,S ) )] for some constant σ .
Revised: − min θ (cid:48) F ( h θ (cid:48) , S | a φ ∗ ( θ (cid:48) ,S ) )] for some constant σ .

Original: If we set the learning rate η = 1 /kT in Algorithm 1, then for T
Revised: If we set the learning rate η = 1 /kT in Algorithm 1, then for T

Original: = O (1 /k(cid:15) ) iterations, δ < (1 − e − γ ∗ ) and ρ <
Revised: = O (1 /k(cid:15) ) iterations, δ < (1 − e − γ ∗ ) and ρ <

Original: [ C min (( e − γ ∗ + δ ) − 1 − 1) − λθ 2max ] /(cid:96) max , we have the following approximation guarantee for Algorithm 1:
Revised: [ C min (( e − γ ∗ + δ ) − 1 − 1) − λθ 2max ] /(cid:96) max , we have the following approximation guarantee for Algorithm 1:

Original: [Equation]
Revised: [Equation]

Original: where θ t is the iterate in Line 3 in Algorithm 1, OPT is the value at the optimum solution of our adversarial training problem (2) , κ = C min / ( λθ 2max + ρ(cid:96) max + C min ) .
Revised: where θ t is the iterate in Line 3 in Algorithm 1, OPT is the value at the optimum solution of our adversarial training problem (2) , κ = C min / ( λθ 2max + ρ(cid:96) max + C min ) .

Original: Here θ max is deﬁned in
Revised: Here θ max is deﬁned in

Original: Assumption 1 and (cid:96) max , C min are deﬁned in Assumptions 2.
Revised: Assumption 1 and (cid:96) max , C min are deﬁned in Assumptions 2.

Original: Proof.
Revised: Proof.

Original: Under the assumptions, Lemmas 13 and 14 hold.
Revised: Under the assumptions, Lemmas 13 and 14 hold.

Original: Using Lemma 13, we have that for all S , (cid:18)
Revised: Using Lemma 13, we have that for all S , (cid:18)

Original: [Equation]
Revised: [Equation]

Original: where the expectation above is taken over the randomness in stochastic distorted greedy algorithm
Revised: where the expectation above is taken over the randomness in stochastic distorted greedy algorithm

Original: [Equation]
Revised: [Equation]

Original: Now
Revised: Now

Original: [Equation]
Revised: [Equation]

Original: taking expectation over the randomness in k -SGD gives us,
Revised: taking expectation over the randomness in k -SGD gives us,

Original: [Equation]
Revised: [Equation]

Original: where the expectation is computed over all the total randomness of the algorithm.
Revised: where the expectation is computed over all the total randomness of the algorithm.

Original: We now sum the above equation over all T to get,
Revised: We now sum the above equation over all T to get,

Original: [Equation]
Revised: [Equation]

Original: Using Lemma
Revised: Using Lemma

Original: [Equation]
Revised: [Equation]

Original: we have that for all θ ,
Revised: we have that for all θ ,

Original: [Equation]
Revised: [Equation]

Original: where the expectation is w.r
Revised: where the expectation is w.r

Original: [Equation]
Revised: [Equation]

Original: t. the total randomness of the algorithm.
Revised: t. the total randomness of the algorithm.

Original: Summing over all T
Revised: Summing over all T

Original: [Equation]
Revised: [Equation]

Original: we obtain:
Revised: we obtain:

Original: T
Revised: T

Original: [Equation]
Revised: [Equation]

Original: Combining inequality (45) and inequality (47) and then dividing by T throughout we obtain:
Revised: Combining inequality (45) and inequality (47) and then dividing by T throughout we obtain:

Original: [Equation]
Revised: [Equation]

Original: Taking min over θ on both sides and noting that all terms except one are independent of θ , we get
Revised: Taking min over θ on both sides and noting that all terms except one are independent of θ , we get

Original: [Equation]
Revised: [Equation]

Original: Putting η = 1 kT , we obtain:
Revised: Putting η = 1 kT , we obtain:

Original: [Equation]
Revised: [Equation]

Original: This gives us the statement in the proof of the theorem.
Revised: This gives us the statement in the proof of the theorem.

Original: Require:
Revised: Require:

Original: Training instances D , regularization param- eter λ , budget b , # of iterations T , learning rate η ,
Revised: Training instances D , regularization param- eter λ , budget b , # of iterations T , learning rate η ,

Original: METHOD ∈ { GD , SGD , k − SGD } 1: I NIT ( h θ ), (cid:98) S 0 ← ∅ 2: for t = 0 to T − 1 do 3: (cid:98) θ t +1 ← T RAIN ( (cid:98) θ t , (cid:98) S t ,η t , METHOD ) 4: (cid:98) S t +1 ← SDG ( G λ ,m λ , (cid:98) θ t +1 ,b ) .
Revised: METHOD ∈ { GD , SGD , k − SGD } 1: I NIT ( h θ ), (cid:98) S 0 ← ∅ 2: for t = 0 to T − 1 do 3: (cid:98) θ t +1 ← T RAIN ( (cid:98) θ t , (cid:98) S t ,η t , METHOD ) 4: (cid:98) S t +1 ← SDG ( G λ ,m λ , (cid:98) θ t +1 ,b ) .

Original: 5: (cid:98) θ = (cid:80) Tt =1 η t (cid:98) θ t / (cid:80)
Revised: 5: (cid:98) θ = (cid:80) Tt =1 η t (cid:98) θ t / (cid:80)

Original: Tt =1 η t 6: return (cid:98) θ , (cid:98) S T 1: procedure SDG ( G λ ,m λ , (cid:98) θ ,b ) 2:
Revised: Tt =1 η t 6: return (cid:98) θ , (cid:98) S T 1: procedure SDG ( G λ ,m λ , (cid:98) θ ,b ) 2:

Original: S ← ∅ 3: for s ∈ [ b ] do 4: γ b,s ← (1 − γ/b ) b − s − 1 5:
Revised: S ← ∅ 3: for s ∈ [ b ] do 4: γ b,s ← (1 − γ/b ) b − s − 1 5:

Original: Randomly draw a subset B from D 6: e ∗ = argmax e ∈ B γ b,s G λ ( e | S ) − m λ ( { e } ) 7: if γ b,s G λ ( e ∗ | S ) − m λ ( { e ∗ } ) ≥ 0 then 8:
Revised: Randomly draw a subset B from D 6: e ∗ = argmax e ∈ B γ b,s G λ ( e | S ) − m λ ( { e } ) 7: if γ b,s G λ ( e ∗ | S ) − m λ ( { e ∗ } ) ≥ 0 then 8:

Original: S ← S ∪ { e } 9: return S 1: procedure T RAIN ( (cid:98) θ ,S,η, METHOD ) 2: //deterministic gradient descent 3: if METHOD is GD then 4: return (cid:98) θ − η ∂F ( h θ ,S | a φ ∗ ( θ ,S ) ) /∂
Revised: S ← S ∪ { e } 9: return S 1: procedure T RAIN ( (cid:98) θ ,S,η, METHOD ) 2: //deterministic gradient descent 3: if METHOD is GD then 4: return (cid:98) θ − η ∂F ( h θ ,S | a φ ∗ ( θ ,S ) ) /∂

Original: θ (cid:12)(cid:12) θ = (cid:98) θ 5: //stochastic
Revised: θ (cid:12)(cid:12) θ = (cid:98) θ 5: //stochastic

Original: gradient descent 6: if METHOD is SGD then 7:
Revised: gradient descent 6: if METHOD is SGD then 7:

Original: Draw i ∼ D uniformly at random 8: if i ∈ S then 9:
Revised: Draw i ∼ D uniformly at random 8: if i ∈ S then 9:

Original: F ← (cid:96) ( h θ ( a φ ( x i )) ,y i ) 10: else 11:
Revised: F ← (cid:96) ( h θ ( a φ ( x i )) ,y i ) 10: else 11:

Original: F ← ρ(cid:96)
Revised: F ← ρ(cid:96)

Original: ( h θ ( x i ) ,y i ) 12: return (cid:98) θ − η ∂F∂ θ (cid:12)(cid:12) θ = (cid:98) θ
Revised: ( h θ ( x i ) ,y i ) 12: return (cid:98) θ − η ∂F∂ θ (cid:12)(cid:12) θ = (cid:98) θ

Original: Approximation guarantee for convex F .
Revised: Approximation guarantee for convex F .

Original: Next we consider the unlikely case when F is convex.
Revised: Next we consider the unlikely case when F is convex.

Original: Here, we present the approximation guarantees of our algorithm, again copied here in Algorithm 2, speciﬁcally with two different variants of stochastic gradient descent, viz. , simple gradient descent (GD) and one-step stochastic gradient descent (SGD) (instead of k -SGD) that allows us to derive approximation guarantees for convecity.
Revised: Here, we present the approximation guarantees of our algorithm, again copied here in Algorithm 2, speciﬁcally with two different variants of stochastic gradient descent, viz. , simple gradient descent (GD) and one-step stochastic gradient descent (SGD) (instead of k -SGD) that allows us to derive approximation guarantees for convecity.

Original: These guarantees generalize the results from Adibi et al.
Revised: These guarantees generalize the results from Adibi et al.

Original: Theorem 5.
Revised: Theorem 5.

Original: Given the conditions of Theorem 2 and Assumption 2, let F ( h θ , S | a φ ∗ ( θ ,S ) ) be convex in θ for all S , the learning rate η = 1 / √ T .
Revised: Given the conditions of Theorem 2 and Assumption 2, let F ( h θ , S | a φ ∗ ( θ ,S ) ) be convex in θ for all S , the learning rate η = 1 / √ T .

Original: Now, suppose we set either method = GD or method =
Revised: Now, suppose we set either method = GD or method =

Original: SGD in line 3 in Algorithm 2, i.e. , we use either one step gradient descent or stochastic gradient descent during training θ for ﬁxed S , then for T
Revised: SGD in line 3 in Algorithm 2, i.e. , we use either one step gradient descent or stochastic gradient descent during training θ for ﬁxed S , then for T

Original: = O (1 /(cid:15) 2 ) iterations, δ < (1 − e − γ ∗ ) and
Revised: = O (1 /(cid:15) 2 ) iterations, δ < (1 − e − γ ∗ ) and

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: max , we have the following approximation guarantee.
Revised: max , we have the following approximation guarantee.

Original: [Equation]
Revised: [Equation]

Original: where OPT is the value at the optimum solution of our adversarial training problem (2) , κ =
Revised: where OPT is the value at the optimum solution of our adversarial training problem (2) , κ =

Original: C min / ( λθ 2max + ρ(cid:96) max + C min ) .
Revised: C min / ( λθ 2max + ρ(cid:96) max + C min ) .

Original: Here, θ max is deﬁned in Assumption 1 and (cid:96) max , C min are deﬁned in Assumption 2.
Revised: Here, θ max is deﬁned in Assumption 1 and (cid:96) max , C min are deﬁned in Assumption 2.

Original: Proof.
Revised: Proof.

Original: Under the Assumptions 2 and convexity of F , Lemma 11 holds.
Revised: Under the Assumptions 2 and convexity of F , Lemma 11 holds.

Original: Hence, we have that θ ∈ Θ ,
Revised: Hence, we have that θ ∈ Θ ,

Original: T
Revised: T

Original: [Equation]
Revised: [Equation]

Original: Under Assumptions 1 and 2, Lemma 9 also holds, which gives us, for all S, t
Revised: Under Assumptions 1 and 2, Lemma 9 also holds, which gives us, for all S, t

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: We note that in Lemma 9, the expectation was taken over the randomness in stochastic distorted greedy algorithm.
Revised: We note that in Lemma 9, the expectation was taken over the randomness in stochastic distorted greedy algorithm.

Original: We now include the randomness due to stochastic gradient descent and take the total expectation to obtain,
Revised: We now include the randomness due to stochastic gradient descent and take the total expectation to obtain,

Original: [Equation]
Revised: [Equation]

Original: Summing the above equation over t = 1 to T gives us, for all θ ∈ Θ , S ,
Revised: Summing the above equation over t = 1 to T gives us, for all θ ∈ Θ , S ,

Original: T (cid:88)
Revised: T (cid:88)

Original: [Equation]
Revised: [Equation]

Original: Summing inequality (51) and inequality (54) and dividing by T , we obtain:
Revised: Summing inequality (51) and inequality (54) and dividing by T , we obtain:

Original: [Equation]
Revised: [Equation]

Original: Since the above holds for all S
Revised: Since the above holds for all S

Original: [Equation]
Revised: [Equation]

Original: we take the maximum over all possible S , on both sides to obtain,
Revised: we take the maximum over all possible S , on both sides to obtain,

Original: [Equation]
Revised: [Equation]

Original: Since F is convex in θ , we get that for all S and for (cid:98) θ = (cid:80) T
Revised: Since F is convex in θ , we get that for all S and for (cid:98) θ = (cid:80) T

Original: [Equation]
Revised: [Equation]

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: Along with linearity of expectation, this gives us that for all θ ∈ Θ ,
Revised: Along with linearity of expectation, this gives us that for all θ ∈ Θ ,

Original: [Equation]
Revised: [Equation]

Original: Finally, we take the minimum over θ on both sides.
Revised: Finally, we take the minimum over θ on both sides.

Original: Noting that the LHS is independent of θ , we obtain:
Revised: Noting that the LHS is independent of θ , we obtain:

Original: [Equation]
Revised: [Equation]

Original: Setting η = 1 √ T , we obtain:
Revised: Setting η = 1 √ T , we obtain:

Original: [Equation]
Revised: [Equation]

Original: Rearranging, we get the statement in the theorem.
Revised: Rearranging, we get the statement in the theorem.

Original: This completes the proof.
Revised: This completes the proof.

Original: F A UXILIARY LEMMAS
Revised: F A UXILIARY LEMMAS

Original: Proposition 6.
Revised: Proposition 6.

Original: If a function Q satisﬁes α -submodularity, i.e. , Q ( k | S ) > αQ ( k | T ) for all k ∈ D \ T with S ⊂ T , then Q satisﬁes γ -weak submodularity (El Halabi et al., 2018, Proposition 8, Appendix)
Revised: If a function Q satisﬁes α -submodularity, i.e. , Q ( k | S ) > αQ ( k | T ) for all k ∈ D \ T with S ⊂ T , then Q satisﬁes γ -weak submodularity (El Halabi et al., 2018, Proposition 8, Appendix)

Original: Lemma 7.
Revised: Lemma 7.

Original: (Guarantees from Stochastic Distorted Greedy) Let , g, c : 2 D
Revised: (Guarantees from Stochastic Distorted Greedy) Let , g, c : 2 D

Original: → R + be two non-negative, monotone set functions, such that g is γ -weakly submodularfor some γ ∈ (0 , 1] and c is modular (see
Revised: → R + be two non-negative, monotone set functions, such that g is γ -weakly submodularfor some γ ∈ (0 , 1] and c is modular (see

Original: Deﬁnition 1).
Revised: Deﬁnition 1).

Original: Furthermore, suppose that for all S, c ( S ) /g ( S ) ≤ 1 − κ for some κ ∈ [0 , 1) .
Revised: Furthermore, suppose that for all S, c ( S ) /g ( S ) ≤ 1 − κ for some κ ∈ [0 , 1) .

Original: Suppose we wish to solve the following problem:
Revised: Suppose we wish to solve the following problem:

Original: [Equation]
Revised: [Equation]

Original: for some ﬁxed K .
Revised: for some ﬁxed K .

Original: Let S ∗ denote the value of set for which the maximum in optimization (60) is attained.
Revised: Let S ∗ denote the value of set for which the maximum in optimization (60) is attained.

Original: Then, for a given value of δ > 0 such that δ + e − γ < 1 , Stochastic Distorted Greedy
Revised: Then, for a given value of δ > 0 such that δ + e − γ < 1 , Stochastic Distorted Greedy

Original: Algorithm makes O ( Dlog (1 /δ )) evaluations of g and returns a set S (cid:48) of size | S (cid:48) | ≤ b which satisﬁes,
Revised: Algorithm makes O ( Dlog (1 /δ )) evaluations of g and returns a set S (cid:48) of size | S (cid:48) | ≤ b which satisﬁes,

Original: [Equation]
Revised: [Equation]

Original: As a corollary, we observe that for all S such that | S | ≤ K , it holds that,
Revised: As a corollary, we observe that for all S such that | S | ≤ K , it holds that,

Original: [Equation]
Revised: [Equation]

Original: Proof.
Revised: Proof.

Original: We begin with the approximation guarantee on Stochastic Distorted Greedy Algorithm as stated in (Harshaw et al., 2019), Theorem 3.
Revised: We begin with the approximation guarantee on Stochastic Distorted Greedy Algorithm as stated in (Harshaw et al., 2019), Theorem 3.

Original: (Harshaw et al., 2019) show that on running Distorted
Revised: (Harshaw et al., 2019) show that on running Distorted

Original: Greedy with K iterations for optimization problem (60), the output is a set S (cid:48) with size | S (cid:48) | ≤ K and,
Revised: Greedy with K iterations for optimization problem (60), the output is a set S (cid:48) with size | S (cid:48) | ≤ K and,

Original: [Equation]
Revised: [Equation]

Original: where in the last inequality we use deﬁnition of κ .
Revised: where in the last inequality we use deﬁnition of κ .

Original: Collecting the terms involving g ( S ∗ ) − c ( S ∗ ) on the left, g ( S (cid:48) )
Revised: Collecting the terms involving g ( S ∗ ) − c ( S ∗ ) on the left, g ( S (cid:48) )

Original: − c ( S (cid:48) ) on the right and then simplifying gives us the result of the lemma.
Revised: − c ( S (cid:48) ) on the right and then simplifying gives us the result of the lemma.

Original: Lemma 8.
Revised: Lemma 8.

Original: (Derivation of κ ) Let G λ
Revised: (Derivation of κ ) Let G λ

Original: ( θ , S ) and m λ ( θ , S ) be as deﬁned in deﬁnition 4 and 5 respectively.
Revised: ( θ , S ) and m λ ( θ , S ) be as deﬁned in deﬁnition 4 and 5 respectively.

Original: Let Assumption 1 hold and suppose max θ ∈ Θ R ( θ )
Revised: Let Assumption 1 hold and suppose max θ ∈ Θ R ( θ )

Original: = θ 2max and for all θ ∈ Θ , and let (cid:96) max , C min , θ max be deﬁned as in Assumption 1.
Revised: = θ 2max and for all θ ∈ Θ , and let (cid:96) max , C min , θ max be deﬁned as in Assumption 1.

Original: Then, for all θ , ∀ S , it holds that
Revised: Then, for all θ , ∀ S , it holds that

Original: [Equation]
Revised: [Equation]

Original: Proof.
Revised: Proof.

Original: We ﬁrst note that:
Revised: We ﬁrst note that:

Original: [Equation]
Revised: [Equation]

Original: Using the deﬁnition of a φ ∗ ( θ ,S ) from Eq.
Revised: Using the deﬁnition of a φ ∗ ( θ ,S ) from Eq.

Original: (3), we have, for all φ ∈ Φ (cid:88)
Revised: (3), we have, for all φ ∈ Φ (cid:88)

Original: i ∈ S
Revised: i ∈ S

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: In particular, this also holds for φ such that for all x , a φ ( x ) = x .
Revised: In particular, this also holds for φ such that for all x , a φ ( x ) = x .

Original: This gives, (cid:88)
Revised: This gives, (cid:88)

Original: [Equation]
Revised: [Equation]

Original: The last line uses the deﬁnition of C min from Assumption 1, and the fact that for all x , C ( x , x ) = 0 .
Revised: The last line uses the deﬁnition of C min from Assumption 1, and the fact that for all x , C ( x , x ) = 0 .

Original: Plugging inequality (71) back into inequality.
Revised: Plugging inequality (71) back into inequality.

Original: (68), we obtain:
Revised: (68), we obtain:

Original: [Equation]
Revised: [Equation]

Original: Here inequalities (73) and (74) follow from non-negativity of (cid:96) .
Revised: Here inequalities (73) and (74) follow from non-negativity of (cid:96) .

Original: Finally, substituting R ( θ ) ≤ θ 2max , we get the statement in the lemma.
Revised: Finally, substituting R ( θ ) ≤ θ 2max , we get the statement in the lemma.

Original: Lemma 9.
Revised: Lemma 9.

Original: Suppose the assumptions of Lemma 8 and Theorem 2 hold.
Revised: Suppose the assumptions of Lemma 8 and Theorem 2 hold.

Original: Let κ = µC min / ( λθ 2max + ρ(cid:96) max + µC min ) , where the symbols are the same as deﬁned in the statement of Lemma 8 and γ ∗ is deﬁned in Theorem 2.
Revised: Let κ = µC min / ( λθ 2max + ρ(cid:96) max + µC min ) , where the symbols are the same as deﬁned in the statement of Lemma 8 and γ ∗ is deﬁned in Theorem 2.

Original: Furthermore, let δ < (1 − e − γ ∗ ) and let ρ < [ C min (( e − γ ∗ + δ ) − 1 − 1) − λθ 2max ] /(cid:96) max .
Revised: Furthermore, let δ < (1 − e − γ ∗ ) and let ρ < [ C min (( e − γ ∗ + δ ) − 1 − 1) − λθ 2max ] /(cid:96) max .

Original: Then for any S such that | S | ≤ b ,
Revised: Then for any S such that | S | ≤ b ,

Original: [Equation]
Revised: [Equation]

Original: [Equation]
Revised: [Equation]

Original: where the expectation is w.r.t.
Revised: where the expectation is w.r.t.

Original: the randomness in Stochastic Distorted Greedy.
Revised: the randomness in Stochastic Distorted Greedy.

Original: Proof.
Revised: Proof.

Original: To obtain our guarantees, we require (cid:16) 1 − e − γ ∗ + δ κ (cid:17) ≥ 0 .
Revised: To obtain our guarantees, we require (cid:16) 1 − e − γ ∗ + δ κ (cid:17) ≥ 0 .

Original: Substituting κ = µC min / (
Revised: Substituting κ = µC min / (

Original: [Equation]
Revised: [Equation]

Original: ρ(cid:96) max + µC min ) and simplifying gives us ρ < [ µC min (( e − γ ∗ + δ ) − 1 − 1) − λθ 2max ] /(cid:96) max .
Revised: ρ(cid:96) max + µC min ) and simplifying gives us ρ < [ µC min (( e − γ ∗ + δ ) − 1 − 1) − λθ 2max ] /(cid:96) max .

Original: To ensure that the this bound is positive, we require δ < (1 − e − γ ∗ ) .
Revised: To ensure that the this bound is positive, we require δ < (1 − e − γ ∗ ) .

Original: In our algorithm, we obtain (cid:98) S t by applying Stochastic Distorted Greedy using (cid:98) θ t − 1 .
Revised: In our algorithm, we obtain (cid:98) S t by applying Stochastic Distorted Greedy using (cid:98) θ t − 1 .

Original: Therefore, by our characterization of F as stated in Eq.
Revised: Therefore, by our characterization of F as stated in Eq.

Original: (6) and using Lemma 7, we have that for any S ,
Revised: (6) and using Lemma 7, we have that for any S ,

Original: [Equation]
Revised: [Equation]

Original: Using the ∇ max -Lipschitzness of F , we get
Revised: Using the ∇ max -Lipschitzness of F , we get

Original: [Equation]
Revised: [Equation]

Original: Now, using the Lipschitz condition, from inequality (81) we get that for t and S
Revised: Now, using the Lipschitz condition, from inequality (81) we get that for t and S

Original: [Equation]
Revised: [Equation]

Original: [Equation]
Revised: [Equation]

Original: Here, inequality (83) is obtained by using inequality (78).
Revised: Here, inequality (83) is obtained by using inequality (78).

Original: Subtracting E
Revised: Subtracting E

Original: [ F ( h (cid:98) θ t , (cid:98) S t | a φ ∗ ( (cid:98) θ t , (cid:98) S t ) )] from both sides of inequality (84), we obtain:
Revised: [ F ( h (cid:98) θ t , (cid:98) S t | a φ ∗ ( (cid:98) θ t , (cid:98) S t ) )] from both sides of inequality (84), we obtain:

Original: [Equation]
Revised: [Equation]

Original: Using inequality (81)
Revised: Using inequality (81)

Original: [Equation]
Revised: [Equation]

Original: we conclude that the above quantity is less than
Revised: we conclude that the above quantity is less than

Original: [Equation]
Revised: [Equation]

Original: This completes the proof of the lemma.
Revised: This completes the proof of the lemma.

Original: Lemma 10.
Revised: Lemma 10.

Original: Suppose Assumption 1 and 2 hold.
Revised: Suppose Assumption 1 and 2 hold.

Original: Let (cid:98) ∇ θ F ( h θ , S | a φ ∗ ( θ ,S ) ) denote the stochastic gradient of F at h θ , S such that E [ (cid:98) ∇ θ F ( h θ , S | a φ ∗ ( θ ,S ) )]
Revised: Let (cid:98) ∇ θ F ( h θ , S | a φ ∗ ( θ ,S ) ) denote the stochastic gradient of F at h θ , S such that E [ (cid:98) ∇ θ F ( h θ , S | a φ ∗ ( θ ,S ) )]

Original: = ∇ θ F ( h θ , S | a φ ∗ ( θ ,S ) ) , for all θ , S .
Revised: = ∇ θ F ( h θ , S | a φ ∗ ( θ ,S ) ) , for all θ , S .

Original: Furthermore, suppose that for all θ , S , we have, (cid:107) (cid:98) ∇ θ F ( h θ , S | a φ ∗ ( θ ,S ) ) (cid:107) ≤ ∇ max .
Revised: Furthermore, suppose that for all θ , S , we have, (cid:107) (cid:98) ∇ θ F ( h θ , S | a φ ∗ ( θ ,S ) ) (cid:107) ≤ ∇ max .

Original: For any θ , S , let θ (cid:48)
Revised: For any θ , S , let θ (cid:48)

Original: = θ − η (cid:98) ∇ θ F ( h θ , S | a φ ∗ ( θ ,S ) ) .
Revised: = θ − η (cid:98) ∇ θ F ( h θ , S | a φ ∗ ( θ ,S ) ) .

Original: Then, for any ˜ θ ∈ Θ
Revised: Then, for any ˜ θ ∈ Θ

Original: [Equation]
Revised: [Equation]

Original: where the expectation is over the randomness in computing the stochastic gradient (cid:98) ∇ θ F
Revised: where the expectation is over the randomness in computing the stochastic gradient (cid:98) ∇ θ F

Original: ( h θ , S | a φ ∗ ( θ ,S ) ) .
Revised: ( h θ , S | a φ ∗ ( θ ,S ) ) .

Original: Proof.
Revised: Proof.

Original: In what follows, we ﬁx S and denote F ( h θ , S | a φ ∗ ( θ ,S ) ) ≡ F ( h θ ) .
Revised: In what follows, we ﬁx S and denote F ( h θ , S | a φ ∗ ( θ ,S ) ) ≡ F ( h θ ) .

Original: We do this for brevity and succinctness.
Revised: We do this for brevity and succinctness.

Original: Using ﬁrst L -smoothness and then θ (cid:48)
Revised: Using ﬁrst L -smoothness and then θ (cid:48)

Original: = θ − η (cid:98) ∇ θ F ( h θ , S | a φ ∗ ( θ ,S ) ) , we obtain:
Revised: = θ − η (cid:98) ∇ θ F ( h θ , S | a φ ∗ ( θ ,S ) ) , we obtain:

Original: [Equation]
Revised: [Equation]

Original: Taking expectations on both sides over the randomness in computing SGD
Revised: Taking expectations on both sides over the randomness in computing SGD

Original: [Equation]
Revised: [Equation]

Original: we obtain:
Revised: we obtain:

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: Since F is convex in ˜ θ
Revised: Since F is convex in ˜ θ

Original: [Equation]
Revised: [Equation]

Original: we have:
Revised: we have:

Original: [Equation]
Revised: [Equation]

Original: Adding the inequality (93) and inequality (92)
Revised: Adding the inequality (93) and inequality (92)

Original: [Equation]
Revised: [Equation]

Original: we obtain:
Revised: we obtain:

Original: [Equation]
Revised: [Equation]

Original: We derive a value for (cid:104)∇ θ F ( h θ ) , θ − ˜ θ (cid:105) using the following:
Revised: We derive a value for (cid:104)∇ θ F ( h θ ) , θ − ˜ θ (cid:105) using the following:

Original: [Equation]
Revised: [Equation]

Original: [Equation]
Revised: [Equation]

Original: Taking expectation on both sides, given θ (noting that ˜ θ does not depend on θ ), we get
Revised: Taking expectation on both sides, given θ (noting that ˜ θ does not depend on θ ), we get

Original: [Equation]
Revised: [Equation]

Original: Rearranging, we obtain:
Revised: Rearranging, we obtain:

Original: [Equation]
Revised: [Equation]

Original: Plugging inequality (101) back into the inequality (94), we get
Revised: Plugging inequality (101) back into the inequality (94), we get

Original: E [ F ( h θ (cid:48)
Revised: E [ F ( h θ (cid:48)

Original: [Equation]
Revised: [Equation]

Original: |
Revised: |

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: F
Revised: F

Original: [Equation]
Revised: [Equation]

Original: Lemma 11.
Revised: Lemma 11.

Original: Suppose the assumptions of Lemma 10 hold.
Revised: Suppose the assumptions of Lemma 10 hold.

Original: Furthermore, let (cid:98) θ t , (cid:98) S t denote the iterates of our algorithm.
Revised: Furthermore, let (cid:98) θ t , (cid:98) S t denote the iterates of our algorithm.

Original: Then, for any ˜ θ ∈ Θ ,
Revised: Then, for any ˜ θ ∈ Θ ,

Original: [Equation]
Revised: [Equation]

Original: Here the expectation is taken w.r.t.
Revised: Here the expectation is taken w.r.t.

Original: the total randomness of the algorithm.
Revised: the total randomness of the algorithm.

Original: This includes the randomness in stochastic gradient descent as well as stochastic distorted greedy.
Revised: This includes the randomness in stochastic gradient descent as well as stochastic distorted greedy.

Original: Proof.
Revised: Proof.

Original: Putting θ (cid:48)
Revised: Putting θ (cid:48)

Original: = (cid:98) θ t , θ = (cid:98) θ t − 1 and S = (cid:98) S t − 1 , in the statement of Lemma 10 we obtain: that for any ˜ θ ∈ Θ
Revised: = (cid:98) θ t , θ = (cid:98) θ t − 1 and S = (cid:98) S t − 1 , in the statement of Lemma 10 we obtain: that for any ˜ θ ∈ Θ

Original: [Equation]
Revised: [Equation]

Original: We now take the expectation w.r.t.
Revised: We now take the expectation w.r.t.

Original: (cid:98) θ 0 , (cid:98) θ 1 , . . .
Revised: (cid:98) θ 0 , (cid:98) θ 1 , . . .

Original: , (cid:98) θ t .
Revised: , (cid:98) θ t .

Original: Let (cid:98) θ 0:
Revised: Let (cid:98) θ 0:

Original: τ := (cid:98) θ 0 , . . .
Revised: τ := (cid:98) θ 0 , . . .

Original: , (cid:98) θ τ .
Revised: , (cid:98) θ τ .

Original: Using law of total expectation and noting that given (cid:98) θ t − 1 , (cid:98) θ t is independent of (cid:98) θ τ for τ (cid:54)
Revised: Using law of total expectation and noting that given (cid:98) θ t − 1 , (cid:98) θ t is independent of (cid:98) θ τ for τ (cid:54)

Original: =
Revised: =

Original: t − 1 , we get
Revised: t − 1 , we get

Original: E
Revised: E

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: E
Revised: E

Original: [Equation]
Revised: [Equation]

Original: E
Revised: E

Original: [Equation]
Revised: [Equation]

Original: (cid:98)
Revised: (cid:98)

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: Finally
Revised: Finally

Original: [Equation]
Revised: [Equation]

Original: we note that E
Revised: we note that E

Original: [Equation]
Revised: [Equation]

Original: ] as later iterations cannot impact previous iterations.
Revised: ] as later iterations cannot impact previous iterations.

Original: We ﬁnally take the expectation w
Revised: We ﬁnally take the expectation w

Original: [Equation]
Revised: [Equation]

Original: r
Revised: r

Original: [Equation]
Revised: [Equation]

Original: t the randomness in stochastic distorted greedy as well.
Revised: t the randomness in stochastic distorted greedy as well.

Original: Thus, we obtain:
Revised: Thus, we obtain:

Original: [Equation]
Revised: [Equation]

Original: where E now denotes the expectation w
Revised: where E now denotes the expectation w

Original: [Equation]
Revised: [Equation]

Original: r
Revised: r

Original: [Equation]
Revised: [Equation]

Original: t. the randomness in the entire procedure (stochastic gradient descent and stochastic distorted greedy).
Revised: t. the randomness in the entire procedure (stochastic gradient descent and stochastic distorted greedy).

Original: Using Lipschitzness of F
Revised: Using Lipschitzness of F

Original: [Equation]
Revised: [Equation]

Original: we get that
Revised: we get that

Original: [Equation]
Revised: [Equation]

Original: Plugging this in the equation above, we get
Revised: Plugging this in the equation above, we get

Original: [Equation]
Revised: [Equation]

Original: Setting η < 1 /L and simplifying gives us the following,
Revised: Setting η < 1 /L and simplifying gives us the following,

Original: [Equation]
Revised: [Equation]

Original: Summing over all T gives us a telescoping sum on the right.
Revised: Summing over all T gives us a telescoping sum on the right.

Original: Simplifying
Revised: Simplifying

Original: [Equation]
Revised: [Equation]

Original: we obtain:
Revised: we obtain:

Original: [Equation]
Revised: [Equation]

Original: We give an upper bound on (cid:107) (cid:98) θ 1 − ˜ θ (cid:107) 2 as follows
Revised: We give an upper bound on (cid:107) (cid:98) θ 1 − ˜ θ (cid:107) 2 as follows

Original: [Equation]
Revised: [Equation]

Original: Substituting upper bound from inequality (109) in inequality (108) gives us the statement of the
Revised: Substituting upper bound from inequality (109) in inequality (108) gives us the statement of the

Original: Lemma:
Revised: Lemma:

Original: [Equation]
Revised: [Equation]

Original: F. A UXILIARY LEMMAS FOR T HEOREM
Revised: F. A UXILIARY LEMMAS FOR T HEOREM

Original: Lemma 12.
Revised: Lemma 12.

Original: ( k -SGD guarantee for a ﬁxed S )
Revised: ( k -SGD guarantee for a ﬁxed S )

Original: Suppose Assumption 1 and 2 hold and F is a nonconvex function that satisﬁes the PL condition.
Revised: Suppose Assumption 1 and 2 hold and F is a nonconvex function that satisﬁes the PL condition.

Original: Fix S and suppose θ (1) , . .
Revised: Fix S and suppose θ (1) , . .

Original: , θ ( k ) are obtained using k -step stochastic gradient descent, for the ﬁxed S , starting from θ (0) .
Revised: , θ ( k ) are obtained using k -step stochastic gradient descent, for the ﬁxed S , starting from θ (0) .

Original: Then, for any ˜ θ ∈ Θ , we have,
Revised: Then, for any ˜ θ ∈ Θ , we have,

Original: E
Revised: E

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: where the expectation is w.r.t.
Revised: where the expectation is w.r.t.

Original: randomness in computing the stochastic gradient.
Revised: randomness in computing the stochastic gradient.

Original: Proof.
Revised: Proof.

Original: Since S is ﬁxed, we drop the second argument and denote F S ( h θ , S | a φ ∗ ( θ ,S ) ) ≡ F S ( h θ ) for succinctness and brevity.
Revised: Since S is ﬁxed, we drop the second argument and denote F S ( h θ , S | a φ ∗ ( θ ,S ) ) ≡ F S ( h θ ) for succinctness and brevity.

Original: For i = 0 , . . .
Revised: For i = 0 , . . .

Original: , k − 1 , we have, θ ( i +1)
Revised: , k − 1 , we have, θ ( i +1)

Original: = θ ( i ) − η (cid:98) ∇ θ ( i ) F S
Revised: = θ ( i ) − η (cid:98) ∇ θ ( i ) F S

Original: ( h θ ( i ) ) .
Revised: ( h θ ( i ) ) .

Original: Using
Revised: Using

Original: L -smoothness, we obtain:
Revised: L -smoothness, we obtain:

Original: [Equation]
Revised: [Equation]

Original: Taking expectation (given θ ( k − 1) ) on both sides w.r.t.
Revised: Taking expectation (given θ ( k − 1) ) on both sides w.r.t.

Original: randomness in stochastic gradient descent, we obtain:
Revised: randomness in stochastic gradient descent, we obtain:

Original: [Equation]
Revised: [Equation]

Original: The PL condition implies that,
Revised: The PL condition implies that,

Original: [Equation]
Revised: [Equation]

Original: where θ ∗ S =
Revised: where θ ∗ S =

Original: min θ (cid:48)
Revised: min θ (cid:48)

Original: F ( h θ (cid:48) , S | a φ ∗ ( θ (cid:48) ,S ) ) .
Revised: F ( h θ (cid:48) , S | a φ ∗ ( θ (cid:48) ,S ) ) .

Original: Substituting this in the inequality (113)
Revised: Substituting this in the inequality (113)

Original: [Equation]
Revised: [Equation]

Original: we obtain:
Revised: we obtain:

Original: [Equation]
Revised: [Equation]

Original: Subtracting F S ( h θ ∗ S ) from both sides and simplifying gives us,
Revised: Subtracting F S ( h θ ∗ S ) from both sides and simplifying gives us,

Original: [Equation]
Revised: [Equation]

Original: Now
Revised: Now

Original: [Equation]
Revised: [Equation]

Original: we take expectation given θ ( k − 2) and get,
Revised: we take expectation given θ ( k − 2) and get,

Original: [Equation]
Revised: [Equation]

Original: Note that E [ F S ( h θ ( k ) ) | θ ( k − 1) , θ ( k − 2) ]
Revised: Note that E [ F S ( h θ ( k ) ) | θ ( k − 1) , θ ( k − 2) ]

Original: =
Revised: =

Original: E [ F S ( h θ ( k ) )
Revised: E [ F S ( h θ ( k ) )

Original: | θ ( k − 1) ] because θ ( k ) , is conditionally independent of θ ( k − 2) when θ ( k − 1) is given.
Revised: | θ ( k − 1) ] because θ ( k ) , is conditionally independent of θ ( k − 2) when θ ( k − 1) is given.

Original: Moreover, the term E
Revised: Moreover, the term E

Original: [ F S ( h θ ( k − 1) )
Revised: [ F S ( h θ ( k − 1) )

Original: | θ ( k − 2) ]
Revised: | θ ( k − 2) ]

Original: − F S ( h θ ∗ S ) can be simpliﬁed in the same manner as above to get,
Revised: − F S ( h θ ∗ S ) can be simpliﬁed in the same manner as above to get,

Original: [Equation]
Revised: [Equation]

Original: Let θ (0):( τ ) denote θ (0) , . .
Revised: Let θ (0):( τ ) denote θ (0) , . .

Original: , θ ( τ ) .
Revised: , θ ( τ ) .

Original: Then
Revised: Then

Original: [Equation]
Revised: [Equation]

Original: repeating the above procedure and simplifying yields,
Revised: repeating the above procedure and simplifying yields,

Original: [Equation]
Revised: [Equation]

Original: where, in inequality (121) we have used the PL condition and in inequality (122) we have used the fact that (cid:107)∇
Revised: where, in inequality (121) we have used the PL condition and in inequality (122) we have used the fact that (cid:107)∇

Original: [Equation]
Revised: [Equation]

Original: (using Lipschitz gradients).
Revised: (using Lipschitz gradients).

Original: Finally, we note that by the deﬁnition of θ ∗ S , F S ( h ˜ θ ) ≥ F S ( h θ ∗ S ) .
Revised: Finally, we note that by the deﬁnition of θ ∗ S , F S ( h ˜ θ ) ≥ F S ( h θ ∗ S ) .

Original: Thus, we replace F S ( h ˜ θ ) by
Revised: Thus, we replace F S ( h ˜ θ ) by

Original: F S ( h θ ∗ S ) in the LHS to get the statement of the lemma.
Revised: F S ( h θ ∗ S ) in the LHS to get the statement of the lemma.

Original: This completes the proof of the lemma.
Revised: This completes the proof of the lemma.

Original: Lemma 13.
Revised: Lemma 13.

Original: ( k -SGD guarantee)
Revised: ( k -SGD guarantee)

Original: Suppose Assumption 1 and 2 hold and F is a non-convex function that satisﬁes the PL condition.
Revised: Suppose Assumption 1 and 2 hold and F is a non-convex function that satisﬁes the PL condition.

Original: Let (cid:98) θ t , (cid:98) S t denote the iterates of our algorithm and suppose method = k -SGD is used.
Revised: Let (cid:98) θ t , (cid:98) S t denote the iterates of our algorithm and suppose method = k -SGD is used.

Original: Then, for any ˜ θ ∈ Θ
Revised: Then, for any ˜ θ ∈ Θ

Original: [Equation]
Revised: [Equation]

Original: where the expectation is taken w.r.t.
Revised: where the expectation is taken w.r.t.

Original: the total randomness of the algorithm (stochastic gradient descent and stochastic distorted greedy).
Revised: the total randomness of the algorithm (stochastic gradient descent and stochastic distorted greedy).

Original: Proof.
Revised: Proof.

Original: In our algorithm with method =
Revised: In our algorithm with method =

Original: k -SGD (cid:98) θ t is derived from (cid:98) θ t − 1 using k steps of SGD with ﬁxed set (cid:98) S t − 1 .
Revised: k -SGD (cid:98) θ t is derived from (cid:98) θ t − 1 using k steps of SGD with ﬁxed set (cid:98) S t − 1 .

Original: In this case, (cid:98) θ t − 1 = θ (0) , (cid:98) θ t
Revised: In this case, (cid:98) θ t − 1 = θ (0) , (cid:98) θ t

Original: = θ ( k ) , S = (cid:98) S t − 1 and θ (1) , . . .
Revised: = θ ( k ) , S = (cid:98) S t − 1 and θ (1) , . . .

Original: , θ ( k − 1) , denote the intermediate k -SGD iterates.
Revised: , θ ( k − 1) , denote the intermediate k -SGD iterates.

Original: In this case, Lemma 12 holds and we obtain:
Revised: In this case, Lemma 12 holds and we obtain:

Original: [Equation]
Revised: [Equation]

Original: Taking total expectation on both sides
Revised: Taking total expectation on both sides

Original: [Equation]
Revised: [Equation]

Original: w.r.t.
Revised: w.r.t.

Original: θ (1) , . . .
Revised: θ (1) , . . .

Original: , θ ( k − 1) , using law of total expectation and observing that the other terms in the equation are independent of these random variables
Revised: , θ ( k − 1) , using law of total expectation and observing that the other terms in the equation are independent of these random variables

Original: [Equation]
Revised: [Equation]

Original: we obtain:
Revised: we obtain:

Original: [Equation]
Revised: [Equation]

Original: Using Lipschitzness of F from Assumption
Revised: Using Lipschitzness of F from Assumption

Original: [Equation]
Revised: [Equation]

Original: we obtain:
Revised: we obtain:

Original: [Equation]
Revised: [Equation]

Original: Adding and subtracting F ( h (cid:98) θ t − 1 , (cid:98) S
Revised: Adding and subtracting F ( h (cid:98) θ t − 1 , (cid:98) S

Original: [Equation]
Revised: [Equation]

Original: − 1 |
Revised: − 1 |

Original: [Equation]
Revised: [Equation]

Original: φ
Revised: φ

Original: [Equation]
Revised: [Equation]

Original: S
Revised: S

Original: [Equation]
Revised: [Equation]

Original: from inequality (126) gives us,
Revised: from inequality (126) gives us,

Original: [Equation]
Revised: [Equation]

Original: Now
Revised: Now

Original: [Equation]
Revised: [Equation]

Original: using inequality (127)
Revised: using inequality (127)

Original: [Equation]
Revised: [Equation]

Original: we obtain:
Revised: we obtain:

Original: [Equation]
Revised: [Equation]

Original: Finally, taking expectation w
Revised: Finally, taking expectation w

Original: [Equation]
Revised: [Equation]

Original: r
Revised: r

Original: [Equation]
Revised: [Equation]

Original: t. the total randomness of the algorithm (stochastic gradient descent and stochastic distorted greedy), we obtain:
Revised: t. the total randomness of the algorithm (stochastic gradient descent and stochastic distorted greedy), we obtain:

Original: [Equation]
Revised: [Equation]

Original: Lemma 14.
Revised: Lemma 14.

Original: Suppose the assumptions of Lemma 8 and Theorem 2 hold.
Revised: Suppose the assumptions of Lemma 8 and Theorem 2 hold.

Original: Let κ = µC min / ( λθ 2max + ρ(cid:96) max + µC min ) , where the symbols are the same as deﬁned in the statement of Lemma 8 and γ ∗ is deﬁned in Theorem 2.
Revised: Let κ = µC min / ( λθ 2max + ρ(cid:96) max + µC min ) , where the symbols are the same as deﬁned in the statement of Lemma 8 and γ ∗ is deﬁned in Theorem 2.

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: where the expectation is w.r.t.
Revised: where the expectation is w.r.t.

Original: the randomness in Stochastic Distorted Greedy.
Revised: the randomness in Stochastic Distorted Greedy.

Original: Proof.
Revised: Proof.

Original: To obtain our guarantees, we require (1 − e − γ
Revised: To obtain our guarantees, we require (1 − e − γ

Original: [Equation]
Revised: [Equation]

Original: + δ κ ) ≥ 0 .
Revised: + δ κ ) ≥ 0 .

Original: Substituting κ = µC min / ( λθ 2max + ρ(cid:96) max + µC min ) and simplifying gives us ρ < [ µC min (( e − γ ∗ + δ ) − 1 − 1) − λθ 2max ] /(cid:96) max .
Revised: Substituting κ = µC min / ( λθ 2max + ρ(cid:96) max + µC min ) and simplifying gives us ρ < [ µC min (( e − γ ∗ + δ ) − 1 − 1) − λθ 2max ] /(cid:96) max .

Original: To ensure that the this bound is positive, we require δ < (1 − e − γ ∗ ) .
Revised: To ensure that the this bound is positive, we require δ < (1 − e − γ ∗ ) .

Original: In our algorithm, we obtain (cid:98) S t by applying Stochastic Distorted Greedy using (cid:98) θ t − 1 .
Revised: In our algorithm, we obtain (cid:98) S t by applying Stochastic Distorted Greedy using (cid:98) θ t − 1 .

Original: Therefore, by our characterization of F as stated in Eq.
Revised: Therefore, by our characterization of F as stated in Eq.

Original: (6) and using Lemma 7, we have that for any S ,
Revised: (6) and using Lemma 7, we have that for any S ,

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: Since (cid:98) θ t is derived from (cid:98) θ t − 1 using method =
Revised: Since (cid:98) θ t is derived from (cid:98) θ t − 1 using method =

Original: k -SGD , we cannot use Lipschitzness directly.
Revised: k -SGD , we cannot use Lipschitzness directly.

Original: Instead, we use inequality (127).
Revised: Instead, we use inequality (127).

Original: Doing so, we get that for all t, S ,
Revised: Doing so, we get that for all t, S ,

Original: [Equation]
Revised: [Equation]

Original: where in inequality (133) we use inequality (131).
Revised: where in inequality (133) we use inequality (131).

Original: Subtracting E
Revised: Subtracting E

Original: [ F ( h (cid:98) θ t , (cid:98) S t | a φ
Revised: [ F ( h (cid:98) θ t , (cid:98) S t | a φ

Original: [Equation]
Revised: [Equation]

Original: S t ) )] from both sides, we obtain:
Revised: S t ) )] from both sides, we obtain:

Original: [Equation]
Revised: [Equation]

Original: Using Lipschitzness of F from Assumption
Revised: Using Lipschitzness of F from Assumption

Original: [Equation]
Revised: [Equation]

Original: we obtain:
Revised: we obtain:

Original: [Equation]
Revised: [Equation]

Original: We use inequality (136) into the inequality (135) to have:
Revised: We use inequality (136) into the inequality (135) to have:

Original: [Equation]
Revised: [Equation]

Original: G A DDITIONAL DETAILS ABOUT THE EXPERIMENTAL SETUP G. D ATASET SPLIT INTO TRAIN , VALIDATION AND TEST
Revised: G A DDITIONAL DETAILS ABOUT THE EXPERIMENTAL SETUP G. D ATASET SPLIT INTO TRAIN , VALIDATION AND TEST

Original: We split the datasets 1 into training, validation, and test set in the ratio of 4:1:1, 5:1:1 and 4:1:1 for
Revised: We split the datasets 1 into training, validation, and test set in the ratio of 4:1:1, 5:1:1 and 4:1:1 for

Original: CIFAR10, FMNIST and CIFAR100 respectively.
Revised: CIFAR10, FMNIST and CIFAR100 respectively.

Original: For CIFAR10, we use 40000 training examples, 10000 validation examples and 10000 test examples.
Revised: For CIFAR10, we use 40000 training examples, 10000 validation examples and 10000 test examples.

Original: For Fashion MNIST, we use 50000 training examples, 10000 validation examples, and 10000 test examples.
Revised: For Fashion MNIST, we use 50000 training examples, 10000 validation examples, and 10000 test examples.

Original: For CIFAR100, we usetraining examples, 10000 validation examples and 10000 test examples.
Revised: For CIFAR100, we usetraining examples, 10000 validation examples and 10000 test examples.

Original: The same train, validation and test split it used for the baselines as well.
Revised: The same train, validation and test split it used for the baselines as well.

Original: In all cases, unless otherwise mentioned, we consider | S | ≤ b = 0 .
Revised: In all cases, unless otherwise mentioned, we consider | S | ≤ b = 0 .

Original: 1 | D | during training.
Revised: 1 | D | during training.

Original: Similarly, during test we use 10% test instances for attack.
Revised: Similarly, during test we use 10% test instances for attack.

Original: The exact nature of drawing this 10% test instances varies across experiments and is mentioned therein.
Revised: The exact nature of drawing this 10% test instances varies across experiments and is mentioned therein.

Original: G. D ETAILS ABOUT THE BASELINES
Revised: G. D ETAILS ABOUT THE BASELINES

Original: In all baselines, we used ResNet18 architecture for CIFAR10 and ResNet9 for CIFAR100, with the last layers having 10 and 100 neurons respectively.
Revised: In all baselines, we used ResNet18 architecture for CIFAR10 and ResNet9 for CIFAR100, with the last layers having 10 and 100 neurons respectively.

Original: For FMNIST, we use LeNet architecture.
Revised: For FMNIST, we use LeNet architecture.

Original: For all the methods (including ours) which use PGD attack during training, we keep the PGD attack parameters to be the same as R OGET ( a φ = PGD) (details in the following subsection).
Revised: For all the methods (including ours) which use PGD attack during training, we keep the PGD attack parameters to be the same as R OGET ( a φ = PGD) (details in the following subsection).

Original: Similar to ρ in our method, GAT, TRADES, Nu-AT and, MART also offer speciﬁc hyperparameters which can control the tradeoff between A clean and A robust .
Revised: Similar to ρ in our method, GAT, TRADES, Nu-AT and, MART also offer speciﬁc hyperparameters which can control the tradeoff between A clean and A robust .

Original: For all methods (including Ours), we use
Revised: For all methods (including Ours), we use

Original: PGD attack as the assumed adversarial perturbation method during hyperparameter selection on the validation set.
Revised: PGD attack as the assumed adversarial perturbation method during hyperparameter selection on the validation set.

Original: GAT (Sriramanan et al., 2020).
Revised: GAT (Sriramanan et al., 2020).

Original: We used the code from the ofﬁcial repository 2 .
Revised: We used the code from the ofﬁcial repository 2 .

Original: They provide two different codebases for CIFAR10 and MNIST.
Revised: They provide two different codebases for CIFAR10 and MNIST.

Original: We used their MNIST code for experiments with
Revised: We used their MNIST code for experiments with

Original: FMNIST dataset.
Revised: FMNIST dataset.

Original: For default hyperparameter selection (Table 1), we refer to the ofﬁcial repositoryin which they provide the value of l 2 _ reg = 10 for CIFAR10 and l 2 _ reg = 15 for MNIST (which we use for FMNIST).
Revised: For default hyperparameter selection (Table 1), we refer to the ofﬁcial repositoryin which they provide the value of l 2 _ reg = 10 for CIFAR10 and l 2 _ reg = 15 for MNIST (which we use for FMNIST).

Original: For worst-case hyperparameter selection (Table 2), we train GAT on a range of l 2 _ reg values: {2.5, 5.0, 10.0, 15.0, 20.0, 30.0} for CIFAR10 and FMNIST, and {2.0, 5.0, 10.0, 20.0, 30.0} for CIFAR100.
Revised: For worst-case hyperparameter selection (Table 2), we train GAT on a range of l 2 _ reg values: {2.5, 5.0, 10.0, 15.0, 20.0, 30.0} for CIFAR10 and FMNIST, and {2.0, 5.0, 10.0, 20.0, 30.0} for CIFAR100.

Original: In their ofﬁcial code, they train GAT for 100 epochs on CIFAR10 and for 50 epochs on MNIST.
Revised: In their ofﬁcial code, they train GAT for 100 epochs on CIFAR10 and for 50 epochs on MNIST.

Original: Hence we train GAT for 100, 50 and 100 epochs on CIFAR10, FMNIST and
Revised: Hence we train GAT for 100, 50 and 100 epochs on CIFAR10, FMNIST and

Original: CIFAR100 respectively.
Revised: CIFAR100 respectively.

Original: FBF (Wong et al., 2019).
Revised: FBF (Wong et al., 2019).

Original: For CIFAR10 we used the code from the ofﬁcial repository 4 .
Revised: For CIFAR10 we used the code from the ofﬁcial repository 4 .

Original: For
Revised: For

Original: FMNIST and CIFAR100, we implemented their code parallel to CIFAR10.
Revised: FMNIST and CIFAR100, we implemented their code parallel to CIFAR10.

Original: The only changes (other than the architecture) were the mean and standard deviation that we computed for FMNIST and
Revised: The only changes (other than the architecture) were the mean and standard deviation that we computed for FMNIST and

Original: CIFAR100 separately.
Revised: CIFAR100 separately.

Original: FBF does not have any tunable parameter and hence it does not undergo any hyperparameter selection.
Revised: FBF does not have any tunable parameter and hence it does not undergo any hyperparameter selection.

Original: For CIFAR10 and CIFAR100, we train FBF for 80 epochs (as used in the ofﬁcial code for CIFAR10).
Revised: For CIFAR10 and CIFAR100, we train FBF for 80 epochs (as used in the ofﬁcial code for CIFAR10).

Original: For FMNIST, we train FBF for 10 epochs (as used in the ofﬁcial code for MNIST).
Revised: For FMNIST, we train FBF for 10 epochs (as used in the ofﬁcial code for MNIST).

Original: TRADES (Zhang et al., 2019b).
Revised: TRADES (Zhang et al., 2019b).

Original: We used the code from the ofﬁcial repository 5 .
Revised: We used the code from the ofﬁcial repository 5 .

Original: They provide two different codebases for CIFAR10 and MNIST.
Revised: They provide two different codebases for CIFAR10 and MNIST.

Original: We used their MNIST code for experiments with
Revised: We used their MNIST code for experiments with

Original: FMNIST dataset.
Revised: FMNIST dataset.

Original: For default hyperparameter selection (Table 1), we refer to the ofﬁcial repositoryin which they use β = 6 . 

Revised: For default hyperparameter selection (Table 1), we refer to the ofﬁcial repositoryin which they use β = 6 .

Original: for CIFAR10 and β = 1 . 0 for MNIST (which we use for FMNIST).
Revised: for CIFAR10 and β = 1 . 0 for MNIST (which we use for FMNIST).

Original: For worst-case hyperparameter selection (Table 2), we train TRADES on a range of β values: {0.1, 0.2, 0.4, 0.6, 0.8, 2.0, 4.0, 6.0} for CIFAR10, {0.4, 0.6,
Revised: For worst-case hyperparameter selection (Table 2), we train TRADES on a range of β values: {0.1, 0.2, 0.4, 0.6, 0.8, 2.0, 4.0, 6.0} for CIFAR10, {0.4, 0.6,

Original: Nu-AT (Sriramanan et al., 2021).
Revised: Nu-AT (Sriramanan et al., 2021).

Original: We used the code from the ofﬁcial repository 7 .
Revised: We used the code from the ofﬁcial repository 7 .

Original: They only provide code for CIFAR10 hence for running it on FMNIST, we modify the PGD parameters to the one we used in FMNIST and the number of epochs to 100.
Revised: They only provide code for CIFAR10 hence for running it on FMNIST, we modify the PGD parameters to the one we used in FMNIST and the number of epochs to 100.

Original: For default hyperparameter selection (Table 1), we refer to the supplementary material of Nu-AT, in which the authors mention that "We use a λ max of 4.5 for CIFAR-10 on ResNet-18 architecture and 4 for WideResNet-34-10.
Revised: For default hyperparameter selection (Table 1), we refer to the supplementary material of Nu-AT, in which the authors mention that "We use a λ max of 4.5 for CIFAR-10 on ResNet-18 architecture and 4 for WideResNet-34-10.

Original: For MNIST we use λ max of 1...".
Revised: For MNIST we use λ max of 1...".

Original: Hence we use λ max =4.5 for CIFAR10 and λ max =1.0 for FMNIST.
Revised: Hence we use λ max =4.5 for CIFAR10 and λ max =1.0 for FMNIST.

Original: For worst-case hyperparameter selection (Table 2), we train Nu-AT on a range of λ max values: {2.0, 2.5, 3.0, 3.5, 4.0, 4.5, 5.0} for CIFAR10 and FMNIST, and {1.0, 2.0, 4.5, 6.0, 8.0} for CIFAR100.
Revised: For worst-case hyperparameter selection (Table 2), we train Nu-AT on a range of λ max values: {2.0, 2.5, 3.0, 3.5, 4.0, 4.5, 5.0} for CIFAR10 and FMNIST, and {1.0, 2.0, 4.5, 6.0, 8.0} for CIFAR100.

Original: Optimizer, batch size and learning rate are same as those used in the ofﬁcial repository.
Revised: Optimizer, batch size and learning rate are same as those used in the ofﬁcial repository.

Original: We train Nu-AT for 120, 100, and 120 epochs on CIFAR10, FMNIST and, CIFAR100 respectively.
Revised: We train Nu-AT for 120, 100, and 120 epochs on CIFAR10, FMNIST and, CIFAR100 respectively.

Original: MART (Wang et al., 2019).
Revised: MART (Wang et al., 2019).

Original: We used the code from the ofﬁcial repository 8 .
Revised: We used the code from the ofﬁcial repository 8 .

Original: They only provide code for CIFAR10 hence for running it on FMNIST, we modify the PGD parameters and the number of epochs.
Revised: They only provide code for CIFAR10 hence for running it on FMNIST, we modify the PGD parameters and the number of epochs.

Original: For default hyperparameter selection (Table 1), we refer to the ofﬁcial repository 9 in which they use β = 5 . 0 for CIFAR10.
Revised: For default hyperparameter selection (Table 1), we refer to the ofﬁcial repository 9 in which they use β = 5 . 0 for CIFAR10.

Original: We were not able to ﬁnd any mention of their hyperparameter values for MNIST either in their paper or their code.
Revised: We were not able to ﬁnd any mention of their hyperparameter values for MNIST either in their paper or their code.

Original: Hence using Figure 2(d) of their paper as reference, we trained MART on FMNIST for β = {0.5, 1.0, 2.5, 5.0, 7.5, 10.0} and found that only β = 1 .undergone effective training and gave A clean above 50%.
Revised: Hence using Figure 2(d) of their paper as reference, we trained MART on FMNIST for β = {0.5, 1.0, 2.5, 5.0, 7.5, 10.0} and found that only β = 1 .undergone effective training and gave A clean above 50%.

Original: Hence we chose β = 1 . 

Revised: Hence we chose β = 1 .

Original: as the default value for FMNIST.
Revised: as the default value for FMNIST.

Original: For worst-case hyperparameter selection (Table 2), we train MART on a range of β values: {0.5, 1.0, 2.5, 5.0, 7.5, 10.0} for CIFAR10 and FMNIST, and {0.5, 1.0, 2.5, 5.0, 10.0} for
Revised: For worst-case hyperparameter selection (Table 2), we train MART on a range of β values: {0.5, 1.0, 2.5, 5.0, 7.5, 10.0} for CIFAR10 and FMNIST, and {0.5, 1.0, 2.5, 5.0, 10.0} for

Original: CIFAR100.
Revised: CIFAR100.

Original: We train MART for 120, 100, and 120 epochs on CIFAR10, FMNIST and, CIFAR respectively.
Revised: We train MART for 120, 100, and 120 epochs on CIFAR10, FMNIST and, CIFAR respectively.

Original: PGD-AT (Madry et al., 2017).
Revised: PGD-AT (Madry et al., 2017).

Original: We could not ﬁnd any ofﬁcial Pytorch implementation for PGD-AT.
Revised: We could not ﬁnd any ofﬁcial Pytorch implementation for PGD-AT.

Original: Therefore, we implemented it ourselves using the architecture mentioned above, for each dataset.
Revised: Therefore, we implemented it ourselves using the architecture mentioned above, for each dataset.

Original: We use SGD optimizer along with batch size of 128 was used for both datasets.
Revised: We use SGD optimizer along with batch size of 128 was used for both datasets.

Original: For FMNIST, initial learning rate 0 . 01 and momentum 0 .
Revised: For FMNIST, initial learning rate 0 . 01 and momentum 0 .

Original: 9 was used.
Revised: 9 was used.

Original: For CIFAR10 and CIFAR100, we use initial learning rate of 0 . 1 and momentum 0 .
Revised: For CIFAR10 and CIFAR100, we use initial learning rate of 0 . 1 and momentum 0 .

Original: PGD-AT has no tunable parameter and hence it undergoes no hyperparameter selection.
Revised: PGD-AT has no tunable parameter and hence it undergoes no hyperparameter selection.

Original: We train PGD-AT for 100 epochs on all three datasets.
Revised: We train PGD-AT for 100 epochs on all three datasets.

Original: RFGSM-AT (Tramèr et al., 2018).
Revised: RFGSM-AT (Tramèr et al., 2018).

Original: We could not ﬁnd any ofﬁcial Pytorch implementation for
Revised: We could not ﬁnd any ofﬁcial Pytorch implementation for

Original: RFGSM-AT.
Revised: RFGSM-AT.

Original: Therefore, we implemented it ourselves using the architecture mentioned above, for each dataset.
Revised: Therefore, we implemented it ourselves using the architecture mentioned above, for each dataset.

Original: RFGSM-AT also does not have any tunable parameter that controls the tradeoff between
Revised: RFGSM-AT also does not have any tunable parameter that controls the tradeoff between

Original: A robust and A clean but it has a parameter α which does affect its robust accuracy to a signiﬁcant extent.
Revised: A robust and A clean but it has a parameter α which does affect its robust accuracy to a signiﬁcant extent.

Original: We refer to their paper in which they use α = (cid:15)/ 2 for ImageNet and MNIST.
Revised: We refer to their paper in which they use α = (cid:15)/ 2 for ImageNet and MNIST.

Original: Hence, for default hyperparameter selection (Table 1), we use α = (cid:15)/ 2 for CIFAR10 and FMNIST.
Revised: Hence, for default hyperparameter selection (Table 1), we use α = (cid:15)/ 2 for CIFAR10 and FMNIST.

Original: This value however gives very low robust accuracy for all the attacks.
Revised: This value however gives very low robust accuracy for all the attacks.

Original: Hence for worst-case hyperparameter selection (Table 2), we tune α such that it achieves A robust above 40% on PGD attack which gives us the value of α = 0 .
Revised: Hence for worst-case hyperparameter selection (Table 2), we tune α such that it achieves A robust above 40% on PGD attack which gives us the value of α = 0 .

Original: 05 (cid:15) .
Revised: 05 (cid:15) .

Original: Optimizer, batch size and learning rate are same as those used in the ofﬁcial repository.
Revised: Optimizer, batch size and learning rate are same as those used in the ofﬁcial repository.

Original: We use SGD optimizer along with batch size of 128 was used for both datasets.
Revised: We use SGD optimizer along with batch size of 128 was used for both datasets.

Original: For FMNIST, initial learning rate 0 . 01 and momentum 0 .
Revised: For FMNIST, initial learning rate 0 . 01 and momentum 0 .

Original: 9 was used.
Revised: 9 was used.

Original: For CIFAR10 and CIFAR100, we use initial learning rate of 0 . 1 and momentum 0 .
Revised: For CIFAR10 and CIFAR100, we use initial learning rate of 0 . 1 and momentum 0 .

Original: We train RFGSM-AT for 100 epochs on all three datasets.
Revised: We train RFGSM-AT for 100 epochs on all three datasets.

Original: G. I MPLEMENTATION D ETAILS OF OUR METHOD
Revised: G. I MPLEMENTATION D ETAILS OF OUR METHOD

Original: Hyperparameters of our method.
Revised: Hyperparameters of our method.

Original: For default hyperparameter selection (Table 1), we simply use ρ = 1 for all the datasets.
Revised: For default hyperparameter selection (Table 1), we simply use ρ = 1 for all the datasets.

Original: For worst-case hyperparameter selection (Table 2), we train R OGET ( a φ = PGD) on a range of ρ values: {0.01, 0.05, 0.5, 1.0, 2.0, 5.0, 8.0, 10.0} for CIFAR10, {0.01, 0.1, 0.5, 1.0, 1.5, 2.0, 4.0, 8.0} for FMNIST, and {2.0, 5.0, 10.0, 20.0, 30.0} for CIFAR100.
Revised: For worst-case hyperparameter selection (Table 2), we train R OGET ( a φ = PGD) on a range of ρ values: {0.01, 0.05, 0.5, 1.0, 2.0, 5.0, 8.0, 10.0} for CIFAR10, {0.01, 0.1, 0.5, 1.0, 1.5, 2.0, 4.0, 8.0} for FMNIST, and {2.0, 5.0, 10.0, 20.0, 30.0} for CIFAR100.

Original: For
Revised: For

Original: R OGET ( a φ = AdvGAN), we train for ρ values: {0.01, 0.25, 0.5, 1.0, 1.5, 2.0} for CIFAR10, {0.001, 0.005, 0.01, 0.1, 0.5, 1.0, 1.5, 2.0} for FMNIST and {0.005, 0.01, 0.25, 0.5, 1.0} for CIFAR100.
Revised: R OGET ( a φ = AdvGAN), we train for ρ values: {0.01, 0.25, 0.5, 1.0, 1.5, 2.0} for CIFAR10, {0.001, 0.005, 0.01, 0.1, 0.5, 1.0, 1.5, 2.0} for FMNIST and {0.005, 0.01, 0.25, 0.5, 1.0} for CIFAR100.

Original: Batch size was set to 128 in all the datasets.
Revised: Batch size was set to 128 in all the datasets.

Original: We use k -SGD to train our method.
Revised: We use k -SGD to train our method.

Original: Moreover, we use early stopping as follows.
Revised: Moreover, we use early stopping as follows.

Original: While running multiple training epochs for a ﬁxed S we use early stopping to determine when to stop.
Revised: While running multiple training epochs for a ﬁxed S we use early stopping to determine when to stop.

Original: In k -SGD , we stop training for the current S if on the validation set, the attacked set accuracy, A robust , drops.
Revised: In k -SGD , we stop training for the current S if on the validation set, the attacked set accuracy, A robust , drops.

Original: Details about a φ .
Revised: Details about a φ .

Original: For R OGET ( a φ = PGD), we set (cid:15) = 0 .
Revised: For R OGET ( a φ = PGD), we set (cid:15) = 0 .

Original: 031 , number of steps = 20 and step size = 0 .
Revised: 031 , number of steps = 20 and step size = 0 .

Original: 007 for CIFAR10 and CIFAR100 while for FMNIST, we use (cid:15) = 0 .
Revised: 007 for CIFAR10 and CIFAR100 while for FMNIST, we use (cid:15) = 0 .

Original: 3 , number of steps = 40 and step size = 0 .
Revised: 3 , number of steps = 40 and step size = 0 .

Original: For R OGET ( a φ = AdvGAN), we used the Pytorch implementation available in an online repository 10 .
Revised: For R OGET ( a φ = AdvGAN), we used the Pytorch implementation available in an online repository 10 .

Original: The same architecture was used for all the datasets with only changes to the number of input channels.
Revised: The same architecture was used for all the datasets with only changes to the number of input channels.

Original: No changes to the generator or discriminator architecture were made besides the number of input channels which was set to 1 for FMNIST and 3 for CIFAR10 and CIFAR100.
Revised: No changes to the generator or discriminator architecture were made besides the number of input channels which was set to 1 for FMNIST and 3 for CIFAR10 and CIFAR100.

Original: At the end of every iteration, we retrain AdvGAN on set S output by stochastic distorted greedy algorithm, forepochs.
Revised: At the end of every iteration, we retrain AdvGAN on set S output by stochastic distorted greedy algorithm, forepochs.

Original: Retraining AdvGAN every time we add a point to the set S in stochastic distorted greedy (SDG) algorithm increases the running time of SDG to such an extent that it becomes infeasible.
Revised: Retraining AdvGAN every time we add a point to the set S in stochastic distorted greedy (SDG) algorithm increases the running time of SDG to such an extent that it becomes infeasible.

Original: For this reason, we instead choose to retrain AdvGAN after SDG outputs a set S , for the current iteration.
Revised: For this reason, we instead choose to retrain AdvGAN after SDG outputs a set S , for the current iteration.

Original: This is equivalent to ﬁne-tuning AdvGAN to attack the set S , output by SDG.
Revised: This is equivalent to ﬁne-tuning AdvGAN to attack the set S , output by SDG.

Original: G. D ETAILS ABOUT ADVERSARIAL PERTURBATION
Revised: G. D ETAILS ABOUT ADVERSARIAL PERTURBATION

Original: For PGD attack, we used same speciﬁcations used to train R OGET ( a φ = PGD).
Revised: For PGD attack, we used same speciﬁcations used to train R OGET ( a φ = PGD).

Original: More speciﬁcally, we set (cid:15) = 0 .
Revised: More speciﬁcally, we set (cid:15) = 0 .

Original: 031 , number of steps = 20 and step size = 0 .
Revised: 031 , number of steps = 20 and step size = 0 .

Original: 007 for CIFAR10 and CIFAR100 while for FMNIST, we use (cid:15) = 0 .
Revised: 007 for CIFAR10 and CIFAR100 while for FMNIST, we use (cid:15) = 0 .

Original: 3 , number of steps = 40 and step size = 0 .
Revised: 3 , number of steps = 40 and step size = 0 .

Original: For Auto Attack, we use the standard version which consists of untargeted APGD-CE, targeted APGD-DLR, targeted FAB and Square attacks each with the default parameters.
Revised: For Auto Attack, we use the standard version which consists of untargeted APGD-CE, targeted APGD-DLR, targeted FAB and Square attacks each with the default parameters.

Original: For square attack, we set number of queries to 1000 and (cid:15) same as that for PGD attack above.
Revised: For square attack, we set number of queries to 1000 and (cid:15) same as that for PGD attack above.

Original: For applying MI-FGSM in black box setting, we take a source model trained on the chosen dataset, get the perturbed sample by computing gradients using the source model and then test the method on this obtained perturbed sample.
Revised: For applying MI-FGSM in black box setting, we take a source model trained on the chosen dataset, get the perturbed sample by computing gradients using the source model and then test the method on this obtained perturbed sample.

Original: Transfer based black box attacks are weaker than white-box attacks.
Revised: Transfer based black box attacks are weaker than white-box attacks.

Original: Hence we set the parameters of MI-FGSM to be stronger than those for PGD attack.
Revised: Hence we set the parameters of MI-FGSM to be stronger than those for PGD attack.

Original: We set (cid:15) = 0 .
Revised: We set (cid:15) = 0 .

Original: 2 , number of steps = 60 , step size = 0 .
Revised: 2 , number of steps = 60 , step size = 0 .

Original: 007 for
Revised: 007 for

Original: CIFAR10 and CIFAR100 and (cid:15) = 0 .
Revised: CIFAR10 and CIFAR100 and (cid:15) = 0 .

Original: 305 , number of steps = 80 , step size = 0 .
Revised: 305 , number of steps = 80 , step size = 0 .

Original: 01 for FMNIST.
Revised: 01 for FMNIST.

Original: For
Revised: For

Original: Square attack, we use (cid:96) ∞ norm with (cid:15)
Revised: Square attack, we use (cid:96) ∞ norm with (cid:15)

Original: = 0 .
Revised: = 0 .

Original: 031 for CIFAR10 and (cid:15)
Revised: 031 for CIFAR10 and (cid:15)

Original: = 0 .
Revised: = 0 .

Original: 3 for FMNIST.
Revised: 3 for FMNIST.

Original: G. I NFRASTRUCTURE D ETAILS
Revised: G. I NFRASTRUCTURE D ETAILS

Original: We implement R OGET using Python 3.8 and PyTorch 1.10.1.
Revised: We implement R OGET using Python 3.8 and PyTorch 1.10.1.

Original: The experiments were run on servers equipped with 2.9GHz CPUs, NVIDIA Quadro (48GB), NVIDIA RTX A6000 (48 GB), NVIDIA
Revised: The experiments were run on servers equipped with 2.9GHz CPUs, NVIDIA Quadro (48GB), NVIDIA RTX A6000 (48 GB), NVIDIA

Original: A40 (46 GB), NVIDIA Quadro RTX 8000 (49 GB) and NVIDIA TITAN RTX (24 GB) GPUs.
Revised: A40 (46 GB), NVIDIA Quadro RTX 8000 (49 GB) and NVIDIA TITAN RTX (24 GB) GPUs.

Original: G. L ICENSE
Revised: G. L ICENSE

Original: We collect the datasets from https://www.cs.toronto.edu/ ∼ kriz/cifar.html (CIFAR10 and CIFAR100), and https://www.kaggle.com/datasets/zalando-research/fashionmnist (Fashion-MNIST).
Revised: We collect the datasets from https://www.cs.toronto.edu/ ∼ kriz/cifar.html (CIFAR10 and CIFAR100), and https://www.kaggle.com/datasets/zalando-research/fashionmnist (Fashion-MNIST).

Original: These sources allow the use of datasets for research purposes.
Revised: These sources allow the use of datasets for research purposes.

Original: Furthermore, we use the following publicly available repositories— https://github.com/val-iisc/GAMA-GAT/ (GAT), https://github.com/locuslab/fast_adversarial/ (FBF), https://github.com/yaodongyu/TRADES/ (TRADES), https://github.com/val-iisc/NuAT/ (Nu-AT), https:// com
Revised: Furthermore, we use the following publicly available repositories— https://github.com/val-iisc/GAMA-GAT/ (GAT), https://github.com/locuslab/fast_adversarial/ (FBF), https://github.com/yaodongyu/TRADES/ (TRADES), https://github.com/val-iisc/NuAT/ (Nu-AT), https:// com

Original: MART (MART) to implement the baselines, https://github
Revised: MART (MART) to implement the baselines, https://github

Original: /mathcbc/
Revised: /mathcbc/

Original: _pytorch (AdvGAN) to implement AdvGAN, and https://submodlib.readthedocs io/en/latest/functions/facilityLocation.html to solve the Facility Location problem in one of our additional experiments mentioned in section H below.
Revised: _pytorch (AdvGAN) to implement AdvGAN, and https://submodlib.readthedocs io/en/latest/functions/facilityLocation.html to solve the Facility Location problem in one of our additional experiments mentioned in section H below.

Original: H A DDITIONAL EXPERIMENTS H. R ESULTS ON LOSS BASED HYPERPARAMETER SELECTION TECHNIQUE ON CIFAR10 AND FMNIST
Revised: H A DDITIONAL EXPERIMENTS H. R ESULTS ON LOSS BASED HYPERPARAMETER SELECTION TECHNIQUE ON CIFAR10 AND FMNIST

Original: We also explore another hyperparameter selection technique in which the learner assumes a subset selection strategy of the adversary.
Revised: We also explore another hyperparameter selection technique in which the learner assumes a subset selection strategy of the adversary.

Original: More speciﬁcally, the learner assumes a distribution across validation samples which is inversely proportional to the loss of a classiﬁer trained on clean samples.
Revised: More speciﬁcally, the learner assumes a distribution across validation samples which is inversely proportional to the loss of a classiﬁer trained on clean samples.

Original: Based on this strategy an attack is simulated on the validation set and the hyperparameter giving the best overall accuracy is selected.
Revised: Based on this strategy an attack is simulated on the validation set and the hyperparameter giving the best overall accuracy is selected.

Original: We present the results for CIFAR10 and FMNIST in Table
Revised: We present the results for CIFAR10 and FMNIST in Table

Original: For CIFAR
Revised: For CIFAR

Original: [Table]
Revised: [Table]

Original: we observe that our method achieves the highest overall accuracy for all attacks.
Revised: we observe that our method achieves the highest overall accuracy for all attacks.

Original: For
Revised: For

Original: FMNIST, TRADES has a better overall accuracy on AA and Square attack by a small margin
Revised: FMNIST, TRADES has a better overall accuracy on AA and Square attack by a small margin

Original: [Table]
Revised: [Table]

Original: H. E VALUATION ON LABEL BASED SUBSET SELECTION STRATEGY
Revised: H. E VALUATION ON LABEL BASED SUBSET SELECTION STRATEGY

Original: We present the complete set of results for label based subset selection strategy on CIFAR10 in Table 8 and 9.
Revised: We present the complete set of results for label based subset selection strategy on CIFAR10 in Table 8 and 9.

Original: Note that we use the worst case hyperparameter setting for all the methods.
Revised: Note that we use the worst case hyperparameter setting for all the methods.

Original: We observe that our method achieves the highest overall accuracy for all classes and for all attacks.
Revised: We observe that our method achieves the highest overall accuracy for all classes and for all attacks.

Original: [Table]
Revised: [Table]

Original: Here, the attacked subset selection is based on the uncertainty of a vanilla classiﬁer ( v ) on the test samples.
Revised: Here, the attacked subset selection is based on the uncertainty of a [Table] 76.27 FBF 72. 67.12 TRADES 81.

Original: For all the methods, we perform worst-case hyperparameter selection.
Revised: 82.05 Nu-AT 82. 83.23 MART 78.

Original: [Table]
Revised: [Table]

Original:  [Table]
Revised: 79.32 PGD-AT 81. [Table] [Table] [Table]

Revised: [Table]

Revised: [Table]

Revised: 81.86 RFGSM-AT 83.

Revised: 83.90 R OGET (

Revised: [Table]

Revised: = PGD) 84.

Revised: [Table]

Revised: [Table]

Revised: 85.47 R OGET (

Revised: [Table]

Revised: = AdvGAN) 85.

Revised: MIFGSM Airplane Automobile

Revised: Bird

Revised: Cat

Revised: Deer

Revised: Dog

Revised: Frog

Revised: Horse

Revised: Ship

Revised: Truck GAT 74.

Revised: 76.42 FBF 72.

Revised: 67.10 TRADES 79.

Revised: [Table]

Revised: attacks.

Revised: Here, attacked

Original: H. D ISCLOSING THE SUBSET SELECTION STRATEGY TO THE BASELINES
Revised: H. D ISCLOSING THE SUBSET SELECTION STRATEGY TO THE BASELINES

Original: In this experiment, we reveal the advsersary’s subset selection strategy (uncertainty based) to the baselines during hyperparameter selection.
Revised: In this experiment, we reveal the advsersary’s subset selection strategy (uncertainty based) to the baselines during hyperparameter selection.

Original: We select the hyperparameter of the baseline which has the best overall accuracy on the validation set using the revealed subset selection strategy.
Revised: We select the hyperparameter of the baseline which has the best overall accuracy on the validation set using the revealed subset selection strategy.

Original: The results are presented in Table 10.
Revised: The results are presented in Table 10.

Original: Comparing with results in Table 2, we see that GAT, TRADES, Nu-AT and
Revised: Comparing with results in Table 2, we see that GAT, TRADES, Nu-AT and

Original: MART have improved i
Revised: MART have improved i

Original: [Table]
Revised: [Table]

Original: e. , all the baselines which had a tunable hyperparameter have become better.
Revised: e. , all the baselines which had a tunable hyperparameter have become better.

Original: More importantly, our method still achieves the best overall accuracy across all attacks except PGD.
Revised: More importantly, our method still achieves the best overall accuracy across all attacks except PGD.

Original: [Table]
Revised: [Table]

Original: H. W ORST CASE OVERALL ACCURACY
Revised: H. W ORST CASE OVERALL ACCURACY

Original: In this experiment choose R = 10000 subsets { S j } Rj =1 uniformly at random from D Test and report the minimum A along with the corresponding A clean and A robust .
Revised: In this experiment choose R = 10000 subsets { S j } Rj =1 uniformly at random from D Test and report the minimum A along with the corresponding A clean and A robust .

Original: We use default hyperparameter selection and report the results for CIFAR10 and FMNIST in Table 11.
Revised: We use default hyperparameter selection and report the results for CIFAR10 and FMNIST in Table 11.

Original: We make the following observations: (1) our method achieves the best min A for PGD, AA
Revised: We make the following observations: (1) our method achieves the best min A for PGD, AA

Original: [Table]
Revised: [Table]

Original: and MIFGSM attacks on
Revised: and MIFGSM attacks on

Original: CIFAR10 and PGD, Square and MIFGSM attacks on FMNIST.
Revised: CIFAR10 and PGD, Square and MIFGSM attacks on FMNIST.

Original: (2) There is no clear winner among the baselines.
Revised: (2) There is no clear winner among the baselines.

Original: RFGSM-AT has a good A on CIFAR10 but poor A robust .
Revised: RFGSM-AT has a good A on CIFAR10 but poor A robust .

Original: For FMNIST, GAT achieves the highest A for AA.
Revised: For FMNIST, GAT achieves the highest A for AA.

Original: However it is purely because of its A clean as it has 0% A robust .
Revised: However it is purely because of its A clean as it has 0% A robust .

Original: [Table]
Revised: [Table]

Original: along with the corresponding A clean and A robust for CIFAR10 and FMNIST.

Original: For all the methods, we use default hyperparameter selection.

Original: H. T RADE OFF BETWEEN A clean AND A robust
Revised: H. T RADE OFF BETWEEN A clean AND A robust

Original: In this experiment
Revised: In this experiment

Original: [Figure]
Revised: [Figure]

Original: we evaluate various hyperparameters of the baselines and plot their A clean vs
Revised: we evaluate various hyperparameters of the baselines and plot their A clean vs

Original: A robust in Table 12 and 13.
Revised: A robust in Table 12 and 13.

Original: Each point on the plot represents a hyperparameter of the method.
Revised: Each point on the plot represents a hyperparameter of the method.

Original: Here the adversary uses uncertainty based subset selection where the true subset chosen for attack S latent consists of top 10% test instances in terms of the uncertainty of a classiﬁer trained on all the clean examples.
Revised: Here the adversary uses uncertainty based subset selection where the true subset chosen for attack S latent consists of top 10% test instances in terms of the uncertainty of a classiﬁer trained on all the clean examples.

Original: We observe that our method forms a pareto optimal front for all the attacks and hence achieves a better trade off between A clean and A robust .
Revised: We observe that our method forms a pareto optimal front for all the attacks and hence achieves a better trade off between A clean and A robust .

Original: We also notice that the baselines do not follow a regular trend and show high sensitivity with their tunable parameter.
Revised: We also notice that the baselines do not follow a regular trend and show high sensitivity with their tunable parameter.

Original: In that aspect, our method is relatively stable with respect to ρ
Revised: In that aspect, our method is relatively stable with respect to ρ

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: robust for all methods for blackbox attacks (Square,
Revised: robust for all methods for blackbox attacks (Square,

Original: MIFGSM)
Revised: MIFGSM)

Original: on CIFAR10.
Revised: on CIFAR10.

Original: Here, the adversary adopts uncertainty based subset selection to perform attack, where the true subset chosen for attack S latent consists of top 10% test instances in terms of the uncertainty of a classiﬁer trained on all the clean examples.
Revised: Here, the adversary adopts uncertainty based subset selection to perform attack, where the true subset chosen for attack S latent consists of top 10% test instances in terms of the uncertainty of a classiﬁer trained on all the clean examples.

Original: H. V ARIATION OF A robust , A clean AND A VS ρ
Revised: H. V ARIATION OF A robust , A clean AND A VS ρ

Original: On CIFAR10 dataset, we try out different values of ρ for two variants of our methods, i.e. , R OGET ( a φ = PGD) and R OGET ( a φ = AdvGAN).
Revised: On CIFAR10 dataset, we try out different values of ρ for two variants of our methods, i.e. , R OGET ( a φ = PGD) and R OGET ( a φ = AdvGAN).

Original: We probe the variation of A clean , A robust and A vs ρ for two attacks— AA (standard) and black-box MI-FGSM.
Revised: We probe the variation of A clean , A robust and A vs ρ for two attacks— AA (standard) and black-box MI-FGSM.

Original: The plot for R OGET ( a φ = PGD) is shown in Figure 14.
Revised: The plot for R OGET ( a φ = PGD) is shown in Figure 14.

Original: For each value of ρ , we test using 5 random attack-clean (1:9) splits on the test set and report the mean accuracy with standard deviation.
Revised: For each value of ρ , we test using 5 random attack-clean (1:9) splits on the test set and report the mean accuracy with standard deviation.

Original: The plot for R OGET ( a φ = AdvGAN) is shown in Figure 15.
Revised: The plot for R OGET ( a φ = AdvGAN) is shown in Figure 15.

Original: We make the following observations: (1) For white box attack (AA), the standard deviation from the mean is ± 1 .
Revised: We make the following observations: (1) For white box attack (AA), the standard deviation from the mean is ± 1 .

Original: 07% across all values of ρ and across all models.
Revised: 07% across all values of ρ and across all models.

Original: In case of black box MI-FGSM attack, the standard deviation rises to ± 3 .
Revised: In case of black box MI-FGSM attack, the standard deviation rises to ± 3 .

Original: (2) For R OGET ( a φ = PGD), A robust accuracy decreases as ρ increases (except ρ = 8 ).
Revised: (2) For R OGET ( a φ = PGD), A robust accuracy decreases as ρ increases (except ρ = 8 ).

Original: (3) For R OGET ( a φ = AdvGAN), we observe that
Revised: (3) For R OGET ( a φ = AdvGAN), we observe that

Original: A robust rises slightly before decreasing as ρ increases.
Revised: A robust rises slightly before decreasing as ρ increases.

Original: [Figure]
Revised: [Figure]

Original: [Figure]
Revised: [Figure]

Original: H. R UN - TIME AND M EMORY ANALYSIS
Revised: H. R UN - TIME AND M EMORY ANALYSIS

Original: In this section
Revised: In this section

Original: [Table]
Revised: [Table]

Original: we present details about the training time and the maximum GPU memory required for all methods while training on CIFAR10.
Revised: we present details about the training time and the maximum GPU memory required for all methods while training on CIFAR10.

Original: Note that the time mentioned for our method includes both, the time taken for a gradient step and a stochastic greedy step.
Revised: Note that the time mentioned for our method includes both, the time taken for a gradient step and a stochastic greedy step.

Original: Here, the size of the attacked subset was | S | = 0 .
Revised: Here, the size of the attacked subset was | S | = 0 .

Original: 1 | D | , where D denotes the training set.
Revised: 1 | D | , where D denotes the training set.

Original: The results are presented in Table 16.
Revised: The results are presented in Table 16.

Original: [Table]
Revised: [Table]

Original: H. A TTACK ON THE MOST VULNERABLE SET
Revised: H. A TTACK ON THE MOST VULNERABLE SET

Original: In this experiment
Revised: In this experiment

Original: [Table]
Revised: [Table]

Original: we take the ﬁnal set (cid:98) S T from our algorithm for CIFAR-10 and ﬁnd b = 0 .
Revised: we take the ﬁnal set (cid:98) S T from our algorithm for CIFAR-10 and ﬁnd b = 0 .

Original: 1 | D | number of samples with highest loss.
Revised: 1 | D | number of samples with highest loss.

Original: Then
Revised: Then

Original: [Table]
Revised: [Table]

Original: we compute the corresponding nearest samples from the test set to get the most vulnerable test set.
Revised: we compute the corresponding nearest samples from the test set to get the most vulnerable test set.

Original: We attack on this set for all the methods and show the results in Table
Revised: We attack on this set for all the methods and show the results in Table

Original: [Table]
Revised: [Table]

Original: We observe that our method makes a good trade-off between accuracy and robustness.
Revised: We observe that our method makes a good trade-off between accuracy and robustness.