Original: I MPROVING C ALIBRATION THROUGH THE R ELATIONSHIP WITH A DVERSARIAL R OBUSTNESS
Revised: I MPROVING C ALIBRATION THROUGH THE R ELATIONSHIP WITH A DVERSARIAL R OBUSTNESS

Original: Anonymous authors
Revised: Anonymous authors

Original: Paper under double-blind review
Revised: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: Neural networks lack adversarial robustness – they are vulnerable to adversarial examples that through small perturbations to inputs cause incorrect predictions.
Revised: Neural networks lack adversarial robustness – they are vulnerable to adversarial examples that through small perturbations to inputs cause incorrect predictions.

Original: Further, trust is undermined when models give miscalibrated uncertainty estimates, i.e. the predicted probability is not a good indicator of how much we should trust our model.
Revised: Further, trust is undermined when models give miscalibrated uncertainty estimates, i.e. the predicted probability is not a good indicator of how much we should trust our model.

Original: In this paper, we study the connection between adversarial robustness and calibration on four classiﬁcation networks and datasets.
Revised: In this paper, we study the connection between adversarial robustness and calibration on four classiﬁcation networks and datasets.

Original: We ﬁnd that the inputs for which the model is sensitive to small perturbations (are easily attacked) are more likely to have poorly calibrated predictions.
Revised: We ﬁnd that the inputs for which the model is sensitive to small perturbations (are easily attacked) are more likely to have poorly calibrated predictions.

Original: Based on this insight, we examine if calibration can be improved by addressing those adversarially unrobust inputs.
Revised: Based on this insight, we examine if calibration can be improved by addressing those adversarially unrobust inputs.

Original: To this end, we propose Adversarial Robustness based Adaptive Label
Revised: To this end, we propose Adversarial Robustness based Adaptive Label

Original: Smoothing ( AR-AdaLS ) that integrates the correlations of adversarial robustness and uncertainty into training by adaptively softening labels for an example based on how easily it can be attacked by an adversary.
Revised: Smoothing ( AR-AdaLS ) that integrates the correlations of adversarial robustness and uncertainty into training by adaptively softening labels for an example based on how easily it can be attacked by an adversary.

Original: We ﬁnd that our method, taking the adversarial robustness of the in-distribution data into consideration, leads to better calibration over the model even under distributional shifts.
Revised: We ﬁnd that our method, taking the adversarial robustness of the in-distribution data into consideration, leads to better calibration over the model even under distributional shifts.

Original: In addition, AR-AdaLS can also be applied to an ensemble model to further improve model’s calibration.
Revised: In addition, AR-AdaLS can also be applied to an ensemble model to further improve model’s calibration.

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: The robustness of machine learning algorithms is becoming increasingly important as ML systems are being used in higher-stakes applications.
Revised: The robustness of machine learning algorithms is becoming increasingly important as ML systems are being used in higher-stakes applications.

Original: In one line of research, neural networks are shown to lack adversarial robustness – small perturbations to the input can successfully fool classiﬁers into making incorrect predictions (Szegedy et al., 2014; Goodfellow et al., 2014; Carlini & Wagner, 2017b; Madry et al., 2017; Qin et al., 2020b).
Revised: In one line of research, neural networks are shown to lack adversarial robustness – small perturbations to the input can successfully fool classiﬁers into making incorrect predictions (Szegedy et al., 2014; Goodfellow et al., 2014; Carlini & Wagner, 2017b; Madry et al., 2017; Qin et al., 2020b).

Original: In largely separate lines of work, researchers have studied uncertainty in model’s predictions.
Revised: In largely separate lines of work, researchers have studied uncertainty in model’s predictions.

Original: For example, models are often miscalibrated where the predicted conﬁdence is not indicative of the true likelihood of the model being correct (Guo et al., 2017; Thulasidasan et al., 2019; Lakshminarayanan et al., 2017; Wen et al., 2020; Kull et al., 2019).
Revised: For example, models are often miscalibrated where the predicted conﬁdence is not indicative of the true likelihood of the model being correct (Guo et al., 2017; Thulasidasan et al., 2019; Lakshminarayanan et al., 2017; Wen et al., 2020; Kull et al., 2019).

Original: The calibration issue is exacerbated when models are asked to make predictions on data different from the training distribution (Snoek et al., 2019), which becomes an issue in practical settings where it is important that we can trust model predictions under distributional shift.
Revised: The calibration issue is exacerbated when models are asked to make predictions on data different from the training distribution (Snoek et al., 2019), which becomes an issue in practical settings where it is important that we can trust model predictions under distributional shift.

Original: Despite robustness, in all its forms, being a popular area of research, the relationship between these perspectives has not been extensively explored previously.
Revised: Despite robustness, in all its forms, being a popular area of research, the relationship between these perspectives has not been extensively explored previously.

Original: In this paper, we study the correlation between adversarial robustness and calibration.
Revised: In this paper, we study the correlation between adversarial robustness and calibration.

Original: We discover that input data that are sensitive to small adversarial perturbations (are easily attacked) are more likely to have poorly calibrated predictions.
Revised: We discover that input data that are sensitive to small adversarial perturbations (are easily attacked) are more likely to have poorly calibrated predictions.

Original: This holds true on a number of network architectures for classiﬁcation and on all the datasets that we consider: SVHN (Netzer et al., 2011), CIFAR-10 (Krizhevsky, 2009), CIFAR-100 (Krizhevsky, 2009) and ImageNet (Russakovsky et al., 2015).
Revised: This holds true on a number of network architectures for classiﬁcation and on all the datasets that we consider: SVHN (Netzer et al., 2011), CIFAR-10 (Krizhevsky, 2009), CIFAR-100 (Krizhevsky, 2009) and ImageNet (Russakovsky et al., 2015).

Original: This suggests that the miscalibrated uncertainty estimates on those adversarially unrobust data greatly degrades the performance of a model’s calibration.
Revised: This suggests that the miscalibrated uncertainty estimates on those adversarially unrobust data greatly degrades the performance of a model’s calibration.

Original: Based on this insight, we hypothesize and study if calibration can be improved by giving different supervision to the model depending on adversarial robustness of each training data.
Revised: Based on this insight, we hypothesize and study if calibration can be improved by giving different supervision to the model depending on adversarial robustness of each training data.

Original: To this end, we propose A dversarial R obustness based Ada ptive L abel S moothing ( AR-AdaLS ) that integrates the correlations of adversarial robustness and calibration into training by adaptively smoothing the training labels conditioned on how unrobust an input is.
Revised: To this end, we propose A dversarial R obustness based Ada ptive L abel S moothing ( AR-AdaLS ) that integrates the correlations of adversarial robustness and calibration into training by adaptively smoothing the training labels conditioned on how unrobust an input is.

Original: Our method improves label smoothing (Szegedy et al., 2014) by explicitly teaching the model to differentiate the training data according to their adversarial robustness and then adaptively smooth their labels.
Revised: Our method improves label smoothing (Szegedy et al., 2014) by explicitly teaching the model to differentiate the training data according to their adversarial robustness and then adaptively smooth their labels.

Original: By giving different supervision to the training data, our method leads to better calibration over the model without an increase of latency during inference.
Revised: By giving different supervision to the training data, our method leads to better calibration over the model without an increase of latency during inference.

Original: In particular, since adversarially unrobust data can be considered as an outlier of the underlying data distribution (Carlini et al., 2019), our method, by taking the adversarial robustness of the in-distribution data into consideration during training, can even greatly improve model’s calibration on held-out shifted data.
Revised: In particular, since adversarially unrobust data can be considered as an outlier of the underlying data distribution (Carlini et al., 2019), our method, by taking the adversarial robustness of the in-distribution data into consideration during training, can even greatly improve model’s calibration on held-out shifted data.

Original: Further, we propose “ AR-AdaLS of Ensemble” to combine our AR-AdaLS and deep ensembles (Lakshminarayanan et al., 2017), which is the state-of-the-art method especially under distributional shift (Snoek et al., 2019), to further improve the calibration performance for shifted data.
Revised: Further, we propose “ AR-AdaLS of Ensemble” to combine our AR-AdaLS and deep ensembles (Lakshminarayanan et al., 2017), which is the state-of-the-art method especially under distributional shift (Snoek et al., 2019), to further improve the calibration performance for shifted data.

Original: Last, we ﬁnd an additional beneﬁt of AR-AdaLS is improving model stability (i.e., decreasing variance), which is valuable in practical applications where changes in predictions across runs (churn) is problematic and deploying ensembles is too costly (Milani Fard et al., 2016).
Revised: Last, we ﬁnd an additional beneﬁt of AR-AdaLS is improving model stability (i.e., decreasing variance), which is valuable in practical applications where changes in predictions across runs (churn) is problematic and deploying ensembles is too costly (Milani Fard et al., 2016).

Original: In summary, our main contributions are as follows:
Revised: In summary, our main contributions are as follows:

Original: • Relationship among Robustness Metrics: We ﬁnd a signiﬁcant correlation between adversarial robustness and calibration: inputs that are unrobust to adversarial attacks are more likely to have poorly calibrated predictions.
Revised: • Relationship among Robustness Metrics: We ﬁnd a signiﬁcant correlation between adversarial robustness and calibration: inputs that are unrobust to adversarial attacks are more likely to have poorly calibrated predictions.

Original: • Algorithm: We propose AR-AdaLS to automatically learn how much to soften the labels of training data based on their adersarial robustness.
Revised: • Algorithm: We propose AR-AdaLS to automatically learn how much to soften the labels of training data based on their adersarial robustness.

Original: Further, we introduce “ AR-AdaLS of Ensemble” to show how to apply AR-AdaLS to an ensemble model.
Revised: Further, we introduce “ AR-AdaLS of Ensemble” to show how to apply AR-AdaLS to an ensemble model.

Original: • Experimental Analysis: On CIFAR-10, CIFAR-100 and ImageNet, we ﬁnd that AR-AdaLS is more effective than previous label smoothing methods in improving calibration, particularly for shifted data.
Revised: • Experimental Analysis: On CIFAR-10, CIFAR-100 and ImageNet, we ﬁnd that AR-AdaLS is more effective than previous label smoothing methods in improving calibration, particularly for shifted data.

Original: Further, we ﬁnd that while ensembling can be beneﬁcial, applying AR-AdaLS to adaptively calibrate ensembles offers further improvements over calibration.
Revised: Further, we ﬁnd that while ensembling can be beneﬁcial, applying AR-AdaLS to adaptively calibrate ensembles offers further improvements over calibration.

Original:  R ELATED W ORK
Revised:  R ELATED W ORK

Original: Uncertainty Estimates How to better estimate a model’s predictive uncertainty is an important research topic, since many models with a focus on accuracy may fall short in predictive uncertainty.
Revised: Uncertainty Estimates How to better estimate a model’s predictive uncertainty is an important research topic, since many models with a focus on accuracy may fall short in predictive uncertainty.

Original: A popular way to improve a model’s predictive uncertainty is to make the model well-calibrated, e.g., post-hoc calibration by temperature scaling (Guo et al., 2017), and multiclass Dirichlet calibration (Kull et al., 2019).
Revised: A popular way to improve a model’s predictive uncertainty is to make the model well-calibrated, e.g., post-hoc calibration by temperature scaling (Guo et al., 2017), and multiclass Dirichlet calibration (Kull et al., 2019).

Original: In addition, Bayesian neural networks, through learning a posterior distribution over network parameters, can also be used to quantify a model’s predictive uncertainty, e.g., Graves (2011); Blundell et al.
Revised: In addition, Bayesian neural networks, through learning a posterior distribution over network parameters, can also be used to quantify a model’s predictive uncertainty, e.g., Graves (2011); Blundell et al.

Original: ; Welling & Teh (2011).
Revised: ; Welling & Teh (2011).

Original: Dropout-based variational inference (Gal &
Revised: Dropout-based variational inference (Gal &

Original: Ghahramani, 2016; Kingma et al., 2015) can help DNN models make less over-conﬁdent predictions and be better calibrated.
Revised: Ghahramani, 2016; Kingma et al., 2015) can help DNN models make less over-conﬁdent predictions and be better calibrated.

Original: Recently, mixup training (Zhang et al., 2018) has been shown to improve both models’ generalization and calibration (Thulasidasan et al., 2019), by preventing the model from being over-conﬁdent in its predictions.
Revised: Recently, mixup training (Zhang et al., 2018) has been shown to improve both models’ generalization and calibration (Thulasidasan et al., 2019), by preventing the model from being over-conﬁdent in its predictions.

Original: Despite the success of improving uncertainty estimates over in-distribution data, Snoek et al.
Revised: Despite the success of improving uncertainty estimates over in-distribution data, Snoek et al.

Original: (2019) argue that it does not usually translate to a better performance on data that shift from the training distribution.
Revised: (2019) argue that it does not usually translate to a better performance on data that shift from the training distribution.

Original: Among all the methods evaluated by Snoek et al.
Revised: Among all the methods evaluated by Snoek et al.

Original: (2019) under distributional shift, ensemble of deep neural networks (Lakshminarayanan et al., 2017), is shown to be most robust to dataset shift, producing the best uncertainty estimates.
Revised: (2019) under distributional shift, ensemble of deep neural networks (Lakshminarayanan et al., 2017), is shown to be most robust to dataset shift, producing the best uncertainty estimates.

Original: Adversarial Robustness On the other hand, machine learning models are known to be brittle (Xin et al., 2017) and vulnerable to adversarial examples (Athalye et al., 2018; Carlini & Wagner, 2017a;b;
Revised: Adversarial Robustness On the other hand, machine learning models are known to be brittle (Xin et al., 2017) and vulnerable to adversarial examples (Athalye et al., 2018; Carlini & Wagner, 2017a;b;

Original: He et al., 2018).
Revised: He et al., 2018).

Original: Many defenses have been proposed to improve model’s adversarial robustness (Song et al., 2017; Yang et al., 2019; Goodfellow et al., 2018), however are further attacked by more advanced defense-aware attacks (Carlini & Wagner, 2017b; Athalye et al., 2018).
Revised: Many defenses have been proposed to improve model’s adversarial robustness (Song et al., 2017; Yang et al., 2019; Goodfellow et al., 2018), however are further attacked by more advanced defense-aware attacks (Carlini & Wagner, 2017b; Athalye et al., 2018).

Original: Recently, Carlini et al.
Revised: Recently, Carlini et al.

Original: (2019); Stock & Ciss´e (2018) deﬁne adversarial robustness as the minimum distance in the input domain required to change the model’s output prediction by constructing an adversarial attack.
Revised: (2019); Stock & Ciss´e (2018) deﬁne adversarial robustness as the minimum distance in the input domain required to change the model’s output prediction by constructing an adversarial attack.

Original: The most recent work that is close to ours, Carlini et al.
Revised: The most recent work that is close to ours, Carlini et al.

Original: (2019), makes the interesting observation that easily attackable data are often outliers in the underlying data distribution and then use adversarial robustness to determine an improved ordering for curriculum learning.
Revised: (2019), makes the interesting observation that easily attackable data are often outliers in the underlying data distribution and then use adversarial robustness to determine an improved ordering for curriculum learning.

Original: Our work, instead, explores the relationship between adversarial robustness and calibration.
Revised: Our work, instead, explores the relationship between adversarial robustness and calibration.

Original: In addition, we use adversarial robustness as an indicator to adaptively smooth the training labels to improve model’s calibration.
Revised: In addition, we use adversarial robustness as an indicator to adaptively smooth the training labels to improve model’s calibration.

Original: Label Smoothing Label smoothing is originally proposed in Szegedy et al.
Revised: Label Smoothing Label smoothing is originally proposed in Szegedy et al.

Original: and is shown to be effective in improving the quality of uncertainty estimates in M ¨ uller et al.
Revised: and is shown to be effective in improving the quality of uncertainty estimates in M ¨ uller et al.

Original: ; Thulasidasan
Revised: ; Thulasidasan

Original: [Table]
Revised: [Table]

Original: et al.
Revised: et al.

Original: Instead of minimizing the cross-entropy loss between the predicted probability ˆ p and the one-hot label p , label smoothing minimizes the cross-entropy between the predicted probability and a softened label (cid:101) p = p (1 − (cid:15) )
Revised: Instead of minimizing the cross-entropy loss between the predicted probability ˆ p and the one-hot label p , label smoothing minimizes the cross-entropy between the predicted probability and a softened label (cid:101) p = p (1 − (cid:15) )

Original: + (cid:15)Z , where Z is the number of classes in the dataset and (cid:15) is a hyperparameter which controls the degree of the smoothing effect.
Revised: + (cid:15)Z , where Z is the number of classes in the dataset and (cid:15) is a hyperparameter which controls the degree of the smoothing effect.

Original: Our work makes label smoothing adaptive and incorporates the correlation with adversarial robustness to further improve calibration.
Revised: Our work makes label smoothing adaptive and incorporates the correlation with adversarial robustness to further improve calibration.

Original:  C ORRELATIONS BETWEEN ADVERSARIAL ROBUSTNESS AND C ALIBRATION
Revised:  C ORRELATIONS BETWEEN ADVERSARIAL ROBUSTNESS AND C ALIBRATION

Original: To explore the relationship between adversarial robustness and calibration, we ﬁrst introduce the metrics to evaluate each of them.
Revised: To explore the relationship between adversarial robustness and calibration, we ﬁrst introduce the metrics to evaluate each of them.

Original: We use arrows to indicate which direction is better.
Revised: We use arrows to indicate which direction is better.

Original: Adversarial robustness ↑ Adversarial robustness measures the minimum distance in the input domain required to change the model’s output prediction by constructing an adversarial attack (Carlini et al., 2019; Stock & Ciss ´ e, 2018).
Revised: Adversarial robustness ↑ Adversarial robustness measures the minimum distance in the input domain required to change the model’s output prediction by constructing an adversarial attack (Carlini et al., 2019; Stock & Ciss ´ e, 2018).

Original: Speciﬁcally, given an input x and a classiﬁer f ( · ) that predicts the class for the input, the adversarial robustness is deﬁned as the minimum adversarial perturbation δ that enables f ( x + δ ) (cid:54) =
Revised: Speciﬁcally, given an input x and a classiﬁer f ( · ) that predicts the class for the input, the adversarial robustness is deﬁned as the minimum adversarial perturbation δ that enables f ( x + δ ) (cid:54) =

Original: f
Revised: f

Original: ( x ) .
Revised: ( x ) .

Original: Following the work (Carlini et al., 2019), we construct the (cid:96)based CW attack (Carlini & Wagner, 2017b) and then use the (cid:96) 2 norm of the adversarial perturbation (cid:107) δ (cid:107) 2 to measure the distance to the decision boundary.
Revised: Following the work (Carlini et al., 2019), we construct the (cid:96)based CW attack (Carlini & Wagner, 2017b) and then use the (cid:96) 2 norm of the adversarial perturbation (cid:107) δ (cid:107) 2 to measure the distance to the decision boundary.

Original: Therefore, a more adversarially robust input requires a larger adversarial perturbation to change the model’s prediction.
Revised: Therefore, a more adversarially robust input requires a larger adversarial perturbation to change the model’s prediction.

Original: Calibration metric ↓ Model’s calibration measures the alignment between the predicted probability and the accuracy.
Revised: Calibration metric ↓ Model’s calibration measures the alignment between the predicted probability and the accuracy.

Original: Well calibrated uncertainty estimates convey the information about how much we should trust a model’s prediction.
Revised: Well calibrated uncertainty estimates convey the information about how much we should trust a model’s prediction.

Original: We follow the widely used expected calibration error ( ECE ) to measure the calibration performance of a network (Guo et al., 2017; Snoek et al., 2019).
Revised: We follow the widely used expected calibration error ( ECE ) to measure the calibration performance of a network (Guo et al., 2017; Snoek et al., 2019).

Original: To compute the ECE, we need to ﬁrst divide all the data into K buckets sorted by their predicted probability (conﬁdence) of the predicted class.
Revised: To compute the ECE, we need to ﬁrst divide all the data into K buckets sorted by their predicted probability (conﬁdence) of the predicted class.

Original: Let B k represent the set of data in the k -th conﬁdence bucket.
Revised: Let B k represent the set of data in the k -th conﬁdence bucket.

Original: Then the accuracy and the conﬁdence of B k are deﬁned as acc( B k ) =
Revised: Then the accuracy and the conﬁdence of B k are deﬁned as acc( B k ) =

Original: 1 | B k | (cid:80) i ∈
Revised: 1 | B k | (cid:80) i ∈

Original: B k 1 (ˆ y i
Revised: B k 1 (ˆ y i

Original: =
Revised: =

Original: y i ) and conf( B k )
Revised: y i ) and conf( B k )

Original: = 1 | B k | (cid:80) i ∈
Revised: = 1 | B k | (cid:80) i ∈

Original: B
Revised: B

Original: k
Revised: k

Original: ˆ p ˆ
Revised: ˆ p ˆ

Original: y
Revised: y

Original: i
Revised: i

Original: i , where ˆ y and y represent the predicted class and the true class respectively, and ˆ p ˆ y is the predicted probability of ˆ y .
Revised: i , where ˆ y and y represent the predicted class and the true class respectively, and ˆ p ˆ y is the predicted probability of ˆ y .

Original: The ECE is then deﬁned as ECE =
Revised: The ECE is then deﬁned as ECE =

Original: (cid:80)
Revised: (cid:80)

Original: Kk =1 | B k | N | acc( B k ) − conf( B k ) | , where N is the number of the data.
Revised: Kk =1 | B k | N | acc( B k ) − conf( B k ) | , where N is the number of the data.

Original: 3. C ORRELATIONS
Revised: 3. C ORRELATIONS

Original: In this section, we perform experiments on the clean test set across four datasets: SVHN (Netzer et al., 2011), CIFAR-10 (Krizhevsky, 2009), CIFAR-100 (Krizhevsky, 2009) and ImageNet (Russakovsky et al., 2015) with different networks, whose architecture and accuracy are shown in Table 1.
Revised: In this section, we perform experiments on the clean test set across four datasets: SVHN (Netzer et al., 2011), CIFAR-10 (Krizhevsky, 2009), CIFAR-100 (Krizhevsky, 2009) and ImageNet (Russakovsky et al., 2015) with different networks, whose architecture and accuracy are shown in Table 1.

Original: We refer to these models as “Vanilla” for each dataset in the following discussion.
Revised: We refer to these models as “Vanilla” for each dataset in the following discussion.

Original: The details for training each vanilla network are included in Section A in the Appendix.
Revised: The details for training each vanilla network are included in Section A in the Appendix.

Original: To explore the relationship between adversarial robustness and calibration, we start with the relationship between adversarial robustness and conﬁdence together with accuracy.
Revised: To explore the relationship between adversarial robustness and calibration, we start with the relationship between adversarial robustness and conﬁdence together with accuracy.

Original: Speciﬁcally, we rank the input data according to their adversarial robustness and then divide the dataset into R equally-sized subsets ( R = 10 used in this paper).
Revised: Speciﬁcally, we rank the input data according to their adversarial robustness and then divide the dataset into R equally-sized subsets ( R = 10 used in this paper).

Original: For each adversarial robustness subset, we compute the accuracy and the average conﬁdence score of the predicted class.
Revised: For each adversarial robustness subset, we compute the accuracy and the average conﬁdence score of the predicted class.

Original: As shown in the ﬁrst row in Figure 1, we can clearly see that both accuracy and conﬁdence increase as adversarial robustness of the input data, and conﬁdence is consistently higher than accuracy in each adversarial robustness subset across four datasets.
Revised: As shown in the ﬁrst row in Figure 1, we can clearly see that both accuracy and conﬁdence increase as adversarial robustness of the input data, and conﬁdence is consistently higher than accuracy in each adversarial robustness subset across four datasets.

Original: This indicates that although vanilla classiﬁcation models achieve the state-of-the-art accuracy, they tend to give over-conﬁdent predictions, especially for those unrobust data.
Revised: This indicates that although vanilla classiﬁcation models achieve the state-of-the-art accuracy, they tend to give over-conﬁdent predictions, especially for those unrobust data.

Original: Based on this, to explore the relationship between adversarial robustness and calibration, we compute the expected calibration error (ECE) in each adversarial robustness subset, shown in the bottom row of Figure 1.
Revised: Based on this, to explore the relationship between adversarial robustness and calibration, we compute the expected calibration error (ECE) in each adversarial robustness subset, shown in the bottom row of Figure 1.

Original: In general, we ﬁnd that those unrobust data in lower adversarial robustness levels are more likely to be over-conﬁdent and less well calibrated (larger ECE).
Revised: In general, we ﬁnd that those unrobust data in lower adversarial robustness levels are more likely to be over-conﬁdent and less well calibrated (larger ECE).

Original: For more robust examples, there is a better alignment between their conﬁdence and accuracy, and the ECE over those examples is close to 0.
Revised: For more robust examples, there is a better alignment between their conﬁdence and accuracy, and the ECE over those examples is close to 0.

Original: On larger-scale ImageNet, while we still see the general trend that less robust examples are less well calibrated, we see that the least robust examples are relatively well calibrated.
Revised: On larger-scale ImageNet, while we still see the general trend that less robust examples are less well calibrated, we see that the least robust examples are relatively well calibrated.

Original: We hypothesize this may be due to larger data and less overﬁtting.
Revised: We hypothesize this may be due to larger data and less overﬁtting.

Original: Furthermore, we also ﬁnd an interesting correlation between adversarial robustness and model stability, which is measured by the variance of the predicted probability across 5 independent runs.
Revised: Furthermore, we also ﬁnd an interesting correlation between adversarial robustness and model stability, which is measured by the variance of the predicted probability across 5 independent runs.

Original: As shown in the bottom row of Figure 1, we see that those adversarially unrobust examples tend to have a much higher variance compared to the robust across all four datasets.
Revised: As shown in the bottom row of Figure 1, we see that those adversarially unrobust examples tend to have a much higher variance compared to the robust across all four datasets.

Original:  M ETHOD
Revised:  M ETHOD

Original: Based on the correlation between adversarial robustness and calibration, we hypothesize and study if calibration can be improved by giving different supervision to the model depending on the adversarial robustness of training data.
Revised: Based on the correlation between adversarial robustness and calibration, we hypothesize and study if calibration can be improved by giving different supervision to the model depending on the adversarial robustness of training data.

Original: To this end, we propose a method named A dversarial R obustness based
Revised: To this end, we propose a method named A dversarial R obustness based

Original: Ada ptive L abel S moothing ( AR-AdaLS ), which performs label smoothing at different degrees to the training data based on their adversarial robustness.
Revised: Ada ptive L abel S moothing ( AR-AdaLS ), which performs label smoothing at different degrees to the training data based on their adversarial robustness.

Original: Speciﬁcally, we sort and divide the training data into R small subsets with equal size according to their adversarial robustness 1 and then use (cid:15) r to soften the labels in each training subset S trainr .
Revised: Speciﬁcally, we sort and divide the training data into R small subsets with equal size according to their adversarial robustness 1 and then use (cid:15) r to soften the labels in each training subset S trainr .

Original: The soft labels can be formulated as:
Revised: The soft labels can be formulated as:

Original: [Equation]
Revised: [Equation]

Original: where p z = y r = 1 for the correct class y and p z (cid:54) =
Revised: where p z = y r = 1 for the correct class y and p z (cid:54) =

Original: y r = 0 for the others, p r stands for the one-hot label, and Z is the number of classes in the dataset.
Revised: y r = 0 for the others, p r stands for the one-hot label, and Z is the number of classes in the dataset.

Original: The parameter (cid:15) r controls the degree of smoothing effect and allows for different levels of smoothing in each adversarial robustness subset.
Revised: The parameter (cid:15) r controls the degree of smoothing effect and allows for different levels of smoothing in each adversarial robustness subset.

Original: Generally, a relatively larger (cid:15) r is desirable for lower adversarial robustness levels such that the model learns to make a lower conﬁdence prediction.
Revised: Generally, a relatively larger (cid:15) r is desirable for lower adversarial robustness levels such that the model learns to make a lower conﬁdence prediction.

Original: Instead of empirically setting the parameter (cid:15) r in each adversarial robustness subset, we allow it to be adaptively updated according to the calibration performance on the validation set (discussed in Section 4.1).
Revised: Instead of empirically setting the parameter (cid:15) r in each adversarial robustness subset, we allow it to be adaptively updated according to the calibration performance on the validation set (discussed in Section 4.1).

Original: In this way, we explicitly train a network with different supervision based on the adversarial robustness of training data.
Revised: In this way, we explicitly train a network with different supervision based on the adversarial robustness of training data.

Original: 4. A DAPTIVE LEARNING MECHANISM
Revised: 4. A DAPTIVE LEARNING MECHANISM

Original: To ﬁnd the best hyperparameter (cid:15) for label smoothing, previous methods (Szegedy et al., 2016;
Revised: To ﬁnd the best hyperparameter (cid:15) for label smoothing, previous methods (Szegedy et al., 2016;

Original: Thulasidasan et al., 2019) sweep (cid:15) in a range and choose the one that has the best validation performance.
Revised: Thulasidasan et al., 2019) sweep (cid:15) in a range and choose the one that has the best validation performance.

Original: However, in our setting, the number of combinations of (cid:15) r increases exponentially with the number of adversarial robustness subsets R .
Revised: However, in our setting, the number of combinations of (cid:15) r increases exponentially with the number of adversarial robustness subsets R .

Original: To this end, we propose an adaptive learning mechanism to automatically learn the parameter (cid:15) r in each adversarial robustness subset.
Revised: To this end, we propose an adaptive learning mechanism to automatically learn the parameter (cid:15) r in each adversarial robustness subset.

Original: The overall training procedure is summarized in Algorithm 1.
Revised: The overall training procedure is summarized in Algorithm 1.

Original: First, we denote the soft label for the correct class in the r -th adversarial robustness subset as (cid:101) p z
Revised: First, we denote the soft label for the correct class in the r -th adversarial robustness subset as (cid:101) p z

Original: = y r .
Revised: = y r .

Original: According to Eqn.
Revised: According to Eqn.

Original: (1), we can derive:
Revised: (1), we can derive:

Original: Input: adaptive
Revised: Input: adaptive

Original: For each adversarial robustness training subset, we initialize the soft label as the one-hot label (cid:101) p r,t = p r , and initialize the soft label for the correct class (cid:101)
Revised: For each adversarial robustness training subset, we initialize the soft label as the one-hot label (cid:101) p r,t = p r , and initialize the soft label for the correct class (cid:101)

Original: p z = y r,t = 1 .
Revised: p z = y r,t = 1 .

Original: for t = 1 to T do
Revised: for t = 1 to T do

Original: Minimize cross-entropy loss between soft label and predicted probability 1 R (cid:80)
Revised: Minimize cross-entropy loss between soft label and predicted probability 1 R (cid:80)

Original: Rr L ( (cid:101) p r,t , ˆ p r,t ) for r = 1 to R do
Revised: Rr L ( (cid:101) p r,t , ˆ p r,t ) for r = 1 to R do

Original: Update (cid:101) p
Revised: Update (cid:101) p

Original: z
Revised: z

Original: = y r,t ← (cid:101) p z = y r,t − α · { conf( S valr ) t − acc
Revised: = y r,t ← (cid:101) p z = y r,t − α · { conf( S valr ) t − acc

Original: S valr ) t } (cid:46)
Revised: S valr ) t } (cid:46)

Original: according to Eqn.
Revised: according to Eqn.

Original: Clip (cid:101) p
Revised: Clip (cid:101) p

Original: z
Revised: z

Original: = y r,t to be within ( 1 Z , 1 ]
Revised: = y r,t to be within ( 1 Z , 1 ]

Original: Update (cid:15) r,t ← ( (cid:101) p
Revised: Update (cid:15) r,t ← ( (cid:101) p

Original: z = y r,t − 1) ·
Revised: z = y r,t − 1) ·

Original: Z 1 − Z (cid:46) according to Eqn.
Revised: Z 1 − Z (cid:46) according to Eqn.

Original: Update (cid:101) p r,t ← p r (1 − (cid:15) r,t ) + (cid:15) r,t Z (cid:46) according to Eqn.
Revised: Update (cid:101) p r,t ← p r (1 − (cid:15) r,t ) + (cid:15) r,t Z (cid:46) according to Eqn.

Original: (1) end for end for (cid:101)
Revised: (1) end for end for (cid:101)

Original: p z = y r =
Revised: p z = y r =

Original: [Equation]
Revised: [Equation]

Original: − (cid:15) r + (cid:15) r Z .
Revised: − (cid:15) r + (cid:15) r Z .

Original: Since well-calibrated uncertainty estimates should be aligned with the empirical accuracy, we use the calibration performance in the validation set to help update (cid:101) p
Revised: Since well-calibrated uncertainty estimates should be aligned with the empirical accuracy, we use the calibration performance in the validation set to help update (cid:101) p

Original: z = y r for the training data .
Revised: z = y r for the training data .

Original: Speciﬁcally, we ﬁrst rank the adversarial robustness of the validation data and split the validation set into R equally-sized subsets.
Revised: Speciﬁcally, we ﬁrst rank the adversarial robustness of the validation data and split the validation set into R equally-sized subsets.

Original: Then, we use the difference between conﬁdence and accuracy in the r -th adversarial robustness validation subset conf( S valr ) − acc( S valr ) to update the soft label for the correct class of training data in the r -th adversarial robustness training subset S trainr ,
Revised: Then, we use the difference between conﬁdence and accuracy in the r -th adversarial robustness validation subset conf( S valr ) − acc( S valr ) to update the soft label for the correct class of training data in the r -th adversarial robustness training subset S trainr ,

Original: [Equation]
Revised: [Equation]

Original: where (cid:101) p
Revised: where (cid:101) p

Original: z = y r,t is the soft label of the correct class in the r -th adversarial robustness training subset at time step t .
Revised: z = y r,t is the soft label of the correct class in the r -th adversarial robustness training subset at time step t .

Original: The accuracy and the conﬁdence of S valr are deﬁned as acc( S valr ) =
Revised: The accuracy and the conﬁdence of S valr are deﬁned as acc( S valr ) =

Original: 1 | S valr | (cid:80) i ∈
Revised: 1 | S valr | (cid:80) i ∈

Original: S valr 1 (ˆ y i
Revised: S valr 1 (ˆ y i

Original: =
Revised: =

Original: y i ) and conf( S valr )
Revised: y i ) and conf( S valr )

Original: =
Revised: =

Original: 1 | S valr | (cid:80) i ∈
Revised: 1 | S valr | (cid:80) i ∈

Original: S valr ˆ p z
Revised: S valr ˆ p z

Original: =ˆ
Revised: =ˆ

Original: y i
Revised: y i

Original: i , where ˆ y and y is the predicted class and the true class respectively, ˆ p z
Revised: i , where ˆ y and y is the predicted class and the true class respectively, ˆ p z

Original: =ˆ y denotes the the predicted probability of the predicted class.
Revised: =ˆ y denotes the the predicted probability of the predicted class.

Original: The hyperparameter α > 0 plays a role as a learning rate to update the soft label (cid:101)
Revised: The hyperparameter α > 0 plays a role as a learning rate to update the soft label (cid:101)

Original: p z = y r,t based on the difference between the predicted conﬁdence and accuracy in the valiadation set.
Revised: p z = y r,t based on the difference between the predicted conﬁdence and accuracy in the valiadation set.

Original: Intuitively, if we assign a large (cid:101) p
Revised: Intuitively, if we assign a large (cid:101) p

Original: z = y r to training data, then the network tends to make a high conﬁdence prediction and vice versa.
Revised: z = y r to training data, then the network tends to make a high conﬁdence prediction and vice versa.

Original: Therefore, if the conﬁdence is greater than the accuracy ( conf( S valr ) >
Revised: Therefore, if the conﬁdence is greater than the accuracy ( conf( S valr ) >

Original: acc( S valr )) ) in the validation set, we should reduce (cid:101) p
Revised: acc( S valr )) ) in the validation set, we should reduce (cid:101) p

Original: z = y r to teach the network to be less conﬁdent.
Revised: z = y r to teach the network to be less conﬁdent.

Original: Otherwise, we should increase (cid:101) p
Revised: Otherwise, we should increase (cid:101) p

Original: z = y r .
Revised: z = y r .

Original: In addition, we also need to constrain (cid:101) p
Revised: In addition, we also need to constrain (cid:101) p

Original: z
Revised: z

Original: =
Revised: =

Original: y r to be within ( 1 Z , 1] after each update as it stands for the true probability of the correct class, where Z is the number of classes in the dataset.
Revised: y r to be within ( 1 Z , 1] after each update as it stands for the true probability of the correct class, where Z is the number of classes in the dataset.

Original: For a given (cid:101) p z = y r , we can easily obtain
Revised: For a given (cid:101) p z = y r , we can easily obtain

Original: [Equation]
Revised: [Equation]

Original: r by reversing Eqn.
Revised: r by reversing Eqn.

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: and the soft labels for all the classes (cid:101) p r can be computed according to Eqn.
Revised: and the soft labels for all the classes (cid:101) p r can be computed according to Eqn.

Original: We update the soft labels after each training epoch in our experiments.
Revised: We update the soft labels after each training epoch in our experiments.

Original: Note that this adaptive learning mechanism can be easily applied to standard label smoothing without adversarial robustness slicing ( R = 1 ).
Revised: Note that this adaptive learning mechanism can be easily applied to standard label smoothing without adversarial robustness slicing ( R = 1 ).

Original: In this case, we can replace sweeping the hyperparameter (cid:15) with this adaptive learning method, named as “ Ada ptive L abel S moothing” ( AdaLS ).
Revised: In this case, we can replace sweeping the hyperparameter (cid:15) with this adaptive learning method, named as “ Ada ptive L abel S moothing” ( AdaLS ).

Original: Our proposed
Revised: Our proposed

Original: AdaLS and AR-AdaLS does not increase the inference time: we test AdaLS and AR-AdaLS exactly the same as a vanilla model.
Revised: AdaLS and AR-AdaLS does not increase the inference time: we test AdaLS and AR-AdaLS exactly the same as a vanilla model.

Original:  E XPERIMENTS
Revised:  E XPERIMENTS

Original: We now test our methods on both clean and shifted data for CIFAR-10, CIFAR-100 and ImageNet for calibration.
Revised: We now test our methods on both clean and shifted data for CIFAR-10, CIFAR-100 and ImageNet for calibration.

Original: The shifted dataset (Hendrycks & Dietterich, 2019) consists of different types ( types for CIFAR-10, 17 types for CIFAR-100 and 15 types for ImageNet) of corruptions, e.g., noise, blur, weather and digital categories that are frequently encountered in natural images.
Revised: The shifted dataset (Hendrycks & Dietterich, 2019) consists of different types ( types for CIFAR-10, 17 types for CIFAR-100 and 15 types for ImageNet) of corruptions, e.g., noise, blur, weather and digital categories that are frequently encountered in natural images.

Original: Each type of corruption has ﬁve levels of shift intensity, with higher levels having more corruption.
Revised: Each type of corruption has ﬁve levels of shift intensity, with higher levels having more corruption.

Original: For each shift intensity, we report the results with a box plot summarizing the 25th, 50th, 75th quartiles across the
Revised: For each shift intensity, we report the results with a box plot summarizing the 25th, 50th, 75th quartiles across the

Original: [Table]
Revised: [Table]

Original: types of shift.
Revised: types of shift.

Original: We ﬁrst test single-model approaches and then explore how our methods compose with deep ensembles (Lakshminarayanan et al., 2017).
Revised: We ﬁrst test single-model approaches and then explore how our methods compose with deep ensembles (Lakshminarayanan et al., 2017).

Original: 5. B ASELINES
Revised: 5. B ASELINES

Original: We compare our proposed AR-AdaLS with the following methods: Vanilla model that is trained with one-hot labels, Temperature Scaling (Guo et al., 2017), label smoothing ( LS ) (Szegedy et al., 2016) that softs labels by sweeping the hyperparameter (cid:15) which controls the smoothing degree in a range to ﬁnd the best hyperparameter (cid:15) , Adaptive Label Smoothing ( AdaLS ): we use our proposed adaptive learning mechanism introduced in Section 4.1 to automatically learn the hyperparameter (cid:15) rather than sweeping to ﬁnd the best (cid:15) .
Revised: We compare our proposed AR-AdaLS with the following methods: Vanilla model that is trained with one-hot labels, Temperature Scaling (Guo et al., 2017), label smoothing ( LS ) (Szegedy et al., 2016) that softs labels by sweeping the hyperparameter (cid:15) which controls the smoothing degree in a range to ﬁnd the best hyperparameter (cid:15) , Adaptive Label Smoothing ( AdaLS ): we use our proposed adaptive learning mechanism introduced in Section 4.1 to automatically learn the hyperparameter (cid:15) rather than sweeping to ﬁnd the best (cid:15) .

Original: In addition, we also report the results of Ensemble of
Revised: In addition, we also report the results of Ensemble of

Original: Vanilla (Lakshminarayanan et al., 2017) with M = 5 vanilla models independently trained with random initialization.
Revised: Vanilla (Lakshminarayanan et al., 2017) with M = 5 vanilla models independently trained with random initialization.

Original: We will further discuss that our method is complementary to deep ensembles.
Revised: We will further discuss that our method is complementary to deep ensembles.

Original: All the methods are trained with the same network architectures and training hyperparameters: e.g., learning rate, batch size, number of training epochs, for fair comparison.
Revised: All the methods are trained with the same network architectures and training hyperparameters: e.g., learning rate, batch size, number of training epochs, for fair comparison.

Original: Please refer to Appendix A for all the training details and hyperparameters.
Revised: Please refer to Appendix A for all the training details and hyperparameters.

Original: 5. I MPROVEMENTS OVER S INGLE M ODEL
Revised: 5. I MPROVEMENTS OVER S INGLE M ODEL

Original: Ablation Study There are two options to compute adversarial robustness.
Revised: Ablation Study There are two options to compute adversarial robustness.

Original: One is “on-the-ﬂy”: to keep creating adversarial attacks during training, which provides precise adversarial robustness ranking but at the cost of great computing time.
Revised: One is “on-the-ﬂy”: to keep creating adversarial attacks during training, which provides precise adversarial robustness ranking but at the cost of great computing time.

Original: The other is to “pre-compute” adversarial robustness by attacking a vanilla model.
Revised: The other is to “pre-compute” adversarial robustness by attacking a vanilla model.

Original: This is more efﬁcient but at the sacriﬁce of the precision of adversarial robustness ranking.
Revised: This is more efﬁcient but at the sacriﬁce of the precision of adversarial robustness ranking.

Original: We perform experiments on CIFAR-100 as an example to compare the performance of AR-AdaLS based on the adversarial robustness that is “pre-computed” or “on-the-ﬂy”.
Revised: We perform experiments on CIFAR-100 as an example to compare the performance of AR-AdaLS based on the adversarial robustness that is “pre-computed” or “on-the-ﬂy”.

Original: As shown in Table 2, generating adversarial robustness “on-the-ﬂy” helps improve the calibration performance further for AR-AdaLS on both clean and shifted datasets compared to pre-computing adversarial robustness.
Revised: As shown in Table 2, generating adversarial robustness “on-the-ﬂy” helps improve the calibration performance further for AR-AdaLS on both clean and shifted datasets compared to pre-computing adversarial robustness.

Original: When comparing AR-AdaLS with other single-model based methods, we can see that all models have similar accuracy on clean and shifted datasets.
Revised: When comparing AR-AdaLS with other single-model based methods, we can see that all models have similar accuracy on clean and shifted datasets.

Original: Both versions of AR-AdaLS signiﬁcantly improve the calibration performance over label smoothing, especially under distributional shifts.
Revised: Both versions of AR-AdaLS signiﬁcantly improve the calibration performance over label smoothing, especially under distributional shifts.

Original: Further, we observe that AR-AdaLS with pre-computed adversarial robustness has similar performance as Temperature Scaling but AR-AdaLS based on more precise adversarial robustness (“on-the-ﬂy”) is signiﬁcantly better 2 .
Revised: Further, we observe that AR-AdaLS with pre-computed adversarial robustness has similar performance as Temperature Scaling but AR-AdaLS based on more precise adversarial robustness (“on-the-ﬂy”) is signiﬁcantly better 2 .

Original: In the following sections, all results related to “ AR-AdaLS ” are based on pre-computed adversarial robustness for efﬁciency.
Revised: In the following sections, all results related to “ AR-AdaLS ” are based on pre-computed adversarial robustness for efﬁciency.

Original: This is because our main target pre-computed AR-AdaLS improves on LS and performs nearly as well as TS on
Revised: This is because our main target pre-computed AR-AdaLS improves on LS and performs nearly as well as TS on

Original: CIFAR-10 and ImageNet.
Revised: CIFAR-10 and ImageNet.

Original: We also see similar improvements from on-the-ﬂy AR-AdaLS on CIFAR-10, but we did not run on-the-ﬂy AR-AdaLS for ImageNet due to the computational intensity. is to show that the idea of differentiating the training data based on their adversarial robustness is promising to improve model’s calibration rather than pushing the results to the best.
Revised: We also see similar improvements from on-the-ﬂy AR-AdaLS on CIFAR-10, but we did not run on-the-ﬂy AR-AdaLS for ImageNet due to the computational intensity. is to show that the idea of differentiating the training data based on their adversarial robustness is promising to improve model’s calibration rather than pushing the results to the best.

Original: Visualization of improvement over label smoothing Since our proposed AR-AdaLS is built upon label smoothing (LS), in Figure 2 we visualize the effect of label smoothing (LS) and
Revised: Visualization of improvement over label smoothing Since our proposed AR-AdaLS is built upon label smoothing (LS), in Figure 2 we visualize the effect of label smoothing (LS) and

Original: our
Revised: our

Original: AR-AdaLS .
Revised: AR-AdaLS .

Original: Comparing Figure 2 (a) and (b).
Revised: Comparing Figure 2 (a) and (b).

Original: AR-AdaLS is better at calibrating the data than label smoothing, especially on the unrobust examples (lower adversarial robustness level).
Revised: AR-AdaLS is better at calibrating the data than label smoothing, especially on the unrobust examples (lower adversarial robustness level).

Original: Further, we show plots of ECE in Figure 2 (c).
Revised: Further, we show plots of ECE in Figure 2 (c).

Original: Both label smoothing and AR-AdaLS improve model’s calibration over vanilla model and AR-AdaLS has the best performance among three methods.
Revised: Both label smoothing and AR-AdaLS improve model’s calibration over vanilla model and AR-AdaLS has the best performance among three methods.

Original: This suggests that AR-AdaLS is better at improving calibration in unrobust regions, not just on average.
Revised: This suggests that AR-AdaLS is better at improving calibration in unrobust regions, not just on average.

Original: Generalization over shifted dataset Figure 9 and Table 3 summarizes the ECE for CIFAR-10 and ImageNet for both clean and shifted data with different levels of corruptions (Hendrycks & Dietterich, 2019).
Revised: Generalization over shifted dataset Figure 11 and Table 4 summarizes the ECE for CIFARand ImageNet for both clean and shifted data with different levels of corruptions (Hendrycks & Dietterich, 2019).

Original: On the clean test set, all non-vanilla methods achieve comparable low values of ECE.
Revised: On the clean test set, all non-vanilla methods achieve comparable low values of ECE.

Original: When the intensity of shift increases, AR-AdaLS signiﬁcantly outperforms other single-model based methods with the lowest ECE.
Revised: When the intensity of shift increases, AR-AdaLS signiﬁcantly outperforms other singlemodel based methods with the lowest ECE.

Original: Contrasting with LS and AdaLS , we see AR-AdaLS beneﬁts greatly from the adversarial robustness slicing.
Revised: Contrasting with LS and AdaLS , we see AR-AdaLS beneﬁts greatly from the adversarial robustness slicing.

Original: As a result, our model learns to give smaller soft labels of the correct class to those adversarially unrobust training data, which can also be considered as outliers of the underlying data distribution (Carlini et al., 2019).
Revised: As a result, our model learns to give smaller soft labels of the correct class to those adversarially unrobust training data, which can also be considered as outliers of the underlying data distribution (Carlini et al., 2019).

Original: Therefore, when tested on the shifted data that deep networks have been shown to produce pathologically over-conﬁdent predictions (Hendrycks & Dietterich, 2019), our model correctly learns to make a relatively lower conﬁdence prediction, resulting in a better calibration performance.
Revised: Therefore, when tested on the shifted data that deep networks have been shown to produce pathologically overconﬁdent predictions (Hendrycks & Dietterich, 2019), our model correctly learns to make a relatively lower conﬁdence prediction, resulting in a better calibration performance.

Original: When we compare to an ensemble of ﬁve Vanilla models, we can see that AR-AdaLS achieves comparable calibration performance on CIFAR-10 and the ensemble is better under highly shifted data on ImageNet. 
Revised: When we compare to an ensemble of ﬁve Vanilla models, we can see that AR-AdaLS achieves comparable calibration performance on CIFAR-10 and the ensemble is better under highly shifted data on ImageNet. Sensitivity analysis To analyze the effect of the number of adversarial robustness subset R we plot the calibration error of AR-AdaLS with a varying R on the clean CIFAR-10 and corrupted CIFAR-10-C in Figure 4.

Original: Improvements over stability Since we observe in Figure 1 that the most adversarially unrobust data are also very unstable, we test AR-AdaLS to see if it can help improve model stability, which is of great value in practice where high variance of a model is bad for churn and deploying ensembles is too costly (Milani Fard et al., 2016).
Revised: We can see that there is a signiﬁcant drop in calibration error (ECE) when we increase the number of adversarial robustness subset R from 1, where R = 1 denotes AdaLS. Further, the calibration error is robust when R is chosen within the range [4, 16]. [Table] AR-AdaLS

Revised: [Table]

Revised: Improvements on Out-of-Distribution Data We further study the performance of AR-AdaLS when predicting on out-of-distribution (OOD) data.

Revised: In ﬁgure

Revised: [Table]

Revised: we compare the performance of

Revised: Vanilla, Label Smoothing and AR-AdaLS by plotting the histogram of the entropy on the OOD data (higher entropy on OOD is better).

Revised: Each model is trained on CIFAR-10 dataset and then tested on CIFAR-100 dataset.

Revised: We can clearly see that AR-AdaLS signiﬁcantly reduces the number of low-entropy prediction on OOD data, which demonstrates the effectiveness of AR-AdaLS even on totally out-of-distribution data.

Revised: Improvements over stability Since we observe in Figure 1 that the most adversarially unrobust data are also very unstable, we test AR-AdaLS to see if it can help improve model stability, which is of great value in practice where high variance of a model is bad for churn and deploying ensembles is too costly (Milani Fard et al., 2016).

Original: Experiments show that AR-AdaLS can effectively reduce the variance of a model compared to a vanilla model and label smoothing on CIFAR-10 and ImageNet.
Revised: Experiments show that AR-AdaLS can effectively reduce the variance of a model compared to a vanilla model and label smoothing on CIFAR-10 and ImageNet.

Original: An extensive set of results are shown in Table 4 and Figure 9 in the Appendix.[Table] [Table]
Revised: An extensive set of results are shown in Table 3 and Figure 11 in the Appendix.

Original:  C OMBINATION WITH DEEP ENSEMBLES
Revised: 5. C OMBINATION WITH DEEP ENSEMBLES

Original: We now discuss if the two best models, deep ensembles and our AR-AdaLS , are complementary.
Revised: We now discuss if the two best models, deep ensembles and our AR-AdaLS , are complementary.

Original: To this end [Table] we propose the following two ways to combine them: Ensemble of AR-AdaLS : As in Lakshminarayanan et al.
Revised: To this end, we propose the following two ways to combine them: Ensemble of AR-AdaLS : As in Lakshminarayanan et al.

Original: ; Lee et al.
Revised: ; Lee et al.

Original: , we ensemble AR-AdaLS by training multiple independent AR-AdaLS models with random initialization, and average their predictions at inference.
Revised: , we ensemble AR-AdaLS by training multiple independent AR-AdaLS models with random initialization, and average their predictions at inference.

Original: AR-AdaLS of Ensemble: Instead of computing soft labels independently for each AR-AdaLS , we perform AR-AdaLS on the ensembled predictions, i.e., in Eqn (3) we compute conﬁdence and accuracy based on the average of M = 5 model predictions.
Revised: AR-AdaLS of Ensemble: Instead of computing soft labels independently for each AR-AdaLS , we perform AR-AdaLS on the ensembled predictions, i.e., in Eqn (3) we compute conﬁdence and accuracy based on the average of M = 5 model predictions.

Original: Each model is then supervised with the same soft labels.
Revised: Each model is then supervised with the same soft labels.

Original: We will see this slight distinction in training is quite important.
Revised: We will see this slight distinction in training is quite important.

Original: Discussion We present the results for CIFAR-10 and ImageNet in Figure 4 and Table 3.
Revised: Discussion We present the results for CIFAR-10 and ImageNet in Figure 6 and Table 4.

Original: At a high level, we see that AR-AdaLS of Ensemble performs the best across both clean test data and all intensities of shifted data.
Revised: At a high level, we see that AR-AdaLS of Ensemble performs the best across both clean test data and all intensities of shifted data.

Original: Looking more closely, some trends emerge: all of the ensemble methods perform relatively well for highly shifted data (intensity 4–5), but Ensemble of AR-AdaLS performs much worse on less shifted and clean test data.
Revised: Looking more closely, some trends emerge: all of the ensemble methods perform relatively well for highly shifted data (intensity 4–5), but Ensemble of AR-AdaLS performs much worse on less shifted and clean test data.

Original: Please refer to Figure 7 in Appendix for more extensive results on CIFAR-10 and Imagenet.
Revised: Please refer to Figure 8 in Appendix for more extensive results on CIFAR-10 and Imagenet.

Original: Digging deeper, we display the conﬁdence of the predictd class and accuracy of each single model and the corresponding ensemble models on the clean test set of CIFAR-10 and ImageNet in Figure 6.
Revised: Digging deeper, we display the conﬁdence of the predictd class and accuracy of each single model and the corresponding ensemble models on the clean test set of CIFAR-10 and ImageNet in Figurein Appendix.

Original: We can clearly see that the ensemble models generally increase accuracy and decrease conﬁdence compared to a single model, which results from the disagreement of the prediction of each single model in ensembles.
Revised: We can clearly see that the ensemble models generally increase accuracy and decrease conﬁdence compared to a single model, which results from the disagreement of the prediction of each single model in ensembles.

Original: Therefore, naive deep ensembles can improve calibration on highly  shifted data where single-model is over-conﬁdent but can harm calibration if applied to a well-calibrated singlemodel.
Revised: Therefore, naive deep ensembles can improve calibration on highly [Table] shifted data where single-model is over-conﬁdent but can harm calibration if applied to a wellcalibrated single-model.

Original: This is made clearer in Figure 5: while deep ensembles make over-conﬁdent vanilla model well calibrate, it leads the well calibrated AR-AdaLS models to be under-conﬁdent (similar patterns observed on LS and AdaLS , shown in Figure 8 in Appendix).
Revised: This is made clearer in Figure 7: while deep ensembles make over-conﬁdent vanilla model well calibrate, it leads the well calibrated AR-AdaLS models to be under-conﬁdent (similar patterns observed on LS and AdaLS , shown in Figure 9 in Appendix).

Original: From this perspective,AR-AdaLS of
Revised: From this perspective,

Original:  Ensemble avoids this issue by adaptively adjusting smoothing to keep the ensemble well calibrated.
Revised: AR-AdaLS of Ensemble avoids this issue by adaptively adjusting smoothing to keep the ensemble well calibrated.

Original: Taken together we see that AR-AdaLS improves calibration for both single-models and ensembles.
Revised: Taken together we see that AR-AdaLS improves calibration for both single-models and ensembles.

Original:  C ONCLUSION
Revised:  C ONCLUSION

Original: In this paper, we have explored the correlations between adversarial robustness and calibration.
Revised: In this paper, we have explored the correlations between adversarial robustness and calibration.

Original: We ﬁnd across four datasets that adversarially unrobust (easily attacked) data are more likely to have poorly calibrated and unstable predictions.
Revised: We ﬁnd across four datasets that adversarially unrobust (easily attacked) data are more likely to have poorly calibrated and unstable predictions.

Original: Based on this insight, we propose AR-AdaLS to adaptively smooth the labels of the training data based on their adversarial robustness.
Revised: Based on this insight, we propose AR-AdaLS to adaptively smooth the labels of the training data based on their adversarial robustness.

Original: In our experiments we see that AR-AdaLS is more effective than previous label smoothing methods in improving calibration, particularly for shifted data, and can offer improvements on top of already strong ensembling methods.
Revised: In our experiments we see that AR-AdaLS is more effective than previous label smoothing methods in improving calibration, particularly for shifted data, and can offer improvements on top of already strong ensembling methods.

Original: We believe this is an exciting new use for adversarial robustness as a means to more generally improve model trustworthiness, not just by limiting adversarial attacks but also improving uncertainty on unexpected data.
Revised: We believe this is an exciting new use for adversarial robustness as a means to more generally improve model trustworthiness, not just by limiting adversarial attacks but also improving uncertainty on unexpected data.

Original: We hope this spurs further work at the intersection of these areas of research
Revised: We hope this spurs further work at the intersection of these areas of research.

Original: A I MPLEMENTATION D ETAILS A. SVHN
Revised: A I MPLEMENTATION D ETAILS A. SVHN

Original: We use a simple network architecture with 7 convolutional layers and follow all the training details introduced in Qin et al.
Revised: We use a simple network architecture with 7 convolutional layers and follow all the training details introduced in Qin et al.

Original: (2020a)
Revised: (2020a)

Original: for SVHN.
Revised: for SVHN.

Original: This network architecture achieves the state-of-the-art accuracy on SVHN.
Revised: This network architecture achieves the state-of-the-art accuracy on SVHN.

Original: A. CIFAR- 
Revised: A. CIFAR-

Original: All the experimental results on CIFAR-10 were obtained with a ResNet-29 v2 (He et al., 2016b) with a batch size of 256.
Revised: All the experimental results on CIFAR-10 were obtained with a ResNet-29 v2 (He et al., 2016b) with a batch size of 256.

Original: The network is trained with Adam optimizer (Kingma et al., 2015) for 200 epochs.
Revised: The network is trained with Adam optimizer (Kingma et al., 2015) for 200 epochs

Original: The initial learning rate is 10 − 3 and decayed down to 10 − 4 after 80 epochs, 10 − 5 after 120 epochs, 10 − 6 after 160 epochs and 0 .
Revised: The initial learning rate is 10 − 3 and decayed down to 10 − 4 after 80 epochs, 10 − 5 after 120 epochs, 10 − 6 after 160 epochs and 0 .

Original: 5 × 10 − 6 after 180 epochs.
Revised: 5 × 10 − 6 after 180 epochs.

Original: We adapted the following data augmentation and training script at https://keras.io/examples/cifar10_resnet/ .
Revised: We adapted the following data augmentation and training script at https://keras.io/examples/cifar10_resnet/ .

Original: The training mechanism is the same for all the methods that we compare in the main paper.
Revised: The training mechanism is the same for all the methods that we compare in the main paper.

Original: We randomly split the training dataset into training data of 45000 images and 5000 images as the validation set.
Revised: We randomly split the training dataset into training data of 45000 images and 5000 images as the validation set.

Original: The test set has 10000 images.
Revised: The test set has 10000 images.

Original: For label smoothing (LS), we sweep the hyperparameter (cid:15) within the range [0, 0.1] with a step size 0.01 and ﬁnd that the network has the best calibration performance on the validation set when (cid:15) = 0 .
Revised: For label smoothing (LS), we sweep the hyperparameter (cid:15) within the range [0, 0.1] with a step size 0.01 and ﬁnd that the network has the best calibration performance on the validation set when (cid:15) = 0 .

Original: For Adaptive Label Smoothing (AdaLS), there is a hyperparameter α which plays a role as learning rate in the adaptive learning mechanism.
Revised: For Adaptive Label Smoothing (AdaLS), there is a hyperparameter α which plays a role as learning rate in the adaptive learning mechanism.

Original: We choose hyperparameter α based on the calibration performance on the validation set.
Revised: We choose hyperparameter α based on the calibration performance on the validation set.

Original: Speciﬁcally, we run experiments with α ∈ { 0 .
Revised: Speciﬁcally, we run experiments with α ∈ { 0 .

Original: 05 , 0 . 1 } and ﬁnd that α = 0 .
Revised: 05 , 0 . 1 } and ﬁnd that α = 0 .

Original: 05 achieve the best calibration performance.
Revised: 05 achieve the best calibration performance.

Original: Similarly, for Adversarial Robustness based Adaptive Label Smoothing ( AR-AdaLS ), we choose the hyperparameter α from the set { 0 . 005 , 0 . 01 , 0 . 05 } and empirically set α = 0 .
Revised: Similarly, for Adversarial Robustness based Adaptive Label Smoothing ( AR-AdaLS ), we choose the hyperparameter α from the set { 0 . 005 , 0 . 01 , 0 . 05 } and empirically set α = 0 .

Original: 005 which has the best calibration performance on the validation set.
Revised: 005 which has the best calibration performance on the validation set.

Original: We use the same hyperparameter α = 0 .
Revised: We use the same hyperparameter α = 0 .

Original: 005 without further tuning for AR-AdaLS of Ensemble.
Revised: 005 without further tuning for AR-AdaLS of Ensemble.

Original: All the results of ensemble models are obtained via training 5 independent models with random initializations.
Revised: All the results of ensemble models are obtained via training 5 independent models with random initializations.

Original: A. CIFAR- 
Revised: A. CIFAR-

Original: We train a Wide ResNet-28-10 v2 (Zagoruyko & Komodakis, 2016) to obtain the state-ofthe-art accuracy for CIFAR-100.
Revised: We train a Wide ResNet-28-10 v2 (Zagoruyko & Komodakis, 2016) to obtain the state-ofthe-art accuracy for CIFAR-100.

Original: We adapt the same training details and data augmentation at https://github.com/google/edward2/blob/master/baselines/cifar/ deterministic.py .
Revised: We adapt the same training details and data augmentation at https://github.com/google/edward2/blob/master/baselines/cifar/ deterministic.py .

Original: For label smoothing, we e sweep the hyperparameter (cid:15) within the range [0, 0.1] with a step size 0.
Revised: For label smoothing, we e sweep the hyperparameter (cid:15) within the range [0, 0.1] with a step size 0.

Original: and ﬁnd that the network has the best calibration performance on the validation set when (cid:15)
Revised: and ﬁnd that the network has the best calibration performance on the validation set when (cid:15)

Original: = 0 .
Revised: = 0 .

Original: The hyperparameter α is set to be 0.005 in AR-AdaLS .
Revised: The hyperparameter α is set to be 0.005 in AR-AdaLS .

Original: For AR-AdaLS that generated with on-theﬂy adversarial examples, we recompute the adversarial robustness for training and validation sets after 65, 130 epochs.
Revised: For AR-AdaLS that generated with on-theﬂy adversarial examples, we recompute the adversarial robustness for training and validation sets after 65, 130 epochs.

Original: A. I MAGE N ET
Revised: A. I MAGE N ET

Original: All the experiments on ImageNet were obtained via training a ResNet-101 v1 (He et al., 2016a) following the training script at https://github.com/google/edward2/blob/master/ baselines/imagenet/deterministic.py .
Revised: All the experiments on ImageNet were obtained via training a ResNet-101 v1 (He et al., 2016a) following the training script at https://github.com/google/edward2/blob/master/ baselines/imagenet/deterministic.py .

Original: The network is trained with a batch size offor each TPU core with SGD optimizer for 90 epochs.
Revised: The network is trained with a batch size offor each TPU core with SGD optimizer for 90 epochs.

Original: The input image is normalized (divided by 255) to be within [0,1].
Revised: The input image is normalized (divided by 255) to be within [0,1].

Original: We randomly divide 50000 validation images into validation set with images and test set with 25000 images.
Revised: We randomly divide 50000 validation images into validation set withimages and test set with 25000 images.

Original: Note that the same dataset and training mechanisms are used for all the methods that we compare in the main paper.
Revised: Note that the same dataset and training mechanisms are used for all the methods that we compare in the main paper.

Original: For Label Smoothing (LS), we sweep the hyperparameter (cid:15) within the range [0, 0.1] with a step size 0.01 and ﬁnd that the best calibration performance on the validation set is achieved by setting (cid:15)
Revised: For Label Smoothing (LS), we sweep the hyperparameter (cid:15) within the range [0, 0.1] with a step size 0.01 and ﬁnd that the best calibration performance on the validation set is achieved by setting (cid:15)

Original: = 0 .
Revised: = 0 .

Original: For Adaptive Label Smoothing (AdaLS), we sweep the hyperparameter α in the set { 0 . 005 , 0 . 01 , 0 .
Revised: For Adaptive Label Smoothing (AdaLS), we sweep the hyperparameter α in the set { 0 . 005 , 0 . 01 , 0 .

Original: 05 , 0 . 1 } and set it to be α = 0 .
Revised: 05 , 0 . 1 } and set it to be α = 0 .

Original: 03 for the best calibration performance on the validation set.
Revised: 03 for the best calibration performance on the validation set.

Original: We empirically set α = 0 .
Revised: We empirically set α = 0 .

Original: 001 for AR-AdaLS in the ﬁrst 60 epochs of the training and then increase it to 0 .
Revised: 001 for AR-AdaLS in the ﬁrst 60 epochs of the training and then increase it to 0 .

Original: for the next 30 epochs.
Revised: for the next 30 epochs.

Original: The same hyperparameter α is used for AR-AdaLS of Ensemble without further tuning.
Revised: The same hyperparameter α is used for AR-AdaLS of Ensemble without further tuning.

Original: All the ensemble models are a combination of 5 independent models with random initializations.
Revised: All the ensemble models are a combination of 5 independent models with random initializations.

Original: A. CW ATTACKS
Revised: A. CW ATTACKS

Original: To compute the adversarial robustness, we construct (cid:96) 2 based CW attacks (Carlini & Wagner, 2017b) following the code at https://github.com/tensorflow/cleverhans/blob/ master/cleverhans/attacks/carlini_wagner_l2.py .
Revised: To compute the adversarial robustness, we construct (cid:96) 2 based CW attacks (Carlini & Wagner, 2017b) following the code at https://github.com/tensorflow/cleverhans/blob/ master/cleverhans/attacks/carlini_wagner_l2.py .

Original: Speciﬁcally, we set the binary search steps to be 3, max iterations to be 500 and learning rate to be 0 .
Revised: Speciﬁcally, we set the binary search steps to be 3, max iterations to be 500 and learning rate to be 0 .

Original: The generated untargeted
Revised: The generated untargeted

Original: CW attacks can achieve 100 % success rate for all the datasets that we consider: SVHN, CIFAR-10,
Revised: CW attacks can achieve 100 % success rate for all the datasets that we consider: SVHN, CIFAR-10,

Original: CIFAR-100 and ImageNet.
Revised: CIFAR-100 and ImageNet.

Original: We set the number of adversarial robustness training subset and validation subset to be R = 10 respectively.
Revised: We set the number of adversarial robustness training subset and validation subset to be R = 10 respectively.

Original: B C ALIBRATION P ERFORMANCE : A DDITIONAL R ESULTS
Revised: B C ALIBRATION P ERFORMANCE : A DDITIONAL R ESULTS

Original: In Figure 7, we show ECE and accuracy of all the single-models and their corresponding ensembles on the clean test and shifted CIFAR-10 and ImageNet.
Revised: In Figure 8, we show ECE and accuracy of all the single-models and their corresponding ensembles on the clean test and shifted CIFAR-10 and ImageNet.

Original: The high-level conclusion is: 1) all the ensemble models that we compare have similar accuracies, which are higher than single-models.
Revised: The high-level conclusion is: 1) all the ensemble models that we compare have similar accuracies, which are higher than single-models.

Original: 2) all the ensemble methods perform relatively well for highly shifted data but ensembles of well calibrated models (Ensemble of LS, Ensemble of AdaLS, Ensemble of AR-AdaLS ) perform much worse on less shifted and clean test data.
Revised: 2) all the ensemble methods perform relatively well for highly shifted data but ensembles of well calibrated models (Ensemble of LS, Ensemble of AdaLS, Ensemble of AR-AdaLS ) perform much worse on less shifted and clean test data.

Original: 3) AR-AdaLS of Ensemble successfully learns to adaptively adjust its smoothing level to keep the ensemble well calibrated on both clean and shifted dataset.
Revised: 3) AR-AdaLS of Ensemble successfully learns to adaptively adjust its smoothing level to keep the ensemble well calibrated on both clean and shifted dataset.

Original: Figure 8 is to validate the observation that naive ensembling of a single model can improve calibration on highly shifted data where single-model is over-conﬁdent but can harm calibration on clean test data where single model is well calibrated.
Revised: Figure 9 is to validate the observation that naive ensembling of a single model can improve calibration on highly shifted data where single-model is over-conﬁdent but can harm calibration on clean test data where single model is well calibrated.

Original: As shown in Figure 8, we can see that if the single-model is over-conﬁdent (Vanilla), Ensemble of Vanilla greatly improves the model’s calibration.
Revised: As shown in Figure 9, we can see that if the single-model is over-conﬁdent (Vanilla), Ensemble of Vanilla greatly improves the model’s calibration.

Original: However, when the single model is well-calibrated (LS, AdaLS, AR-AdaLS ), naive ensembling of these models leads to an under-conﬁdent model with a worse calibration performance.
Revised: However, when the single model is well-calibrated (LS, AdaLS, AR-AdaLS ), naive ensembling of these models leads to an under-conﬁdent model with a worse calibration performance.

Original: In contrast, AR-AdaLS of Ensemble successfully avoids this issue by adaptively smoothing the training labels according to adversarial robustness of training data.
Revised: In contrast, AR-AdaLS of Ensemble successfully avoids this issue by adaptively smoothing the training labels according to adversarial robustness of training data.