Original: I MPROVING ROBUSTNESS OF SOFTMAX CORSSENTROPY LOSS VIA INFERENCE INFORMATION
Revised: I MPROVING ROBUSTNESS OF SOFTMAX CORSSENTROPY LOSS VIA INFERENCE INFORMATION

Original: Anonymous authors
Revised: Anonymous authors

Original: Paper under double-blind review
Revised: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: Adversarial samples easily mislead the vision systems based on deep neural networks DNNs) which are trained with the softmax cross entropy SCE loss.
Revised: Adversarial examples easily mislead the vision systems based on deep neural networks (DNNs) trained with the softmax cross entropy (SCE) loss.

Original: Such a vulnerability of DNN comes from the fact that SCE drives DNNs to ﬁt on the training samples, whereas the resultant feature distributions between the training and adversarial samples are unfortunately misaligned.
Revised: Such a vulnerability of DNN comes from the fact that SCE drives DNNs to ﬁt on the training samples, whereas the resultant feature distributions between the training and adversarial examples are unfortunately misaligned.

Original: Several state-of-the- arts start from improving the inter-class separability of training samples by modifying loss functions, where we argue that the adversarial samples are ignored and thus limited robustness to adversarial attacks is resulted.
Revised: Several state-of-the-arts start from improving the inter-class separability of training samples by modifying loss functions, where we argue that the adversarial examples are ignored and thus limited robustness to adversarial attacks is resulted.

Original: In this paper, we exploitthe distribution difference between the ground truth and the predictions measured by the Kullback–Leibler divergence. The difference is termed as inference re-
Revised: In this paper, we exploit inference region which inspires us to involve a margin-like inference information to

Original: gion and inspires us to involve an additive inference information to SCE, resulting in a novel inference-softmax cross entropy (I-SCE) loss, which is intuitively appealing and interpretable.
Revised: SCE, resulting in a novel inference-softmax cross entropy (I-SCE) loss, which is intuitively appealing and interpretable.

Original: The inference information is a guarantee to both the inter -class separability and the improved generalization to adversarial samples, which is furthermore demonstrated under the min-max framework.
Revised: The inference information is a guarantee to both the inter-class separability and the improved generalization to adversarial examples, which is furthermore demonstrated under the min-max framework.

Original: Extensive experiments show that under strong adaptive attacks, the DNN models trained with the proposed I-SCE loss achieve superior performance and robustness over the state-of-the-arts
Revised: Extensive experiments show that under strong adaptive attacks, the DNN models trained with the proposed I-SCE loss achieve superior performance and robustness over the state-of-the-arts.

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Although deep neural networks have achieved state-of-the-art performance on various tasks (Szegedy et al., 2015; Zagoruyko & Komodakis, 2016; He et al., 2015; Huang et al., 2016; Larsson et al., 2016), it is recently shown that adversarial samples by adding imperceptible disturbances are not hard to fool well-trained neural networks (Szegedy et al., 2014; Goodfellow et al., 2015), leading to malfunction in intelligent systems such as image classiﬁcation (Goodfellow et al., 2015;
Revised: Although deep neural networks have achieved state-of-the-art performance on various tasks (Szegedy et al., 2015; Zagoruyko & Komodakis, 2016; He et al., 2015; Huang et al., 2016; Larsson et al., 2016), it is recently shown that adversarial examples by adding imperceptible disturbances are not hard to fool well-trained neural networks (Szegedy et al., 2014; Goodfellow et al., 2015), leading to malfunction in intelligent systems such as image classiﬁcation (Goodfellow et al., 2015;

Original: Szegedy et al., 2014), natural language processing (Jia & Liang, 2017; Carlini & Wagner, 2018), and autonomous driving (Liu et al., 2019; Chernikova et al., 2019).
Revised: Szegedy et al., 2014), natural language processing (Jia & Liang, 2017; Carlini & Wagner, 2018), and autonomous driving (Liu et al., 2019; Chernikova et al., 2019).

Original: The vulnerability to adversarial attacks indicates that the neural networks do not convey proper feature representations and may overﬁt on the training samples which are even of large amounts (Ilyas et al., 2019).
Revised: The vulnerability to adversarial attacks indicates that the neural networks do not convey proper feature representations and may overﬁt on the training samples which are even of large amounts (Ilyas et al., 2019).

Original: A reason of this issue is about the loss function used in training.
Revised: A reason of this issue is about the loss function used in training.

Original: Take the softmax cross entropy (SCE) loss as an example, which is widely adopted in regressing probabilities and is a core building block for high performance.
Revised: Take the softmax cross entropy (SCE) loss as an example, which is widely adopted in regressing probabilities and is a core building block for high performance.

Original: The neural networks trained with SCE are shown to be limited in robustness on input perturbation, hence being suboptimal in real applications where adversarial attacks exist (Carlini & Wagner, 2017; Goodfellow et al., 2015; Kurakin et al., 2017b; Moosavi-Dezfooli et al., 2016;
Revised: The neural networks trained with SCE are shown to be limited in robustness to input perturbation, hence being suboptimal in real applications where adversarial attacks exist (Carlini & Wagner, 2017; Goodfellow et al., 2015; Kurakin et al., 2017b; Moosavi-Dezfooli et al., 2016;

Original: Papernot et al., 2016a).
Revised: Papernot et al., 2016a).

Original: The above issue brings many attempts that optimize SCE to enhance the robustness and anti-attack properties of neural networks (Sun et al., 2014; Schroff et al., 2015; Wen et al., 2016; Wan et al., 2018;
Revised: The above issue brings many attempts that optimize SCE to enhance the robustness and anti-attack properties of neural networks (Sun et al., 2014; Schroff et al., 2015; Wen et al., 2016; Wan et al., 2018;

Original: Pang et al., 2020).
Revised: Pang et al., 2020).

Original: These methods follow the same principle that they minimize the losses to maximally ﬁt the training examples.
Revised: These methods follow the same principle that they minimize the losses to maximally ﬁt the training examples.

Original: However, the adversarial samples have a misaligned distribution with the training data, meaning that the ﬁtted models in training could be repellent to the adversarial data (Ilyas et al., 2019).
Revised: However, the adversarial examples have a misaligned distribution with the training data, meaning that the ﬁtted models in training could be repellent to the adversarial data (Ilyas et al., 2019).

Original: In fact, given a well-trained model, the distribution difference between the training and adversarial data is a blind region to the model, where we term as the inference region.
Revised: In fact, given a well-trained model, the distribution difference between the training and adversarial data is a blind region to the model, where we term as the inference region.

Original: The samples in this region are expected to be generalizable by the well-trained model, which is not the case in existing methods, resulting in the vulnerability of neural networks (Szegedy et al., 2014).
Revised: The samples in this region are expected to be generalizable by the well-trained model, which is not the case in existing methods, resulting in the vulnerability of neural networks (Szegedy et al., 2014).

Original: The reason why this region exists, according to our analyses, is that the model overﬁts on the training data even when large amounts of data is accessible in training and the adversarial data is clearly absent.
Revised: The reason why this region exists, according to our analyses, is that the model overﬁts on the training data even when large amounts of data is accessible in training and the adversarial data is clearly absent.

Original: Hence, how to generalize to the samples in this region still remains unresolved.
Revised: Hence, how to generalize to the samples in this region still remains unresolved.

Original: Unfortunately, the above methods fail to take this fact into consideration.
Revised: Unfortunately, the above methods fail to take this fact into consideration.

Original: In this paper, we exploit the inference regionand analyze the Kullback–Leibler (KL) divergence between the distribution ofthe training data and that of the model predictions.
Revised: In this paper, we exploit the inference region between the distributions of training data and adversarial examples.

Original: To overﬁtting, an enforced gap between the two distributions is useful, which could help to improve the generalization ability of the model during training.

Original: This inspires us to propose an inference schema, which imposes a basic expectation of the correct class on predictions.
Revised: This region guides us to develop an inference schema which imposes a margin-like inference information on the predicted logit of the network.

Original: This schema is applied on KL divergence and cross entropy, resulting in an inference-softmax cross entropy (I-SCE) loss.
Revised: Based on this, we propose an inferencesoftmax cross entropy (I-SCE) loss.

Original: In this loss, the inference information is intuitively regarded as an additive term imposed on the predicted probabilities, which is extremely easy to implement and appealing.
Revised: In this loss, the inference information is intuitively regarded as an additive term imposed on the prediction, which is extremely easy to implement and appealing.

Original: We further show the robustness of I-SCE under the Min-Max framework.
Revised: We further show the robustness of I-SCE under the Min-Max framework.

Original: Under severe adversarial attacks, I-SCE still maintains high accuracy and robustness, and has better resistance.
Revised: Under severe adversarial attacks, I-SCE still maintains high accuracy and robustness, and has better resistance.

Original: The experiments on MNIST and CIFAR10 demonstrate that the proposed loss produces improved effectiveness and robustness compared with the state-of-the-art methods.
Revised: The experiments on MNIST and CIFAR10 demonstrate that the proposed loss produces improved effectiveness and robustness compared with the state-of-the-art methods.

Original:  R ELATED W ORK
Revised:  R ELATED W ORK

Original: Adversarial attacks exist widely in open environment, imposing the demand that the robustness  of neural networksis critical to the security quality and the overall performance of systems.
Revised: Adversarial attacks exist widely in open environment, imposing critical robustness demand of neural networks to the security quality and the overall performance of systems.

Original: Therefore, how to design an anti-attack and robust neural network has attracted the interest of many researchers, which are brieﬂy reviewed in this section.
Revised: Therefore, how to design an anti-attack and robust neural network has attracted the interest of many researchers, which are brieﬂy reviewed in this section.

Original: Adversarial attack: Szegedy et al.
Revised: Adversarial attack: Szegedy et al.

Original: ﬁrst proposed the concept of adversarial samples and employed the L-BFGS method as the solver of a disturbed problem to mislead neural networks.
Revised: ﬁrst proposed the concept of adversarial examples and employed the L-BFGS method as the solver of a disturbed problem to mislead neural networks.

Original: Goodfellow et al. (2015) proposed the Fast Gradient Symbol Method (FGSM) to generate adversarial examples with a single gradient step.
Revised: Goodfellow et al. (2015) proposed the Fast Gradient Symbol Method (FGSM) to generate adversarial examples with a single gradient step.

Original: Before backpropagation, FGSM was used to perturb the input of the model, which was an early form of adversarial training.
Revised: Before backpropagation, FGSM was used to perturb the input of the model, which was an early form of adversarial training.

Original: Moosavi-Dezfooli et al.
Revised: Moosavi-Dezfooli et al.

Original: (2016) proposed the DeepFool which calculated the minimal necessary disturbance and applied it to construct adversarial samples.
Revised: (2016) proposed the DeepFool which calculated the minimal necessary disturbance and applied it to construct adversarial examples.

Original: By imposing the (cid:96) 2 regularization to limit the disturbance scale,
Revised: By imposing the (cid:96) 2 regularization to limit the disturbance scale,

Original: DeepFool achieved good performance.
Revised: DeepFool achieved good performance.

Original: After this, Madry et al.
Revised: After this, Madry et al.

Original: (2018) proposed the projected gradient descent (PGD) attack which had a strong attack strength, and was used in adversarial training to improve robustness.
Revised: (2018) proposed the projected gradient descent (PGD) attack which had a strong attack strength, and was used in adversarial training to improve robustness.

Original: Recently, Guo et al.
Revised: Recently, Guo et al.

Original: (2019) developed a local searching-based technique to construct a numerical approximation of the gradient, which was then used to perturb a small part of the input image.
Revised: (2019) developed a local searching-based technique to construct a numerical approximation of the gradient, which was then used to perturb a small part of the input image.

Original: Adversarial defense: The features of adversarial examples could follow a different distribution from the clean training data, making the defense progress very difﬁcult.
Revised: Adversarial defense: The features of adversarial examples could follow a different distribution from the clean training data, making the defense progress very difﬁcult.

Original: Distillation temperature was used to stabilize the gradient during training, thereby reducing the sensitivity of the model to disturbances (Papernot et al., 2016b).
Revised: Distillation temperature was used to stabilize the gradient during training, thereby reducing the sensitivity of the model to disturbances (Papernot et al., 2016b).

Original: Metzen et al.
Revised: Metzen et al.

Original: (2017) introduced a novel model to detect adversarial samples.
Revised: (2017) introduced a novel model to detect adversarial examples.

Original: Chen et al.
Revised: Chen et al.

Original: (2017) injected annealing noise into the softmax function during training to alleviate the early saturation problem of softmax loss.
Revised: (2017) injected annealing noise into the softmax function during training to alleviate the early saturation problem of softmax loss.

Original: Xie et al.
Revised: Xie et al.

Original: (2018) proposed the use of random resizing and random padding on images for defense.
Revised: (2018) proposed the use of random resizing and random padding on images for defense.

Original: Ross & Doshi-Velez (2018) and Yan et al.
Revised: Ross & Doshi-Velez (2018) and Yan et al.

Original: (2018) proposed to regularize the gradients during training to improve the model robustness.
Revised: (2018) proposed to regularize the gradients during training to improve the model robustness.

Original: Farnia et al.
Revised: Farnia et al.

Original: (2019) used a spectral regularization as the gradient penalty which was combined with adversarial training to alleviate vulnerability.
Revised: (2019) used a spectral regularization as the gradient penalty which was combined with adversarial training to alleviate vulnerability.

Original: In addition, data augmentation (Zhang et al., 2018;
Revised: In addition, data augmentation (Zhang et al., 2018;

Original: Hendrycks et al., 2020) was a typical option to enhance the generalization ability of neural networks and to reduce the risk of overﬁtting on training data.
Revised: Hendrycks et al., 2020) was a typical option to enhance the generalization ability of neural networks and to reduce the risk of overﬁtting on training data.

Original: However, this option could not completely solve the problem of adversarial attack which always generated new kinds of adversarial samples.
Revised: However, this option could not completely solve the problem of adversarial attack which always generated new kinds of adversarial examples.

Original: As a top performer, the adversarial training (AT) achieved advanced robustness in different adversarial attack environments (Kurakin et al., 2017a;
Revised: As a top performer, the adversarial training (AT) achieved advanced robustness in different adversarial attack environments (Kurakin et al., 2017a;

Original: Miyato et al., 2017; Madry et al., 2018;  Shafahi et al., 2019).
Revised: Miyato et al., 2017; Madry et al., 2018; Sinha et al., 2018; Najaﬁ et al., 2019; Shafahi et al., 2019).

Original: By using extra adversarial samples, it enabled the model to learn more generalizable feature representations.
Revised: By using extra adversarial examples, it enabled the model to learn more generalizable feature representations.

Original: The AT mechanism accepted various losses and regularizers, and was a powerful tool to resist attacks.
Revised: The AT mechanism accepted various losses and regularizers, and was a powerful tool to resist attacks.

Original: Despite of this, AT might sacriﬁce the performance on clean input and was computationally expensive (Xie et al., 2019).
Revised: Despite of this, AT might sacriﬁce the performance on clean input and was computationally expensive (Xie et al., 2019).

Original: Schmidt et al.
Revised: Schmidt et al.

Original: (2018) showed that the sample complexity of robust learning might be much larger than standard learning.
Revised: (2018) showed that the sample complexity of robust learning might be much larger than standard learning.

Original: Robust loss functions: Lots of studies have been conducted to improve the widely used SCE loss function, most of which focused on encouraging higher intra-class compactness and greater separa- tion between classes.
Revised: Robust loss functions: Lots of studies have been conducted to improve the widely used SCE loss function, most of which focused on encouraging higher intra-class compactness and greater separation between classes.

Original: The comparing loss (Sun et al., 2014) and the triplet loss (Schroff et al., 2015) were proposed to improve the internal compactness of each class which, however, suffered from the slowed training process and the unstable convergence.
Revised: The comparing loss (Sun et al., 2014) and the triplet loss (Schroff et al., 2015) were proposed to improve the internal compactness of each class which, however, suffered from the slowed training process and the unstable convergence.

Original: Center loss (Wen et al., 2016) avoided the problem of slow convergence and instability by minimizing the Euclidean distance between features and the corresponding class centers, but the resultant robustness was not satisfactory.
Revised: Center loss (Wen et al., 2016) avoided the problem of slow convergence and instability by minimizing the Euclidean distance between features and the corresponding class centers, but the resultant robustness was not satisfactory.

Original: Liu et al.
Revised: Liu et al.

Original: (2016) converted the softmax loss to the cosine space, and proposed that the angular distance margin favoured high intra-class compactness and inter-class separability.
Revised: (2016) converted the softmax loss to the cosine space, and proposed that the angular distance margin favoured high intra-class compactness and inter-class separability.

Original: Wan et al.
Revised: Wan et al.

Original: (2018) proposed the large-margin Gaussian Mixture loss, which used the Gaussian mixture distribution to ﬁt the training data and increased the distance between feature distributions of different classes.
Revised: (2018) proposed the large-margin Gaussian Mixture loss, which used the Gaussian mixture distribution to ﬁt the training data and increased the distance between feature distributions of different classes.

Original: Pang et al.
Revised: Pang et al.

Original: (2020) proposed the Max-Mahalanobis center (MMC) loss to induce dense feature regions, which encouraged the model to concentrate on learning ordered and compacted representations.
Revised: (2020) proposed the Max-Mahalanobis center (MMC) loss to induce dense feature regions, which encouraged the model to concentrate on learning ordered and compacted representations.

Original: Different from the previous works which improve the loss function to better ﬁt the data distribution, the proposed method ( i.e. I-SCE) is a much easy and interpretable way to enable the neural networks to learn freely.
Revised: Different from the previous works which improve the loss function to better ﬁt the data distribution, the proposed method ( i.e. I-SCE) is a much simple and interpretable way to enable the neural networks to learn freely.

Original: Moreover, we advocate that I-SCE encourages the models to be more generalizable with respect to the adversarial data instead of being overﬁtting on the training data.  
Revised: Moreover, we advocate that I-SCE encourages the models to be more generalizable with respect to the adversarial data instead of being overﬁtting on the training data.  M ETHODS

Revised: In this section, we introduce the inference-softmax cross entropy loss by ﬁrst presenting the deﬁnition of inference region, which motivates us to develop an inference schema.

Original: M ETHODS 3. I NFERENCE R EGION
Revised: 3. I NFERENCE R EGION

Original: Current neural networks tend to overﬁt on the by-hand clean training data which, however, cannot work out a robust model and instead, makes them vulnerable to adversarial attacks.
Revised: Current neural networks tend to overﬁt on the by-hand clean training data which, however, cannot work out a robust model and instead, makes them vulnerable to adversarial attacks.

Original: We advocate that this scenario is caused by the misaligned distribution between the clean training data and the adversarial data, and overﬁtting prevents the model to be tolerant to input perturbations.
Revised: We advocate that this scenario is caused by the misaligned distribution between the clean training data and the adversarial data, and overﬁtting prevents the model to be tolerant to input perturbations.

Original: The distribution difference is termed as inference region , which characterizes why adversarial samples are outliers to the neural networks trained on clean data.
Revised: The distribution difference is termed as inference region , which characterizes why adversarial examples are outliers to the neural networks trained on clean data.

Original: Given Figure 1 as an illustration, the features of adversarial examples reside outside the feature space of training examples, whereas the decision boundary speciﬁed by the well-trained model closely ﬁt the training data area.
Revised: Given Figure 1 as an illustration, the features of adversarial examples reside outside the feature space of training examples, whereas the decision boundary speciﬁed by the well-trained model closely ﬁt the training data area.

Original: Considering that the type of adversarial attackis incrementally appear in real scenarios, the decision boundary in Figure 1(a) is not sufﬁcient to give the right prediction, even if several kinds of input perturbation are involved in training.
Revised: Considering that the type of adversarial attack incrementally appear in real scenarios, the decision boundary in Figure 1(a) is not good enough to give the right prediction, even if several kinds of input perturbation are involved in training.

Original: Instead, adversarial attacks are assumed to result in an isotropic expansion of the feature space, where the expanded region is the inference region as shown in Figure 1(b).
Revised: Instead, adversarial attacks are assumed to result in an isotropic expansion of the feature space, where the expanded region is the inference region as shown in Figure 1(b).

Original: Then, out task is to encourage the model generalizable to this region.
Revised: Then, our task is to encourage the model generalizable to this region.

Original: Overﬁtting occurs when, during training, the model prediction achieves thehighest probability of  the right class, resulting in the lowest loss. Our option is to forcibly prevent the  model predictions to be the same as the ground truth by intuitively adding an inference information which is manually speciﬁed during training.
Revised: The softmax cross entropy (SCE) loss is a typical loss function used in training deep models, which imposes a hard constraint on the label of the input, i.e. regressing the probability of 1 on the correct label and the probability of 0 on the incorrect labels (generally in the case of one-hot label representation). Unfortunately, the hard constraint, on one hand, causes a difﬁcult regression process in training, and on the other hand, makes the resultant model over-conﬁdent on the predictions, hence bringing the issue of vulnerability.

Original: Speciﬁcally, assume that the input sample is x , the ground truth label is y , and  the model prediction is y (cid:48) .
Revised: This has already been mentioned in the literatures of label smoothing (Szegedy et al., 2016; Papernot et al., 2016b; M ¨ uller et al., 2019; Pereyra et al., 2017; Zou et al., 2019), which solves the problem by designing a soft label or a soft output distribution, i.e. regressing the probabilities of 1 − (cid:15) and (cid:15)/K on the correct and incorrect labels, respectively, where K is the number of task labels.

Original: The inference schema is formulated as
Revised: We give an intuitive explanation of the above discussion in

Original: [Equation]
Revised: Figure 2(a) and Figure 2(b). As seen, the SCE encourages the label regression from one side along the 0-1 axis, whereas the label smoothing drives the regression from both sides around the target probabilities. Besides, we also identify that the margin-based idea in SCE is similar to the label smoothing.

Original: where m ∈ (0 , 1) is the inference information. In the deep learning-based classiﬁcation, softmax is generally employed to map the logit outputs of the neural network to probabilities. In this mapping process, softmax does not change the relative order of the possibilities of different classes that theinput belongs.
Revised: Specifically, the soft label implies a margin between the true distribution and the soft output distribution. Considering that softmax is a monotonically increasing function, a margin between the label distributions can induce a margin between features in the logit layer of a neural network, as in the

Original: Hence, the above schema is equivalent to imposing the inference information directly to the logits, which is the case of the proposed inference-SCE in Section 3.3.
Revised: ArcFace loss (Deng et al., 2019).

Original: The use of the inference information could help 1) to avoid overﬁtting and 2) to improve the generalization ability of the feature representation, driving the decision boundary towards the boundary of inference region in feature space.This schema is simple, interpretable, and effective as demonstrated in experiments.
Revised: From Figure 2(c), we see that ArcFace pushes regression towards the target angles from both sides in a circle axis. While the above analyses inform us that the regression is performed from either one side or both sides, here, we propose an alternative deﬁnition of soft label which could be regressed from arbitrary directions in feature space.

Original: In the following, we analyze the inference-KL divergence and inference-cross entropy to show its robustness.
Revised: Speciﬁcally, we free the circle constraint in ArcFace and impose the additive margin to the features only normalized by L2-norm.

Original: As known, the cross entropy loss is derived from the relative entropy (also known as KL divergence) which is used to measure the difference between two probability distributions.
Revised: In this way, the resultant features are not necessarily located on a circle or a sphere, and on the contrary, the marge is isotropically posed around each sample in the feature space, as shown in Figure 2(d).

Original: To make the description precise, we denote the above ground-truth distribution P ( y | x ) as P ( y ) , and denote the prediction P ( y (cid:48) | x ) as Q ( y ) . Then, KL divergence is expressed as [Equation]
Revised: We will empirically demonstrate the effectiveness of this operation over the ArcFace.

Original: where H ( P ( y ) , Q ( y )) is the cross entropy and H ( P ( y )) is  the shannon entropy. Since the ground truth distribution oftraining data is known, H ( P ( y )) is a constant and hence, minimizing the KL divergence is equivalent to minimizing the cross entropy. In an ideal case that P ( y ) =
Revised: By implementing this margin idea, the inference information is then contained in the margin, which could help 1) to avoid overﬁtting and 2) to improve the generalization ability of the feature representation, driving the decision boundary towards the boundary of inference region in feature space.

Original: Q ( y ) during training, the KL divergence is 0 and overﬁtting occurs. By applying the inference schema, we derive the inference crossentropy as [Equation] and the inference KL divergence as
Revised: Hence, the small perturbation of an adversarial examples is not easy to cross the decision boundary, greatly alleviating the problem of vulnerability.

Original: [Equation] The minimizer of either H I ( P ( y ) , Q ( y )) or D KL I ( P ( y ) (cid:107) Q ( y )) tends to produce an estimation of Q ( y ) close to P ( y ) − m instead of P ( y ) . Hence, even when the inference KL divergence ideally reaches 0 , Q ( y ) does not completely overﬁt on the training data distribution P ( y ) .
Revised: This schema is simple, interpretable and effective as demonstrated in experiments.

Original: To explain this, we show that [Equation] This equation indicates that D KL I ( P ( y ) (cid:107) Q ( y )) − D KL ( P ( y ) (cid:107) Q ( y )) < 0 , showing how inference KL divergence avoids the overﬁtting scenario.
Revised: In the following, we present the inference-softmax cross entropy in details.

Original: 3. I NFERENCE - SOFTMAX CROSS ENTROPY
Revised: 3. I NFERENCE - SOFTMAX CROSS ENTROPY

Original: To derive a robust loss for neural network training, in this section, we apply the inference-schema on SCE and propose an inference-softmax cross entropy (I-SCE) loss, which could increase the inference probability of  adversarial samples, thus avoid overﬁtting.
Revised: To derive a robust loss for neural network training, in this section, we apply the inference-schema on SCE and propose an inference-softmax cross entropy (I-SCE) loss, which could encourage the tolerance of the model to adversarial perturbations, thus avoid overﬁtting.

Original: Given a k -class classiﬁcation task, the posterior probability predicted by the deep model using softmax is
Revised: Given a k -class classiﬁcation task, the posterior probability predicted by the deep model using softmax is

Original: [Equation]
Revised: [Equation]

Original: where i ∈ [1 , k ] is the label candidate, and f i is the prediction function for the i -th class which speciﬁes both the backbone and the softmax layer in a typical classiﬁcation network.
Revised: where i ∈ [1 , k ] is the label candidate, and f i is the prediction function for the i -th class which speciﬁes both the backbone and the softmax layer in a typical classiﬁcation network.

Original: To improve the vulnerability of SCE, we impose the inference information to the logits produced by the neural networks and propose an inference softmax as
Revised: To improve the vulnerability of SCE, we impose the inference information to the logits produced by the neural networks and propose an inference softmax as

Original: [Equation]
Revised: [Equation]

Original: which then induces the inference-softmax cross entropy loss as
Revised: which then induces the inference-softmax cross entropy loss as

Original: [Equation]
Revised: [Equation]

Original: where y i
Revised: where y i

Original: = 1 if the ground truth label of x is i and otherwise 0, and s ≥ 1 is used to scale the predication
Revised: = 1 if the ground truth label of x is i and otherwise 0, and s ≥ 1 is used to scale the predication

Original: f i ( x ) and control the gradient update rate on the right class.
Revised: f i ( x ) and control the gradient update rate on the right class.

Original: Note that we use y i as an indicator of the inference information, that is, s and m are only imposed on the right class instead of all classes.
Revised: Note that we use y i as an indicator of the inference information, that is, s and m are only imposed on the right class instead of all classes.

Original: As seen, the implementation of this loss is very easy by simply adding a scalar and a constant on the prediction of the right class, which is unaggressive to the original training code of neural networks.
Revised: As seen, the implementation of this loss is very easy by simply adding a scalar and a constant on the prediction of the right class, which is unaggressive to the original training code of neural networks.

Original: In the implementation of I-SCE, we ﬁnd that the case of f i (cid:29) f j , j (cid:54) =
Revised: In the implementation of I-SCE, we ﬁnd that the case of f i (cid:29) f j , j (cid:54) =

Original: i possibly occurs, which reduces the effect of m .
Revised: i possibly occurs, which reduces the effect of m .

Original: To address this issue, we normalize f ( x ) by L 2 to increase the numerical stabilization.
Revised: To address this issue, we normalize f ( x ) by L 2 to increase the numerical stabilization.

Original: During the inference process, Eq. 7 is calculated by ﬁrstly ﬁnding the index i of the maximal value
Revised: During the inference process, Eq. 2 is calculated by ﬁrstly ﬁnding the index i of the maximal value

Original: f i ( x ) among i ∈ [1 , k ] and then applying s and m on the i -th class according to this equation.
Revised: f i ( x ) among i ∈ [1 , k ] and then applying s and m on the i -th class according to this equation.

Original: This operation does not change the class decision since s ≥ 1 and m > 0 .
Revised: This operation does not change the class decision since s ≥ 1 and m > 0 .

Original: 3. R OBUSTNESS ANALYSIS OF I-SCE 3.4. E XPECTED INTERVAL OF CORRECT CLASS
Revised: 3. R OBUSTNESS ANALYSIS OF I-SCE 3.3. E XPECTED INTERVAL OF CORRECT CLASS

Original: To demonstrate the robustness of I-SCE, we analyze the expected intervals of the correct class predicted by both I-SCE and SCE.
Revised: To demonstrate the robustness of I-SCE, we analyze the expected intervals of the correct class predicted by both I-SCE and SCE.

Original: Here, assume the minimum perturbation δ which makes the model just misclassiﬁed.
Revised: Here, assume the minimum perturbation δ which makes the model just misclassiﬁed.

Original: The probability that the SCE model recognizes the adversarial sample x + δ as the correct label i is
Revised: The probability that the SCE model recognizes the adversarial sample x + δ as the correct label i is

Original: [Equation]
Revised: [Equation]

Original: Regarding the I-SCE model, the probability is then
Revised: Regarding the I-SCE model, the probability is then

Revised: [Equation]

Original: [Equation]
Revised: [Equation]

Original: The expected intervals of the correct class by using SCE and I-SCE are deﬁned as
Revised: The expected intervals of the correct class by using SCE and I-SCE are deﬁned as

Original: [Equation]
Revised: [Equation]

Original: ) and
Revised: 6) and

Original: [Equation]

Original: [Equation]
Revised: [Equation]

Original:  respectively.
Revised: 7) respectively.

Original: The vulnerability of SCE to adversarial attacks states that f ( x + δ ) < f
Revised: The vulnerability of SCE to adversarial attacks states that f ( x + δ ) < f

Original: ( x ) .
Revised: ( x ) .

Original: Considering that the perturbation δ is a just value that misleads the SCE model, the expected interval measures the maximal level of perturbation that the model is robust on.
Revised: Considering that the perturbation δ is a just value that misleads the SCE model, the expected interval measures the maximal level of perturbation that the model is robust on.

Original: The larger the interval is, the more robust the model is.
Revised: The larger the interval is, the more robust the model is.

Original: Starting from this point, we show the following property of I-SCE:
Revised: Starting from this point, we show the following property of I-SCE:

Original: When s ≥ 1 , m > 0 , and
Revised: When s ≥ 1 , m > 0 , and

Original: [Equation]
Revised: [Equation]

Original: L
Revised: [Figure] [Equation] [Figure] [Equation]

Revised: [Figure]

Revised: [Equation]

Revised: [Figure]

Revised: [Equation]

Revised: [Figure]

Original: [Equation]
Revised: [Equation]

Original: The condition in the above property is both theoretically demonstrated and empirically validated in
Revised: [Figure] [Equation] [Figure] [Equation]

Revised: [Figure]

Revised: [Equation]

Revised: larger than L

Revised: [Equation]

Revised: The condition in the above property is both theoretically demonstrated and empirically validated in

Original: Appendix A.2.
Revised: Appendix A.2.

Original: This states that the robustness of I-SCE is improved compared with SCE.
Revised: This states that the robustness of I-SCE is improved compared with SCE.

Original: 3.4. M IN -M AX FRAMEWORK
Revised: 3.3. M IN -M AX FRAMEWORK

Original: The above robustness conclusion is also applicable to the Min-Max framework (Madry et al., 2018), which is a typical framework of adversarial attack and defense.
Revised: The above robustness conclusion is also applicable to the Min-Max framework (Madry et al., 2018), which is a typical framework of adversarial attack and defense.

Original: The Min-Max framework is formulated as
Revised: The Min-Max framework is formulated as

Original: [Equation]
Revised: [Equation]

Revised: where ρ ( θ

Revised: [Equation]

Revised: = E (

Revised: [Equation]

Original: where θ is the model parameter and δ is the input perturbation.
Revised: where θ is the model parameter and δ is the input perturbation.

Original: The internal maximization is an attack process that ﬁnds the perturbation that maximally mislead the model θ .
Revised: The internal maximization is an attack process that ﬁnds the perturbation that maximally mislead the model θ .

Original: The external minimization is a defense process that encourages the model tolerant to such an attack.
Revised: The external minimization is a defense process that encourages the model tolerant to such an attack.

Original: We use ρ I and ρ to represent the objective losses by using I-SCE and SCE, respectively.
Revised: We use ρ I and ρ to represent the objective losses by using I-SCE and SCE, respectively.

Original: Given an input perturbation δ and a trained model { f i } , we have when s ≥ 1 and m > 0 ,
Revised: Given an input perturbation δ and a trained model { f i } , we have when s ≥ 1 and m > 0 ,

Original: [Equation]
Revised: [Equation]

Original: which is proven in Eq.
Revised: which is proven in Eq.

Original: 17 of Appendix A.2.
Revised: 12 of Appendix A.2.

Original: This states that the P I results in a lower loss than P , i.e. ρ I < ρ .
Revised: This states that the P I results in a lower loss than P , i.e. ρ I < ρ .

Original: Hence, the lower loss indicates the better defense performance on adversarial attacks, which demonstrates the improved robustness of I-SCE.
Revised: Hence, the lower loss indicates the better defense performance on adversarial attacks, which demonstrates the improved robustness of I-SCE.

Revised: 3. R ELATIONSHIP WITH LARGE MARGIN LEARNING

Revised: While the proposed method (I-SCE) could be viewed as a margin-based loss, the difference to the

Revised: ArcFace loss is how the margin (or inference information) is applied to the logits.

Original: E XPERIMENTS
Revised: ArcFace loss normalizes the features and the weights such that the resultant features are located on a hypersphere, and the training process regresses the class targets along the surface of the hyper-sphere. Instead, the proposed method only normalizes the features but not the weights in order to locate the features in a free space, in which case the regression process can be performed in any direction. We advocate that freeing the sphere constraint will bring performance improvement of adversarial defencing, which is demonstrated in the experiments. The reason of the effectiveness may be that the adversarial perturbation causes a large variation in the feature space.

Revised: Constraining the features on a hyper-sphere would bring a large feature shift if the normalization direction (to the sphere) is undesirable.

Revised: By contrast, the proposed method prefers isotropic tolerance to feature perturbations, hence being better.

Original: In this section, we conduct a series of experiments on MNIST (Lecun & Bottou, 1998) and CIFAR10 (Krizhevsky & Hinton, 2009) to demonstrate the effectiveness of the proposed I-SCE.
Revised: In this section, we conduct a series of experiments on MNIST (Lecun & Bottou, 1998) and CIFAR10 (Krizhevsky & Hinton, 2009) to demonstrate the effectiveness of the proposed I-SCE.

Original: The backbone used in our implementation is ResNet-32 with ﬁve stages (He et al., 2016), which is optimized  by using the Adam algorithm (Kingma & Ba, 2015).
Revised: The backbone used in our implementation is ResNet-32 with ﬁve stages (He et al., 2016), which is optimized [Table] [Table] by using the Adam algorithm (Kingma & Ba, 2015).

Original: We employ the white-box attack and the blackbox attack including the targeted and untargeted PGD (Madry et al., 2018), deepfool (MoosaviDezfooli et al., 2016), and SimBA (Guo et al., 2019).
Revised: We employ the white-box attack and the blackbox attack including the targeted and untargeted PGD (Madry et al., 2018), deepfool (MoosaviDezfooli et al., 2016), and SimBA (Guo et al., 2019).

Original: We select the state-of-the-arts as competitors, such as the Center loss (Wen et al., 2016), the large-margin Gaussian Mixture (L-GM) loss (Wan et al., 2018),  the Max-Mahalanobis center (MMC) loss (Pang et al., 2020), the random method (Xie et al., 2018),  and the adversarial training (AT) method (Madry et al., 2018).
Revised: We select the state-of-the-arts as competitors, such as the Center loss (Wen et al., 2016), the large-margin Gaussian Mixture (L-GM) loss (Wan et al., 2018), ArcFace loss (Deng et al., 2019), the Max-Mahalanobis center (MMC) loss (Pang et al., 2020), the random method (Xie et al., 2018), Label Smoothing(Szegedy et al., 2016), and the adversarial training (AT) method (Madry et al., 2018).

Original: 4. A BLATION STUDIES
Revised: 4. A BLATION STUDIES

Original: There are two hyper-parameters s and m in the proposed I-SCE, which affects the defense performance.
Revised: There are two hyper-parameters s and m in the proposed I-SCE, which affects the defense performance.

Original: We set the ranges as s ∈ [1 , 2] and m ∈ (0 , 0 . 1] , and densely evaluate the performance of I-SCE under different settings and different attacks.
Revised: We set the ranges as s ∈ [1 , 2] and m ∈ (0 , 0 . 1] , and densely evaluate the performance of I-SCE under different settings and different attacks.

Original: Figure 2 illustrates the results, from which we see that the performance is highly correlated with the settings, the attack types, and the datasets.
Revised: Figure 3 illustrates the results, from which we see that the performance is highly correlated with the settings, the attack types, and the datasets.

Original: Therefore, to get better robustness, the parameters need to be reset in different tasks by using a small validation set.
Revised: Therefore, to get better robustness, the parameters need to be reset in different tasks by using a small validation set.

Original: In the following experiments, to make fair comparison, we set s = 1 and m = 0 . 1 .
Revised: In the following experiments, to make fair comparison, we set s = 1 and m = 0 . 1 .

Original: 4. C OMPARISON WITH STATE - OF - THE - ARTS
Revised: 4. C OMPARISON WITH STATE - OF - THE - ARTS

Original: PGD attack: The PGD attack is a strong white-box untargeted and targeted attack.
Revised: PGD attack: The PGD attack is a strong white-box untargeted and targeted attack.

Original: We use Lconstrained untargeted and targeted PGD attacks for comparison.
Revised: We use Lconstrained untargeted and targeted PGD attacks for comparison.

Original: The results are listed in  Table [Table] [Table] [Table]
Revised: The results are listed in Tableand Table 2.

Original: [Table] [Table] [Table] [Table]
Revised: The Clean column is the accuracy on clean samples, (cid:15) is the perturbation level, and

Original: [Table]

Original: Random 99. AT 99. 1 and Table 2. The Clean column is the accuracy on clean samples, (cid:15) is the perturbation level, and PGD tar,un 10 , 50 represents the targtered or untargeted attacks with 10 or 50 iterations.
Revised: PGD tar,un 10 , 50 represents the targeted or untargeted attacks with 10 or 50 iterations.

Original: The results indicate that I-SCE produces better performance than the others in most cases.
Revised: The results indicate that I-SCE produces better performance than the others in most cases.

Original: While AT sometimes achieves good performance, it has a noticeable sacriﬁce of accuracy on clean examples, e.g. on {+CIFAR
+}
Revised: While AT sometimes achieves good performance, it has a noticeable sacriﬁce of accuracy on clean examples, e.g. on {+CIFAR
+}

Original: CIFAR10.
Revised: and it has weaker defense against strong PGD attacks than I-SCE. By constrast, I-SCE preserves high [Table] % ) under SimBA attack.

Original: By constrast, I-SCE preserves high performance on clean data.
Revised: [Table] performance on clean data.

Original: Under several attack cases, e.g. (cid:15) = 0 .
Revised: Under several attack cases, e.g. (cid:15) = 0 .

Original: 04 , I-SCE performs better than the others and is comparable with MMC and AT.
Revised: 04 , I-SCE performs better than the others and is comparable with MMC and AT.

Original: Deepfool attack: The Deepfool attack generates minimal input perturbations to mislead the neural Networks.
Revised: Deepfool attack: The Deepfool attack generates minimal input perturbations to mislead the neural Networks.

Original: Here, we use the L 2 constrained Deepfool attack on MNIST and CIFAR10.
Revised: Here, we use the L 2 constrained Deepfool attack on MNIST and CIFAR10.

Original: From the results in Table 3, it is clearly observed that I-SCE produces much higher performance than all competitors, which have very limited defense ability against Deep fool.
Revised: From the results in Table 3, it is clearly observed that I-SCE produces much higher performance than all competitors, which have very limited defense ability against Deep fool.

Original: The performance improvement of I-SCE is above 50 % in most cases, which is signiﬁcant and exciting.
Revised: The performance improvement of I-SCE is above 50 % in most cases, which is signiﬁcant and exciting.

Original: In real applications, the minimal disturbance generated by Deepfool is more usual than the strong offensive disturbance generated by PGD.
Revised: In real applications, the minimal disturbance generated by Deepfool is more usual than the strong offensive disturbance generated by PGD.

Original: Therefore, the results indicate that I-SCE is more suitable and can achieve better performance in real scenarios than the other methods.[Table]
Revised: Therefore, the results indicate that I-SCE is more suitable and can achieve better performance in real scenarios than the other methods.

Original: Black-box attack
Revised: Black-box attack

Original: : Robust performance is critical to claim reliable robustness against the black-box attacks (Carlini et al., 2019).
Revised: : Robust performance is critical to claim reliable robustness against the black-box attacks (Carlini et al., 2019).

Original: SimBA (Guo et al., 2019) is a black-box query-based attack, which is employed here.
Revised: SimBA (Guo et al., 2019) is a black-box query-based attack, which is employed here.

Original: We set the frequency of query as 300 times per image on MNIST and 500 times per image on CIFAR10.
Revised: We set the frequency of query as 300 times per image on MNIST and 500 times per image on CIFAR10.

Original: The results under different disturbance levels are shown in table 4, from which we see that I-SCE has higher accuracy and little sacriﬁce of accuracy compared with the others.
Revised: The results under different disturbance levels are shown in Table 4, from which we see that I-SCE has higher accuracy and little sacriﬁce of accuracy compared with the others.

Original: This evidence indicates that I-SCE can induce reliable robustness rather than the false one caused by, e.g. , gradient mask (Athalye et al., 2018).
Revised: This evidence indicates that I-SCE can induce reliable robustness rather than the false one caused by, e.g. , gradient mask (Athalye et al., 2018).

Original: Feature embedding: To visually investigate the effect of I-SCE, we compute a 3d representation of the input by adding a three-dimensional embedding layer before the output layer.
Revised: Feature embedding: To visually investigate the effect of I-SCE, we compute a 3d representation of the input by adding a three-dimensional embedding layer before the output layer.

Original: The embedded points are plotted in Figure 3, where the samples are selected from the test set of MNIST and
Revised: The embedded points are plotted in Figure 4, where the samples are selected from the test set of MNIST and

Original: CIFAR10 without any perturbation.
Revised: CIFAR10 without any perturbation.

Original: As seen, the samples of SCE distribute confusedly in the space, where little perturbations on the samples could change the category decision.
Revised: As seen, the samples of SCE distribute confusedly in the space, where little perturbations on the samples could change the category decision.

Original: In contrast, I-SCE produces separable clusters for each classes with large margins among them, which hence has higher tolerance to the perturbations than the other competitors.
Revised: In contrast, I-SCE produces separable clusters for each classes with large margins among them, which hence has higher tolerance to the perturbations than the other competitors.

Original:  CONCLUSION
Revised:  CONCLUSION

Original: The original SCE loss induces the model to ﬁt the distribution of the clean data, which is shown vulnerable to adversarial attacks.
Revised: The original SCE loss induces the model to ﬁt the distribution of the clean data, which is shown vulnerable to adversarial attacks.

Original: We advocate that the vulnerability is caused by the unawareness of the inference region during learning.
Revised: We advocate that the vulnerability is caused by the unawareness of the inference region during learning.

Original: Targeting at this issue, we propose an inference-SCE loss that avoids overﬁtting by imposing an additive inference information to the output of the neural network such that the sensitive class region of the model is expanded.
Revised: Targeting at this issue, we propose an inference-SCE loss that avoids overﬁtting by imposing an additive inference information to the output of the neural network such that the sensitive class region of the model is expanded.

Original: In this way, the model has higher generalization ability to the adversarial samples.
Revised: In this way, the model has higher generalization ability to the adversarial examples.

Original: Extensive experiments demonstrate the superiority of I-SCE compared with the state-of-the-arts.
Revised: Extensive experiments demonstrate the superiority of I-SCE compared with the state-of-the-arts.

Original: Especially in the case of strong attacks,
Revised: Especially in the case of strong attacks,

Original: I-SCE still remains high robustness.
Revised: I-SCE still remains high robustness

Original: A A PPENDIX A. E XPERIMENTS ON SHALLOW NETWORKS
Revised: A A PPENDIX A. E XPERIMENTS ON SHALLOW NETWORKS

Original: In real applications on mobiles shallow networks are generally preferred because of low computational costs.
Revised: In real applications on mobiles, shallow networks are generally preferred because of low computational costs.

Original: Hence, in this section we evaluate the robustness of the proposed I-SCE with shallow networks.
Revised: Hence, in this section we evaluate the robustness of the proposed I-SCE with shallow networks.

Original: Speciﬁcally, we following the same settings of competitors and attack methods as in Section 4.
Revised: Speciﬁcally, we following the same settings of competitors and attack methods as in Section 4.

Original: The backbone network is LeNet-5 (Lecun & Bottou, 1998) for MNIST and an 8-layer neural network for CIFAR10.
Revised: The backbone network is LeNet-5 (Lecun & Bottou, 1998) for MNIST and an 8-layer neural network for CIFAR10.

Original: Table 5 and Table 6 illustrate the performance under the PGD attack on MNIST and CIFAR10, respectively.
Revised: Table 5 and Table 6 illustrate the performance under the PGD attack on MNIST and CIFAR10, respectively.

Original: The results indicate that I-SCE performs surprisingly well in all cases of attack, while remaining slight sacriﬁce of accuracy on clean data.
Revised: The results indicate that I-SCE performs surprisingly well in all cases of attack, while remaining slight sacriﬁce of accuracy on clean data.

Original: Notably, the performance gaps between I-SCE and the others are above 50% in many cases, which validates the effectiveness of the proposed schema.
Revised: Notably, the performance gaps between I-SCE and the others are above 50% in many cases, which validates the effectiveness of the proposed schema.

Original: More importantly, under severe attacks, I-SCE still shows strong robustness.
Revised: More importantly, under severe attacks, I-SCE still shows strong robustness.

Original: Table 7 lists the results of all methods under the Deepfool attack.
Revised: Table 7 lists the results of all methods under the Deepfool attack.

Original: We ﬁnd that the performance of I-SCE is comparable with the state-of-the-arts.
Revised: We ﬁnd that the performance of I-SCE is comparable with the state-of-the-arts.

Original: MMC produces the best accuracy under attacks, but has noticeable sacriﬁce of accuracy on clean data.
Revised: MMC produces the best accuracy under attacks, but has noticeable sacriﬁce of accuracy on clean data.

Original: By contrast, I-SCE shows better trade-off between accuracy and robustness.
Revised: By contrast, I-SCE shows better trade-off between accuracy and robustness.

Original: A. P ROVE OF THE PROPERTY ON EXPECTED INTERVAL OF CORRECT CLASS
Revised: A. P ROVE OF THE PROPERTY ON EXPECTED INTERVAL OF CORRECT CLASS

Original: According to the deﬁnition L and L I in Eq.
Revised: According to the deﬁnition L and L I in Eq.

Original: 11 and Eq.
Revised: 6 and Eq.

Original: 12, we can derive
Revised: 7, we can derive

Original: [Equation]
Revised: [Equation]

Original: By deﬁning
Revised: By deﬁning

Original: [Equation]
Revised: [Equation]

Original: 16) we then have
Revised: we then have

Original: [Equation]
Revised: [Equation]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: L-GM 74.
Revised: L-GM 74.

Original: MMC 73.
Revised: MMC 73.

Original: I-SCE 81.
Revised: I-SCE 81.

Original: Random 78.
Revised: Random 78.

Original: AT 78.
Revised: AT 78.

Original: The above equation gives us that h ( f ( x )) > 

Revised: The above equation gives us that h ( f ( x )) >

Original: ⇐⇒ e sf i ( x )+ m − e f i ( x ) > 

Revised: ⇐⇒ e sf i ( x )+ m − e f i ( x ) >

Original: ⇐⇒ e sfi ( x )+ m e fi ( x ) >
Revised: ⇐⇒ e sfi ( x )+ m e fi ( x ) >

Original: 1 ⇐⇒ e ( s − 1) f i ( x )+ m > 1 ⇐⇒ ( s − 1)
Revised: 1 ⇐⇒ e ( s − 1) f i ( x )+ m > 1 ⇐⇒ ( s − 1)

Original: f i ( x ) + m > 

Revised: f i ( x ) + m >

Original: ⇐⇒ s > f i ( x ) − m f i ( x ) .
Revised: ⇐⇒ s > f i ( x ) − m f i ( x ) .

Original: Hence, when the parameters s and m satisfy s ≥ 1 > f i ( x ) − m f i ( x ) and m > 0 , h ( f ( x )) > 0 .
Revised: Hence, when the parameters s and m satisfy s ≥ 1 > f i ( x ) − m f i ( x ) and m > 0 , h ( f ( x )) > 0 .

Original: When s = 1 and m = 0 ,
Revised: When s = 1 and m = 0 ,

Original: P I ( i | x ) degenerates to P ( i | x ) .
Revised: P I ( i | x ) degenerates to P ( i | x ) .

Original: Similarly, regarding h ( f ( x + δ )) , we have
Revised: Similarly, regarding h ( f ( x + δ )) , we have

Original: [Equation]
Revised: [Equation]

Original: When s ≥ 1 > f i ( x + δ ) − m f i ( x + δ ) and m > 0 , h ( f ( x + δ )) > 0 .
Revised: When s ≥ 1 > f i ( x + δ ) − m f i ( x + δ ) and m > 0 , h ( f ( x + δ )) > 0 .

Original: Based on the above derivations, we calculate
Revised: Based on the above derivations, we calculate

Original: [Equation]
Revised: [Equation]

Original: To analyze the sign of the above equation, we compute the derivative of h ( f ( x )) with respective to f i ( x ) as
Revised: To analyze the sign of the above equation, we compute the derivative of h ( f ( x )) with respective to f i ( x ) as

Original: [Equation]
Revised: [Equation]

Original: [Table]
Revised: [Table]

Original: Considering that the perturbation δ is a just value that misleads the network, f ( x ) >
Revised: Considering that the perturbation δ is a just value that misleads the network, f ( x ) >

Original: f ( x + δ ) .
Revised: f ( x + δ ) .

Original: When s and m satisfy
Revised: When s and m satisfy

Original: [Figure]
Revised: [Figure]

Original: [Equation] [Equation] 
Revised: [Equation] [Equation] [Equation]

Original: )) is monotonically increasing.
Revised: is monotonically increasing.

Original: This guarantees that L I − L > 0 .
Revised: This guarantees that L I − L > 0 .

Original: However, the condition
Revised: However, the condition

Original: [Equation]
Revised: [Equation]

Original: >
Revised: >

Original: [Equation]
Revised: [Equation]

Original: is not easy to validate in the case of s ≥ 1 and m > 0 .
Revised: is not easy to validate in the case of s ≥ 1 and m > 0 .

Original: Here, we conduct an experiment to empirically demonstrate its validation.
Revised: Here, we conduct an experiment to empirically demonstrate its validation.

Original: Speciﬁcally, we compute the empirical values (cid:80) j (cid:54) =
Revised: Speciﬁcally, we compute the empirical values (cid:80) j (cid:54) =

Original: i e f j ( x ) ≈ 8 , f i ( x ) ≈ 0 . 97 by averaging the corresponding values of all samples in MNIST and CIFAR10.
Revised: i e f j ( x ) ≈ 8 , f i ( x ) ≈ 0 . 97 by averaging the corresponding values of all samples in MNIST and CIFAR10.

Original: By employing these two values, we plot the 3D surface of z =
Revised: By employing these two values, we plot the 3D surface of z =

Original: [Equation]
Revised: [Equation]

Original: 2 with respect to s and m , which is shown in Figure 4.
Revised: 2 with respect to s and m , which is shown in Figure 5.

Original: The surface indicates that z is always larger than 0 when s > 1 and m > 0 .
Revised: The surface indicates that z is always larger than 0 when s > 1 and m > 0 .

Original: This empirically demonstrates the validness of the conditions in the property.
Revised: This empirically demonstrates the validness of the conditions in the property.