Original: Is It Time to Redeﬁne the Classiﬁcation Task for Deep Learning Systems?
Revised: Is It Time to Redeﬁne the Classiﬁcation Task for Deep Learning Systems?

Original: Abstract
Revised: Abstract

Original: Many works have demonstrated that deep neural networks (DNNs) are vulnerable to adversarial examples.
Revised: Many works have demonstrated that deep neural networks (DNNs) are vulnerable to adversarial examples.

Original: A deep learning system involves a couple of elements: the learning task, data set, deep model, loss, and optimizer.
Revised: A deep learning system involves a couple of elements: the learning task, data set, deep model, loss, and optimizer.

Original: Each element may cause the vulnerability of the deep learning system, and simply attributing the vulnerability of the deep learning system to the deep model may impede addressing the adversarial attack.
Revised: Each element may cause the vulnerability of the deep learning system, and simply attributing the vulnerability of the deep learning system to the deep model may impede addressing the adversarial attack.

Original: So we redeﬁne the robustness of DNNs as the robustness of the deep neural learning system, and we experimentally ﬁnd that the vulnerability of the deep learning system also roots in the learning task itself.
Revised: So we redeﬁne the robustness of DNNs as the robustness of the deep neural learning system, and we experimentally ﬁnd that the vulnerability of the deep learning system also roots in the learning task itself.

Original: In detail, this paper deﬁnes the interval-label classiﬁcation task for the deep classiﬁcation system, whose labels are predeﬁned non-overlapping intervals instead of a ﬁxed value (hard label) or probability vector (soft label).
Revised: In detail, this paper deﬁnes the interval-label classiﬁcation task for the deep classiﬁcation system, whose labels are predeﬁned non-overlapping intervals instead of a ﬁxed value (hard label) or probability vector (soft label).

Original: The experimental results demonstrate that the interval-label classiﬁcation task is more robust than the traditional classiﬁcation task while retaining accuracy.
Revised: The experimental results demonstrate that the interval-label classiﬁcation task is more robust than the traditional classiﬁcation task while retaining accuracy.

Original: 1. Introduction
Revised: 1. Introduction

Original: Deep Neural Networks (DNNs) (Szegedy et al., 2017;
Revised: Deep Neural Networks (DNNs) (Szegedy et al., 2017;

Original: Krizhevsky et al., 2017) are even indispensable for many tasks, such as computer vision (CV), natural language processing (NLP) and speech recognition (SR) (LeCun et al., 2015).
Revised: Krizhevsky et al., 2017) are even indispensable for many tasks, such as computer vision (CV), natural language processing (NLP) and speech recognition (SR) (LeCun et al., 2015).

Original: However, DNNs are demonstrated to be vulnerable to adversarial examples.
Revised: However, DNNs are demonstrated to be vulnerable to adversarial examples.

Original: The adversarial example is crafted by adding adversarial perturbation to the original legitimate example to fool DNNs while being imperceptible to humans.
Revised: The adversarial example is crafted by adding adversarial perturbation to the original legitimate example to fool DNNs while being imperceptible to humans.

Original: There are two kinds of adversarial attacks, namely  poisoning attack and evasion attack (Yuan et al., 2019).
Revised: There are two kinds of adversarial attacks, namely .cn > poisoning attack and evasion attack (Yuan et al., 2019).

Original: The poisoning attack ruins the victim model in the training phase, while the evasion attack tries to fool the victim in the testing phase.
Revised: The poisoning attack ruins the victim model in the training phase, while the evasion attack tries to fool the victim in the testing phase.

Original: In this paper, we focus on the evasion attack.
Revised: In this paper, we focus on the evasion attack.

Original: The evasion attack falls into three categories according to the manner to craft the adversarial perturbation, namely single-step attack, iterative attack, and optimization-based attack.
Revised: The evasion attack falls into three categories according to the manner to craft the adversarial perturbation, namely single-step attack, iterative attack, and optimization-based attack.

Original: The single-step attacks directly add the adversarial perturbation into the legitimate example (Goodfellow et al., 2015) or map the legitimate example as an adversarial example(Baluja & Fischer, 2018).
Revised: The single-step attacks directly add the adversarial perturbation into the legitimate example (Goodfellow et al., 2015) or map the legitimate example as an adversarial example(Baluja & Fischer, 2018).

Original: The iterative attacks (Kurakin et al., 2017b;a) iteratively explore the adversarial perturbation.
Revised: The iterative attacks (Kurakin et al., 2017b;a) iteratively explore the adversarial perturbation.

Original: For instance, Fast gradient sign method
Revised: For instance, Fast gradient sign method

Original: FGSM (Goodfellow et al., 2015) adds the scaled gradient sign to the legitimate example.
Revised: FGSM (Goodfellow et al., 2015) adds the scaled gradient sign to the legitimate example.

Original: Project gradient descent (PGD) (Kurakin et al., 2017a) is a multi-step attack, which consists of few single-step attacks.
Revised: Project gradient descent (PGD) (Kurakin et al., 2017a) is a multi-step attack, which consists of few single-step attacks.

Original: Carlini & Wagner (CW) (Carlini & Wagner, 2017) is also a multi-step attack, which formulates the attack as an optimization problem.
Revised: Carlini & Wagner (CW) (Carlini & Wagner, 2017) is also a multi-step attack, which formulates the attack as an optimization problem.

Original: Most of existing methods to improve the robustness of deep learning system pay attention to the training data, the model architecture, training loss, and parameterupdating strategy.
Revised: Most of existing methods to improve the robustness of deep learning system pay attention to the training data, the model architecture, training loss, and parameterupdating strategy.

Original: For training data-level methods, feature nulliﬁcation (Wang et al., 2017) randomly nulliﬁes features to improve the robustness of the target model.
Revised: For training data-level methods, feature nulliﬁcation (Wang et al., 2017) randomly nulliﬁes features to improve the robustness of the target model.

Original: The work in (Das et al., 2018) demonstrates that image compress can be employed to improve the robustness of DNNs; as to model architecture-level method, in (Xie et al., 2019), the denoising module is introduced to the target model; as to training loss-based methods, (Zhang et al., 2019; S. et al., 2020) introduce regularization loss; for the parameter-updating strategy methods, (Katz et al., 2017) updates model parameters with the simplex-like method.
Revised: The work in (Das et al., 2018) demonstrates that image compress can be employed to improve the robustness of DNNs; as to model architecture-level method, in (Xie et al., 2019), the denoising module is introduced to the target model; as to training-loss-based methods, (Zhang et al., 2019; S. et al., 2020) introduce regularization loss; for the parameter-updating strategy methods, (Katz et al., 2017) updates model parameters with the simplex-like method.

Original: Jonathan Uesato et al.
Revised: Jonathan Uesato et al.

Original: update model parameters with approximate gradients(Uesato et al., 2018).
Revised: update model parameters with approximate gradients (Uesato et al., 2018).

Original: Moreover, the adversarial example detection methods (Wang et al., 2018;
Revised: Moreover, the adversarial example detection methods (Wang et al., 2018;

Original: Meng & Chen, 2017; Ma et al., 2019) are also employed to improve the robustness of the deep learning system by keeping the adversarial example away from the deep model.
Revised: Meng & Chen, 2017; Ma et al., 2019) are also employed to improve the robustness of the deep learning system by keeping the adversarial example away from the deep model.

Original: As introduced above, existing methods mainly focus on elements related to the deep model, and few methods focus on the robustness of the learning task itself.
Revised: As introduced above, existing methods mainly focus on elements related to the deep model, and few methods focus on the robustness of the learning task itself.

Original: To better investigate adversarial robustness, we extend the robustness of the deep model to the robustness of the deep learning system.
Revised: To better investigate adversarial robustness, we extend the robustness Label Encoding Label Decoding O

Original: In this paper, we take the deep image classiﬁcation
Revised: Interval Label ෤𝑦 None • ෤𝑦 : the predicted hard label • O : the output of the interval- label classifier, O  R• None: the input example does not belong to any category The gap between interval labels

Revised: Interval-label Classifier

Original: [Figure]
Revised: [Figure]

Original:    system as an instance to demonstrate that the vulnerability of deep learning systems may also root in the learning task.
Revised:   of the deep model to the robustness of the deep learning system. In this paper, we take the deep image classiﬁcation system as an instance to demonstrate that the vulnerability of deep learning systems may also root in the learning task.

Original: Our contributions are summarized as follows.
Revised: Our contributions are summarized as follows.

Original: • We extend the issue of the adversarial robustness of the deep model to the adversarial robustness of the deep learning systems.
Revised: • We extend the issue of the adversarial robustness of the deep model to the adversarial robustness of the deep learning systems.

Original: The deep learning system consists of the predeﬁned learning task and elements to implement the learning task.
Revised: The deep learning system consists of the predeﬁned learning task and elements to implement the learning task.

Original: • We deﬁne the interval-label classiﬁcation task for the deep learning system.
Revised: • We deﬁne the interval-label classiﬁcation task for the deep learning system.

Original: The experimental results demonstrate that it is more robust than the traditional classiﬁcation task.
Revised: The experimental results demonstrate that it is more robust than the traditional classiﬁcation task.

Original: 2. Interval-label Classiﬁcation 2.1. Deﬁnition
Revised: 2. Interval-label Classiﬁcation 2.1. Deﬁnition

Original: The traditional image classiﬁcation task can be deﬁned as follows: ∀ x ∈ R C × W × H , T : x (cid:55)→ R d , where x is an image example, and C , W and H are the number of the channels, the width and height of x , respectively.
Revised: The traditional image classiﬁcation task can be deﬁned as follows: ∀ x ∈ R C × W × H , T : x (cid:55)→ R d , where x is an image example, and C , W and H are the number of the channels, the width and height of x , respectively.

Original: T is the classiﬁcation task.
Revised: T is the classiﬁcation task.

Original: k is the number of categories.
Revised: k is the number of categories.

Original: In this paper, we investigate the vulnerability of the classiﬁcation task by deﬁning the interval-label classiﬁcation task.
Revised: In this paper, we investigate the vulnerability of the classiﬁcation task by deﬁning the interval-label classiﬁcation task.

Original: The interval-label classiﬁcation task can deﬁned as: ∀ x ∈ R C × W × H , T : x (cid:55)→ R 1 .
Revised: The interval-label classiﬁcation task can deﬁned as: ∀ x ∈ R C × W × H , T : x (cid:55)→ R 1 .

Original: The output of the intervallabel classiﬁer, i.e. the deep model to implement the intervallabel classiﬁcation task, is a real number, and the label of x is the predeﬁned interval into which the output falls.
Revised: The output of the intervallabel classiﬁer, i.e. the deep model to implement the intervallabel classiﬁcation task, is a real number, and the label of x is the predeﬁned interval into which the output falls.

Original: The labels of the interval-label classiﬁcation are some non-overlapping intervals.
Revised: The labels of the interval-label classiﬁcation are some non-overlapping intervals.

Original: 2.2. An Instance of the Interval-label Classiﬁcation Task
Revised: 2.2. An Instance of the Interval-label Classiﬁcation Task

Original: In this subsection, we introduce an instance of interval-label classiﬁcation.
Revised: In this subsection, we introduce an instance of interval-label classiﬁcation.

Original: As introduced in Section 2.1, the intervallabel classiﬁcation maps the example as a real number.
Revised: As introduced in Section 2.1, the intervallabel classiﬁcation maps the example as a real number.

Original: So we set the output dimension of the last fully connected layer of the DNN classiﬁer as one.
Revised: So we set the output dimension of the last fully connected layer of the DNN classiﬁer as one.

Original: The detailed workﬂow of the interval-label classiﬁcation system is shown in Fig.
Revised: The detailed workﬂow of the interval-label classiﬁcation system is shown in Fig.

Original: The interval-label classiﬁcation system consists of three modules, namely label encoding, label decoding module and Interval-label Classiﬁer.
Revised: The interval-label classiﬁcation system consists of three modules, namely label encoding, label decoding module and an interval-label classiﬁer.

Original: As mentioned above, the target model is a deep neural network with one-dimension output.
Revised: As mentioned above, the target model is a deep neural network with one-dimension output.

Original: The Label Encoding module turns the hard labels of the existing dataset into predeﬁned interval labels, and the Label Decoding module projects the interval label as a hard label.
Revised: The label encoding module turns the hard labels of the existing dataset into predeﬁned interval labels, and the label decoding module projects the interval label as a hard label.

Original: When the output of interval-label classiﬁer o does not fall into any label label, Label Decoding module marks corresponding input as ‘None’.
Revised: When the output of interval-label classiﬁer o does not fall into any label label, Label Decoding module marks corresponding input as ‘None’.

Original: Label Encoding is vital for the interval-label classiﬁcation system, which determines the length of each interval label and the gap between two adjacent interval labels.
Revised: Label encoding is vital for the interval-label classiﬁcation system, which determines the length of each interval label and the gap between two adjacent interval labels.

Original: Label Decoding module translates the interval label as a hard label or ground-truth label name, interpreting the classiﬁcation result to the human.
Revised: Label Decoding module translates the interval label as a hard label or ground-truth label name, interpreting the classiﬁcation result to the human.

Original: The details of Label Encoding and Label Decoding modules will be introduced in the following paragraphs.
Revised: The details of label encoding and label decoding modules will be introduced in the following paragraphs.

Original: Label Encoding module transforms the hard label into an interval label.
Revised: Label encoding module transforms the hard label into an interval label.

Original: The map function can be formulated as follows,
Revised: The map function can be formulated as follows,

Original: [Equation]
Revised: [Equation]

Original: where s 0 is the smallest lower bound of interval labels.
Revised: where s 0 is the smallest lower bound of interval labels.

Original: α is the length of the gap between two adjacent interval labels, while β is the length of the interval label.
Revised: α is the length of the gap between two adjacent interval labels, while β is the length of the interval label.

Original: M L ( · ) and M U ( · ) are lower bound and upper bound map function, respectively.
Revised: M L ( · ) and M U ( · ) are lower bound and upper bound map function, respectively.

Original: According to Equation (1), for the hard label ‘3’, when s 0 = 0 , α = 1 , and β = 3 , the corresponding interval-label is [12 , 15] .
Revised: According to Equation (1), for the hard label ‘3’, when s 0 = 0 , α = 1 , and β = 3 , the corresponding interval-label is [12 , 15] .

Original: If the output of the interval-label classiﬁer falls into an interval label, the label decoding function can be formulated as follows.
Revised: If the output of the interval-label classiﬁer falls into an interval label, the label decoding function can be formulated as follows.

Original: [Equation]
Revised: [Equation]

Original: where x is the input example.
Revised: where x is the input example.

Original: I ( · ) is the interval-label classiﬁer.
Revised: I ( · ) is the interval-label classiﬁer.

Original: (cid:98)·(cid:99) is the rounded down function.
Revised: (cid:98)·(cid:99) is the rounded down function.

Original: If I ( x ) does not belong to any interval label, the corresponding input example will viewed as an abnormal example.
Revised: If I ( x ) does not belong to any interval label, the corresponding input example will viewed as an abnormal example.

Original: Actually, we canrandomly assign s 0 , α, and β for each interval label.
Revised: Actually, we can assign variant α and β for different interval labels.

Original: The loss function of the interval-label classiﬁcation task can be formulated as follows,
Revised: The loss function of the interval-label classiﬁcation task can be formulated as follows,

Original: [Equation]
Revised: [Equation]

Original: where θ is the parameter set of the classiﬁer
Revised: where θ is the parameter set of the classiﬁer

Original: I .
Revised: I .

Original: B ( X, Y (cid:48) ) is a mini batch.
Revised: B ( X, Y (cid:48) ) is a mini batch.

Original: X and Y is the examples set and hard label set, and Y (cid:48) =
Revised: X and Y is the examples set and hard label set, and Y (cid:48) =

Original: [ M L ( Y ) , M U ( Y )] is the interval labels set.
Revised: [ M L ( Y ) , M U ( Y )] is the interval labels set.

Original: M L ( Y ) and M U ( Y ) is the lower bound set and upper bound set, respectively.
Revised: M L ( Y ) and M U ( Y ) is the lower bound set and upper bound set, respectively.

Original: r ( · ) is the ReLU activation function (Nair & Hinton, 2010).
Revised: r ( · ) is the ReLU activation function (Nair & Hinton, 2010).

Original: 2.3. Characteristics of Interval-label Classiﬁcation
Revised: 2.3. Characteristics of Interval-label Classiﬁcation

Original: The traditional classiﬁcation model more easily overﬁts compared to the interval-label classiﬁcation model.
Revised: The traditional classiﬁcation model more easily overﬁts compared to the interval-label classiﬁcation model.

Original: The reason is that even an example has been correctly classiﬁed by the model, the loss, such as the cross-entropy loss and negative log-likelihood loss, is still not 0 for the traditional classiﬁcation task.
Revised: The reason is that even an example has been correctly classiﬁed by the model, the loss, such as the cross-entropy loss and negative log-likelihood loss, is still not 0 for the traditional classiﬁcation task.

Original: When the probability of the ground-truth class exceeding 0.5, the example certainly is correctly classiﬁed.
Revised: When the probability of the ground-truth class exceeding 0.5, the example certainly is correctly classiﬁed.

Original: However, only if the target class probability is one that the loss is zero for the cross-entropy loss.
Revised: However, only if the target class probability is one that the loss is zero for the cross-entropy loss.

Original: As to the interval-label classiﬁcation task, if an example has been correctly classiﬁed, the corresponding loss will be 0, according to Equation (3).
Revised: As to the interval-label classiﬁcation task, if an example has been correctly classiﬁed, the corresponding loss will be 0, according to Equation (3).

Original: According to (Tsipras et al., 2019), overconﬁdence may cause the adversarial vulnerability of the deep learning system.
Revised: According to (Tsipras et al., 2019), overconﬁdence may cause the adversarial vulnerability of the deep learning system.

Original: Moreover, when s 0 = 0 , α = 1 , and β = 0 , the interval-label classiﬁcation degrades to the traditional classiﬁcation.
Revised: Moreover, when s 0 = 0 , α = 1 , and β = 0 , the interval-label classiﬁcation degrades to the traditional classiﬁcation.

Original: The interval-label classiﬁcation is immune to existing optimization-based attacks that cannot attack the interval-label classiﬁcation tasks, such as CW (Carlini &
Revised: The interval-label classiﬁcation is immune to existing optimization-based attacks that cannot attack the interval-label classiﬁcation tasks, such as CW (Carlini &

Original: Wagner, 2017), EAD (Chen et al., 2018), and Deepfool (Moosavi-Dezfooli et al., 2016) since the adversary needs to redeﬁne the distance between the output and target label.
Revised: Wagner, 2017), EAD (Chen et al., 2018), and Deepfool (Moosavi-Dezfooli et al., 2016) since the adversary needs to redeﬁne the distance between the output and target label.

Original: 3. Experiments 3.1. Experiment Settings
Revised: 3. Experiments 3.1. Experiment Settings

Original: In this paper, two data sets are applied to evaluate the effectiveness of our method, namely MNIST (Lecun et al., 1998) and a subset of ImageNet (Russakovsky et al., 2015).
Revised: In this paper, two data sets are applied to evaluate the effectiveness of our method, namely MNIST (Lecun et al., 1998) and a subset of ImageNet (Russakovsky et al., 2015).

Original: The training set of MNIST consists of 60,000 grayscale hand-written digit images, while the testing set of MNIST includes 10,000 images.
Revised: The training set of MNIST consists of 60,000 grayscale hand-written digit images, while the testing set of MNIST includes 10,000 images.

Original: Imagenet is a color image data set, consisting of 1000 ﬁne-grained categories.
Revised: Imagenet is a color image data set, consisting of 1000 ﬁne-grained categories.

Original: Considering the task’s complexity, we select the ﬁrst 10 categories of the training set and validation set as the training set and testing set.
Revised: Considering the task’s complexity, we select the ﬁrst 10 categories of the training set and validation set as the training set and testing set.

Original: On MNIST, three deep neural networks, NN, AlexNet (Krizhevsky et al., 2017) and ResNet18 (He et al., 2016) are employed to implement classiﬁcation tasks.
Revised: On MNIST, three deep neural networks, NN, AlexNet (Krizhevsky et al., 2017) and ResNet18 (He et al., 2016) are employed to implement classiﬁcation tasks.

Original: NN is a neural network consists of two convolution layers and ﬁve fully connected layers, and the ﬁrst two fully connected layers adopt the sigmoid activation function.
Revised: NN is a neural network consists of two convolution layers and ﬁve fully connected layers, and the ﬁrst two fully connected layers adopt the sigmoid activation function.

Original: On subset of
Revised: On subset of

Original: ImageNet, AlexNet, DenseNet121 (Huang et al., 2017) and
Revised: ImageNet, AlexNet, DenseNet121 (Huang et al., 2017) and

Original: ResNet18 are adopted to implement classiﬁcation tasks.
Revised: ResNet18 are adopted to implement classiﬁcation tasks.

Original: 3.2. Feature Visualization
Revised: 3.2. Feature Visualization

Original: [Figure]
Revised: [Figure]

Original: We also experiment to visualize the penultimate layer features for both traditional classiﬁcation task, and intervallabel classiﬁcation on MNIST with t-SNE (Maaten & Geoffrey, 2008).
Revised: We also experiment to visualize the penultimate layer features for both traditional classiﬁcation task and interval-label classiﬁcation on MNIST with t-SNE (Maaten & Geoffrey, 2008).

Original: As shown in Fig.
Revised: As shown in Fig.

Original: 2, for the interval-label classiﬁcation task, the examples of the same category aggregate more tightly than the traditional classiﬁcation task.
Revised: 2, for the interval-label classiﬁcation task, the examples of the same category aggregate more tightly than the traditional classiﬁcation task.

Original: There is no intersection between different clusters, which means that the interval-label classiﬁcation can learn a better feature representation than the traditional classiﬁcation.
Revised: There is no intersection between different clusters, which means that the interval-label classiﬁcation can learn a better feature representation than the traditional classiﬁcation.

Original: We speculate that the intersection of features of different categories for traditional classiﬁcation tasks is that when the traditional classiﬁcation task minimizes the empirical risk, it also pays attention to the non-semantic features, while the values of non-semantic features are all the same for MNIST.
Revised: We speculate that the intersection of features of different categories for traditional classiﬁcation tasks is that when the traditional classiﬁcation task minimizes the empirical risk, it also pays attention to the non-semantic features, while the values of non-semantic features are all the same for MNIST.

Original: Furthermore, non-semantic (non-robust) features cause the vulnerability of the deep learning system (Ilyas et al., 2019).
Revised: Furthermore, non-semantic (non-robust) features cause the vulnerability of the deep learning system (Ilyas et al., 2019).

Original: 3.3. Robustness Analysis
Revised: 3.3. Robustness Analysis

Original: In this section, we experiment to explore the robustness of the interval-label classiﬁcation task on both white-box and black-box scenarios.
Revised: In this section, we experiment to explore the robustness of the interval-label classiﬁcation task on both white-box and black-box scenarios.

Original: We implement the traditional and interval-label classiﬁcation tasks on the same deep neural network, only the last fully-connected layer being different.
Revised: We implement the traditional and interval-label classiﬁcation tasks on the same deep neural network, only the last fully-connected layer being different.

Original: The corresponding experimental results are shown in Tables 1 and 2.
Revised: The corresponding experimental results are shown in Tables 1 and 2.

Original: For all scenarios, the interval length β is set as 16, while the length of the gap between two adjacent interval labels α is set as 4.
Revised: For all scenarios, the interval length β is set as 16, while the length of the gap between two adjacent interval labels α is set as 4.

Original: TRA, HIN, and INT represent the
Revised: TRA, HIN, and INT represent the

Original: [Table] [Table]
Revised: [Table] [Table]

Original: traditional classiﬁcation task, traditional classiﬁcation task with hinge loss
Revised: traditional classiﬁcation task, traditional classiﬁcation task with hinge loss

Original: [Table]
Revised: [Table]

Original: and the interval-label classiﬁcation task, respectively.
Revised: and the interval-label classiﬁcation task, respectively.

Original: LEG represents the accuracy on the test set.
Revised: LEG represents the accuracy on the test set.

Original: The experimental results demonstrate that the interval-label classiﬁcation task is much more robust than the traditional classiﬁcation task in most cases.
Revised: The experimental results demonstrate that the interval-label classiﬁcation task is much more robust than the traditional classiﬁcation task in most cases.

Original: In the traditional classiﬁcation task, the robustness is at odds with the accuracy (Tsipras et al., 2019).
Revised: In the traditional classiﬁcation task, the robustness is at odds with the accuracy (Tsipras et al., 2019).

Original: However, according to Table 1 and 2, it is noted that, as to the interval-label classiﬁcation task, the higher test accuracy, the more robust it is.
Revised: However, according to Tables 1 and 2, it is noted that, as to the interval-label classiﬁcation task, the higher test accuracy, the more robust it is.

Original: The reason is that when an example is correctly classiﬁed, its loss will be 0.
Revised: The reason is that when an example is correctly classiﬁed [Table] its loss will be 0.

Original: So it is difﬁcult for the adversary to explore an efﬁcient gradient to craft adversarial examples.
Revised: So it is difﬁcult for the adversary to explore an efﬁcient gradient to craft adversarial examples.

Original: So we conclude that interval-label classiﬁcation can alleviate the competition between robustness and accuracy.
Revised: So we conclude that interval-label classiﬁcation can alleviate the competition between robustness and accuracy.

Original: 3.4. Adversarial Transferability between Interval-label Classiﬁcation Tasks with Different α and β
Revised: 3.4. Adversarial Transferability between Interval-label Classiﬁcation Tasks with Different α and β

Original: In this subsection, we experiment to investigate the adversarial transferability of PGD adversarial examples among interval-label classiﬁcation tasks with different α 
Revised: In this subsection [Table] we experiment to investigate the adversarial transferability of PGD adversarial examples among interval-label classiﬁcation tasks with different α ( =4, =2) ( =2, =2) ( =

Original: [Figure]
Revised: 2 , =2) ( =10 2 , =2) ( =2, =2) ( =4, =2) 0. (a) Fixed β for variant α ( =4, =8) ( =4, =4) ( =4, =2) ( =4, =2) ( =4, =4) ( =4, =8) 0.

Original:  and β on ImageNet.
Revised: (b) Fixed α for variant β and β on ImageNet.

Original: η is the attack intensity of the PGD attack.
Revised: η is the attack intensity of the PGD attack.

Original: All the interval-label classiﬁcation tasks are deﬁned on the ResNet18.
Revised: All the interval-label classiﬁcation tasks are deﬁned on the ResNet18.

Original: In Fig.
Revised: In Fig.

Original: 3, the lighter color represents a higher attack success rate.
Revised: 3, the lighter color represents a higher attack success rate.

Original: We consider two scenarios, namely, the length of the interval label is ﬁxed, and the length of the gap between two adjacent interval label is ﬁxed.
Revised: We consider two scenarios, namely, the length of the interval label is ﬁxed, and the length of the gap between two adjacent interval label is ﬁxed.

Original: According to Fig.
Revised: According to Fig.

Original: 3, we know that bigger α and β will increase the robustness of interval-label classiﬁcation.
Revised: 3, we know that bigger α and β will increase the robustness of interval-label classiﬁcation.

Original: Moreover, we also note that even though the white-box attack success rate is high in some cases, the adversarial example is a little hard to transfer between the interval-label tasks with different α and β .
Revised: Moreover, we also note that even though the white-box attack success rate is high in some cases, the adversarial example is a little hard to transfer between the interval-label tasks with different α and β .

Original: The reason is that when α and β are small, the interval-label classiﬁcation is approximate to the traditional classiﬁcation.
Revised: The reason is that when α and β are small, the interval-label classiﬁcation is approximate to the traditional classiﬁcation.

Original: In a real-world application, a deep neural network may be deployed in variant devices.
Revised: In a real-world application, a deep neural network may be deployed in variant devices.

Original: So if an adversary has successfully attacked a device, the crated adversarial example may have a chance to attack the rest devices.
Revised: So if an adversary has successfully attacked a device, the crated adversarial example may have a chance to attack the rest devices.

Original: The interval-label classiﬁcation task promises to address the issue mentioned above since the defender can adopt a different combination of α and β .
Revised: The interval-label classiﬁcation task promises to address the issue mentioned above since the defender can adopt a different combination of α and β .

Original: 4. Conclusion
Revised: 4. Conclusion

Original: In this paper, we extend the deﬁnition of the adversarial robustness of DNNs to the deep learning system.
Revised: In this paper, we extend the deﬁnition of the adversarial robustness of DNNs to the deep learning system.

Original: Furthermore, we ﬁrst investigate the learning task robustness of the deep learning system.
Revised: Furthermore, we ﬁrst investigate the learning task robustness of the deep learning system.

Original: The experimental results show that the interval-label classiﬁcation task can alleviate the competition between accuracy and robustness for the deep learning system.
Revised: The experimental results show that the interval-label classiﬁcation task can alleviate the competition between accuracy and robustness for the deep learning system.

Original: Moreover, the traditional classiﬁcation task is easily transformed into the interval-label classiﬁcation task.
Revised: Moreover, the traditional classiﬁcation task is easily transformed into the interval-label classiﬁcation task.

Original: However, the interval-label classiﬁcation task converges slower than the traditional classiﬁcation task.
Revised: However, the interval-label classiﬁcation task converges slower than the traditional classiﬁcation task.

Original: In the future, a more efﬁcient interval-label classiﬁcation deep learning system will be explored.
Revised: In the future, a more efﬁcient interval-label classiﬁcation deep learning system will be explored.