Original: Laplacian Networks: Bounding Indicator Function Smoothness for Neural Networks Robustness
Revised: Laplacian Networks: Bounding Indicator Function Smoothness for Neural Networks Robustness

Original: Anonymous authors
Revised: Anonymous authors

Original: Paper under double-blind review
Revised: Paper under double-blind review

Original: Abstract
Revised: Abstract

Original: For the past few years, Deep Neural Network (DNN) robustness has become a question of paramount importance.
Revised: For the past few years, Deep Neural Network (DNN) robustness has become a question of paramount importance.

Original: As a matter of fact, in sensitive settings misclassiﬁcation can lead to dramatic consequences.
Revised: As a matter of fact, in sensitive settings misclassiﬁcation can lead to dramatic consequences.

Original: Such misclassiﬁcations are likely to occur when facing adversarial attacks, hardware failures or limitations, and imperfect signal acquisition.
Revised: Such misclassiﬁcations are likely to occur when facing adversarial attacks, hardware failures or limitations, and imperfect signal acquisition.

Original: To address this question, authors have proposed diﬀerent approaches aiming at increasing the robustness of DNNs, such as adding regularizers or training using noisy examples.
Revised: To address this question, authors have proposed diﬀerent approaches aiming at increasing the robustness of DNNs, such as adding regularizers or training using noisy examples.

Original: In this paper we propose a new regularizer built upon the
Revised: In this paper we propose a new regularizer built upon the

Original: Laplacian of similarity graphs obtained from the representation of training data at each layer of the DNN architecture.
Revised: Laplacian of similarity graphs obtained from the representation of training data at each layer of the DNN architecture.

Original: This regularizer penalizes large changes (across consecutive layers in the architecture) in the distance between examples of diﬀerent classes, and as such enforces smooth variations of the class boundaries.
Revised: This regularizer penalizes large changes (across consecutive layers in the architecture) in the distance between examples of diﬀerent classes, and as such enforces smooth variations of the class boundaries.

Original: Since it is agnostic to the type of deformations that are expected when predicting with the DNN, the proposed regularizer can be combined with existing ad-hoc methods.
Revised: Since it is agnostic to the type of deformations that are expected when predicting with the DNN, the proposed regularizer can be combined with existing ad-hoc methods.

Original: We provide theoretical justiﬁcation for this regularizer and demonstrate its eﬀectiveness to improve robustness of DNNs on classical supervised learning vision datasets.
Revised: We provide theoretical justiﬁcation for this regularizer and demonstrate its eﬀectiveness to improve robustness of DNNs on classical supervised learning vision datasets.

Original:  Introduction
Revised:  Introduction

Original: Deep Neural Networks (DNNs) provide state-of-the-art performance in many challenges in machine learning (He et al., 2016; Wu et al., 2016).
Revised: Deep Neural Networks (DNNs) provide state-of-the-art performance in many challenges in machine learning (He et al., 2016; Wu et al., 2016).

Original: Their ability to achieve good generalization is often explained by the fact they use very few priors about data (LeCun et al., 2015).
Revised: Their ability to achieve good generalization is often explained by the fact they use very few priors about data (LeCun et al., 2015).

Original: On the other hand, their strong dependency on data may lead to focus on biased features of the training dataset, resulting in a nonrobust classiﬁcation performance.
Revised: On the other hand, their strong dependency on data may lead to focus on biased features of the training dataset, resulting in a nonrobust classiﬁcation performance.

Original: In the literature authors have been interested in studying the robustness of DNNs in various conditions.
Revised: In the literature authors have been interested in studying the robustness of DNNs in various conditions.

Original: These conditions include:
Revised: These conditions include:

Original: • Robustness to isotropic noise,
Revised: • Robustness to isotropic noise,

Original: i
Revised: i

Original: e., small isotropic variations of the input (Mallat, 2016), typically meaning that the network function leads to a small Lipschitz constant.
Revised: e., small isotropic variations of the input (Mallat, 2016), typically meaning that the network function leads to a small Lipschitz constant.

Original: • Robustness to adversarial attacks, which can exploit knowledge about the network parameters or the training dataset (Szegedy et al., 2013; Goodfellow et al., 2014).
Revised: • Robustness to adversarial attacks, which can exploit knowledge about the network parameters or the training dataset (Szegedy et al., 2013; Goodfellow et al., 2014).

Original: • Robustness to implementation defects, which can result in only approximately correct computations (Hubara et al., 2017).
Revised: • Robustness to implementation defects, which can result in only approximately correct computations (Hubara et al., 2017).

Original: To improve DNN robustness, three main families of solutions have been proposed in the literature.
Revised: To improve DNN robustness, three main families of solutions have been proposed in the literature.

Original: The ﬁrst one involves enforcing smoothness, as measured by a Lipschitz constant, in the operators and having a minimum separation margin (Mallat, 2016).
Revised: The ﬁrst one involves enforcing smoothness, as measured by a Lipschitz constant, in the operators and having a minimum separation margin (Mallat, 2016).

Original: A similar approach has been proposed in (Cisse et al., 2017), where the authors restrict the function of the network to be contractive.
Revised: A similar approach has been proposed in (Cisse et al., 2017), where the authors restrict the function of the network to be contractive.

Original: A second class of methods use intermediate representations obtained at various layers to perform the prediction (Papernot and McDaniel, 2018).
Revised: A second class of methods use intermediate representations obtained at various layers to perform the prediction (Papernot and McDaniel, 2018).

Original: Finally, in (Kurakin et al., 2016; Pezeshki et al., 2016; Madry et al., 2018), the authors propose to train the network using noisy inputs so that it better generalizes to this type of noise.
Revised: Finally, in (Kurakin et al., 2016; Pezeshki et al., 2016; Madry et al., 2018), the authors propose to train the network using noisy inputs so that it better generalizes to this type of noise.

Original: This has been shown to improve the robustness of the network to the speciﬁc type of noise used during training, but it is not guaranteed that this robustness would be extended to other types of deformations.
Revised: This has been shown to improve the robustness of the network to the speciﬁc type of noise used during training, but it is not guaranteed that this robustness would be extended to other types of deformations.

Original: In this work, we introduce a new regularizer that does not focus on a speciﬁc type of deformation, but aims at increasing robustness in general.
Revised: In this work, we introduce a new regularizer that does not focus on a speciﬁc type of deformation, but aims at increasing robustness in general.

Original: As such, the proposed regularizer can be combined with other existing methods.
Revised: As such, the proposed regularizer can be combined with other existing methods.

Original: It is inspired by recent developments in Graph
Revised: It is inspired by recent developments in Graph

Original: Signal Processing (GSP) (Shuman et al., 2013).
Revised: Signal Processing (GSP) (Shuman et al., 2013).

Original: GSP is a mathematical framework that extends classical Fourier analysis to complex topologies described by graphs, by introducing notions of frequency for signals deﬁned on graphs.
Revised: GSP is a mathematical framework that extends classical Fourier analysis to complex topologies described by graphs, by introducing notions of frequency for signals deﬁned on graphs.

Original: Thus, signals that are smooth on the graph (i.e., change slowly from one node to its neighbors) will have most of their energy concentrated in the low frequencies.
Revised: Thus, signals that are smooth on the graph (i.e., change slowly from one node to its neighbors) will have most of their energy concentrated in the low frequencies.

Original: The proposed regularizer is based on constructing a series of graphs, one for each layer of the
Revised: The proposed regularizer is based on constructing a series of graphs, one for each layer of the

Original: DNN architecture, where each graph captures the similarity between all training examples given their intermediate representation at that layer.
Revised: DNN architecture, where each graph captures the similarity between all training examples given their intermediate representation at that layer.

Original: Our proposed regularizer penalizes large changes in the smoothness of class indicator vectors (viewed here as graph signals) from one layer to the next.
Revised: Our proposed regularizer penalizes large changes in the smoothness of class indicator vectors (viewed here as graph signals) from one layer to the next.

Original: As a consequence, the distances between pairs of examples in diﬀerent classes are only allowed to change slowly from one layer to the next.
Revised: As a consequence, the distances between pairs of examples in diﬀerent classes are only allowed to change slowly from one layer to the next.

Original: Note that because we use deep architectures, the regularizer does not prevent the smoothness from achieving its maximum value, but constraining the size of changes from layer to layer increases the robustness of the network function by controlling the distance to the boundary region, as supported by experiments in Section 4.
Revised: Note that because we use deep architectures, the regularizer does not prevent the smoothness from achieving its maximum value, but constraining the size of changes from layer to layer increases the robustness of the network function by controlling the distance to the boundary region, as supported by experiments in Section 4.

Original: The outline of the paper is as follows.
Revised: The outline of the paper is as follows.

Original: In Section 2 we present related work.
Revised: In Section 2 we present related work.

Original: In Sectionwe introduce the proposed regularizer.
Revised: In Sectionwe introduce the proposed regularizer.

Original: In Section 4 we evaluate the performance of our proposed method in various conditions and on vision benchmarks.
Revised: In Section 4 we evaluate the performance of our proposed method in various conditions and on vision benchmarks.

Original: Section 5 summarizes our conclusions.
Revised: Section 5 summarizes our conclusions.

Original:  Related work
Revised:  Related work

Original: DNN robustness may refer to many diﬀerent problems.
Revised: DNN robustness may refer to many diﬀerent problems.

Original: In this work we are mostly interested in the stability to deformations (Mallat, 2016), or noise, which can be due to multiple factors mentioned in the introduction.
Revised: In this work we are mostly interested in the stability to deformations (Mallat, 2016), or noise, which can be due to multiple factors mentioned in the introduction.

Original: The most studied stability to deformations is in the context of adversarial attacks.
Revised: The most studied stability to deformations is in the context of adversarial attacks.

Original: It has been shown that very small imperceptible changes on the input of a trained DNN can result in missclassiﬁcation of the input (Szegedy et al., 2013;
Revised: It has been shown that very small imperceptible changes on the input of a trained DNN can result in missclassiﬁcation of the input (Szegedy et al., 2013;

Original: Goodfellow et al., 2014).
Revised: Goodfellow et al., 2014).

Original: These works have been primordial to show that DNNs may not be as robust to deformations as the test accuracy benchmarks would have lead one to believe.
Revised: These works have been primordial to show that DNNs may not be as robust to deformations as the test accuracy benchmarks would have lead one to believe.

Original: Other works, such as (Recht et al., 2018), have shown that DNNs may also suﬀer from drops in performance when facing deformations that are not originated from adversarial attacks, but simply by re-sampling the test images.
Revised: Other works, such as (Recht et al., 2018), have shown that DNNs may also suﬀer from drops in performance when facing deformations that are not originated from adversarial attacks, but simply by re-sampling the test images.

Original: Multiple ways to improve robustness have been proposed in the literature.
Revised: Multiple ways to improve robustness have been proposed in the literature.

Original: They range from the use of a model ensemble composed of k -nearest neighbors classiﬁers for each layer (Papernot and McDaniel, 2018), to the use of distillation as a mean to protect the network (Papernot et al., 2016a).
Revised: They range from the use of a model ensemble composed of k -nearest neighbors classiﬁers for each layer (Papernot and McDaniel, 2018), to the use of distillation as a mean to protect the network (Papernot et al., 2016a).

Original: Other methods introduce regularizers (Gu and Rigazio, 2014), control the Lipschitz constant of the network function (Cisse et al., 2017) or implement multiple strategies revolving around using deformations as a data augmentation procedure during the training phase (Goodfellow et al., 2014; Kurakin et al., 2016; Moosavi Dezfooli et al., 2016).
Revised: Other methods introduce regularizers (Gu and Rigazio, 2014), control the Lipschitz constant of the network function (Cisse et al., 2017) or implement multiple strategies revolving around using deformations as a data augmentation procedure during the training phase (Goodfellow et al., 2014; Kurakin et al., 2016; Moosavi Dezfooli et al., 2016).

Original: Compared to these works, our proposed method can be viewed as a regularizer that penalizes large deformations of the class boundaries throughout the network architecture, instead of focusing on a speciﬁc deformation of the input.
Revised: Compared to these works, our proposed method can be viewed as a regularizer that penalizes large deformations of the class boundaries throughout the network architecture, instead of focusing on a speciﬁc deformation of the input.

Original: As such, it can be combined with other mentioned strategies.
Revised: As such, it can be combined with other mentioned strategies.

Original: Indeed, we demonstrate that the proposed method can be implemented in combination with (Cisse et al., 2017), resulting in a network function such that small variations to the input lead to small variations in the decision, as in (Cisse et al., 2017), while limiting the amount of change to the class boundaries.
Revised: Indeed, we demonstrate that the proposed method can be implemented in combination with (Cisse et al., 2017), resulting in a network function such that small variations to the input lead to small variations in the decision, as in (Cisse et al., 2017), while limiting the amount of change to the class boundaries.

Original: Note that our approach does not require using training data aﬀected by a speciﬁc deformation, and our results could be further improved if such data were available for training, as shown in the Appendix.
Revised: Note that our approach does not require using training data aﬀected by a speciﬁc deformation, and our results could be further improved if such data were available for training, as shown in the Appendix.

Original: As for combining GSP and machine learning, this area has sparked interest recently.
Revised: As for combining GSP and machine learning, this area has sparked interest recently.

Original: For example, the authors of (Gripon et al., 2018) show that it is possible to detect overﬁtting by tracking the evolution of the smoothness of a graph containing only training set examples.
Revised: For example, the authors of (Gripon et al., 2018) show that it is possible to detect overﬁtting by tracking the evolution of the smoothness of a graph containing only training set examples.

Original: Another example is in (Anirudh et al., 2017) where the authors introduce diﬀerent quantities related to GSP that can be used to extract interpretable results from DNNs.
Revised: Another example is in (Anirudh et al., 2017) where the authors introduce diﬀerent quantities related to GSP that can be used to extract interpretable results from DNNs.

Original: In (Svoboda et al., 2018) the authors exploit graph convolutional layers (Bronstein et al., 2017) to increase the robustness of the network.
Revised: In (Svoboda et al., 2018) the authors exploit graph convolutional layers (Bronstein et al., 2017) to increase the robustness of the network.

Original: To the best of our knowledge, this is the ﬁrst use of graph signal smoothness as a regularizer for deep neural network design.
Revised: To the best of our knowledge, this is the ﬁrst use of graph signal smoothness as a regularizer for deep neural network design.

Original:  Methodology 3. Similarity preset and postset graphs
Revised:  Methodology 3. Similarity preset and postset graphs

Original: Consider a deep neural network architecture.
Revised: Consider a deep neural network architecture.

Original: Such a network is obtained by assembling layers of various types.
Revised: Such a network is obtained by assembling layers of various types.

Original: Of particular interest are layers of the form x (cid:96) (cid:55)→ x (cid:96) +

Revised: Of particular interest are layers of the form x (cid:96) (cid:55)→ x (cid:96) +

Original: = h (cid:96) ( W (cid:96) x (cid:96) + b (cid:96) ) , where h (cid:96) is a nonlinear function, typically a ReLU, W (cid:96) is the weight tensor at layer (cid:96) , x (cid:96) is the intermediate representation of the input at layer (cid:96) and
Revised: = h (cid:96) ( W (cid:96) x (cid:96) + b (cid:96) ) , where h (cid:96) is a nonlinear function, typically a ReLU, W (cid:96) is the weight tensor at layer (cid:96) , x (cid:96) is the intermediate representation of the input at layer (cid:96) and

Original: b (cid:96) is the corresponding bias tensor.
Revised: b (cid:96) is the corresponding bias tensor.

Original: Note that strides or pooling may be used.
Revised: Note that strides or pooling may be used.

Original: Assembling can be achieved in various ways: composition, concatenation, sums. . .
Revised: Assembling can be achieved in various ways: composition, concatenation, sums. . .

Original: so that we obtain a global function f that associates an input tensor x 0 to an output tensor y =
Revised: so that we obtain a global function f that associates an input tensor x 0 to an output tensor y =

Original: f ( x 0 ) .
Revised: f ( x 0 ) .

Original: When computing the output y associated with the input x 0 , each layer (cid:96) of the architecture processes some input x (cid:96) and computes the corresponding output y (cid:96) =
Revised: When computing the output y associated with the input x 0 , each layer (cid:96) of the architecture processes some input x (cid:96) and computes the corresponding output y (cid:96) =

Original: h (cid:96) ( W (cid:96) x (cid:96) + b (cid:96) ) .
Revised: h (cid:96) ( W (cid:96) x (cid:96) + b (cid:96) ) .

Original: For a given layer (cid:96) and a batch of b inputs X = { x 1 , . . .
Revised: For a given layer (cid:96) and a batch of b inputs X = { x 1 , . . .

Original: , x b } , we can obtain two sets
Revised: , x b } , we can obtain two sets

Original: X (cid:96) =
Revised: X (cid:96) =

Original: { x (cid:96) 1 , . . .
Revised: { x (cid:96) 1 , . . .

Original: , x (cid:96)b } , called the preset , and Y (cid:96) =
Revised: , x (cid:96)b } , called the preset , and Y (cid:96) =

Original: { y (cid:96) 1 , . . .
Revised: { y (cid:96) 1 , . . .

Original: , y (cid:96)b } , called the postset .
Revised: , y (cid:96)b } , called the postset .

Original: Given a similarity measure s on tensors, from a preset we can build the similarity preset matrix: M (cid:96)pre [ i, j ] = s ( x (cid:96)i , x (cid:96)j ) , ∀ 1 ≤
Revised: Given a similarity measure s on tensors, from a preset we can build the similarity preset matrix: M (cid:96)pre [ i, j ] = s ( x (cid:96)i , x (cid:96)j ) , ∀ 1 ≤

Original: i, j ≤ b , where M [ i, j ] denotes the element at line i and column j in M .
Revised: i, j ≤ b , where M [ i, j ] denotes the element at line i and column j in M .

Original: The postset matrix is deﬁned similarly.
Revised: The postset matrix is deﬁned similarly.

Original: Consider a similarity (either preset or postset) matrix M (cid:96) .
Revised: Consider a similarity (either preset or postset) matrix M (cid:96) .

Original: This matrix can be used to build a k -nearest neighbor similarity weighted graph G (cid:96) =
Revised: This matrix can be used to build a k -nearest neighbor similarity weighted graph G (cid:96) =

Original: (cid:104) V, A (cid:96) (cid:105) , where V = { 1 , . . .
Revised: (cid:104) V, A (cid:96) (cid:105) , where V = { 1 , . . .

Original: , b } is the set of vertices and A (cid:96) is the weighted adjacency matrix deﬁned as:
Revised: , b } is the set of vertices and A (cid:96) is the weighted adjacency matrix deﬁned as:

Original: [Equation]
Revised: [Equation]

Original: otherwise
Revised: otherwise

Original: [Equation]
Revised: [Equation]

Original: where arg max i ( a i , k ) denotes the indices of the k largest elements in { a 1 , . .
Revised: where arg max i ( a i , k ) denotes the indices of the k largest elements in { a 1 , . .

Original: . , a b } .
Revised: . , a b } .

Original: Note that by construction A (cid:96) is symmetric.
Revised: Note that by construction A (cid:96) is symmetric.

Original: 3. Smoothness of label signals
Revised: 3. Smoothness of label signals

Original: Given a weighted graph G (cid:96) =
Revised: Given a weighted graph G (cid:96) =

Original: (cid:104) V, A (cid:96) (cid:105) , we call Laplacian of G (cid:96) the matrix L (cid:96) =
Revised: (cid:104) V, A (cid:96) (cid:105) , we call Laplacian of G (cid:96) the matrix L (cid:96) =

Original: D (cid:96) − A (cid:96) , where D (cid:96) is the diagonal matrix such that: D (cid:96) [ i, i ] =
Revised: D (cid:96) − A (cid:96) , where D (cid:96) is the diagonal matrix such that: D (cid:96) [ i, i ] =

Original: (cid:80) j A (cid:96) [ i, j ] , ∀ i ∈ V .
Revised: (cid:80) j A (cid:96) [ i, j ] , ∀ i ∈ V .

Original: Because L (cid:96) is symmetric and real-valued, it can be written:
Revised: Because L (cid:96) is symmetric and real-valued, it can be written:

Original: [Equation]
Revised: [Equation]

Original: where F is orthonormal and contains eigenvectors of L (cid:96) as columns, F (cid:62) denotes the transpose of F , and Λ is diagonal and contains eigenvalues of L (cid:96) is ascending order.
Revised: where F is orthonormal and contains eigenvectors of L (cid:96) as columns, F (cid:62) denotes the transpose of F , and Λ is diagonal and contains eigenvalues of L (cid:96) is ascending order.

Original: Note that the constant vector 1 ∈ R b is an eigenvector of L (cid:96) corresponding to eigenvalue 0 .
Revised: Note that the constant vector 1 ∈ R b is an eigenvector of L (cid:96) corresponding to eigenvalue 0 .

Original: Moreover, all eigenvalues of L (cid:96) are nonnegative.
Revised: Moreover, all eigenvalues of L (cid:96) are nonnegative.

Original: Consequently, 1 / √ n can be chosen as the ﬁrst column in
Revised: Consequently, 1 / √ n can be chosen as the ﬁrst column in

Original: F .
Revised: F .

Original: Consider a vector s ∈ R b , we deﬁne ˆ s the Graph Fourier Transform (GFT) of s on G (cid:96) as (Shuman et al., 2013):
Revised: Consider a vector s ∈ R b , we deﬁne ˆ s the Graph Fourier Transform (GFT) of s on G (cid:96) as (Shuman et al., 2013):

Original: [Equation]
Revised: [Equation]

Original: Because the order of the eigenvectors is chosen so that the corresponding eigenvalues are in ascending order, if only the ﬁrst few entries of ˆ s are nonzero that indicates that s is low frequency (smooth).
Revised: Because the order of the eigenvectors is chosen so that the corresponding eigenvalues are in ascending order, if only the ﬁrst few entries of ˆ s are nonzero that indicates that s is low frequency (smooth).

Original: In the extreme case where only the ﬁrst entry of ˆ s is nonzero we have that s is constant (maximum smoothness).
Revised: In the extreme case where only the ﬁrst entry of ˆ s is nonzero we have that s is constant (maximum smoothness).

Original: More generally, smoothness σ (cid:96) ( s ) of a signal s can be measured using the quadratic form of the Laplacian:
Revised: More generally, smoothness σ (cid:96) ( s ) of a signal s can be measured using the quadratic form of the Laplacian:

Original: [Equation]
Revised: [Equation]

Original: where we note that s is smoother when σ (cid:96) ( s ) is smaller.
Revised: where we note that s is smoother when σ (cid:96) ( s ) is smaller.

Original: In this paper we are particularly interested in smoothness of the label signals.
Revised: In this paper we are particularly interested in smoothness of the label signals.

Original: We call label signal s c associated with class c a binary ( { 0 , 1 } ) vector whose nonzero coordinates are the ones corresponding to input vectors of class c .
Revised: We call label signal s c associated with class c a binary ( { 0 , 1 } ) vector whose nonzero coordinates are the ones corresponding to input vectors of class c .

Original: In other words, s c
Revised: In other words, s c

Original: [ i ] = 1 ⇔ ( x i is in class c ) , ∀ 1 ≤ i ≤ b .
Revised: [ i ] = 1 ⇔ ( x i is in class c ) , ∀ 1 ≤ i ≤ b .

Original: Using Equation (4), we obtain that the smoothness of the label signal s c is the sum of similarities between examples in distinct classes.
Revised: Using Equation (4), we obtain that the smoothness of the label signal s c is the sum of similarities between examples in distinct classes.

Original: Thus a smoothness of 0 means that examples in distinct classes have 0 similarity.
Revised: Thus a smoothness of 0 means that examples in distinct classes have 0 similarity.

Original: Denote u the last layer of the architecture: y u i =
Revised: Denote u the last layer of the architecture: y u i =

Original: y i , ∀ i .
Revised: y i , ∀ i .

Original: Note that in typical settings, where outputs of the networks are one-hot-bit encoded and no regularizer is used, at the end of the learning process it is expected that y (cid:62) i y j ≈ 1 if i and j belong to the same class, and y (cid:62) i y j ≈ 0 otherwise.
Revised: Note that in typical settings, where outputs of the networks are one-hot-bit encoded and no regularizer is used, at the end of the learning process it is expected that y (cid:62) i y j ≈ 1 if i and j belong to the same class, and y (cid:62) i y j ≈ 0 otherwise.

Original: Thus, assuming that cosine similarity is used to build the graph, the last layer smoothness for all c would be σ upost ( s c ) ≈ 0 , since edge weights between nodes having diﬀerent labels will be close to zero given Equation (4).
Revised: Thus, assuming that cosine similarity is used to build the graph, the last layer smoothness for all c would be σ upost ( s c ) ≈ 0 , since edge weights between nodes having diﬀerent labels will be close to zero given Equation (4).

Original: More generally, smoothness of s c at the preset or postset of a given layer measures the average similarity between examples in class c and examples in other classes ( σ ( s c ) decreases as the weights of edges connecting nodes in diﬀerent classes decrease).
Revised: More generally, smoothness of s c at the preset or postset of a given layer measures the average similarity between examples in class c and examples in other classes ( σ ( s c ) decreases as the weights of edges connecting nodes in diﬀerent classes decrease).

Original: Because the last layer can achieve σ ( s c ) ≈ 0 , we expect the smoothness metric σ at each layer to decrease as we go deeper in the network.
Revised: Because the last layer can achieve σ ( s c ) ≈ 0 , we expect the smoothness metric σ at each layer to decrease as we go deeper in the network.

Original: Next we introduce a regularization strategy that limits how much σ can decrease from one layer to the next and can even prevent the last layer from achieving σ ( s c ) = 0 .
Revised: Next we introduce a regularization strategy that limits how much σ can decrease from one layer to the next and can even prevent the last layer from achieving σ ( s c ) = 0 .

Original: This will be shown to improve generalization and robustness.
Revised: This will be shown to improve generalization and robustness.

Original: The theoretical motivation for this choice is discussed in Section 3.4.
Revised: The theoretical motivation for this choice is discussed in Section 3.4.

Original: 3. Proposed regularizer 3.3. Definition
Revised: 3. Proposed regularizer 3.3. Definition

Original: We propose to measure the deformation induced by a given layer (cid:96) in the relative positions of examples by computing the diﬀerence between label signal smoothness before and after the layer, averaged over all labels:
Revised: We propose to measure the deformation induced by a given layer (cid:96) in the relative positions of examples by computing the diﬀerence between label signal smoothness before and after the layer, averaged over all labels:

Original: [Equation]
Revised: [Equation]

Original: These quantities are used to regularize modiﬁcations made to each of the layers during the learning process.
Revised: These quantities are used to regularize modiﬁcations made to each of the layers during the learning process.

Original: Remark 1: Since we only consider label signals, we solely depend on the similarities between examples that belong to distinct classes.
Revised: Remark 1: Since we only consider label signals, we solely depend on the similarities between examples that belong to distinct classes.

Original: In other words, the regularizer only focuses on the boundary region, and does not vary if the distance between examples of the same label grows or shrinks.
Revised: In other words, the regularizer only focuses on the boundary region, and does not vary if the distance between examples of the same label grows or shrinks.

Original: This is because forcing similarities between examples of a same class to evolve slowly could prevent the network to train appropriately.
Revised: This is because forcing similarities between examples of a same class to evolve slowly could prevent the network to train appropriately.

Original: Remark 2:
Revised: Remark 2:

Original: Compared with (Cisse et al., 2017), there are three key diﬀerences that characterize the proposed regularizer:
Revised: Compared with (Cisse et al., 2017), there are three key diﬀerences that characterize the proposed regularizer:

Original: Not all pairwise distances are taken into account in the regularization; only distances between examples corresponding to diﬀerent classes play a role in
Revised: Not all pairwise distances are taken into account in the regularization; only distances between examples corresponding to diﬀerent classes play a role in

Original: the regularization.
Revised: the regularization.

Original: We allow a limited amount of both contraction and dilation of the metric space.
Revised: We allow a limited amount of both contraction and dilation of the metric space.

Original: Experimental work (e.g. (Gripon et al., 2018; Papernot and McDaniel, 2018)) has
Revised: Experimental work (e.g. (Gripon et al., 2018; Papernot and McDaniel, 2018)) has

Original: [Figure]
Revised: [Figure]

Original: shown that the evolution of metric spaces across DNN layers is complex, and thus restricting ourselves to contractions only could lead to lower overall performance.
Revised: shown that the evolution of metric spaces across DNN layers is complex, and thus restricting ourselves to contractions only could lead to lower overall performance.

Original: The proposed criterion is an average (sum) over all distances, rather than a stricter criterion (e.g. Lipschitz), which would force each pair of vectors ( x i , x j ) to obey the constraint.
Revised: The proposed criterion is an average (sum) over all distances, rather than a stricter criterion (e.g. Lipschitz), which would force each pair of vectors ( x i , x j ) to obey the constraint.

Original: Illustrative example:
Revised: Illustrative example:

Original: In Figure 1 we depict a toy illustrative example to motivate the proposed regularizer.
Revised: In Figure 1 we depict a toy illustrative example to motivate the proposed regularizer.

Original: We consider here a one-dimensional two-class problem.
Revised: We consider here a one-dimensional two-class problem.

Original: To linearly separate circles and crosses, it is necessary to group all circles.
Revised: To linearly separate circles and crosses, it is necessary to group all circles.

Original: Without regularization (setting i)), the resulting embedding is likely to increase considerably the distance between examples and the size of the boundary region between classes.
Revised: Without regularization (setting i)), the resulting embedding is likely to increase considerably the distance between examples and the size of the boundary region between classes.

Original: In contrast, by penalizing large variations of the smoothness of label signals (setting ii)), the average distance between circles and crosses must be preserved in the embedding domain, resulting in a more precise control of distances within the boundary region.
Revised: In contrast, by penalizing large variations of the smoothness of label signals (setting ii)), the average distance between circles and crosses must be preserved in the embedding domain, resulting in a more precise control of distances within the boundary region.

Original: 3. Motivation: label signal bandwidth and powers of the Laplacian
Revised: 3. Motivation: label signal bandwidth and powers of the Laplacian

Original: Recent work (Anis et al., 2017) develops an asymptotic analysis of the bandwidth of label signals, BW ( s ) , where bandwidth is deﬁned as the highest non-zero graph frequency of s , i.e., the nonzero entry of ˆ s with the highest index.
Revised: Recent work (Anis et al., 2017) develops an asymptotic analysis of the bandwidth of label signals, BW ( s ) , where bandwidth is deﬁned as the highest non-zero graph frequency of s , i.e., the nonzero entry of ˆ s with the highest index.

Original: An estimate of the bandwidth can be obtained by computing:
Revised: An estimate of the bandwidth can be obtained by computing:

Original: [Equation]
Revised: [Equation]

Original: [Equation]

Original: for large m .
Revised: for large m .

Original: This can be viewed as a generalization of the smoothness metric of (4).
Revised: This can be viewed as a generalization of the smoothness metric of (4).

Original: (Anis et al., 2017) shows that, as the number of labeled points x (assumed drawn from a distribution p ( x ) ) grows asymptotically, the bandwidth of the label signal converges in probability to the supremum of p ( x ) in the region of overlap between classes.
Revised: (Anis et al., 2017) shows that, as the number of labeled points x (assumed drawn from a distribution p ( x ) ) grows asymptotically, the bandwidth of the label signal converges in probability to the supremum of p ( x ) in the region of overlap between classes.

Original: This motivates our work in three ways.
Revised: This motivates our work in three ways.

Original: First, it provides theoretical justiﬁcation to use σ (cid:96) ( s ) for regularization, since lower values of σ (cid:96) ( s ) are indicative of better separation between classes.
Revised: First, it provides theoretical justiﬁcation to use σ (cid:96) ( s ) for regularization, since lower values of σ (cid:96) ( s ) are indicative of better separation between classes.

Original: Second, the asymptotic analysis suggests that using higher powers of the Laplacian would lead to better regularization, since estimating bandwidth using BW m ( s ) becomes increasingly accurate as m increases.
Revised: Second, the asymptotic analysis suggests that using higher powers of the Laplacian would lead to better regularization, since estimating bandwidth using BW m ( s ) becomes increasingly accurate as m increases.

Original: Finally, this regularization can be seen to be protective against specializing by preventing σ (cid:96) ( s )
Revised: Finally, this regularization can be seen to be protective against specializing by preventing σ (cid:96) ( s )

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: from decreasing “too fast”.
Revised: from decreasing “too fast”.

Original: For most problems of interest, given a suﬃciently large amount of labeled data available, it would be reasonable to expect the bandwidth of s not to be arbitrarily small, because the classes cannot be exactly separated, and thus a network that reduces the bandwidth too much can result in being biased by the training set.
Revised: For most problems of interest, given a suﬃciently large amount of labeled data available, it would be reasonable to expect the bandwidth of s not to be arbitrarily small, because the classes cannot be exactly separated, and thus a network that reduces the bandwidth too much can result in being biased by the training set.

Original: 3. Analysis of the Laplacian powers
Revised: 3. Analysis of the Laplacian powers

Original: In Figure 2 we depict the Laplacian and squared Laplacian of similarity graphs obtained at diﬀerent layers in a trained vanilla architecture.
Revised: In Figure 2 we depict the Laplacian and squared Laplacian of similarity graphs obtained at diﬀerent layers in a trained vanilla architecture.

Original: On the deep layers, we can clearly see blocks corresponding to the classes, while the situation in the middle layer is not as clear.
Revised: On the deep layers, we can clearly see blocks corresponding to the classes, while the situation in the middle layer is not as clear.

Original: This ﬁgure illustrates how using the squared Laplacian helps modifying the distances to improve separation.
Revised: This ﬁgure illustrates how using the squared Laplacian helps modifying the distances to improve separation.

Original: Note that we normalize the squared Laplacian values by dividing them by the highest absolute value.
Revised: Note that we normalize the squared Laplacian values by dividing them by the highest absolute value.

Original: In Figure 3, we plot the average evolution of smoothness of label signals over 100 batches, as a function of layer depth in the architecture, and for diﬀerent choices of the regularizer.
Revised: In Figure 3, we plot the average evolution of smoothness of label signals over 100 batches, as a function of layer depth in the architecture, and for diﬀerent choices of the regularizer.

Original: In the left part, we look at smoothness measures using the Laplacian.
Revised: In the left part, we look at smoothness measures using the Laplacian.

Original: In the right part, we use the squared Laplacian.
Revised: In the right part, we use the squared Laplacian.

Original: We can clearly see the eﬀectiveness of the regularizer in enforcing small variations of smoothness across the architecture.
Revised: We can clearly see the eﬀectiveness of the regularizer in enforcing small variations of smoothness across the architecture.

Original: Note that for model regularized with L 2 , changes in smoothness measured by L are not easy to see.
Revised: Note that for model regularized with L 2 , changes in smoothness measured by L are not easy to see.

Original: This seems to suggest that some of the gains achieved via L 2 regularization come in making changes that would be “invisible” when looking at the layers from the perspective of L smoothness.
Revised: This seems to suggest that some of the gains achieved via L 2 regularization come in making changes that would be “invisible” when looking at the layers from the perspective of L smoothness.

Original: The same normalization from Figure 2 is used for L 2 .
Revised: The same normalization from Figure 2 is used for L 2 .

Original:  Experiments
Revised:  Experiments

Original: In the following paragraphs we evaluate the proposed method using various tests.
Revised: In the following paragraphs we evaluate the proposed method using various tests.

Original: We use the well known CIFAR-10 (Krizhevsky and Hinton, 2009) dataset made of tiny images.
Revised: We use the well known CIFAR-10 (Krizhevsky and Hinton, 2009) dataset made of tiny images.

Original: As far as the DNN is concerned, we use the same PreActResNet
Revised: As far as the DNN is concerned, we use the same PreActResNet

Original: (He et al., 2016) architecture for all tests, with 18 layers.
Revised: (He et al., 2016) architecture for all tests, with 18 layers.

Original: All inputs, including those on the test set, are normalized based on the mean and standard deviation of the images of the training set.
Revised: All inputs, including those on the test set, are normalized based on the mean and standard deviation of the images of the training set.

Original: In all ﬁgures, P are
Revised: In all ﬁgures, P are

Original: SNR ≈ ∞
Revised: SNR ≈ ∞

Original: SNR ≈ SNR ≈
Revised: SNR ≈ SNR ≈

Original: [Figure]
Revised: [Figure]

Original: T e s t s e t
Revised: T e s t s e t

Original: A cc u r a c y
Revised: A cc u r a c y

Original: [Figure]
Revised: [Figure]

Original: Parseval trained networks, R are networks trained with the proposed regularizer and V are vanilla networks.
Revised: Parseval trained networks, R are networks trained with the proposed regularizer and V are vanilla networks.

Original: More details and experiments can be found at the Appendix.
Revised: Appendix.

Original: We depict the obtained results using box plots where data is aggregated from 10 diﬀerent networks corresponding to diﬀerent random seeds and batch orders.
Revised: We depict the obtained results using box plots where data is aggregated from 10 diﬀerent networks corresponding to diﬀerent random seeds and batch orders.

Original: In the ﬁrst experiment (left most plot) in Figure 4, we plot the baseline accuracy of the models on the clean test set (no deformation is added at this point).
Revised: In the ﬁrst experiment (left most plot) in Figure 4, we plot the baseline accuracy of the models on the clean test set (no deformation is added at this point).

Original: These experiments agree with the claim from (Cisse et al., 2017) where the authors show that they are able to increase the performance of the network on the clean test set.
Revised: These experiments agree with the claim from (Cisse et al., 2017) where the authors show that they are able to increase the performance of the network on the clean test set.

Original: We observe that our proposed method leads to a minor decrease of performance on this test.
Revised: We observe that our proposed method leads to a minor decrease of performance on this test.

Original: However, we see in the following experiments that this is mitigated with increased robustness to deformations.
Revised: However, we see in the following experiments that this is mitigated with increased robustness to deformations.

Original: Such a trade-oﬀ between robustness and accuracy has already been discussed in the literature ().
Revised: Such a trade-oﬀ between robustness and accuracy has already been discussed in the literature ().

Original: 4. Isotropic deformation
Revised: 4. Isotropic deformation

Original: In this scenario we evaluate the robustness of the network function to small isotropic variations of the input.
Revised: In this scenario we evaluate the robustness of the network function to small isotropic variations of the input.

Original: We generate 40 diﬀerent deformations using random variables N (0 , 0 . 25) which are added to the test set inputs.
Revised: We generate 40 diﬀerent deformations using random variables N (0 , 0 . 25) which are added to the test set inputs.

Original: Note that they are scaled so that SNR ≈ 15 and SNR ≈ 20 .
Revised: Note that they are scaled so that SNR ≈ 15 and SNR ≈ 20 .

Original: The middle and right-most plots from Figure 4 show that the proposed method increases the robustness of the network to isotropic deformations.
Revised: The middle and right-most plots from Figure 4 show that the proposed method increases the robustness of the network to isotropic deformations.

Original: Note that in both scenarios the best results are achieved by combining Parseval training and our proposed method (lower-most box on both ﬁgures).
Revised: Note that in both scenarios the best results are achieved by combining Parseval training and our proposed method (lower-most box on both ﬁgures).

Original: 4. Adversarial Robustness
Revised: 4. Adversarial Robustness

Original: We next evaluate robustness to adversarial inputs, which are speciﬁcally built to fool the network function.
Revised: We next evaluate robustness to adversarial inputs, which are speciﬁcally built to fool the network function.

Original: Such adversarial inputs can be generated and evaluated in multiple ways.
Revised: Such adversarial inputs can be generated and evaluated in multiple ways.

Original: Here we implement two approaches: ﬁrst a mean case of adversarial noise, where the adversary can only use one forward and one backward pass to generate the deformations, and second a worst case scenario, where the adversary can use multiple forward and backward passes to try to ﬁnd the smallest deformation that will fool the network.
Revised: Here we implement two approaches: ﬁrst a mean case of adversarial noise, where the adversary can only use one forward and one backward pass to generate the deformations, and second a worst case scenario, where the adversary can use multiple forward and backward passes to try to ﬁnd the smallest deformation that will fool the network.

Original: For the ﬁrst approach, we add the scaled gradient sign (FGSM attack) on the input (Kurakin et al., 2016), so that we obtain a target SNR = 33 .
Revised: For the ﬁrst approach, we add the scaled gradient sign (FGSM attack) on the input (Kurakin et al., 2016), so that we obtain a target SNR = 33 .

Original: Results are depicted in the left and center plots of Figure 5.
Revised: Results are depicted in the left and center plots of Figure 5.

Original: In the left plot the noise is added after normalizing the input whereas on the middle plot it is added before normalizing.
Revised: In the left plot the noise is added after normalizing the input whereas on the middle plot it is added before normalizing.

Original: As in the isotropic noise case, a combination of the Parseval method and our proposed approach achieves maximum robustness.
Revised: As in the isotropic noise case, a combination of the Parseval method and our proposed approach achieves maximum robustness.

Original: In regards to the second approach, where a worst case scenario is considered, we use the
Revised: In regards to the second approach, where a worst case scenario is considered, we use the

Original: Foolbox toolbox (Rauber et al., 2017) implementation of DeepFool (Moosavi Dezfooli et al., 2016).
Revised: Foolbox toolbox (Rauber et al., 2017) implementation of DeepFool (Moosavi Dezfooli et al., 2016).

Original: Due to time constraints we sample only 110 of the test set images for this test.
Revised: Due to time constraints we sample only 110 of the test set images for this test.

Original: The conclusions are similar (right plot of Figure 5) to those obtained for the ﬁrst adversarial attack approach.
Revised: The conclusions are similar (right plot of Figure 5) to those obtained for the ﬁrst adversarial attack approach.

Original: 4. Implementation robustness
Revised: 4. Implementation robustness

Original: Finally, in a third series of experiments we evaluate the robustness of the network functions to faulty implementations.
Revised: Finally, in a third series of experiments we evaluate the robustness of the network functions to faulty implementations.

Original: As a result, approximate computations are made during the
Revised: As a result, approximate computations are made during the

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: s
Revised: t a

Original: [Figure]
Revised: [Figure]

Original: t a cc u r a c y
Revised: u r a c y

Original: [Figure]
Revised: [Figure]

Original: test phase that consist of random erasures of the memory (dropout) or quantization of the weights (Hubara et al., 2017).
Revised: test phase that consist of random erasures of the memory (dropout) or quantization of the weights (Hubara et al., 2017).

Original: In the dropout case, we compute the test set accuracy when the network has a probability of either 25% or 40% of dropping a neuron’s value after each block.
Revised: In the dropout case, we compute the test set accuracy when the network has a probability of either 25% or 40% of dropping a neuron’s value after each block.

Original: We run each experiment 40 times.
Revised: We run each experiment 40 times.

Original: The results are depicted in the left and center plots of Figure 6.
Revised: The results are depicted in the left and center plots of Figure 6.

Original: It is interesting to note that the Parseval trained functions seem to drop in performance as soon as we reach 40% probability of dropout, providing an average accuracy smaller than the vanilla networks.
Revised: It is interesting to note that the Parseval trained functions seem to drop in performance as soon as we reach 40% probability of dropout, providing an average accuracy smaller than the vanilla networks.

Original: In contrast, the proposed method is the most robust to these perturbations.
Revised: In contrast, the proposed method is the most robust to these perturbations.

Original: For the quantization of the weights, we consider a scenario where the network size in memory has to be shrink 6 times.
Revised: For the quantization of the weights, we consider a scenario where the network size in memory has to be shrink 6 times.

Original: We therefore quantize the weights of the networks to 5 bits (instead of 32) and re-evaluate the test set accuracy.
Revised: We therefore quantize the weights of the networks to 5 bits (instead of 32) and re-evaluate the test set accuracy.

Original: The right plot of Figure 6 shows that the proposed method is providing a better robustness to this kind of deformation than the tested counterparts.
Revised: The right plot of Figure 6 shows that the proposed method is providing a better robustness to this kind of deformation than the tested counterparts.

Original:  Conclusion
Revised:  Conclusion

Original: In this paper we have introduced a new regularizer that enforces small variations of the smoothness of label signals on similarity graphs obtained at intermediate layers of a deep neural network architecture.
Revised: In this paper we have introduced a new regularizer that enforces small variations of the smoothness of label signals on similarity graphs obtained at intermediate layers of a deep neural network architecture.

Original: We have empirically shown with our tests that it can lead to improved robustness in various conditions compared to existing counterparts.
Revised: We have empirically shown with our tests that it can lead to improved robustness in various conditions compared to existing counterparts.

Original: We also demonstrated that combining the proposed regularizer with existing methods can result in even better robustness for some conditions.
Revised: We also demonstrated that combining the proposed regularizer with existing methods can result in even better robustness for some conditions.

Original: Future work includes a more systematic study of the eﬀectiveness of the method with regards to other datasets, models and deformations.
Revised: Future work includes a more systematic study of the eﬀectiveness of the method with regards to other datasets, models and deformations.

Original: Recent works shown adversarial noise is partially transferable between models and dataset (Moosavi-Dezfooli et al., 2017; Papernot et al., 2016b) and therefore we are conﬁdent about the generality of the method in terms of models and datasets.
Revised: Recent works shown adversarial noise is partially transferable between models and dataset (Moosavi-Dezfooli et al., 2017; Papernot et al., 2016b) and therefore we are conﬁdent about the generality of the method in terms of models and datasets.

Original: One possible extension of the proposed method is to use it in a ﬁne-tuning stage, combined with diﬀerent techniques already established on the literature.
Revised: One possible extension of the proposed method is to use it in a ﬁne-tuning stage, combined with diﬀerent techniques already established on the literature.

Original: An extension using a combination of input barycenter and class barycenter signals instead of the class signal could be interesting as that would be comparable to (Zhang et al., 2017).
Revised: An extension using a combination of input barycenter and class barycenter signals instead of the class signal could be interesting as that would be comparable to (Zhang et al., 2017).

Original: In the same vein, using random signals could be beneﬁcial for semi-supervised or unsupervised learning challenges.
Revised: In the same vein, using random signals could be beneﬁcial for semi-supervised or unsupervised learning challenges.

Original: A Parseval Training and implementation
Revised: A Parseval Training and implementation

Original: We compare our results with those obtained using the method described in (Cisse et al., 2017).
Revised: We compare our results with those obtained using the method described in (Cisse et al., 2017).

Original: There are three modiﬁcations to the normal training procedure: orthogonality constraint, convolutional renormalization and convexity constraint.
Revised: There are three modiﬁcations to the normal training procedure: orthogonality constraint, convolutional renormalization and convexity constraint.

Original: For the orthogonality constraint we enforce Parseval tightness (Kovačević and Chebira, 2008) as a layer-wise regularizer:
Revised: For the orthogonality constraint we enforce Parseval tightness (Kovačević and Chebira, 2008) as a layer-wise regularizer:

Original: [Equation]
Revised: [Equation]

Original: (7) where W (cid:96) is the weight tensor at layer (cid:96) .
Revised: (7) where W (cid:96) is the weight tensor at layer (cid:96) .

Original: This function can be approximately optimized with gradient descent by doing the operation:
Revised: This function can be approximately optimized with gradient descent by doing the operation:

Original: [Equation]
Revised: [Equation]

Original: Given that our network is smaller we can apply the optimization to the entirety of the W , instead of 30% as per the original paper, this increases the strength of the Parseval tightness.
Revised: Given that our network is smaller we can apply the optimization to the entirety of the W , instead of 30% as per the original paper, this increases the strength of the Parseval tightness.

Original: For the convolutional renormalization, each matrix W (cid:96) is reparametrized before being applied to the convolution as
Revised: For the convolutional renormalization, each matrix W (cid:96) is reparametrized before being applied to the convolution as

Original: [Equation]
Revised: [Equation]

Revised: k

Original: [Equation]
Revised: [Equation]

Original: k s is the kernel size.
Revised: is the kernel size.

Original: For our architecture the inputs from a layer come from either one or two diﬀerent layers.
Revised: For our architecture the inputs from a layer come from either one or two diﬀerent layers.

Original: In the case where the inputs come from only one layer, α the convexity constraint parameter is set to 1.
Revised: In the case where the inputs come from only one layer, α the convexity constraint parameter is set to 1.

Original: When the inputs come from the sum of two layers we use α = 0 .
Revised: When the inputs come from the sum of two layers we use α = 0 .

Original: 5 as the value for both of them, which constraints our Lipschitz constant, this is softer than the convexity constraint from the original paper.
Revised: 5 as the value for both of them, which constraints our Lipschitz constant, this is softer than the convexity constraint from the original paper.

Original: B Hyperparameters
Revised: B Hyperparameters

Original: We train our networks using classical stochastic gradient descent with momentum ( 0 . 9 ), with batch size of b = 100 images and using a L2-norm weight decay with a coeﬃcient of λ = 0 . 0005 .
Revised: We train our networks using classical stochastic gradient descent with momentum ( 0 . 9 ), with batch size of b = 100 images and using a L2-norm weight decay with a coeﬃcient of λ = 0 . 0005 .

Original: We do a 100 epoch training.
Revised: We do a 100 epoch training.

Original: Our learning rate starts at 0 .
Revised: Our learning rate starts at 0 .

Original: After half of the training ( 50 epochs) the learning rate decreases to 0 .
Revised: After half of the training ( 50 epochs) the learning rate decreases to 0 .

Original: We use the mean of the diﬀerence of smoothness between successive layers in our loss function.
Revised: We use the mean of the diﬀerence of smoothness between successive layers in our loss function.

Original: Therefore in our loss function we have:
Revised: Therefore in our loss function we have:

Original: [Equation]
Revised: [Equation]

Original: where ∆ = 1 d − 1 (cid:80) d(cid:96)
Revised: where ∆ = 1 d − 1 (cid:80) d(cid:96)

Original: =1 | δ (cid:96)σ | .
Revised: =1 | δ (cid:96)σ | .

Original: We perform experiments using various powers of the Laplacian m = 1 , 2 , 3 , in which case the scaling coeﬃcient γ is put to the same power as the Laplacian.
Revised: We perform experiments using various powers of the Laplacian m = 1 , 2 , 3 , in which case the scaling coeﬃcient γ is put to the same power as the Laplacian.

Original: We tested multiple parameters of β , the Parseval tightness parameter, γ the weight for the smoothness diﬀerence cost and m the power of the Laplacian.
Revised: We tested multiple parameters of β , the Parseval tightness parameter, γ the weight for the smoothness diﬀerence cost and m the power of the Laplacian.

Original: We found that the best values for this speciﬁc architecture, dataset and training scheme were: β = 0 .
Revised: We found that the best values for this speciﬁc architecture, dataset and training scheme were: β = 0 .

Original: 01 , γ = 0 .
Revised: 01 , γ = 0 .

Original: 01 , m = 2 , k
Revised: 01 , m = 2 , k

Original: = b .
Revised: = b .

Original: C Depiction of the network
Revised: C Depiction of the network

Original: Figure C depicts the network used on all experiments of sections 3 and 4.
Revised: Figure 7 depicts the network used on all experiments of sections 3 and 4.

Original: f = 64 is the ﬁlter size of the ﬁrst layer of the network.
Revised: f = 64 is the ﬁlter size of the ﬁrst layer of the network.

Original: Conv layers are 3x3 layers and are always preceded by batch normalization and relu (except for the ﬁrst layer which receives just the input).
Revised: Conv layers are 3x3 layers and are always preceded by batch normalization and relu (except for the ﬁrst layer which receives just the input).

Original: The smoothness gaps are calculated after each ReLU.
Revised: The smoothness gaps are calculated after each ReLU.

Original: [Figure]
Revised: [Figure]

Original: D Additional experiments
Revised: D Additional experiments

Original: Given suggestions from the reviewers, we performed additional experiments to further demonstrate the capabilities of the proposed regularizer.
Revised: Given suggestions from the reviewers, we performed additional experiments to further demonstrate the capabilities of the proposed regularizer.

Original: Due to the lack of space they could not be added to the main paper.
Revised: Due to the lack of space they could not be added to the main paper.

Original: We consider the eﬀects of the regularizer when applied on another datasets.
Revised: We consider the eﬀects of the regularizer when applied on another datasets.

Original: We also consider the eﬀects of adding adversarial data augmentation methods while minimizing the amount of other inﬂuencing factors.
Revised: We also consider the eﬀects of adding adversarial data augmentation methods while minimizing the amount of other inﬂuencing factors.

Original: We ﬁrst look at the results when using the same architecture as for the CIFAR-10 dataset, which inevitably results in far from state-of-the-art accuracy on CIFAR-100.
Revised: We ﬁrst look at the results when using the same architecture as for the CIFAR-10 dataset, which inevitably results in far from state-of-the-art accuracy on CIFAR-100.

Original: Then, we perform experiments using a diﬀerent architecture (namely WideResnet 28-10, with dropout) for CIFAR-100.
Revised: Then, we perform experiments using a diﬀerent architecture (namely WideResnet 28-10, with dropout) for CIFAR-100.

Original: D. CIFAR- 
Revised: D. CIFAR-

Original: We add two types of tests for the CIFAR-10 dataset: adversarial data augmentation during training and black-box FGSM.
Revised: We add two types of tests for the CIFAR-10 dataset: adversarial data augmentation during training and black-box FGSM.

Original: D.1. Tests with FGSM adversarial data augmentation
Revised: D.1. Tests with FGSM adversarial data augmentation

Original: In this section we consider tests adding adversarial data augmentation as suggested in (Kurakin et al., 2016).
Revised: In this section we consider tests adding adversarial data augmentation as suggested in (Kurakin et al., 2016).

Original: To be more precise we use the method they advise which is called "step1.1" using (cid:15) = 8255 .
Revised: To be more precise we use the method they advise which is called "step1.1" using (cid:15) = 8255 .

Original: The results presented in the ﬁgures below are obtained by running 10 experiments with random initializations.
Revised: The results presented in the ﬁgures below are obtained by running 10 experiments with random initializations.

Original: We ﬁrst perform the same tests as in Section 4.
Revised: We ﬁrst perform the same tests as in Section 4.

Original: As expected, we observe in Figure 8 that training with adversarial examples help in the case of Gaussian noise, as it adds more variation to the training set, while reducing the accuracy on the clean set.
Revised: As expected, we observe in Figure 8 that training with adversarial examples help in the case of Gaussian noise, as it adds more variation to the training set, while reducing the accuracy on the clean set.

Original: Note that combining our method with adversarial training results in the best median accuracy.
Revised: Note that combining our method with adversarial training results in the best median accuracy.

Original: Combining the three methods is less successful than expected, which could indicate that a better hyperparameter search would be needed.
Revised: Combining the three methods is less successful than expected, which could indicate that a better hyperparameter search would be needed.

Original: [Figure]
Revised: [Figure]

Original: [Equation]
Revised: [Equation]

Original: [Figure]
Revised: [Figure]

Original: [Equation]
Revised: [Equation]

Original: [Figure]
Revised: [Figure]

Original: the proposed Regularizer and V is for Vanilla network.
Revised: the proposed Regularizer and V is for Vanilla network.

Original: Considering adversarial robustness, the obtained results are depicted in Figure 9.
Revised: Considering adversarial robustness, the obtained results are depicted in Figure 9.

Original: We observe that adding FGSM adversarial training does not generalize well to other types of attack (which is readily seen in the literature Madry et al.
Revised: We observe that adding FGSM adversarial training does not generalize well to other types of attack (which is readily seen in the literature Madry et al.

Original: Overall, the models using the proposed regularizer are the most robust.
Revised: Overall, the models using the proposed regularizer are the most robust.

Original: Finally, when considering implementation related perturbations, the results depicted in
Revised: Finally, when considering implementation related perturbations, the results depicted in

Original: Figure 10 are consistent with the ones from Section 4.3, in which is shown that the proposed regularizer helps improving robustness.
Revised: Figure 10 are consistent with the ones from Section 4.3, in which is shown that the proposed regularizer helps improving robustness.

Original: In summary, even when adding adversarial training, the proposed regularizer is either the most robust in median, or capable of improving the robustness when used combined with the other methods.
Revised: In summary, even when adding adversarial training, the proposed regularizer is either the most robust in median, or capable of improving the robustness when used combined with the other methods.

Original: D.1. Tests with black box FGSM
Revised: D.1. Tests with black box FGSM

Original: To further verify that the obtained results are not only due to gradient masking, we perform tests with black box FGSM, where the target attacked network is not the same as the source of the adversarial noise.
Revised: To further verify that the obtained results are not only due to gradient masking, we perform tests with black box FGSM, where the target attacked network is not the same as the source of the adversarial noise.

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: For this test we set the SNR of FGSM to 33.
Revised: For this test we set the SNR of FGSM to 33.

Original: We chose the network with the best performance for each of the tested methods.
Revised: We chose the network with the best performance for each of the tested methods.

Original: The results are depicted in Table 1.
Revised: The results are depicted in Table 1.

Original: In our experiments, we found that the combination of our method with Parseval is the most robust to noise coming from other sources, while the noise created by both Parseval and our method did not generalize as well as the one created by Vanilla.
Revised: In our experiments, we found that the combination of our method with Parseval is the most robust to noise coming from other sources, while the noise created by both Parseval and our method did not generalize as well as the one created by Vanilla.

Original: This demonstrates that the improvements are not caused by gradient masking, but are caused by the increased robustness of the proposed method and Parseval’s. 
Revised: This demonstrates that the improvements are not caused by gradient masking, but are caused by the increased robustness of the proposed method and Parseval’s. [Table] Vanilla

Original: [Table]
Revised: [Table]

Original: D.1. Tests with PGD adversarial data augmentation
Revised: D.1. Tests with PGD adversarial data augmentation

Original: Most of our adversarial tests are performed with FGSM because of its simplicity and speed, even though it has already been shown (e.g: Madry et al.
Revised: Most of our adversarial tests are performed with FGSM because of its simplicity and speed, even though it has already been shown (e.g: Madry et al.

Original: that FGSM is weak as an attack and as a defense mechanism.
Revised: that FGSM is weak as an attack and as a defense mechanism.

Original: Despite the fact we do not only target adversarial defense, we further stress the ability of the proposed regularizer to improve it and to combine with other methods.
Revised: Despite the fact we do not only target adversarial defense, we further stress the ability of the proposed regularizer to improve it and to combine with other methods.

Original: To this end we perform experiments against the PGD (Projected
Revised: To this end we perform experiments against the PGD (Projected

Original: Gradient Descent) attack.
Revised: Gradient Descent) attack.

Original: PGD is an iterative version of FGSM, which run for a maximum number of iterations it or until convergence.
Revised: PGD is an iterative version of FGSM, which run for a maximum number of iterations it or until convergence.

Original: For each iteration it moves by a distance of step in the direction of the gradient provided it does not go at a distance greater than (cid:15) from the original image.
Revised: For each iteration it moves by a distance of step in the direction of the gradient provided it does not go at a distance greater than (cid:15) from the original image.

Original: Our experiments show that the proposed regularizer increases robustness against a weak PGD attack (similar epsilon as our FGSM with SNR=33), but it is almost completely defeated by the PGD with the parameters from (Madry et al., 2018).
Revised: Our experiments show that the proposed regularizer increases robustness against a weak PGD attack (similar epsilon as our FGSM with SNR=33), but it is almost completely defeated by the PGD with the parameters from (Madry et al., 2018).

Original: The results are depicted in table 2.
Revised: The results are depicted in table 2.

Original: We also show that, as expected, FGSM training does not add signiﬁcant robustness against the stronger PGD attack.
Revised: We also show that, as expected, FGSM training does not add signiﬁcant robustness against the stronger PGD attack.

Original: [Table]
Revised: [Table]

Original: As the proposed regularizer can be combined with FGSM defense, it is natural to also test it alongside PGD training.
Revised: As the proposed regularizer can be combined with FGSM defense, it is natural to also test it alongside PGD training.

Original: We use the parameters advised in (Madry et al., 2018): 7 iterations with step = 2 / 255 , and (cid:15) = 8 / 255 .
Revised: We use the parameters advised in (Madry et al., 2018): 7 iterations with step = 2 / 255 , and (cid:15) = 8 / 255 .

Original: The results depicted in Table 3 show that using our regularizer increases robustness of networks trained with PGD.
Revised: The results depicted in Table 3 show that using our regularizer increases robustness of networks trained with PGD.

Original: Note that Dropout and
Revised: Note that Dropout and

Original: Gaussian Noise were applied ten times to each of the networks and the results are displayed as the mean test set accuracy under these perturbations.
Revised: Gaussian Noise were applied ten times to each of the networks and the results are displayed as the mean test set accuracy under these perturbations.

Original: A rate of 40% was used for dropout.
Revised: A rate of 40% was used for dropout.

Original: The PGD attack uses the following parameters: it = 20 , step = 2255 , (cid:15) = 8255 .
Revised: The PGD attack uses the following parameters: it = 20 , step = 2255 , (cid:15) = 8255 .

Original: Robustness
Revised: Robustness

Original: [Table]
Revised: [Table]

Original: D. CIFAR- 
Revised: D. CIFAR-

Original: We test the generality of the method using the CIFAR-100 dataset.
Revised: We test the generality of the method using the CIFAR-100 dataset.

Original: Results are shown in
Revised: Results are shown in

Original: Table 4 as the mean over three diﬀerent initializations.
Revised: Table 4 as the mean over three diﬀerent initializations.

Original: Dropout and Gaussian Noise are applied ten times to each of the networks for a total of 30 diﬀerent runs.
Revised: Dropout and Gaussian Noise are applied ten times to each of the networks for a total of 30 diﬀerent runs.

Original: An SNR of 33 is used for FGSM
Revised: An SNR of 33 is used for FGSM

Original: [Table]
Revised: [Table]

Original: and a rate of 25% is used for dropout.
Revised: and a rate of 25% is used for dropout.

Original: Images are normalized in the same way as the experiments with CIFAR-10.
Revised: Images are normalized in the same way as the experiments with CIFAR-10.

Original: Due to time constraints we sample only 110 of the images from the test set for the Deep Fool test.
Revised: Due to time constraints we sample only 110 of the images from the test set for the Deep Fool test.

Original: The proposed regularizer is the most robust on all categories, while Parseval has problems with the perturbations, despite yielding the best accuracy on the clean test set.
Revised: The proposed regularizer is the most robust on all categories, while Parseval has problems with the perturbations, despite yielding the best accuracy on the clean test set.

Original: The combination of the proposed regularizer and the parseval training method is not able to reproduce the good results from the CIFAR-10 dataset.
Revised: The combination of the proposed regularizer and the parseval training method is not able to reproduce the good results from the CIFAR-10 dataset.

Original: [Table]
Revised: [Table]

Original: The results shown in Table 4 are obtained using an architecture that is not performing very well on the clean test set for the CIFAR-100 dataset.
Revised: The results shown in Table 4 are obtained using an architecture that is not performing very well on the clean test set for the CIFAR-100 dataset.

Original: We thus performed additional experiments using the WideResNet 28-10 (Zagoruyko and Komodakis, 2016) architecture, and we added standard data augmentation (random crops and random horizontal ﬂipping) and dropout with probability of 30% after the ﬁrst convolution of each residual block.
Revised: We thus performed additional experiments using the WideResNet 28-10 (Zagoruyko and Komodakis, 2016) architecture, and we added standard data augmentation (random crops and random horizontal ﬂipping) and dropout with probability of 30% after the ﬁrst convolution of each residual block.

Original: We train for 200 epochs, starting with a learning rate of 0.1 and divide the learning rate by 5 in epochs 60, 120 and 160.
Revised: We train for 200 epochs, starting with a learning rate of 0.1 and divide the learning rate by 5 in epochs 60, 120 and 160.

Original: Momentum of 0.9 is used and weight decay of 5e-4.
Revised: Momentum of 0.9 is used and weight decay of 5e-4.

Original: We use the value from the Parseval paper ( β = 0 . 0003 )
Revised: We use the value from the Parseval paper ( β = 0 . 0003 )

Original: as in this case it provided better results than the one described in Section B.
Revised: as in this case it provided better results than the one described in Section B.

Original: Results on the WideResNet 28-10 architecture using data augmentation are shown in Table 5.
Revised: Results on the WideResNet 28-10 architecture using data augmentation are shown in Table 5.

Original: We observe that the proposed method (sometimes with combinations with other methods) is still the most robust. 
Revised: We observe that the proposed method (sometimes with combinations with other methods) is still the most robust. [Table]

Revised: E Impact of the proposed regularizer on the boundary

Revised: We look at the impact of the proposed regularizer on the boundary region.

Revised: To this end, we choose 10 pairs of points in distinct classes that are the most similar (i

Original: [Table]
Revised: [Table]

Revised: e. their distance is minimal) in the input space and we look at the decision of the network function along the segment between them.

Revised: The average is depicted in Figure 11.

Revised: Note that the point to the left is always chosen to be the one corresponding to the decision of the network at the middle of the segment, so that the average curve is asymmetric.

Revised: −− 0 .

Revised: [Figure]

Revised: [Equation]

Revised: [Figure]

Revised: [Equation]

Revised: [Figure]

Revised: Interestingly, we observe that the proposed regularizer is the one for which the boundary is closest to the middle of the segments, thus proving our claim that the proposed regularizer control the boundary region.

Revised: F Regularizer pseudo-code

Revised: Below in Algorithm 1 we describe how we use the proposed regularizer to compute the loss as a pseudo-code.

Revised: This function receives ﬁve inputs:

Revised: list activations : the list of the intermediate features right after each call of the ReLU activation function of the network.

Revised: We call these intermediate features activations (cid:96) where (cid:96) represents the depth of the network; 2.

Revised: y : the output of the network; 3.

Revised: s : the label signal of the batch.

Revised: Otherwise said, the ground truth labels of the examples of the batch; 4.

Revised: m : the power of the Laplacian for which we wish to compute the smoothness; 5.

Revised: γ : the scaling coeﬃcient of the regularizer loss.

Revised: 1: procedure Smoothness ( activations (cid:96) , s , m ) 2:

Revised: A (cid:96) ← Pairwise cosine similarity of activations (cid:96) 3:

Revised: D (cid:96) ← Diagonal degree matrix of A (cid:96) 4:

Revised: L (cid:96) ← D (cid:96) − A (cid:96) 5: σ (cid:96) ← Trace ( s (cid:124)

Revised: ( L (cid:96) )

Original: {+m s ) 6: return σ (cid:96) 7: procedure Loss ( list activations , y , s , m, γ ) 8: for activations (cid:96) ∈ list activations do σ (cid:96) ← Smoothness ( activations (cid:96) , s , m ) 9: ∆ ← (cid:80) (cid:96)maxi =
+}
Revised: {+m s ) 6: return σ (cid:96) 7: procedure Loss ( list activations , y , s , m, γ ) 8: for activations (cid:96) ∈ list activations do σ (cid:96) ← Smoothness ( activations (cid:96) , s , m ) 9: ∆ ← (cid:80) (cid:96)maxi =
+}

Revised: | σ i − σ i − 1 | (cid:96) max −10: return CategoricalCrossEntropy ( s , y ) + γ m ∆