Original: Semantic Perturbations with Normalizing Flows for Improved Generalization
Revised: Semantic Perturbations with Normalizing Flows for Improved Generalization

Original: Anonymous Authors

Original: Abstract
Revised: Abstract

Original: Several methods from two separate lines of works, namely, data augmentation (DA) and adversarial training techniques, rely on perturbations done in latent space.
Revised: Several methods from two separate lines of works, namely, data augmentation (DA) and adversarial training techniques, rely on perturbations done in latent space.

Original: Often, these methods are either non-interpretable due to their non-invertibility or are notoriously difﬁcult to train due to their numerous hyperparameters.
Revised: Often, these methods are either non-interpretable due to their non-invertibility or are notoriously difﬁcult to train due to their numerous hyperparameters.

Original: We exploit the exactly reversible encoder-decoder structure of normalizing ﬂows to perform perturbations in the latent space.
Revised: We exploit the exactly reversible encoder-decoder structure of normalizing ﬂows to perform perturbations in the latent space.

Original: We demonstrate that these on-manifold perturbations match the performance of advanced
Revised: We demonstrate that these on-manifold perturbations match the performance of advanced

Original: DA techniques—reaching 96 . 6% test accuracy for
Revised: DA techniques—reaching 96 . 6% test accuracy for

Original: CIFAR-10 using ResNet-18 and outperform existing methods particularly in low data regimes— yielding 10 – 25% relative improvement of test accuracy from classical training.
Revised: CIFAR-10 using ResNet-18 and outperform existing methods particularly in low data regimes— yielding 10 – 25% relative improvement of test accuracy from classical training.

Original: We ﬁnd our latent adversarial perturbations, adaptive to the classiﬁer throughout its training, are most effective.
Revised: We ﬁnd our latent adversarial perturbations, adaptive to the classiﬁer throughout its training, are most effective.

Original: 1. Introduction
Revised: 1. Introduction

Original: Successfully applying Deep Neural Networks (DNNs) in real world tasks in large part depends on the availability of large annotated datasets for the task at hand.
Revised: Successfully applying Deep Neural Networks (DNNs) in real world tasks in large part depends on the availability of large annotated datasets for the task at hand.

Original: Thus, besides several overﬁtting techniques, data-augmentation (DA) often remains a “mandatory” step when deploying DNNs in practice.
Revised: Thus, besides several overﬁtting techniques, data-augmentation (DA) often remains a “mandatory” step when deploying DNNs in practice.

Original: Traditional DA techniques consist of applying a predeﬁned set of transformations to the training samples that do not change the class label.
Revised: Traditional DA techniques consist of applying a predeﬁned set of transformations to the training samples that do not change the class label.

Original: As this approach is limited to making the classiﬁer robust solely to the ﬁxed set of hardcoded transformations, advanced methods incorporate more loosely deﬁned transformations in the data space (Zhang et al., 2018a; DeVries & Taylor, 2017; Yun et al., 2019).
Revised: As this approach is limited to making the classiﬁer robust solely to the ﬁxed set of hardcoded transformations, advanced methods incorporate more loosely deﬁned transformations in the data space (Zhang et al., 2018a; DeVries & Taylor, 2017; Yun et al., 2019).

Original: Furthermore, recently proposed DA techniques exploit the latent space to perform such transformations (Antoniou et al., 2017; Zhao et al., 2018), while typically solving the model’s non-invertability by training a separate model (Zhao et al.,
Revised: Furthermore, recently proposed DA techniques exploit the latent space to perform such transformations (Antoniou et al., 2017; Zhao et al., 2018), while typically solving the model’s non-invertability by training a separate model (Zhao et al. Third workshop on Invertible Neural Networks, Normalizing Flows, and Explicit Likelihood Models ICML 2021)

Original: , thus making them hard to train.
Revised: , thus making them hard to train.

Original: A separate line of work focuses on adversarial training (see (Biggio & Roli, 2018) and references therein), where the ﬁnal model is trained with samples perturbed in a way that makes its prediction incorrect, called adversarial samples.
Revised: A separate line of work focuses on adversarial training (see (Biggio & Roli, 2018) and references therein), where the ﬁnal model is trained with samples perturbed in a way that makes its prediction incorrect, called adversarial samples.

Original: However, further empirical studies showed that such training reduces the “clean” samples accuracy, indicating the two objectives are competing (Tsipras et al., 2019b;
Revised: However, further empirical studies showed that such training reduces the “clean” samples accuracy, indicating the two objectives are competing (Tsipras et al., 2019b;

Original: Su et al., 2018).
Revised: Su et al., 2018).

Original: Stutz et al.
Revised: Stutz et al.

Original: (2019) postulate that this robustnessgeneralization trade-off appears due to using off-manifold adversarial attacks that leave the data-manifold, and that ‘onmanifold adversarial attacks’ can improve generalization.
Revised: (2019) postulate that this robustnessgeneralization trade-off appears due to using off-manifold adversarial attacks that leave the data-manifold, and that ‘onmanifold adversarial attacks’ can improve generalization.

Original: Thus, the authors proposed to use perturbations in the latent space of a generative model, VAE-GAN (Larsen et al., 2016;
Revised: Thus, the authors proposed to use perturbations in the latent space of a generative model, VAE-GAN (Larsen et al., 2016;

Original: Rosca et al., 2017).
Revised: Rosca et al., 2017).

Original: However, as this method relies on the VAE-GAN model which is particularly hard to train— since in addition to GAN training it involves hard to tune hyperparamaters balancing the VAE and GAN objectives— its usage remained limited.
Revised: However, as this method relies on the VAE-GAN model which is particularly hard to train— since in addition to GAN training it involves hard to tune hyperparamaters balancing the VAE and GAN objectives— its usage remained limited.

Original: Motivated by the advantages of normalizing ﬂows (NF) relevant to these two lines of works, we employ NFs ( e.g.
Revised: Motivated by the advantages of normalizing ﬂows (NF) relevant to these two lines of works, we employ NFs ( e.g.

Original: Glow, Kingma & Dhariwal, 2018), to deﬁne entirely unsupervised augmentations—contrasting with pre-deﬁned ﬁxed transformations—with the same goal of improving the generalization of deep classiﬁers.
Revised: Glow, Kingma & Dhariwal, 2018), to deﬁne entirely unsupervised augmentations—contrasting with pre-deﬁned ﬁxed transformations—with the same goal of improving the generalization of deep classiﬁers.

Original: In particular, NF models offer appealing advantages for latent space perturbations, such as: (i) exact latent-variable inference and log-likelihood evaluation, and (ii) efﬁcient inference and synthesis that can be parallelized (Kingma & Dhariwal, 2018).
Revised: In particular, NF models offer appealing advantages for latent space perturbations, such as: (i) exact latent-variable inference and log-likelihood evaluation, and (ii) efﬁcient inference and synthesis that can be parallelized (Kingma & Dhariwal, 2018).

Original: Related works.
Revised: Related works.

Original: Several works learn useful DA policies, for instance by optimization (Fawzi et al., 2016; Ratner et al., 2017), Reinforcement Learning techniques (Cubuk et al., 2019; 2020; Zhang et al., 2020b), speciﬁcally trained generator networks (Peng et al., 2018) or assisted by generative adversarial networks (Perez & Wang, 2017; Antoniou et al., 2017; Zhang et al., 2018b; Tran et al., 2020).
Revised: Several works learn useful DA policies, for instance by optimization (Fawzi et al., 2016; Ratner et al., 2017), Reinforcement Learning techniques (Cubuk et al., 2019; 2020; Zhang et al., 2020b), speciﬁcally trained generator networks (Peng et al., 2018) or assisted by generative adversarial networks (Perez & Wang, 2017; Antoniou et al., 2017; Zhang et al., 2018b; Tran et al., 2020).

Original: Several methods traverse the latent space to ﬁnd virtual data samples that are missclassiﬁed (Baluja & Fischer, 2017;
Revised: Several methods traverse the latent space to ﬁnd virtual data samples that are missclassiﬁed (Baluja & Fischer, 2017;

Original: Song et al., 2018;
Revised: Song et al., 2018;

Original: Xiao et al., 2018; Zhang et al., 2020a).
Revised: Xiao et al., 2018; Zhang et al., 2020a).

Original: Complementary, the connection of adversarial learning and generalization has also been studied in (Tanay & Grifﬁn, 2016;
Revised: Complementary, the connection of adversarial learning and generalization has also been studied in (Tanay & Grifﬁn, 2016;

Original: Rozsa et al., 2016; Jalal et al., 2017;
Revised: Rozsa et al., 2016; Jalal et al., 2017;

Original: Tsipras et al., 2019a; Gilmer et al., 2018; Zhao et al., 2018).
Revised: Tsipras et al., 2019a; Gilmer et al., 2018; Zhao et al., 2018).

Original: [Figure]
Revised: [Figure]

Original: [Figure]
Revised: [Equation]

Original: Normalizing Flow

Original: [Figure]
Revised: [Figure]

Original: Overview of contributions.
Revised: Overview of contributions.

Original: We exploit the exactly reversible encoder-decoder structure of NFs to perform efﬁcient and controllable augmentations in the learned onmanifold space.
Revised: We exploit the exactly reversible encoder-decoder structure of NFs to perform efﬁcient and controllable augmentations in the learned onmanifold space.

Original: We demonstrate that our on-manifold perturbations consistently outperform the standard training on
Revised: We demonstrate that our on-manifold perturbations consistently outperform the standard training on

Original: CIFAR-10/100 using ResNet-18.
Revised: CIFAR-10/100 using ResNet-18.

Original: Moreover, in a low-data regime, such training yields up to 25% relative improvement from classical training, of which—as most effective—we ﬁnd the adversarial perturbations that are adaptive to the classiﬁer throughout its training, see § 3.
Revised: Moreover, in a low-data regime, such training yields up to 25% relative improvement from classical training, of which—as most effective—we ﬁnd the adversarial perturbations that are adaptive to the classiﬁer throughout its training, see §3.

Original: 2. Perturbations in Latent Spaceusing Normalizing Flows
Revised: 2. Perturbations in Latent Space

Original: The invertibility of normalizing ﬂows enables bidirectional transitions between image and latent space, see Figure 1.
Revised: The invertibility of normalizing ﬂows enables bidirectional transitions between image and latent space, see Figure 1.

Original: This in turn allows for applying perturbations directly in the latent space rather than image space.
Revised: This in turn allows for applying perturbations directly in the latent space rather than image space.

Original: We denote a trained normalizing ﬂow model, mapping data manifold X to latent space Z as, F : X → Z .
Revised: We denote a trained NF model, mapping data manifold X to latent space Z as, F : X → Z .

Original: Given a perturbation function P : Z → Z , deﬁned over the latent space, we deﬁne its counterpart in image space as F − 1 ( P ( F ( z ))) .
Revised: Given a perturbation function P : Z → Z , deﬁned over the latent space, we deﬁne its counterpart in image space as F − 1 ( P ( F ( z ))) .

Original: Our goal is to deﬁne latent perturbation function P ( z ) such that we obtain identity-preserving semantic modiﬁcations over the original image x in the image domain.
Revised: Our goal is to deﬁne latent perturbation function P ( z ) such that we obtain identity-preserving semantic modiﬁcations over the original image x in the image domain.

Original: To this end, we limit the structure of possible P ( z ) in two-ways.
Revised: To this end, we limit the structure of possible P ( z ) in two-ways.

Original: Firstly, we directly consider incremental perturbations of the form z
Revised: Firstly, we directly consider incremental perturbations of the form z

Original: + P ( z ) .
Revised: + P ( z ) .

Original: Secondly, we use an (cid:15) parameter to control the size of perturbation allowed.
Revised: Secondly, we use an (cid:15) parameter to control the size of perturbation allowed.

Original: More precisely, we have:
Revised: More precisely, we have:

Original: [Equation]
Revised: [Equation]

Original: For brevity, we refer to P ( z ) as “latent attacks” (LA) and we consider two variants, described below.
Revised: For brevity, we refer to P ( z ) as “latent attacks” (LA) and we consider two variants, described below.

Original: 2.1. Randomized Latent Attacks
Revised: 2.1. Randomized Latent Attacks

Original: At training time, given a datapoint x i , with 1 ≤ i ≤ n , using trained normalizing ﬂow we obtain its corresponding latent code
Revised: At training time, given a datapoint x i , with 1 ≤ i ≤ n , using trained normalizing ﬂow we obtain its corresponding latent code

Original: z i
Revised: z i

Original: = F ( x i ) .
Revised: = F ( x i ) .

Original: Primarily, as perturbation function we consider a simplistic
Revised: Primarily, as perturbation function we consider a simplistic

Original: Gaussian noise in the latent space:
Revised: Gaussian noise in the latent space:

Original: [Equation]
Revised: [Equation]

Original: Randomized

Original: [Equation]

Original: which is independent from z i .
Revised: which is independent from z i .

Original: Any such distribution around the original z i is equivalent to sampling from the learned manifold.
Revised: Any such distribution around the original z i is equivalent to sampling from the learned manifold.

Original: In this case, the normalizing ﬂow pushes forward this simple Gaussian distribution centered around z
Revised: In this case, the normalizing ﬂow pushes forward this simple Gaussian distribution centered around z

Original: i to a distribution on the image space around x i =
Revised: i to a distribution on the image space around x i =

Original: F − 1 ( z i ) .
Revised: F − 1 ( z i ) .

Original: Thus, sampling from the simple prior distribution N (0 , I ) is equivalent to sampling from a complex conditional distribution around the original image over the data manifold.
Revised: Thus, sampling from the simple prior distribution N (0 , I ) is equivalent to sampling from a complex conditional distribution around the original image over the data manifold.

Original: We also deﬁne norm truncated versions as follows:
Revised: We also deﬁne norm truncated versions as follows:

Original: [Equation]
Revised: [Equation]

Original: where (cid:96) p denotes the selected norm, e.g. (cid:96) 2 or (cid:96) ∞ .
Revised: where (cid:96) p denotes the selected norm, e.g. (cid:96) 2 or (cid:96) ∞ .

Original: For (cid:96)norm, Π is deﬁned as (cid:96) 2 norm scaling, and for (cid:96) ∞ , Π is the component-wise clipping operation deﬁned below:
Revised: For (cid:96)norm, Π is deﬁned as (cid:96) 2 norm scaling, and for (cid:96) ∞ , Π is the component-wise clipping operation deﬁned below:

Original: [Equation]
Revised: [Equation]

Original: 2.2. Adversarial Latent Attacks
Revised: 2.2. Adversarial Latent Attacks

Original: Analogous to the above randomized latent attacks, at train time, given a datapoint x
Revised: Analogous to the above randomized latent attacks, at train time, given a datapoint x

Original: i and it’s associated label l i , with 1 ≤ i ≤ n , using trained normalizing ﬂow we obtain its corresponding latent code
Revised: i and it’s associated label l i , with 1 ≤ i ≤ n , using trained normalizing ﬂow we obtain its corresponding latent code

Original: z i =
Revised: z i =

Original: F ( x i ) .
Revised: F ( x i ) .

Original: We search for ∆ z i ∈
Revised: We search for ∆ z i ∈

Original: Z such that the loss obtained of the generated image ˜ x
Revised: Z such that the loss obtained of the generated image ˜ x

Original: i =
Revised: i =

Original: F − 1 ( z i + ∆ z i ) is maximal:
Revised: F − 1 ( z i + ∆ z i ) is maximal:

Original: [Equation]
Revised: [Equation]

Original: where L θ is the loss function of the classiﬁer, and (cid:96) p denotes the selected norm, e.g. (cid:96) 2 or (cid:96) ∞ .
Revised: where L θ is the loss function of the classiﬁer, and (cid:96) p denotes the selected norm, e.g. (cid:96) 2 or (cid:96) ∞ .

Original: In practice, we deﬁne the number of steps k  to optimize for ∆ (cid:63) z i ∈
Revised: In practice, we deﬁne the number of steps k and the step size α to optimize for ∆ (cid:63) z i ∈

Original: Z, as well as the step size α (as in Stutz et al.
Revised: Z (as in Stutz et al.

Original: ; Wong & Kolter (2021)), and we have the following procedure:
Revised: ; Wong & Kolter (2021)), and we have the following procedure:

Original: • Initialize a random ∆ 

Revised: • Initialize a random ∆

Original: z i with (cid:107) ∆ 

Revised: z i with (cid:107) ∆

Original: z i (cid:107) (cid:96) p ≤ (cid:15) .
Revised: z i (cid:107) (cid:96) p ≤ (cid:15) .

Original: • Iteratively update ∆ j z i for j = 1 , . . .
Revised: • Iteratively update ∆ j z i for j = 1 , . . .

Original: , k number of steps with step size α as follows:
Revised: , k number of steps with step size α as follows:

Original: [Equation]
Revised: [Equation]

Original: where Π is the projection operator that ensures
Revised: where Π is the projection operator that ensures

Revised: (cid:107) ∆ j z i (cid:107) (cid:96) p ≤ (cid:15) and the gradient is with respect to ∆ j z i .

Revised: • Output P

Revised: adv ( z i , (cid:15) )

Original: [Equation]
Revised: [Equation]

Original: and the gradient is with respect to ∆ j z i .

Original: [Table]
Revised: [Table]

Original: Standard (no
Revised: VAE-GAN (Stutz et al., 2019)

Original: [Table]

Original: [Table]
Revised: [Table]

Original: Standard
Revised: Cutout (DeVries & Taylor, 2017)

Original: [Table]
Revised: [Table]

Original: VAE-GAN (Stutz et al., 2019)
Revised: Mixup (Zhang et al., 2018a)

Original: [Table]

Original: [Table]
Revised: [Table]

Original: Randomized-LA (ours)
Revised: Randomized–LA (ours)

Original: [Table]
Revised: [Table]

Original: Adversarial-LA (ours)
Revised: Adversarial–LA (ours)

Original: [Table]
Revised: [Table]

Original: P adv (  z i, (cid:15) ) = 
Revised: For the case of (cid:96) ∞ , we replace normalization of gradient with sign ( · ) operator, i.e.: ∆ j z i = [Equation]

Original: ∆k z
Revised: ∆

Original: [Table]
Revised: [Equation]

Original: For the case of (cid:96) ∞ , we replace normalization of gradient with sign ( · ) operator, i.e.:
Revised: +

Original: [Equation]
Revised: [Equation]

Revised: ∇L

Original:  and use component-wise clipping for projection, equivalent to the standard (cid:96)
Revised: [Equation] [Equation] and use component-wise clipping for projection, equivalent to the standard (cid:96)

Original: ∞
Revised: ∞

Original: PGD adversarial attack of Madry et al..
Revised: PGD adversarial attack of Madry et al..

Original: Similarly, as NFs directly models the underlying data manifold, this perturbation is equivalent to a search over the on-manifold adversarial samples (Stutz et al., 2019).
Revised: Similarly, as NFs directly models the underlying data manifold, this perturbation is equivalent to a search over the on-manifold adversarial samples (Stutz et al., 2019).

Original: 3. Experiments 3.1. Generalization on CIFAR- 
Revised: 3. Experiments 3.1. Generalization on CIFAR-

Original: We are primarily interested in the performance of our perturbations in the low-data regime, when using only a small subset of CIFAR-10 as the training set.
Revised: We are primarily interested in the performance of our perturbations in the low-data regime, when using only a small subset of CIFAR-10 as the training set.

Original: We train ResNetclassiﬁers on only 5% percent of the full training set and evaluate models on the full test set.
Revised: We train ResNetclassiﬁers on only 5% percent of the full training set and evaluate models on the full test set.

Original: We compare our methods with some of the most commonly used data augmentations methods such as Cutout (DeVries & Taylor, 2017) and Mixup (Zhang et al., 2018a), as well as with the VAE-GAN based approach (Stutz et al., 2019).
Revised: We compare our methods with some of the most commonly used data augmentations methods such as Cutout (DeVries & Taylor, 2017) and Mixup (Zhang et al., 2018a), as well as with the VAE-GAN based approach (Stutz et al., 2019).

Original: For (Stutz et al., 2019), we use the authors’ implementation.
Revised: For (Stutz et al., 2019), we use the authors’ implementation.

Original: For (DeVries & Taylor, 2017), we report the best test accuracy observed among a grid search on the learning rate η ∈ { 0 . 1 , 0 . 01 } .
Revised: For (DeVries & Taylor, 2017), we report the best test accuracy observed among a grid search on the learning rate η ∈ { 0 . 1 , 0 . 01 } .

Original: Similarly, for (Zhang et al., 2018a), we report the best accuracy among grid search on learning rate η ∈ { 0 . 1 , 0 . 01 } and mixup coefﬁcient λ ∈ { . 1 , .
Revised: Similarly, for (Zhang et al., 2018a), we report the best accuracy among grid search on learning rate η ∈ { 0 . 1 , 0 . 01 } and mixup coefﬁcient λ ∈ { . 1 , .

Original: For Randomized–LA, we use (cid:96) =
Revised: For Randomized–LA, we use (cid:96) =

Original: (cid:96) ∞ , (cid:15)
Revised: (cid:96) ∞ , (cid:15)

Original: = 0 .
Revised: = 0 .

Original: 25 , and for
Revised: 25 , and for

Original: Adversarial–LA, we use (cid:96) = 2 , (cid:15) = 1 . 0 , α = 0 .
Revised: Adversarial–LA, we use (cid:96) = 2 , (cid:15) = 1 . 0 , α = 0 .

Original: 5 , k = 3 .
Revised: 5 , k = 3 .

Revised: Table 1 summarizes our generalization experiments in the

Original: [Table]
Revised: [Table]

Original: Table 1 summarizes our generalization experiments in the low data regime—using only 5% of CIFAR-10 for training, compared to the full CIFAR-10 training set.
Revised: low data regime—using only 5% of CIFAR-10 for training, compared to the full CIFAR-10 training set.

Original: Both
Revised: Both

Original: Randomized–LA and Adversarial–LA notably outperform the standard training baseline.
Revised: Randomized–LA and Adversarial–LA notably outperform the standard training baseline.

Original: In particular, we observe that (i) our simplistic Randomized–LA method already outperforms some recent strong data augmentation methods, and (ii) Adversarial–LA achieves best test accuracy for both low-data and full-set regimes.
Revised: In particular, we observe that (i) our simplistic Randomized–LA method already outperforms some recent strong data augmentation methods, and (ii) Adversarial–LA achieves best test accuracy for both low-data and full-set regimes.

Original: See § 3.3 below for additional benchmarks with VAE-GAN (Stutz et al., 2019).
Revised: See §3.3 below for additional benchmarks with VAE-GAN (Stutz et al., 2019) and §B. for additional results with different attack parameters.

Original: 3.2. Cross-Dataset Experiments
Revised: 3.2. Cross-Dataset Experiments

Original: To further analyze potential applications of our NF based latent attacks on real-world use cases, we conduct the following experiment.
Revised: To further analyze potential applications of our NF based latent attacks on real-world use cases, we conduct the following experiment.

Original: Assuming we have available a relevant large-scale dataset, a question arises if the NF within our approach can be pre-trained on it, and used for training the classiﬁer on a different dataset.
Revised: Assuming we have available a relevant large-scale dataset, a question arises if the NF within our approach can be pre-trained on it, and used for training the classiﬁer on a different dataset.

Original: In particular, we use CIFAR10 to train the NF model, and then our latent attacks to train a classiﬁer on 10% of the CIFAR-100 dataset.
Revised: In particular, we use CIFAR10 to train the NF model, and then our latent attacks to train a classiﬁer on 10% of the CIFAR-100 dataset.

Original: Table 2 shows our results for a selection of latent attacks.
Revised: Table 2 shows our results for a selection of latent attacks.

Original: Randomized-LA and Adversarial-LA achieve 16% and 24% percent improvements over the standard baseline, respectively.
Revised: Randomized–LA and Adversarial–LA achieve 16% and 24% percent improvements over the standard baseline, respectively.

Original: The results indicate that normalizing ﬂows are capable of transferring useful augmentations across datasets.
Revised: The results indicate that NFs are capable of transferring useful augmentations across datasets.

Revised: See §B. for an additional results with SVHN and CIFAR-10.

Original: 3.3. Additional Comparison with VAE-GAN
Revised: 3.3. Additional Comparison with VAE-GAN

Original: We study the performance of our latent perturbation-based training strategies in varying settings, starting from low-data regime to full-set.
Revised: We study the performance of our latent perturbation-based training strategies in varying settings, starting from low-data regime to full-set.

Original: We reproduce the classiﬁer and the hyperparameter setup used in (Stutz et al., 2019), and use analogous setup for our method.
Revised: We reproduce the classiﬁer and the hyperparameter setup used in (Stutz et al., 2019), and use analogous setup for our method.

Original: For the reported VAE-GAN results, we used the source code provided by the authors 1 .
Revised: For the reported VAE-GAN results, we used the source code provided by the authors 1 .

Original: For our Randomized–LA, we use perturbations of size (cid:15) =0 .and
Revised: For our Randomized–LA, we use perturbations of size (cid:15) =0 .and

Original: for Adversarial–LA, we use (cid:15) =0 .
Revised: for Adversarial–LA, we use (cid:15) =0 .

Original: 05 , α =0 .
Revised: 05 , α =0 .

Original: 01 and number of steps k = 10 .
Revised: 01 and number of steps k = 10 .

Original: disentangling
Revised: generalization

Revised: [Figure]

Original: robustness-generalization
Revised: cc [Figure] r

Original: [Figure]
Revised: [Figure]

Original: Figure 2 shows our average results for 3 runs with training sizes in { 600 , 2400 , 6000 , 50000 } .
Revised: Figure 2 shows our average results for 3 runs with training sizes in { 600 , 2400 , 6000 , 50000 } .

Original: We observe that
Revised: We observe that

Original: Randomized–LA performs comparatively to the standard training baseline, whereas Adversarial–LA outperforms the standard baseline across all train set sizes.
Revised: Randomized–LA performs comparatively to the standard training baseline, whereas Adversarial–LA outperforms the standard baseline across all train set sizes.

Original: Note that the difference to the standard baselines shrinks as we increase the number of samples available to the classiﬁers.
Revised: Note that the difference to the standard baselines shrinks as we increase the number of samples available to the classiﬁers.

Original: Inline with our results, Stutz et al.
Revised: Inline with our results, Stutz et al.

Original: (2019) report diminishing performance gains for increasingly challenging datasets such as FashionMNIST to CelebA, when using therein VAEGAN based approach.
Revised: (2019) report diminishing performance gains for increasingly challenging datasets such as FashionMNIST to CelebA, when using therein VAEGAN based approach.

Original: One potential cause could be the approximate encoding and decoding mappings, and/or sensitivity to hyper-parameter tuning.
Revised: One potential cause could be the approximate encoding and decoding mappings, and/or sensitivity to hyper-parameter tuning.

Original: Indeed, our results support the numerous appealing advantages of NF models for latent space perturbations, and indicate that they have better capacity to produce useful augmented training samples.
Revised: Indeed, our results support the numerous appealing advantages of NF models for latent space perturbations, and indicate that they have better capacity to produce useful augmented training samples.

Original: 4. Discussion
Revised: 4. Discussion

Original: Exact Coding.
Revised: Exact Coding.

Original: As noted in § 2, normalizing ﬂows can perform exact encoding and decoding by their construction.
Revised: As noted in §2, normalizing ﬂows can perform exact encoding and decoding by their construction.

Original: That is, the decoding operation is exactly the reverse of the encoding operation.
Revised: That is, the decoding operation is exactly the reverse of the encoding operation.

Original: Any continuous encoder maps alocal neighborhood of a sample to somelocal neighborhood of its latent representation.
Revised: Any continuous encoder maps a neighborhood of a sample to some neighborhood of its latent representation.

Original: However, the invertibility of normalizing ﬂows also maps anylocal neighborhood of latent code to alocal neighborhood of the original sample .
Revised: However, the invertibility of normalizing ﬂows also maps any neighborhood of latent code to a neighborhood of the original sample .

Original: This property has signiﬁcant advantages over any other approximate invertible encoder-decoder methods including VAE-GANs, for deﬁning perturbations in latent space.
Revised: This property has signiﬁcant advantages over any other approximate invertible encoder-decoder methods including VAE-GANs, for deﬁning perturbations in latent space.

Original: Increasing Effective Dataset Size.
Revised: Increasing Effective Dataset Size.

Original: The primary advantage of exact coding is that the generated samples via latent perturbations improve the generalization performance of classiﬁers, as we show in § 3.1.
Revised: The primary advantage of exact coding is that the generated samples via latent perturbations improve the generalization performance of classiﬁers, as we show in §3.1.

Original: To understand why this occurs, consider the limit case (cid:15) → 0 for a latent perturbation.
Revised: To understand why this occurs, consider the limit case (cid:15) → 0 for a latent perturbation.

Original: For a numerically stable NF, this implies that we recover the original data samples, hence the original data manifold.
Revised: For a numerically stable NF, this implies that we recover the original data samples, hence the original data manifold.

Original: As we increase the (cid:15) , we “enlarge” our manifold simultaneously from all data samples.
Revised: As we increase the (cid:15) , we “enlarge” our manifold simultaneously from all data samples.

Original: Thus, by increasing (cid:15) , we add further plausible data points to our training set as long the learned latent representation is a good approximation of the underlying data manifold.
Revised: Thus, by increasing (cid:15) , we add further plausible data points to our training set as long the learned latent representation is a good approximation of the underlying data manifold.

Original: This does not necessarily hold for approximate mappings due to inherent decoder noise .
Revised: This does not necessarily hold for approximate mappings due to inherent decoder noise .

Original: Controllability.
Revised: Controllability.

Original: In § 2, we introduced two variants of latent perturbations with normalizing ﬂows.
Revised: In §2, we introduced two variants of latent perturbations with normalizing ﬂows.

Original: These two variants deﬁne different local objectives around the latent code of the original sample.
Revised: These two variants deﬁne different local objectives around the latent code of the original sample.

Original: The randomized latent attack deﬁnes a sampling operation on the data manifold, whereas the adversarial latent attack deﬁnes a stochastic search procedure to ﬁnd samples attaining high classiﬁer losses.
Revised: The Randomized–LA deﬁnes a sampling operation on the data manifold, whereas the Adversarial–LA deﬁnes a stochastic search procedure to ﬁnd samples attaining high classiﬁer losses.

Original: Here, we exploit the diffeomorphism provided by normalizing ﬂow to efﬁciently map a complex sampling operation—sampling from data manifold, or a complex search operation—ﬁnding on-manifold adversarial samples, to the latent space.
Revised: Here, we exploit the diffeomorphism provided by normalizing ﬂow to efﬁciently map a complex sampling operation—sampling from data manifold, or a complex search operation—ﬁnding on-manifold adversarial samples, to the latent space.

Original: Combined with simple prior structure of NFs, this allow for future possibilities on designing efﬁcient algorithms tackling various on manifold problems § 5.
Revised: Combined with simple prior structure of normalizing ﬂows, this allow for future possibilities on designing efﬁcient algorithms tackling various on manifold problems §5.

Original: Compatibility with Data Augmentations.
Revised: Compatibility with Data Augmentations.

Original: It is important to note that our method is orthogonal to image space data augmentation methods.
Revised: It is important to note that our method is orthogonal to image space data augmentation methods.

Original: In other words, we can train normalizing ﬂows with commonly used data augmentations.
Revised: In other words, we can train normalizing ﬂows with commonly used data augmentations.

Original: Indeed in our experiments, we observe that trained models apply some of the training-time augmentations such as cropping.
Revised: Indeed in our experiments, we observe that trained models apply some of the training-time augmentations such as cropping.

Original: This allows us to encode and decode augmented samples as well as original samples of CIFAR-10.
Revised: This allows us to encode and decode augmented samples as well as original samples of CIFAR-10.

Original: Additionally, we can use more advanced methods such as DeVries &
Revised: Additionally, we can use more advanced methods such as DeVries &

Original: Taylor (2017); Zhang et al. (2018a) concurrently with our latent perturbations to train classiﬁers.
Revised: Taylor (2017); Zhang et al. (2018a) concurrently with our latent perturbations to train classiﬁers.

Original: 5. Conclusion
Revised: 5. Conclusion

Original: Motivated by the numerous advantages of normalizing ﬂows, we propose ﬂow-based latent perturbation methods to augment the training datasets, to train a classiﬁer.
Revised: Motivated by the numerous advantages of normalizing ﬂows, we propose ﬂow-based latent perturbation methods to augment the training datasets, to train a classiﬁer.

Original: Our empirical results on several real-world datasets demonstrate the efﬁcacy of these generative models for improved test accuracy both in full and in low-data regimes.
Revised: Our empirical results on several real-world datasets demonstrate the efﬁcacy of these generative models for improved test accuracy both in full and in low-data regimes.

Original: Further directions include exploiting potentially more complex prior structures to design efﬁcient ﬂow-based algorithms tackling on-manifold sampling or optimization problems.
Revised: Further directions include exploiting potentially more complex prior structures to design efﬁcient ﬂow-based algorithms tackling on-manifold sampling or optimization problems.

Original: For example, using NF models with explicit parametrization of speciﬁc semantic transformations (e.g., zoom or orientation) would enable the training of more robustly generalizing classiﬁers.
Revised: For example, using NF models with explicit parametrization of speciﬁc semantic transformations (e.g., zoom or orientation) would enable the training of more robustly generalizing classiﬁers.

Original: A. Details on the implementation
Revised: A. Details on the implementation

Original: In this section, we list all details on the implementation.
Revised: In this section, we list all details on the implementation.

Original: Source Code.
Revised: Source Code.

Original: Our source code isanonymously provided in this repository: https://anonymous.4open.
Revised: Our source code is provided in this repository: https://github.com/okyksl/flow-lp .

Original: science/r/37e44cb8-6c57-4dc2-8bde-2ef5bf844c73/

Original: A.1. Architectures
Revised: A.1. Architectures

Original: Generative model (NF) architecture.
Revised: Generative model (NF) architecture.

Original: We use Glow (Kingma & Dhariwal, 2018) for the normalizing ﬂow architecture.
Revised: We use Glow (Kingma & Dhariwal, 2018) for the normalizing ﬂow architecture.

Original: For the MNIST  and FMNIST experiments, we use a conditional, 12-step, Glow-coupling-based architecture similar to (Ardizzone et al., 2019).
Revised: For the MNIST (Lecun et al., 1998) and FashionMNIST (Xiao et al., 2017) experiments, we use a conditional, 12-step, Glowcoupling-based architecture similar to (Ardizzone et al., 2019).

Original: See Table 3 for details.
Revised: See Table 3 for details.

Original: For the CIFAR-10/100  experiments, we use the original Glow architecture described in (Kingma & Dhariwal, 2018), i.e. , 3 scales of 32 steps each containing activation normalization, afﬁne coupling and invertible 1 × 1 convolution.
Revised: For the CIFAR-10/100 (Krizhevsky & Hinton, 2009) and SVHN (Netzer et al., 2011) experiments, we use the original Glow architecture described in (Kingma & Dhariwal, 2018), i.e. , 3 scales of 32 steps each containing activation normalization, afﬁne coupling and invertible 1 ×convolution.

Original: We adapt an existing PyTorch implementation in 2 to better match the original Tensorﬂow implementation in 3 .
Revised: We adapt an existing PyTorch implementation in 2 to better match the original Tensorﬂow implementation in 3 .

Original: For more details on multi-scale architecture in normalizing ﬂows, see (Dinh et al., 2017).
Revised: For more details on multi-scale architecture in normalizing ﬂows, see (Dinh et al., 2017).

Original: Generative Model
Revised: [Table]

Original: Input: x ∈ R 784 , y ∈ R
Revised: Input: x ∈ R 784 , y ∈ R

Original: GLOWCouplingBlock
Revised: GLOWCouplingBlock

Original: PermuteRandom
Revised: PermuteRandom

Original: GLOWCouplingBlockPermuteRandom ...
Revised: GLOWCouplingBlock PermuteRandom ...

Original: x ...
Revised: x ...

Original: GLOWCouplingBlock PermuteRandom
Revised: GLOWCouplingBlockPermuteRandom

Original: GLOWCouplingBlock
Revised: GLOWCouplingBlock

Original: Input: x ∈ R 784 , y ∈
Revised: Input: x ∈ R 784 , y ∈

Original: Rsplit x → x 1 , x 2 ( 784 → 392 , 392 ) subnet x 2 ⊕ y 
Revised: Rsplit x → x 1 , x 2 ( 784 → 392 , 392 ) subnet x 2 ⊕ y → s 1 , t

Revised: [Table]

Original: → s 1 , t 1 ( 402 → 392 , 392 ) afﬁne coupling x 1 , s 1 , t 1 → z 1 ( 3 × 392 → 392 ) subnet z 1 ⊕ y
Revised: 392 , 392 ) afﬁne coupling x [Table] s 1 , t 1 → z 1 ( 3 × 392 → 392 ) [Table]

Revised: → s

Revised: [Table]

Original: → s 2 , t 2 ( 402 → 392 , 392 ) afﬁne coupling x 2 , s 2 , t 2 → x (cid:48) 2 ( 3 × 392 → 392 ) concat.
Revised: [Table] [Table] 392 , 392 ) afﬁne coupling x 2 , s 2 , t [Table]

Revised: →

Revised: [Table]

Revised: (cid:48) 2 ( 3 ×

Revised: [Table]

Original:  z 1 ⊕ z 2 ( 392 , 392 →784 )
Revised: 392 ) concat. z [Table] z 2 ( 392 , 392 →

Revised: [Table]

Original: Subnets
Revised: Subnets

Original: Input: x ∈ Rlinear ( 402 → 512 )
Revised: Input: x [Table] [Table]

Original:  ReLU linear ( 512 → 784 ) split (784 → 392 , 392 )
Revised: [Table] ReLU linear ( 512 → [Table] ) split (

Revised: [Table]

Revised: → 392 , 392 )

Original: Classiﬁer architecture.
Revised: Classiﬁer architecture.

Original: For our experiments on MNIST, we use LeNet-5 (Lecun et al., 1998) with replaced nonlinearity– instead of tanh we use ReLU , and we initialize the network parameters with truncated normal distribution σ = 0 .
Revised: For our experiments on MNIST, we use LeNet-5 (Lecun et al., 1998) with replaced nonlinearity– instead of tanh we use ReLU , and we initialize the network parameters with truncated normal distribution σ = 0 .

Original: For the FMNIST experiments, we use the same classiﬁer as used in (Stutz et al., 2019).
Revised: For the FashionMNIST experiments, we use the same classiﬁer as used in (Stutz et al., 2019).

Original: See Table 4 for more details.
Revised: See Table 4 for more details.

Original: For CIFAR-10/100, we use the ResNet-18 architecture as implemented in (DeVries & Taylor, 2017; Zhang et al., 2018a).This
Revised: For CIFAR-10/100 and SVHN, we use the ResNet-18 architecture as implemented in (DeVries & Taylor, 2017; Zhang et al., 2018a).

Original:  ResNet-18 includes slight modiﬁcations over the standard ResNet-18 architecture in order to achieve better performance on CIFAR-10/100.
Revised: This ResNet-18 includes slight modiﬁcations over the standard ResNet-18 architecture in order to achieve better performance on CIFAR-10/100.

Original: See 4 and 5 for implementation.
Revised: See 4 and 5 for implementation.

Original: In particular, the ﬁrst layer is changed to a 3 × 3 convolution with strideand padding 1 , from the original 7 × 7 convolution with stride 2 and padding 3 .
Revised: In particular, the ﬁrst layer is changed to a 3 ×convolution with stride 1 and padding 1 , from the original 7 × 7 convolution with stride 2 and padding 3 .

Original: Additionally, the following max-pooling layer is removed.
Revised: Additionally, the following max-pooling layer is removed.

Original: A.2. Hyperparameters
Revised: A.2. Hyperparameters

Original: Generative Models.
Revised: Generative Models.

Original: For MNIST and FMNIST, we use the Adam (Kingma & Ba, 2014) optimizer with a batch size of 100 and learning rate of 10 − 6 for 100 epochs to train normalizing ﬂows.
Revised: For MNIST and FashionMNIST, we use the Adam (Kingma & Ba, 2014) optimizer with a batch size of 100 and learning rate of 10 − 6 for 100 epochs to train normalizing ﬂows.

Original: For CIFAR-10, we use the Adamax (Kingma & Ba, 2014) optimizer with learning rate of 0 . 0005 and weight decay of 0 . 
Revised: For CIFAR-10 and SVHN, we use the Adamax (Kingma & Ba, 2014) optimizer with learning rate of 0 . 0005 and weight decay of 0 . 00005 .

Original: We use warmup learning rate scheduling for the ﬁrst 

Revised: We use warmup learning rate scheduling for the ﬁrst

Original: . 000 steps of the training.
Revised: . 000 steps of the training.

Original: That is, the learning rate is linearly increased from 0 to the base learning rate 0 .
Revised: That is, the learning rate is linearly increased from 0 to the base learning rate 0 .

Original: 0005 in 500 . 000 steps.
Revised: 0005 in 500 . 000 steps.

Original: For VAE-GAN training, we run the implementation provided by authors 6 with the default architectures and parameters.
Revised: For VAE-GAN training, we run the implementation provided by authors 6 with the default architectures and parameters.

Original: That
Revised: That

Original: [Table]

Original: Input: x →

Original: [Table]
Revised: [Table]

Original: convolution (ker: 5 × 5 , 1 → 6 ; stride: 1 ; pad: 2 )

Original: ReLU

Original: AvgPool2d (ker: 2 × 2 ) convolution (ker: 5 × 5 , 6 → 16 ; stride: 1 ; pad: 0 )

Original: ReLU

Original: AvgPool2d (ker: 2 × 2 ) Flatten ( 16 × 5 × 5 → 400 ) linear ( 400 → 120 ) ReLU linear ( 120 → 84 )
Revised: is, for FashionMNIST, we use β = 2 .

Original: ReLU linear ( 120 → 10 )

Original: ReLU

Original: CNN from (Stutz et al., 2019)

Original: Input

Original: [Table]

Original: convolution (ker: 4 × 4 , 1 → 16 ; stride: 2 ; pad: 1 )

Original: Batch NormalizationReLU convolution (ker: 4 × 4 , 16 → 32 ; stride: 2 ; pad: 1 )

Original: Batch NormalizationReLU convolution (ker: 4 × 4 , 32 → 64 ; stride: 2 ; pad: 1 )

Original: Batch NormalizationReLU

Original: Flatten ( 64 × 3 × 3 → 576 ) linear

Original: ( 576 → 100 ) linear ( 100 → 10 ) is, for MNIST, we use β = 2 .

Original: 75 , γ = 1 , η = 0 and latent space size of 10 .
Revised: 75 , γ = 1 , η = 0 and latent space size of 10 .

Original: We use Adam optimizer with a batch size of 100 , learning rate of 0 .
Revised: We use Adam optimizer with a batch size of 100 , learning rate of 0 .

Original: 005 , weight decay of 0 .
Revised: 005 , weight decay of 0 .

Original: 0001 and train VAE-GANs for 60 epochs with an exponential decay scheduling of 0 .
Revised: 0001 and train VAE-GANs for 60 epochs with an exponential decay scheduling of 0 .

Original: 9 for the learning rate.
Revised: 9 for the learning rate.

Original: For CIFAR-10, we use the CelebA setup provided (the only 3-channel color dataset provided) and thus use β = 3 . 0 , latent space size of 25 and 30 epochs instead.
Revised: For CIFAR-10, we use the CelebA setup provided (the only 3-channel color dataset provided) and thus use β = 3 . 0 , latent space size of 25 and 30 epochs instead.

Original: Note that we report “On-Learned-ManifoldAdversarial
Revised: Note that we report “On-Learned-Manifold

Original:  Training” from (Stutz et al., 2019) which uses class-speciﬁc VAE-GANs.
Revised: Adversarial Training” from (Stutz et al., 2019) which uses class-speciﬁc VAE-GANs.

Original: That is, 10 separate VAE-GAN architectures are trained for both FMNIST and CIFAR-10 datasets.
Revised: That is, 10 separate VAE-GAN architectures are trained for both FashionMNIST and CIFAR-10 datasets.

Original: Discussion on Hyperparameters of Generative Models.
Revised: Discussion on Hyperparameters of Generative Models.

Original: As normalizing ﬂows directly optimize log-likelihood of the data, there are no hyperparameters in their loss function.
Revised: As normalizing ﬂows directly optimize log-likelihood of the data, there are no hyperparameters in their loss function.

Original: Additionally, the normalizing ﬂow models that we use have a ﬁxed latent dimension equal to the input dimension due to their architectural design.
Revised: Additionally, the normalizing ﬂow models that we use have a ﬁxed latent dimension equal to the input dimension due to their architectural design.

Original: As noted in §3.3, this is in contrast to VAE-GAN used in (Stutz et al., 2019) where the training involves optimizing separate losses for three networks (namely, encoder, decoder and discriminator) concurrently.
Revised: This is in contrast to VAE-GAN used in (Stutz et al., 2019) where the training involves optimizing separate losses for three networks (namely, encoder, decoder and discriminator) concurrently.

Original: Coefﬁcients called β , γ and η are used to scale different loss terms involved such as reconstruction, decoder and discriminator loss.
Revised: Coefﬁcients called β , γ and η are used to scale different loss terms involved such as reconstruction, decoder and discriminator loss.

Original: Additionally, the latent size for VAE-GAN is hand-picked for each dataset.
Revised: Additionally, the latent size for VAE-GAN is hand-picked for each dataset.

Original: Classiﬁers.
Revised: Classiﬁers.

Original: We list hyperparameters used in our experiments on FMNIST and CIFAR-10 for classiﬁer training in §3.

Original: For MNIST, we use the Adam optimizer with  learning rate of 0 .
Revised: For MNIST, we use the Adam optimizer with a learning rate of 0 .

Original: 001 and weight decay of 0 .
Revised: 001 and weight decay of 0 .

Original: We train LeNet-5 classiﬁers for 20 epochs with exponential learning decay of rate 0 .
Revised: We train LeNet-5 classiﬁers for 20 epochs with exponential learning decay of rate 0 .

Original: 1 for 10 . 000 steps.
Revised: 1 for 10 . 000 steps.

Revised: For FashionMNIST, we use the training setup used in (Stutz et al., 2019).

Original: Data Augmentation.
Revised: That is, we use Adam optimizer with a learning rate of 0 . 01 and weight decay of 0 . 0001 . We train classiﬁers for 20 epochs with exponential learning decay of rate 0 . 9 for 500 steps.

Revised: For CIFAR10/100, we use the training setup used in (DeVries & Taylor, 2017; Zhang et al., 2018a).

Revised: More precisely, we use Stochastic Gradient

Revised: Descent (SGD) with a batch size of 128 , a learning rate of 0 . 1 , weight decay of 0 . 0005 , and Nesterov momentum of 0 . 9 .

Revised: We train ResNet-18 classiﬁers for 200 epochs and multiply the learning rate by 0 .

Revised: 2 at epochs { 60 , 120 , 160 } .

Revised: For SVHN, we use the same optimizer with a weight decay of 0 . 0001 .

Revised: We train ResNet-18 classiﬁers for 120 epochs and multiply the learning rate by 0 .

Revised: 1 at epochs { 30 , 60 , 90 } .

Revised: Data Augmentation.

Original: For CIFAR-10/100, we use standard data augmentation akin to (Zagoruyko & Komodakis, 2016).
Revised: For CIFAR-10/100, we use standard data augmentation akin to (Zagoruyko & Komodakis, 2016).

Original: That is, we zero-pad images with 4 pixels on each side, take a random crop of size 32 × 32 , and then mirror the resulting image horizontally with 50% probability.
Revised: That is, we zero-pad images with 4 pixels on each side, take a random crop of size 32 × 32 , and then mirror the resulting image horizontally with 50% probability.

Original: We use such data augmentation for both training the generative and the classiﬁer models.
Revised: We use such data augmentation for both training the generative and the classiﬁer models.

Original: Hence, our normalizing ﬂow model is capable of encoding-decoding operations on augmented samples as well.
Revised: Hence, our normalizing ﬂow model is capable of encoding-decoding operations on augmented samples as well.

Original: Advanced data augmentation baselines we use in  1 (DeVries & Taylor, 2017; Zhang et al., 2018a) also include the same standard data augmentations.
Revised: Advanced data augmentation baselines we use in Table 1 (DeVries & Taylor, 2017; Zhang et al., 2018a) also include the same standard data augmentations.

Original: However, (Stutz et al., 2019) does not use data augmentation in their generative model.
Revised: However, (Stutz et al., 2019) does not use data augmentation in their generative model.

Original: To provide a more direct comparison between the performance of two generative models, in §B.2 we conduct an additional study without any data augmentations.
Revised: To provide a more direct comparison between the performance of two generative models, in §B.3 we conduct an additional study without any data augmentations.

Original: B. Additional Results B.1. Results on MNIST
Revised: B. Additional Results B.1. Results on MNIST

Original: Table 5 summarizes our results on MNIST in full data regime.
Revised: Table 5 summarizes our results on MNIST in full data regime.

Original: Although the baseline has very good performances on this dataset, we observe improved generalization.
Revised: Although the baseline has very good performances on this dataset, we observe improved generalization.

Original: [Table]
Revised: [Table]

Revised: B.2. Results on SVHN

Revised: Table 6 summarizes our results on SVHN in low-data regime.

Revised: Similarly to §3.2, we conduct a cross-dataset experiment between CIFAR-10 and SVHN, where we use pre-trained normalizing ﬂows on CIFAR-10 to train classiﬁers on SVHN.

Revised: To provide a baseline on the effect of using different datasets for normalizing ﬂows and classiﬁers, we also provide results with pre-training on SVHN.

Revised: Latent attacks transferred from CIFAR-10 achieve superior performance to direct pre-training on

Revised: SVHN, indicating that transferring augmentations across datasets is promising.

Revised: [Table]

Original: B.2. Additional Results on CIFAR- 
Revised: B.3. Additional Results on CIFAR-

Original: Results without Data Augmentation.
Revised: Results without Data Augmentation.

Original: To provide a direct comparison between two generative models and eliminate the effect of data augmentation, we run additional experiments.
Revised: To provide a direct comparison between two generative models and eliminate the effect of data augmentation, we run additional experiments.

Original: Table 6 shows results for our latent perturbations without any data augmentation to train the normalizing ﬂow and the classiﬁer.
Revised: Table 7 shows results for our latent perturbations without any data augmentation to train the normalizing ﬂow and the classiﬁer.

Original: In line with our FMNIST results in §3.3, we observe that both randomized and adversarial latent attack overperform standard baseline and VAE-GAN based approach
Revised: In line with our FashionMNIST results in §3.3, we observe that both Randomized–LA and Adversarial–LA overperform standard baseline and VAE-GAN based approach.

Original: [Table]
Revised: [Table]

Original: Results with Different Attack Parameters.
Revised: Results with Different Attack Parameters.

Original: In Table 7 we provide results with varying hyperparameters for the different attacks.
Revised: In Table 8, we provide results with varying hyperparameters for the different attacks.

Original: Observe that in the “higher” Adversarial–LA perturbation setting–where (cid:15) = 2 . 0 , the classiﬁer still didn’t fully ﬁt to the training set but the test performance is above the standard baseline.
Revised: Observe that in the “higher” Adversarial–LA perturbation setting–where (cid:15) = 2 . 0 , the classiﬁer still didn’t fully ﬁt to the training set but the test performance is above the standard baseline.

Original: Multi-step Training.
Revised: Multi-step Training.

Original: We run additional experiments where we sequentially apply different attack hyperparameters in a multi-step training with weaker perturbations to increase the performance on the test set.
Revised: We run additional experiments where we sequentially apply different attack hyperparameters in a multi-step training with weaker perturbations to increase the performance on the test set.

Original: The results are listed in Table 7, denoted with + .
Revised: The results are listed in Table 8, denoted with + .

Original: [Table]
Revised: [Table]

Original: [-.+ P rand , (cid:15) =0 .100 .
 P (cid:96) 2 adv , (cid:15) =1 . 0 , α =0 . 5 , k = 99 .0 .96 .0 .-]
Revised: [-.+ P rand , (cid:15) =0 .100 .
 P (cid:96) 2 adv , (cid:15) =1 . 0 , α =0 . 5 , k = 99 .0 .96 .0 .-]Generated Images.

Original: [-P (cid:96) 2 adv , (cid:15) =2 . 0 , α =1 . 5 , k = 89 .
 .+ P (cid:96) 2 adv , (cid:15) =1 . 0 , α =0 . 75 , k = 99 .0 .96 .
-]
Revised: [-P (cid:96) 2 adv , (cid:15) =2 . 0 , α =1 . 5 , k = 89 .
 .+ P (cid:96) 2 adv , (cid:15) =1 . 0 , α =0 . 75 , k = 99 .0 .96 .
-]Figure 3 depicts samples obtained with our Randomized-LA and Adversarial-LA methods.

Original: [-.+ P (cid:96) 2 adv , (cid:15) =0 . 75 , α =0 . 5 , k = 99 .0 .96 .
-]
Revised: [-.+ P (cid:96) 2 adv , (cid:15) =0 . 75 , α =0 . 5 , k = 99 .0 .96 .
-]In contrast to random image space perturbations, we observe that both Randomized-LA and Adversarial-LA yield perturbations dependent on the semantic content of the input image.

Original: [-.+ P rand , (cid:15) =0 .100 .
 .+ P (cid:96) 2 rand , (cid:15) =10 .100 .
-]
Revised: [-.+ P rand , (cid:15) =0 .100 .
 .+ P (cid:96) 2 rand , (cid:15) =10 .100 .
-][Figure]