A DVERSARIALLY R OBUST M ODELS MAY NOT T RANSFER B ETTER : S UFFICIENT C ONDITIONS FOR D OMAIN T RANSFERABILITY FROM THE V IEW OF R EGULARIZATION
Anonymous authors
Paper under double-blind review
A BSTRACT
Machine learning (ML) robustness and generalization are fundamentally correlated: they essentially concern about data distribution shift under adversarial and natural settings, respectively.
Thus, it is critical to uncover their underlying connections to tackle one based on the other.
On one hand, recent studies show that more robust (adversarially trained) models are more generalizable to other domains.
On the other hand, there lacks of theoretical understanding of such phenomenon, and it is not clear whether there are counterexamples.
In this paper, we aim to provide sufﬁcient conditions for this phenomenon considering different factors that could affect both, such as norm of the last layer, Jacobian norm, and data augmentations (DA).
In particular, we propose a general theoretical framework indicating factors that can be reformed as a function class regularization process, which could lead to improvements of domain generalization.
Our analysis, for the ﬁrst time, shows that “robustness” is actually not the causation for domain generalization; rather, robustness induced by adversarial training is a by-product of such function class regularization.
We then discuss in details about different properties of DA and we prove that under certain conditions, DA can be viewed as regularization and therefore improve generalization.
We conduct extensive experiments to verify our theoretical ﬁndings and show several counterexamples where robustness and generalization are negatively correlated when the sufﬁcient conditions are not satisﬁed.
I NTRODUCTION
Domain generalization (or transferability) is the task of training machine learning models with data from one or more source domains that can be adapted to a target domain, often via lowcost ﬁne-tuning.
Thus, domain generalization refers to approaches designed to address the natural data distribution shift problem (Muandet et al., 2013; Rosenfeld et al., 2021).
A wide array of approaches have been proposed to address domain transferability, including ﬁne-tuning the last layer of DNNs (Huang et al., 2018), invariant feature optimization (Muandet et al., 2013), efﬁcient model selection for ﬁne-tuning (You et al., 2019), and optimal transport based domain adaptation (Courty et al., 2016).
Improving domain generalization has emerged as an important task in the machine learning community: for instance, it is among the key technologies to enable an autonomous driving vehicle trained in city scenarios to make correct decisions in the countryside as well.
On the other hand, robust machine learning aims to tackle the problem of adversarial data distribution shift.
Both empirical and certiﬁed robust learning approaches have been proposed, such as empirical adversarial training (Madry et al., 2018) and certiﬁed defenses based on deterministic and probabilistic approaches (Cohen et al., 2019).
As domain transferability and robust machine learning tackle different kinds of data distribution shifts, this work seeks to uncover their underlying connections and tradeoffs.
For instance, recent studies suggest that adversarially robust models are more domain transferable (Salman et al., 2020), which, in turn, provides new insights on improving domain generalization.
However, a theoretical analysis of their relationship is still lacking, and it is unclear whether such positive correlations al-
[Figure]
ways hold.
In this paper, we take the ﬁrst steps towards formally analyzing the relationship between model robustness and domain transferability to answer the following questions: What are sufﬁcient conditions for domain transferability?
Is model robustness the cause of domain transferability?
Can robustness and domain transferability be negatively correlated?
To answer the above questions and uncover the underlying relationship between robustness and domain transferability, we propose a general theoretical framework that characterizes sufﬁcient conditions for domain transferability from the view of function class regularization.
Our analysis shows that if the function class of feature extractors is more regularized, the model based on a feature extractor trained from the function class, composed with a ﬁne-tuned last layer, can be more transferable.
Formally, we prove that there is a monotone relation between the regularization strength and a tight upper bound on the relative domain transfer loss.
Under the proposed framework, we analyze several common factors for model training, including the Jacobian norm, the last layer norm, data augmentation, and adversarial training as shown in
Fig.
In particular, controlling the Jacobian norm and last layer norm can be viewed as functionclass regularization, thus can be analyzed in our framework.
We also analyze how other common regularization operations can be mapped to function class regularization.
For instance, we consider noise-dependent and independent data augmentation procedures based on feature average and loss average aggregation algorithms.
We conduct extensive experiments on ImageNet (CIFAR-10 as target domain) and CIFAR- (SVHN as target domain) based on different models to verify our analysis.
We show that regularization can control domain transferability, and robustness and domain transferability can be negatively correlated, which are counter-examples against Salman et al.
Taken together, this indicates that robustness is not a cause of transferability.
Technical Contributions.
We aim to uncover the underlying relationship between robustness and domain transferability and lay out the sufﬁcient conditions for transferability from the view of regularization.
We make both theoretical and empirical contributions.
• We propose a theoretical framework to analyze the sufﬁcient conditions for domain transferability from the view of function class regularization.
We provably show that stronger regularization on the feature extractor implies a decreased tight upper bound on the relative transferability loss; while model robustness could be arbitrary.
• We prove the tightness of our transferability upper bound, and provide the generalization bound of the relative transferability loss from the view of regularization.
• We analyze several factors such as different data augmentations ( e.g. , rotation and Gaussian) under the framework, and show how they can be mapped to function class regularization and therefore affect transferability.
• We conduct extensive experiments on different datasets and model architectures to verify our theoretical claims.
We also show several counterexamples that indicate signiﬁcant negative correlation between robustness and the relative domain transferability.
R ELATED W ORK
Domain Transferability has been analyzed in different settings.
Muandet et al.
present a generalization bound for classiﬁcation task based on the properties of the assumed prior over training environments.
Rosenfeld et al.
model domain transferability/generalization as an online game and show that generalizing beyond the convex hull of training environments is NP-hard, and Zhang et al. provides a generalization bound for distributions with sufﬁciently small H-divergence.
Given the complexity of domain transferability analysis, recent empirical studies show that adversarially robust models transfer better (Salman et al., 2020).
In this paper, we aim to relax the assumptions and focus on understanding the domain transferability from the view of regularization and theoretically show whether “robustness” is indeed a causation for transferability or not.
Model Robustness is an important topic given recent diverse adversarial attacks (Goodfellow et al., 2014; Carlini & Wagner, 2017).
These attacks may be launched without access to model parameters (Tu et al., 2019) or even with the model predicted label alone (Chen et al., 2020).
Different approaches have been proposed to improve model robustness against adversarial attack.
Adversarial training has been shown to be effective empirically (Madry et al., 2018;
Zhang et al., 2019a; Miyato et al., 2018).
Some studies have shown that robustness is property related to other model characteristics, such as transferability and invertibility (Engstrom et al., 2019).
S UFFICIENT C ONDITIONS FOR D OMAIN T RANSFERABILITY
In this section, we theoretically analyze the problem of domain transferability from the view of regularization and discuss some sufﬁcient conditions for good transferability.
All of the proofs are provided in Section A in the appendix.
Notations.
We denote the input space as X ; the feature space as Z and the output space as Y .
Let the ﬁne-tuning function class be g ∈ G .
Given a feature extractor f : X → Z and a ﬁne-tuning function g : Z → Y , the full model is g ◦ f : X → Y .
We denote P X×Y as the set of distributions on X × Y .
The loss function is denoted by (cid:96) :
Y × Y → R + , and the population loss based on data distribution D ∈ P X×Y and a model g ◦ f is deﬁned as
[Equation]
Before diving into the details, we ﬁrst provide the following example to illustrate why one might investigate domain transferability from the view of regularization.
3. E XAMPLE : R OBUSTNESS AND T RANSFERABILITY ARE I NDEPENDENT
In this subsection, we construct a simple example where domain transferability depends on regularization, yet domain transferability and robustness are independent .
Moreover, this example serves as motivation to consider domain transferability from the view of regularization.
Given the source and target distributions D S , D T ∈ P X×Y , we denote their marginal distributions on the input space X as D X S and D X T , respectively.
We consider the case that X ⊂ R m being a low-dimensional manifold in R m , and Y = R d .
Given an input x ∈ X , the ground truth target for the source domain is y S ( x ) generated by a function y S : R m → R d .
Similarly, we deﬁne y T for the target domain.
In this example, for simplicity, we neglect the ﬁne-tuning process but directly consider learning a function f : R m → R d with a norm (cid:107) · (cid:107) on R d .
For the source domain we have the population loss:
[Equation]
A distribution D ∈ P X on the input space X , deﬁnes a norm of a function f : R m → R d as
[Equation]
where we view two functions f 1 , f 2 as the same if (cid:107) f 1 − f 2 (cid:107) D = 0 .
Therefore, we can deﬁne the source domain loss (cid:96) D S ( f ) = (cid:107) f − y S
(cid:107) D X S and the target domain loss (cid:96) D T ( f )
= (cid:107) f − y T (cid:107) D X T .
For the sake of illustration, we consider the simple case where the input distributions D X S , D X T are the same, and hence we denote D
= D X S = D X T .
Note that y S and y T are different.
Denoting a function space F = { f : R m → R d | (cid:107) f (cid:107) D < ∞} , we assume that y S , y T ∈ F and we can compare f, y S , y T in the same space.
Therefore, given c > 0 as a regularization parameter, the domain transferability problem can be deﬁned as:
Learning
[Equation]
Testing on a target domain:
[Equation]
where the minimizer f D S c := y S min { 1 , c (cid:107) y S (cid:107) D } , the source domain loss is (cid:96) D S ( f )
= (cid:107) f
− y S
(cid:107) D , and the target domain loss is (cid:96) D T ( f )
= (cid:107) f − y T (cid:107) D .
We prove in Proposition 3.1 that f D S c is indeed a minimizer of equation 1 and provide an intuitive illustration in Figure 2.
We ﬁrst analyze the relations among the adversarial robustness of the source model f D S c , the source error (cid:96) D S ( f D S c ) , and the target error (cid:96) D T ( f D S c ) .
Since the loss functions only evaluate f D S c on X , which is a low-dimensional manifold in R m , f D S c could be arbitrarily bad on R m \X without changing the value of (cid:96) D T ( f D S c ) or (cid:96) D S ( f D S c ) .
Therefore, given an input x ∈ X , an adversarial perturbation δ ∈ R m could make an input x + δ ∈ R m \X , which means that the adversarial robustness of f D S c (e.g., max [Equation] ≤ (cid:15) (cid:96) ( f D S c ( x + δ ) , y S ( x )) ) could be arbitrarily bad.
As we can see, the robustness is independent to domain transferability in this example .
On the contrary, if we change the perspective to consider the the regularization parameter c , we have the following interesting ﬁnding.
An illustration of the ﬁnding is shown in Figure 2, and a more formal statement is provided in Proposition 3.1. ℱ [Equation] [Table]
[Figure]
Proposition 3.1.
Given the problem deﬁned above, f D S c is a minimizer of equation 1.
If c ≥ c (cid:48) ≥ 0 , then the relative domain transferability loss (cid:96) D T ( f D S c ) − (cid:96) D S
( f D S c ) ≥ (cid:96) D T ( f D S c (cid:48) ) − (cid:96) D S ( f D S c (cid:48) ) .
We can see that robustness is not sufﬁcient to characterize domain transferability.
However, there is a monotone relation between the regularization strength and the relative transferability loss, where adversarial robustness could be arbitrary.
Similar behavior is also observed in our experiments, as we will discuss in Section 4.
Naturally, these ﬁndings motivate the study of the connections between the regularization of the training process and domain transferability in general, as we consider next.
3. U PPER B OUND OF THE R ELATIVE D OMAIN T RANSFERABILITY
In this subsection, we consider the general transferability problem with ﬁne-tuning.
We prove that there is a monotone relationship between the regularization strength and relative domain transferability loss. We also present a tight upper bound on the relative domain transferability loss.
Denote the training algorithm as A that takes a data distribution D and outputs a feature extractor f D A ∈ F A chosen from a function class F A and a ﬁne-tuning function g D A ∈ G .
Next we formally deﬁne relative domain transferability.
Deﬁnition 1 (Relative Domain Transferability Loss) .
Given the training algorithm A and a pair of distributions D S , D T ∈ P X×Y , the relative domain transferability loss between D S , D T is deﬁned to be the difference of ﬁne-tuned losses, i.e.,
[Equation]
Note that the training algorithm
A is not required to be optimal, i.e., it could be the case that
[Equation]
D S
[Equation]
g D S A ◦ f D S A ) > inf g ∈G ,f ∈F A
[Equation]
D S ( g ◦ f ) .
As we can see, the smaller τ ( A ; D S , D T ) is, the better the model’s relative performance becomes on the target domain.
Another perspective of Deﬁnition 1 is that inf g
[Equation]
From this perspective, the transferred loss is the source loss plus an additional term to be upper bounded by a certain distance metric between the source and target distributions – as is common in the literature of domain adaptation (e.g., Ben-David et al.
; Zhao et al.
The key question of the “distance metric” remains unanswered.
To this end, we propose the following.
Deﬁnition 2 ( ( G , F ) -pseudometric) .
Given a ﬁne-tuning function class G , a feature extractor function class F and distributions D S , D T ∈ P X×Y , the ( G , F ) -pseudometric between D S , D T is
[Equation]
Since the ﬁne-tuning function class is usually simple and ﬁxed, we will use d F as an abbreviation in the context where G is clear.
It can be easily veriﬁed that d G , F is a pseudometric that measures the distance between two distributions, as shown in the following proposition.
Proposition 3.2.
d G , F ( · , · ) : P X×Y × P X×Y → R + satisﬁes the following properties; (Symmetry)
d G , F ( D S , D T ) =
d G , F ( D T , D S ) ; (Triangle Inequality)
d G , F ( D S , D T ) ≤ d G , F ( D S , D (cid:48) )
+ d G , F ( D (cid:48) , D T ) ; (Weak Zero Property)
d G , F ( D , D ) = 0 .
In this section, we consider a ﬁxed ﬁne-tuning function class G and feature extractor function class
F A given by the training algorithm A .
Thus, we denote d G , F as d F A for the remainder of the paper.
With the deﬁnition of d F A , we can derive the following result.
Theorem 3.1.
Given a training algorithm A , for ∀D S , D T ∈ P X×Y we have
[Equation]
or equivalently ,
[Equation]
D S [Equation] D T ) . Interpretation: As we can see, the above theorem provides sufﬁcient conditions for good domain transferability.
There is a monotone relation between the regularization strength and d F A ( D S , D T ) , i.e., the upper bound on the relative domain transferability loss τ ( A ; D S , D T ) .
More explicitly, if a training algorithm A (cid:48) has F A (cid:48) ⊆
F A , then d F A (cid:48)
( D S , D T ) ≤ d F A ( D S , D T ) .
Moreover, small d F A ( D S , D T ) implies good relative domain transferability.
From this perspective, we can see that we need both small d F A ( D S , D T ) and small source loss (cid:96) D S ( g D S
A ◦ f D S A ) to guarantee good absolute domain transferability.
Note that there is a possible trade-off, i.e., with F A being smaller, d F A ( D S , D T ) decreases but possibly (cid:96) D S ( g D S
A ◦ f D S A ) increases due to the limited power of F A .
On the other hand, there may not be such trade-off if D S and D T are close enough such that d F A ( D S , D T ) is small.
To make the upper bound more meaningful, we need to study the tightness of it.
Theorem 3.2.
Given any source distribution D S ∈ P X× R d , any ﬁne-tuning function class G where
G includes the zero function, and any training algorithm A , denote
[Equation]
We assume some properties of the loss function (cid:96) : R d × R d → R + : it is differentiable and strictly convex w.r.t.
its ﬁrst argument; (cid:96) ( y, y ) = 0 for any y ∈ R d ; and lim r →∞ inf y :
(cid:107) y (cid:107) 2 = r (cid:96) ( (cid:126) 0 , y ) = ∞ , where (cid:126) 0 is the zero vector.
Then, for any distribution D X on X , there exist some distributions D T ∈ P
X× R d with its marginal on X being D X such that
[Equation]
or equivalently d F A ( D S , D T ) − (cid:15) ≤ τ ( A ; D S , D T ) ≤ d F A ( D S , D T ) .
Interpretation:
In the above theorem, we show that given any A, D S , and the marginal D X , there exists some conditional distributions of y | x such that by composing it with the given D X we have a distribution D T to make the bound in Theorem 3.1 (cid:15) -tight.
Note that (cid:15) is the difference between the source loss and the its inﬁmum, i.e., with a good enough algorithm A , the (cid:15) could be arbitrarily small.
3. G ENERALIZATION U PPER B OUND OF THE R ELATIVE D OMAIN T RANSFERABILITY
Here we investigate the proposed theory on relative transferability with ﬁnite samples.
For a distribution D ∈ P X×Y , we denote its empirical distribution with n samples as (cid:98) D n .
That being said,
[Equation]
where ( x i , y i ) are i.i.d.
samples from D .
Therefore, given two distributions D S , D T ∈ P X×Y , the empirical ( G , F ) -pseudometric between them is d G , F ( (cid:98) D nS , (cid:98) D nT ) .
Note that d G , F is not only a pseudometric of distributions, but also a complexity measure, and we will ﬁrst connect it with the Rademacher complexity.
Deﬁnition 3 (Empirical Rademacher Complexity) .
The loss function class induced by G , F is
[Equation] where h g,f ( x, y ) :
= (cid:96) ( g ◦ f ( x ) , y ) .
Given an empirical distribution (cid:98) D n (i.e., n data samples), the Rademacher complexity of L is
[Equation]
where ξ ∈ R
n are Rademacher variables, i.e., each ξ i is i.i.d.
uniformly distributed on {− 1 , 1 } .
We can see that if there is a F (cid:48) ⊆
F , then Rad (cid:98) D n ( L G , F (cid:48) )
≤ Rad (cid:98) D n ( L G , F ) .
With the above deﬁnitions, we have the following lemma connecting the ( G , F ) -pseudometric to Rademacher complexity.
Lemma 3.1.
Assuming the individual loss function (cid:96) :
Y × Y → [0 , c ] , given any distribution
D ∈ P X×Y and ∀ δ > 0 , with probability ≥ 1 − δ we have
[Equation]
Therefore, denoting again d F A as d G , F A , the empirical version of Theorem 3.1 is as follows.
Theorem 3.3.
Assuming the individual loss function (cid:96) :
Y × Y → [0 , c ] , given ∀D S , D T ∈ P
X×Y , for ∀ δ > 0 with probability ≥ 1 − δ we have
[Equation]
We can see that a smaller feature extractor function class F A implies both a smaller d F A and the
Rademacher complexity.
Therefore, the monotone relation between the regularization strength and the upper bound on the relative domain transferability loss also holds for the empirical settings.
Other than direct regularization, empirically we ﬁnd that the transferability is also related to the use of data augmentation.
Can we explain such phenomena from the view of regularization again?
We discuss this question next.
3. W HEN CAN D ATA AUGMENTATION BE VIEWED AS R EGULARIZATION ?
In this subsection, we discuss the connections between data augmentation (DA) and regularization.
We present the results and their interpretation in this subsection, while deferring the detailed discussion to the Section B in the appendix.
Empirical research has shown evidence of the regularization effect of DA (Hern´andez-Garc´ıa &
K¨onig, 2018a;b).
However, there is a lack of theoretical understanding on when can data augmentation be viewed as regularization in general.
In an attempt to address this question, we consider a general DA setting of afﬁne transformation (Perez & Wang, 2017) with parameters ( W (cid:63) , b (cid:63) ) whose distribution represents speciﬁc DA.
General Settings.
We consider the ﬁne-tuning function g : R d → R as a linear layer, which will be concatenated to the feature extractor f : R m → R d .
Given a model g ◦ f , we use the squared loss (cid:96) ( g ◦ f ( x ) , y )
=
( g ◦ f ( x ) − y ) 2 , and accordingly apply second-order Taylor expansion to the objective function to study the effect of data augmentation.
DA categories.
We discuss two categories of DA, feature-level DA and data-level DA .
Feature-level
DA (Wong et al., 2016; DeVries & Taylor, 2017) requires the transformation to be performed in the learned feature space: given a data sample x ∈ R m and a feature extractor f , the augmented feature is W (cid:63) f ( x ) + b (cid:63) where W (cid:63) ∈ R d × d , b (cid:63) ∈ R d are sampled from a distribution.
On the other hand, data-level DA requires the transformation to be performed in the input space: given a data sample x , the augmented sample is W (cid:63) x + b (cid:63) where W (cid:63) ∈ R m × m , b (cid:63) ∈ R m are sampled from a distribution.
Intuition on sufﬁcient conditions .
For either the feature-level or the data-level DA, the intuitions given by our analysis are similar.
Our results (Theorem B.1&B.2) suggest that the following conditions indicate the regularization effects of a data augmentation: 1) E W (cid:63) [ W (cid:63) ]
= I ; 2) E b (cid:63)
[ b (cid:63) ] = (cid:126) 0 ; 3) W (cid:63) and b (cid:63) are independent, where I is the identity matrix and (cid:126) 0 is the zero vector; 4) W (cid:63) is not a constant if it is the feature-level DA; 5) DA is of a small magnitude if it is the data-level DA.
Empirical veriﬁcation.
Combining with Theorem 3.3, it suggests that DA satisfying the conditions above may improve the relative domain transferability.
In fact, it matches the empirical observations in Section 4.
Concretely, 1) Gaussian noise satisﬁes the four conditions, and empirically the
Gaussian noise improves domain transferability while robustness decreases a bit (Figure 5); 2) Rotation , which rotates input image with a predeﬁned ﬁxed angle with predeﬁned ﬁxed probability, violates E W (cid:63) [ W (cid:63) ]
= I , and empirically the rotation barely affects domain transferability (Figurein Appendix D.3); 3) Translation , which moves the input image for a predeﬁned distance along a pre-selected axis with ﬁxed probability, violates E b (cid:63)
[ b (cid:63) ] = (cid:126) 0 , and empirically the translation distance barely co-relates to the domain transferability (Figure 14 in Appendix D.3).
E VALUATION 4. E XPERIMENTAL S ETTING
Source model training We train our model on two source domains: CIFAR-10 and ImageNet.
Unless speciﬁed, we will use the training setting as follows 1 .
For CIFAR-10, we train the model with 200 epochs using the momentum SGD optimizer with momentum 0.9, weight decay 0.0005, an initial learning rate 0.1 which decays by a factor of 10 at the 100-th and 150-th epoch.
For
ImageNet, we train the model with 90 epochs using the momentum SGD optimizer with momentum 0.9, weight decay 0.0001, an initial learning rate 0.1 which decays by a factor of 10 at the 30-th and 60-th epoch.
We use the standard cross entropy loss denote as L CE ( h s , x, y ) , where h s =
g s ◦ f is the trained model and x, y are the input and label respectively.
To evaluate the robustness on the source domain, we follow the evaluation setting in Ilyas et al.
and perform the PGD attack with 20 steps using (cid:15) = 0 .
We also evaluate the robustness using AutoAttack in Appendix D.4.
For both tasks we use ResNet-18 as the model structure.
We provide results of other model structures in appendix D.2.
Domain Transferability We evaluate the transferability from CIFAR-10 to SVHN and from ImageNet to CIFAR-10.
For the ImageNet transferability, we focus on CIFAR as the target domain, since it is the domain that is the most positively correlated with robustness as shown in Salman et al.
We evaluate the ﬁxed-feature transfer where only the last fully-connected layer is ﬁne-tuned following our theoretical framework.
We ﬁne-tune the last layer with 40 epochs using momentum
SGD optimizer with momentum 0.9, weight decay 0.0005, an initial learning rate 0.01 which decays by a factor of 10 at the 20-th and 30-th epoch.
To mitigate the impact of benign accuracy, we evaluate the relative domain transfer accuracy (DT Acc) as follows.
Let acc src and acc tgt be the accuracy of the a ﬁne-tuned model on source and target domain, and acc vsrc and acc vtgt be the accuracy of vanilla model ( i.e. , models trained with standard setting) on source and target domain, then the relative DT accuracy is deﬁned as:
[Equation]
We also provide the results of absolute DT accuracy in Appendix D.1.
4. R ELATIONSHIP BETWEEN R OBUSTNESS AND T RANSFERABILITY U NDER C ONTROLLABLE C ONDITIONS
We train the model under different controllable conditions to validate our analysis.
In particular, we train the methods by controlling different regularization or data augmentations to evaluate the change of model robustness and transferability. [Figure]
Controlling the norm of last layer As shown in our framework, domain transferability is related with the regularization on the feature extractor.
Here we regularize the transferability by controlling the norm of last linear layer g s .
Intuitively, when we force the norm of g s to be large during training, the corresponding norm of f will be regularized to be small.
We use two approaches to control the last layer norm:
• Last-layer regularization (LLR): we impose a strong l2-regularizer with parameter λ l speciﬁcally on the weight of g s and therefore our training loss becomes: L LLR ( h s , x, y ) =
L CE ( h s , x, y ) + λ l · || g s || F , where || g s || F is the frobenius norm of the weight matrix of g s .
• Last-layer orthogonal training (LLOT): we directly control the l2-norm of g s with orthogonal training (Huang et al.
The orthogonal training will enforce the weight to become a 1norm matrix and we multiply a constant to obtain the desired norm
||
g s || 2 .
The result of LLR and LLOT are shown in Figure 3.
We observe that when we regularize the norm of last layer to be large (i.e. smaller λ in LLR and larger ||
g s || 2 in LLOT), the domain transferability will increase while the model robustness will decrease (their negative correlation is signiﬁcant with
Pearson’s coefﬁcient around − 0 . 9 ).
This is because larger last layer norm will produce a feature extractor f with smaller norm, which, according to our analysis, leads to a better domain transferability.
On the other hand, the model g s ◦ f will have a larger norm and therefore becomes less robust under adversarial attacks.
Controlling the norm of feature extractor We directly regularize the feature extractor f and check the impact on domain transferability.
We implement two regularization as follows:
• Jacobian regularization (JR): we follow the approach in Hoffman et al
(2019) to apply JR on the feature extractor.
Given model h s =
g s ◦ f , the training loss becomes: L JR ( h s , x, y )
=
L CE ( h s , x, y ) + λ j · || J ( f, x ) || 2 F , where J ( f, x ) denotes the Jacobian matrix of f on x and || · || F is the frobenius norm.
• Weight Decay (WD): we impose a strong weight decay with factor λ w on the feature extractor f during training.
This is equivalent to imposing a strong l2-regularizer with factor λ w on the feature extractor (excluding the last layer).
The results under JR and WD are shown in Figure 4.
We observe that with larger regularization on the feature extractor, the model shows higher domain transferability, which matches our analysis.
Meanwhile, the robustness decreases signiﬁcantly with large regularizer.
This is because a large regularization will harm the model performance on source domain and lead to low model robustness. [Figure]
[Figure] [Figure] Data augmentation As shown in Section 3.4, data augmentation can be viewed as a type of regularization during training and thus affects the domain transferability.
Here we consider both noise dependent and independent data augmentations
[Figure]
Noise-dependent data augmentation We include two noise-dependent augmentations: • Gaussian Noise data augmentation (Gauss): we add zero-mean Gaussian noise with variance σto the input image.
• Posterize (Pos): we truncate each channel of one pixel value into b bits (originally they are 8 bits).
The results of Gauss and Pos are shown in Figure 5.
We observe that the domain transferability of trained model keeps improving with larger data augmentation, which matches our theory.
The robustness also beneﬁts from a small data augmentation, but decreases when it becomes large.
Resolution- related noise-independent data augmentation.
Speciﬁcally, for ImageNet to
CIFAR-10 transferability, we consider two resolution-related data augmentations.
The intuition is that when the target domain has a lower resolution than the source domain (ImageNet is 224 ×while CIFAR-10 is 32 × 32 ), the data augmentations that down-sample the inputs during the training on source domain will help transferability.
We consider the below resolution-related augmentations:
• Rescale: we rescale the input to be m times smaller ( i e. , shape ImageNet as (224 /m ) × (224 /m ) )
and then rescale them back to the original size.
• Blur: we apply Gaussian blurring with kernel size k on the input.
The Gaussian kernel is created with a standard deviation randomly sampled from [0 . 1 , 2 . 0] .
We show the results of rescaling and blurring in Figure 6.
The experiments are evaluated only for ImageNet to CIFAR-10, and we include the results of both ResNet18 (the default model) and
WideResNet50.
We can see that these data augmentations help with transferability to target domain, although the robustness on the source domain decreases since these augmentations do not include any robustness-related operations.
C ONCLUSIONS
In this work, we theoretically analyze the sufﬁcient conditions for domain transferability based on the view of function class regularization.
We also conduct experiments to verify our claims and observe some counterexamples that shows a negative correlation between robustness and domain transferability.
These results are helpful in the domain generalization of machine learning models.
E THICS S TATEMENT
Our work focuses on theoretically and empirically studying the domain transferability of a machine learning model.
All the datasets and packages we use are open-sourced.
We do not have ethical concerns in our paper.
R EPRODUCIBILITY S TATEMENT
We have tried our best to provide training details to facilitate reproducing our results.
In Section
we provide detailed results on how to train the model and how to transfer the trained model to target domain, as well as how we evaluate our model.
We also upload the zip ﬁle of our code with the submission.
We will open-source our code once accepted.
Appendix A P ROOFS
Proposition A.1 (Proposition 3.1 Restated) .
Given the problem deﬁned in subsection 3.1, f D S c is a minimizer of equation 1.
Moreover, if c ≥ c (cid:48) ≥ 0 , then the relative domain transfer loss (cid:96) D T ( f D S c ) − (cid:96) D S
( f D S c ) ≥ (cid:96) D T ( f D S c (cid:48) ) − (cid:96) D S ( f D S c (cid:48) ) .
Proof.
Recall that (cid:96) D S ( f )
= (cid:107) f
− y S
(cid:107) D , (cid:96) D T ( f ) =
(cid:107) f − y T (cid:107) D and f D S c := y S min { 1 , c (cid:107) y S (cid:107) D } .
First, let’s verify that f D S c ∈ arg min f ∈F (cid:96) D S ( f ) , s.t.
(cid:107) f (cid:107) D ≤ c.
If c ≥ (cid:107) y S (cid:107) D , then f D S c := y S achieves the minimum.
If c < (cid:107) y S (cid:107) D , then for any f ∈ F : (cid:107) f (cid:107) D ≤ c , we have
[Equation]
c
[Equation]
− c (cid:107)
[Equation] [Equation]
S c ) .
Therefore, f D S c indeed achieves the minimum.
Now, let’s prove the proposition.
For any c ≥ (cid:107) y S (cid:107) D , we have (cid:96) D S ( f D S c )
=
and (cid:96) D T ( f D S c ) is a constant.
Therefore, there is no difference for all c ≥ (cid:107) y S (cid:107) D , and the proposition holds for c ≥ c (cid:48) ≥ (cid:107) y S (cid:107) D .
Then, We only need to verify the case for (cid:107) y S (cid:107) ≥ c ≥ c (cid:48) :
[Equation]
Rearranging the above inequality gives the proposition.
Proposition A.2 (Proposition 3.2 Restated) .
d G , F
[Equation]
: P
[Equation]
→ R + satisﬁes the following three properties.
(Symmetry)
(Triangle Inequality)
For ∀D
(Weak Zero Property) For ∀D ∈ P
X×Y : d G , F ( D , D ) = 0 .
Proof.
Recall that
[Equation]
We can see that the symmetry and weak zero property are obvious.
For triangle inequality, given ∀D (cid:48)
∈ P X×Y :
[Equation]
Proposition A.3.
Denote the function class
[Equation]
where h g,f ( x, y ) :
= (cid:96) ( g ◦ f ( x ) , y ) .
Let d : X × Y → R + be a metric on X × Y , and assume ∀ h ∈
L G , F is L -Lipschitz continuous with respect to the metric d .
Then, we have
[Equation]
where W ( D S , D T ) is the Wasserstein distance:
[Equation]
Proof.
Recall that
[Equation]
By the deﬁnition of inf
[Equation]
for ∀ (cid:15) > 0 there exist g S,(cid:15) , g T,(cid:15) ∈ G such that
[Equation]
By the deﬁnition of sup
[Equation]
there exists f (cid:15) ∈ F such that
[Equation]
Let’s ﬁrst consider the ﬁrst term in the max {· , ·} above
[Equation]
where the inequality is due to that both 1 L (cid:96) ( g S,(cid:15) ◦ f (cid:15) ( x ) , y ) and 1 L (cid:96) ( g T,(cid:15) ◦ f (cid:15) ( x ) , y ) are 1-Lipschitz w.r.t.
( x, y ) and the metric d .
Similarly, we also have
[Equation]
Therefore, equation 2 implies
[Equation]
Letting (cid:15) → 0 completes the proof.
Proposition A.4.
Consider multi-class classiﬁcation where Y =
[ k ] for some k ≥ 2 .
Deﬁne the loss function (cid:96) as
[Equation]
Let δ TV ( D S , D T ) denote the total variation distance.
Then we have
[Equation]
Proof.
Fix f ∈ F .
By the deﬁnition of inf, there exists g T,(cid:15) such that
[Equation]
Let A be the event
such that A = { ( x
[Equation]
y ) : arg max j ∈ [ k ] ( g T,(cid:15) ◦ f ( x ))
j (cid:54) = y } .
Then we can write equation 3 as
[Equation]
Noting that f ∈ F was arbitrary, apply sup to both sides gives us the desired inequality.
Theorem 3.1 can be proved easily by deﬁnition.
Theorem A.1 (Theorem 3.1 Restated) .
Given a training algorithm A , for ∀D S , D T ∈ P X×Y we have
[Equation]
or equivalently ,
[Equation]
Proof.
By deﬁnition,
[Equation]
To prove Theorem 3. [Equation] we ﬁrst prove the following interesting lemma.
Lemma A.1.
Let S d − 1 r [Equation]
[Equation]
d | [Equation] y
[Equation] 2 = r } denotes the ( d − 1) -dimensional sphere in R d with radius r > 0 .
If a function h : S d [Equation] 1 r [Equation]
[Equation]
then we have
[Equation]
i.e., (cid:126) 0 is in the convex hull of { h ( y ) |
y ∈ S
d − 1 r } .
Proof.
We assume that (cid:126) 0 / ∈ conv( h ( S d − 1 r )) and prove by contradiction.
Since (cid:126) 0 / ∈ conv( h ( S d − 1 r )) , we can ﬁnd a hyperplane that separates (cid:126) 0 and the convex set conv( h ( S d − 1 r )) .
By the separating hyperplane theorem there exists a nonzero vector v ∈ R d and c ≥ 0 such that
[Equation]
We choose y =
r v / (cid:107) v (cid:107) 2 and observe that h ( y ) ∈ conv( h ( S d − 1 r )) .
Hence, by equation 5 we have
[Equation]
, y [Equation] ≥ 0 , which contradicts to the condition of equation 4.
Therefore, it must be that (cid:126) 0 ∈ conv( h ( S d − 1 r )) .
Theorem A.2 (Theorem 3.2 Restated) .
Given any source distribution D S ∈ P X× R d , any ﬁne-tuning function class G where G includes the zero function, and any training algorithm A , denote [Equation]
[Equation]
We assume some properties of the sample individual loss function (cid:96) : R d × R d → R + : it is differentiable and strictly convex w.r.t.
its ﬁrst argument; (cid:96) ( y, y ) = 0 for any y ∈ R d ; and lim r [Equation] 0 , y )
= ∞ .
Then, for any distribution D X on X , there exist some distributions D T ∈ P X×Y with its marginal on X being D X such that
[Equation]
Proof.
The τ ( A ; D S , D T ) ≤ d F A ( D S , D T ) is proved by Theorem 3.1, we only need to prove that there exists some D T ∈ P X×Y with its marginal on X being D X such that
[Equation]
We begin by observing that lim r
[Equation]
0 , y ) = ∞ , and thus there exists r > 0 such that
[Equation]
where S d − 1 r :
= { y ∈ R
d | (cid:107) y
(cid:107) 2 = r } denotes the ( d − 1)
-dimensional sphere with radius r .
Note the we abuse the notion a bit to let (cid:126) 0 also denotes the zero function (i.e., maps all input to zero).
Now, let us deﬁne at the following set
[Equation]
where ∇ 1 is taking the gradient w.r.t.
the ﬁrst argument of (cid:96) ( · , · ) .
By the strict convexity of (cid:96) ( · , y ) , we have
[Equation]
Noting that (cid:96) ( y, y )
=
is the unique minimum of (cid:96) ( · , y ) , we have (cid:96) ( (cid:126) 0 , y ) > 0 .
Accordingly, ∀ y ∈ S
d − 1 r : 0 > − (cid:96) ( (cid:126) 0 , y ) > (cid:104)∇
[Equation]
(cid:96) ( (cid:126) 0 , y ) , y (cid:105) .
Having the above property, and noting that ∇ 1 (cid:96) ( (cid:126) 0 , · ) : S d − 1 r → R d , we can invoke Lemma A.1 to see that
[Equation]
Therefore, there exists n points { y i } ni =1 ⊂ S d − 1 r such that
[Equation]
where c i > 0 and (cid:80) ni =1 c i = 1 .
Therefore, we can deﬁne the target distribution D T as the following.
Given any x ∼ D X , the distribution of y conditioned on x is: y = y
i with probability
c i .
Now we verify the distribution D T indeed makes the bound (cid:15) -tight.
Denote a strictly convex function h : R d → R + as the following
[Equation]
Since h is strictly convex and ∇ h ( (cid:126) 0)
= (cid:126)
(equation 7), we can see that h ( (cid:126) 0) achieves the unique global minimum of h on R d .
Therefore, given the D T , for any ∀ f ∈ F A we have
[Equation]
G contains the zero function
[Equation]
Recall that d F A ( D S , D T ) =
sup f ∈F A | inf [Equation] ∈G
[Equation]
D T ( g ◦ f ) − inf g ∈G
[Equation]
D S ( g ◦ f ) | , we can see that
[Equation]
| (9) By equation 6, for ∀ f ∈ F A , we have n
[Equation]
Hence, we can continue as
[Equation]
Therefore, it holds that d F A ( D S , D T ) ≤ τ ( A ; D S , D T ) + (cid:15) , and thus the theorem.
Lemma A.2 (Lemma 3.1 Restated) .
Assuming the individual loss function (cid:96) :
Y ×Y → [0 , c ] , given any distribution D ∈ P X×Y and ∀ δ > 0 , with probability ≥ 1 − δ we have
[Equation]
Proof.
Given any δ > 0 , f ∈ F , g ∈ G , D ∈ P X×Y , and taking any h g,f ∈ L G , F (Deﬁnition 3), with probability ≥ 1 − δ we have
[Equation]
where the inequality is by the well-known Rademacher complexity uniform bound
[Equation]
Similarly,
[Equation]
The probability that both events equation 10 and equation 11 happen can be upper bounded by union bound,
i
[Equation]
e.,
[Equation]
Therefore, combining the above with probability ≥ 1 − δ we have
[Equation]
With equation [Equation] we can prove the lemma as the following.
Given ∀ (cid:15) > 0 , by the deﬁnition of inﬁmum there exists a g (cid:15) ∈
G such that
[Equation]
By equation [Equation] with probability ≥ 1 − δ we have
[Equation]
Moreover, by deﬁnition
[Equation]
Combining the above three inequalities we have
[Equation]
Letting (cid:15) → 0 , we can see that
[Equation]
Similarly, we can derive the above inequality again but with D and (cid:98) D n switched.
Therefore,
[Equation]
Since the above inequality holds for ∀ f ∈ F , taking the supremum over f ∈ F gives the lemma.
Lemma A.3.
Assuming the individual loss function (cid:96) :
Y × Y → [0 , c ] , given any distributions
D S , D T ∈ P X×Y and ∀ δ > 0 , with probability ≥ 1 − δ we have
[Equation]
Proof.
By Proposition 3.
[Equation]
we apply the triangle inequality to derive
[Equation]
By Lemma 3.1, we can apply the union bound argument (e
[Equation]
g., see the proof of Lemma 3.1) to bound d F A ( (cid:98) D
nT , D T ) and d F A ( (cid:98) D nS , D S ) .
That being said, ∀ δ (cid:48) > 0 with probability ≥ 1 − 2 δ (cid:48)
we have
[Equation]
Therefore,
[Equation]
Denoting δ = 2 δ (cid:48) gives the lemma.
Theorem A.3 (Theorem 3.3 Restated) .
Given ∀D S , D T ∈ P X×Y , for ∀ δ > 0 with probability ≥ 1 − δ we have
[Equation]
Proof.
For ∀ δ > 0 , from the proof of Lemma A.3 we can see that with probability ≥ 1 − δ :
[Equation]
and Lemma A.3 holds.
Therefore
[Equation]
where the ﬁrst inequality is by deﬁnition of inﬁmum, the second inequality is by the Deﬁnition 2, the third inequality is by equation 13 and the last inequality is by Lemma A.3.
B D ATA AUGMENTATION (DA) AS R EGULARIZATION
In this section, we discuss data augmentation (DA) as a concrete example of regularization for training feature extractor f D S A , and explore its impact on the function class F A discussed in Section 3.
Empirical research has shown evidence of the regularization effect of DA (Hern ´ andez-Garc ´ ıa &
K ¨ onig, 2018a;b).
However, there is a lack of theoretical analysis, and thus we aim to construct a theoretical framework to understand under what sufﬁcient conditions DA can be viewed as regularization on the feature extractor function class F A .
We categorize DA into feature-level DA and data-level DA , and for each category, we analyze different DA algorithms to characterize the sufﬁcient conditions under which DA regularizes the function class F A .
Combined with analysis in
Theorem 3.3, we also provide concrete sufﬁcient conditions to tighten the upper bound of relative transferability τ ( A ; (cid:98) D n , D T ) .
General Settings.
For the following discussion we apply a general DA setting of afﬁne transformation (Perez & Wang, 2017), taking the form of x (cid:63)
= W (cid:62) (cid:63) x + b (cid:63) , where ( x, x (cid:63) ) is a pair of the original and augmented samples, ( W (cid:63) , b (cid:63) ) are parameters representing speciﬁc DA policies.
We set g : R d → R as the linear layer corresponding to the weight matrix W g , which will be composed with the feature extractor f : R m → R d .
We use squared loss for (cid:96) : R × R → R , and let (cid:96) (cid:98) D n ,A ( g ◦ f ) be the objective function given by training algorithm A from Theorem 3.3.
B. F EATURE - LEVEL DA ( A FL )
Feature-level DA (Wong et al., 2016; DeVries & Taylor, 2017) requires the transformation to be performed in the learned feature space, which gives us an augmented feature W (cid:63) f ( x ) + b (cid:63) .
We use Loss-Averaging algorithm where we take an average of the loss over augmented features for training.
Denote the training algorithm based on feature-level DA as A FL , the objective function is as below.
[Equation]
Theorem B.1.
Apply feature-level DA with afﬁne transformation parameters ( W (cid:63) , b [Equation]
) s. [Equation]
E W
[Equation]
[ W [Equation] ] = [Equation]
; 2) W [Equation] (cid:54)≡ I m (i.e., W (cid:63) is not an identity matrix); 3) E [Equation]
[ b [Equation] ] = (cid:126) 0 m ; 4) W (cid:63) and b (cid:63) are independent.
Set (cid:96) : R × R
→
R as squared loss; Deﬁne ∆ W (cid:63) :
= W (cid:63) − I m , then we have
[Equation]
=
[Equation]
where Ω
[Equation]
Proof
[Equation]
g ◦ f ( x i ))
= 2 for (cid:96) as squared loss.
Apply Taylor expansion to (cid:96) (cid:16) g ◦ (cid:0) W (cid:63) f
( x i ) + b (cid:63) (cid:1) , y i (cid:17) around f ( x i ) , all higher-than-two order terms will vanish:
[Equation]
[-(cid:126) 
-]
[Table]
Interpretation .
Ω A FL is composed of two segments: 1) l 2 regularization to an f -dependent scalar averaged over W (cid:63) and x i ; 2) l 2 regularization to an f -independent scalar averaged over b (cid:63) .
Due to the regularization effect on f from the ﬁrst segment of Ω A FL , we can reasonably expect the function class F A (cid:48) enabled by A FL to be a subset of that enabled by a general training algorithm A [Table]
Sufﬁcient conditions .
Combined with Theorem 3. [Table] the sufﬁcient conditions to tighten the upper bound
d F A ( (cid:98) D nS , (cid:98) D nT ) for the relative transferability τ ( A ; (cid:98) D S , D T ) are: feature-level DA ( A FL ) with parameters satisfying: 1) E W (cid:63) [ W (cid:63) ]
= I m ; 2) W (cid:63) (cid:54)≡ I m ; 3) E b (cid:63) [ b (cid:63) ]
= (cid:126) 0 m ; 4) W (cid:63) and b (cid:63) are independent.
B. D ATA - LEVEL DA ( A DL )
Data-level DA requires that the transformation to be performed in the input space to generate augmented samples W (cid:63) x + b (cid:63) .
We cover analysis on two ubiquitous algorithms for data-level DA training: Prediction-Averaging ( A DLP ) (Lyle et al., 2019) and Loss-Averaging ( A DLL )
(Wong et al., 2016).
The difference between A DLP and A DLL lies in whether we take the average of the prediction or the losses:
[Equation]
Theorem B.2.
Deﬁne the data-level deviation caused by data-level DA A DL ∈ { A DLP , A DLL } with parameters ( W (cid:63) , b (cid:63) ) from the original data sample as ∆ x i :=
( W (cid:63) − I m )
x i + b (cid:63) , and deﬁne ∆ 3 x :=
E x i ,W (cid:63) ,b (cid:63) (cid:104)(cid:13)(cid:13) ∆ x i (cid:13)(cid:13) 3 2 (cid:105) .
Suppose we apply data-level DA s.t. 1) E W (cid:63) [ W (cid:63) ]
= I m ; 2) E b (cid:63)
[ b (cid:63) ]
= (cid:126) 0 m ; 3)
O (∆ jx ) ≈ 0 , ∀ j ∈ N + , j ≥ 3 ; 4) W (cid:63) and b (cid:63) are independent.
Deﬁne ∆ W (cid:63) :
= W (cid:63) − I m ∈ R m × m , ∆ (cid:98) y
i := W (cid:62) g f
( x i ) − y i ∈ R .
Let W ( k ) g ∈ R be the k th dimension component of W g and then deﬁne w i, ( k ) :
= W ( k ) g ∆ (cid:98)
y i ∈ R ; Denote the Hessian matrix of the k th dimension component in f ( x i ) as
H ( k ) ,i f ; Let ∇ f be the Jacobian matrix of f , then we have
[Equation]
, where Ω
[Equation]
Proof.
Let ∆ f i ,A DLP :=
E W [Equation] b
[Equation]
i + [Equation] ) − f ( x i ) [Equation]
then [Equation]
(15) where [ · ( k ) ]
d denotes a d-dimensional vector and k denotes the k th dimension element.
Since (cid:96) is squared loss, the third-and-higher derivative are 0, therefore, the third-and-higher order terms in
Taylor expansion to (cid:96) (cid:0) E W (cid:63) ,b (cid:63) (cid:2)
g ◦ f ( W (cid:63) x
i + b (cid:63) ) (cid:3) , y i (cid:1) around f ( x i ) will vanish:
[Equation]
Substitute Eq.
(15) into the ﬁrst-order term in Eq. (16), we have [Equation]
Substitute Eq.
(17) into Eq. (16), we have [Equation] (cid:0) E W (cid:63)
[Equation]
b (cid:63) (cid:2) g ◦ f ( W (cid:63) [Equation] b
[Equation]
) (cid:3) [Equation] y i (cid:1) = (cid:96) (cid:0) g ◦ f
[Equation]
x
[Equation] [Equation] y i [Equation]
+
[Equation]
(cid:107) 32 ) .
[Equation]
Substitute Eq.
(18) into Eq.
(14) which is the deﬁnition of (cid:96) (cid:98) D n ,A DL P ( g ◦ f ) , and recall that ∆ 3 x :=
E x i ,W (cid:63) ,b (cid:63) (cid:104)(cid:13)(cid:13) ∆ x i (cid:13)(cid:13) 3 2 (cid:105) , we have
[Equation]
Let ∆ f i , [Equation]
=
[Equation]
∆
[Equation]
[Equation]
Applying Taylor expansion to E W (cid:63) ,b (cid:63) (cid:2) (cid:96) (cid:0)
g ◦ f ( W (cid:63) x
i + b
[Equation]
) , y i (cid:1)(cid:3) around f ( x i ) will give us
[Equation]
Since E W (cid:63) ,b (cid:63) ∆ f i ,A DLL = ∆ f i ,A DLP , the ﬁrst-order term in Eq.
(20) is exactly Eq.
[Equation]
The second-order term in Eq.
(20) is
[Equation]
Substituting Eq.
(21) and Eq. (22) into Eq. (20), we have [Equation]
[Equation]
Substitute Eq.
(23) into the deﬁnition of (cid:96) (cid:98) D n ,A DLL ( g ◦ f ) , then (cid:96)
[Equation]
g
[Equation]
=
[Equation] The proof is complete by Eq. (19) and Eq. Interpretation .
Ω A DL P and Ω A DL L turn out to be: 1) Ω A DL P is a weighted trace expectation dependent on the Hessian matrix of f ; 2) Ω A DLL is equivalent to Ω A DLP together with the summation of two norm expectations dependent on ∇ f .
Therefore, the data-level DA algorithms A DLP and A DLL are expected to regularize f so that the f function class F DLA enabled by A DL ∈ { A DLP , A DLL } would be reasonably expected as a subset of F A enabled by general training algorithm A .
Sufﬁcient conditions .
Combined with Theorem 3.3, the sufﬁcient conditions indicated here to tighten the upper bound
d F A ( (cid:98) D nS , (cid:98) D nT ) of the relative transferability τ ( A ; (cid:98) D S , D T ) are: datalevel DA ( A DL ) with DA parameters satisfying that 1) E W (cid:63) [ W (cid:63) ]
= I m ; 2) E b (cid:63)
[ b (cid:63) ]
= (cid:126) 0 m ; 3)
O (∆ jx ) ≈ 0 , ∀ j ∈ N + , j ≥ 3 ; 4) W (cid:63) and b (cid:63) are independent.
Empirical veriﬁcation .
We further provide empirical veriﬁcation in Section 4 for the sufﬁcient conditions above, investigating the concrete cases of DA methods: 1) Gaussian noise satisﬁes the sufﬁcient conditions, then we empirically show that Gaussian noise improves domain transferability while robustness decreases a bit (Figure 5); 2) Rotation , which rotates input image with a predeﬁned ﬁxed angle with predeﬁned ﬁxed probability, violates E W (cid:63) [ W (cid:63) ]
= I m , and we empirically show that rotation barely affect domain transferability (Figure 14 in Appendix D.3); Translation , which moves the input image for a predeﬁned distance along a pre-selected axis with ﬁxed probability, violates
E b (cid:63) [ b (cid:63) ]
{+= (cid:126) 
+}
m (Figure 14 in Appendix D.3).
Corollary B.2.1.
If the neural network in Theorem B.2 is activated by Relu or Max-pooling, then
Theorem B.2 becomes
[Equation]
where Ω A DLP = 0 ; Ω A DLL =
[Equation]
Proof.
Denote an L − layer NN g ◦ f ( x ) :
= W (cid:62) g · z [ L − 1] , where z [ l ] :=
σ [ l − 1] ( W (cid:62) [ l − 1] · z [ l − 1] ) , l = 1 , 2 , 3 , ..., L − 1 ; Deﬁne that σ [0] ( W (cid:62) [0] · z [0] ) :
{+= x , then ∇ 2 (cid:0) g ◦ f ( x ) (cid:1) = 
+}
(B.2 of Zhang et al.
Since ∇ 2 (cid:0) g ◦ f ( x ) (cid:1) =
W (cid:62) g · ∇ 2 f ( x ) , we have ∇ 2 f ( x ) = 0 .
Combine this with Theorem B.2, we have
[Equation]
[Table]
Remark.
Corollary B.2.1 analyzes special cases (Relu/ Max-pooling activation) of Theorem B.2, giving notably different regularization effect: in these cases the A DLP (average the prediction) fails as a regularizer, therefore, doesn’t fulﬁll our sufﬁcient conditions for improving domain transferability (Theorem 3.3); A DLL (average the loss) only reserves the regularization on ∇ f -dependent norms, but no longer regularizes H f ( x ) .
Since A DLL still induces regularization, the induced sufﬁcient conditions analyzed after Theorem B.2 for promoting domain transferability won’t be affected.
C A DVERSARIAL T RAINING AS A R EGULARIZER
In this section, we show, under certain conditions, why adversarial training may improve domain generalization by viewing adversarial training as a function class regularizer.
We ﬁrst provide some notation.
Let
[Equation]
where φ j are activations, W j , b
j are weight matrix and bias vector, θ is the collection of parameters (i.e. θ =
( W 1 , b 1 , . . .
, W L , b L ) .
For the rest of the article, assume that φ j are just ReLUs.
Now ﬁx x ∈ X .
Deﬁne the preactivation as
[Equation]
Deﬁne the activation pattern φ x :=
( φ 1 x , . .
. , φ L − 1 x ) ∈ { 0 , 1 } m such that for each j ∈ [ L − 1]
[Equation]
where 1 is applied elementwise.
Now, given an activation pattern φ ∈ { 0 , 1 } m , we deﬁne the preimage X ( φ ) :
= { x ∈ R d : φ x = φ }
Theorem C.1.
(In the proof of theorem 1 in (Roth et al., 2020))
Let (cid:15) > 0 s.t. B p(cid:15) ( x )
⊂ X
( φ x ) where B p(cid:15) ( x ) denotes the l p ball centered at x with radius (cid:15) .
Let p = { 1 , 2 , ∞} and q be the Holder conjugate of p (i.e. 1 p + 1 q = 1 ).
Then
E ( x,y ) ∼ P [ l ( y, f ( x )) + λ
[Equation]
x
[Equation]
Interpretation: This theorem provides an equivalence between the objective functions for adversarial training (left term) and jacobian regularization (right term).
We give some intuition on the size of (cid:15) .
Let us ﬁrst consider a shallow 2 layer network f ( x )
=
W 2 φ ( W 1 x + b 1 ) .
Suppose W 2 ∈ R m 2 × mand W 1 ∈
R
m 1 × d .
Given a matrix M, let M j denote the j th row of M .
We study the activation pattern φ x which equals
[Equation]
We wish to compute the largest radius (cid:15) such that the activation pattern φ x is constant within B 2 (cid:15) ( x ) .
This is simply the distance from x to the closest hyperplane of the form H W 1 j ,b 1 j = { x ∈ R d :
W 1 j x + b 1 j = 0 } where j = 0 , . . .
, m 1 (i.e. (cid:15) =
min j dist ( x, H W 1 j ,b 1 j ) ).
In particular, if W 1 = I d × d and b 1 = 0 , (cid:15) =
min j ∈ d | x j | .
Furthermore, we note that (cid:15) is nondecreasing as a function of the number of layers.
However, it has been observed empirically in (Roth et al., 2020) that approximate correspondence holds in a much larger ball.
Deﬁnition 4.
(source and target function class) Let G S , G T be ﬁne tuning function classes for source and target domains, respectively.
We deﬁne the class of source models as
[Equation]
and the class of target models as
[Equation]
Deﬁnition 5.
(empirical training objective with jacobian regularization) Let λ, (cid:15) > 0 .
Take any hypothesis h θ = g S ◦ f θ ∈ H S .
Let ˆ R ( h θ ) = 1 n (cid:80) ni
=1 (cid:96) ( h θ ( x i ) , y i ) denote the empirical risk where l (ˆ y, y )
= (cid:107)
ˆ y − y (cid:107) 2 .
We deﬁne the empirical training objective with jacobian regularization as
[Equation]
Theorem C.2.
Fix regularization strength λ > 0 .
Deﬁne
[Equation]
where 0 denotes the zero function (i.e. the class of feature extractors that outperform the zero function).
Suppose ( x, y ) ∈
X × Y is bounded such that max ( (cid:107) x (cid:107) ∞ , (cid:107) y (cid:107) 2 ) ≤ R .
Fix δ > 0 .
Suppose we additionally restrict our ﬁne tuning class models to linear models where
[Equation]
(where W j is the jth column of W ) and
[Equation]
(Here we are abusing notation to let g S ∈ G S to denote the last linear layer as well as the ﬁne tuning function).
Then for 0 ≤ λ 1 < λ
[Equation]
(where (cid:40) denotes proper subset).
In particular, if H A,Tλ = G T ◦ F Aλ , we have
[Equation]
Interpretation:
At the high level, this theorem captures the idea that minimizing the empirical risk with jacobian regularization puts a constraint on the set of feature extractors.
In particular, F Aλ 1 represents the potential class of feature extractors we select after training with jacobian regularization.
Therefore, the class of ﬁne tuned models H A,Tλ 1 with feature extractors trained with jacobian regularization for the target domain is smaller than the class of ﬁne tuned models H with feature extractors trained without any regularization.
Furthermore, we show that the space of feature extractors shrinks as we increase the regularization stength λ .
Since we showed in section 3.3 that smaller function classes have smaller d F A , this theorem shows that jacobian regularization reduces d F A .
To connect back to adversarial training, if (cid:15) satisﬁes the hypothesis in theorem C. 1 , we have that
[Equation]
Therefore, minimizing the training objective with jacobian regularization is equivalent to minimizing the adversarial training objective.
Using this connection, this theorem essentially shows that, given sufﬁcient number of samples, adversarial training reduces the class of feature extractors which in turn reduces d F A .
Finally, we comment on the assumption that (cid:13)(cid:13) g S (cid:13)(cid:13) > δ .
Since δ > 0 is arbitrary, we can make it as small as we like and thus we are essentially excluding the 0 last layer which is hardly a constraint on the function class.
This assumption is necessary as we are considering regularization on the whole model g ◦ f as opposed to regularization on just the feature extractor.
Thus, this assumption prevents the scenario where only the last linear layer is regularized.
Proof.
We ﬁrst show that if 0 ≤ λ 1 < λ 2 , we have that
[Equation]
We ﬁrst prove the following lemma
Lemma C.1.
Suppose the conditions of theorem C. 2 are satisﬁed.
Suppose additionally we have that y :
= 1 n (cid:80) di
{+=
+}
{+y i (cid:54) = 
+}
(note this occurs with probability 1 if marginal distribution over Y is continuous).
Then for every λ ≥ 0 , there exists a function f θ ∈ F Aλ and a ﬁne tuning layer g ∗ ∈ G S such that
[Equation]
Choose another λ (cid:48) ≥ 0 (can equal λ ).
Then there exists a g ∗(cid:48)
∈
G S be the ﬁne tuning layer such that inf g ∈G S
Obj Aλ (cid:48)
( g ◦ f θ ) =
Obj Aλ (cid:48) ( g ∗(cid:48) ◦ f θ ) and
[Equation]
Proof.
Fix α ≥ 0 and c > α · R .
Set biases b 1 =  
c . ..
 
b j = 0 , j ≥and weights
W 1 =   α . . .
 
W j =    . . .
  , j ≥
Deﬁne x i,j be the j th entry of the data point x i .
Deﬁne α
i := α · x i,α := 1 n d (cid:88) i
= α
i y : = 1 n d (cid:88) i = y i
Now we observe that for a ﬁxed λ ≥ 0 and any g ∈ G S , we have that
[Table]
[Equation]
Therefore,
[Equation]
is equivalent to solving
[Equation]
Utilizing lagrange multipliers, we ﬁnd the minimizer is
[Equation]
when c ≥ (cid:107) y
(cid:107) 2 δ .
Now consider the function
[Equation]
Note that this function is continuous with respect to the input ( c, α ) .
Now ﬁx α = 0 , c
= (cid:107) y (cid:107) 2 δ .
Set w =
δ · y (cid:107) y (cid:107) .
Then we have that [Equation] The inequality comes from the fact that we assumed y (cid:54) = 0 and noting that y is the minimizer of the function p ( z ) = 1 n (cid:107)
z − y i (cid:107) 22 . Continuity of S ensures that there exists α 0 > 0 such that [Equation] Aλ
[Equation]
Now consider U ( t ) = S ((1 + t ) (cid:107) y (cid:107) 2 δ , (1 + t ) α 0 ) for t ≥ 0 . Note that U is continuous with respect to t .
Furthermore, we note that t → ∞ implies U ( t ) → ∞ which implies there exists some time t = T f such that U ( T f ) > Obj Aλ ( 0 ) . Therefore, by the intermediate value theorem, there exists a time t =
T such that U ( T ) = Obj Aλ ( 0 ) . Finally, set c =
( T + 1) {+(cid:107) y (cid:107) 
 δ , α = ( T + 1) α 0 , and g ∗ as+} the matrix where g ∗ 1 = δ · y (cid:107) y (cid:107) and 0 for the other columns. By equation 25 and equation 26 we have
[Equation] Furthermore, if we choose another λ (cid:48) ≥ 0 , since c = ( T + 1) (cid:107) y (cid:107) 2 δ > (cid:107) y (cid:107) 2 δ by equation 26 , we have that
[Equation] and [Equation]
which is nonzero as δ > 0 and α = ( T + 1) α 0 > 0 . Clearly, we have F Aλ 2 ⊂ F Aλ 1 .
If we can show that f θ 1 (cid:54)∈ F Aλ 2 then we have F Aλ 2 (cid:40) F Aλ 1 . Using lemma C. 1 we can ﬁnd f θ 1 ∈ F Aλ 1 such that [Equation] In addition lemma C
[Equation] 1 guarantees minimizers g ∗ 1 and g ∗ 2 such that [Equation] Thus, we have that
[Equation] n (cid:88) i = (cid:13)(cid:13) [Equation]
x i
[Equation]
(cid:13)(cid:13)since λ 2 > λ≥ [Equation] n [Equation]
def of g ∗=
Obj Aλ [Equation] 0 ) lemma C. Thus f θ 1 (cid:54)∈ F Aλ 2 which implies F Aλ 2 (cid:40)
F Aλ 1 . It remains to show for λ 1 ≥ 0 , we have that F Aλ 1 (cid:40) F . Consider any g ∈ G S . For j ∈ [ L ] , deﬁne W j as the weight matrix where W j = I d × d (identity matrix) for j ∈
[ L − 1] and let the ﬁnal weight W L = B · I d × d for some constant B > 0 . Set the bias vectors b j = 0 for j ≥ 2 . Let the ﬁrst bias equal b 1 = R · 1 where 1 is the vector of all 1’s and R is the upper bound such that (cid:107) x (cid:107) ∞ ≤ R .
Set θ = ( W 1 , b 1 , . . . , W L , b L ) and let h θ =
g ◦ f θ We compute [Equation] ( x i + R 1 ) − y i (cid:107) 2 + B (cid:107) g (cid:107)≥n n (cid:88)
i = [-(cid:126) 
-](cid:107) B ( x i + R 1 ) − y i (cid:107) 2 + Bδ
We note that sending B → ∞ we get Obj Aλ 1 ( h θ ) → ∞ which implies that there exists a B = B (cid:48) such that Obj Aλ 1 ( h θ ) > Obj Aλ 1 ( 0 ) . Setting B = B (cid:48) implies f θ (cid:54)∈ F Aλ 1 .
D E XTRA E XPERIMENT R ESULTS D. A BSOLUTE T RANSFERABILITY
We show the results with absolute transferability in Figure 7,8,9 and 10 respectively
[Figure] [Figure] [Figure]
D. R ESULTS OF O THER M ODEL S TRUCTURES
To further validate our evaluation results [Figure] we evaluate the experiments on another model structure [Figure]
We use a simpler CNN model for CIFAR-10 to SVHN and a more complicated WideResNet-50 for
ImageNet to CIFAR-10.
The CNN model consists of four convolutional layer with 3 × 3 kernels and 32,32,64,64 channels respectively, followed by two hidden layer with size 256.
A 2 × 2 max pooling is calculated after the second and fourth layer.
Other settings are the same as in the main text.
Note that in some settings the new model cannot converge, and therefore we will omit the result.
In addition, Jacobian regularization cannot be applied on WideResNet-50 because of the large memory cost, so we do not include it in the ﬁgures.
The results are shown in Figure 11, 12 and 13. [Figure] [Figure]
D. D ATA A UGMENTATIONS THAT V IOLATE S UFFICIENT C ONDITION
We study rotation and translation, the two data augmentations that violate the sufﬁcient condition for regularization.
The result is shown in Figure 14.
We observe that these augmentations do not have an obvious impact on domain transferability. D. R OBUSTNESS E VALUATION WITH A UTO A TTACK
Besides PGD attack
[Figure]
we also evaluate the model robustness using the stronger AutoAttack. We use APGD-CE, APGD-T and FAB-T as the sub-attacks in AutoAttack with 100 steps. Since the accuracy will decrease after the stronger attack, we use a slightly smaller (cid:15) = 0 .
2 to better visualize the trend. The results are shown in Fig. We can observe that the trend is similar with what we observed before when we used the PGD attack - domain generalization is an effect of regularization and data augmentation, and it is sometimes negatively correlated with model robustness. Also,
[Figure] [Figure] [Figure]
augmentations like rotation and translation, which violates the sufﬁcient condition, do not improve the domain generalization.
[Figure]