DART: A Principled Approach to Adversarially Robust Unsupervised Domain Adaptation

Thank you for the comments and suggestions.

[W1]

“However, in my opinion, this ideal joint loss is a fixed value and cannot be optimized by minimizing its upper bound. The optimization of this term seems somewhat ridiculous.”

Thank you for the discussion. We’d like to point out that the ideal joint risk is not a fixed quantity; instead, it’s a function of the feature representations (that we are learning), so controlling it makes sense. This is not a claim that we are making in this paper, but a mathematical fact, which is clearly stated in the seminal work [1]. To simplify the discussion, we will first discuss why this holds using [1]’s notation and setup, and after that we will discuss why it holds in our setup (which is the same as [1] but with adversarial robustness).

In Ben-David et al. (2006) [1], the authors fix a feature representation function R, and consider a hypothesis class H that takes feature representations (based on R) as input–so the hypothesis class H is a function of R. The ideal joint risk is by definition a function of H (for a given/fixed R). Theorem 2 in [1] is stated for a fixed R and H, and motivated by the theorem, the authors in [1] and also in DANN’s paper [2] call for finding/learning an R that minimizes the upper bound in Theorem 2. Thus, every time the representation function R is changed (e.g., by a learning algorithm as in DANN), the hypothesis class H will change (because it is a function of R), and consequently the ideal joint loss will change (because it is a function of H). Now in [1] the authors chose to assume that the ideal joint loss is small for any “reasonable R”; quoting from the authors “we assume that $\lambda$ is small for reasonable R”. Of course there could be cases where the chosen R will lead to a large ideal joint loss, so controlling this loss will be important in such cases.

In our setup, the ideal joint loss is defined similarly to [1] with the exception that the target examples are transformed by an adversary (as described in eq (2) in our paper). Similar to [1], our ideal joint loss is a function of the feature representation. However, please note that we are using a different notation than [1]. In our notation H represents the hypothesis class of $h:= f \circ g$, i.e., H is the hypothesis class of the composition of the feature representation function g (called R in [1]) and the main classifier f. Formally, $f\in F, g\in G, H=\\{h:h=f \circ g, s.t. f\in F, g\in G\\}$. Thus, every time we change the feature representation g, the ideal joint loss is optimized over a subset of H, i.e, given the fixed g, we optimize h over $H(g)=\\{h:h=f \circ g, s.t. f\in F\\}$, and consequently the ideal joint loss will change. Thus, generally, the learning algorithm may encounter g’s that lead to a large ideal joint risk–by attempting to control this term (even loosely) we may be able to avoid such bad g’s.

In the revised version of the paper, we added a clarification on this point -- please see the end of Section 3 and in the paragraph “A practical bound” in Section 4.

[1] Ben-David, S., Blitzer, J., Crammer, K., & Pereira, F. (2006). Analysis of representations for domain adaptation. Advances in neural information processing systems, 19.

[2] Ganin, Yaroslav, Evgeniya Ustinova, Hana Ajakan, Pascal Germain, Hugo Larochelle, François Laviolette, Mario Marchand, and Victor Lempitsky. "Domain-adversarial training of neural networks." The journal of machine learning research 17, no. 1 (2016): 2096-2030.

[W2] Please note that we are not claiming that we directly control the ideal joint risk in the practice and we agree that there’s a gap between the algorithm and theory; basically the algorithm “attempts” to control a proxy of the ideal joint loss (using pseudo labels). Whether this control is effective or not is ultimately decided by the empirical results, and our experiments show that controlling this proxy is helpful on many datasets–please see the ablation study in Table 2.

As a side note, all of the major practical works on UDA (e.g., DANN) are motivated by theory but also have a “gap” between theory in practice. E.g., in DANN, the theory calls for evaluating H-divergence which requires optimizing a 0/1 loss to global optimality–this is impossible in practice so DANN just uses a simple heuristic algorithm (SGD and logistic loss) to approximate H divergence. Moreover, in DANN the ideal joint risk (which is a function of the feature representation) is completely ignored–another gap from the theory.

However, we believe that such gaps (whether in our work or others such as DANN) should not be a reason for rejection, especially given the strong empirical results. Moreover, the theory in our case helped uncover key quantities that should be controlled in the adversarial robustness UDA setup–these quantities were not thoroughly studied in previous work on the same problem.

Thank you for the comments and suggestions.

[W1] Please note that we have tried two different network architectures, i.e., small CNN for DIGIT datasets, and ResNet50 for PACS, OfficeHome, and VisDA. These are the standard popular network architectures that have been used in the transfer learning literature [1,2,3,4]. The results are consistent across the two architectures.

[W2] We have included a variety of datasets (with experiments covering 46 source-target pairs), and all of these datasets are much larger and arguably more complex than Office31 (e.g., OfficeHome, PACS, VisDA). Having said that, we're currently running an additional experiment with Office31 and will report the results back if the experiment finishes before the rebuttal deadline.

[W3] For the chosen models and datasets, we think that eps=2/255 is reasonable choice for a few reasons:

• eps=2/255 significantly degrades the performance of natural DANN (without any defense mechanism), e.g., the robust accuracy is lower than 2% for OfficeHome and VisDA. So this eps is non-trivial and is reasonable to use (from an attacker’s perspective) because it leads to a relatively low image distortion while significantly fooling the model.
• In figure 1, we present the results for models trained with eps=2/255 but tested with a different eps varying between 1/255 and 64/255. The results indicate that DART consistently outperforms other algorithms across the whole range of testing epsilons.
• Also please note that larger epsilons may generally require more iterations for the attack to converge (whether during training or inference), assuming a fixed learning rate for the attack. Since we’re carrying out large-scale experiments (training more than 29700 models), this can significantly increase the compute time.

As a side note, there are many works in the literature where a similar epsilon is used, e.g., [1,2,3] also trained or evaluated with 2/255 l_infty perturbation size.

With that said, based on your suggestion, we have started running a set of experiments with epsilon=8/255 and will report the result once it’s finished.

[1] Gulrajani, Ishaan, and David Lopez-Paz. "In search of lost domain generalization." The Ninth International Conference on Learning Representations (2020).

[2] Ye, Haotian, et al. "Towards a theoretical framework of out-of-distribution generalization." Advances in Neural Information Processing Systems 34 (2021).

[3] Rame, Alexandre, et al. "Diverse weight averaging for out-of-distribution generalization." Advances in Neural Information Processing Systems 35 (2022).

[4] Chu, Xu, et al. "DNA: Domain generalization with diversified neural averaging." International Conference on Machine Learning. PMLR, 2022.

[5] Balunovic, Mislav, and Martin Vechev. "Adversarial training and provable defenses: Bridging the gap." International Conference on Learning Representations. 2019.

[6] Sehwag, Vikash, et al. "Hydra: Pruning adversarially robust neural networks." Advances in Neural Information Processing Systems 33 (2020).

[7] Tao, Lue, et al. "Can Adversarial Training Be Manipulated By Non-Robust Features?." Advances in Neural Information Processing Systems 35 (2022).

Thank you for the comments and suggestions.

[W1]

“The theoretical results lack novelty. It seems that Theory 3.1 is similar to the bound in [1]. The authors only need to replace the standard loss function with the adversarial loss function.”

Our result is inspired by [1] but does not directly follow from [1]. The proof of Theorem 2 in [1] does not follow if we replace the standard loss with adversarial loss. Specifically, the proof technique in [1] is not sufficient to obtain a generalization bound (from sample to population) for the adversarial version of H divergence. To deal with this, we had to carefully decompose the adversarial version of H divergence (among other terms in the objective).

[W2] Regarding perturbation size. For the chosen models and datasets, we think that eps=2/255 is reasonable choice for a few reasons:

• eps=2/255 significantly degrades the performance of natural DANN (without any defense mechanism), e.g., the robust accuracy is lower than 2% for OfficeHome and VisDA. So this eps is non-trivial and is reasonable to use (from an attacker’s perspective) because it leads to a relatively low image distortion while significantly fooling the model.
• In figure 1, we present the results for models trained with eps=2/255 but tested with a different eps varying between 1/255 and 64/255. The results indicate that DART consistently outperforms other algorithms across the whole range of testing epsilons.
• Also please note that larger epsilons may generally require more iterations for the attack to converge (whether during training or inference), assuming a fixed learning rate for the attack. Since we’re carrying out large-scale experiments (training more than 29700 models), this can significantly increase the compute time.

As a side note, there are many works in the literature where a similar epsilon is used, e.g., [1,2,3] also trained or evaluated with 2/255 $l_\infty$ perturbation size.

With that said, based on your suggestion, we have started running a set of experiments with epsilon=8/255 and will report the result once it’s finished.

[Q] AT (tgt,cg) is defined as applying adversarial training on the target examples with pseudo-labels, where the pseudo-labels are generated using exactly the same algorithm we use in DART (as described in Section 4 paragraph Pseudo-Labels $\hat Y_T$). Essentially, AT(tgt, cg) only considers the third term in our optimization formulation (equation 6). We hypothesize that DART outperforms AT(tgt,cg) because DART leverages additional terms (adversarial H-divergence and source loss).

[1] Balunovic, Mislav, and Martin Vechev. "Adversarial training and provable defenses: Bridging the gap." International Conference on Learning Representations. 2019.

[2] Sehwag, Vikash, et al. "Hydra: Pruning adversarially robust neural networks." Advances in Neural Information Processing Systems 33 (2020).

[3] Tao, Lue, et al. "Can Adversarial Training Be Manipulated By Non-Robust Features?." Advances in Neural Information Processing Systems 35 (2022).

We conducted additional experiments with epsilon=8/255 on four DIGIT source-target pairs (fixing one source and trying all possible targets), comparing DART with some of the most competitive methods. The algorithms were trained and evaluated using the same epsilon. The results, as shown in the tables below, indicate that DART outperforms other methods on average. These findings are consistent with the previous results in the paper. We will provide the full results in the final version. Thanks again for this suggestion.

Table: Standard accuracy (nat acc) / Robust accuracy under PGD attack (pgd acc) of target test data on DIGIT dataset with a fix source domain SVHN and different target domains.

Here we provide more results with epsilon=8/255 on three PACS source-target pairs (fixing one source and trying all possible targets). The results, as shown in the tables below, indicate that DART outperforms other methods on average in terms of robust accuracy. These findings are consistent with the previous results in the paper.

Table: Standard accuracy (nat acc) / Robust accuracy under PGD attack (pgd acc) of target test data on PACS dataset with a fix source domain Photo and different target domains.

[W1] Thank you for pointing out this typo in the proof. We believe that this is a simple typo: basically all $(\tilde x,y)$ should be $(x,y)$ starting from the second equation. We fixed this in the revised paper. To clarify, starting the second equation, we consider $(x,y)\sim \tilde D_T$, where $\tilde D_T$ is the worst case (adversarial) target distribution, and all the equation only works on $(x,y)$ instead of $(\tilde x,y)$. The proof follows automatically.

[W2] Regarding the comment on DomainRobust, we would like to emphasize that the contribution of DomainRobust extends beyond the mere addition of an adversarial component to DomainBed. We did a major redesign of DomainBed that required rewriting the algorithm code and major parts of eval from scratch. We added ~6000 lines of new code on top of DomainBed. We clarify our contributions in more detail below:

1. Transfer learning setting: DomainBed focuses on domain generalization (DG) and lacks implementation for the Unsupervised Domain Adaptation (UDA). Since we’re focusing on a UDA setting, we had to make major changes to the whole ML pipeline in DomainBed: data splits and preprocessing, algorithms, hyperparam tuning (because it’s different between DG and UDA) and eval.
2. Algorithms: DomainRobust implements 7 meta algorithms (11 variants) from scratch–these include adversarial training, TRADES, ARTUDA, SroUDA, and our proposed DART. These algorithms have important differences when it comes to the specifics of adversarial training, so we had to write a separate adversarial training code for each of the algorithms.

Please let us know if you have more questions or concerns.