Rethinking Invariance Regularization in Adversarial Training to Improve Robustness-Accuracy Trade-off

We sincerely appreciate your recognition that (1) this work is well-written and easy to understand, and (2) the perspective on gradient conflict is particularly interesting, as it connects previously disparate threads in adversarial robustness research.

Below, we address the concerns one by one.

---

[W1: Deeper theoretical examination on gradient conflicts]

We appreciate the reviewer’s comment and will carefully address the points raised.

[Clarification on the definition of "gradient conflict"]

As noted, there are two distinct types of "conflicts" in optimization:

• (1) Gradient conflicts between multiple objectives (i.e., $\nabla_{\theta} L1 \cdot \nabla_{\theta} L2$ < 0), which arise when simultaneously optimizing multiple objectives. This is the focus of our work. We have clarified this in Sec. 3.1.
• (2) Conflicts across mini-batches (i.e., $\nabla_{\theta} L_t \cdot \nabla_{\theta} L_{t+1} < 0$), which result from inconsistent gradients between consecutive mini-batches. This is beyond the scope of our work.

While both can cause oscillations and hinder convergence, they require different solutions. For (2), design choices like batch size, momentum in the optimizer, and learning rate scheduling can help mitigate batch-wise conflicts. In contrast, addressing (1) involves specific adjustments in the multi-objective optimization, such as altering loss functions, which is the focus of our approach.

[Clarification on our claims and justifications regarding gradient conflict]

The paper doesn't provide sufficient theoretical justification for why resolving gradient conflicts specifically improves adversarial robustness.

Sorry for any confusion. To clarify, we did not intend to suggest that resolving gradient conflict directly improves robustness. Our argument is that resolving gradient conflict improves the robustness-accuracy trade-off in adversarial training with invariance regularization, mainly by enhancing model accuracy without compromising robustness. This is demonstrated in Table 1.

Below, we summarize how we verified our claims for easier understanding:

• Known fact: Resolving gradient conflict generally leads to better multi-loss optimization. This is supported by prior works in multi-task learning and domain generalization (please refer to Section 3.1).
• Claim 1: Gradient conflict exists in adversarial training with invariance regularization.
  • Justification: Empirical evidence provided in Figure 2.
• Claim 2: In the naive invariance loss, $Dist(z', z) = (Dist(z', sg(z)) + Dist(sg(z'), z)) / 2$, the second term $Dist(sg(z'), z)$ causes gradient conflict. Using stop-grad (only minimizing $Dist(z', sg(z))$) resolves this conflict.
  • Justification: Empirical evidence in Figure 2 shows that the term $Dist(sg(z'), z)$ induces gradient conflict. We have updated Figure 2 based on the reviewer JoTP's suggestion.
• Claim 3: When gradient conflict is resolved, the robustness-accuracy trade-off is mitigated.
  • Justification: Supported by empirical results in Table 1.

We believe that our claims are effectively verified, and our empirical validation is both clear and convincing, as acknowledged by other reviewers (e.g., “in-depth analysis” by daZ8, “Experiments clearly show the effectiveness of each technique” by Kdc6). Nonetheless, we acknowledge that a deeper theoretical analysis would be valuable and consider this a promising direction for future work. We highly appreciate your valuable feedback.

---

[W2: Analysis between local optimization dynamics and global distributional properties]

We highly appreciate your constructive suggestion. To investigate whether the gradient conflict observed at the mini-batch level reflects conflicts in the full input distribution, we provide empirical results showing that gradient conflict persists across different batch sizes.

In Figure 12 (Appendix H), we plot the proportion of parameters experiencing gradient conflict across varied batch sizes. With the naive invariance loss ($L_{V0}$), the conflict ratio remains consistently high, with around 50% of parameters experiencing gradient conflict, regardless of the batch size. Actually, the conflict ratio appears to increase with the larger batch size. This indicates that the gradient conflict is not limited to the mini-batch level but is prevalent throughout the entire input distribution.

Thank you for your thorough response, and sorry for my late response. The revised manuscript provides better clarity on the key concepts. While the work shows considerable merit and I would be open to increasing my score, there are two fundamental questions that warrant deeper discussion:

1. Regarding Claim 2, could you elaborate on the theoretical (or intuitive) foundation of gradient conflict arising from the second term? A more rigorous theoretical analysis or intuitive explanation would strengthen this crucial aspect of your argument beyond the empirical observations.
2. The connection between addressing gradient conflict and mitigating the trade-off requires further elaboration. Specifically, the trade-off on the test set involves complex interactions between generalization and robust generalization. Could you provide a more thorough (not empirical) discussion explaining this relationship?

While your experimental results are promising, I believe additional theoretical insights into these "why" questions would significantly strengthen the paper's contribution and its suitability for ICLR. Such additions would help bridge the gap between empirical findings and theoretical/intuitive understanding.

We sincerely appreciate your recognition that (1) the paper is easy to follow, (2) the motivation behind the proposed method is clear, and your positive assessment of our work.

In the following, we address the raised concerns one-by-one.

---

[W1: Why $||z' - z||_2$ increases over time even though you add a regularization term? and why the use of stop-grad exacerbates this issue?]

We appreciate your detailed question and address each part below:

• Q. Why does $||z' - z||_2$ increase over time?

  • This reflects the robustness-accuracy trade-off: as model accuracy improves, adversarial perturbations become easier to find, which in turn increases $||z' - z||_2$.
  • To illustrate this further, we added Figure 13 in Appendix I.1. Figure 13 shows that this phenomenon also occurs in (1) adversarial training (AT) without regularization and (2) standard training, highlighting that this trade-off is common across training methods.

• Q. Why does stop-grad exacerbate this issue?

  • While stop-grad resolves gradient conflict and aids training convergence, it weakens invariance regularization by removing the second term in Eq. 5 ($(Dist(z', sg(z)) + Dist(z, sg(z'))) / 2$). This reduced regularization increases $||z' - z||_2$, intensifying the mixture distribution problem. Our split-BN strategy effectively mitigates this issue, ensuring the utility of stop-grad.

---

[W2: Line 200-201 & Figure 2: Plotting curves of only minimizing the second term can enhance your claim.]

Thank you so much for your constructive suggestion.

As suggested, we have plotted the curves of only minimizing the second term ($D(sg(z'), z)$) in Figure 2 (please refer to the updated paper). Interestingly, the results clearly show that this term is the primary source of gradient conflict with the classification loss. Specifically, minimizing this term led to negative gradient similarity and significantly larger proportion of parameters experiencing gradient conflict.

We are so delighted with this insight and appreciate your high-quality feedback.

---

[W3: Gradient conflict alone does not contribute much to robustness. Better to add standard deviation for Table 1.]

As in lines 321-324 (highlighted in red in the updated paper), the fact that gradient conflict alone does not contribute much to robustness is expected, and this is one of our key findings. The issue arises from the exacerbated mixture distribution problem caused by stop-gradient, as shown in Figure 3. Table 1 clearly demonstrates that the benefit of stop-gradient becomes apparent when Split-BN is employed.

Thank you for highlighting this. We will clarify this in the paper.

---

[Q1: Where is Figure 4?]

Thank you for pointing this out. We have corrected the error.

---

[Q2: Computational overhead of your method compared to other baselines?]

Thank you for your comment. In Appendix J, Table 19, we report the computational time of the baseline methods and ARAT.

ARAT is faster than TRADES and LBGAT. This is because these methods use the $KL$ divergence ($KL(f_\theta(x)|| f_\theta(x'))$) for adversarial example generation, requiring forward passes for both clean and adversarial images. In contrast, ARAT uses the cross-entropy loss ($CE(f_\theta(x'), y)$), which only requires forwarding the adversarial images.

Compared to AT, ARAT introduces a 15% increase in time. This is due to (1) the need for forward passes of both clean and adversarial images for loss calculation (please refer to Table 10) and (2) additional updates for separate BatchNorm layers and the predictor MLP head.

---

Feel free to ask any further questions if anything is unclear. If you feel your concerns have been adequately addressed, we would appreciate it if you could adjust the score accordingly.

We sincerely appreciate your recognition of (1) the clarity of the target issues and the motivation behind each solution, and (2) the clear presentation of experiments demonstrating the effectiveness of each technique.

In the following, we address the raised concerns one-by-one.

---

[W1: Regarding missing error bars for the baselines]

Due to time constraints, we provided error bars only for our method and the state-of-the-art method, LBGAT. Still, we believe this adequately demonstrates the effectiveness of our approach. For ARREST, we were unable to run experiments since the authors did not release their code.

---

[W2: Regarding more baseline methods]

In the main paper, we focused on comparing with adversarial training (AT) methods that incorporate invariance regularization for the following reasons:

• (1) Invariance regularization-based AT methods are the state-of-the-art approach to mitigate robustness-accuracy trade-off, as shown in Appendix B.
• (1) We aimed to highlight that our contribution is understanding the issues within the invariance regularization-based AT and proposing solutions to improve performance.

In Appendix B, we also provide comparisons between other AT methods, including methods not based on invariance regularization, demonstrating the strong performance of our proposed method, AR-AT.

We believe this addresses your concern.

---

[Q1: Invariance regularization types]

TRADES, MART, and LBGAT apply invariance regularization in the logit space (the output of the classification layer, before softmax), while ARREST applies invariance regularization to the penultimate layer’s representation. This is summarized in Appendix A, Table 10.

---

[Q2: Additional computation costs compared to baseline methods]

Thank you for your comment. In Appendix J, Table 19, we report the computational time of the baseline methods and ARAT, trained on CIFAR-10 with ResNet-18 using a single NVIDIA A100 GPU and a batch size 128.

ARAT is faster than TRADES and LBGAT. This is because these methods use the $KL$ divergence ($KL(f_\theta(x)|| f_\theta(x'))$) for adversarial example generation, requiring forward passes for both clean and adversarial images. In contrast, ARAT uses the cross-entropy loss ($CE(f_\theta(x'), y)$), which only requires forwarding the adversarial images.

Compared to AT, ARAT introduces a 15% increase in time. This is due to (1) the need for forward passes of both clean and adversarial images for loss calculation (please refer to Table 10) and (2) additional updates for separate BatchNorm layers and the predictor MLP head.

---

Feel free to ask any further questions if anything is unclear. If you feel your concerns have been adequately addressed, we would appreciate it if you could adjust the score accordingly.

We sincerely appreciate recognizing (1) the clarity of our writing, (2) the strong empirical validation of AR-AT, and (3) our in-depth analysis of gradient conflict and mixture distribution problems, which provide novel and valuable theoretical insights for adversarial defense.

Below, we address each of the raised concerns in detail.

---

[W1, Q1] The novelty of the proposed stop-gradient operation and predictor

We are glad to explain the novelty of our proposed method. We will clarify these points in the camera-ready version.

(Novelty 1) Distinct Motivation and Objective: Resolving "gradient conflict" by "Asymmetric structure"

While the loss functions may appear similar to SSL methods like SimSiam [A], our approach is tailored to address the unique problem of "gradient conflict," distinct from the motivations in SSL.

Let us denote the distance function as $Dist(\cdot, \cdot)$, the stop-gradient operation as $sg(\cdot)$, and the predictor as $h(\cdot)$.

• [SSL setup] In SSL, SimSiam uses two representations from two augmented images, $z1$ and $z2$, with the loss function: \begin{aligned} L = (Dist(h(z1), sg(z2)) + Dist(h(z2), sg(z1))) / 2. \end{aligned} where the invariance regularization is symmetric.

• [AR-AT setup] Let $z'$ represent the adversarial example and $z$ the clean image. In addition to classification losses, AR-AT (w/o predictor) employs an asymmetric invariance loss formulated as: \begin{aligned} L_{inv} = Dist(z', sg(z)), \end{aligned} where the invariance regularization is asymmetric.

• [Key Difference] As discussed in Section 3.1, we hypothesized that including the second term $Dist(sg(z'), z)$ (in Eq. 5) could lead to "corruption" of representations, causing "gradient conflict" between classification loss. Figure 2 demonstrates that $Dist(sg(z'), z)$ induces gradient conflict (please refer to the updated paper).

Thus, we emphasize that our approach goes beyond the simple application of SSL techniques: Our asymmetric invariance loss is based on novel findings and distinct motivations, separate from SSL. This makes our approach fundamentally different from state-of-the-art defenses like LBGAT and ARREST, which rely on knowledge distillation.

(Novelty 2) Novel Insights for Adversarial Defense

Crucially, the novelty of our work lies more in offering new theoretical insights for adversarial defense, as recognized by the reviewers, rather than in the technical details themselves. We identified and tackled two key problems of "gradient conflict" and mixture distribution issues in invariance regularization, supported by thorough analysis and strong empirical evidence.

---

[W2,Q2: More evidence and experiments on mixture distribution problem]

Thank you for your constructive suggestion. In Appendix I of the updated paper, we analyze the stability of BatchNorm (BN) statistics with and without Split-BN, providing additional evidence that supports our findings on the mixture distribution problem.

In Figure 14, we plot the variance of the running mean $\mu$ of the BN layers computed at each epoch. With the naive invariance loss ($L_{V0}$), the variance of the $\mu$ remains high throughout training. In contrast, split-BN stabilizes the updates of BN statistics by separating clean and adversarial BN statistics. Specifically, (1) the variance of adversarial BN statistics is comparable or lower than that of the shared BN of the naive model, and (2) the variance for clean BN statistics is consistently lower. These results confirm that the split-BN stabilizes the estimation of BN statistics, effectively addressing the mixture distribution problem.

We are delighted to strengthen our claim and highly appreciate your valuable feedback.

---

[W3,Q3: Minor typos]

We appreciate pointing out this error. It has been corrected in the updated version.

---

[Q4: ImageNet results]

Thank you for your suggestion. We agree that conducting experiments on a large-scale dataset like ImageNet is important, however, adversarial training on such datasets is extremely computationally expensive. This issue is common in the adversarial defense research community: most of the baseline methods, including ARREST and LBGAT, also do not provide results on ImageNet.

In fact, adversarial training on ImageNet even with a small step size of 3 requires approximately 6 days with 4 V100 GPUs (https://github.com/MadryLab/robustness/issues/76), while adversarial training (10-steps) on CIFAR-10 takes just 2 hours with a single GPU.

We acknowledge the significance of this issue but addressing it falls beyond the scope of our current work.

---

Feel free to ask any further questions if anything is unclear. If you feel your concerns have been adequately addressed, we would appreciate it if you could adjust the score accordingly.

---

Reference

[A] Chen, Xinlei, and Kaiming He. "Exploring simple siamese representation learning." CVPR 2021.