{"id":"e95b1949-14e5-4805-842a-5393240eaa3d","arxiv_id":"2411.14424","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":3.0,"correctness_risk":"high","formal_verification":"none","parameter_count":2,"one_line_summary":"A claim that same-class mixup combined with adversarial training provably reduces class-wise robustness disparity, but the theoretical support is invalid because it evaluates the classifier on the wrong distribution and uses incorrect Phi-difference formulas.","lead":"This paper proposes 'same-domain mixup' (averaging examples from the same class) during adversarial training to reduce class-wise gaps in error rates. The authors claim a proof for Gaussian data and report CIFAR-10 improvements, but the proof's formulas describe the mixup distribution, not the original test distribution, and the disparity equations are algebraically wrong.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorems 3/4 evaluate class-wise risk on the mixup distribution (variance g(λ)σ²), not the original distribution that defines the problem; Remarks 1/3 then compare these to original-risk baselines, so the claimed provable disparity reduction is not established.","rationale":"The reader's verdict is REJECT, and I agree: the paper does not provide a sound proof of its central claim. The reader's weakest_assumption focused on the unproved lemma w*_1 = ... = w*_d; that is a genuine gap, but the more load-bearing issue is that even granting that lemma, the class-wise risks in Theorems 3 and 4 are computed on the mixup distribution, not the original distribution used in the problem statement and in Propositions 1 and 2. Without a transfer argument, the inequalities in Remarks 1 and 3 compare different quantities. The additional algebraic slip in Remarks 1/3, where a common term is dropped inside a nonlinear Φ function, compounds the problem. I do not claim the underlying phenomenon is impossible; the original-distribution disparity may still shrink in some regimes, and a repaired proof might exist. But as written, the 'provably reduce' claim is unsupported. The experimental section cannot rescue the theory because it is a single unbaselined FGSM evaluation without error bars. Therefore the reader's REJECT verdict should stand, which I mark as UNCHANGED.","tokens_in":11278,"tokens_out":14339,"duration_ms":131912,"concrete_test":"Re-derive the original-distribution class-wise risks of f*_smix: take the threshold t* from eq. (29) and compute R+ = Φ((-t*-dµ+)/(√d σ)) and R- = Φ((t*-dµ-)/(√d σ)), then compare these with the theorem's formulas and with the baseline (5)-(6). Use a concrete instance such as d=10, µ+=µ-=1, σ=1, α=0.8, λ=0.5. If the theorem's formulas do not match the original-risk values, the proof has evaluated the wrong distribution; then check whether the original-distribution disparity is still ≤ the baseline disparity over a grid of parameters.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim rests on the formulas in Theorems 3 and 4 and their comparison with Propositions 1 and 2. However, the proofs compute the wrong quantity. The class-wise risks defined before Proposition 1 are expectations over the original data: x|y=+1 ~ N(µ+, σ²I) and x|y=-1 ~ N(-µ-, σ²I). In Appendix A, eqs. (26)-(27), and Appendix B, eqs. (32)/(34), the same symbols R+_nat and R-_nat are instead evaluated on the mixup samples x_smix ~ N(µ+, g(λ)σ²I) and N(-µ-, g(λ)σ²I). These are different distributions. For a fixed linear classifier, replacing σ² by g(λ)σ² changes the Φ argument from (-t-dµ±)/(√d σ) to (-t-dµ±)/(√(dg(λ))σ). No transfer lemma shows that the mixup-distribution risk of f*_smix equals its original-distribution risk. Consequently, Remarks 1 and 3 compare R_nat/adv of f*_smix on the mixup distribution with R_nat/adv of f*_nat/f*_adv on the original distribution, so the inequalities ∆nat(f*_smix) ≤ ∆nat(f*_nat) and ∆adv(f*_smix) ≤ ∆adv(f*_adv) are not established for the class-wise risks the paper defines. The comparison is also algebraically unsupported: Remarks 1/3 drop the common term -d²(µ+ + µ-)² inside Φ, which is invalid because Φ is nonlinear. A correct re-derivation for the original distribution would use the threshold t* from eq. (29) but variance σ², yielding R+ = Φ((-t*-dµ+)/(√d σ)), not eq. (14).","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes same-class mixup (domain mixup) combined with adversarial training as a method to reduce class-wise disparity in natural and adversarial risks. For binary classification with Gaussian class-conditional data and linear classifiers, it states closed-form expressions for the class-wise risks of the mixup-trained classifier (Theorems 3 and 4) and claims, in Remarks 1 and 3, that these disparities are provably no larger than those of standard natural and adversarial training. The paper also reports experiments on synthetic Gaussian data and CIFAR-10 with a ResNet-20 model, showing improved worst-class adversarial risk under the proposed mixup scheme.","tokens_in":11692,"tokens_out":5174,"duration_ms":54293,"significance":"If the main theoretical claim were correct, the paper would offer a simple and appealing mechanism for fairness in adversarial robustness, with a transparent analysis in a tractable Gaussian model. The proposed method is easy to state and the CIFAR-10 results, if reproducible, are empirically suggestive. However, the central theoretical result as written proves a different quantity than the one claimed, and the disparity comparisons contain an algebraic error. The derivations also rely on an unproved symmetry lemma for the optimal weight vector. These issues affect the paper's main contribution, so the current version does not establish the advertised provable disparity reduction.","major_comments":[{"comment":"The class-wise risks R_{nat}^{+1}, R_{nat}^{-1} and R_{adv}^{+1}, R_{adv}^{-1} are defined before Proposition 1 as expectations over the original data distribution, with x|y=+1 ~ N(µ+, σ^2 I) and x|y=-1 ~ N(-µ-, σ^2 I). In the proofs of Theorems 3 and 4, however, these same symbols are evaluated on the mixup samples x_smix ~ N(µ+, g(λ)σ^2 I) and N(-µ-, g(λ)σ^2 I). The resulting formulas, e.g., Eq. (14) and the equal-variance formulas below it, contain g(λ) in the variance and are therefore mixup-distribution risks, not original-distribution risks. No transfer lemma shows that the original-distribution risk of f*_smix equals its mixup-distribution risk. Consequently, the theorems do not support the abstract's claim that mixup provably reduces class-wise disparity on the original data distribution.","section":"Theorems 3-4, Appendix A (Eqs. (26)-(27)), Appendix B (Eqs. (32)-(34))"},{"comment":"The comparisons in Remarks 1 and 3 drop the common term -d^2(µ+ + µ-)^2 (and, in the adversarial case, the corresponding M' term) from inside the Φ arguments. Since Φ is nonlinear, Φ(A-B) - Φ(A+B) is not equal to 2Φ(-B) - 1 in general; this simplification is valid only when A = 0, which is not the case here. Thus even the comparison of the mixup-distribution disparities, as opposed to the original-distribution disparities, is not established by the displayed algebra.","section":"Remarks 1 and 3, Eqs. (16)-(17) and (22)-(23)"},{"comment":"The closed-form solutions depend on the lemma that the optimal weight vector satisfies w*_1 = ... = w*_d. The paper only says this follows by the strategy of proof in [14], and it is not proved for the mixup distribution. Because the mixup distribution has a different variance, the optimality proof from [14] does not apply verbatim without additional argument. The entire derivation of Eqs. (14)-(15) and (37)-(38), and hence the disparity reduction claim, rests on this unproved step.","section":"Appendix A, proof of Theorem 3; Appendix B, proof of Theorem 4"}],"minor_comments":[{"comment":"The notation conflates training risk and evaluation risk: R_smix_nat is introduced for the mixup training objective, but Theorems 3 and 4 state results for R_nat and R_adv as if they were original-distribution risks. The paper should either redefine the target risks or clearly state which distribution is used in each theorem.","section":"Throughout Section III"},{"comment":"K is called a positive constant, but the derivation gives K = d log(α σ- / ((1-α) σ+)), which is not always positive. The sign of K matters for the inequalities in Remarks 2 and 4, so the positivity assumption needs a proof or a restriction on the parameters.","section":"Eqs. (5)-(6) and Appendix A, Eq. (28)"},{"comment":"There are several typos and stylistic issues, including 'expend the risk' for 'expand the risk', 'There the overall natural risk' where 'adversarial risk' is meant in Appendix B, and 'the the difference' in Remark 3. These should be corrected.","section":"Text quality"},{"comment":"The CIFAR-10 experiments report only point estimates; no standard errors over random seeds are given, and the details of the same-class mixup sampling (e.g., the distribution of λ and how adversarial samples are mixed) are not specified. Please provide this information for reproducibility.","section":"Table I"}],"recommendation":"reject","confidential_remarks":"The main theoretical claim is not established: Theorems 3 and 4 compute risks on the mixup distribution while the abstract and problem statement concern original-distribution risks, and the disparity comparisons in Remarks 1 and 3 involve an invalid simplification of Φ differences. These are load-bearing errors rather than local presentation issues. I would not recommend major revision because the path to a correct proof requires reformulating the theorems and likely new arguments to transfer the mixup-distribution result back to the original distribution. I would be open to reconsidering a substantially revised version that addresses the transfer question and re-derives the remarks without dropping terms inside Φ."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Punchline: the paper's core claim is not established. The class-wise risks in Section II are defined on the original Gaussian data, but the proofs in Appendices A and B evaluate the same symbols on the mixup distribution with variance g(λ)σ². There is no transfer argument showing that the mixup-distribution risk of f*_smix equals its original-distribution risk. So Remarks 1 and 3 compare apples to oranges, and the claimed inequalities Δnat(f*_smix) ≤ Δnat(f*_nat) and Δadv(f*_smix) ≤ Δadv(f*_adv) are not proven for the risks the paper defines. The algebra in those remarks also drops the common term −d²(µ+ + µ−)² inside Φ; that is invalid because Φ is nonlinear.\n\nWhat is genuinely useful: framing fair adversarial training as class-wise risk disparity and proposing same-class mixup as a simpler alternative to weighted losses is a clean, motivated idea. The paper is clearly written and transparently follows the Gaussian setup of Xu et al. and Ma et al. If the claim were reframed as \"mixup changes the training distribution and thus the optimal classifier,\" the derivations would be a straightforward corollary of the known formulas. That is not nothing.\n\nThe soft spots are serious. Beyond the distribution mismatch, the experiments are thin: FGSM only, no standard AT baselines from prior work, no error bars, and the reported improvement at ε=0.3 (average adversarial risk dropping from 7% to 1%) is implausibly large without repeated runs. There is also a numeric typo in the text about standard deviation, which does not inspire confidence in the numbers. None of this is a fabrication accusation—it is just under-evidenced for the strength of the claim.\n\nWho benefits from this paper: readers who want a simple baseline idea in fair adversarial training, or a teaching example of a distribution-mismatch error in theoretical risk analysis. I would not cite the theorem as a proof. I would, however, send it to peer review rather than desk-reject: the problem is real, the idea has legs, and a good referee can tell the authors exactly what to fix—either bridge the distributions or reframe the claim. But major revision is required.","headline":"The same-class mixup idea is a sensible thing to try, but the central theorem computes risks on the mixup distribution rather than the original data, so the provable disparity-reduction claim does not hold as written.","tokens_in":12218,"tokens_out":2426,"would_cite":false,"duration_ms":25686,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Same-class mixup before adversarial training can provably shrink the gap between a classifier's best- and worst-class error rates, at least for linear classifiers on Gaussian data.","keywords":["fair robustness","class-wise disparity","adversarial training","mixup","domain mixup","linear classifiers","Gaussian data","CIFAR-10"],"falsifier":"Train a linear classifier on same-class mixup samples drawn from two Gaussian classes with unequal variances and priors, then evaluate the learned classifier on fresh samples from the original distribution and measure the class-wise risk gap. If the gap is not smaller than the gap of a classifier trained without mixup, the claimed inequality fails; the same check can be run with $\\sigma_+=\\sigma_-$ to isolate the equal-variance regime the theorem assumes.","tokens_in":11045,"feed_emoji":"⚖️","tokens_out":7965,"duration_ms":73913,"temperature":0.7,"pith_summary":"Adversarial training makes models robust on average, but it can leave some classes much less protected than others. The paper proposes a simple change: before training, mix pairs of examples drawn from the same class, so the classifier sees variance-reduced versions of each class. Its central claim is that for linear classifiers on class-conditional Gaussian data, this same-domain mixup provably reduces the class-wise disparity, the absolute difference between best- and worst-class risk, for both natural and adversarial training, i.e. $\\Delta_{\\mathrm{nat}}(f^*_{\\mathrm{smix}}) \\le \\Delta_{\\mathrm{nat}}(f^*_{\\mathrm{nat}})$ and $\\Delta_{\\mathrm{adv}}(f^*_{\\mathrm{smix}}) \\le \\Delta_{\\mathrm{adv}}(f^*_{\\mathrm{adv}})$. If true, fairness across classes can be improved without a new objective, just by changing the training distribution. Experiments on CIFAR-10 with a ResNet20 are offered as evidence that the effect carries beyond the Gaussian setting.","feed_headline":"Same-class mixup shrinks adversarial training's fairness gap","feed_subtitle":"A variance-reducing training mix narrows class-wise error gaps — proven for linear classifiers and shown on CIFAR-10.","key_machinery":"The load-bearing mechanism is same-domain mixup: new training points $x_{\\mathrm{smix}} = \\lambda x_i + (1-\\lambda)x_j$ with $x_i, x_j$ from the same class and the same label. Because the class-conditional data are Gaussian, the mixed class has covariance $(\\lambda^2+(1-\\lambda)^2)\\sigma^2 I$, so the variance factor $g(\\lambda)=\\lambda^2+(1-\\lambda)^2$ is strictly below 1. The proof reduces the optimal linear classifier to the threshold $t^* = b^*/w^*$, assuming the optimal weights are equal across all $d$ coordinates; the closed-form class-wise risks then place $g(\\lambda)$ inside the $\\Phi$ arguments in a way that pulls the two class risks toward each other. The variance factor is what carries the argument: it is the only new quantity distinguishing mixup training from ordinary training.","core_discovery":"Stated on its own terms, the paper's discovery is that interpolating two same-label samples produces a distribution with variance scaled by $g(\\lambda)=\\lambda^2+(1-\\lambda)^2$, and since $g(\\lambda)<1$ for $0<\\lambda<1$, same-class mixup compresses the within-class scatter that drives the classifier's bias. Theorems 3 and 4 solve the optimal linear classifier on this mixup distribution and give closed-form class-wise risks; comparing them with the no-mixup risks in Propositions 1 and 2 yields the inequalities $\\Delta_{\\mathrm{nat}}(f^*_{\\mathrm{smix}}) \\le \\Delta_{\\mathrm{nat}}(f^*_{\\mathrm{nat}})$ and $\\Delta_{\\mathrm{adv}}(f^*_{\\mathrm{smix}}) \\le \\Delta_{\\mathrm{adv}}(f^*_{\\mathrm{adv}})$ under equal class variances. The same-class mixup recipe, applied to FGSM adversarial training on CIFAR-10, lowers the worst-class adversarial test risk from about 12.70% to 3.80% at perturbation budget $\\epsilon=0.3$.","pith_inferences":["This suggests applying same-class mixup only to the higher-risk class, or weighting mixup by class variance, could yield the same disparity reduction with less accuracy cost; the paper does not test this.","Because the proof uses isotropic Gaussians and equal feature weights, the CIFAR-10 gains are likely explained by an additional mechanism, such as smoother decision boundaries; a testable follow-up would be to run the same recipe on a linear model applied to CIFAR-10 features to see how much of the empirical gain survives outside the theorem's regime.","The variance-compression view predicts that other variance-reducing augmentations, such as feature averaging within a class or label-preserving noise reduction, might mimic mixup's fairness effect; this is an extrapolation, not a paper claim."],"forward_implications":["If the claim is right, a practitioner can reduce class-wise fairness gaps in adversarial training without changing the loss function, only the sampling procedure.","The same mechanism covers natural training, so the fairness improvement is not bought by sacrificing the natural-risk balance of the classifier.","The closed-form risks predict that choosing $\\lambda$ closer to $1/2$ shrinks the gap monotonically, since $g(\\lambda)$ is minimized at $\\lambda=1/2$.","On CIFAR-10, the worst-class adversarial risk drops from 12.70% to 3.80% at $\\epsilon=0.3$, indicating the method also improves the minimum class performance, not just the average."],"supporting_citations":[{"why":"Supplies the class-wise natural risk formulas and the equal-weight proof-by-contradiction strategy that the mixup derivations reuse.","marker":"[14]"},{"why":"Gives the class-wise adversarial risk analysis under $\\ell_\\infty$ perturbations that Theorem 4 extends to mixup training.","marker":"[17]"},{"why":"Introduces mixup (linear interpolation of inputs and labels), the operation the paper's same-domain mixup is built on.","marker":"[22]"},{"why":"Defines adversarial training as robust risk minimization, the baseline that the mixup adversarial training modifies.","marker":"[4]"}],"fun_headline_variants":["Same-class mixup slashes adversarial fairness gap","Mixup lowers worst-class adversarial risk from 12.7% to 3.8%","Adversarial training gets fairness boost from mixup","Interpolating same-class data narrows robustness disparity","Provable: mixup equalizes class-wise adversarial robustness"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The closed-form solutions assume the optimal linear classifier has identical weight on every feature, a lemma cited to earlier work rather than proved here, and the formulas are treated as original-distribution class-wise risks even though they are derived on mixup-distributed inputs.","fun_headline_variants_meta":{"raw":{"variants":["Same-class mixup slashes adversarial fairness gap","Mixup lowers worst-class adversarial risk from 12.7% to 3.8%","Adversarial training gets fairness boost from mixup","Interpolating same-class data narrows robustness disparity","Provable: mixup equalizes class-wise adversarial robustness"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00022,"raw_usage":{"total_tokens":1448,"prompt_tokens":948,"completion_tokens":500,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":564,"completion_tokens_details":{"reasoning_tokens":415}},"tokens_in":564,"tokens_out":500,"duration_ms":5069,"temperature":1.0,"reasoning_tokens":415,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T15:12:43.012502+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a linear classifier on same-class mixup samples drawn from two Gaussian classes with unequal variances and priors, then evaluate the learned classifier on fresh samples from the original distribution and measure the class-wise risk gap. If the gap is not smaller than the gap of a classifier trained without mixup, the claimed inequality fails; the same check can be run with $\\sigma_+=\\sigma_-$ to isolate the equal-variance regime the theorem assumes.","supporting_citations":[{"cited_title":"To be robust or to be fair: Towards fairness in adversarial training,","cited_arxiv_id":null,"evidence_quote":"Supplies the class-wise natural risk formulas and the equal-weight proof-by-contradiction strategy that the mixup derivations reuse."},{"cited_title":"On the tradeoff between robustness and fairness,","cited_arxiv_id":null,"evidence_quote":"Gives the class-wise adversarial risk analysis under $\\ell_\\infty$ perturbations that Theorem 4 extends to mixup training."}],"review_version":1}