Pith. sign in

REVIEW 3 major objections 7 minor 50 references

TAROT: Towards Essentially Domain-Invariant Robustness with Theoretical Justification

T0 review · 3 major / 7 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper proves that adversarial risk on an unlabeled target domain is controlled by source margin loss, an empirical robust margin disparity discrepancy, and the model's local Lipschitz constant, and builds TAROT on this bound.

desk verdict Solid, largely credible extension of MDD to robust UDA with strong empirical results, but Theorem 1 has an unstated permutation-invariance assumption and the Lipschitz term may be vacuous in practice. read the letter →

arxiv 2505.06580 v1 pith:TEHHVIWE submitted 2025-05-10 cs.AI stat.ML

Dongyoon Yang , Jihu Lee , Yongdai Kim This is my paper · ORCID
classification cs.AIstat.ML MSC 68T0562H30
keywords robustdomainadaptationadversarialrobustnessgeneralizationboundmargindisparitydiscrepancypseudo-labelingdomain-invariantfeatureslocalLipschitzconstantRademachercomplexity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper derives a new generalization bound for adversarial robustness in unsupervised domain adaptation. It shows that the worst-case (robust) risk on an unlabeled target domain is bounded by the source domain's margin loss, a new empirical discrepancy called the Robust Margin Disparity Discrepancy, and a term involving the model's local Lipschitz constant. The bound implies that pseudo-labels alone are insufficient, and that combining pseudo-labeling with explicit distributional alignment should improve robust adaptation. The authors build the TAROT algorithm from this bound and report higher standard and robust accuracy than prior methods on Office-31, Office-Home, VisDA2017, and DomainNet, including gains on source and unseen domains.

What carries the argument

The load-bearing object is the Robust Margin Disparity Discrepancy (Definition 3): for a fixed score function $f$, it is the supremum over $f'$ of the target-domain robust margin disparity minus the source-domain standard margin disparity. It measures how much adversarial examples on the target are more confusing than clean source examples relative to a pseudo-label generator $f'$. The proof of Theorem 1 carries this discrepancy through Rademacher complexity bounds, and the local Lipschitz constant $L_f(T_X,\varepsilon)$ appears because perturbing an input by $\varepsilon$ changes the margin loss by at most $2\varepsilon/\rho$ times that constant.

What would settle it

Take a UDA task with a fixed non-permutation-invariant network, compute every term in inequality (16) on held-out source and target sets (estimating the Rademacher terms and the local Lipschitz constant as in Section 10.4), and compare the bound against measured AutoAttack accuracy; repeated violation of the inequality would falsify the theorem for that architecture.

Watch

Extended reading notes

Core claim

The central claim is Theorem 1: for any $\delta>0$, with probability at least $1-3\delta$, the target robust risk is bounded by $$$R^{{(\rho)}}$_{\hat S}(f) + $d^{{\mathrm{rob}}$,(\rho)}_{f,F}(\hat S_X, \hat T_X) + \$\lambda$ + \frac{$2C^{2}$}{\rho} R_{n,S}(\Pi_1 F) + \frac{2C}{\rho} R_{n,S}(\Pi_H F) + 2\sqrt{\frac{\log(2/\delta)}{2n}} + \frac{2C}{\rho} R_{m,T}(\Pi_H F) + \sqrt{\frac{\log(2/\delta)}{2m}} + \frac{2\varepsilon L_f(T_X,\varepsilon)}{\rho}.$$ In words, the target adversarial error is controlled by the source margin loss, an empirical discrepancy computable from unlabeled target data, and the model's local Lipschitz constant. The paper argues this bound is not merely formal: it predicts why robustly pretrained initializations help, why pseudo-labeling alone degrades on large domain gaps, and it motivates the TAROT objective that combines a teacher pseudo-label adversarial term with distributional alignment.

Load-bearing premise

The proof assumes the classifier class is closed under permuting the class labels, so a Rademacher complexity bound for the maximum over classes goes through; a fixed neural network with tied or structured output weights may not satisfy this closure.

Editorial extensions

If this is right

  • If Theorem 1 is correct, robust UDA can be formulated as minimizing source margin loss plus an empirical discrepancy, with no need to generate adversarial examples on the source domain.
  • The bound's local Lipschitz term explains why starting from a robustly pretrained model matters: a smaller Lipschitz constant directly shrinks the dominant term at large perturbation budgets.
  • Pseudo-labeling alone corresponds to the weaker Proposition 2 bound, so the theorem predicts its collapse as the source-target gap grows; TAROT's alignment term addresses exactly that.
  • The same bound structure yields Proposition 3, a source-domain robust risk bound, which explains the observed robustness gains on source and unseen domains.
  • Because all data-dependent terms in the bound are estimable from labeled source and unlabeled target data, the bound can be evaluated at deployment time to predict worst-case target accuracy.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension: use the empirical RMDD plus Lipschitz estimate as a model-selection score for robust domain generalization, picking the checkpoint with the smallest predicted bound without any target labels.
  • The proof's permutation-invariance assumption (Section 8.2, Lemma 6) is not stated in the main theorem; for architectures whose score functions are not closed under label permutations, the Rademacher term may need replacement, and this is the weakest point to test empirically.
  • The same design—reusing adversarial examples for both Lipschitz reduction and discrepancy estimation—should transfer to robust few-shot learning and source-free domain adaptation, where target labels are even scarcer.
  • The theorem suggests a cheap diagnostic: if the bound is tight, plotting source margin loss and empirical RMDD during training should track AutoAttack accuracy, giving an early stopping rule.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. The paper addresses adversarial robustness in unsupervised domain adaptation (UDA). It introduces a new divergence measure, the robust margin disparity discrepancy, and uses it to derive a generalization bound (Theorem 1) on the target-domain robust risk in terms of the source margin loss, an empirical discrepancy computable from unlabeled target data, Rademacher complexity terms, and a local Lipschitz constant. From this bound the authors extract two insights: that pseudo-labeling alone is insufficient and should be combined with distributional alignment, and that initializing with a robustly pretrained model is beneficial because it reduces the local Lipschitz term. They then propose the TAROT algorithm, which optimizes the empirical, computable parts of the bound, and report experiments on Office-31, Office-Home, VisDA2017, and DomainNet showing improvements over ARTUDA, RFA, SRoUDA, and a pseudo-labeling baseline, including gains on source and unseen domains.

Significance. If the theoretical gaps are repaired, the robust margin disparity discrepancy is a natural extension of the MDD framework to adversarial robustness, and Theorem 1 provides a plausible theoretical justification for combining pseudo-labeling with domain alignment. The empirical study is a clear strength: the paper compares against several recent baselines, evaluates with AutoAttack as well as other attacks, includes ablations on the trade-off parameter, the perturbation budget, and the Robust-PT initialization, and provides the code. The main theoretical value, however, currently rests on an unstated permutation-invariance assumption in the proof of Lemma 6, and a second theoretical result, Proposition 3, appears to have an incorrect proof; these issues undermine the completeness of the claimed theoretical justification, though they are likely repairable.

major comments (3)
  1. [Supplementary Sec. 8.2, Lemma 6; Theorem 1 (Eq. 16)] The proof of Lemma 6 uses the assertion 'As we assumed that H is permutation-invariant' to bound the second Rademacher complexity term, but this assumption is not stated in Definition 5, Lemma 6, or Theorem 1. Since Theorem 1 and Lemma 8 depend directly on Lemma 6, the central bound is not proven for a general score-function class F. Please either state the closure condition explicitly (e.g., that for every h in H and every label permutation ξ, the function ξ∘h is also in H) in the main text and in the theorem statement, or modify the proof to avoid the requirement. The assumption does hold for standard unconstrained softmax output layers, but it is not automatic and should be discussed.
  2. [Supplementary Sec. 8.3, Proposition 3] The proof of Proposition 3 appears to contain an unjustified inequality. The step from R_T^(ρ)(f) to R_S^(ρ)(f) + 2 disp^(ρ)_{SX}(f*,f) − disp^(ρ)_{TX}(f*,f) does not follow from the preceding line or from Lemma 4, and the final replacement of 2[disp_SX(f*,f) − disp_TX(f*,f)] by 2 d rob,(ρ)_{f,F}(SX,TX) has the wrong sign relative to the definition d rob = sup_{f'} [disprob_TX(f',f) − disp_SX(f',f)], since disp_SX − disp_TX is not bounded above by d rob. Please correct the derivation or withdraw the proposition; as written, the claimed source-domain robust risk bound is unsupported.
  3. [Sec. 4.2, Theorem 1; Table 9] The Lipschitz term 2ε Lf(TX,ε)/ρ in Eq. (16) is f-dependent and empirically very large: Table 9 reports local Lipschitz constants on the order of 10^3 even for adversarially trained models. With ε = 8/255 and a typical margin ρ, this term alone exceeds the scale of the 0-1 risk, making the bound vacuous for the networks actually trained. The paper uses this term to motivate Robust-PT initialization in Sec. 4.3, but it should explicitly acknowledge the vacuousness, and ideally report an empirical estimate of the bound to show whether it is ever nontrivial in the evaluated settings.
minor comments (7)
  1. [Algorithm 1 (Sec. 4.4)] The input list repeats 'DS = {(xs_i,ys_i)}^m_{i=1} : source domain dataset' twice, and the batch indices are used inconsistently with Eq. (20); please clean up the notation.
  2. [Sec. 4.4, Eq. (20)] The definition of γ as 'γ := expρ' is unclear and appears to be a typo for the MDD margin parameter; please clarify the role and value of γ in the loss.
  3. [Sec. 5.1.1] The sentence about standard training MDD having robust accuracy exactly 0.0 appears twice; please remove the duplication.
  4. [Supplementary Sec. 10.7] The text says 'As seen in the table below' but no table is included; please add the promised comparison table.
  5. [Supplementary Sec. 8.3] The section title 'Source Robusk Risk' should be corrected to 'Source Robust Risk'.
  6. [Supplementary Sec. 8.2, proof of Lemma 6] The notation ξ^j h and ξ j h(x_i) is introduced without defining whether ξ acts on the label output of h or on h itself; please define the permutation action on H precisely.
  7. [Supplementary Sec. 8.2, proof of Theorem 1] The proof writes Rrob,(ρ)_bS(f) where the theorem statement uses R(ρ)_bS(f); this typo should be corrected for consistency.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the bound is derived from stated assumptions via external tools, the algorithm minimizes the bound's computable terms, and the reported gains are external benchmarks rather than self-justifying predictions.

full rationale

The derivation chain is not circular. Theorem 1 (Eq. 16) follows from Proposition 1 / Eq. (9) plus three uniform concentration steps (Lemmas 1, 6, 8) proved from stated distributional assumptions using external results: Rademacher bound for margin loss (attributed to Zhang et al. [45] and Mohri et al. [23]), Talagrand's lemma [23, 33], Lemma 3 of Mohri et al. [23], the 2-Lipschitz property of the margin operator from Bartlett et al. [5], and the MDD margin-disparity framework [45]. No parameter is fitted to the data and then renamed a prediction: the bound's RHS is a uniform-in-f upper bound; its data-dependent terms (R^(ρ)_S(f) on empirical source, d^rob on empirical distributions, and the local Lipschitz term) are exactly the objective TAROT minimizes (Eq. 19), which is the standard 'minimize the bound' design; the reported accuracies (Tables 1-6) are external benchmark evaluations, not outputs of the bound, and no calibration claim is made. The two 'insights' in Sec. 4.3 are a structural reading of the bound (presence of both the discrepancy term and the Lipschitz term) plus an empirical ablation of Robust-PT initialization; neither renames a fitted value as a prediction. The only self-citations ([40, 41], Yang-Kong-Kim) are background references for adversarial training methods and are not load-bearing. One flagged caveat, which is a proof-completeness gap rather than circularity: Lemma 6's proof (Supplementary Sec. 8.2) needs the claim 'As we assumed that H is permutation-invariant, we know that for ∀h∈H and j = 1,...,k−1, ξ^j h∈H holds' to bound the second Rademacher term by C*R_n(Π_H F), yet this permutation-invariance is never stated in the main text or in Lemma 6/Theorem 1 and can fail for fixed network classes; as written the central Rademacher term is unjustified for general F, but this does not reduce the bound to its inputs — the proof simply needs an added assumption or a modified complexity term.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The central bound relies on standard i.i.d. sample assumptions, Rademacher complexity, and a local Lipschitz condition. The proof also requires an unstated permutation-invariance of the classifier class. The algorithm introduces tuned hyperparameters α and ε per dataset, and uses a margin parameter ρ whose value is not reported. No new physical entities are postulated.

free parameters (3)
  • α (trade-off parameter in Eq. 20) = 0.05 (Office-31), 0.1 (Office-Home), 0.5 (VisDA2017), 1.0 (DomainNet)
    Selected per dataset based on empirical validation; sensitivity analysis reported in Sec 5.2 and Sec 10.3.
  • ε (perturbation budget) = 16/255 (Office-31, Office-Home), 8/255 (VisDA2017), 4/255 (DomainNet)
    Chosen based on dataset difficulty; standard in adversarial robustness but still a manual per-dataset choice.
  • ρ (margin parameter)
    Appears in the margin loss and in γ:=exp(ρ) in Eq. (20); the paper never states the numeric value used, apparently inherited from MDD defaults.
assumptions (5)
  • ad hoc to paper The classifier class H is permutation-invariant.
    Used in the proof of Lemma 6 (Supplementary Sec 8.2) to bound the Rademacher complexity of a max over classes; not stated as an assumption in the main text or in Theorem 1.
  • domain assumption Score functions f are locally Lipschitz with finite L_f(D_X,ε).
    Definition 4 assumes local Lipschitzness; it is needed in Lemma 6 and Theorem 1, but the value may be very large for neural networks, making the bound vacuous.
  • domain assumption There exists an ideal hypothesis f* with small combined robust margin risk λ.
    λ = min_f {R_T(ρ)(f)+R_S(ρ)(f)} appears in every bound and is unknown in practice; standard for domain adaptation theory.
  • standard math Samples are drawn i.i.d. from source and target distributions.
    Standard assumption for Rademacher complexity based generalization bounds.
  • standard math The function classes F, Π1F, and ΠHF have finite Rademacher complexity.
    Needed to apply Lemmas 1, 5, and 6; standard in learning theory.

how reviews work

0 comments
Cite this review

Pith. "Pith review of TAROT: Towards Essentially Domain-Invariant Robustness with Theoretical Justification." pith.science (2026). https://pith.science/paper/TEHHVIWE

@misc{pith2026250506580,
  author       = {Pith},
  title        = {Pith review of: TAROT: Towards Essentially Domain-Invariant Robustness with Theoretical Justification},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TEHHVIWE}},
  note         = {Machine review of arXiv:2505.06580}
}
read the original abstract

Robust domain adaptation against adversarial attacks is a critical research area that aims to develop models capable of maintaining consistent performance across diverse and challenging domains. In this paper, we derive a new generalization bound for robust risk on the target domain using a novel divergence measure specifically designed for robust domain adaptation. Building upon this, we propose a new algorithm named TAROT, which is designed to enhance both domain adaptability and robustness. Through extensive experiments, TAROT not only surpasses state-of-the-art methods in accuracy and robustness but also significantly enhances domain generalization and scalability by effectively learning domain-invariant features. In particular, TAROT achieves superior performance on the challenging DomainNet dataset, demonstrating its ability to learn domain-invariant representations that generalize well across different domains, including unseen ones. These results highlight the broader applicability of our approach in real-world domain adaptation scenarios.

Figures

Figures reproduced from arXiv: 2505.06580 by the authors.

Figure 1
Figure 1. Overview of TAROT algorithm. it requires calculating a robust disparity and a standard disparity rather than two standard disparities. • To reduce the local Lipschitz constant, we minimize the cross entropy loss with adversarial examples for given pseudo labels attached by a teacher model learned by a nonrobust UDA approach. This is based on the previously mentioned phenomenon that adversarial training reduces the l… view at source ↗
Figure 2
Figure 2. Sensitivity Analysis of α. α = 0 corresponds to PL. the standard accuracies and robust accuracies against AA. Especially, that performance gap is increasing as ε increases. Figures 3a and 3b show that both algorithms perform sig￾nificantly better when Robust-PT is applied, particularly as ε increases, indicating that Robust-PT is crucial for robust￾ness against strong attacks. Figures 3c and 3d illustrate that TAROT… view at source ↗
Figure 3
Figure 3. Effect of Robust-PT across various methods and [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

50 extracted references · 49 canonical work pages

  1. [14]

    Certifying better robust generalization for unsupervised domain adaptation

    Zhiqiang Gao, Shufei Zhang, Kaizhu Huang, Qiufeng Wang, Rui Zhang, and Chaoliang Zhong. Certifying better robust generalization for unsupervised domain adaptation. In Pro- ceedings of the 30th ACM International Conference on Multi- media, pages 2399–2410, 2022. 1

    work page 2022

  2. [1]

    Pseudo-labeling and confirmation bias in deep semi-supervised learning

    Eric Arazo, Diego Ortego, Paul Albert, Noel E O’Connor, and Kevin McGuinness. Pseudo-labeling and confirmation bias in deep semi-supervised learning. In International joint conference on neural networks (IJCNN) , pages 1–8. IEEE,

    work page

  3. [2]

    Obfus- cated gradients give a false sense of security: Circumventing defenses to adversarial examples

    Anish Athalye, Nicholas Carlini, and David Wagner. Obfus- cated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning, pages 274–283. PMLR, 2018. 6

    work page 2018

  4. [3]

    Adversarial robust- ness for unsupervised domain adaptation

    Muhammad Awais, Fengwei Zhou, Hang Xu, Lanqing Hong, Ping Luo, Sung-Ho Bae, and Zhenguo Li. Adversarial robust- ness for unsupervised domain adaptation. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 8568–8577, 2021. 1, 2, 6, 7

    work page 2021

  5. [4]

    Latent space regularization for unsupervised domain adaptation in semantic segmentation

    Francesco Barbato, Marco Toldo, Umberto Michieli, and Pietro Zanuttigh. Latent space regularization for unsupervised domain adaptation in semantic segmentation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2835–2845, 2021. 1

    work page 2021

  6. [5]

    Convexity, classification, and risk bounds

    Peter L Bartlett, Michael I Jordan, and Jon D McAuliffe. Convexity, classification, and risk bounds. Journal of the American Statistical Association, 101(473):138–156, 2006. 2

    work page 2006

  7. [6]

    Spectrally-normalized margin bounds for neural networks

    Peter L Bartlett, Dylan J Foster, and Matus J Telgarsky. Spectrally-normalized margin bounds for neural networks. Advances in neural information processing systems, 30, 2017. 4

    work page 2017

  8. [7]

    A theory of learning from different domains

    Shai Ben-David, John Blitzer, Koby Crammer, Alex Kulesza, Fernando Pereira, and Jennifer Wortman Vaughan. A theory of learning from different domains. Machine learning, 79: 151–175, 2010. 2

    work page 2010

Show all 50 references
  1. [8]

    Two wrongs don’t make a right: Combating confirmation bias in learning with label noise

    Mingcai Chen, Hao Cheng, Yuntao Du, Ming Xu, Wenyu Jiang, and Chongjun Wang. Two wrongs don’t make a right: Combating confirmation bias in learning with label noise. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 14765–14773, 2023. 5

    2023

  2. [9]

    Parseval networks: Improving robustness to adversarial examples

    Moustapha Cisse, Piotr Bojanowski, Edouard Grave, Yann Dauphin, and Nicolas Usunier. Parseval networks: Improving robustness to adversarial examples. In International con- ference on machine learning, pages 854–863. PMLR, 2017. 4

    2017

  3. [10]

    Reliable evaluation of adversarial robustness with an ensemble of diverse parameter- free attacks

    Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter- free attacks. In International conference on machine learning, pages 2206–2216. PMLR, 2020. 6

    2020

  4. [11]

    Vector analysis versus vector calculus

    Antonio Galbis and Manuel Maestre. Vector analysis versus vector calculus. Springer Science & Business Media, 2012. 4

    2012

  5. [12]

    Unsupervised domain adaptation by backpropagation

    Yaroslav Ganin and Victor Lempitsky. Unsupervised domain adaptation by backpropagation. In International conference on machine learning, pages 1180–1189. PMLR, 2015. 5

    2015

  6. [13]

    Domain-adversarial training of neural networks

    Yaroslav Ganin, Evgeniya Ustinova, Hana Ajakan, Pascal Germain, Hugo Larochelle, François Laviolette, Mario March, and Victor Lempitsky. Domain-adversarial training of neural networks. Journal of machine learning research, 17(59):1–35,

  7. [15]

    Reliable and efficient concept erasure of text- to-image diffusion models

    Chao Gong, Kai Chen, Zhipeng Wei, Jingjing Chen, and Yulong Jiang. Reliable and efficient concept erasure of text- to-image diffusion models. In In Euopean Conference on Computer Vision (ECCV), 2024. 1

    2024

  8. [16]

    Johansson, David Sontag, and Rajesh Ranganath

    Fredrik D. Johansson, David Sontag, and Rajesh Ranganath. Support and invertibility in domain-invariant representations. International Conference on Artificial Intelligence and Statis- tics, 2019. 1

    2019

  9. [17]

    Exactly computing the local lipschitz constant of relu networks

    Matt Jordan and Alexandros G Dimakis. Exactly computing the local lipschitz constant of relu networks. Advances in Neural Information Processing Systems, 33:7344–7353, 2020. 4

    2020

  10. [18]

    Transfer-learning-library

    Bo Fu Junguang Jiang, Baixu Chen and Mingsheng Long. Transfer-learning-library. https : / / github . com / thuml/Transfer-Learning-Library, 2020. 5

    2020

  11. [19]

    R.a.c.e.: Ro- bust adversarial concept erasure for secure text-to-image dif- fusion model

    Changhoon Kim, Kyle Min, and Yezhou Yang. R.a.c.e.: Ro- bust adversarial concept erasure for secure text-to-image dif- fusion model. In In Euopean Conference on Computer Vision (ECCV), 2025. 1

    2025

  12. [20]

    Shao-Yuan Lo and Vishal M. Patel. Exploring adversarially robust training for unsupervised domain adaptation. In Asian Conference on Computer Vision (ACCV), 2022. 1, 2, 4, 6, 7

    2022

  13. [21]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Con- ference on Learning Representations (ICLR), 2018. 1, 2, 3, 6

    2018

  14. [22]

    Understanding zero-shot adversarial robust- ness for large-scale models

    Chengzhi Mao, Scott Geng, Junfeng Yang, Xin Wang, and Carl V ondrick. Understanding zero-shot adversarial robust- ness for large-scale models. In In International Conference on Learning Representations (ICLR), 2023. 1

    2023

  15. [23]

    Foundations of Machine Learning

    Afshin Rostamizadeh Mehryar Mohri and Ameet Talwalkar. Foundations of Machine Learning. MIT Press, 2012. 4, 1

    2012

  16. [24]

    Sstn: Self- supervised domain adaptation thermal object detection for autonomous driving, 2021

    Farzeen Munir, Shoaib Azam, and Moongu Jeon. Sstn: Self- supervised domain adaptation thermal object detection for autonomous driving, 2021. 1

    2021

  17. [25]

    Visda: The visual domain adaptation challenge, 2017

    Xingchao Peng, Ben Usman, Neela Kaushik, Judy Hoffman, Dequan Wang, and Kate Saenko. Visda: The visual domain adaptation challenge, 2017. 6

    2017

  18. [26]

    Moment matching for multi-source domain adaptation

    Xingchao Peng, Qinxun Bai, Xide Xia, Zijun Huang, Kate Saenko, and Bo Wang. Moment matching for multi-source domain adaptation. In Proceedings of the IEEE/CVF inter- national conference on computer vision, pages 1406–1415,

  19. [27]

    Adapting visual category models to new domains

    Kate Saenko, Brian Kulis, Mario Fritz, and Trevor Darrell. Adapting visual category models to new domains. In In European Conference on Computer Vision (ECCV) , pages 213–226. Springer, 2010. 6

    2010

  20. [28]

    Do adversarially robust imagenet models transfer better? In Conference on Neural Information Processing Systems (NeurIPS), 2020

    Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adversarially robust imagenet models transfer better? In Conference on Neural Information Processing Systems (NeurIPS), 2020. 6

    2020

  21. [29]

    Robust clip: Unsupervised adversar- ial fine-tuning of vision embeddings for robust large vision- language models

    Christian Schlarmann, Naman Deep Singh, Francesco Croce, and Matthias Hein. Robust clip: Unsupervised adversar- ial fine-tuning of vision embeddings for robust large vision- language models. In In International Conference on Machine Learning (ICML), 2024. 1

    2024

  22. [30]

    Efficiently computing local lipschitz con- stants of neural networks via bound propagation

    Zhouxing Shi, Yihan Wang, Huan Zhang, J Zico Kolter, and Cho-Jui Hsieh. Efficiently computing local lipschitz con- stants of neural networks via bound propagation. Advances in Neural Information Processing Systems, 35:2350–2364, 2022. 4

    2022

  23. [31]

    Domain adaptation: Challenges, methods, datasets, and applications

    Peeyush Singhal, Rahee Walambe, Sheela Ramanna, and Ketan Kotecha. Domain adaptation: Challenges, methods, datasets, and applications. IEEE Access, 11:6973–7020, 2023. 1

    2023

  24. [32]

    Intriguing properties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations (ICLR), 2014. 1

    2014

  25. [33]

    Upper and lower bounds for stochastic processes

    Michel Talagrand. Upper and lower bounds for stochastic processes. Springer, 2014. 1

    2014

  26. [34]

    Multinet: Real-time joint se- mantic reasoning for autonomous driving, 2018

    Marvin Teichmann, Michael Weber, Marius Zoellner, Roberto Cipolla, and Raquel Urtasun. Multinet: Real-time joint se- mantic reasoning for autonomous driving, 2018. 1

    2018

  27. [35]

    The robust way to stack and bag: the local lipschitz way

    Thulasi Tholeti and Sheetal Kalyani. The robust way to stack and bag: the local lipschitz way. arXiv preprint arXiv:2206.00513, 2022. 4

    2022 arXiv

  28. [36]

    Are labels required for improving adversarial robustness? In Con- ference on Neural Information Processing Systems (NeurIPS),

    Jonathan Uesato, Jean-Baptiste Alayrac, Po-Sen Huang, Robert Stanforth, Alhussein Fawzi, and Pushmeet Kohli. Are labels required for improving adversarial robustness? In Con- ference on Neural Information Processing Systems (NeurIPS),

  29. [37]

    Deep hashing network for unsupervised domain adaptation

    Hemanth Venkateswara, Jose Eusebio, Shayok Chakraborty, and Sethuraman Panchanathan. Deep hashing network for unsupervised domain adaptation. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 5018–5027, 2017. 6

    2017

  30. [38]

    Improving adversarial robustness requires revisiting misclassified examples

    Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In International Conference on Learning Representataions(ICLR)), 2020. 1

    2020

  31. [39]

    Do wider neural networks really help adversarial robust- ness? Advances in Neural Information Processing Systems, 34:7054–7067, 2021

    Boxi Wu, Jinghui Chen, Deng Cai, Xiaofei He, and Quanquan Gu. Do wider neural networks really help adversarial robust- ness? Advances in Neural Information Processing Systems, 34:7054–7067, 2021. 4

    2021

  32. [40]

    Enhanc- ing adversarial robustness in low-label regime via adaptively weighted regularization and knowledge distillation

    Dongyoon Yang, Insung Kong, and Yongdai Kim. Enhanc- ing adversarial robustness in low-label regime via adaptively weighted regularization and knowledge distillation. In Pro- ceedings of the IEEE/CVF International Conference on Com- puter Vision, pages 4552–4561, 2023. 1, 2

    2023

  33. [41]

    Improving adversarial robustness by putting more regularizations on less robust samples

    Dongyoon Yang, Insung Kong, and Yongdai Kim. Improving adversarial robustness by putting more regularizations on less robust samples. In International Conference on Machine Learning, pages 39331–39348. PMLR, 2023. 1, 2

    2023

  34. [42]

    A closer look at accuracy vs

    Yao-Yuan Yang, Cyrus Rashtchian, Hongyang Zhang, Ruslan Salakhutdinov, and Kamalika Chaudhuri. A closer look at accuracy vs. robustness. In Conference on Neural Information Processing Systems (NeurIPS), 2020. 4, 6, 1, 7

    2020

  35. [43]

    Rethinking lipschitz neural networks and certified robustness: A boolean function perspective

    Bohang Zhang, Du Jiang, Di He, and Liwei Wang. Rethinking lipschitz neural networks and certified robustness: A boolean function perspective. In Conference on Neural Information Processing Systems (NeurIPS), 2022. 4, 6, 1

    2022

  36. [44]

    Theoretically principled trade-off between robustness and accuracy

    Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P Xing, Laurent El Ghaoui, and Michael I Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning (ICML), 2019. 1, 2

    2019

  37. [45]

    Yuchen Zhang, Tianle Liu, Mingsheng Long, and Michael I. Jordan. Bridging theory and algorithm for domain adaptation. In International Conference on Machine Learning (ICML),

  38. [46]

    Srouda: meta self-training for robust unsupervised domain adaptation

    Wanqing Zhu, Jia-Li Yin, Bo-Hao Chen, and Ximeng Liu. Srouda: meta self-training for robust unsupervised domain adaptation. In Proceedings of the AAAI Conference on Ar- tificial Intelligence, pages 3852–3860, 2023. 1, 2, 3, 4, 6, 7 TAROT: Towards Essentially Domain-Invariant R...

    2023

  39. [47]

    Novelty Summarization Our work goes beyond a simple theoretical extension of the existing MDD in three key aspects. First, we expand upon MDD by introducing a newly defined robust divergence to derive an upper bound of the target domain robust risk that does not use adversaria...

  40. [48]

    Auxiliary Lemmas Lemma 1 (Lemma C.4 from Zhang et al

    Theoretical Results 8.1. Auxiliary Lemmas Lemma 1 (Lemma C.4 from Zhang et al. [45], Theorem 8.1 from Mehryar Mohri and Talwalkar [23]). LetF⊆ RX×Y be a hypothesis set of score functions whereY ={1,...,C }. Define Π1F ={x7→f(x,y )|y∈Y ,f ∈F} and fix the margin parameter ρ >0. ...

  41. [49]

    Further Details on Experiments Loss The exact forms of Equation (20) loss function are as follows: ℓce ((π◦ψ)(x),y )) :=− logσy(π◦ψ(x)), ℓrob mod-ce ((π◦ψ)(x),y )) := log(1−σy(π◦ψ(xadv))), ℓrob ce ((π◦ψ)(x),y )) :=− logσy(π◦ψ(xadv)), whereσy denotes the predictive confidence f...

  42. [50]

    Additionally, we perform supplemen- tary experiments to further support the effectiveness of our proposed method, TAROT

    Additional Experimental Results Here, we present experimental results that were not included in the manuscript. Additionally, we perform supplemen- tary experiments to further support the effectiveness of our proposed method, TAROT. 10.1. Essentially Domain-Invariant Robustnes...

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.