# MixedNUTS: Training-Free Accuracy-Robustness
Balance via Nonlinearly Mixed Classifiers

Yatong Bai  Mo Zhou  Vishal M. Patel  Somayeh Sojoudi

###### Abstract

Adversarial robustness often comes at the cost of degraded accuracy, impeding
the real-life application of robust classification models. Training-based
solutions for better trade-offs are limited by incompatibilities with already-
trained high-performance large models, necessitating the exploration of
training-free ensemble approaches. Observing that robust models are more
confident in correct predictions than in incorrect ones on clean and
adversarial data alike, we speculate amplifying this “benign confidence
property” can reconcile accuracy and robustness in an ensemble setting. To
achieve so, we propose “MixedNUTS”, a _training-free_ method where the output
logits of a robust classifier and a standard non-robust classifier are
processed by nonlinear transformations with only three parameters, which are
optimized through an efficient algorithm. MixedNUTS then converts the
transformed logits into probabilities and mixes them as the overall output. On
CIFAR-10, CIFAR-100, and ImageNet datasets, experimental results with custom
strong adaptive attacks demonstrate MixedNUTS’s vastly improved accuracy and
near-SOTA robustness – it boosts CIFAR-100 clean accuracy by $7.86$ points,
sacrificing merely $0.87$ points in robust accuracy.

Adversarial Robustness, Accuracy-Robustness Trade-Off, Deep Learning, Computer
Vision, ICML

††footnotetext: 1University of California, Berkeley. 2John Hopkins University.
Correspondence to: Yatong Bai<EMAIL_ADDRESS>Code available at
github.com/Bai-YT/MixedNUTS.

##  1 Introduction

Neural classifiers are vulnerable to adversarial attacks, producing unexpected
predictions when subject to purposefully constructed human-imperceptible input
perturbations and hence manifesting severe safety risks (Goodfellow et al.,
2015; Madry et al., 2018). Existing methods for robust deep neural networks
(Madry et al., 2018; Zhang et al., 2019) often suffer from significant
accuracy penalties on clean (unattacked) data (Tsipras et al., 2019; Zhang et
al., 2019; Pang et al., 2022). As deep models continue to form the core of
numerous products, trading clean accuracy for robustness is understandably
unattractive for real-life users and profit-driven service providers. As a
result, despite the continuous development in adversarial robustness research,
robust models are rarely deployed and practical services remain non-robust
(Ilyas et al., 2018; Borkar & Chen, 2021).

To bridge the gap between robustness research and applications, researchers
have considered reconciling robustness and accuracy (Balaji et al., 2019; Chen
et al., 2020; Raghunathan et al., 2020; Rade & Moosavi-Dezfooli, 2021; Liu &
Zhao, 2022; Pang et al., 2022; Cheng et al., 2022). Most works focused on
improving robust training methods, and are thus expensive to implement.
Moreover, training-based methods may be incompatible with each other, and can
be hard to integrate into recent advancements in large-scale models pre-
trained with large real or synthetic datasets. An alternative direction to
relieve the accuracy-robustness trade-off is through an ensemble of a standard
(often non-robust) model and a robust model Bai et al. (2023b, a). This
ensemble model is referred to as the mixed classifier, whereas base
classifiers refers to its standard and robust components.

We observe that many robust base models share a benign confidence property:
their correct predictions are much more confident than incorrect ones.
Verifying such a property for numerous existing models trained via different
methods (Peng et al., 2023; Pang et al., 2022; Wang et al., 2023; Debenedetti
et al., 2022; Na, 2020; Gowal et al., 2020; Liu et al., 2023; Singh et al.,
2023), we speculate that strengthening this property can improve the mixed
classifiers’ trade-off even without changing the base classifiers’ predicted
classes.

Based on this intuition, we propose MixedNUTS (Mixed neUral classifiers with
Nonlinear TranSformation), a training-free method that enlarges the robust
base classifier confidence difference between correct and incorrect
predictions and thereby optimizes the mixed classifier’s accuracy-robustness
trade-off. MixedNUTS applies nonlinear transformations to the accurate and
robust base classifiers’ logits before converting them into probabilities used
for mixing. We parameterize the transformation with only three coefficients
and design an efficient algorithm to optimize them for the best trade-off.
Unlike (Bai et al., 2023a), MixedNUTS does not modify base neural network
weights or introduce additional components and is for the first time
efficiently extendable to larger datasets such as ImageNet. MixedNUTS is
compatible with various pre-trained standard and robust models and is agnostic
to the base model details such as training method, defense norm
($\ell_{\infty}$, $\ell_{2}$, etc.), training data, and model architecture.
Therefore, MixedNUTS can take advantage of recent developments in accurate or
robust classifiers while being general, lightweight, and convenient.

Our experiments leverage AutoAttack (Croce & Hein, 2020) and strengthened
adaptive attacks (details in Appendix B) to confirm the security of the mixed
classifier and demonstrate the balanced accuracy and robustness on datasets
including CIFAR-10, CIFAR-100, and ImageNet. On CIFAR-100, MixedNUTS improves
the clean accuracy by 7.86 percentage points over the state-of-the-art non-
mixing robust model while reducing robust accuracy by merely 0.87 points.

##  2 Background and Related Work

###  2.1 Definitions and Notations

This paper uses $\sigma:{\mathbb{R}}^{c}\to(0,1)^{c}$ to denote the standard
Softmax function: for an arbitrary $z\in{\mathbb{R}}^{c}$, the $i^{\text{th}}$
entry of $\sigma(z)$ is defined as
$\sigma(z)_{i}\coloneqq\frac{\exp(z_{i})}{\sum_{j=1}^{c}\exp(z_{j})}$, where
$z_{i}$ denotes the $i^{\text{th}}$ entry of $z$. Consider the special case of
$z_{i}=+\infty$ for some $i$, with all other entries of $z$ being less than
$+\infty$. We define $\sigma(z)$ for such a $z$ vector to be the basis (one-
hot) vector $e_{i}$. For a classifier $h:{\mathbb{R}}^{d}\to{\mathbb{R}}^{c}$,
we use the composite function $\sigma\circ h:{\mathbb{R}}^{d}\to[0,1]^{c}$ to
denote its output probabilities and use $\sigma\circ h_{i}$ to denote the
$i^{\text{th}}$ entry of it.

We define the notion of _confidence margin_ of a classifier as the output
probability gap between the top two classes:

######  Definition 2.1.

Consider a model $h:{\mathbb{R}}^{d}\to{\mathbb{R}}^{c}$, an arbitrary input
$x\in{\mathbb{R}}^{d}$, and its associated predicted label
$\widehat{y}\in[c]$. The _confidence margin_ is defined as
$m_{h}(x)\coloneqq\sigma\circ
h_{\widehat{y}}(x)-\max_{i\neq{\widehat{y}}}\sigma\circ h_{i}(x)$.

We consider a classifier to be ($\ell_{p}$-norm) robust at an input
$x\in{\mathbb{R}}^{d}$ if it assigns the same label to all perturbed inputs
$x+\delta$ such that $\lVert\delta\rVert_{p}\leq\epsilon$, where $\epsilon\geq
0$ is the attack radius. We additionally introduce the notion of the worst-
case adversarial perturbation in the sense of minimizing the margin:

######  Definition 2.2.

Consider an adversarial attack against the confidence margin $m_{h}(x)$,

$\min_{\|\delta\|\leq\epsilon}m_{h}(x+\delta).\vspace{-.9mm}$

We define the optimizer of this problem, $\delta^{\star}_{h}(x)$, as the
minimum-margin perturbation of $h(\cdot)$ around $x$. We further define the
optimal objective value, denoted as $\underline{m}^{\star}_{h}(x)$, as the
minimum margin of $h(\cdot)$ around $x$.

When the minimum margin is negative, the adversarial perturbation successfully
changes the model prediction as a wrong class. When the minimum margin is
positive, the model is robust at $x$, because perturbations within the radius
cannot change the prediction.

###  2.2 Related Adversarial Attacks and Defenses

While the fast gradient sign method (FGSM) and projected gradient descent
(PGD) attacks could attack and evaluate certain models (Madry et al., 2018;
Goodfellow et al., 2015), they are insufficient and can fail to attack non-
robust models (Carlini & Wagner, 2017; Athalye et al., 2018; Papernot et al.,
2017). To this end, stronger adversaries leveraging novel attack objectives,
black-box attacks, and expectation over transformation have been proposed
(Gowal et al., 2019; Croce & Hein, 2020; Tramèr et al., 2020). Benchmarks
based on these strong attacks, such as RobustBench (Croce et al., 2020), ARES-
Bench (Liu et al., 2023), and OODRobustBench (Li et al., 2023), aim to unify
defense evaluation.

AutoAttack (Croce & Hein, 2020) is a combination of white-box and black-box
attacks (Andriushchenko et al., 2020). It is the attack algorithm of
RobustBench (Croce et al., 2020), where AutoAttack-evaluated robust models are
often agreed to be trustworthy. We select AutoAttack as the main evaluator,
with further strengthening tailored to our defense.

Models aiming to be robust against adversarial attacks often incorporate
adversarial training (Madry et al., 2018; Bai et al., 2022, 2023c), TRADES
(Zhang et al., 2019), or their variations. Later work further enhance the
adversarial robustness by synthetic training data (Wang et al., 2023; Sehwag
et al., 2022), data augmentation (Gowal et al., 2020; Rebuffi et al., 2021;
Gowal et al., 2021), improved training loss functions (Cui et al., 2023),
purposeful architectures (Peng et al., 2023), or efficient optimization
(Shafahi et al., 2019). Nevertheless, training-based methods suffer from the
trade-off between clean and robust accuracy, and cannot leverage already-
trained state-of-the-art non-robust models.

###  2.3 Ensemble and Calibration

Model ensembles, where the outputs of multiple models are combined to produce
the overall prediction, have been explored to improve model performance
(Ganaie et al., 2022) or estimate model uncertainty (Liu et al., 2019).
Ensemble techniques have also been considered to strengthen adversarial
robustness (Pang et al., 2019; Adam & Speciel, 2020; Alam et al., 2022; Co et
al., 2022). Theoretical certified robustness analyses of ensemble models
indicate that the robust margins, gradient diversity, and runner-up class
diversity all contribute to ensemble robustness (Petrov et al., 2023; Yang et
al., 2022). Unlike these existing works that combine multiple robust models,
we focus on mixing a robust model and a high-accuracy (usually non-robust)
model.

Model calibration often involves adjusting confidence, which aims to align a
model’s confidence with its mispredicting probability, usually via temperature
scaling (Guo et al., 2017; Yu et al., 2022; Hinton et al., 2015). While
adjusting confidence of a single model generally does not change the
prediction, it is not the case in the ensemble setting. Unlike most
calibration research focusing on uncertainty, this paper adjusts the
confidence for performance.

###  2.4 Mixing Classifiers for Accuracy-Robust Trade-Off

Consider a classifier $g:{\mathbb{R}}^{d}\to{\mathbb{R}}^{c}$, whose predicted
logits are $g_{1},\ldots,g_{c}$, where $d$ is the input dimension and $c$ is
the number of classes. We assume $g(\cdot)$ to be a standard classifier
trained for high clean accuracy (and hence may not manifest adversarial
robustness). Similarly, we consider another classifier
$h:{\mathbb{R}}^{d}\to{\mathbb{R}}^{c}$ and assume it to be robust against
adversarial attacks. We use _accurate base classifier_ and _robust base
classifier_ to refer to $g(\cdot)$ and $h(\cdot)$.

Mixing the outputs of a standard classifier and a robust classifier improves
the accuracy-robustness trade-off, and it has been shown that mixing the
probabilities is more desirable than mixing the logits from theoretical and
empirical perspectives (Bai et al., 2023b, a). Here, we denote the proposed
mixed model with $f:{\mathbb{R}}^{d}\to{\mathbb{R}}^{c}$. Specifically, the
$i^{\text{th}}$ output logit of the mixed model follows the formulation

$f_{i}(x)\coloneqq\log\big{(}(1-\alpha)\cdot\sigma\circ
g(x)_{i}+\alpha\cdot\sigma\circ h(x)_{i}\big{)}$ (1)

for all $i\in[c]$, where $\alpha\in[\nicefrac{{1}}{{2}},1]$ adjusts the mixing
weight††Bai et al. (2023b, a) have shown that $\alpha$ should be no smaller
than $\nicefrac{{1}}{{2}}$ for $f(\cdot)$ to have non-trivial robustness.. The
mixing operation is performed in the probability space, and the natural
logarithm maps the mixed probability back to the logit space without changing
the predicted class for interchangeability with existing models. If the
desired output is the probability $\sigma\circ f(\cdot)$, the logarithm can be
omitted.

##  3 Base Classifier Confidence Modification

We observe that the robust base classifier $h(\cdot)$ often enjoys the benign
confidence property of having much more confidence in correct predictions than
in mistakes, even when subject to adversarial attack. Section 5.2 verifies
this property with multiple model examples, and Section C.1 visualizes the
confidence margin distribution. As a result, when mixing the output
probabilities $\sigma\circ h(\cdot)$ and $\sigma\circ g(\cdot)$ on clean data,
where $g$ is expected to be more accurate than $h$, $g$ can correct $h$’s
mistake because $h$ is unconfident. Meanwhile, when the mixed classifier is
under attack and $h$ becomes much more reliable than $g$, $h$’s high
confidence in correct predictions can overcome $g$’s misguided outputs. Hence,
even when $g$’s robust accuracy is near zero, the mixed classifier still
inherits most of $h$’s robustness.

Note that this benign confidence property is only observed on robust
classifiers. Neural classifiers trained without any robustness considerations
often make highly confident mispredictions when subject to adversarial attack
(more confident than correctly predicted unperturbed examples).

###  3.1 Accurate Base Classifier Temperature Scaling

Since the mixed classifier’s accuracy-robustness trade-off heavily depends on
the base classifiers’ confidence properties, modifying their confidence has
vast potential. To this end, we consider temperature scaling (Hinton et al.,
2015).

We start with analyzing the accurate base classifier $g(\cdot)$. One approach
to mitigate $g(\cdot)$’s detrimental property of being more confident when
mispredicting under attack than when correctly predicting clean data is to
scale up its logits prior to the Softmax operation. Specifically, we construct
the temperature scaled model $g^{\textrm{TS},T}(\cdot)$, whose $i^{\text{th}}$
entry is

$g^{\textrm{TS},T}_{i}(x)\coloneqq{\Large\nicefrac{{g_{i}(x)}}{{T}}}$

for all $i$, where $T\geq 0$ is the temperature constant. To scale up the
confidence, $T$ should be less than $1$.

To understand this operation, observe that temperature scaling increases
$g(\cdot)$’s confidence in correct clean examples and incorrect adversarial
examples simultaneously. However, because $g(\cdot)$’s confidence under attack
is already close to $1$ prior to the scaling, the increase in attacked
misprediction confidence is negligible due to the saturation of the Softmax
function. Since $g(\cdot)$ becomes more confident on correct examples with the
mispredicting confidence almost unchanged, its detrimental confidence property
is mitigated.

The extreme selection of $T$ for the temperature scaling operation is $0$, in
which case the predicted probabilities $\sigma\circ g^{\textrm{TS},0}(\cdot)$
becomes a one-hot vector corresponding to $g(\cdot)$’s predicted class. In
addition to mitigating the detrimental confidence property of $g(\cdot)$,
selecting $T=0$ has the additional benefit of simplifying Section 4’s analysis
on the robust base model $h(\cdot)$ by allowing for a direct connection
between $h(\cdot)$’s confidence and the mixed classifier’s correctness. Hence,
we select $T=0$ and use $g^{\textrm{TS},0}(\cdot)$ as the accurate base
classifier for the remaining analyses. Sec. B.2 discusses how our attacks
circumvent the nondifferentiability resulting from using $T=0$. Sec. D.1
verifies that $T=0$ produces the best empirical effectiveness.

A similar temperature scaling operation can be applied to the robust base
classifier $h(\cdot)$. Unlike $g(\cdot)$, $h(\cdot)$’s confidence property is
benign. To fully unleash its potential, we generalize the idea of confidence
modification beyond temperature scaling to allow nonlinear logit
transformations, thereby treating low-confidence and high-confidence examples
differently and amplifying $h(\cdot)$’s benign property, leading to further
mixed classifier accuracy-robustness balance.

##  4 MixedNUTS - Nonlinearly Mixed Classifier

###  4.1 Nonlinear Robust Base Classifier Transformation

We aim to build a nonlinearly mapped classifier $h^{M}(\cdot)\coloneqq
M(h(\cdot))$, where
$M\in{\mathcal{M}}:{\mathbb{R}}^{c}\mapsto{\mathbb{R}}^{c}$ is a nonlinear
transformation applied to the classifier $h(\cdot)$’s logits, and
${\mathcal{M}}$ is the set of all possible transformations. The prediction
probabilities from this transformed robust base model are then mixed with
those from $g^{\textrm{TS},0}(\cdot)$ to form the mixed classifier
$f^{M}(\cdot)$ following Eq. 1. For the optimal accuracy-robustness trade-off,
we select an $M$ that maximizes the clean accuracy of $f^{M}(\cdot)$ while
maintaining the desired robust accuracy. Formally, this goal is described as
the optimization problem

$\displaystyle\max_{M\in{\mathcal{M}},\
\alpha\in[\nicefrac{{1}}{{2}},1]}\;{\mathbb{P}}_{(X,Y)\sim{\mathcal{D}}}\big{[}\operatorname*{arg\,max}_{i}f^{M}_{i}(X)=Y\big{]}$
(2)
$\displaystyle\operatorname{s.t.}\;{\mathbb{P}}_{(X,Y)\sim{\mathcal{D}}}\big{[}\operatorname*{arg\,max}_{i}f^{M}_{i}(X+\delta_{f^{M}}^{\star}(X))=Y\big{]}\geq
r_{f^{M}},$

where ${\mathcal{D}}$ is the distribution of data-label pairs, $r_{f^{M}}$ is
the desired robust accuracy of $f^{M}(\cdot)$, and $\delta_{f^{M}}^{\star}(x)$
is the minimum-margin perturbation of $f^{M}(\cdot)$ at $x$. Note that
$f^{M}_{i}(\cdot)$ implicitly depends on $M$ and $\alpha$.

The problem LABEL:{eq:T_opt_1} depends on the robustness behavior of the mixed
classifier, which is expensive to probe. Ideally, the optimization should only
need the base classifier properties, which can be evaluated beforehand. To
allow such a simplification, we make the following two assumptions.

######  Assumption 4.1.

On unattacked clean data, if $h^{M}(\cdot)$ makes a correct prediction, then
$g(\cdot)$ is also correct.

We make this assumption because the clean accuracy of the accurate base
classifier $g^{\textrm{TS},0}(\cdot)$ should be noticeably higher than that of
the robust base model $h^{M}(\cdot)$ to justify the potential advantage of
mixing them together. In practice, the amount of clean data correctly
predicted by $h^{M}(\cdot)$, but not by $g^{\textrm{TS},0}(\cdot)$, is rare
and does not make significant impact.

######  Assumption 4.2.

The transformation $M(\cdot)$ does not change the predicted class due to,
_e.g._ , monotonicity. Namely, it holds that
$\operatorname*{arg\,max}_{i}M(h(x))_{i}=\operatorname*{arg\,max}_{i}h_{i}(x)$
for all $x$.

We make this assumption because, while it is mathematically possible to find
an $M$ that improves the accuracy of $h(\cdot)$, obtaining it could be as hard
as training a new improved robust model. On the other hand, many relatively
simple transformations can preserve the predicted class of $h(\cdot)$ while
enhancing its benign confidence property, and we will propose Algorithm 1 for
finding such a transformation.

These two assumptions allow us to decouple the optimization of $M(\cdot)$ from
the accurate base classifier $g(\cdot)$. Specifically, we can solve the
following optimization problem as a surrogate for the formulation Eq. 2:

$\displaystyle\min_{M\in{\mathcal{M}},\ \alpha\in[\nicefrac{{1}}{{2}},1]}$
$\displaystyle{\mathbb{P}}_{X\sim{\mathcal{X}}_{ic}}\left[m_{h^{M}}(X)\geq\tfrac{1-\alpha}{\alpha}\right]$
(3) $\displaystyle\operatorname{s.t.}$
$\displaystyle{\mathbb{P}}_{Z\sim{\mathcal{X}}_{ca}}\left[\underline{m}^{\star}_{h^{M}}(Z)\geq\tfrac{1-\alpha}{\alpha}\right]\geq\beta,$

where ${\mathcal{X}}_{ic}$ is the distribution formed by clean examples
incorrectly classified by $h^{M}(\cdot)$, ${\mathcal{X}}_{ca}$ is the
distribution formed by attacked examples correctly classified by
$h^{M}(\cdot)$, $X$, $Z$ are the random variables drawn from these
distributions, and $\beta\in[0,1]$ controls the desired level of robust
accuracy with respect to the robust accuracy of $h(\cdot)$.

Note that Eq. 3 no longer depends on $g(\cdot)$, allowing for replacing the
standard base classifier without re-solving for a new $M(\cdot)$. The
following two theorems justify approximating Eq. 2 with Eq. 3 by
characterizing the optimizers of Eq. 3:

######  Theorem 4.3.

Suppose that 4.2 holds. Let $r_{h}$ denote the robust accuracy of $h(\cdot)$.
If $\beta\geq\nicefrac{{r_{f^{M}}}}{{r_{h}}}$, then a solution to Eq. 3 is
feasible for Eq. 2.

######  Theorem 4.4.

Suppose that 4.1 holds. Furthermore, consider an input random variable $X$ and
suppose that the margin of $h^{M}(X)$ is independent of whether $g(X)$ is
correct. Then, minimizing the objective of Eq. 3 is equivalent to maximizing
the objective of Eq. 2.

The proofs to Theorems 4.3 and 4.4 are provided in Appendices A.1 and A.2,
respectively. The independence assumption in Theorem 4.4 can be relaxed with
minor changes to our method, which we discuss in Section E.3. Also note that
Theorems 4.3 and 4.4 rely on using $T=0$ for the temperature scaling for
$g(\cdot)$, justifying this selection.

###  4.2 Parameterizing the Transformation $M$

Optimizing the nonlinear transformation $M(\cdot)$ requires representing it
with parameters. To avoid introducing additional training requirements or
vulnerable backdoors, the parameterization should be simple (_i.e._ , not
introducing yet another neural network). Thus, we introduce a manually
designed transformation with only three parameters, along with an algorithm to
efficiently optimize the three parameters.

Unlike linear scaling and the Softmax operation, which are shift-agnostic
(_i.e._ , adding a constant to all logits does not change the predicted
probabilities), the desired nonlinear transformations’ behavior heavily
depends on the numerical range of the logits. Thus, to make the nonlinear
transformation controllable and interpretable, we pre-process the logits by
applying layer normalization (LN): for each input $x$, we standardize the
logits $h(x)$ to have zero mean and identity variance. We observe that LN
itself also slightly increases the margin difference between correct and
incorrect examples, favoring our overall formulation as shown in Figure 2.
This phenomenon is further explained in Section E.2.

Among the post-LN logits, only those associated with confidently predicted
classes can be large positive values. To take advantage of this property, we
use a clamping function $\textrm{Clamp}(\cdot)$, such as ReLU, GELU, ELU, or
SoftPlus, to bring the logits smaller than a threshold toward zero. This
clamping operation can further suppress the confidence of small-margin
predictions while preserving large-margin predictions. Since correct examples
often enjoy larger margins, the clamping function enlarges the margin gap
between correct and incorrect examples. We provide an ablation study over
candidate clamping functions in Section D.3 and empirically select GELU for
our experiments.

Finally, since the power functions with greater-than-one exponents diminish
smaller inputs while amplifying larger ones, we exponentiate the clamping
function outputs to a constant power and preserve the sign. The combined
nonlinearly transformed robust base classifier
$\mathchoice{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-7.74998pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-7.3194pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-8.1805pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-7.74998pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-9.47217pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-9.47217pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}(\cdot)$ becomes

$\displaystyle h^{\mathrm{Clamp},c}(x)=$ $\displaystyle\
\mathrm{Clamp}\big{(}\mathrm{LN}(h(x))+c\big{)}$ (4)
$\displaystyle\mathchoice{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-7.74998pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-7.3194pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-8.1805pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-7.74998pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-9.47217pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-9.47217pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}(x)=$ $\displaystyle\
s\cdot\left|h^{\mathrm{Clamp},c}(x)\right|^{p}\cdot\operatorname{sgn}\left(h^{\mathrm{Clamp},c}(x)\right),$
(17)

where $s\in(0,+\infty)$ is a scaling constant, $p\in(0,+\infty)$ is an
exponent constant, and $c\in{\mathbb{R}}$ is a bias constant that adjusts the
cutoff location of the clamping function. We apply the absolute value before
the exponentiation to maintain compatibility with non-integer $p$ values and
use the sign function to preserve the sign. Note that when the clamping
function is linear and $p=1$, Eq. 4 degenerates to temperature scaling with
LN. Hence, the optimal combination of $s$, $c$, $p$ is guaranteed to be no
worse than temperature scaling.

Note that the nonlinear transformation that converts $h(\cdot)$ to
$\mathchoice{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-7.74998pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-7.3194pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-8.1805pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-7.74998pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-9.47217pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-9.47217pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}(\cdot)$ generally adheres to 4.2. While 4.2 may be
slightly violated if GELU is chosen as the clamping function due to its
portion around zero being not monotonic, its effect is empirically very small
according to our observation, partly because the negative slope is very
shallow. We additionally note that the certified robustness results presented
in (Bai et al., 2023a) also apply to the nonlinearly mixed classifiers in this
work.

###  4.3 Efficient Algorithm for Optimizing $s$, $p$, $c$, and $\alpha$

With the nonlinear transformation parameterization in place, the functional-
space optimization problem Eq. 3 reduces to the following algebraic
optimization formulation:

$\displaystyle\min_{s,p,c,\alpha\in{\mathbb{R}}}$
$\displaystyle{\mathbb{P}}_{X\sim{\mathcal{X}}_{ic}}\left[m_{\mathchoice{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.425pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-5.12358pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.72635pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-5.425pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}}(X)\geq\tfrac{1-\alpha}{\alpha}\right]$ (18)
$\displaystyle\operatorname{s.t.}$
$\displaystyle{\mathbb{P}}_{Z\sim{\mathcal{X}}_{ca}}\left[\underline{m}^{\star}_{\mathchoice{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.425pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-5.12358pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.72635pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-5.425pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}}(Z)\geq\tfrac{1-\alpha}{\alpha}\right]\geq\beta,$
$\displaystyle s\geq 0,\;\;\;p\geq 0,\;\;\;\nicefrac{{1}}{{2}}\leq\alpha\leq
1.$

Exactly solving Eq. 18 involves evaluating
$\underline{m}^{\star}_{\mathchoice{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.425pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-5.12358pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.72635pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-5.425pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}}(x)$ for every $x$ in the support of ${\mathcal{X}}_{ca}$,
which is intractable since the support is a continuous set and
${\mathcal{X}}_{ca}$ and ${\mathcal{X}}_{ic}$ implicitly depend on the
optimization variables $s$, $p$, and $c$. To this end, we approximate
${\mathcal{X}}_{ic}$ and ${\mathcal{X}}_{ca}$ with a small set of data.
Consider the subset of clean examples in this set incorrectly classified by
$h^{\mathrm{LN}}(\cdot)$, denoted as $\tilde{{\mathcal{X}}}_{ic}$, and the
subset of attacked examples correctly classified by $h^{\mathrm{LN}}(\cdot)$,
denoted as $\tilde{{\mathcal{X}}}_{ca}$. Using them as surrogates to
${\mathcal{X}}_{ic}$ and ${\mathcal{X}}_{ca}$ decouples the probability
measures from the optimization variables.

Despite optimizing $s$, $p$, $c$, and $\alpha$ on a small set of data,
overfitting is unlikely since there are only four parameters, and thus a small
number of images should suffice. Sec. D.2 analyzes the effect of the data
subset size on optimization quality and confirms the absence of overfitting.

The minimum margin
$\underline{m}^{\star}_{\mathchoice{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.425pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-5.12358pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.72635pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-5.425pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}}(x)$ also depends on the optimization variables $s$, $p$,
$c$, and $\alpha$, as its calculation requires the minimum-margin perturbation
for $\mathchoice{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-7.74998pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-7.3194pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-8.1805pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-7.74998pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-9.47217pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-9.47217pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}(\cdot)$ around $x$. Since finding
$\underline{m}^{\star}_{\mathchoice{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.425pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-5.12358pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.72635pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-5.425pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}}(x)$ for all $s$, $p$, and $c$ combinations is
intractable, we seek to use an approximation that does not depend on $s$, $p$,
and $c$. To this end, we approximate
$\underline{m}^{\star}_{\mathchoice{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.425pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-5.12358pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.72635pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-5.425pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}}(x)$, defined as
$m_{\mathchoice{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.425pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-5.12358pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.72635pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-5.425pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}}\big{(}x+\delta^{\star}_{\mathchoice{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.425pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-5.12358pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.72635pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-5.425pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}}(x)\big{)}$, with the quantity

$\displaystyle\underline{\tilde{m}}_{\mathchoice{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.425pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-5.12358pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.72635pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-5.425pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}}(x)\coloneqq
m_{\mathchoice{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.425pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-5.12358pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.72635pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-5.425pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}}\big{(}x+\tilde{\delta}_{h^{\mathrm{LN}}}(x)\big{)},$

where $\tilde{\delta}_{h^{\mathrm{LN}}}(x)$ is an empirical minimum-margin
perturbation of $h^{\mathrm{LN}}(\cdot)$ around $x$ obtained from a strong
adversarial attack. For this purpose, in Section B.1, we propose _minimum-
margin AutoAttack (MMAA)_ , an AutoAttack variant that keeps track of the
minimum margin while generating perturbations. Note that calculating
$\underline{\tilde{m}}_{\mathchoice{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.425pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-5.12358pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.72635pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-5.425pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}}(x)$ does not require attacking
$\mathchoice{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-7.74998pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-7.3194pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-8.1805pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-7.74998pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-9.47217pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-9.47217pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}(\cdot)$ but instead attacks $h^{\mathrm{LN}}(\cdot)$,
which is independent of the optimization variables.

Since the probability measures and the perturbations are now both decoupled
from $s$, $p$, $c$, $\alpha$, we only need to run MMAA once to estimate the
worst-case perturbation, making this hyperparameter search problem efficiently
solvable. While using $h^{\mathrm{LN}}(\cdot)$ as a surrogate to
$\mathchoice{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-7.74998pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-7.3194pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-8.1805pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-7.74998pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-9.47217pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-9.47217pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}(\cdot)$ introduces a distribution mismatch, we expect this
mismatch to be benign. To understand this, observe that the nonlinear logit
transformation Eq. 4 generally preserves the predicted class due to the
(partially) monotonic characteristics of GELU and the sign-preserving power
function. Consequently, we expect the accuracy and minimum-margin
perturbations of $\mathchoice{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-7.74998pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-7.3194pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-8.1805pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-7.74998pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-9.47217pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-9.47217pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}(\cdot)$ to be very similar to those of
$h^{\mathrm{LN}}(\cdot)$. Section E.4 empirically verifies this speculated
proximity.

To simplify notations, let
$\tilde{{\mathcal{A}}}_{ca}\coloneqq\\{x+\tilde{\delta}_{h^{\mathrm{LN}}}(x):\;x\in\tilde{{\mathcal{X}}}_{ca}\\}$
denote all correctly predicted minimum-margin perturbed images for
$h^{\mathrm{LN}}$. Inherently,
${\mathbb{P}}_{Z\in\tilde{{\mathcal{A}}}_{ca}}\left[m_{\mathchoice{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.425pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-5.12358pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.72635pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-5.425pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}}(Z)\geq\tfrac{1-\alpha}{\alpha}\right]$ equals to
${\mathbb{P}}_{Z\in\tilde{{\mathcal{X}}}_{ca}}\left[\underline{\tilde{m}}_{\mathchoice{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.425pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-5.12358pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.72635pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-5.425pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}}(Z)\geq\tfrac{1-\alpha}{\alpha}\right]$, which then
approximates
${\mathbb{P}}_{Z\sim{\mathcal{X}}_{ca}}\left[\underline{m}^{\star}_{\mathchoice{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.425pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-5.12358pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.72635pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-5.425pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}}(Z)\geq\tfrac{1-\alpha}{\alpha}\right]$. The approximate
hyperparameter selection problem is then

$\displaystyle\min_{s,p,c,\alpha\in{\mathbb{R}}}$
$\displaystyle{\mathbb{P}}_{X\in\tilde{{\mathcal{X}}}_{ic}}\left[m_{\mathchoice{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.425pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-5.12358pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.72635pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-5.425pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}}(X)\geq\tfrac{1-\alpha}{\alpha}\right]$ (19)
$\displaystyle\operatorname{s.t.}$
$\displaystyle{\mathbb{P}}_{Z\in\tilde{{\mathcal{A}}}_{ca}}\left[m_{\mathchoice{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.425pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-5.12358pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.72635pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-5.425pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}}(Z)\geq\tfrac{1-\alpha}{\alpha}\right]\geq\beta,$
$\displaystyle s\geq 0,\;\;\;p\geq 0,\;\;\;\nicefrac{{1}}{{2}}\leq\alpha\leq
1.$

Algorithm 1 Algorithm for optimizing $s$, $p$, $c$, and $\alpha$.

1: Given an image set, save the predicted logits associated with mispredicted
clean images
$\big{\\{}h^{\mathrm{LN}}(x):x\in\tilde{{\mathcal{X}}}_{ic}\big{\\}}$.

2: Run MMAA on $h^{\mathrm{LN}}(\cdot)$ and save the logits of correctly
classified perturbed inputs
$\big{\\{}h^{\mathrm{LN}}(x):x\in\tilde{{\mathcal{A}}}_{ca}\big{\\}}$.

3: Initialize candidate values $s_{1},\ldots,s_{l}$, $p_{1},\ldots,p_{m}$,
$c_{1},\ldots,c_{n}$.

4: for $s_{i}$ for $i=1,\ldots,l$ do

5: for $p_{j}$ for $j=1,\ldots,m$ do

6: for $c_{k}$ for $k=1,\ldots,n$ do

7: Obtain mapped logits
$\big{\\{}\mathchoice{h^{M}\smash{\raisebox{-1.54996pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s_{i}$}\\\\[-6.97498pt] \scalebox{0.9}{$\scriptstyle p_{j}$}\\\\[-6.58745pt]
\scalebox{0.9}{$\scriptstyle
c_{k}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.54996pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s_{i}$}\\\\[-7.36244pt] \scalebox{0.8}{$\scriptstyle p_{j}$}\\\\[-6.97498pt]
\scalebox{0.8}{$\scriptstyle
c_{k}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.77498pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s_{i}$}\\\\[-8.52495pt] \scalebox{0.5}{$\scriptstyle p_{j}$}\\\\[-8.13748pt]
\scalebox{0.5}{$\scriptstyle
c_{k}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.77498pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s_{i}$}\\\\[-8.52495pt] \scalebox{0.5}{$\scriptstyle p_{j}$}\\\\[-8.13748pt]
\scalebox{0.5}{$\scriptstyle
c_{k}$}\end{tabular}}}}(x):x\in\tilde{{\mathcal{A}}}_{ca}\big{\\}}$.

8: Calculate the margins from the mapped logits
$\big{\\{}m_{\mathchoice{h^{M}\smash{\raisebox{-1.08498pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s_{i}$}\\\\[-4.88249pt] \scalebox{0.9}{$\scriptstyle p_{j}$}\\\\[-4.61122pt]
\scalebox{0.9}{$\scriptstyle
c_{k}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.08498pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s_{i}$}\\\\[-5.15372pt] \scalebox{0.8}{$\scriptstyle p_{j}$}\\\\[-4.88249pt]
\scalebox{0.8}{$\scriptstyle
c_{k}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.54248pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s_{i}$}\\\\[-5.96747pt] \scalebox{0.5}{$\scriptstyle p_{j}$}\\\\[-5.69624pt]
\scalebox{0.5}{$\scriptstyle
c_{k}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.54248pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s_{i}$}\\\\[-5.96747pt] \scalebox{0.5}{$\scriptstyle p_{j}$}\\\\[-5.69624pt]
\scalebox{0.5}{$\scriptstyle
c_{k}$}\end{tabular}}}}}(x):x\in\tilde{{\mathcal{A}}}_{ca}\big{\\}}$.

9: Store the bottom $1-\beta$-quantile of the margins as $q_{1-\beta}^{ijk}$
(corresponds to $\frac{1-\alpha}{\alpha}$ in Eq. 19).

10: Record the current objective
$o^{ijk}\leftarrow{\mathbb{P}}_{X\in\tilde{{\mathcal{X}}}_{ic}}\big{[}m_{\mathchoice{h^{M}\smash{\raisebox{-1.08498pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s_{i}$}\\\\[-4.88249pt] \scalebox{0.9}{$\scriptstyle p_{j}$}\\\\[-4.61122pt]
\scalebox{0.9}{$\scriptstyle
c_{k}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.08498pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s_{i}$}\\\\[-5.15372pt] \scalebox{0.8}{$\scriptstyle p_{j}$}\\\\[-4.88249pt]
\scalebox{0.8}{$\scriptstyle
c_{k}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.54248pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s_{i}$}\\\\[-5.96747pt] \scalebox{0.5}{$\scriptstyle p_{j}$}\\\\[-5.69624pt]
\scalebox{0.5}{$\scriptstyle
c_{k}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.54248pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s_{i}$}\\\\[-5.96747pt] \scalebox{0.5}{$\scriptstyle p_{j}$}\\\\[-5.69624pt]
\scalebox{0.5}{$\scriptstyle c_{k}$}\end{tabular}}}}}(X)\geq
q_{1-\beta}^{ijk}\big{]}$.

11: end for

12: end for

13: end for

14: Find optimal indices
$(i^{\star},j^{\star},k^{\star})=\operatorname*{arg\,min}_{i,j,k}o^{ijk}$.

15: Recover optimal mixing weight
$\alpha^{\star}\coloneqq\nicefrac{{1}}{{\left(1+q_{1-\beta}^{i^{\star}j^{\star}k^{\star}}\right)}}$.

16: return $s^{\star}\coloneqq s_{i^{\star}}$, $p^{\star}\coloneqq
p_{j^{\star}}$, $c^{\star}\coloneqq c_{k^{\star}}$, $\alpha^{\star}$.

Since Eq. 19 only has four optimization variables, it can be solved via a grid
search algorithm. Furthermore, the constraint
${\mathbb{P}}_{Z\in\tilde{{\mathcal{A}}}_{ca}}\left[m_{\mathchoice{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.425pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-5.12358pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.72635pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-5.425pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}}(Z)\geq\tfrac{1-\alpha}{\alpha}\right]\geq\beta$ should
always be active at optimality. To understand this, suppose that for some
combination of $s$, $p$, $c$, and $\alpha$, this inequality is satisfied
strictly. Then, it will be possible to decrease $\alpha$ (i.e., increase
$\frac{1-\alpha}{\alpha}$) without violating this constraint, and thereby
decrease the objective function. Hence, we can treat this constraint as
equality, reducing the degrees of freedom to three. Specifically, we sweep
over a range of $s$, $p$, and $c$ to form a three-dimensional grid, and select
the $\alpha$ value that binds the chance constraint. Then, we select an $s$,
$p$, $c$ combination that minimizes the objective from this grid.

The resulting algorithm is Algorithm 1. As discussed above, this algorithm
only needs to query MMAA’s APGD components once on a small set of data, and
all other steps are simple mathematical operations. Hence, Algorithm 1 is
efficiently solvable. Also note that it is not necessary to solve Eq. 19 to a
very high accuracy due to the discrete nature of the approximated objective
function. Thus, the number of candidate values for $s$, $p$, and $c$ can be
small, and Algorithm 1 is highly efficient despite the triply nested loop
structure. Sec. D.2 reports the run time of Algorithm 1.

##  5 Experiments

We use extensive experiments to demonstrate the accuracy-robustness balance
achieved by the MixedNUTS classifier

$\mathchoice{f^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-7.74998pt] \scalebox{0.9}{$\scriptstyle
p^{\star}$}\\\\[-7.3194pt] \scalebox{0.9}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{f^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-8.1805pt] \scalebox{0.8}{$\scriptstyle
p^{\star}$}\\\\[-7.74998pt] \scalebox{0.8}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{f^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-9.47217pt] \scalebox{0.5}{$\scriptstyle
p^{\star}$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{f^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-9.47217pt] \scalebox{0.5}{$\scriptstyle
p^{\star}$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c^{\star}$}\end{tabular}}}}(x)\coloneqq\log\big{(}(1-\alpha)g^{\textrm{TS},0}(x)+\alpha\mathchoice{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-7.74998pt] \scalebox{0.9}{$\scriptstyle
p^{\star}$}\\\\[-7.3194pt] \scalebox{0.9}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-8.1805pt] \scalebox{0.8}{$\scriptstyle
p^{\star}$}\\\\[-7.74998pt] \scalebox{0.8}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-9.47217pt] \scalebox{0.5}{$\scriptstyle
p^{\star}$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-9.47217pt] \scalebox{0.5}{$\scriptstyle
p^{\star}$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c^{\star}$}\end{tabular}}}}(x)\big{)},$ (20)

especially focusing on the effectiveness of the nonlinear logit
transformation. We validate our proposed method on the CIFAR-10 (Krizhevsky,
2012), CIFAR-100 (Krizhevsky, 2012), and ImageNet (Deng et al., 2009)
datasets. For each dataset, we select the corresponding state-of-the-art model
with the highest robust accuracy verified on RobustBench (Croce et al., 2020)
as the robust base classifier $h(\cdot)$, and select a state-of-the-art
standard (non-robust) model enhanced with extra training data as the accurate
base classifier $g(\cdot)$. All mixed classifiers are evaluated with a custom
strengthened adaptive AutoAttack algorithm specialized in attacking MixedNUTS
and do not manifest gradient obfuscation issues, with the details explained in
Sec. B.2.

###  5.1 Main Experiment Results

Figure 1: MixedNUTS balances the robustness from its robust base classifier
and the accuracy from its standard base classifier. The nonlinear logit
transformation helps MixedNUTS achieve a much better accuracy-robust trade-off
than a baseline mixed model without transformation. Section E.1 reports the
base model details and the optimal $s$, $p$, $c$, $\alpha$ values. Table 1:
MixedNUTS’s accuracy compared with state-of-the-art classifiers. “AA”
abbreviates AutoAttacked accuracy.

CIFAR-10

Model Mixed |  Clean $(\uparrow)$ |  AA $(\uparrow)$
---|---|---
This work | ✓ | $95.19\%$ | $69.71\%$
Peng et al. (2023) | ✗ | $93.27\%$ | $71.07\%$
Bai et al. (2023a) | ✓ | $95.23\%$ | $68.06\%$
Rebuffi et al. (2021) | ✗ | $92.23\%$ | $66.58\%$
Kolesnikov et al. (2020) | ✗ | $98.50\%$ | $0.00\%$

CIFAR-100

Model Mixed |  Clean $(\uparrow)$ |  AA $(\uparrow)$
---|---|---
This work | ✓ | $83.08\%$ | $41.80\%$
Wang et al. (2023) | ✗ | $75.22\%$ | $42.67\%$
Bai et al. (2023a) | ✓ | $85.21\%$ | $38.72\%$
Gowal et al. (2020) | ✗ | $69.15\%$ | $36.88\%$
Kolesnikov et al. (2020) | ✗ | $91.38\%$ | $0.00\%$

Table 2: MixedNUTS’s error rate change relative to the robust base classifier (more negative is better). |  Clean ($\downarrow$) |  Robust (AutoAttack) ($\downarrow$)
---|---|---
CIFAR-10 | $-28.53\%$ | $+4.70\%$
CIFAR-100 | $-31.72\%$ | $+1.52\%$
ImageNet | $-12.14\%$ | $+2.62\%$
Figure 2: The median confidence margin of the accurate/robust base classifier
$g(\cdot)$/$h(\cdot)$, the layer-normed logits $h^{\mathrm{LN}}(\cdot)$, and
the nonlinearly transformed model
$\mathchoice{h^{M}\smash{\raisebox{-1.54996pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-6.97498pt] \scalebox{0.9}{$\scriptstyle
p^{\star}$}\\\\[-6.58745pt] \scalebox{0.9}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.54996pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-7.36244pt] \scalebox{0.8}{$\scriptstyle
p^{\star}$}\\\\[-6.97498pt] \scalebox{0.8}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.77498pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-8.52495pt] \scalebox{0.5}{$\scriptstyle
p^{\star}$}\\\\[-8.13748pt] \scalebox{0.5}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.77498pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-8.52495pt] \scalebox{0.5}{$\scriptstyle
p^{\star}$}\\\\[-8.13748pt] \scalebox{0.5}{$\scriptstyle
c^{\star}$}\end{tabular}}}}(\cdot)$ on clean and AutoAttacked data, grouped by
prediction correctness. The number above each bar group is the “margin gap”,
defined as the difference between the medians on clean incorrect inputs and
AutoAttacked correct ones. A higher margin gap signals more benign confidence
property, and thus better accuracy-robustness trade-off for the mixed
classifier.

The comparisons among Robust Base Classifier (RBC), Accurate Base Classifier
(ABC), as well as the baseline method Mixed (Bai et al., 2023b) on the three
datasets are shown in Figure 1. The results confirm that MixedNUTS
consistently achieves higher clean accuracy and better robustness than a mixed
classifier without the nonlinear logit transformation, demonstrating that the
transformation mitigates the accuracy-robustness trade-off. By quantitatively
comparing MixedNUTS with its robust base classifier $h(\cdot)$, Table 2 shows
that mixing classifiers with the nonlinear transformation significantly
reduces the clean error rate while incurring a small robust error rate
increase. Clearly, MixedNUTS balances accuracy and robustness _without
additional training_.

Meanwhile, Figure 2 compares the robust base classifier’s confidence margins
on clean and attacked data with or without our nonlinear logit transformation
Eq. 4. For each dataset, the transformation enlarges the margin gap between
correct and incorrect predictions, especially in terms of the median which
represents the margin majority. Using
$\mathchoice{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-7.74998pt] \scalebox{0.9}{$\scriptstyle
p^{\star}$}\\\\[-7.3194pt] \scalebox{0.9}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-8.1805pt] \scalebox{0.8}{$\scriptstyle
p^{\star}$}\\\\[-7.74998pt] \scalebox{0.8}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-9.47217pt] \scalebox{0.5}{$\scriptstyle
p^{\star}$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-9.47217pt] \scalebox{0.5}{$\scriptstyle
p^{\star}$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c^{\star}$}\end{tabular}}}}(\cdot)$ instead of $h(\cdot)$ makes correct
predictions more confident while keeping the mispredictions less confident,
making the mixed classifier more accurate without losing robustness.

With the nonlinear transformation in place, it is still possible to adjust the
emphasis between clean and robust accuracy at inference time. This can be
achieved by simply re-running Algorithm 1 with a different $\beta$ value. Note
that the MMAA step in Algorithm 1 does not depend on $\beta$, and hence can be
cached to speed up re-runs. Meanwhile, the computational cost of the rest of
Algorithm 1 is marginal. Our experiments use $\beta=98.5\%$ for CIFAR-10 and
-100, and use $\beta=99.0\%$ for ImageNet. The optimal $s$, $p$, $c$ values
and the searching grid used in Algorithm 1 are discussed in Section E.1.

Table 1 compares MixedNUTS with existing methods that achieve the best
AutoAttack-validated adversarial robustness. MixedNUTS noticeably improves
clean accuracy while still maintaining competitive robustness. Note that since
MixedNUTS can use existing or future improved accurate or robust models as
base classifiers, the entries of Table 1 should not be regarded as pure
competitors.

Figure 3: The median confidence margin of a diverse set of existing robust
models with the logits standardized via layer normalization. These models all
enjoy higher margins on correct predictions than on incorrect ones, for clean
and adversarial inputs alike. The percentages below each model name are the
clean/AutoAttacked accuracy.

Existing models suffer from the most pronounced accuracy-robustness trade-off
on CIFAR-100, where MixedNUTS offers the most prominent improvement, boosting
the clean accuracy by 7.86 percentage points over the state-of-the-art non-
mixing robust model while reducing merely 0.87 points in robust accuracy. In
comparison, the previous mixing method (Bai et al., 2023a) sacrifices 3.95
points of robustness (4.5x MixedNUTS’s degradation) to achieve a 9.99-point
clean accuracy bump using the same set of base models. Moreover, (Bai et al.,
2023a) requires training an additional mixing network component, whereas
MixedNUTS is training-free (MixedNUTS is also compatible with the mixing
network for even better results). Clearly, MixedNUTS utilizes the robustness
of $h(\cdot)$ more effectively and efficiently. On CIFAR-10 and ImageNet,
achieving robustness against the common attack budget ($\nicefrac{{8}}{{255}}$
and $\nicefrac{{4}}{{255}}$ respectively) penalizes the clean accuracy less
severely than on CIFAR-100. Nonetheless, MixedNUTS is still effective in these
less suitable cases, reducing the clean error rate by $28.53\%$/$12.14\%$
(relative) while only sacrificing $1.91\%$/$0.98\%$ (relative) robust accuracy
on CIFAR-10/ImageNet compared to non-mixing methods. On CIFAR-10, MixedNUTS
matches (Bai et al., 2023a)’s clean accuracy while reducing the robust error
rate by $5.17\%$ (relative).

###  5.2 Confidence Properties of Various Robust Models

MixedNUTS is built upon the observation that robust models are more confident
in correct predictions than incorrect ones. Figure 3 confirms this property
across existing models with diverse structures trained with different loss
functions across various datasets, and hence MixedNUTS is applicable for a
wide range of base model combinations. For a fair confidence margin
comparison, all logits are standardized to zero mean and identity variance
(corresponding to $h^{\mathrm{LN}}(\cdot)$) before converted to probabilities.
Section C.1 presents histograms to offer more margin distribution details.

Figure 3 illustrates that existing CIFAR-10 and -100 models have tiny
confidence margins for mispredictions and moderate margins for correct
predictions, implying that most mispredictions have a close runner-up class.
Compared to CIFAR models, ImageNet classifiers have higher overall margins,
with the property of more confidence in correct predictions than incorrect
ones still present. Since the logits are standardized before Softmax, the
higher overall confidence suggests that ImageNet models often do not have a
strong confounding class despite having more classes, and their non-predicted
classes’ probabilities spread more evenly.

###  5.3 Accuracy-Robustness Trade-Off Curves

Figure 4: Accuracy-robustness trade-off comparison between MixedNUTS, mixed
classifier without nonlinear transformation, and TRADES on 1000 CIFAR-10
images.

Figure 4 displays the robust accuracy of MixedNUTS as a function of its clean
accuracy and compares this accuracy-robustness trade-off curve with that of
the mixed classifier without nonlinear logit transformation (as designed in
(Bai et al., 2023b)) and that of TRADES, a popular adjustable method that aims
to improve the trade-off (Zhang et al., 2019). For TRADES, adjusting between
accuracy and robustness requires modifying a $\beta_{\textrm{TR}}$ parameter
in the loss function and training a new model. Figure 4 selects CIFAR-10
WRN-34-10 models trained with $\beta_{\textrm{TR}}=0,0.1,0.3,6$, where $0$
corresponds to standard (non-robust) training and $6$ achieves the best
robustness. For a fair comparison, we select the models with
$\beta_{\textrm{TR}}=0$ and $6$ as the mixed classifiers’ base models. Figure
4 confirms that both mixed classifiers achieve much more benign trade-offs
than TRADES without re-training the model. Furthermore, MixedNUTS balances
accuracy and robustness better than (Bai et al., 2023b).

##  6 Conclusions

This work proposes MixedNUTS, a versatile training-free method that combines
the output probabilities of a robust classifier and an accurate classifier. By
introducing nonlinear base model logit transformations, MixedNUTS more
effectively exploits the benign confidence property of the robust base
classifier, thereby achieving a balance between clean data classification
accuracy and adversarial robustness. For performance-driven practitioners,
this balance implies less to lose in using robust models, incentivizing the
real-world deployment of safe deep learning systems. For researchers, as
improving the accuracy-robustness trade-off with a single model becomes
harder, MixedNUTS identifies building base models with better margin
properties as an alternative to improve the trade-off in an ensemble setting.

## References

  * Adam & Speciel (2020) Adam, G. and Speciel, R.  Evaluating ensemble robustness against adversarial attacks.  _arXiv preprint arXiv:2005.05750_ , 2020.
  * Alam et al. (2022) Alam, M., Datta, S., Mukhopadhyay, D., Mondal, A., and Chakrabarti, P. P.  Resisting adversarial attacks in deep neural networks using diverse decision boundaries.  _arXiv preprint arXiv:2208.08697_ , 2022.
  * Andriushchenko et al. (2020) Andriushchenko, M., Croce, F., Flammarion, N., and Hein, M.  Square attack: A query-efficient black-box adversarial attack via random search.  In _European Conference on Computer Vision_ , 2020.
  * Athalye et al. (2018) Athalye, A., Engstrom, L., Ilyas, A., and Kwok, K.  Synthesizing robust adversarial examples.  In _International Conference on Machine Learning_ , 2018.
  * Bai et al. (2022) Bai, Y., Gautam, T., Gai, Y., and Sojoudi, S.  Practical convex formulation of robust one-hidden-layer neural network training.  In _American Control Conference_ , 2022.
  * Bai et al. (2023a) Bai, Y., Anderson, B. G., Kim, A., and Sojoudi, S.  Improving the accuracy-robustness trade-off of classifiers via adaptive smoothing.  _arXiv preprint arXiv:2301.12554_ , 2023a.
  * Bai et al. (2023b) Bai, Y., Anderson, B. G., and Sojoudi, S.  Mixing classifiers to alleviate the accuracy-robustness trade-off.  _arXiv preprint arXiv:2311.15165_ , 2023b.
  * Bai et al. (2023c) Bai, Y., Gautam, T., and Sojoudi, S.  Efficient global optimization of two-layer relu networks: Quadratic-time algorithms and adversarial training.  _SIAM Journal on Mathematics of Data Science_ , 2023c.
  * Balaji et al. (2019) Balaji, Y., Goldstein, T., and Hoffman, J.  Instance adaptive adversarial training: Improved accuracy tradeoffs in neural nets.  _arXiv preprint arXiv:1910.08051_ , 2019.
  * Borkar & Chen (2021) Borkar, J. and Chen, P.-Y.  Simple transparent adversarial examples.  _arXiv preprint arXiv:2105.09685_ , 2021.
  * Carlini & Wagner (2017) Carlini, N. and Wagner, D. A.  Towards evaluating the robustness of neural networks.  In _IEEE Symposium on Security and Privacy_ , 2017.
  * Chen et al. (2020) Chen, T., Zhang, Z., Liu, S., Chang, S., and Wang, Z.  Robust overfitting may be mitigated by properly learned smoothening.  In _International Conference on Learning Representations_ , 2020.
  * Cheng et al. (2022) Cheng, M., Lei, Q., Chen, P. Y., Dhillon, I., and Hsieh, C. J.  CAT: Customized adversarial training for improved robustness.  In _International Joint Conference on Artificial Intelligence_ , 2022\.
  * Co et al. (2022) Co, K. T., Martinez-Rego, D., Hau, Z., and Lupu, E. C.  Jacobian ensembles improve robustness trade-offs to adversarial attacks.  In _Artificial Neural Networks and Machine Learning_ , 2022.
  * Croce & Hein (2020) Croce, F. and Hein, M.  Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks.  In _International Conference on Machine Learning_ , 2020.
  * Croce et al. (2020) Croce, F., Andriushchenko, M., Sehwag, V., Debenedetti, E., Flammarion, N., Chiang, M., Mittal, P., and Hein, M.  Robustbench: a standardized adversarial robustness benchmark.  _arXiv preprint arXiv:2010.09670_ , 2020.
  * Cui et al. (2023) Cui, J., Tian, Z., Zhong, Z., Qi, X., Yu, B., and Zhang, H.  Decoupled kullback-leibler divergence loss.  _arXiv preprint arXiv:2305.13948_ , 2023.
  * Debenedetti et al. (2022) Debenedetti, E., Sehwag, V., and Mittal, P.  A light recipe to train robust vision transformers.  _arXiv preprint arXiv:2209.07399_ , 2022.
  * Deng et al. (2009) Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L.  ImageNet: A large-scale hierarchical image database.  In _IEEE Conference on Computer Vision and Pattern Recognition_ , 2009\.
  * Ganaie et al. (2022) Ganaie, M. A., Hu, M., Malik, A., Tanveer, M., and Suganthan, P.  Ensemble deep learning: A review.  _Engineering Applications of Artificial Intelligence_ , 115:105151, 2022.
  * Goodfellow et al. (2015) Goodfellow, I. J., Shlens, J., and Szegedy, C.  Explaining and harnessing adversarial examples.  In _International Conference on Learning Representations_ , 2015.
  * Gowal et al. (2019) Gowal, S., Uesato, J., Qin, C., Huang, P.-S., Mann, T., and Kohli, P.  An alternative surrogate loss for pgd-based adversarial testing.  _arXiv preprint arXiv:1910.09338_ , 2019.
  * Gowal et al. (2020) Gowal, S., Qin, C., Uesato, J., Mann, T., and Kohli, P.  Uncovering the limits of adversarial training against norm-bounded adversarial examples.  _arXiv preprint arXiv:2010.03593_ , 2020.
  * Gowal et al. (2021) Gowal, S., Rebuffi, S.-A., Wiles, O., Stimberg, F., Calian, D. A., and Mann, T.  Improving robustness using generated data.  _arXiv preprint arXiv:2110.09468_ , 2021.
  * Guo et al. (2017) Guo, C., Pleiss, G., Sun, Y., and Weinberger, K. Q.  On calibration of modern neural networks.  In _International Conference on Machine Learning_ , 2017.
  * Hinton et al. (2015) Hinton, G., Vinyals, O., and Dean, J.  Distilling the knowledge in a neural network.  _arXiv preprint arXiv:1503.02531_ , 2015.
  * Ilyas et al. (2018) Ilyas, A., Engstrom, L., Athalye, A., and Lin, J.  Black-box adversarial attacks with limited queries and information.  In _International Conference on Machine Learning_ , 2018.
  * Kolesnikov et al. (2020) Kolesnikov, A., Beyer, L., Zhai, X., Puigcerver, J., Yung, J., Gelly, S., and Houlsby, N.  Big transfer (BiT): General visual representation learning.  In _European Conference on Computer Vision_ , 2020.
  * Krizhevsky (2012) Krizhevsky, A.  Learning multiple layers of features from tiny images.  https://www.cs.toronto.edu/~kriz/learning-features-2009-TR.pdf, 2012\.
  * Li et al. (2023) Li, L., Wang, Y., Sitawarin, C., and Spratling, M.  Oodrobustbench: benchmarking and analyzing adversarial robustness under distribution shift.  _arXiv preprint arXiv:2310.12793_ , 2023.
  * Liu et al. (2023) Liu, C., Dong, Y., Xiang, W., Yang, X., Su, H., Zhu, J., Chen, Y., He, Y., Xue, H., and Zheng, S.  A comprehensive study on robustness of image classification models: Benchmarking and rethinking.  _arXiv preprint arXiv:2302.14301_ , 2023.
  * Liu & Zhao (2022) Liu, F. and Zhao, R.  Towards both accurate and robust neural networks without extra data.  In _International Conference on Artificial Neural Networks_ , 2022\.
  * Liu et al. (2019) Liu, J., Paisley, J., Kioumourtzoglou, M.-A., and Coull, B.  Accurate uncertainty estimation and decomposition in ensemble learning.  In _Advances in Neural Information Processing Systems_ , 2019.
  * Madry et al. (2018) Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A.  Towards deep learning models resistant to adversarial attacks.  In _International Conference on Learning Representations_ , 2018.
  * Na (2020) Na, D.  Pytorch adversarial training on cifar-10.  https://github.com/ndb796/Pytorch-Adversarial-Training-CIFAR, 2020\.
  * Pang et al. (2019) Pang, T., Xu, K., Du, C., Chen, N., and Zhu, J.  Improving adversarial robustness via promoting ensemble diversity.  In _International Conference on Machine Learning_ , 2019.
  * Pang et al. (2022) Pang, T., Lin, M., Yang, X., Zhu, J., and Yan, S.  Robustness and accuracy could be reconcilable by (proper) definition.  _arXiv preprint arXiv:2202.10103_ , 2022.
  * Papernot et al. (2017) Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z. B., and Swami, A.  Practical black-box attacks against machine learning.  In _ACM Asia Conference on Computer and Communications Security_ , 2017.
  * Peng et al. (2023) Peng, S., Xu, W., Cornelius, C., Hull, M., Li, K., Duggal, R., Phute, M., Martin, J., and Chau, D. H.  Robust principles: Architectural design principles for adversarially robust CNNs.  _arXiv preprint arXiv:2308.16258_ , 2023.
  * Petrov et al. (2023) Petrov, A., Eiras, F., Sanyal, A., Torr, P. H., and Bibi, A.  Certifying ensembles: A general certification theory with S-Lipschitzness.  _arXiv preprint arXiv:2304.13019_ , 2023.
  * Rade & Moosavi-Dezfooli (2021) Rade, R. and Moosavi-Dezfooli, S.-M.  Helper-based adversarial training: Reducing excessive margin to achieve a better accuracy vs. robustness trade-off.  In _ICML 2021 Workshop on Adversarial Machine Learning_ , 2021.
  * Raghunathan et al. (2020) Raghunathan, A., Xie, S. M., Yang, F., Duchi, J. C., and Liang, P.  Understanding and mitigating the tradeoff between robustness and accuracy.  In _International Conference on Machine Learning_ , 2020.
  * Rebuffi et al. (2021) Rebuffi, S.-A., Gowal, S., Calian, D. A., Stimberg, F., Wiles, O., and Mann, T.  Fixing data augmentation to improve adversarial robustness.  _arXiv preprint arXiv:2103.01946_ , 2021.
  * Sehwag et al. (2022) Sehwag, V., Mahloujifar, S., Handina, T., Dai, S., Xiang, C., Chiang, M., and Mittal, P.  Robust learning meets generative models: Can proxy distributions improve adversarial robustness?  In _International Conference on Learning Representations_ , 2022.
  * Shafahi et al. (2019) Shafahi, A., Najibi, M., Ghiasi, M. A., Xu, Z., Dickerson, J., Studer, C., Davis, L. S., Taylor, G., and Goldstein, T.  Adversarial training for free!  In _Annual Conference on Neural Information Processing Systems_ , 2019\.
  * Singh et al. (2023) Singh, N. D., Croce, F., and Hein, M.  Revisiting adversarial training for imagenet: Architectures, training and generalization across threat models.  _arXiv preprint arXiv:2303.01870_ , 2023.
  * Tramèr et al. (2020) Tramèr, F., Carlini, N., Brendel, W., and Madry, A.  On adaptive attacks to adversarial example defenses.  In _Annual Conference on Neural Information Processing Systems_ , 2020\.
  * Tsipras et al. (2019) Tsipras, D., Santurkar, S., Engstrom, L., Turner, A., and Madry, A.  Robustness may be at odds with accuracy.  In _International Conference on Learning Representations_ , 2019.
  * Wang et al. (2023) Wang, Z., Pang, T., Du, C., Lin, M., Liu, W., and Yan, S.  Better diffusion models further improve adversarial training.  _arXiv preprint arXiv:2302.04638_ , 2023.
  * Woo et al. (2023) Woo, S., Debnath, S., Hu, R., Chen, X., Liu, Z., Kweon, I. S., and Xie, S.  ConvNeXt V2: Co-designing and scaling convnets with masked autoencoders.  In _IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , 2023.
  * Yang et al. (2022) Yang, Z., Li, L., Xu, X., Kailkhura, B., Xie, T., and Li, B.  On the certified robustness for ensemble models and beyond.  In _International Conference on Learning Representations_ , 2022.
  * Yu et al. (2022) Yu, Y., Bates, S., Ma, Y., and Jordan, M.  Robust calibration with multi-domain temperature scaling.  2022\.
  * Zhang et al. (2019) Zhang, H., Yu, Y., Jiao, J., Xing, E. P., Ghaoui, L. E., and Jordan, M. I.  Theoretically principled trade-off between robustness and accuracy.  In _International Conference on Machine Learning_ , 2019.

##  Appendix A Proofs

###  A.1 Proof to Theorem 4.3

######  Theorem 4.3 (restated).

Suppose that 4.2 holds. Let $r_{h}$ denote the robust accuracy of $h(\cdot)$.
If $\beta\geq\nicefrac{{r_{f^{M}}}}{{r_{h}}}$, then a solution to Eq. 3 is
feasible for Eq. 2.

###### Proof.

Suppose that $M(\cdot)$ is a solution from Eq. 3. Since the mixed classifier
$f^{M}(\cdot)$ is by construction guaranteed to be correct and robust at some
$x$ if $h^{M}(\cdot)$ is correct and robust with a margin no smaller than
$\frac{1-\alpha}{\alpha}$ at $x$, it holds that

$\displaystyle{\mathbb{P}}_{(X,Y)\sim{\mathcal{D}}}\big{[}\operatorname*{arg\,max}_{i}f^{M}_{i}(X+\delta_{f^{M}}^{\star}(X))=Y\big{]}\geq$
$\displaystyle{\mathbb{P}}_{(X,Y)\sim{\mathcal{D}}}\big{[}m_{h^{M}_{i}}(X+\delta_{f^{M}}^{\star}(X))\geq\tfrac{1-\alpha}{\alpha},\
H_{\textrm{cor}}(X)\big{]}$ $\displaystyle=$
$\displaystyle{\mathbb{P}}_{(X,Y)\sim{\mathcal{D}}}\big{[}m_{h^{M}_{i}}(X+\delta_{f^{M}}^{\star}(X))\geq\tfrac{1-\alpha}{\alpha}\big{|}H^{M}_{\textrm{cor}}(X)\big{]}\cdot{\mathbb{P}}_{(X,Y)\sim{\mathcal{D}}}[H^{M}_{\textrm{cor}}(X)],$

where $H_{\textrm{cor}}(X)$ denotes the event of $h(\cdot)$ being correct at
$X$, i.e., $\operatorname*{arg\,max}_{i}h_{i}(X+\delta_{f^{M}}^{\star}(X))=Y$.
Similarly, $H^{M}_{\textrm{cor}}(X)$ denotes
$\operatorname*{arg\,max}_{i}h^{M}_{i}(X+\delta_{f^{M}}^{\star}(X))=Y$. Under
4.2, $H_{\textrm{cor}}(X)$ is equivalent to $H^{M}_{\textrm{cor}}(X)$.
Therefore,

$\displaystyle{\mathbb{P}}_{(X,Y)\sim{\mathcal{D}}}\big{[}\operatorname*{arg\,max}_{i}f^{M}_{i}(X+\delta_{f^{M}}^{\star}(X))=Y\big{]}=$
$\displaystyle{\mathbb{P}}_{(X,Y)\sim{\mathcal{D}}}\big{[}m_{h^{M}_{i}}(X+\delta_{f^{M}}^{\star}(X))\geq\tfrac{1-\alpha}{\alpha}\big{|}H_{\textrm{cor}}(X)\big{]}\cdot{\mathbb{P}}_{(X,Y)\sim{\mathcal{D}}}[H_{\textrm{cor}}(X)]$
$\displaystyle=$ $\displaystyle
r_{h}\cdot{\mathbb{P}}_{X\sim{\mathcal{X}}_{ca}}\big{[}m_{h^{M}_{i}}(X+\delta_{f^{M}}^{\star}(X))\geq\tfrac{1-\alpha}{\alpha}\big{]}$
$\displaystyle\geq$ $\displaystyle
r_{h}\cdot{\mathbb{P}}_{Z\sim{\mathcal{X}}_{ca}}\left[\underline{m}^{\star}_{h^{M}}(Z)\geq\tfrac{1-\alpha}{\alpha}\right]\geq
r_{h}\cdot\beta\geq r_{f^{M}},$

which proves the statement. ∎

###  A.2 Proof to Theorem 4.4

######  Theorem 4.4 (restated).

Suppose that 4.1 holds. Furthermore, consider an input random variable $X$ and
suppose that the margin of $h^{M}(X)$ is independent of whether $g(X)$ is
correct. Then, minimizing the objective of Eq. 3 is equivalent to maximizing
the objective of Eq. 2.

###### Proof.

By construction, for an clean input $x$ incorrectly classified by
$h^{M}(\cdot)$, i.e., $x$ is in the support of ${\mathcal{X}}_{ic}$, the mixed
classifier prediction $f(x)$ is correct if and only if $g^{\textrm{TS},0}(x)$
is correct and $h^{M}(x)$’s margin is no greater than
$\frac{1-\alpha}{\alpha}$. Let $G_{\textrm{cor}}(X)$ denote the event of
$g(X)$ being correct, i.e.,
$\operatorname*{arg\,max}_{i}g^{\textrm{TS},0}(X)=Y$. Furthermore, let
${\mathcal{D}}_{ic}$ denote the data-label distribution formed by clean
examples incorrectly predicted by $h^{M}(\cdot)$. Then,

$\displaystyle{\mathbb{P}}_{(X,Y)\sim{\mathcal{D}}_{ic}}\big{[}\operatorname*{arg\,max}_{i}f^{M}_{i}(X)=Y\big{]}=$
$\displaystyle{\mathbb{P}}_{X\sim{\mathcal{X}}_{ic}}\left[m_{h^{M}}(X)<\tfrac{1-\alpha}{\alpha},G_{\textrm{cor}}(X)\right]$
$\displaystyle=$
$\displaystyle{\mathbb{P}}_{X\sim{\mathcal{X}}_{ic}}\left[m_{h^{M}}(X)<\tfrac{1-\alpha}{\alpha}|G_{\textrm{cor}}(X)\right]\cdot{\mathbb{P}}_{X\sim{\mathcal{X}}_{ic}}\left[G_{\textrm{cor}}(X)\right]$

for all transformations $M$ and mixing weight $\alpha$ (recall that
$f^{M}(\cdot)$ depends on $\alpha$).

Suppose that the margin of $h^{M}(\cdot)$ is independent from the accuracy of
$g(\cdot)$, then the above probability further equals to

$\displaystyle\left(1-{\mathbb{P}}_{X\sim{\mathcal{X}}_{ic}}\left[m_{h^{M}}(X)\geq\tfrac{1-\alpha}{\alpha}\right]\right)\cdot{\mathbb{P}}_{X\sim{\mathcal{X}}_{ic}}\left[G_{\textrm{cor}}(X)\right]$

Since ${\mathbb{P}}_{X\sim{\mathcal{X}}_{ic}}\left[G_{\textrm{cor}}(X)\right]$
does not depend on $M$ or $\alpha$, it holds that

$\displaystyle\operatorname*{arg\,min}_{M\in{\mathcal{M}},\
\alpha\in[\nicefrac{{1}}{{2}},1]}{\mathbb{P}}_{X\sim{\mathcal{X}}_{ic}}\left[m_{h^{M}}(X)\geq\tfrac{1-\alpha}{\alpha}\right]=$
$\displaystyle\operatorname*{arg\,max}_{M\in{\mathcal{M}},\
\alpha\in[\nicefrac{{1}}{{2}},1]}{\mathbb{P}}_{(X,Y)\sim{\mathcal{D}}_{ic}}\big{[}\operatorname*{arg\,max}_{i}f^{M}_{i}(X)=Y\big{]}$
$\displaystyle=$ $\displaystyle\operatorname*{arg\,max}_{M\in{\mathcal{M}},\
\alpha\in[\nicefrac{{1}}{{2}},1]}{\mathbb{P}}_{(X,Y)\sim{\mathcal{D}}}\big{[}\operatorname*{arg\,max}_{i}f^{M}_{i}(X)=Y\big{]},$

where the last equality holds because under 4.1, $h^{M}(x)$ being correct
guarantees $g^{\textrm{TS},0}(x)$’s correctness. Since $f^{M}(\cdot)$ must be
correct when $h^{M}(x)$ and $g^{\textrm{TS},0}(x)$ are both correct, the mixed
classifier must be correct at clean examples correctly classified by
$h^{M}(\cdot)$. Hence, maximizing $f^{M}(\cdot)$’s clean accuracy on
$h^{M}(\cdot)$’s mispredictions is equivalent to maximizing $f^{M}(\cdot)$’s
overall clean accuracy. ∎

##  Appendix B Custom Attack Algorithms

###  B.1 Minimum-Margin AutoAttack

Our margin-based hyperparameter selection procedure (Algorithm 1) and
confidence margin estimation experiments (Figures 2 and 3) require
approximating the minimum-margin perturbations associated with the robust base
classifier in order to analyze the mixed classifier behavior. Approximating
these perturbations requires a strong attack algorithm. While AutoAttack is
often regarded as a strong adversary that reliably evaluates model robustness,
its original implementation released with (Croce & Hein, 2020) does not return
all perturbed examples. Specifically, traditional AutoAttack does not record
the perturbation around an input if it deems the model to be robust at this
input (i.e., model prediction does not change). While this is acceptable for
estimating robust accuracy, it forbids the calculation of correctly predicted
AutoAttacked examples’ confidence margins, which are required by Algorithm 1,
Figure 2, and Figure 3.

To construct a strong attack algorithm compatible with margin estimation, we
propose _minimum-margin AutoAttack (MMAA)_. Specifically, we modify the two
APGD components of AutoAttack (untargeted APGD-CE and targeted APGD-DLR) to
keep track of the margin at each attack step (the margin history is shared
across the two components) and always return the perturbation achieving the
smallest margin. The FAB and Square components of AutoAttack are much slower
than the two APGD components, and for our base classifiers, FAB and Square
rarely succeed in altering the model predictions for images that APGD attacks
fail to attack. Therefore, we exclude them for the purpose of margin
estimation (but include them for the robustness evaluation of MixedNUTS).

###  B.2 Attacks for Nonlinearly Mixed Classifier Robustness Evaluation

When proposing a novel adversarially robust model, reliably measuring its
robustness with strong adversaries is always a top priority. Hence, in
addition to designing MMAA for the goal of margin estimation, we devise an
adaptive attack to evaluate the robustness of the MixedNUTS and its
nonlinearly mixed model defense mechanism.

Following the guidelines for constructing adaptive attacks (Tramèr et al.,
2020), our adversary maintains full access to the end-to-end gradient
information of the mixed classifier $f(\cdot)$. Nonetheless, when temperature
scaling with $T=0$ is applied to the accurate base classifier $g(\cdot)$ as
discussed in Section 3.1, $g^{\textrm{TS},T}(\cdot)$ is no longer
differentiable. While this is an advantage in practice since the mixed
classifier becomes harder to attack, we need to circumvent this obfuscated
gradient issue in our evaluations to properly demonstrate white-box
robustness. To this end, transfer attack comes to the rescue. We construct an
auxiliary differentiable mixed classifier $\widetilde{f}(\cdot)$ by mixing
$g(\cdot)$’s unmapped logits with $h^{M}(\cdot)$. We allow our attacks to
query the gradient of $\widetilde{f}(\cdot)$ to guide the gradient-based
attack on $f(\cdot)$. Since $g(\cdot)$ and $g^{\textrm{TS},T}(\cdot)$ always
produce the same predictions, the transferability between
$\widetilde{f}(\cdot)$ and $f(\cdot)$ should be high.

On the other hand, while $h(\cdot)$’s nonlinear logit transformation Eq. 4 is
differentiable, it may also hinder gradient flow in certain cases, especially
when the logits fall into the relatively flat near-zero portion of the
clamping function $\mathrm{Clamp}(\cdot)$. Hence, we also provide the raw
logits of $h(\cdot)$ to our evaluation adversary for better gradient flow. To
keep the adversary aware of the transformation
$\mathchoice{M\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-7.74998pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-7.3194pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{M\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-8.1805pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-7.74998pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{M\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-9.47217pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{M\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-9.47217pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}$, we also include it in the gradient. The overall
construction of the auxiliary differentiable mixed classifier
$\widetilde{f}(\cdot)$ is then

$\widetilde{f}(x)=\log\Big{(}(1-\alpha_{d})\sigma\circ
g(\cdot)+\alpha_{d}r_{d}\sigma\circ
g(\cdot)+\alpha_{d}(1-r_{d})\sigma\circ\mathchoice{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-7.74998pt] \scalebox{0.9}{$\scriptstyle
p^{\star}$}\\\\[-7.3194pt] \scalebox{0.9}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-8.1805pt] \scalebox{0.8}{$\scriptstyle
p^{\star}$}\\\\[-7.74998pt] \scalebox{0.8}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-9.47217pt] \scalebox{0.5}{$\scriptstyle
p^{\star}$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-9.47217pt] \scalebox{0.5}{$\scriptstyle
p^{\star}$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c^{\star}$}\end{tabular}}}}(\cdot)\Big{)},$ (21)

where $\alpha_{d}$ is the mixing weight and $r_{d}$ adjusts the level of
contribution of $\mathchoice{M\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-7.74998pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-7.3194pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{M\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-8.1805pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-7.74998pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{M\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-9.47217pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{M\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-9.47217pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}$ to the gradient. Our experiments fix $r_{d}$ to $0.9$ and
calculate $\alpha_{d}$ using Algorithm 1 with no clamping function, $s$ and
$p$ fixed to $1$, and $c$ fixed to $0$. The gradient-based components (APGD
and FAB) of our adaptive AutoAttack use $\nabla\widetilde{f}(x)$ as a
surrogate for $\nabla\mathchoice{f^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-7.74998pt] \scalebox{0.9}{$\scriptstyle
p^{\star}$}\\\\[-7.3194pt] \scalebox{0.9}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{f^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-8.1805pt] \scalebox{0.8}{$\scriptstyle
p^{\star}$}\\\\[-7.74998pt] \scalebox{0.8}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{f^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-9.47217pt] \scalebox{0.5}{$\scriptstyle
p^{\star}$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{f^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-9.47217pt] \scalebox{0.5}{$\scriptstyle
p^{\star}$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c^{\star}$}\end{tabular}}}}(x)$, whereas the gradient-free Square attack
component remains unchanged.

With the transfer-based gradient query in place, our adaptive AutoAttack does
not suffer from gradient obfuscation, a phenomenon that leads to overestimated
robustness. Specifically, we observe that the black-box Square component of
our adaptive AutoAttack does not change the prediction of any images that
white-box components fail to attack, confirming the effectiveness of querying
the transfer-based auxiliary differentiable mixed classifier for the gradient.
If we set $r_{d}$ to 0 (i.e., do not bypass
$\mathchoice{M\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-7.74998pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-7.3194pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{M\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-8.1805pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-7.74998pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{M\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-9.47217pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{M\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-9.47217pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}$ for gradient), the AutoAttacked accuracy of the CIFAR-100
model reported in Figure 1 becomes $42.97\%$ instead of $41.80\%$, and the
black-box Square attack finds 12 vulnerable images. This comparison confirms
that the proposed modifications on AutoAttack strengthen its effectiveness
against MixedNUTS and eliminate the gradient flow issue, making it a reliable
robustness evaluator.

##  Appendix C Additional Visualizations

###  C.1 Confidence Margin Histograms

Table 3: Prediction confidence margin of $h(\cdot)$, $h^{\mathrm{LN}}(\cdot)$, and $\mathchoice{h^{M}\smash{\raisebox{-1.54996pt}{ \begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-6.97498pt] \scalebox{0.9}{$\scriptstyle p^{\star}$}\\\\[-6.58745pt] \scalebox{0.9}{$\scriptstyle c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.54996pt}{ \begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-7.36244pt] \scalebox{0.8}{$\scriptstyle p^{\star}$}\\\\[-6.97498pt] \scalebox{0.8}{$\scriptstyle c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.77498pt}{ \begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-8.52495pt] \scalebox{0.5}{$\scriptstyle p^{\star}$}\\\\[-8.13748pt] \scalebox{0.5}{$\scriptstyle c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.77498pt}{ \begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-8.52495pt] \scalebox{0.5}{$\scriptstyle p^{\star}$}\\\\[-8.13748pt] \scalebox{0.5}{$\scriptstyle c^{\star}$}\end{tabular}}}}(\cdot)$ used in the CIFAR-100 experiments in Figure 2. The nonlinear logit transformation Eq. 4 amplifies the margin advantage of correct predictions over incorrect ones. As in Figure 2, 10000 clean examples and 1000 AutoAttack examples are used. | Standard base model $g(\cdot)$ | Robust base model $h(\cdot)$ | With LN $h^{\mathrm{LN}}(\cdot)$ | With transform $\mathchoice{h^{M}\smash{\raisebox{-1.72218pt}{ \begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-7.74998pt] \scalebox{0.9}{$\scriptstyle p^{\star}$}\\\\[-7.3194pt] \scalebox{0.9}{$\scriptstyle c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.72218pt}{ \begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-8.1805pt] \scalebox{0.8}{$\scriptstyle p^{\star}$}\\\\[-7.74998pt] \scalebox{0.8}{$\scriptstyle c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{ \begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-9.47217pt] \scalebox{0.5}{$\scriptstyle p^{\star}$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{ \begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-9.47217pt] \scalebox{0.5}{$\scriptstyle p^{\star}$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle c^{\star}$}\end{tabular}}}}(\cdot)$
---|---|---|---|---
Clean |  |  |  |
AutoAttack (APGD) |  |  |  |

Table 3 displays the histograms of the confidence margins of the base
classifiers used in the CIFAR-100 experiment in Figure 1. We can observe the
following conclusions, which support the design of MixedNUTS:

  * •

$g(\cdot)$ is more confident when making mistakes under attack than when
correctly predicting clean images.

  * •

$h(\cdot)$ is more confident in correct predictions than in incorrect ones, as
required by MixedNUTS. Note that even when subject to strong AutoAttack,
correct predictions are still more confident than incorrect predictions on
clean unperturbed images.

  * •

Layer normalization increases $h(\cdot)$’s correct prediction margins while
maintaining the incorrect margins.

  * •

MixedNUTS’s nonlinear logit transformation significantly boosts the correct
margins while keeping most incorrect margins small.

###  C.2 Visualization of Transformed Probabilities

We first visualize how the proposed nonlinear transformation Eq. 4 before the
Softmax operation affects the behavior of the resulting prediction
probabilities. Consider a three-class classification problem, with three
example $h(\cdot)$ logit vectors: $(0.9,1.0,1.1)$, $(-1.0,1.1,1.0)$, and
$(1.0,-1.1,-1.0)$. The first example reflects an overall unconfident scenario,
the second vector simulates the case of two competing classes, and the third
example illustrates a confidently predicted instance. We then compare how the
post-Softmax probability of each class changes when $h(\cdot)$ and
$h^{M}(\cdot)$ are subject to temperature scaling. Specifically, varying the
temperature scalar $T$ from $T_{\max}$ to $T_{\min}$ results in probability
trajectories of
$\sigma(\nicefrac{{\mathchoice{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.425pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-5.12358pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-5.72635pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-5.425pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.63052pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-6.32918pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}(\cdot)}}{{T}})$ on the probability simplex, and we compare
the trajectories with those associated with
$\sigma(\nicefrac{{h(\cdot)}}{{T}})$.

The four columns of Figure 5 present the trajectories obtained using different
$T_{\min}$ while fixing $T_{\max}$ to $100$. A point close to a simplex vertex
signals a high-margin prediction, whereas a point close to an edge results
from competing classes. The trajectories show that the nonlinear
transformation increases the confidence of the first example (unconfident)
while decreasing that of the second example (competing classes). Moreover,
$\mathchoice{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-7.74998pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-7.3194pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-8.1805pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-7.74998pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-9.47217pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-9.47217pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}(\cdot)$’s trajectories are overall straighter and further
from the edges than $h(\cdot)$’s, implying rarer class competition. In the
context of mixed classifiers, when
$\mathchoice{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-7.74998pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-7.3194pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-8.1805pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-7.74998pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-9.47217pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-9.47217pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}(\cdot)$ is used as a robust base classifier mixed with an
accurate classifier $g(\cdot)$, the nonlinear transformation gives $g(\cdot)$
more relative authority when $h(\cdot)$ encounters competing classes. Such a
quality improves the accuracy-robustness trade-off of the mixed classifier.

##  Appendix D Ablation Studies

Figure 5: Prediction probability trajectories of $\sigma\circ h(\cdot)$ and
$\sigma\circ\mathchoice{h^{M}\smash{\raisebox{-1.54996pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-6.97498pt]
\scalebox{0.9}{$\scriptstyle p$}\\\\[-6.58745pt] \scalebox{0.9}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.54996pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-7.36244pt]
\scalebox{0.8}{$\scriptstyle p$}\\\\[-6.97498pt] \scalebox{0.8}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.77498pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-8.52495pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-8.13748pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.77498pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s$}\\\\[-8.52495pt]
\scalebox{0.5}{$\scriptstyle p$}\\\\[-8.13748pt] \scalebox{0.5}{$\scriptstyle
c$}\end{tabular}}}}(\cdot)$ on the probability simplex. The logit
transformation reduces confidence when there are competing classes.

Table 4: Compare several clamping functions.

$\textrm{Clamp}(\cdot)$ | $s^{\star}$ | $c^{\star}$ | $p^{\star}$ | $\alpha^{\star}$ | $\beta$ |  Obj ($\downarrow$)
---|---|---|---|---|---|---
CIFAR-10
Linear | $.050$ | - | $9.14$ | $.963$ | $.985$ | $.671$
ReLU | $10.4$ | $-.750$ | $4.00$ | $.934$ | $.985$ | $.671$
GELU | $2.59$ | $-.750$ | $4.00$ | $.997$ | $.985$ | $.671$
CIFAR-100
Linear | $.000005$ | - | $10.5$ | $.880$ | $.985$ | $.504$
ReLU | $.612$ | $-2.29$ | $4.00$ | $.972$ | $.985$ | $.500$
GELU | $.612$ | $-2.14$ | $3.57$ | $.986$ | $.985$ | $.500$

Table 5: MixedNUTS’s clean and AutoAttack accuracy on a 1000-example CIFAR-100 subset with various temperature scales for the standard base model $g(\cdot)$. The robust base classifier is $\mathchoice{h^{M}\smash{\raisebox{-1.54996pt}{ \begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-6.97498pt] \scalebox{0.9}{$\scriptstyle p^{\star}$}\\\\[-6.58745pt] \scalebox{0.9}{$\scriptstyle c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.54996pt}{ \begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-7.36244pt] \scalebox{0.8}{$\scriptstyle p^{\star}$}\\\\[-6.97498pt] \scalebox{0.8}{$\scriptstyle c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.77498pt}{ \begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-8.52495pt] \scalebox{0.5}{$\scriptstyle p^{\star}$}\\\\[-8.13748pt] \scalebox{0.5}{$\scriptstyle c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.77498pt}{ \begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-8.52495pt] \scalebox{0.5}{$\scriptstyle p^{\star}$}\\\\[-8.13748pt] \scalebox{0.5}{$\scriptstyle c^{\star}$}\end{tabular}}}}(\cdot)$ with the $s$, $p$, $c$ values reported in Table 8. Accurate | Clean | AutoAttack
---|---|---
Base Model |  |
$g^{\textrm{TS},0}(\cdot)$ (Default) | $82.8\%$ | $41.6\%$
$g^{\textrm{TS},0.5}(\cdot)$ | $82.8\%$ | $41.4\%$
$g^{\textrm{TS},1}(\cdot)$ | $82.8\%$ | $41.3\%$

Table 6: MixedNUTS’s clean and AutoAttack accuracy when $s$, $p$, and $c$ are optimized using different numbers of images. Evaluated with the CIFAR-100 base models from Figure 1 on a 1000-example subset. # Images for | Clean | AutoAttack
---|---|---
Optimization
1000 (Default) | $82.8\%$ | $41.6\%$
300 | $83.0\%$ | $41.5\%$
100 | $85.1\%$ | $39.5\%$

Table 7: The accuracy on images used for calculating $s^{\star}$, $p^{\star}$, and $c^{\star}$ (marked by ✓in the “Seen” column) is similar to that on images unseen by Algorithm 1 (marked by ✗), confirming the absence of overfitting. Dataset Seen | Clean | AutoAttack
---|---|---
CIFAR-10 | ✓ | $95.20\%$ | $69.20\%$
✗ | $95.18\%$ | $69.77\%$
CIFAR-100 | ✓ | $82.80\%$ | $41.60\%$
✗ | $83.11\%$ | $41.82\%$
ImageNet | ✓ | $82.60\%$ | $60.80\%$
✗ | $81.20\%$ | $57.93\%$

###  D.1 Temperature Scaling for $g(\cdot)$

This section verifies that scaling up the logits of $g(\cdot)$ improves the
accuracy-robustness trade-off of the mixed classifier. We select the pair of
CIFAR-100 base classifiers used in Figure 1. By jointly adjusting the
temperature of $g(\cdot)$ and the mixing weight $\alpha$, we can keep the
clean accuracy of the mixed model to approximately $84$ percent and compare
the APGD accuracy. In Table 7, we consider two temperature constants: $0.5$
and $0$. Note that as defined in Section 2.1, when the temperature is zero,
the resulting prediction probabilities $\sigma\circ g(\cdot)$ is the one-hot
vector associated with the predicted class. As demonstrated by the CIFAR-100
example in Table 7, when we fix the clean accuracy to $82.8\%$, using $T=0.5$
and $T=0$ produces higher AutoAttacked accuracy than $T=1$ (no scaling), with
$T=0$ producing the best accuracy-robustness balance.

###  D.2 Run Time of Algorithm 1, Effect of Optimization Dataset Size, and
Absence of Overfitting

Algorithm 1 requires performing MMAA on a set of validation images. Performing
this attack on 1000 images requires 3752/10172 seconds for CIFAR-100/ImageNet
with one Nvidia RTX-8000 GPU. Other steps of Algorithm 1 require minimal
computation. While there is a triply-nested loop, since the number of
candidate values need not be large as discussed in Section 4.3, the loops can
be completed within ten seconds and can even be performed on a laptop
computer.

Since the MMAA step has the dominant computational time, reducing the number
of images used in Algorithm 1 can greatly accelerate it. Analyzing the effect
of this data size also helps understand whether optimizing $s$, $p$, and $c$
on validation images introduces overfitting. Table 7 shows that on CIFAR-100,
reducing the number of images used in the optimization from 1000 to 300 (3
images per class) has minimal effect on the resulting mixed classifier
performance. Further reducing the optimized subset size to 100 still allows
for an accuracy-robustness balance, but shifts the balance towards clean
accuracy.

To further demonstrate the absence of overfitting, Table 7 reports that under
the default setting of optimizing $s$, $p$, $c$ on 1000 images, the accuracy
on these 1000 images is similar to that on the rest of the validation images
unseen during optimization. The CIFAR-10 and -100 models, in fact, perform
slightly better on unseen images. The ImageNet model’s accuracy on unseen
images is marginally lower than seen ones, likely due to the scarcity of
validation images per class (only 5 per class in total since ImageNet has 1000
classes) and the resulting performance variance across the validation set.

###  D.3 Selecting the Clamping Function

This section performs an ablation study on the clamping function in the
nonlinear logit transformation defined in Eq. 4. Specifically, we compare
using GELU or ReLU as $\mathrm{Clamp}(\cdot)$ to bypassing
$\mathrm{Clamp}(\cdot)$ (i.e., use a linear function). Here, we select a
CIFAR-10 ResNet-18 model (Na, 2020) and a CIFAR-100 WideResNet-70-16 model
(Wang et al., 2023) as two examples of $h(\cdot)$ and compare the optimal
objective returned by Algorithm 1 using each of the clamping function
settings. As shown in Table 4, while the optimal objective is similar for all
three options, the returned hyperparameters $s^{\star}$, $p^{\star}$,
$c^{\star}$, and $\alpha^{\star}$ is the most “modest” for GELU, which
translates to the best numerical stability. In comparison, using a linear
clamping function requires applying a power of 9.14 to the logits, whereas
using the ReLU clamping function requires scaling the logits up by a factor of
10.4 for CIFAR-10, potentially resulting in significant numerical
instabilities. Therefore, we select GELU as the default clamping function and
use it for all other experiments.

###  D.4 Selecting the Base Classifiers

This section provides some guidelines on how to select the accurate and robust
base classifiers for the best mixed classifier performance. For the accurate
classifier, since MixedNUTS only considers its predicted class and does not
depend on its confidence (recall that MixedNUTS uses
$g^{\textrm{TS},0}(\cdot)$), the classifier with the best-known clean accuracy
should be selected. Meanwhile, for the robust base classifier, since MixedNUTS
relies on its margin properties, one should select a model that has high
robust accuracy as well as benign margin characteristics (i.e., is
significantly more confident in correct predictions than incorrect ones). As
shown in Figure 3, most high-performance robust models share this benign
property, and there is not a strong correlation between robust accuracy and
margins. Therefore, state-of-the-art robust models are usually safe to use.

That being said, consider the hypothetical scenario that between a pair of
robust base classifiers on some dataset, one has higher robust accuracy and
the other has more benign margin properties. In this case, one should compare
the percentages of data that the two models are robust at with a certain non-
zero margin. The model with higher “robust accuracy with margin” should be
selected.

##  Appendix E Additional Discussions

###  E.1 Base Classifier and Mixing Details in Main Experiment

Table 8: Details of the base classifiers used in our main experiments. Dataset |  Robust Base Classifier $g(\cdot)$ |  Accurate Base Classifier $h(\cdot)$
---|---|---
CIFAR-10 |  ResNet-152 (Kolesnikov et al., 2020) |  RaWRN-70-16 (Peng et al., 2023)
CIFAR-100 |  ResNet-152 (Kolesnikov et al., 2020) |  WRN-70-16 (Wang et al., 2023)
ImageNet |  ConvNeXt V2-L (Woo et al., 2023) |  Swin-L (Liu et al., 2023)
Table 9: The optimal $s$, $p$, $c$, $\alpha$ values returned by Algorithm 1 used in our main experiments, presented along with the minimum and maximum candidate values in Algorithm 1’s searching grid. | $s^{\star}$ | $c^{\star}$ | $p^{\star}$ | $\alpha^{\star}$ | $s_{\min}$ | $s_{\max}$ | $c_{\min}$ | $c_{\max}$ | $p_{\min}$ | $p_{\max}$
---|---|---|---|---|---|---|---|---|---|---
CIFAR-10 | $5.00$ | $-1.10$ | $4.00$ | $.999$ | $0.05$ | $5$ | $-1.1$ | $0$ | $1$ | $4$
CIFAR-100 | $.612$ | $-2.14$ | $3.57$ | $.986$ | $0.05$ | $4$ | $-2.5$ | $-0.4$ | $1$ | $4$
ImageNet | $.0235$ | $-.286$ | $2.71$ | $.997$ | $0.01$ | $0.2$ | $-2$ | $0$ | $2$ | $3$
Table 10: The proposed nonlinear logit transformation $\mathchoice{M\smash{\raisebox{-1.54996pt}{ \begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-6.97498pt] \scalebox{0.9}{$\scriptstyle p^{\star}$}\\\\[-6.58745pt] \scalebox{0.9}{$\scriptstyle c^{\star}$}\end{tabular}}}}{M\smash{\raisebox{-1.54996pt}{ \begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-7.36244pt] \scalebox{0.8}{$\scriptstyle p^{\star}$}\\\\[-6.97498pt] \scalebox{0.8}{$\scriptstyle c^{\star}$}\end{tabular}}}}{M\smash{\raisebox{-0.77498pt}{ \begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-8.52495pt] \scalebox{0.5}{$\scriptstyle p^{\star}$}\\\\[-8.13748pt] \scalebox{0.5}{$\scriptstyle c^{\star}$}\end{tabular}}}}{M\smash{\raisebox{-0.77498pt}{ \begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-8.52495pt] \scalebox{0.5}{$\scriptstyle p^{\star}$}\\\\[-8.13748pt] \scalebox{0.5}{$\scriptstyle c^{\star}$}\end{tabular}}}}$ has minimal effect on base model accuracy. Dataset |  Clean (full dataset) |  AutoAttack (1000 images)
---|---|---
$h(\cdot)$ | $h^{\mathrm{LN}}(\cdot)$ | $\mathchoice{h^{M}\smash{\raisebox{-1.54996pt}{ \begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-6.97498pt] \scalebox{0.9}{$\scriptstyle p^{\star}$}\\\\[-6.58745pt] \scalebox{0.9}{$\scriptstyle c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.54996pt}{ \begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-7.36244pt] \scalebox{0.8}{$\scriptstyle p^{\star}$}\\\\[-6.97498pt] \scalebox{0.8}{$\scriptstyle c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.77498pt}{ \begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-8.52495pt] \scalebox{0.5}{$\scriptstyle p^{\star}$}\\\\[-8.13748pt] \scalebox{0.5}{$\scriptstyle c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.77498pt}{ \begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-8.52495pt] \scalebox{0.5}{$\scriptstyle p^{\star}$}\\\\[-8.13748pt] \scalebox{0.5}{$\scriptstyle c^{\star}$}\end{tabular}}}}(\cdot)$ | $h(\cdot)$ | $h^{\mathrm{LN}}(\cdot)$ | $\mathchoice{h^{M}\smash{\raisebox{-1.54996pt}{ \begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-6.97498pt] \scalebox{0.9}{$\scriptstyle p^{\star}$}\\\\[-6.58745pt] \scalebox{0.9}{$\scriptstyle c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.54996pt}{ \begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-7.36244pt] \scalebox{0.8}{$\scriptstyle p^{\star}$}\\\\[-6.97498pt] \scalebox{0.8}{$\scriptstyle c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.77498pt}{ \begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-8.52495pt] \scalebox{0.5}{$\scriptstyle p^{\star}$}\\\\[-8.13748pt] \scalebox{0.5}{$\scriptstyle c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.77498pt}{ \begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-8.52495pt] \scalebox{0.5}{$\scriptstyle p^{\star}$}\\\\[-8.13748pt] \scalebox{0.5}{$\scriptstyle c^{\star}$}\end{tabular}}}}(\cdot)$
CIFAR-10 | $93.27\%$ | $93.27\%$ | $93.25\%$ | $71.4\%$ | $71.4\%$ | $71.4\%$
CIFAR-100 | $75.22\%$ | $75.22\%$ | $75.22\%$ | $43.0\%$ | $42.9\%$ | $43.3\%$
ImageNet | $78.75\%$ | $78.75\%$ | $78.75\%$ | $57.5\%$ | $57.5\%$ | $57.5\%$

Table 8 presents the sources and architectures of the base classifiers
selected for our main experiments (Figure 1, Figure 2, Table 1, and Table 2).
The robust base classifiers are the state-of-the-art models listed on
RobustBench as of submission, and the accurate base classifiers are popular
high-performance models pre-trained on large datasets. Note that since
MixedNUTS only queries the predicted classes from $g(\cdot)$ and is agnostic
of its other details, $g(\cdot)$ may be any classifier, including large-scale
vision-language models that currently see rapid development.

Table 9 presents the optimal $s^{\star}$, $p^{\star}$, $c^{\star}$, and
$\alpha^{\star}$ values used in MixedNUTS’s nonlinear logit transformation
returned by Algorithm 1. When optimizing $s$, $p$, and $c$, Algorithm 1
performs a grid search, selecting from a provided set of candidate values. In
our experiments, we generate uniform linear intervals as the candidate values
for the power coefficient $p$ and the bias coefficient $c$, and use a log-
scale interval for the scale coefficient $s$. Each interval has eight numbers,
with the minimum and maximum values for the intervals listed in Table 9.

Table 10 demonstrates that MixedNUTS’s nonlinear logit transformation
$\mathchoice{M\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-7.74998pt] \scalebox{0.9}{$\scriptstyle
p^{\star}$}\\\\[-7.3194pt] \scalebox{0.9}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{M\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-8.1805pt] \scalebox{0.8}{$\scriptstyle
p^{\star}$}\\\\[-7.74998pt] \scalebox{0.8}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{M\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-9.47217pt] \scalebox{0.5}{$\scriptstyle
p^{\star}$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{M\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-9.47217pt] \scalebox{0.5}{$\scriptstyle
p^{\star}$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c^{\star}$}\end{tabular}}}}$ has negligible effects on base classifier
accuracy, confirming that MixedNUTS’s improved accuracy-robustness balance is
rooted in the improved base classifier confidence properties.

###  E.2 Behavior of Logit Normalization

The LN operation on the model logits makes the margin agnostic to the overall
scale of the logits. Consider two example logit vectors in ${\mathbb{R}}^{3}$,
namely $(0.9,1,1.1)$ and $(-2,1,1.1)$. The first vector corresponds to the
case where the classifier prefers the third class but is relatively
unconfident. The second vector reflects the scenario where the classifier is
generally more confident, but the second and third classes compete with each
other. The LN operation will scale up the first vector and scale down the
second. It is likely that the competing scenario is more common when the
prediction is incorrect, and therefore the LN operation, which comparatively
decreases the margin under the competing scenario, makes incorrect examples
less confident compared with correct ones. As a result, the LN operation
itself can slightly enlarge the margin difference between incorrect and
correct examples.

For ImageNet, instead of performing LN on the logits based on the mean and
variance of all 1000 classes, we normalize using the statistics of the top 250
classes. The intuition of doing so is that the predicted probabilities of
bottom classes are extremely small and likely have negligible influence on
model prediction and robustness. However, they considerably influence the mean
and variance statistics of logits. Excluding these least-related classes makes
the LN operation less noisy.

###  E.3 Relaxing the Independence Assumption in Theorem 4.4

Theorem 4.4 assumes that the margin of $h^{M}(X)$ and the correctness of
$g(X)$ are independent. Suppose that such an assumption does not hold for a
pair of base classifiers. Then,
${\mathbb{P}}_{X\sim{\mathcal{X}}_{ic}}\left[m_{h^{M}}(X)\geq\tfrac{1-\alpha}{\alpha}\right]$
may not be equal to
${\mathbb{P}}_{X\sim{\mathcal{X}}_{ic}}\left[m_{h^{M}}(X)\geq\tfrac{1-\alpha}{\alpha}\right|G_{\textrm{cor}}(X)]$.
In this case, we need to minimize the latter quantity in order to effectively
optimize Eq. 2. Hence, we need to modify the objective functions of Eq. 3 and
Eq. 18 accordingly, and change the objective value assignment step in Line 10
of Algorithm 1 to
$o^{ijk}\leftarrow{\mathbb{P}}_{X\in\tilde{{\mathcal{X}}}_{ic}}\left[m_{\mathchoice{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s_{i}$}\\\\[-5.425pt]
\scalebox{0.9}{$\scriptstyle p_{j}$}\\\\[-5.12358pt]
\scalebox{0.9}{$\scriptstyle
c_{k}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.20552pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s_{i}$}\\\\[-5.72635pt] \scalebox{0.8}{$\scriptstyle p_{j}$}\\\\[-5.425pt]
\scalebox{0.8}{$\scriptstyle
c_{k}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s_{i}$}\\\\[-6.63052pt] \scalebox{0.5}{$\scriptstyle p_{j}$}\\\\[-6.32918pt]
\scalebox{0.5}{$\scriptstyle
c_{k}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.60275pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s_{i}$}\\\\[-6.63052pt] \scalebox{0.5}{$\scriptstyle p_{j}$}\\\\[-6.32918pt]
\scalebox{0.5}{$\scriptstyle c_{k}$}\end{tabular}}}}}(X)\geq
q_{1-\beta}^{ijk}\Big{|}G_{\textrm{cor}}(X)\right]$. With such a modification,
the optimization of $s$, $p$, $c$ is no longer decoupled from $g(\cdot)$, but
the resulting algorithm is still efficiently solvable and Theorem 4.4 still
holds.

###  E.4 Approximation Quality of Eq. 19

Algorithm 1 solves Eq. 19 as a surrogate of Eq. 18 for efficiency. One of the
approximations of Eq. 19 is to use the minimum-margin perturbation against
$h^{\mathrm{LN}}(\cdot)$ instead of that associated with $h^{M}(\cdot)$. While
$h^{M}(\cdot)$ and $h^{\mathrm{LN}}(\cdot)$ are expected to have similar
standalone accuracy and robustness, their confidence properties are different,
and therefore the minimum-margin perturbation associated with $h^{M}(\cdot)$
can be different from that associated with $h^{\mathrm{LN}}(\cdot)$, inducing
a distribution mismatch. To analyze the influence of this mismatch on the
effectiveness of Algorithm 1, we record the values of $s^{\star}$,
$p^{\star}$, and $c^{\star}$, compute the minimum-margin-AutoAttacked examples
of $\mathchoice{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-7.74998pt] \scalebox{0.9}{$\scriptstyle
p^{\star}$}\\\\[-7.3194pt] \scalebox{0.9}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-8.1805pt] \scalebox{0.8}{$\scriptstyle
p^{\star}$}\\\\[-7.74998pt] \scalebox{0.8}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-9.47217pt] \scalebox{0.5}{$\scriptstyle
p^{\star}$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-9.47217pt] \scalebox{0.5}{$\scriptstyle
p^{\star}$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c^{\star}$}\end{tabular}}}}(\cdot)$ and re-run Algorithm 1 with the new
examples. If the objective value calculated via the new examples and
$s^{\star}$, $p^{\star}$, $c^{\star}$ is close to the optimal objective
returned from the original Algorithm 1, then the mismatch is small and benign
and Algorithm 1 is capable of indirectly optimizing Eq. 18.

We use the CIFAR-100 model from Figure 1 as an example to perform this
analysis. The original optimal objective returned by Algorithm 1 is $50.0\%$.
The re-computed objective based on
$\mathchoice{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-7.74998pt] \scalebox{0.9}{$\scriptstyle
p^{\star}$}\\\\[-7.3194pt] \scalebox{0.9}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-1.72218pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-8.1805pt] \scalebox{0.8}{$\scriptstyle
p^{\star}$}\\\\[-7.74998pt] \scalebox{0.8}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-9.47217pt] \scalebox{0.5}{$\scriptstyle
p^{\star}$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c^{\star}$}\end{tabular}}}}{h^{M}\smash{\raisebox{-0.86108pt}{
\begin{tabular}[b]{<EMAIL_ADDRESS>s^{\star}$}\\\\[-9.47217pt] \scalebox{0.5}{$\scriptstyle
p^{\star}$}\\\\[-9.04166pt] \scalebox{0.5}{$\scriptstyle
c^{\star}$}\end{tabular}}}}(\cdot)$’s minimum-margin perturbations, where
$s^{\star}=.612$, $p^{\star}=3.57$, $c^{\star}=-2.14$, is $66.7\%$. While
there is a gap between the two objective values and therefore the
approximation-induced distribution mismatch exists, Algorithm 1 can still
effectively decrease the objective value of Eq. 18.