first commit

.gitignore

@@ -0,0 +1,144 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py,cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+#Pipfile.lock
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+data
+models/
+unlabeled_targets/
+clean_models/
+.nfs*
+.python-version

Dockerfile

@@ -18,3 +18,5 @@ RUN pyenv rehash
 RUN pip install --upgrade pip
 ADD ./requirements.txt requirements.txt
 RUN pip install -r requirements.txt
+RUN apt-get install -y texlive-full
+RUN apt-get install bc

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020 Aditi Raghunathan, Sang Michael Xie
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,27 @@
+# Understanding and Mitigating the Tradeoff Between Robustness and Accuracy
+
+The repository contains the code for reproducing experiments in the following [paper](https://arxiv.org/abs/2002.10716):
+```
+@inproceedings{raghunathan2020understanding,
+  author = {A. Raghunathan and S. M. Xie and F. Yang and J. C. Duchi and P. Liang},
+  booktitle = {International Conference on Machine Learning (ICML)},
+  title = {Understanding and Mitigating the Tradeoff Between Robustness and Accuracy},
+  year = {2020},
+}
+```
+The experiments in this repository are reproduced in this [CodaLab worksheet.](https://worksheets.codalab.org/worksheets/0x16e1477c039b40b38534353108755541).
+
+## Setup
+To get started, please activate a new virtualenv with Python 3.6 or above and install the dependencies using `pip install -r requirements.txt`. The CIFAR experiments are in the `cifar/` directory and the code to reproduce spline simulations and figures are in the `splines` directory. The Dockerfile can also be used to construct a suitable environment to run the code in a personal setup or on CodaLab.
+
+## Description
+
+In this paper, we study empirically-documented tradeoff between adversarial robustness and standard accuracy, where adding adversarial examples during training tends to significantly decrease standard accuracy. The tradeoff is particularly suprising given that the adversarial perturbations are typically very small, such that the true target of the perturbed example does not change. We call these consistent perturbations. Furthermore, since we use powerful neural networks, the model should be expressive enough to contain the true predictor (well-specification).
+
+In this paper we ask, if we assume that perturbations are consistent and the model family is well specified such that there is no inherent trade off, why do we observe a trade off in practice? We can make the following observations and conclusions:
+
+We characterize how training with consistent extra data can increase standard error even in well specified, noiseless linear regression. Our analysis suggests that using unlabeled data with the recent robust self training algorithm can mitigate the tradeoff.
+We prove that robust self training improves the robust error without hurting standard error, therefore eliminating the tradeoff in the linear setting using unlabeled data.
+Empirically, RST improves both robust and standard error across different adversarial training algorithms and perturbations.
+
+![table](cifar/rst_table.png)

cifar/README.md

@@ -0,0 +1,22 @@
+# CIFAR experiments
+
+The scripts in this directory run standard training, adversarial training (PG-AT), and robust self-training on CIFAR-10. Please refer to [this repo](https://github.com/yaircarmon/semisup-adv) for TRADES + RST experiments.
+
+## Code descriptions
+- `run_*_for_sample_size.sh` scripts run a WRN-40-2 model over different labeled sample sizes.
+- `run_{pgat,selftrain}.sh` scripts run a WRN-28-10 model on L-inf adversarial perturbations. These scripts run the projected gradient adversarial training, and self-training (semi-supervised) algorithms respectively. ThePG-AT script also runs the semi-supervised version of the algorithm with RST.
+- `run_rotations.sh` runs standard training, PG-AT adversarial training, and PG-AT + RST on spatial adversarial examples, i.e. translation and rotation perturbations.
+- `code/` contains all the code for standard, adversarial, and RST training.
+- We also include many scripts for running on CodaLab, where the main runner is `run_cl.sh`.
+
+## Data
+- [500K unlabeled data from TinyImages (with pseudo-labels)](https://drive.google.com/open?id=1LTw3Sb5QoiCCN-6Y5PEKkq9C9W60w-Hi): unlabeled data, which is also provided in this [Codalab worksheet.](https://worksheets.codalab.org/worksheets/0x16e1477c039b40b38534353108755541)
+
+
+Here, we plot the effect of sample size on generalization of robust models on clean examples. As the number of labeled examples increases, the drop in standard accuracy between the adversarially-trained (PG-AT) model and the standard-trained model gets smaller. This suggests that the tradeoff in standard accuracy is an issue of generalization.
+
+![generalization](generalization_adv.png)
+
+Using robust self-training (RST+AT) not only mitigates the increase in test error from AT but even improves test error beyond that of the standard estimator.
+
+![table](rst_table.png)