# On the Connection between Invariant Learning and Adversarial Training for
Out-of-Distribution Generalization

Shiji Xin1,4, Yifei Wang2, Jingtong Su3, Yisen Wang1,5 Corresponding Author:
Yisen Wang (yisen.wang@pku.edu.cn).

###### Abstract

Despite impressive success in many tasks, deep learning models are shown to
rely on spurious features, which will catastrophically fail when generalized
to out-of-distribution (OOD) data. Invariant Risk Minimization (IRM) is
proposed to alleviate this issue by extracting domain-invariant features for
OOD generalization. Nevertheless, recent work shows that IRM is only effective
for a certain type of distribution shift (e.g., correlation shift) while it
fails for other cases (e.g., diversity shift). Meanwhile, another thread of
method, Adversarial Training (AT), has shown better domain transfer
performance, suggesting that it has the potential to be an effective candidate
for extracting domain-invariant features. This paper investigates this
possibility by exploring the similarity between the IRM and AT objectives.
Inspired by this connection, we propose Domain-wise Adversarial Training
(DAT), an AT-inspired method for alleviating distribution shift by domain-
specific perturbations. Extensive experiments show that our proposed DAT can
effectively remove domain-varying features and improve OOD generalization
under both correlation shift and diversity shift.

##  1 Introduction

Modern deep learning techniques have achieved remarkable success in many tasks
(He et al. 2016; Wang et al. 2017; Brown et al. 2020). However, deep models
will suffer catastrophic performance degradation under some scenarios, as they
tend to exploit spurious correlations in the training data (Beery, Van Horn,
and Perona 2018). One of those representative scenarios is the Out-of-
Distribution (OOD) generalization, where the trained model is expected to
perform well at the test time, even when the training and testing data come
from different distributions (Zhang et al. 2021a). Another representative
scenario in which deep models are unstable is the adversarial example.
Researchers have found that deep models are quite brittle, as one can inject
imperceptible perturbations into the input and cause the model to make wrong
predictions with extremely high confidence (Szegedy et al. 2014).

Figure 1: An illustrative example of the two kinds of distribution shifts. The
curly brackets enclose the distribution shift between the environments. Here
$z$ stands for the spurious feature, and $y$ stands for label class.

These two issues have some similarities to each other. They both arise because
deep networks do not learn the essential causal associations (or intrinsic
features). Nevertheless, in their corresponding fields, different approaches
have been proposed. A large class of methods called Invariant Causal
Prediction (ICP) (Peters, Bühlmann, and Meinshausen 2016) is proposed for OOD
generalization. Among them, Invariant Risk Minimization (IRM) (Arjovsky et al.
2019) attracts significant attention, which intends to extract invariant
features across different data distributions and expects the model to ignore
information related to the environment111The terminologies of “domain”,
“environment”, and “distribution” are often used interchangeably in current
literature.. While for adversarial robustness against adversarial examples,
Adversarial Training (AT) (Madry et al. 2018; Wang et al. 2019) is the most
effective approach at the current stage (Athalye, Carlini, and Wagner 2018).
It trains a model on adversarial examples generated by injecting perturbations
optimized for each image into natural examples. Several recent works have
explored the relationship between AT and OOD (Volpi et al. 2018; Shankar et
al. 2018; Yi et al. 2021), but rarely focus on the typical domain
generalization setting considered by IRM. Therefore, the two fields still seem
rather independent. In this paper, we are going to explore their potential
relationships.

Although IRM and its variants are promising on certain tasks, e.g., CMNIST
(Arjovsky et al. 2019), recent studies (Gulrajani and Lopez-Paz 2021) show
that on a large-scale controlled experiment on OOD generalization, all these
methods fail to exceed the simplest _i.i.d._ baseline, i.e., Empirical Risk
Minimization (ERM). Further, two kinds of distribution shifts in benchmark
datasets are identified (Ye et al. 2022), i.e., , diversity shift and
correlation shift, shown in Figure 1. Diversity shift refers to the shift of
the distribution support of spurious feature $z$, for example, the style of
the images changed from cartoon to sketch on object classification task. In
contrast, correlation shift refers to the change in conditional probability
(posterior distribution) of label $y$ given spurious feature $z$ on the same
support, e.g., , the color in the CMNIST dataset (Ahuja et al. 2020). They
found that an algorithm that performs well on one kind of distribution shift
tends to perform poorly on the other one (Ye et al. 2022).

Thus, we need to seek better alternatives for OOD generalization, while AT
seems to be a promising candidate from both theoretical and empirical aspects.
Theoretically, by learning invariance w.r.t. local input perturbations (Wu,
Xia, and Wang 2020), AT can be regarded as Distributionally Robust
Optimization (DRO) (Sinha, Namkoong, and Duchi 2018; Volpi et al. 2018;
Rahimian and Mehrotra 2019; Duchi, Glynn, and Namkoong 2021) over the
$\ell_{p}$-bounded distributional shift. Thus, AT could reliably extract
robust features, e.g., the shape of the object, from the input (Ren et al.
2021). Empirically, several recent works show that AT has better domain
transferability than ERM (Salman et al. 2020; Yi et al. 2021). These findings
naturally lead to the following questions:

_Is AT related to IRM? If so, is AT helpful for OOD generalization?_

In this paper, we take a further step to answer these intriguing questions. We
first reveal the connections between IRM and AT, and find that IRM can be
regarded as an instance-reweighted version of Domain-wise Adversarial Training
(DAT), a new version of adversarial training that we propose for multi-source
domain generalization. Inspired by this connection, we further explore how DAT
performs on OOD data. We first notice that DAT is suitable for solving domain
generalization problems, as it can effectively remove relatively static
background information with domain-wise perturbations. We further verify this
intuition on both synthetic tasks and real-world datasets, where DAT shows
clear advantages over ERM. Finally, we conduct extensive experiments on
benchmark datasets and show that our DAT can consistently outperform ERM on
tasks dominated by both correlation shift and diversity shift.

We summarize our contributions as follows:

  * •

We theoretically derive the connection between IRM and AT. Based on this
connection, we develop a new kind of adversarial training, Domain-wise
Adversarial Training (DAT), for domain generalization.

  * •

We analyze how DAT is beneficial for learning invariant features and verify
our hypothesis through synthetic data and real-world datasets.

  * •

Experiments on benchmark datasets show that DAT not only performs better than
ERM under correlation shift like IRM but also outperforms ERM under diversity
shift like (sample-wise) AT.

##  2 Related Works

#### IRM and Its Variants.

Invariant Risk Minimization (IRM) (Arjovsky et al. 2019) develops a paradigm
to extract causal (invariant) features and find the optimal invariant
classifier on top of several given training environments. The work of Kamath
et al. (2021) reveals the gap between IRM and IRMv1, showing that even in a
simple model that echos the idea of the original IRM objective, IRMv1 can fail
catastrophically. Rosenfeld, Ravikumar, and Risteski (2021) prove that when
the number of training environments is not large enough, IRMv1 can face the
risk of using environmental features.

#### AT and Its Variants.

Szegedy et al. (2014) reported that one can inject imperceptible perturbations
to fool deep models. Among the proposed defenses, Adversarial Training (AT)
(Goodfellow, Shlens, and Szegedy 2015; Madry et al. 2018; Wang et al. 2020;
Wang and Wang 2022) is the promising and representative approach to training
robust models (Athalye, Carlini, and Wagner 2018). Recently, Salman et al.
(2020) showed that adversarially learned features could transfer better than
standardly trained models, while various works (Volpi et al. 2018; Sinha,
Namkoong, and Duchi 2018; Shankar et al. 2018; Ford et al. 2019; Qiao, Zhao,
and Peng 2020; Yi et al. 2021; Gokhale et al. 2021) adopt sample-wise
adversarial training or adversarial data augmentation to improve OOD
robustness. However, most discussions are limited to distributional robustness
w.r.t. Wasserstein distance. The small perturbations used in AT make it less
practical to account for real-world OOD scenarios (e.g., correlation to
backgrounds), thus Wang et al. (2022) incorporated low-rank structured priors
into AT for this kind of large data distribution shifts. Moreover, previous
work shows that there seems to be a trade-off between the two distribution
shifts: an algorithm that performs well on one task tends to perform poorly on
the other (Ye et al. 2022). Instead, in this work, our proposed method can
achieve fair performance on both correlation shift and diversity shift tasks.

##  3 Relationship Between IRM and AT Variants

#### Notation.

Let $\Phi:\mathcal{X}\subset R^{n}\to R^{d}$ denote the representation of a
$\theta$-parameterized piecewise linear classifier, i.e.,
$\Phi(\cdot)=\phi^{L}(W^{L}\phi^{L-1}(\dots)+b^{L-1})+b^{L}$, where $\phi^{L}$
is the activation function, and $W^{L}$, $b^{L}$ denote the layer-wise weight
matrix and bias vector, collectively denoted by $\theta$. Furthermore, let
$\beta$ be the linear classifier on the top, and let the network output be
$\beta\cdot\Phi(x)=\beta^{\top}\Phi(x)$. Let
$\ell(\hat{y},y)=-\log\sigma(y\hat{y})$ be the sample logistic loss. We
consider a two-class $(y=\pm 1)$ classification setting with output dimension
$d=1$, and our discussion can be easily extended to general cases.

#### ERM.

The traditional Empirical Risk Minimization (ERM) algorithm optimizes over the
loss on i.i.d. data, i.e.,

$\displaystyle\min_{\beta,\Phi}R(\beta\cdot\Phi),\ \mathrm{where}\
R(\beta\cdot\Phi)=\mathbb{E}_{(x,y)\sim D}\ell(\beta^{\top}\Phi(x),y).$ (1)

In the OOD generalization problem, one faces a set of (training) environments
$\mathcal{E}$, where each environment $e\in\mathcal{E}$ corresponds to a
unique data distribution $D_{e}$. When facing multiple environments, the ERM
objective simply mixes the data together and takes the form

$(\operatorname{ERM})\quad\min_{\beta,\Phi}\sum_{e}R^{e}(\beta\cdot\Phi),$ (2)

where $R^{e}(\beta\cdot\Phi)=\mathbb{E}_{(x,y)\sim
D_{e}}\ell(\beta^{\top}\Phi(x),y)$.

#### IRM and IRMv1.

Instead of simply mixing the data together, IRM seeks to learn an _invariant_
representation $\Phi$ such that the objective can be minimized with the same
classifier $\beta$ in all training domains. Formally, we have

$(\operatorname{IRM})\quad\begin{aligned}
\min_{\beta,\Phi}&\sum_{e\in\mathcal{E}}R^{e}(\beta\cdot\Phi)\\\
\mathrm{s.t.}\
&\beta\in\arg\min_{\bar{\beta}}R^{e}(\bar{\beta}\cdot\Phi),\forall
e\in\mathcal{E}.\end{aligned}$ (3)

Since this bilevel optimization problem is difficult to solve, the practical
version IRMv1 is formulated as regularized ERM, where the gradient penalty is
calculated w.r.t. a dummy variable $w$:

$(\operatorname{IRMv1})\min_{\beta,\Phi}\sum_{e\in\mathcal{E}}\\!\big{[}R^{e}(\beta\cdot\Phi)+\\!\lambda\\!\underbrace{||\nabla_{w|w=1.0}R^{e}(w\cdot(\beta\cdot\Phi))||^{2}}_{\mathrm{Penalty_{IRM}}}\big{]}.$
(4)

#### AT.

Adversarial Training instead replaces ERM with a minimax objective,

$\min_{\beta,\Phi}R^{\rm
AT}(\beta\cdot\Phi)=\min_{\beta,\Phi}\mathbb{E}_{(x,y)\sim
D}\max_{||\delta_{x}||_{p}\leq\varepsilon}\ell(\beta^{\top}\Phi(x+\delta_{x}),y),$
(5)

where one maximizes inner loss by injecting _sample-wise_ perturbations
$\delta_{x}$ and solve the outer minimization w.r.t. parameters $\beta,\Phi$
on the perturbed sample $(x+\delta_{x},y)$. Typically, the perturbation is
constrained within an $\ell_{p}$ ball with radius $\varepsilon$. In this way,
AT can learn models that are robust to $\ell_{p}$ perturbations.

###  3.1 Relating AT to IRM

As shown above, it seems that IRM and AT are two distinct learning paradigms,
while, in fact, we can show that IRM is closely related to a certain kind of
adversarial training. To see this, we first notice that AT can be rephrased
into a regularized ERM loss with a penalty on _sample-wise_ robustness through
linearization:

$\displaystyle R^{\rm AT}(\beta\cdot\Phi)=\mathbb{E}_{(x,y)\sim
D}\max_{||\delta_{x}||\leq\varepsilon}\ell(\beta^{\top}\Phi(x+\delta_{x}),y)$
(6) $\displaystyle=$ $\displaystyle\mathbb{E}_{(x,y)\sim
D}\big{[}\ell(\beta^{\top}\Phi(x),y)+$
$\displaystyle\max_{||\delta_{x}||\leq\varepsilon}\left(\ell(\beta^{\top}\Phi(x+\delta_{x}),y)-\ell(\beta^{\top}\Phi(x),y)\right)\big{]}$
$\displaystyle\approx$ $\displaystyle
R(\beta\cdot\Phi)+\varepsilon\underbrace{\mathbb{E}_{(x,y)\sim
D}\left\|\nabla_{x}\ell(\beta^{\top}\Phi(x),y)\right\|}_{\rm Penalty_{AT}},$

which resembles the gradient penalty adopted in IRMv1. One main difference is
that AT’s penalty is calculated w.r.t. sample-wise gradients, while IRM’s
penalty w.r.t. the population loss. This difference motivates us to adopt a
population-level perturbation $\delta$ instead.

#### Proposed DAT.

Inspired by the above connection, we propose Domain-wise Adversarial Training
(DAT), which adopts a _domain-wise_ perturbation $\delta_{e}$ for each
training domain $e\in{\mathcal{E}}$. Formally, we have

$\displaystyle\min_{\beta,\Phi}$
$\displaystyle\sum_{e\in\mathcal{E}}\mathbb{E}_{(x,y)\sim
D_{e}}\ell\left(\beta^{\top}\Phi(x+\delta_{e})),y\right)$ (7)
$\displaystyle\mathrm{s.t.}$
$\displaystyle\delta_{e}\in\operatorname*{arg\,max}_{\|\delta\|\leq\varepsilon}\mathbb{E}_{(x,y)\sim
D_{e}}\ell(\beta^{\top}\Phi(x+\delta),y),\forall e\in\mathcal{E}.$

where the perturbation $\delta_{e}$ is defined at the distribution level.

In practice, we solve the above problem by alternating updates of model
parameters $\beta,\Phi$ and perturbations $\delta_{e}$. Specifically, for each
mini-batch $B_{e}$ sampled from domain $\mathcal{D}_{e}$, we update
$\delta_{e}$ with $B_{e}$ using gradient ascent to find the best adversarial
perturbations. The adversarial samples are then used to train the model. A
detailed description is in Algorithm 1.

Algorithm 1 Domain-wise Adversarial Training

0: Dataset of multiple environments $D_{e},e\in\mathcal{E}$,desired $l_{p}$
norm of the perturbation $\varepsilon$,perturbation step size $\alpha$

0: Model $(\Phi,\beta)$

Randomly initiate $\theta$, perturbation $\delta_{e},\forall e\in\mathcal{E}$

for iterations $=1,2,3,\ldots$ do

for each environment $e$ do

1\. Sample batch $B_{e}$ from environment $e$

2\. Update the perturbation $\delta_{e}$ using one-step gradient ascent with
step size $\alpha$

3\. Project the perturbation $\delta_{e}$ to a $\ell_{p}$ ball of radius
$\varepsilon$

4\. Generate adversarial examples $x_{adv}\leftarrow x+\delta_{e},\forall x\in
B_{e}$

5\. Update $\Phi$ and $\beta$ with gradient descent on $x_{adv}$

end for

end for

In the setting of single-source domain generalization, where only one training
domain is provided, DAT degenerates into universal adversarial training (UAT)
(Moosavi-Dezfooli et al. 2017), where a single perturbation is provided for
the entire training distribution.

###  3.2 Connection Between IRM and DAT

Here, we establish a formal connection between IRM and DAT. To begin with, we
note that DAT can also be reformulated as a regularized ERM in the multi-
domain scenario.

$\displaystyle R^{\rm
DAT}(\beta\cdot\Phi)=\sum_{e\in{\mathcal{E}}}\max_{||\delta_{e}||\leq\varepsilon}\mathbb{E}_{(x,y)\sim
D_{e}}\ell(\beta^{\top}\Phi(x+\delta_{e}),y)$ (8) $\displaystyle=$
$\displaystyle\sum_{e\in{\mathcal{E}}}\big{[}\mathbb{E}_{(x,y)\sim
D_{e}}\ell(\beta^{\top}\Phi(x),y)+$
$\displaystyle\max_{||\delta_{e}||\leq\varepsilon}\mathbb{E}_{(x,y)\sim
D_{e}}\left(\ell(\beta^{\top}\Phi(x+\delta_{e}),y)-\ell(\beta^{\top}\Phi(x),y)\right)\big{]}$
$\displaystyle\approx$
$\displaystyle\sum_{e\in{\mathcal{E}}}\big{[}R^{e}(\beta\cdot\Phi)+\varepsilon\underbrace{\left\|\mathbb{E}_{(x,y)\sim
D_{e}}\nabla_{x}\ell(\beta^{\top}\Phi(x),y)\right\|}_{\rm
Penalty_{DAT}}\big{]}.$

Based on this reformulation, we can show that there exists an intrinsic
relationship between DAT and IRM as in the following proposition:

######  Proposition 3.1.

Consider each $D_{e}$ as the corresponding distribution of a particular
training domain $e$. For any $\beta\cdot\Phi$ as a deep network with any
activation function, the penalty term of IRMv1, $\mathrm{Penalty_{IRM}}$ (Eq.
4), could be expressed as the square of a reweighted version of the penalty
term of the above approximate target, $\mathrm{Penalty_{DAT}}$(Eq. 8), on each
environment $e$ with coefficients related to the distribution $D_{e}$, which
could be stated as follows:

$\displaystyle\mathrm{Penalty_{IRM}}$
$\displaystyle=\left\|\mathbb{E}_{D_{e}}[L_{x}x+\tilde{B}_{x}]\right\|^{2}$
(9) $\displaystyle\mathrm{Penalty_{DAT}}$
$\displaystyle=\left\|\mathbb{E}_{D_{e}}L_{x}\right\|$ (10)

where $L_{x}=(1-\sigma(y\beta^{\top}\Phi_{x}x))y\beta^{\top}\Phi_{x}$ and
$\tilde{B}_{x}=\left(1-\sigma\left(y\beta^{\top}\Phi_{x}x\right)\right)y\beta^{\top}B_{x}$.
$B_{x}$ denotes the collection of constants introduced by bias terms in neural
network layers.

If we consider the extreme case where each domain only contains one sample, we
can see that DAT degenerates into AT as a special case. The equivalence
between IRMv1 and (linearized) DAT in this setting can be shown as follows,
which extends the similarity between IRM (Eq. 4) and AT (Eq. 6).

######  Remark 3.2 (Equivalence under Single-sample Environments).

When the environments degenerate into a single data point, we have the
following relationship: If $\varepsilon$ is sufficiently small, then for
$\beta\cdot\Phi$ as a deep network with any activation function, the penalty
term of IRMv1 (Eq. 4) on each sample and the square of the maximization term
of the linearized version of Eq. 7 (LDAT, obtained by the first-order
approximation of DAT)

$\mathrm{Penalty_{LDAT}}=\left\langle\nabla_{x}\ell\left(\beta^{T}\Phi(x),y\right),\pm\hat{\delta}_{x}\right\rangle$
(11)

on each sample with perturbation $\hat{\delta}_{x}=\pm\varepsilon x$ only
differ by a fixed multiple $\varepsilon^{2}$ and a bias term $B_{x}$, which is
formally stated as

$\displaystyle\mathrm{Penalty^{2}_{LDAT}}$
$\displaystyle=[\langle\nabla_{x}\ell\left(\beta^{T}\Phi(x),y\right),\pm\varepsilon
x\rangle]^{2}$ (12)
$\displaystyle=\varepsilon^{2}(1-\sigma(\beta^{\top}\Phi(x)))^{2}\left\|\beta^{\top}\Phi_{x}x\right\|^{2}$
$\displaystyle=\varepsilon^{2}\cdot\mathrm{Penalty^{\prime}_{IRM}},$

where
$\mathrm{Penalty^{\prime}_{IRM}}=(1-\sigma(y\beta^{\top}\Phi(x)))^{2}\left\|\beta^{\top}(\Phi_{x}x)\right\|^{2}$,
$\mathrm{Penalty_{IRM}}=(1-\sigma(y\beta^{\top}\Phi(x)))^{2}\left\|\beta^{\top}(\Phi_{x}x+B_{x})\right\|^{2}$.

The proofs of Proposition 3.1 and Remark 3.2 can be found in Appendix C. The
above connection between DAT and IRM highlights that our DAT is potentially
helpful in addressing OOD problems.

##  4 Empirical Investigation on Domain-wise Adversarial Training

In this section, we further explore how domain-wise perturbations could help
alleviate distribution shifts in real-world scenarios. In particular, we
noticed that domain-wise perturbations could effectively remove the domain-
varying _background information_ , which usually corresponds to spurious
features for image classification tasks. We empirically verify this property
by applying DAT to a well-designed OOD task based on background shift.

(a) Images and heatmaps of ERM from NICO.

(b) Images and heatmaps of ERM and DAT from Mixed-Same and Mixed-Rand.

Figure 2: Images from NICO and Mixed datasets and corresponding heatmaps of
the models. The red regions in the heatmaps correspond to the model’s focus
during prediction. Heatmaps demonstrate the effectiveness of DAT in attending
to interested objects rather than uncorrelated background information compared
to ERM.

###  4.1 Comparing ERM to DAT for Background Removal

#### ERM Learns Spurious Background Features.

Our understanding of DAT is based on the idea that an image is composed of a
foreground object and a corresponding background, and typically the object is
the invariant feature, while the background is only spuriously correlated with
the labels. However, models that rely on spurious background information will
easily fail when encountering images from a different domain. This phenomenon
is also empirically verified by Xiao et al. (2021), who find that models
trained on an ImageNet-like dataset with ERM require image backgrounds to
correctly classify large portions of test sets. These findings point out the
limitations of ERM and motivate us to find a solution that could effectively
learn a background-invariant classifier.

$\begin{array}[]{lccccc}\hline\cr\hline\cr\hbox{\multirowsetup
Algorithm}&\lx@intercol\hfil\text{}\hfil\lx@intercol{Correlationshift\qquad}&\lx@intercol\hfil\text{}\hfil\lx@intercol{Diversityshift\
\ \qquad}\\\ \cline{2-3}\cr\cline{4-5}\cr&\text{CMNIST}&\text{NICO }&\text{
PACS }&\text{ TerraInc }&\\\ \hline\cr\text{ERM (Baseline)}&58.5\pm
0.3&72.1\pm 1.6&81.5\pm 0.0&42.6\pm 0.9\\\ \hline\cr\text{VREx
\cite[citep]{(\@@bibref{AuthorsPhrase1Year}{krueger2020out}{\@@citephrase{{}
}}{})}}&56.3\pm 1.9&71.5\pm 2.3&81.8\pm 0.1&40.7\pm 0.7\\\ \text{GroupDRO
\cite[citep]{(\@@bibref{AuthorsPhrase1Year}{sagawa2019distributionally}{\@@citephrase{{}
}}{})}}&61.2\pm 0.6&71.0\pm 0.4&80.4\pm 0.3&36.8\pm 1.1\\\ \text{IRM
\cite[citep]{(\@@bibref{AuthorsPhrase1Year}{ahuja2020invariant}{\@@citephrase{{}
}}{})}}&\mathbf{70.2\pm 0.2}&\mathbf{73.3\pm 2.1}&81.1\pm 0.3&42.0\pm 1.8\\\
\text{ARM
\cite[citep]{(\@@bibref{AuthorsPhrase1Year}{zhang2020adaptive}{\@@citephrase{{}
}}{})} }&63.2\pm 0.7&67.3\pm 0.2&81.0\pm 0.4&39.4\pm 0.7\\\ \text{RSC
\cite[citep]{(\@@bibref{AuthorsPhrase1Year}{huang2020self}{\@@citephrase{{}
}}{})} }&58.5\pm 0.5&\mathbf{74.3\pm 1.9}&\mathbf{82.8\pm 0.4}&\mathbf{43.6\pm
0.5}\\\ \text{DANN
\cite[citep]{(\@@bibref{AuthorsPhrase1Year}{ganin2016domain}{\@@citephrase{{}
}}{})}}&58.3\pm 0.2&69.4\pm 1.7&81.1\pm 0.4&39.5\pm 0.2\\\ \text{MMD
\cite[citep]{(\@@bibref{AuthorsPhrase1Year}{li2018domain}{\@@citephrase{{}
}}{})}}&63.4\pm 0.7&68.9\pm 1.2&81.7\pm 0.2&38.3\pm 0.4\\\ \text{MTL
\cite[citep]{(\@@bibref{AuthorsPhrase1Year}{blanchard2017domain}{\@@citephrase{{}
}}{})} }&57.6\pm 0.3&70.6\pm 0.8&81.2\pm 0.4&38.9\pm 0.6\\\ \text{MLDG
\cite[citep]{(\@@bibref{AuthorsPhrase1Year}{li2018learning}{\@@citephrase{{}
}}{})}}&58.4\pm 0.2&66.6\pm 2.4&73.0\pm 0.4&27.3\pm 2.0\\\ \text{SagNet
\cite[citep]{(\@@bibref{AuthorsPhrase1Year}{nam2019reducing}{\@@citephrase{{}
}}{})} }&58.2\pm 0.3&69.8\pm 0.7&81.6\pm 0.4&42.3\pm 0.7\\\ \text{CORAL
\cite[citep]{(\@@bibref{AuthorsPhrase1Year}{sun2016deep}{\@@citephrase{{}
}}{})}}&57.6\pm 0.5&70.8\pm 1.0&81.6\pm 0.6&38.3\pm 0.7\\\ \text{Mixup
\cite[citep]{(\@@bibref{AuthorsPhrase1Year}{yan2020improve}{\@@citephrase{{}
}}{})}}&58.4\pm 0.2&72.5\pm 1.5&79.8\pm 0.6&39.8\pm 0.3\\\ \hline\cr\text{AT
(sample-wise)
\cite[citep]{(\@@bibref{AuthorsPhrase1Year}{goodfellow2014explaining}{\@@citephrase{{}
}}{})}}&57.9\pm 0.4&70.5\pm 0.7&\mathbf{82.0\pm 0.2}&42.6\pm 0.3\\\ \text{UAT
\cite[citep]{(\@@bibref{AuthorsPhrase1Year}{shafahi2020universal}{\@@citephrase{{}
}}{})}}&58.7\pm 2.3&69.1\pm 1.2&80.7\pm 0.4&41.9\pm 1.8\\\ \text{WRM
\cite[citep]{(\@@bibref{AuthorsPhrase1Year}{sinha2018certifying}{\@@citephrase{{}
}}{})}}&57.9\pm 3.3&68.2\pm 1.0&80.4\pm 0.0&26.1\pm 1.5\\\ \text{ADA
\cite[citep]{(\@@bibref{AuthorsPhrase1Year}{volpi2018generalizing}{\@@citephrase{{}
}}{})}}&56.3\pm 0.4&69.5\pm 1.9&80.2\pm 0.2&41.2\pm 0.7\\\ \hline\cr\text{DAT
(our work)}&\mathbf{68.4\pm 2.0}&72.6\pm 1.7&\mathbf{82.0\pm
0.1}&\mathbf{42.7\pm 0.7}\\\ \hline\cr\hline\cr\end{array}$ Table 1: Test
accuracy (%) on four representative tasks for OOD generalization. According to
the OOD-Bench (Ye et al. 2022), two are dominated by correlation shift, CMNIST
and NICO, and two are dominated by diversity shift, PACS and TerraInc. We
highlight the top two results on each task.

#### Removing Background Information with DAT.

Compared to the failure of ERM above, we notice that DAT can be applied to
eliminate domain-wise background information with its domain-specific
perturbations. Take the NICO images in Figure 2(a) as an example, where
samples from the environment “on grass” have a common background dominated by
green grass with low frequency, while the foreground object (e.g., the cats)
has complex and instance-specific shape and texture with much higher
frequency. In fact, Moosavi-Dezfooli et al. (2017) show that a universal
perturbation vector lies in a low-dimensional subspace, which fits the
background statistics and could be used to eliminate the low-frequency
background factor. Therefore, when our DAT is applied to these samples, the
domain-wise perturbation will capture the common domain-specific background.
Consequently, domain-wise AT will help remove the dependence on these spurious
background features.

###  4.2 Empirical Verification with Controlled Experiments

We construct a synthetic OOD task to verify the above analysis by evaluating a
classifier’s dependence on background information. It is based on two datasets
introduced by Xiao et al. (2021), Mixed-Same and Mixed-Rand, which are
constructed from a subset of ImageNet images with the background of each image
replaced by another background that is either of the same class (Mixed-Same)
or a random class (Mixed-Rand). As they are perfect candidates for evaluating
a classifier in terms of its background dependence, we construct a new OOD
task by using Mixed-Same as the training domain and evaluating the learned
classifier on Mixed-Rand as the test domain. If the classifier relies heavily
on background information, it will perform poorly in the test domain, where
objects and backgrounds are disentangled. In particular, the experiment
results show that ERM achieves a test accuracy of ${71.9\%}$, while DAT
achieves ${72.6\%}$ in the test domain with random background, which means
that DAT has a better generalization ability by effectively removing
background information. Sample images from the dataset and the corresponding
attention heatmaps are shown in Figure 2(b), demonstrating that ERM may lose
focus when the background correlation is broken while DAT does not. Details of
the experiment are shown in Appendix A.1.

##  5 Experiments

For the experiments, we follow the setting in Ye et al. (2022) and evaluate
the OOD generalization on both types of distribution shift: diversity shift
and correlation shift. In particular, we select four representative tasks. For
the correlation shift, we use CMNIST (Arjovsky et al. 2019), a synthetic
dataset on digit classification with color as the spurious feature, and NICO
(He, Shen, and Cui 2020), a real-world dataset on object classification with
context as the spurious feature. Regarding diversity shift, we use PACS (Li et
al. 2017) and Terra Incognita (Beery, Van Horn, and Perona 2018), which are
both datasets consisting of natural images with four domains. To ensure fair
evaluation, we perform all of our experiments following the evaluation
pipeline of DomainBed (Gulrajani and Lopez-Paz 2021). Specifically, we use the
same dataset splitting and model selection strategy as in Ye et al. (2022) for
each task. For datasets except for NICO, one of the domains is used as the
test domain. We train the models in each run, treating one of the domains as
the test domain and the rest as training domains, then report the average
accuracy of all domains. For NICO, the training, test, and evaluation domains
are predefined. We train the models on training domains, evaluate them on the
evaluation domain for model selection, and report their accuracy on the test
domain. More details of the experimental settings and domain-split results can
be found in Appendix A.2.

When training models using DAT, we first perform standard data augmentation
(Gulrajani and Lopez-Paz 2021), then proceed with the update of the
perturbation and model parameters as shown in Algorithm 1, where the perturbed
samples are clipped to the legal range after data augmentation. We use DAT
with perturbation bounded by $\ell_{2}$-norm in our experiments. To test DAT
on a wider range of tasks, we also carry out experiments on DomainBed
(Gulrajani and Lopez-Paz 2021), the results are shown in Appendix A.3.

###  5.1 Evaluation on Benchmark Datasets

We compare our results with previous work, including vanilla ERM, invariance-
based methods including IRM (Ahuja et al. 2020), robust optimization methods
including GroupDRO (Sagawa et al. 2020), distribution matching methods
including MMD (Li et al. 2018b) and CORAL (Sun and Saenko 2016), a method
based on domain classifier DANN (Ganin et al. 2016), and various other
algorithms. The results of the CMNIST dataset are adopted from Gulrajani and
Lopez-Paz (2021), which is the average of three domains, while the results of
the other datasets are adopted from Ye et al. (2022). In addition to that, we
implement and test four AT-based algorithms, including sample-wise adversarial
training AT (Goodfellow, Shlens, and Szegedy 2015), universal adversarial
training UAT (Shafahi et al. 2020), WRM (Sinha, Namkoong, and Duchi 2018), and
adversarial data augmentation ADA (Volpi et al. 2018).

From Table 1, we can see that DAT consistently outperforms ERM and achieves
good performance under both diversity and correlation shifts. Specifically,
DAT achieves much better results than ERM on correlation-shift tasks (CMNIST
and NICO) like IRM. Second, we can see that most domain generalization
algorithms at the moment cannot surpass ERM on tasks dominated by diversity
shifts. Although RSC has great performance on these tasks, it performs much
worse under correlation shifts. However, DAT consistently outperforms ERM and
could account for both kinds of shifts. Furthermore, compared to other AT-
based algorithms (i.e., sample-wise AT, UAT, WRM, and ADA), DAT has a fair
performance by considering a domain-wise perturbation that removes domain-
varying spurious features. The results demonstrate the effectiveness of DAT in
dealing with domain discrepancy.

###  5.2 Extension to Single Domain Generalization

As discussed in Section 4, DAT can reduce the influence of background even
when no domain labels are given, which corresponds to the single-source domain
generalization setting. We conduct experiments that strengthen this claim to
see how DAT could help in the single-source domain generalization setting. The
experimental setting can be found in Appendix B.

The results on the four datasets used in Table 1 are shown in Table 2. We can
see that our DAT has fair performance on all four datasets compared to ERM,
either under correlation shift or diversity shift. Although the difference is
not as significant as in the multiple-domain setting, it shows that our DAT
works for both single-domain and multi-domain generalization scenarios. In
particular, its advantages are more significant with multiple domains, where
the domain-wise perturbation mechanism is more effective.

We also test DAT on Digits, a common single-source domain generalization
dataset consisting of five sub-datasets: MNIST (LeCun et al. 1998), MNIST-M
(Ganin and Lempitsky 2015), SVHN (Netzer et al. 2011), SYN (Ganin and
Lempitsky 2015), and USPS (Denker et al. 1988). We show the results in Table
3. The performance of ERM is adopted from Qiao, Zhao, and Peng (2020). From
these results, we can see that DAT retains its better generalization ability
in the challenging single-domain generalization setting by outperforming ERM
in all tasks and could be a promising alternative to ERM.

Algorithm | CMNIST | NICO | PACS | TerraInc
---|---|---|---|---
ERM | $45.8\pm 0.7$ | $63.2\pm 2.9$ | $59.8\pm 1.6$ | $27.3\pm 4.0$
DAT | $\mathbf{46.0\pm 2.0}$ | $\mathbf{64.4\pm 0.7}$ | $\mathbf{59.9\pm 2.4}$ | $\mathbf{28.1\pm 4.0}$

Table 2: Average test accuracy (%) of ERM, DAT on four representative tasks
(single-source domain generalization).

Algorithm | SVHN | MNIST-M | SYN | USPS | Avg
---|---|---|---|---|---
ERM | 27.83 | 52.72 | 39.65 | 76.94 | 49.29
DAT | $\mathbf{28.2\pm 1.0}$ | $\mathbf{55.8\pm 1.4}$ | $\mathbf{43.1\pm 0.2}$ | $\mathbf{81.3\pm 1.0}$ | $\mathbf{52.1}$

Table 3: Results of ERM and DAT on Digits dataset Algorithm | CMNIST | NICO
---|---|---
UAT | $58.7\pm 2.3$ | $69.1\pm 1.2$
Ensemble UAT | $58.2\pm 2.3$ | $60.8\pm 0.2$
DAT | $\mathbf{68.4\pm 2.0}$ | $\mathbf{72.6\pm 1.7}$
Table 4: Results of UAT, Ensemble UAT, and DAT on CMNIST and NICO.

Under this setting, DAT generates perturbations in the only training domain,
thus degenerating into UAT. However, as shown in Table 1, DAT performs much
better in the multidomain setting, which shows the necessity of generating
domain-specific perturbations. Furthermore, to show that models trained using
DAT on multi-domains are not a trivial ensemble of models trained on single-
domains, we train voting classifiers on CMNIST and NICO using UAT models
trained separately on each domain. The results are shown in Table 4. We can
see that neither UAT nor ensemble UAT has the same performance as DAT. This
verifies the effectiveness of learning domain-wise perturbations using DAT.

###  5.3 Analysis

We conduct extensive experiments to better understand what our algorithm
learns and how the magnitude of hyperparameters affects its performance.

#### Qualitative Analysis through Semantic Graphs.

We use GradCam (Selvaraju et al. 2017; Gildenblat and contributors 2021) to
visualize the attention heatmaps of models trained by ERM, sample-wise AT, and
DAT on the NICO dataset. The results are shown in Figure 3, where we can see
that DAT pays more attention to the object itself than the strongly correlated
background, while ERM and sample-wise AT tend to use environmental features
instead.

Figure 3: Attention heatmaps of ERM, IRM, (sample-wise) AT, and our DAT on the
NICO dataset. Compared to other methods, DAT focuses more precisely on the
object itself.

#### Perturbation Radius and Step Size.

We investigate the effect of the perturbation radius $\varepsilon$ and the
perturbation step size $\alpha$ on the NICO dataset. The results are shown in
Table 5. The results show that the perturbation radius $\varepsilon$ greatly
affects the OOD performance. When $\varepsilon$ is too large $(>10^{-1})$, it
begins to hurt the invariant feature and causes performance degradation (from
$72.9\%$ to $67.9\%$). The step size $\alpha$ has a smaller influence, and
choosing a value between $1/100$ and $1/10$ times the size of $\varepsilon$
would be appropriate. The effect of the norm used for perturbation in DAT is
analyzed in Appendix A.4.

Radius $\varepsilon$ | Step Size $\alpha$ | Acc (%)
---|---|---
$[10^{-2},10^{-1}]$ | $[10^{-4},10^{-3}]$ | $72.6\pm 1.7$
$[10^{-3},10^{-2}]$ | $72.0\pm 2.1$
$[10^{-2},10^{-1}]$ | $68.9\pm 1.5$
$[10^{-1},10^{0}]$ | $[10^{-3},10^{-2}]$ | $71.2\pm 0.4$
$[10^{-2},10^{-1}]$ | $66.6\pm 1.7$
$[10^{-1},10^{0}]$ | $69.4\pm 0.4$
$[10^{0},10^{1}]$ | $[10^{-3},10^{-2}]$ | $64.6\pm 0.3$
$[10^{-2},10^{-1}]$ | $67.9\pm 2.0$
$[10^{-1},10^{0}]$ | $67.4\pm 0.4$
Table 5: Comparison of the test accuracy of different perturbation radius
$\varepsilon$ and step size $\alpha$ of $\ell_{2}$-norm bounded DAT on the
NICO dataset.

##  6 Discussions

#### Comparison with Sample-wise AT.

Previous works (Hendrycks et al. 2021; Yi et al. 2021) try to exploit _sample-
wise_ AT as a data augmentation strategy to obtain higher OOD performance.
However, the performance only improves when the distribution shift is
dominated by diversity shift, e.g., noise, and blurring. Otherwise,
performance might be degraded, as shown in Table 1. One possible explanation
is that sample-wise AT fails to capture the domain-level variations as DAT. As
a result, it may add perturbations to the invariant features and hurt
performance, especially under correlation shift.

#### Comparison with Invariant Causal Prediction.

A thread of methods, including ICP (Peters, Bühlmann, and Meinshausen 2016),
IRM (Arjovsky et al. 2019), and IGA (Koyama and Yamaguchi 2020), try to find
invariant data representations that could induce an invariant classifier. They
have superior performance on synthetic datasets like CMNIST but fail to
outperform ERM on real-world datasets (tasks dominated by both correlation
shift and diversity shift). We believe that these failures could be attributed
to the lack of prior information of their invariant learning principles. In
our DAT, we effectively exploit the foreground-background difference in image
classification tasks through domain-wise perturbations.

##  7 Conclusion

In this work, we carefully analyze the similarity between IRM and adversarial
training in a domain-wise manner and establish a formal connection between OOD
and adversarial robustness. Based on this connection, we propose a new
adversarial training method for domain generalization: Domain-wise Adversarial
Training (DAT). We show that it could effectively remove spurious background
features in image classification and obtain fair performance on benchmark
datasets. In particular, our DAT could consistently outperform ERM on tasks
dominated by both the correlation shift and the diversity shift, while
previous methods typically fail in one of the two cases.

## Acknowledgment

Yisen Wang is partially supported by the NSF China (No. 62006153), Open
Research Projects of Zhejiang Lab (No. 2022RC0AB05), and Huawei Technologies
Inc.

## References

  * Ahuja et al. (2020) Ahuja, K.; Shanmugam, K.; Varshney, K.; and Dhurandhar, A. 2020.  Invariant risk minimization games.  In _ICML_.
  * Arjovsky et al. (2019) Arjovsky, M.; Bottou, L.; Gulrajani, I.; and Lopez-Paz, D. 2019.  Invariant risk minimization.  arXiv:1907.02893.
  * Athalye, Carlini, and Wagner (2018) Athalye, A.; Carlini, N.; and Wagner, D. 2018.  Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples.  In _ICML_.
  * Beery, Van Horn, and Perona (2018) Beery, S.; Van Horn, G.; and Perona, P. 2018.  Recognition in terra incognita.  In _ECCV_.
  * Blanchard et al. (2021) Blanchard, G.; Deshmukh, A. A.; Dogan, Ü.; Lee, G.; and Scott, C. D. 2021.  Domain Generalization by Marginal Transfer Learning.  _J. Mach. Learn. Res._ , 22: 2:1–2:55.
  * Brown et al. (2020) Brown, T.; Mann, B.; Ryder, N.; Subbiah, M.; Kaplan, J. D.; Dhariwal, P.; Neelakantan, A.; Shyam, P.; Sastry, G.; Askell, A.; Agarwal, S.; Herbert-Voss, A.; Krueger, G.; Henighan, T.; Child, R.; Ramesh, A.; Ziegler, D.; Wu, J.; Winter, C.; Hesse, C.; Chen, M.; Sigler, E.; Litwin, M.; Gray, S.; Chess, B.; Clark, J.; Berner, C.; McCandlish, S.; Radford, A.; Sutskever, I.; and Amodei, D. 2020.  Language Models are Few-Shot Learners.  In _NeurIPS_.
  * Denker et al. (1988) Denker, J. S.; Gardner, W. R.; Graf, H. P.; Henderson, D.; Howard, R. E.; Hubbard, W. E.; Jackel, L. D.; Baird, H. S.; and Guyon, I. 1988.  Neural Network Recognizer for Hand-Written Zip Code Digits.  In _NeurIPS_.
  * Duchi, Glynn, and Namkoong (2021) Duchi, J. C.; Glynn, P. W.; and Namkoong, H. 2021.  Statistics of robust optimization: A generalized empirical likelihood approach.  _Mathematics of Operations Research_.
  * Ford et al. (2019) Ford, N.; Gilmer, J.; Carlini, N.; and Cubuk, E. D. 2019.  Adversarial Examples Are a Natural Consequence of Test Error in Noise.  In _ICML_.
  * Ganin and Lempitsky (2015) Ganin, Y.; and Lempitsky, V. 2015.  Unsupervised domain adaptation by backpropagation.  In _ICML_.
  * Ganin et al. (2016) Ganin, Y.; Ustinova, E.; Ajakan, H.; Germain, P.; Larochelle, H.; Laviolette, F.; Marchand, M.; and Lempitsky, V. S. 2016.  Domain-Adversarial Training of Neural Networks.  _Journal of Machine Learning Research_ , 17: 59:1–59:35.
  * Gildenblat and contributors (2021) Gildenblat, J.; and contributors. 2021.  PyTorch library for CAM methods.  https://github.com/jacobgil/pytorch-grad-cam.
  * Gokhale et al. (2021) Gokhale, T.; Anirudh, R.; Kailkhura, B.; J. Thiagarajan, J.; Baral, C.; and Yang, Y. 2021.  Attribute-Guided Adversarial Training for Robustness to Natural Perturbations.  In _AAAI_.
  * Goodfellow, Shlens, and Szegedy (2015) Goodfellow, I. J.; Shlens, J.; and Szegedy, C. 2015.  Explaining and harnessing adversarial examples.  In _ICLR_.
  * Gulrajani and Lopez-Paz (2021) Gulrajani, I.; and Lopez-Paz, D. 2021.  In Search of Lost Domain Generalization.  In _ICLR_.
  * He et al. (2016) He, K.; Zhang, X.; Ren, S.; and Sun, J. 2016.  Deep residual learning for image recognition.  In _CVPR_.
  * He, Shen, and Cui (2020) He, Y.; Shen, Z.; and Cui, P. 2020.  Towards Non-IID Image Classification: A Dataset and Baselines.  _Pattern Recognition_ , 107383.
  * Hendrycks et al. (2021) Hendrycks, D.; Basart, S.; Mu, N.; Kadavath, S.; Wang, F.; Dorundo, E.; Desai, R.; Zhu, T.; Parajuli, S.; Guo, M.; Song, D.; Steinhardt, J.; and Gilmer, J. 2021\.  The Many Faces of Robustness: A Critical Analysis of Out-of-Distribution Generalization.  In _ICCV_.
  * Huang et al. (2020) Huang, Z.; Wang, H.; Xing, E. P.; and Huang, D. 2020.  Self-Challenging Improves Cross-Domain Generalization.  In _ECCV_.
  * Kamath et al. (2021) Kamath, P.; Tangella, A.; Sutherland, D. J.; and Srebro, N. 2021.  Does Invariant Risk Minimization Capture Invariance?  In _AISTATS_.
  * Koyama and Yamaguchi (2020) Koyama, M.; and Yamaguchi, S. 2020.  When is invariance useful in an Out-of-Distribution Generalization problem?  arXiv:2008.01883.
  * Krueger et al. (2021) Krueger, D.; Caballero, E.; Jacobsen, J.-H.; Zhang, A.; Binas, J.; Zhang, D.; Priol, R. L.; and Courville, A. C. 2021.  Out-of-Distribution Generalization via Risk Extrapolation (REx).  In _ICML_.
  * LeCun et al. (1998) LeCun, Y.; Bottou, L.; Bengio, Y.; and Haffner, P. 1998.  Gradient-based learning applied to document recognition.  _Proceedings of the IEEE_.
  * Li et al. (2017) Li, D.; Yang, Y.; Song, Y.-Z.; and Hospedales, T. M. 2017.  Deeper, broader and artier domain generalization.  In _ICCV_.
  * Li et al. (2018a) Li, D.; Yang, Y.; Song, Y.-Z.; and Hospedales, T. M. 2018a.  Learning to generalize: Meta-learning for domain generalization.  In _AAAI_.
  * Li et al. (2018b) Li, H.; Pan, S. J.; Wang, S.; and Kot, A. C. 2018b.  Domain generalization with adversarial feature learning.  In _CVPR_.
  * Madry et al. (2018) Madry, A.; Makelov, A.; Schmidt, L.; Tsipras, D.; and Vladu, A. 2018.  Towards Deep Learning Models Resistant to Adversarial Attacks.  In _ICLR_.
  * Moosavi-Dezfooli et al. (2017) Moosavi-Dezfooli, S.-M.; Fawzi, A.; Fawzi, O.; and Frossard, P. 2017.  Universal adversarial perturbations.  In _CVPR_.
  * Nam et al. (2021) Nam, H.; Lee, H.; Park, J.; Yoon, W.; and Yoo, D. 2021.  Reducing Domain Gap by Reducing Style Bias.  In _CVPR_.
  * Netzer et al. (2011) Netzer, Y.; Wang, T.; Coates, A.; Bissacco, A.; Wu, B.; and Ng, A. 2011.  Reading Digits in Natural Images with Unsupervised Feature Learning.  In _NeurIPS Workshop on Deep Learning and Unsupervised Feature Learning_.
  * Peters, Bühlmann, and Meinshausen (2016) Peters, J.; Bühlmann, P.; and Meinshausen, N. 2016.  Causal inference by using invariant prediction: identification and confidence intervals.  _Journal of the Royal Statistical Society. Series B (Statistical Methodology)_.
  * Qiao, Zhao, and Peng (2020) Qiao, F.; Zhao, L.; and Peng, X. 2020.  Learning to Learn Single Domain Generalization.  In _CVPR_.
  * Rahimian and Mehrotra (2019) Rahimian, H.; and Mehrotra, S. 2019.  Distributionally robust optimization: A review.  arXiv:1908.05659.
  * Ren et al. (2021) Ren, J.; Zhang, D.; Wang, Y.; Chen, L.; Zhou, Z.; Chen, Y.; Cheng, X.; Wang, X.; Zhou, M.; Shi, J.; et al. 2021.  A unified game-theoretic interpretation of adversarial robustness.  In _NeurIPS_.
  * Rosenfeld, Ravikumar, and Risteski (2021) Rosenfeld, E.; Ravikumar, P. K.; and Risteski, A. 2021.  The Risks of Invariant Risk Minimization.  In _ICLR_.
  * Sagawa et al. (2020) Sagawa, S.; Koh, P. W.; Hashimoto, T. B.; and Liang, P. 2020.  Distributionally Robust Neural Networks.  In _ICLR_.
  * Salman et al. (2020) Salman, H.; Ilyas, A.; Engstrom, L.; Kapoor, A.; and Madry, A. 2020.  Do Adversarially Robust ImageNet Models Transfer Better?  In _NeurIPS_.
  * Selvaraju et al. (2017) Selvaraju, R. R.; Cogswell, M.; Das, A.; Vedantam, R.; Parikh, D.; and Batra, D. 2017.  Grad-cam: Visual explanations from deep networks via gradient-based localization.  In _ICCV_.
  * Shafahi et al. (2020) Shafahi, A.; Najibi, M.; Xu, Z.; Dickerson, J. P.; Davis, L. S.; and Goldstein, T. 2020.  Universal Adversarial Training.  In _AAAI_.
  * Shankar et al. (2018) Shankar, S.; Piratla, V.; Chakrabarti, S.; Chaudhuri, S.; Jyothi, P.; and Sarawagi, S. 2018.  Generalizing Across Domains via Cross-Gradient Training.  In _ICLR_.
  * Sinha, Namkoong, and Duchi (2018) Sinha, A.; Namkoong, H.; and Duchi, J. 2018.  Certifying Some Distributional Robustness with Principled Adversarial Training.  In _ICLR_.
  * Sun and Saenko (2016) Sun, B.; and Saenko, K. 2016.  Deep coral: Correlation alignment for deep domain adaptation.  In _ECCV_.
  * Szegedy et al. (2014) Szegedy, C.; Zaremba, W.; Sutskever, I.; Bruna, J.; Erhan, D.; Goodfellow, I. J.; and Fergus, R. 2014.  Intriguing properties of neural networks.  In _ICLR_.
  * Volpi et al. (2018) Volpi, R.; Namkoong, H.; Sener, O.; Duchi, J. C.; Murino, V.; and Savarese, S. 2018\.  Generalizing to Unseen Domains via Adversarial Data Augmentation.  In _NeurIPS_.
  * Wang and Wang (2022) Wang, H.; and Wang, Y. 2022.  Self-Ensemble Adversarial Training for Improved Robustness.  In _ICLR_.
  * Wang et al. (2022) Wang, Q.; Wang, Y.; Zhu, H.; and Wang, Y. 2022.  Improving Out-of-Distribution Generalization by Adversarial Training with Structured Priors.  In _NeurIPS_.
  * Wang et al. (2017) Wang, Y.; Deng, X.; Pu, S.; and Huang, Z. 2017.  Residual convolutional CTC networks for automatic speech recognition.  _arXiv preprint arXiv:1702.07793_.
  * Wang et al. (2019) Wang, Y.; Ma, X.; Bailey, J.; Yi, J.; Zhou, B.; and Gu, Q. 2019.  On the Convergence and Robustness of Adversarial Training.  In _ICML_.
  * Wang et al. (2020) Wang, Y.; Zou, D.; Yi, J.; Bailey, J.; Ma, X.; and Gu, Q. 2020.  Improving Adversarial Robustness Requires Revisiting Misclassified Examples.  In _ICLR_.
  * Wu, Xia, and Wang (2020) Wu, D.; Xia, S.-T.; and Wang, Y. 2020.  Adversarial Weight Perturbation Helps Robust Generalization.  In _NeurIPS_.
  * Xiao et al. (2021) Xiao, K. Y.; Engstrom, L.; Ilyas, A.; and Madry, A. 2021.  Noise or Signal: The Role of Image Backgrounds in Object Recognition.  In _ICLR_.
  * Yan et al. (2020) Yan, S.; Song, H.; Li, N.; Zou, L.; and Ren, L. 2020.  Improve unsupervised domain adaptation with mixup training.
  * Ye et al. (2022) Ye, N.; Li, K.; Bai, H.; Yu, R.; Hong, L.; Zhou, F.; Li, Z.; and Zhu, J. 2022.  OoD-Bench: Quantifying and Understanding Two Dimensions of Out-of-Distribution Generalization.  In _CVPR_.
  * Yi et al. (2021) Yi, M.; Hou, L.; Sun, J.; Shang, L.; Jiang, X.; Liu, Q.; and Ma, Z.-M. 2021.  Improved OOD Generalization via Adversarial Training and Pre-training.  In _ICML_.
  * Zhang et al. (2021a) Zhang, D.; Ahuja, K.; Xu, Y.; Wang, Y.; and Courville, A. 2021a.  Can subnetwork structure be the key to out-of-distribution generalization?  In _ICML_.
  * Zhang et al. (2021b) Zhang, M.; Marklund, H.; Dhawan, N.; Gupta, A.; Levine, S.; and Finn, C. 2021b.  Adaptive Risk Minimization: Learning to Adapt to Domain Shift.  In _NeurIPS_.

##  Appendix A Experiment Settings and More Detailed Results

We train all the models based on the DomainBed benchmark presented in
(Gulrajani and Lopez-Paz 2021).

###  A.1 Mixed-Same and Mixed-Rand

To construct the dataset, we use the validation set of Mixed-Same (4185
images) provided by (Xiao et al. 2021) as the training environment and use the
validation set of Mixed-Rand (4185 images) as the testing (OOD) environment.

For training, we use pre-trained ResNet-18 as the backbone and train it for
5000 iterations. The hyperparameters are the same as those proposed in
(Gulrajani and Lopez-Paz 2021), except that the learning rate searching
interval is altered to $[10^{-5.5},10^{-4.5}]$, while we set the
hyperparameters search space of DAT as $\varepsilon\in[10^{-0.5},10^{0}]$,
$\alpha\in[10^{-1.5},10^{-1}]$.

###  A.2 Typical OOD Datasets

We conduct experiments on four typical OOD datasets, including CMNIST, NICO,
Terra Incognita, and PACS. We split the NICO dataset using the same strategy
in (Ye et al. 2022) for a fair comparison.

For network architecture, models trained on CMNIST adopt the four-layer
convolution network MNIST-CNN provided in the DomainBed benchmark (Gulrajani
and Lopez-Paz 2021), while other datasets use ResNet-18 as the backbone. For
Terra Incognita and PACS, pre-trained ResNet-18 is used. While on NICO, we use
unpretrained ResNet-18 as the pre-training dataset contains photos that are
largely overlapped with ImageNet classes.

For model selection, models trained on PACS and Terra Incognita are selected
by training-domain validation, which selects the model with the highest
training accuracy averaged across all training domains. For NICO, an
additional OOD validation set is used. CMNIST, due to the large correlation
shift, uses test-domain validation as its model selection criteria.

DAT, AT, and UAT models are trained for an appropriate number of iterations to
ensure convergence, that is, $5000$ for Terra Incognita, $8000$ for NICO, and
$10000$ for CMNIST and PACS.

When training NICO using DAT, we clamp the single sample adversarial loss to
$(0,2)$ to obtain a better domain-wise perturbation as suggested in (Shafahi
et al. 2020).

We use the same hyperparameters as those proposed in (Ye et al. 2022) whenever
possible while setting the hyperparameters search space for DAT, sample-wise
AT, and UAT as in Table 6, 7 and 8. We use DAT with perturbation bounded by
$\ell_{2}$-norm in our experiments. For sample-wise AT, we use a 10-step
$\ell_{2}$ PGD (Madry et al. 2018).

For WRM, we set the step number to $10$ in inner maximization while searching
for the learning rate in inner maximization in the range $[10^{-2},10^{-1}]$
and $\gamma$ in the range $[10^{-0.5},10^{0.5}]$. We train the models for
$5000$ iterations to ensure convergence.

For ADA, we set the step number to $10$ in the inner maximization while
searching for the adversarial learning rate in the range $[10^{-1},10^{0.5}]$,
$\gamma$ in the range $[0.5,1.5]$, the number of steps in the min-phase in the
range $[10^{0.5},10^{2.5}]$, and the number of whole adversarial phases in the
range $[10^{0.5},10^{2}]$. We train the models for $5000$ iterations to ensure
convergence.

Dataset | Radius $\varepsilon$ | Step Size $\alpha$
---|---|---
CMNIST | $[10^{-1},10^{2}]$ | $[10^{-2},10^{1}]$
NICO | $[10^{-2},10^{-1}]$ | $[10^{-4},10^{-3}]$
PACS | $[10^{-1},10^{2}]$ | $[10^{-2},10^{1}]$
TerraInc | $[10^{-0.5},10^{0.7}]$ | $[10^{-2},10^{-1}]$
Table 6: Hyperparameter Search Space for DAT on Typical OOD Datasets. Dataset | Radius $\varepsilon$ | Step Size $\alpha$
---|---|---
CMNIST | $[10^{-1},10^{1}]$ | $[10^{-2},10^{0}]$
NICO | $[10^{-1},10^{0}]$ | $[10^{-2},10^{-1}]$
PACS | $[10^{-2},10^{-1}]$ | $[10^{-3},10^{-2}]$
TerraInc | $[10^{-1},10^{0}]$ | $[10^{-2},10^{-1}]$
Table 7: Hyperparameter Search Space for (sample-wise) AT on Typical OOD Datasets. Dataset | Radius $\varepsilon$ | Step Size $\alpha$
---|---|---
CMNIST | $[10^{-1},10^{2}]$ | $[10^{-2},10^{1}]$
NICO | $[10^{-2},10^{-1}]$ | $[10^{-4},10^{-3}]$
PACS | $[10^{-1},10^{2}]$ | $[10^{-2},10^{1}]$
TerraInc | $[10^{0},10^{0.5}]$ | $[10^{-2},10^{-1}]$
Table 8: Hyperparameter Search Space for UAT on Typical OOD Datasets.

The domain-split results for ERM, UAT, and DAT are shown in Table 9, 10, and
11, where the results of ERM on CMNIST are from (Gulrajani and Lopez-Paz 2021)
and all other results come from our experiments.

(a) Training domain validation. Algorithm | $0.1$ | $0.2$ | $0.9$ | Average
---|---|---|---|---
ERM | $\mathbf{72.7\pm 0.2}$ | $73.2\pm 0.3$ | $10.0\pm 0.0$ | $52.0\pm 0.1$
UAT | $72.1\pm 0.1$ | $\mathbf{73.7\pm 0.1}$ | $10.0\pm 0.1$ | $52.0\pm 0.1$
DAT | $72.4\pm 0.2$ | $\mathbf{73.7\pm 0.1}$ | $\mathbf{10.2\pm 0.2}$ | $\mathbf{52.1\pm 0.1}$

(b) Test domain validation (Oracle). Algorithm | $0.1$ | $0.2$ | $0.9$ | Average
---|---|---|---|---
ERM | $72.3\pm 0.6$ | $73.1\pm 0.3$ | $30.0\pm 0.3$ | $58.5\pm 0.3$
UAT | $75.3\pm 6.4$ | $71.9\pm 0.7$ | $29.0\pm 0.2$ | $58.7\pm 2.3$
DAT | $\mathbf{78.5\pm 4.8}$ | $\mathbf{79.3\pm 0.2}$ | $\mathbf{47.5\pm 2.6}$ | $\mathbf{68.4\pm 2.0}$

Table 9: Test accuracy of ERM, UAT, and DAT on CMNIST.

Algorithm | Artpaint | Cartoon | Photo | Sketch | Average
---|---|---|---|---|---
ERM | $\mathbf{80.5\pm 0.8}$ | $74.2\pm 0.5$ | $\mathbf{94.7\pm 0.5}$ | $72.9\pm 2.1$ | $80.6\pm 0.6$
UAT | $79.9\pm 0.6$ | $74.7\pm 0.8$ | $92.6\pm 0.4$ | $75.5\pm 2.1$ | $80.7\pm 0.4$
DAT | $80.0\pm 0.3$ | $\mathbf{77.6\pm 0.8}$ | $92.6\pm 0.9$ | $\mathbf{77.6\pm 0.5}$ | $\mathbf{82.0\pm 0.1}$

(a) Test domain validation (Oracle). Algorithm | Artpaint | Cartoon | Photo | Sketch | Average
---|---|---|---|---|---
ERM | $79.7\pm 1.0$ | $\mathbf{76.9\pm 0.3}$ | $\mathbf{94.2\pm 0.4}$ | $78.3\pm 1.5$ | $\mathbf{82.3\pm 0.4}$
UAT | $\mathbf{80.4\pm 2.1}$ | $75.0\pm 0.4$ | $93.5\pm 0.5$ | $\mathbf{79.3\pm 0.4}$ | $82.0\pm 0.6$
DAT | $79.7\pm 0.1$ | $74.9\pm 0.7$ | $93.9\pm 0.6$ | $78.1\pm 0.4$ | $81.7\pm 0.2$
(b) Training domain validation.

Table 10: Test accuracy of ERM, UAT, and DAT on PACS.

Algorithm | L100 | L38 | L43 | L46 | Average
---|---|---|---|---|---
ERM | $53.2\pm 1.4$ | $31.9\pm 0.3$ | $50.2\pm 0.9$ | $\mathbf{33.6\pm 0.3}$ | $42.2\pm 0.4$
UAT | $47.2\pm 3.3$ | $\mathbf{36.9\pm 1.6}$ | $\mathbf{50.3\pm 0.3}$ | $32.8\pm 0.3$ | $41.8\pm 1.2$
DAT | $\mathbf{53.8\pm 1.6}$ | $35.1\pm 2.3$ | $\mathbf{50.3\pm 0.3}$ | $31.7\pm 0.6$ | $\mathbf{42.7\pm 0.7}$
(a) Training domain validation.

Algorithm | L100 | L38 | L43 | L46 | Average
---|---|---|---|---|---
ERM | $\mathbf{55.8\pm 1.1}$ | $40.8\pm 2.0$ | $49.8\pm 1.3$ | $35.0\pm 0.2$ | $45.3\pm 0.3$
UAT | $50.5\pm 2.6$ | $40.3\pm 0.2$ | $50.7\pm 0.3$ | $34.3\pm 0.5$ | $44.0\pm 0.6$
DAT | $54.1\pm 2.3$ | $\mathbf{42.5\pm 2.1}$ | $\mathbf{52.7\pm 0.8}$ | $\mathbf{35.1\pm 1.0}$ | $\mathbf{46.1\pm 0.6}$
(b) Test domain validation (Oracle).

Table 11: Test accuracy of ERM, UAT, and DAT on TerraInc.

###  A.3 DomainBed

In this section, we present the performance of DAT on DomainBed benchmark
(Gulrajani and Lopez-Paz 2021) except DomainNet in Table 12. The results for
all other baselines are from the official repository of DomainBed. We
highlight the results where DAT performs better than ERM. From the results, we
can see that DAT outperforms ERM on most datasets while having comparable
performance on other datasets.

Algorithm | ColoredMNIST | RotatedMNIST | VLCS | PACS | OfficeHome | TerraIncognita | Avg
---|---|---|---|---|---|---|---
ERM | 51.5 $\pm$ 0.1 | 98.0 $\pm$ 0.0 | 77.5 $\pm$ 0.4 | 85.5 $\pm$ 0.2 | 66.5 $\pm$ 0.3 | 46.1 $\pm$ 1.8 | 70.9
IRM | 52.0 $\pm$ 0.1 | 97.7 $\pm$ 0.1 | 78.5 $\pm$ 0.5 | 83.5 $\pm$ 0.8 | 64.3 $\pm$ 2.2 | 47.6 $\pm$ 0.8 | 70.6
GroupDRO | 52.1 $\pm$ 0.0 | 98.0 $\pm$ 0.0 | 76.7 $\pm$ 0.6 | 84.4 $\pm$ 0.8 | 66.0 $\pm$ 0.7 | 43.2 $\pm$ 1.1 | 70.1
Mixup | 52.1 $\pm$ 0.2 | 98.0 $\pm$ 0.1 | 77.4 $\pm$ 0.6 | 84.6 $\pm$ 0.6 | 68.1 $\pm$ 0.3 | 47.9 $\pm$ 0.8 | 71.3
MLDG | 51.5 $\pm$ 0.1 | 97.9 $\pm$ 0.0 | 77.2 $\pm$ 0.4 | 84.9 $\pm$ 1.0 | 66.8 $\pm$ 0.6 | 47.7 $\pm$ 0.9 | 71.0
CORAL | 51.5 $\pm$ 0.1 | 98.0 $\pm$ 0.1 | 78.8 $\pm$ 0.6 | 86.2 $\pm$ 0.3 | 68.7 $\pm$ 0.3 | 47.6 $\pm$ 1.0 | 71.8
MMD | 51.5 $\pm$ 0.2 | 97.9 $\pm$ 0.0 | 77.5 $\pm$ 0.9 | 84.6 $\pm$ 0.5 | 66.3 $\pm$ 0.1 | 42.2 $\pm$ 1.6 | 70.0
DANN | 51.5 $\pm$ 0.3 | 97.8 $\pm$ 0.1 | 78.6 $\pm$ 0.4 | 83.6 $\pm$ 0.4 | 65.9 $\pm$ 0.6 | 46.7 $\pm$ 0.5 | 70.7
CDANN | 51.7 $\pm$ 0.1 | 97.9 $\pm$ 0.1 | 77.5 $\pm$ 0.1 | 82.6 $\pm$ 0.9 | 65.8 $\pm$ 1.3 | 45.8 $\pm$ 1.6 | 70.2
MTL | 51.4 $\pm$ 0.1 | 97.9 $\pm$ 0.0 | 77.2 $\pm$ 0.4 | 84.6 $\pm$ 0.5 | 66.4 $\pm$ 0.5 | 45.6 $\pm$ 1.2 | 70.5
SagNet | 51.7 $\pm$ 0.0 | 98.0 $\pm$ 0.0 | 77.8 $\pm$ 0.5 | 86.3 $\pm$ 0.2 | 68.1 $\pm$ 0.1 | 48.6 $\pm$ 1.0 | 71.7
ARM | 56.2 $\pm$ 0.2 | 98.2 $\pm$ 0.1 | 77.6 $\pm$ 0.3 | 85.1 $\pm$ 0.4 | 64.8 $\pm$ 0.3 | 45.5 $\pm$ 0.3 | 71.2
VREx | 51.8 $\pm$ 0.1 | 97.9 $\pm$ 0.1 | 78.3 $\pm$ 0.2 | 84.9 $\pm$ 0.6 | 66.4 $\pm$ 0.6 | 46.4 $\pm$ 0.6 | 70.9
RSC | 51.7 $\pm$ 0.2 | 97.6 $\pm$ 0.1 | 77.1 $\pm$ 0.5 | 85.2 $\pm$ 0.9 | 65.5 $\pm$ 0.9 | 46.6 $\pm$ 1.0 | 70.6
DAT | 52.1 $\pm$ 0.1 | 97.9 $\pm$ 0.0 | 77.2 $\pm$ 0.3 | 86.0 $\pm$ 0.4 | 67.0 $\pm$ 0.4 | 47.1 $\pm$ 0.8 | 71.2
Table 12: Sweep results on DomainBed.

###  A.4 The Effect of the Norm Used for Perturbation in DAT

In this section, we provide the results of DAT on the NICO dataset using
$\ell_{\infty}$ as the perturbation norm instead of $\ell_{2}$ used in Table 5
in Section 5.3. The results are shown in Table 13, which shows that we could
still obtain a good performance in this scenario by choosing a sufficiently
large perturbation radius.

Radius $\varepsilon$ | Step Size $\alpha$ | Acc (%)
---|---|---
$[10^{-3},10^{-2}]$ | $[10^{-4},10^{-3}]$ | $68.5\pm 0.2$
$[10^{-2},10^{-1}]$ | $[10^{-3},10^{-2}]$ | $67.9\pm 2.4$
$[10^{-1},10^{0}]$ | $[10^{-3},10^{-2}]$ | $72.5\pm 1.6$
Table 13: Test accuracy of $\ell_{\infty}$-norm bounded DAT on the NICO
dataset.

###  A.5 The Effect of the Batch Size Used for Perturbation in DAT

As DAT calculates the increment of the perturbation based on a batch of
inputs, the performance correlates with the batch size during training. As the
batch size we used is sampled in a search space, we empirically verified this
by showing the scatter plot of the batch size and the test accuracy on PACS,
as shown in Fig. 4. We can see that the batch size has a positive correlation
with the performance, which means that a better approximation of the
distributional level update of the perturbation in each step leads to better
performance, which does support our underlying hypothesis that generating
adversarial perturbations with respect to domain distribution could lead to
better OOD generalization performance.

Figure 4: The Test Accuracy of DAT models with different batch size on the
four domains of PACS. Regression lines are shown.

##  Appendix B On Single-source Domain Generalization

To show that our method can also be applied to single-source domain
generalization scenarios, we conduct experiments with settings similar to
those of Appendix A.2 on the four benchmark datasets, except that we train on
one of the domains and report its test accuracy on all other domains. For the
NICO dataset, as it comes with a validation domain, we train the models on one
of the training domains, using the validation domain for model selection, then
report its accuracy on the test domain.

We train all models using ERM/DAT for $5000$ iterations to ensure convergence
and set the hyperparameter search space of DAT as shown in Table 14. All other
settings are the same as those shown in Appendix A.2.

Dataset | Radius $\varepsilon$ | Step Size $\alpha$
---|---|---
CMNIST | $[10^{-1},10^{2}]$ | $[10^{-2},10^{1}]$
NICO | $[10^{-2},10^{-1}]$ | $[10^{-4},10^{-3}]$
PACS | $[10^{-2},10^{-1}]$ | $[10^{-3},10^{-2}]$
TerraInc | $[10^{-0.5},10^{0.7}]$ | $[10^{-2},10^{-1}]$
Table 14: Hyperparameter searching space for DAT on typical OOD datasets
(single-source domain generalization).

For the Digits dataset, we used the exact same setting as in (Qiao, Zhao, and
Peng 2020), where the model is trained on the MNIST dataset and tested on all
other four datasets.

The domain-split results for ERM and DAT under single-source domain
generalization setting are shown in Table 15(a) to 15(h).

Training Domain | 0.1 | 0.2 | 0.9 | Avg
---|---|---|---|---
0.1 | \ | $79.8\pm 0.2$ | $21.2\pm 0.2$ | $50.5$
0.2 | $88.7\pm 0.4$ | \ | $35.2\pm 1.3$ | $\mathbf{62.0}$
0.9 | $21.0\pm 0.9$ | $29.1\pm 0.7$ | \ | $\mathbf{25.1}$
(a) ERM on CMNIST.

Training Domain | 0.1 | 0.2 | 0.9 | Avg
---|---|---|---|---
0.1 | \ | $80.0\pm 0.1$ | $27.9\pm 4.7$ | $\mathbf{54.0}$
0.2 | $90.0\pm 0.1$ | \ | $32.4\pm 1.0$ | $61.2$
0.9 | $18.3\pm 1.1$ | $27.1\pm 1.1$ | \ | $22.7$
(b) DAT on CMNIST.

Training Domain | Test Accuracy
---|---
1 | $56.8\pm 3.5$
2 | $69.6\pm 2.0$
Avg | $63.2$
(c) ERM on NICO.

Training Domain | Test Accuracy
---|---
1 | $61.7\pm 0.9$
2 | $67.1\pm 0.3$
Avg | $\mathbf{64.4}$
(d) DAT on NICO.

Training Domain | Artpaint | Cartoon | Photo | Sketch | Avg
---|---|---|---|---|---
Artpaint | \ | $64.9\pm 0.7$ | $94.2\pm 0.1$ | $61.5\pm 4.1$ | $\mathbf{73.5}$
Cartoon | $61.9\pm 2.7$ | \ | $76.6\pm 1.6$ | $69.5\pm 1.1$ | $69.3$
Photo | $66.9\pm 0.3$ | $26.9\pm 0.1$ | \ | $35.5\pm 0.7$ | $\mathbf{43.1}$
Sketch | $47.3\pm 0.1$ | $65.7\pm 0.9$ | $46.6\pm 0.8$ | \ | $53.2$
(e) ERM on PACS.

Training Domain | Artpaint | Cartoon | Photo | Sketch | Avg
---|---|---|---|---|---
Artpaint | \ | $59.6\pm 0.0$ | $94.2\pm 0.8$ | $48.7\pm 2.3$ | $67.5$
Cartoon | $68.1\pm 0.1$ | \ | $83.9\pm 1.0$ | $69.1\pm 1.3$ | $\mathbf{73.7}$
Photo | $64.5\pm 1.4$ | $27.6\pm 5.8$ | \ | $30.9\pm 4.5$ | $41.0$
Sketch | $52.2\pm 0.2$ | $63.4\pm 1.4$ | $56.4\pm 1.1$ | \ | $\mathbf{57.3}$
(f) DAT on PACS.

Training Domain | L100 | L38 | L43 | L46 | Avg
---|---|---|---|---|---
L100 | \ | $24.9\pm 4.1$ | $26.8\pm 0.5$ | $27.1\pm 4.5$ | $\mathbf{26.3}$
L38 | $42.3\pm 0.6$ | \ | $12.5\pm 1.2$ | $13.2\pm 1.5$ | $22.7$
L43 | $34.2\pm 9.8$ | $31.9\pm 0.9$ | \ | $30.1\pm 0.5$ | $32.1$
L46 | $24.9\pm 6.2$ | $13.0\pm 2.8$ | $46.6\pm 2.0$ | \ | $28.3$
(g) ERM on TerraInc.

Training Domain | L100 | L38 | L43 | L46 | Avg
---|---|---|---|---|---
L100 | \ | $23.3\pm 1.4$ | $24.3\pm 0.7$ | $16.7\pm 1.2$ | $21.4$
L38 | $44.6\pm 7.4$ | \ | $17.3\pm 1.0$ | $16.3\pm 0.4$ | $\mathbf{26.1}$
L43 | $35.2\pm 7.4$ | $32.0\pm 7.6$ | \ |  $32.9\pm 1.$5 | $\mathbf{33.4}$
L46 | $24.3\pm 4.0$ | $23.2\pm 0.2$ | $47.5\pm 0.2$ | \ | $\mathbf{31.7}$
(h) DAT on TerraInc.

Table 15: Test accuracy (single-source domain generalization).

##  Appendix C Proofs

We give a proof of Remark C.1 (Remark 3.2) first, then use a similar technique
to prove Proposition C.2 (Proposition 3.1).

######  Remark C.1 (Equivalence under Single-sample Environments).

When the environments degenerate into a single data point, we have the
following relationship: If $\varepsilon$ is sufficiently small, then for
$\beta\cdot\Phi$ as a deep network with any activation function, the penalty
term of IRMv1 (Eq. 4) on each sample and the square of the maximization term
of Linearized version of Eq. 7 (LDAT, obtained by first-order approximation of
DAT)

$\mathrm{Penalty_{LDAT}}=\left\langle\nabla_{x}\ell\left(\beta^{T}\Phi(x),y\right),\pm\hat{\delta}_{x}\right\rangle$
(13)

on each sample with perturbation $\hat{\delta}_{x}=\pm\varepsilon x$ only
differ by a fixed multiple $\varepsilon^{2}$ and a bias term $B_{x}$, which is
formally stated as

$\displaystyle\mathrm{Penalty^{2}_{LDAT}}$
$\displaystyle=[\langle\nabla_{x}\ell\left(\beta^{T}\Phi(x),y\right),\pm\varepsilon
x\rangle]^{2}=\varepsilon^{2}(1-\sigma(\beta^{\top}\Phi(x)))^{2}\left\|\beta^{\top}\Phi_{x}x\right\|^{2}$
(14) $\displaystyle=\varepsilon^{2}\cdot\mathrm{Penalty^{\prime}_{IRM}}.$ (15)

where
$\mathrm{Penalty^{\prime}_{IRM}}=(1-\sigma(y\beta^{\top}\Phi(x)))^{2}\left\|\beta^{\top}(\Phi_{x}x)\right\|^{2}$
and
$\mathrm{Penalty_{IRM}}=(1-\sigma(y\beta^{\top}\Phi(x)))^{2}\left\|\beta^{\top}(\Phi_{x}x+B_{x})\right\|^{2}$.

#### Proof of Remark C.1

Note that we presume $\Phi$ is piece-wise linear. We represent the output
logit of the given deep network as $\beta^{\top}\Phi(x)$ =
$\beta^{\top}(\Phi_{x}x+B_{x})$ where $\Phi_{x}$ and $B_{x}$ are related to
the sample $x$ due to the different activation patterns.

We first derive the form of $\mathrm{Penalty_{LDAT}}$ by first-order
approximation of Eq. 7.

$\displaystyle\ell(\beta^{\top}\Phi(x+\delta_{e}),y)-\ell(\beta^{\top}\Phi(x),y)\approx\left\langle\nabla_{x}\ell(\beta^{\top}\Phi(x),y),\delta_{e}\right\rangle$
(16)

Letting $\delta_{e}=\pm\varepsilon x$, we have

$\mathrm{Penalty_{LDAT}}=\left\langle\nabla_{x}\ell\left(\beta^{T}\Phi(x),y\right),\pm\hat{\delta}_{x}\right\rangle$
(17)

The penalty term for IRMv1 on each sample is as follows:

$\displaystyle\left\|\nabla_{w|w=1.0}-\log(\sigma(w\cdot(y\beta^{\top}\Phi(x))))\right\|^{2}$
(18)
$\displaystyle=\left\|-\frac{\sigma^{\prime}(w\cdot(y\beta^{\top}\Phi(x)))}{\sigma(w\cdot(y\beta^{\top}\Phi(x)))}y\beta^{\top}\Phi(x)\right\|^{2}$
$\displaystyle=\left\|-(1-\sigma(y\beta^{\top}\Phi(x)))y\beta^{\top}\Phi(x)\right\|^{2}$
$\displaystyle=(1-\sigma(y\beta^{\top}\Phi(x)))^{2}\left\|\beta^{\top}(\Phi_{x}x+B_{x})\right\|^{2}$

For LDAT, note that the gradient w.r.t.  $x$ is equal to

$\nabla_{x}[-\log(\sigma(y\beta^{\top}\Phi(x))]=-(1-\sigma(y\beta^{\top}\Phi(x)))y\beta^{\top}\Phi_{x}$

So the square of the penalty term of LDAT on each sample with perturbation
$\pm\varepsilon x$ is:

$[\langle\nabla_{x}-\log(\sigma(y\beta^{\top}\Phi(x))),\pm\varepsilon
x\rangle]^{2}=\varepsilon^{2}(1-\sigma(\beta^{\top}\Phi(x)))^{2}\left\|\beta^{\top}\Phi_{x}x\right\|^{2}$
(19)

which is identical to Eq. 4 with a difference of multiple $\varepsilon^{2}$
and a bias term $B_{x}$.

$\Box$

######  Proposition C.2.

Consider each $D_{e}$ as the corresponding distribution of a particular
training domain $e$. For any $\beta\cdot\Phi$ as a deep network with any
activation function, the penalty term of IRMv1, $\mathrm{Penalty_{IRM}}$ (Eq.
4), could be expressed as the square of a reweighted version of the penalty
term of the above approximate target, $\mathrm{Penalty_{DAT}}$(Eq. 8), on each
environment $e$ with coefficients related to the distribution $D_{e}$, which
could be stated as follows:

$\displaystyle\mathrm{Penalty_{IRM}}$
$\displaystyle=\left\|\mathbb{E}_{D_{e}}[L_{x}x+\tilde{B}_{x}]\right\|^{2}$
(20) $\displaystyle\mathrm{Penalty_{DAT}}$
$\displaystyle=\left\|\mathbb{E}_{D_{e}}L_{x}\right\|$ (21)

where $L_{x}=(1-\sigma(y\beta^{\top}\Phi_{x}x))y\beta^{\top}\Phi_{x}$ and
$\tilde{B}_{x}=\left(1-\sigma\left(y\beta^{\top}\Phi_{x}x\right)\right)y\beta^{\top}B_{x}$.
$B_{x}$ denotes the collection of constants (introduced by bias terms in
neural network layers).

#### Proof of Proposition C.2

For IRMv1, from the proof of Remark C.1 we know

$\nabla_{w|w=1.0}\ell(w\cdot(\beta\cdot\Phi),y)=-(1-\sigma(y\beta^{\top}\Phi_{x}x))y\beta^{\top}(\Phi_{x}x+B_{x})$
(22)

So that $\mathrm{Penalty_{IRM}}$ (suppose derivation and integration are
commutable)

$\displaystyle\left\|\nabla_{w|w=1.0}R^{e}(w\cdot(\beta\cdot\Phi))\right\|^{2}$
$\displaystyle=\left\|\mathbb{E}_{D_{e}}(1-\sigma(y\beta^{\top}\Phi_{x}x))y\beta^{\top}(\Phi_{x}x+B_{x})\right\|^{2}$
(23)

For DAT, on each environment

$\displaystyle\max_{\|\delta_{e}\|\leq\varepsilon}\mathbb{E}_{D_{e}}\left[\ell(\beta^{\top}\Phi(x+\delta_{e}),y)-\ell(\beta^{\top}\Phi(x),y)\right)\big{]}$
(24) $\displaystyle\approx$
$\displaystyle\max_{\|\delta_{e}\|\leq\varepsilon}\mathbb{E}_{D_{e}}\left[\left\langle\nabla_{x}\ell(\beta^{\top}\Phi(x),y),\delta_{e}\right\rangle\right]$
$\displaystyle=$
$\displaystyle\max_{\|\delta_{e}\|\leq\varepsilon}\left\langle\mathbb{E}_{D_{e}}\left[\nabla_{x}\ell(\beta^{\top}\Phi(x),y)\right],\delta_{e}\right\rangle$
$\displaystyle=$
$\displaystyle\varepsilon\left\|\mathbb{E}_{D_{e}}\left[\nabla_{x}\ell(\beta^{\top}\Phi(x),y)\right]\right\|$

So $\mathrm{Penalty_{DAT}}$ is

$\left\|\mathbb{E}_{D_{e}}\left[\nabla_{x}\ell(\beta^{\top}\Phi(x),y)\right]\right\|=\left\|\mathbb{E}_{D_{e}}\left[-(1-\sigma(y\beta^{\top}\Phi(x)))y\beta^{\top}\Phi_{x}\right]\right\|$
(25)

Therefore, we know that $\mathrm{Penalty_{IRM}}$ can be regarded as the square
of a reweighted version of $\mathrm{Penalty_{DAT}}$ with the coefficient on
each sample within the expectation $x$ with the difference of a bias term
$B_{x}$.

$\Box$