positive sample.[]{data-label="variance"}](img/variance2.pdf){width="1.00\linewidth"}

To make sure that our dynamic loss based mining approach ($L_t$ with $t =0.3$) cannot become unstable towards much larger negative loss values we tested it to an extreme: we randomly removed 80% of the negative training samples while keeping all positive. Doing so, it not only stayed stable, but it even used a smaller positive/negative sample mining ratio than the approach with all training samples – possibly it can choose harder positive samples which contribute more to training. Even with the removal of 80% (8 million) of possible samples we achieved a matching robustness $r$ of $99.18\%$.

$L_g$ performed best for $g=0.4$ which corresponds to a gap of $L_t, t=0.3$ ($g_{L_t} = 1-2t$). However, even with the best $g$, $L_g$ performs significantly worse than $L_t$. This is probably due to the fact that the variance $\mathrm{Var} (L_2(p_1,p_2))$ is much larger for $L_g$ than for $L_t$. As shown in Figure \[variance\], this is the case for both positive ($p^+_2$) as well as negative ($p^-_2$) samples. We think this affects the test set negatively as follows: if we assume that $p_1$, $p^+_2$, $p^-_2$ are unlearned test set patches it is clear that the condition $L_2(p_1,p^+_2) < L_2(p_1,p^-_2)$ is more 