This work provides theoretical and empirical evidence that
invariance-inducing regularizers can increase predictive accuracy for
worst-case spatial transformations (spatial robustness). Evaluated on these
adversarially transformed examples, we demonstrate that adding regularization
on top of standard or adversarial training reduces the relative error by 20%
for CIFAR10 without increasing the computational cost. This outperforms
handcrafted networks that were explicitly designed to be spatial-equivariant.
Furthermore, we observe for SVHN, known to have inherent variance in
orientation, that robust training also improves standard accuracy on the test
set. We prove that this no-trade-off phenomenon holds for adversarial examples
from transformation groups in the infinite data limit.

对标准或对抗训练添加正则化技术，可提高对空间扰动的容忍度，并缩小误差率，同时无需增加额外的计算成本，这种优化策略被证明比专门针对空间等变性的网络更加有效。在无穷大数据条件下，该训练模型也能同时提高 SVHN 数据集的标准准确率。