These observations suggest the existence of a tradeoff between average robustness and robust fairness. We use var and rob.acc to denote the variance of class-wise robust accuracy, and average robust accuracy, respectively. We use var and rob.acc to denote the variance of class-wise robust accuracy, and average robust accuracy, respectively. B.1 Naturally Trained Linear model We use var and rob.acc to denote the variance of class-wise robust accuracy, and average robust accuracy, respectively. For any classifier f ( x) in Equation ( 2), we first calculate its natural risk.

Interestingly, recent experimental results [ 2, 26 ] have identified a robust fairness phenomenon in adversarial training (A T), namely that a robust model well-trained by A T exhibits a remarkable disparity of standard accuracy and robust accuracy among different classes compared with natural training. However, the effect of different perturbation radii in A T on robust fairness has not been studied, and one natural question is raised: does a tradeoff exist between average robustness and robust fairness? Our extensive experimental results provide an affirmative answer to this question: with an increasing perturbation radius, stronger A T will lead to a larger class-wise disparity of robust accuracy. Theoretically, we analyze the class-wise performance of adversarially trained linear models with mixture Gaussian distribution. Our theoretical results support our observations. Moreover, our theory shows that adversarial training easily leads to more serious robust fairness issue than natural training. Motivated by theoretical results, we propose a fairly adversarial training (FA T) method to mitigate the tradeoff between average robustness and robust fairness. Experimental results validate the effectiveness of our proposed method.