Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper studies the problem of zero-shot adversarial robustness: adapting pretrained large-scale vision-language models to unseen target tasks with high robust accuracies. With the conjecture that language encoder plays an important role in achieving good zero-shot generalization ability, a contrastive based adversarial training objective is proposed to contrast between image and text embeddings. Several adaptation methods are analyzed, and some interesting discoveries are made for the visual prompt tunning method.
strength_and_weaknesses: Strength:

The proposed problem is new and under-explored.

The paper conducts rich experiments to compare diverse adaptations methods and several possible training loss functions. Many datasets are employed to evaluate zero-shot generalization.

The proposed loss function is well motivated by the observation that text encoder is important to zero-shot transferability. Ablation study verifies that the proposed method using text embedding for contrastive learning is important. 


Weakness:

Although the setting is new, the proposed loss function is a direct use of contrastive loss for two modalities. Moreover, the adaptation methods used are all existing techniques.

Implementation details are not sufficient. For example, it is unclear how exactly the adaptation methods are employed during training and what the objective functions of CoAdv or ImgCoAdv are. It would be better to give mathematical formulations of these methods in appendix.

clarity,_quality,_novelty_and_reproducibility: Most explanations of the proposed method are clear and are presented with high quality. The technique is not novel and some implementation details are not given.
summary_of_the_review: This paper targets the problem of zero-shot adversarial robustness for CLIP, and it seems that it is a “first do A+B” type of work. Techniques used in the proposed methods are not new, while comprehensive experimental results show that the proposed method is effective through comparisons with reasonable baseline methods.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: Authors are the first to show that zero-shot image recognition models built on top of CLIP are still susceptible to adversarial attacks, and that standard adversarial training objective, while effective at preventing adversarial attacks, destroys the rich image-language capability of CLIP, making the defended model useless for zero-shot recognition on different tasks/datasets. Authors propose TeCoA - a novel objective that takes the image-language nature of the model into account during adversarial training via visual prompt tuning (VPT) and contrastive learning. Authors show how the proposed objective interacts with various task adaptation techniques, including linear probing, full and partial finetuning, image and token-level prompting. More specifically, authors propose to perform an adversarial attack on the standard contrastive image-text alignment objective used in CLIP - an adversarial image perturbation aims to make the correct image-text pair to have lower cosine similarity then an incorrect one. Authors propose two ablations that verifies that observed gains indeed come from robustifying the vision-language model, and not from robustifying the vision backbone itself - contrastive alignment to one-hot vectors and an image-to-image loss. Authors show that when it comes to zero-shot adversarial robustness, the proposed approach beats the baseline adversarial training and both ablations, and that finetuning outperforms visual prompt tuning. Authors also investigate the effect of the dataset size, attack strength, prompt design, number of adapted parameters during fine-tuning, and the of pareto optimum the clear-vs-robust accuracy.
strength_and_weaknesses: The paper is very well written and easy to follow: the motivation is clear, the objective and the training procedure are clearly defined. All experiments and ablations are clearly motivated, described, and reported as well. The results are promising. The provided intuition for why the proposed method helps while baselines fail makes intuitive sense.

The only part of the paper that I found to be not entirely clear and self-contained is the specifics of the image-to-image loss used in ImgCoAdv experiments.

clarity,_quality,_novelty_and_reproducibility: The paper is very well written and should be reproducible from the description in the paper alone. I lack the background in zero-shot learning to judge the novelty of this work compared to prior work. 
summary_of_the_review: 
I think this is a great paper - it establishes an impactful problem, explores a simple solution in great detail with a lot of ablation experiments to verify their intuition, the paper is very well written.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper explores the problem of adapting large-scale pre-trained models for adversarially robust zero-shot classification. It is found that vanilla adversarial training on a single task may reduce the zero-shot capability of the pre-trained model. To improve the zero-shot adversarial robustness, a text-guided contrastive adversarial training (TeCoA) is proposed, which aligns the image embeddings of adversarial examples and the text embeddings of the standard prompts for zero-shot predictions. Experiments validate the effectiveness of TeCoA.
strength_and_weaknesses: [Strength]
1. The problem of zero-shot adversarial robustness is important in practice and has not been well explored.
2. Some of the results are interesting and may inspire future works on this problem, e.g., Figure 1 and Table 2.

[Weaknesses]
1. Technical novelty. The proposed TeCoA is nearly identical to: (1) first construct a zero-shot linear classifier head with the pre-defined text prompts for zero-shot classification, as done in (Wortsman et al., 2022), and then (2) perform vanilla adversarial training (using CE loss) with the classification head frozen. Hence the main technical contribution may be that the initialization (and/or freezing) of the classification head is important for adversarial fine-tuning.
2. Missing important experimental details. The missing implementation details include model architecture, training epochs and which visual prompt design is used. Besides, the generation of pseudo text labels for images (for results in Table 2) needs further explanation.
3. Robustness evaluation. PGD-100 may not be a reliable attack for robustness evaluation. It would be better to consider stronger attacks like AutoAttack (or at least the two APGD attacks used in AutoAttack) [1]. Besides, the main results in Table 1 are based on eps=1/255, which may be too small. Using larger eps like 4/255 as in [1] may be more convincing.

[1] Croce, Francesco, and Matthias Hein. "Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks." International conference on machine learning. PMLR, 2020.

4. Explanation of abnormal results. As shown in Table 1, while FT (TeCoA) is the best on most datasets, LP (CE) and VPT (adv.) outperform other methods by a large margin on HateMemes and PACM. Is there any possible explanation?
5. Table 1 and Table 3 are inconsistent. Especially, there are two rows starting with "+VP (TeCoA)", which is confusing.
clarity,_quality,_novelty_and_reproducibility: The paper is readable, but some important details are missing. The novelty is limited as discussed in the Weaknesses. The reproducibility may be questionable due to some missing experimental details and that code is not provided.
summary_of_the_review: While this paper studies an interesting and not well-explored problem, and provides some experimental results that may promote the understanding of zero-shot adversarial robustness, there is a lack of insight and technical novelty. Besides, the missing details and weak robustness evaluation reduce the reliability of the results.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: CLIP has shown remarkable performance on zero-shot visual recognition. However, adversarial examples still greatly affect CLIP's performance. This work propose a text-guided contrastive adversarial training loss to adopt CLIP to attain adversarial robustness for the datasets that are not seen during adversarial training. They show that a naive adversarial training of CLIP on ImageNet achieves the best performance on ImageNet but fails on other classification datasets. Their approach, on the other hand, performs much better for zero-shot tasks, despite being slightly worse on ImageNet than the naive adversarial training. They evaluate their zero-shot performance on 15 image datasets, and perform comprehensive ablation studies of their method.
strength_and_weaknesses: # Strength

- Zero-shot adversarial robustness is an important problem, given the fact that large-scale models are becoming some sort of infrastructure in practice.
- Their approach empirically performs well compared to other baselines.
- They even show that their approach doesn't require ground truth labels, and using psudo-labels (via CLIP image-to-text retrieval) is enough to attain similar performance.
- They have done comprehensive ablation study including:
	- The effect of text supervision in contrastive adversarial training.
	- The effect of visual prompt design (e.g. appending an additional token is better than adding a learnable noise to the raw input image.)
	- These ablation studies provide useful insights for future research in zero-shot adversarial robustness.

# Weaknesses 

- No major weaknesses. See Clarify and Minor for small issues.
clarity,_quality,_novelty_and_reproducibility: # Clarity
-  For contributions: "our analysis provides useful lessons to understand the problem of zero-shot adversarial robustness."
	-  Their contributions would be easier to understand if the authors could list specific lessons instead (or highlight one or two most important lessons). 
- I assume y_ij = -1 when i is not equal to j, but this is not explicitly mentioned.

# Novelty
- The problem setting (e.g. zero-shot adversarial robustness) and their approach is novel. 

# Reproducibility
- They have enough details (e.g. Implementation Details section) to reproduce their results.

## Minor
- "finetuning has higher gains than VPT as more parameters are tuned." -> "Finetuning has..."
- Figure 7:  "By change(-ing) the interpolation ratio for the adapted CLIP and the vanilla CLIP,"
summary_of_the_review: The problem of zero-shot adversarial robustness is important and this work illustrates how naive adversarial training cannot deal with zero-shot settings. Then they propose a new approach based on image-text embedding alignment to achieve superior zero-shot adversarial robustness. They also conduct a comprehensive set of ablation studies which yield useful insight for future research.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: This paper presents a robust prompt tuning method TeCoA to counter the Adv attack in the context of using pre-trained vision-language models such as CLIP. Experimental results demonstrate good robustness.

Strengths:
A novel task in investigating the adv robustness in foundation models. 

Weakness:
If we consider the paper as a fine-tuning paper, it is novel. However, if we consider it as an adv defence paper, it is over-simplified. 
justification_for_why_not_higher_score: Though the task is novel, the approach is clearly not as "professional" as those adv. defence works.
justification_for_why_not_lower_score: A good starting point for the community to study the adv. attack of foundation models.
Decision: Accept: poster