SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Specifically, we notice three major differences when computing the CL and SL objectives: 1) CL usually adopts heavy data augmentations while SL does not; 2) CL adopts a projector head after the embedding while SL does not; and 3) CL and SL adopt different objectives: InfoNCE loss and CE loss. As shown in Table 7, ablating the augmentation and/or projector indeed brings a better attack success rate (lower robustness), since it bridges the differences between two paradigms. Following the same vein, we further consider ablating the InfoNCE loss with a simple alignment loss between the natural example  $x$  and adversarial example  $x'$ , i.e.,
$$
x _ {\mathrm {a d v}} = \underset {x ^ {\prime}} {\arg \max } \| f (x) - f \left(x ^ {\prime}\right) \| ^ {2}. \tag {15}
$$
We can see from Table 7 that this alignment-only attacking objective obtains significantly lower robustness, though the difference to attacking CE is still large. This ablation experiment shows that the distinction between paradigms is not absolute, and we can improve their transferability by gradually eliminating their gap. We leave a more comprehensive study on this aspect to future work.
Table 7: Ablation study of model components when transferring adversarial examples generated w.r.t. the CL objective to the classification task on CIFAR-10.
Paradigm	Attack Configuration	Robustness (%)
CL	No Attack	78.51
InfoNCE loss + Projector + Augmentation (default)	70.31
InfoNCE loss + Projector	70.21
InfoNCE loss + Augmentation	71.09
InfoNCE loss	59.76
Alignment-only loss	33.20
SL	CE	0.78
C Cross-Paradigm Transferability of Non-robust features from SSL Paradigms
In the main paper, we have mainly examined non-robust features extracted from an SL (supervised learning) model and show their non-transferability in a cross-paradigm sense. For completeness, we further examine non-robust features generated from the other three SSL paradigms considered in our work: CL, MIM, and DM. We follow the same hyperparameter setting as Ilyas et al. [19] for constructing non-robust dataset (Section 2.1) and for each paradigm, we generate adversarial examples by optimizing the perturbation to maximize the SSL pretraining objective per se (mode details below in Appendix C.1).
Table 8: Cross-paradigm transferability of non-robust features generated from SSL paradigms. Here the non-robust datasets are generated with noise initialization following the setting of Ilyas et al. [19].
Accuracy	SL	CL	MIM	DM
CL-non-robust	18.71	60.02	10.09	13.66
MIM-non-robust	12.02	21.65	22.19	15.47
DM-non-robust	14.07	14.11	18.07	31.08
Table 9: Here the non-robust datasets are generated with noise initialization following the setting of Ilyas et al. [19]. Here the non-robust datasets are generated with random image initialization following the setting of Ilyas et al. [19].
Accuracy	SL	CL	MIM	DM
CL-non-robust	22.18	41.80	14.33	11.91
MIM-non-robust	14.11	9.29	32.80	21.78
DM-non-robust	12.47	9.86	18.25	39.41
Results are shown in Table 8 (with random noise initialization) and Table 9 (with random image initialization). We still observe the same trend as observed in the SL-induced non-robust dataset (Section 3), where non-robust features show much better usefulness in-paradigm compared to that of other paradigms. Thus, we can conclude that the cross-paradigm non-transferability still holds for non-robust features pretrained from SSL paradigms.
C.1 Implementation Details
Constrastive Learning: We leverage the non-robust features hidden in CL models by aligning the adversarial examples with the clean images. Specifically, the adversarial examples are obtained via the following optimization
$$
\mathrm {C L}: \delta_ {i} ^ {*} = \arg \min  _ {\delta_ {i}} \log \frac {\exp (f (\delta_ {i}) / \tau) \exp (f (x _ {i}) / \tau)}{\sum_ {j = 1 , j \neq i} ^ {n} \exp (f (\delta_ {j}) / \tau) \exp f (x _ {j}) / \tau} \tag {16}
$$
where  $\delta_{i=1}^{n}$  denote the  $n$  adversarial examples,  $x_{i=1}^{n}$  denote the  $n$  clean image, i.e., the attack target within a batch and  $f$  is the encoder being attacked. The non-robust features generated this way look like random noise but are semantically close to the clean images for the model, which qualifies them for the definition of adversarial examples.
Masked Image Modeling & Diffusion Model: The non-robust features for MIM and DM are obtained by maximizing the possibility of recovering the target (the clean image) from the adversarial examples. Denoting the procedure of random masking in MIM and adding Gaussian noise in DM as  $\Gamma$ , we can express the adversarial optimization of the two paradigms as follows
$$
\operatorname {M I M}: \delta^ {*} = \arg \min  _ {\delta} \| f (\Gamma (\delta)) - x \| _ {2} ^ {2} \tag {17}
$$
$$
\mathrm {D M}: \delta^ {*} = \arg \min  _ {\delta} | | f (\Gamma (\delta)) - (x - \delta) | | _ {2} ^ {2} \tag {18}
$$
with  $f$  denoting the model and  $x$  denoting the clean image. Conceptually, we assume the non-robust features of MIM to be invisible perturbations that contain information for the model to reconstruct the clean image from it. With the diffusion models predicting noise added to the input, the non-robust features of DM are similarly defined as small perturbations fooling the model to predict the difference between the clean images and the adversarial examples. Note that we fix the timestep used in generating the adversarial examples to be the same as the one used in turning the DM into classifiers.