SlowGuess/NeurIPS_2023_OCR huggingface dataset:
1. Given a fixed  $\mathbf{P}_2$ , a more diverse  $\mathbf{P}_1$  potentially results in greater variations in performance. We show visualizations that support this in Sec. D in the Appendix. In other words, the use of larger, more diverse pretrained datasets for the teacher model or more diverse data augmentations for the student model increases the likelihood of creating a robust final model. This is also been shown empirically in prior work investigating the source of robustness in foundation models [16, 62]. However, in practice, the efficacy of distilling from this teacher depends on a variety of factors, including student-teacher architecture, training objective, and student capacity.
2. For a fixed  $\mathbf{P}_2$ , the greater the distance between the testing dataset  $P'$  and  $\mathbf{P}_2$ , the more likely it is that the performance gains will be realized by distilling the teacher model trained on a more extensive set of training data. To put it intuitively, if the testing dataset closely resembles the training dataset (i.e.,  $w(\mathbf{P}, P')$  is small), then adversarial training based on the teacher model might not yield significant performance improvements. However, if the testing dataset differs considerably from the training dataset, then adversarial training based on a teacher model that has been trained on a larger dataset is more likely to yield superior performance gains. This observation aligns with our empirical results.
Models. We focus primarily on ResNet50 [25] and ViT-B/16 [14]. We distill from a frozen pretrained CLIP-ViT-L/14 [48], trained on  $224 \times 224$  resolution images with a patch size of 14.
Datasets. We train our models on ImageNet-1K [13]. We use several evaluation datasets. For in-distribution performance, we evaluate on ImageNet and ImageNet-V2 [51], a replication of ImageNet's evaluation set. We focus our study on natural distribution shifts and evaluate on ImageNet-A [29], a set of adversarially filtered natural images misclassified by a ResNet50, ImageNet-Sketch [68] which contains artistic sketches of objects, and ImageNet-Rendition [26] which contains abstract
Table 1: Main results on natural distribution shifts and in-distribution ImageNet. Baseline models are ViT-B/16 (top half) and ResNet50 (bottom half) trained on  $224 \times 224$  images. The CLIP teacher is ViT-L/14. DAD variants have the best average performance for both types of distributions.
Method	Rendition	Sketch	A	Avg
CLIP [48]	87.7	61.6	64.2	71.2
ViT [14]	27.1	17.3	8.0	17.5
Advprop [74]	43.5	31.7	18.5	31.2
Fast Advprop [42]	41.8	29.4	17.9	29.7
Debiased [36]	40.3	29.4	18.3	29.3
AugReg-ViT [59]	39.5	29.2	19.0	29.2
+ Pyramid AT [31]	47.7	36.8	23.0	35.8
+ DAT [41]	47.3	34.8	30.2	37.4
+ DAD (Ours)	65.1	46.1	31.8	47.7
+ DAT + DAD (Ours)	53.2	39.3	28.2	40.2
ResNet50 [25]	36.1	24.0	0.0	20.0
Advprop [74]	38.8	25.5	4.3	22.9
Pyramid AT [31]	38.9	23.8	3.0	21.9
Debiased [36]	40.8	28.4	3.5	24.2
DAT [41]	42.0	27.3	4.4	24.6
DAD (Ours)	51.6	35.8	7.7	31.7
DAT + DAD (Ours)	47.7	33.3	6.1	29.0
Method	ImageNet	V2	Avg
CLIP [48]	79.9	72.9	76.4
ViT [14]	72.8	58.7	65.8
Advprop [74]	79.5	68.7	74.1
Fast Advprop [42]	79.0	67.0	73.0
Debiased [36]	79.3	67.6	73.5
AugReg-ViT [59]	79.9	67.9	73.9
+ Pyramid AT [31]	81.7	70.3	76.0
+ DAT [41]	81.5	70.8	76.2
+ DAD (Ours)	79.6	69.9	74.8
+ DAT + DAD (Ours)	81.9	71.7	76.8
ResNet50 [25]	76.1	63.2	69.7
Advprop [74]	77.6	65.5	35.6
Pyramid AT [31]	75.5	62.5	71.6
Debiased [36]	76.9	65.0	71.0
DAT [41]	76.5	65.0	70.8
DAD (Ours)	75.7	65.0	70.4
DAT + DAD (Ours)	77.8	66.0	71.9
or rendered objects. To observe performance on distributions that are out-of-distribution for the CLIP teacher, we evaluate on synthetic distribution shifts ImageNet-C [27], which applies corruptions (snow, blur, noise, etc.) to ImageNet, and Stylized-ImageNet [17], which processes ImageNet with style transfer from a source image.
DAD consists of both a data augmentation and knowledge distillation objective. We compare to both types of methods in our experiments.
Common data augmentations. For the simplest baseline, we follow [59] and train with common data augmentations Mixup [79], which combines images and labels, and Randaugment [11], which learns a policy over common transformations such as brightness or shear.
DAT. We also compare against the state-of-the-art data augmentation, DAT [41], which uses a VQGAN [15] to discretize adversarial examples in adversarial training. DAT uses the standard adversarial training objective 5.
Knowledge distillation. We compare against other logit-based knowledge distillation objectives, which only distill the output logits of the teacher. We consider standard knowledge distillation 7 and DIST [33], which aims to address the model capacity gap issue by distilling logit class relationships. Neither method natively supports distillation on augmented samples, so we also compare to defensive distillation objectives ARD [20] and RSLAD [83]. ARD modifies 7 to use the KL divergence between the student logits on the augmented sample with the teacher logits on the normal sample. RSLAD is an extension of ARD that replaces the cross-entropy terms with a KL divergence loss. For a fair comparison, we use DAD as the data augmentation.
4.3 Main Experimental Results on ViT-B/16 and ResNet50
ImageNet-1K. Tab. 1 shows results on ImageNet-1K and its distribution shifts. We compare against ViT-B/16 and ResNet50 models without data augmentation and with the state-of-the-art data augmentation approaches, PyramidAT [31] and DAT [41]. We combine DAD with the data augmentations used in AugReg [59], MixUp [79] and RandAugment [11]. We find that DAD has the best average performance across datasets for both models. For ViT-B we find that DAD has competitive in-distribution performance, but greatly improves performance on natural distributions. Compared to Pyramid AT and DAT, DAD also generalizes well to ResNet50. This suggests that the
Table 2: Main results on synthetic distribution shifts, which is out-of-distribution for the CLIP teacher. Models are ViT-B/16 (left) and ResNet50 (right) trained on  ${224} \times  {224}$  images. The CLIP teacher is ViT-L/14. Compared to DAT,DAD tends to perform worse on ViT-B but better on ResNet50.
Method	C (↓)	Stylized
CLIP [48]	60.2	18.5
ViT [14]	74.0	6.4
Advprop [74]	51.5	19.2
Fast Advprop [42]	53.3	18.4
Debiased [36]	49.8	22.4
AugReg-ViT [59]	54.5	16.6
+ Pyramid AT [31]	45.0	19.1
+ DAT [41]	44.7	23.1
+ DAD	53.2	22.4
+ DAT + DAD	47.5	22.6
Method	C (↓)	Stylized
ResNet50 [25]	76.7	7.4
Advprop [74]	70.5	8.0
Pyramid AT [31]	76.4	10.4
Debiased [36]	67.6	17.4
DAT [41]	74.2	10.8
DAD	67.4	13.1
DAT + DAD	65.2	14.6
Table 3: Comparison to distillation objectives on ImageNet. We use DAD for the data augmentation of ARD and RSLAD for a fair comparison. All students are ViT-B/16 trained on  $224 \times 224$  images and all teachers are CLIP-ViT-L/14. We find that our distillation objective is the best at distilling out-of-distribution robustness from CLIP.
In-distribution	Synthetic	Natural
Method	ImageNet	V2	C (↓)	Stylized	Rendition	Sketch	A	Avg
KD [32]	78.6	67.2	61.5	16.2	51.5	34.7	16.0	43.2
DIST [33]	76.6	63.9	65.8	12.7	40.8	26.9	11.2	38.0
ARD [20]	80.1	70.3	52.1	22.2	55.6	38.6	27.3	48.9
RSLAD [83]	79.9	69.3	55.6	20.8	55.9	39.8	25.5	47.9
DAD (Ours)	79.6	69.9	53.2	22.4	65.1	46.1	31.8	51.7
DAD data augmentation can be used across student architectures and that due to distillation, DAD is especially effective when training smaller models.
We also demonstrate DAD can be combined with existing approach DAT for stronger in-distribution performance. We add our distillation objective to the DAT objective and train the student on both the teacher's and its own adversarial samples. However, this comes at the cost of lower performance on natural distribution shifts, although we do observe that  $\mathrm{DAD} + \mathrm{DAT}$  still outperforms the prior state-of-the-art on ImageNet-Sketch and ImageNet-Rendition.
Synthetic distribution shifts. We also evaluate our models on synthetic distribution shifts composed of generated transformations in Tab. 2. Since the diverse training distribution of CLIP is mostly composed of natural distribution shifts, it has weaker zero-shot generalization to synthetic distribution shifts, and this performance is inherited in the student model. In fact, zero-shot CLIP is already outperformed by some compared methods on ImageNet-C, and Stylized-ImageNet. However, for ResNet50 DAD also has the best ImageNet-C performance, likely due to compared methods being specialized for certain distribution shifts [36, 74] or architectures [31].
Distillation. In Tab. 3 we compare DAD to knowledge distillation objectives. KD [32] and DIST [33] are vanilla distillation approaches without data augmentation or AT. ARD [20] and RSLAD [83] are defensive distillation objectives that use a adversarially robust teacher to encourage invariance to perturbations. For a fair comparison, we use CLIP-ViT-L/14 as the teacher and discretize the adversarial examples. We find that our distillation objective outperforms vanilla and defensive distillation objectives. We note that all methods can transfer robustness to the student, even methods without data augmentation.
ImageNet-21k. In Tab. 4 we show further gains in robustness from applying DAD to a ViT-B/16 pretrained on ImageNet-21K. We fine-tune this model with our method using only our method. Despite the baseline model performing worse than the variant trained with AugReg, DAD achieves
Table 4: Main results from pre-training on ImageNet-21K and fine-tuning on ImageNet-1K. All columns report top-1 accuracy except ImageNet-C which reports mean Corruption Error (mCE) where lower is better. All models are ViT-B/16 trained on  $224 \times 224$  images. We find that pretraining on ImageNet-21K results in larger robustness improvements.
In-distribution	Synthetic	Natural
Method	ImageNet	V2	C (↓)	Stylized	Rendition	Sketch	A	Avg
ViT	77.5	65.7	61.9	17.7	41.5	16.4	23.1	40.0
DAT [41]	83.1	73.2	43.6	24.8	55.2	41.7	36.7	53.0
DAD (Ours)	79.8	70.9	52.0	23.4	72.1	51.2	40.3	55.1
Table 5: Results on other student/teacher architectures, on ImageNet-1K. All experiments use DAD for the knowledge distillation objective and data augmentation. Using the best CLIP model as the teacher tends to result in the highest overall performance, but some teachers are better for some shifts.
Student	Teacher	IM	A	C (↓)	V2	Rendition	Sketch	Stylized	Avg
ViT-B	CLIP-RN101 [48]	81.2	24.3	49.6	69.3	48.7	34.5	17.3	46.5
ViT-B	CLIP-ViT-L [48]	79.6	31.8	53.2	69.9	65.1	46.1	22.4	51.7
RN50	-	76.1	0	76.7	63.2	36.1	24.0	7.4	32.9
RN50	ViT-B + DAT [41]	80.4	10.1	65.6	68.8	40.4	29.6	8.5	38.9
RN50	DrViT-S [40]	78.5	5.5	67.4	66.2	42.0	30.1	11.5	38.1
RN50	CLIP-RN101 [48]	76.4	5.4	70.2	64.5	47.7	32.2	9.6	37.9
RN50	CLIP-ViT-L [48]	75.7	7.7	67.4	65.0	51.6	35.8	13.1	40.2
ViT-S	-	77.8	11.9	63.9	66.0	36.9	25.3	12.0	38.0
ViT-S	ViT-B + DAT [41]	77.8	11.9	67.1	66.0	36.9	25.3	12.0	37.5
ViT-S	CLIP-RN101 [48]	73.4	9.0	65.2	62.1	38.8	23.9	12.0	36.3
ViT-S	CLIP-ViT-L [48]	73.8	18.0	63.1	64.0	52.9	35.8	17.3	42.7
RN34	-	66.5	3.0	94.5	54.7	32.4	21.0	5.6	27.0
RN34	RN50 + AugMix [28]	68.9	1.8	82.9	56.2	37.2	24.1	9.9	30.7
RN34	DrViT-S [40]	68.2	2.1	79.5	55.6	37.0	23.0	10.5	31.0
RN34	ViT-B + DAT [41]	69.2	2.2	79.0	56.6	38.7	25.0	11.0	32.0
RN34	CLIP-RN101 [48]	65.4	2.5	85.3	53.5	42.5	26.3	8.5	30.5
RN34	CLIP-ViT-L [48]	63.6	4.5	82.0	53.7	46.0	29.1	11.7	32.4
higher relative and absolute gains in robustness. We hypothesize the larger training distribution equips the student with useful inductive biases that let it more easily learn the more out-of-distribution adversarial examples generated from CLIP. We note that the CLIP training set is still  $\sim 28.2\mathrm{x}$  larger so this does not contradict our theory, but it may also be beneficial to train or pretrain the student on a more diverse dataset for a smoother distillation process.
Other student and teacher architectures. Although our method and theory is adapted for foundation models, we investigate its efficacy on other models and teachers in Tab. 5. We consider a different large-scale teacher, CLIP-RN101, as well as teachers trained on ImageNet-1K that achieve out-of-distribution robustness through methods besides large-scale training, like Discrete ViT [40] or ViT-B [14] trained with DAT [41]. We also consider smaller students like ResNet34 [25] and ViT-S.
We find that distilling robustness in our setting depends on several factors, but most crucially, the robustness of the teacher. Like other distillation techniques, we find that our method can transfer representations between various student/teacher architectures. We find that our method is also susceptible to the model capacity gap, with lower clean accuracy on ResNet34 when distilling from CLIP than training from scratch. However, using CLIP results in the best performance on natural distribution shifts. Despite the more similar architecture, distilling from CLIP-RN101 across students is less effective than distilling from the more robust CLIP-ViT-L. We include similar results with vanilla knowledge distillation in Sec. A of the Appendix.
Table 6: Comparisons to data augmentation approaches. All columns report top-1 accuracy except ImageNet-C which reports mean Corruption Error (mCE) where lower is better. All models are ViT-B/16 trained on  $224 \times 224$  images. We remove the distillation terms and use DAD samples as a standard data augmentation. All methods are based on AugReg and use Mixup and Randaugment.
Model	IM	A	C (↓)	V2	Rendition	Sketch	Stylized	Avg
AugReg-ViT [59]	79.9	19.0	54.5	67.9	39.5	29.2	16.6	42.5
+ Pyramid AT [31]	81.7	23.0	45.0	70.3	47.7	36.8	19.1	47.7
+ DAT [41]	81.5	30.2	44.7	70.8	47.3	34.8	23.1	49.0
+ DAD (Ours)	80.2	24.6	53.0	69.8	51.7	36.9	22.1	47.5
Table 7: Adversarial-training-based data augmentations and their training budget. Cost is based on training a ResNet50 from scratch for 100 epochs. While still more expensive than standard training, DAD is significantly cheaper than other techniques due to reusing precomputed adversarial examples.
Method	Attack Steps	Training Budget
ImageNet	0	1x
Adversarial Training [22]	10	11x
AdvProp [74]	5	7x
Fast AdvProp [42]	1	3x
DAT [41]	1	3.5x
DAD (Ours)	1	2x
Pure data augmentation. We study in Tab. 6 the effect of training on the DAD adversarial examples purely as a data augmentation technique, without distillation. Although DAD remains competitive, we find significant drops in performance, suggesting that it is difficult for the student to learn robust representations of these images on its own. However, we continue to observe improvements on natural distribution shifts, suggesting these samples are closer to CLIP's training distribution. However, training with DAD samples is significantly cheaper than DAT and Pyramid AT, making it more efficient in practice.
Computational cost analysis. Since DAD uses adversarial examples generated from a frozen teacher, there is no need to regenerate them during training. This amortizes the otherwise significant cost of adversarial training. We compare the cost of DAD with other adversarial data augmentation approaches in Tab. 7. By avoiding the need to continuously generate new adversarial examples, the only remaining cost for DAD is training on a larger dataset, making it cheaper than similar methods.
Additional ablations on choice of generative model, use of gradients, and transfer to adversarial robustness can be found in Sec. B in the Appendix.
We conduct the first study on distilling out-of-distribution robustness. We develop a framework for the use of foundation models in this setting and empirically and theoretically validate their advantages as a teacher. We propose discrete adversarial distillation (DAD) which uses the discrete adversarial examples of the teacher as a more diverse data augmentation and directly distill its most diverse representations. However, we find that DAD tends to be biased towards the performance of the CLIP teacher, exhibiting improvements mostly on natural distribution shifts. In practice, these shifts tend to be the most useful, and with the small computational cost of using DAD, we encourage practitioners to adopt it when training small models. We hope the development and release of improved foundation models and generative models will further demonstrate the effectiveness of our method.
We encourage further work to understand the limitations of machine vision models in out-of-distribution settings. More robust models carry the potential risk of automation bias, i.e., an undue trust in vision models. However, even if models are robust against corruptions in finite out-of-distribution datasets, they might still quickly fail on the massive space of semantic transformations in real-world data. Understanding under what conditions model decisions can be deemed reliable is still an open research question.
This work was supported in part by NSF Grant 2106825 and NIFA Award 2020-67021-32799.
[65] Zhuozhuo Tu, Jingwei Zhang, and Dacheng Tao. Theoretical analysis of adversarial learning: A minimax approach. In NeurIPS, 2019. 19
[66] Frederick Tung and Greg Mori. Similarity-preserving knowledge distillation. In CVPR, 2019. 3
[67] Aaron van den Oord, Oriol Vinyals, and Koray Kavukcuoglu. Neural discrete representation learning. In NeurIPS, 2017. 2
[68] Haohan Wang, Songwei Ge, Zachary Lipton, and Eric P Xing. Learning robust global representations by penalizing local predictive power. In NeurIPS, 2019. 1, 2, 3, 6
[69] Haohan Wang, Zeyi Huang, Xindi Wu, and Eric Xing. Toward learning robust and invariant representations with alignment regularization and data augmentation. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2022. 1
[70] Haohan Wang, Xindi Wu, Zeyi Huang, and Eric P Xing. High-frequency component helps explain the generalization of convolutional neural networks. In CVPR, 2020. 2
[71] Huan Wang, Yijun Li, Yuehai Wang, Haoji Hu, and Ming-Hsuan Yang. Collaborative distillation for ultra-resolution universal style transfer. In CVPR, 2020. 3
[72] Huan Wang, Suhas Lohit, Mike Jones, and Yun Fu. What makes a "good" data augmentation in knowledge distillation – a statistical perspective. NeurIPS, 2020. 4
[73] D. Wu, S.-T. Xia, and Y. Wang. Adversarial weight perturbation helps robust generalization. In NeurIPS, 2020. 1
[74] Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan Yuille, and Quoc V. Le. Adversarial examples improve image recognition. In CVPR, 2020. 2, 7, 8, 10
[75] Suorong Yang, Weikang Xiao, Mengcheng Zhang, Suhan Guo, Jian Zhao, and Furao Shen. Image data augmentation for deep learning: A survey. arXiv:2204.08610, 2022. 1, 2
[76] Jiahui Yu, Zirui Wang, Vijay Vasudevan, Legg Yeung, Mojtaba Seyedhosseini, and Yonghui Wu. Coca: Contrastive captioners are image-text foundation models. arXiv:2205.01917, 2022. 1
[77] Sergey Zagoruyko and Nikos Komodakis. Paying more attention to attention: Improving the performance of convolutional neural networks via attention transfer. In ICLR, 2017. 3
[78] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML, 2019. 2
[79] Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz. Mixup: Beyond empirical risk minimization. In ICLR, 2018. 1, 2, 7
[80] Peiyan Zhang, Haoyang Liu, Chaozhuo Li, Xing Xie, Sunghun Kim, and Haohan Wang. Foundation model-oriented robustness: Robust image model evaluation with pretrained models. arXiv:2308.10632, 2023. 2
[81] Xinyu Zhang, Qiang Wang, Jian Zhang, and Zhao Zhong. Adversarial autoaugment. In ICLR, 2019. 2
[82] Shiji Zhao, Jie Yu, Zhenlong Sun, Bo Zhang, and Xingxing Wei. Enhanced accuracy and robustness via multi-teacher adversarial distillation. In ECCV, 2022. 3
[83] Bojia Zi, Shihao Zhao, Xingjun Ma, and Yu-Gang Jiang. Revisiting adversarial robustness distillation: Robust soft labels make student better. ICCV, 2021. 3, 7, 8
6 Appendix
The appendix is organized as follows. First, in Sec. A, we show additional results on using the original knowledge distillation objective. In Sec. B we show the results of additional ablations on the generative model, use of gradients, and transfer to adversarial robustness. In Sec. C we provide additional hyperparameter and implementation details. In Sec. D we show visualizations of DAD and the diversity of its data augmentation to support our theory. In Sec. E we provide full proofs from our theory. Finally, in Sec. F we provide visualizations of generated DAD samples compared to standard and DAT samples.
A Additional results on vanilla knowledge distillation
Table 8: Knowledge distillation can improve robustness. The teacher is CLIP-ViT-L/14 @ 224px [48] We use the original knowledge distillation objective [32]. ViT-B [14] and ViT-S [14] are trained with AugReg [59]. Top half of the table is the original performance. Bottom half is the distilled performance. We find that distilling from CLIP can transfer robustness, even on in-distribution data.
Model	ImageNet	A	C (↓)	V2	Rendition	Sketch	Stylized
CLIP [48]	79.9	64.2	60.2	72.9	87.7	61.6	18.5
ViT-B [59]	79.9	19.0	54.5	67.9	39.5	29.2	16.6
ViT-S	77.8	11.9	63.9	66.0	36.9	25.3	12.0
ResNet50	76.1	0.0	76.7	63.2	36.1	24.1	7.4
ResNet34	66.5	3.0	94.5	54.7	32.4	21.0	5.6
ViT-B	78.6	16.0	61.5	67.2	51.5	34.7	16.2
ViT-S	79.3	18.1	59.1	68.8	45.9	30.6	14.3
ResNet50	77.8	7.4	69.0	67.6	47.0	32.3	8.7
ResNet34	74.5	3.6	77.1	63.2	41.2	28.5	9.3
Average Change	+2.1	+2.8	-5.7	+3.75	+10.2	+6.63	+1.73
Table 9: Results on other student/teacher architectures with the original KD objective, on ImageNet-1K. Robustness can be distilled from a variety of robust teachers.
Model	Teacher	IM	A	C (↓)	V2	Rendition	Sketch	Stylized
RN50	ViT-B + DAT	80.0	8.1	66.3	68.5	40.9	29.4	8.6
RN50	DrViT-S	79.3	8.2	67.4	68.4	41.7	30.0	8.9
RN34	RN50 + AugMix	72.6	1.9	80.2	61.5	37.9	25.6	8.6
RN34	DrViT-S	74.2	2.5	77.4	62.1	38.2	25.4	8.7
RN34	ViT-B + DAT	74.3	2.5	77.1	62.3	37.8	25.4	8.4
RN34	CLIP-RN101	72.4	3.9	79.8	61.2	45.4	29.8	8.5
In Tab. 8 we find that surprisingly, distilling from CLIP on only in-distribution data is able to transfer robust representations, but is generally outperformed by DAD. This works especially well on smaller models, like ResNet34. In fact, it can also improve clean accuracy compared to training from scratch, for all the models we test except ViT-B. In Tab. 9, we find that distilling from CLIP generally results in the highest average robust performance, especially for natural distribution shifts. However, any robust teacher can distill robustness in this setting, including a ResNet50 trained with AugMix as the only robustness intervention. This matches our results for Tab. 5.
B Additional ablations
B.1 Choice of generative model
We use VQGAN [15] as our generative model of choice due to its nature as a image-to-image model, making it suitable as a discretizer. To justify this, we also experiment with Stable Diffusion [53], a
Table 10: We ablate the use of VQGAN by using Stable Diffusion with DAD. The results are significantly worse, indicating the need to use a image-to-image model to discretize adversarial examples.
ImageNet	V2	Rendition	Sketch	A	Avg
Stable-Diffusion	79.1	67.8	45.9	33.4	22.0	49.6
VQGAN	79.6	69.9	65.1	46.1	31.8	69.5
Table 11: VQGAN sampling baseline comparison. To show the importance of using model gradients to discover a diverse data augmentation, we sample from the VQGAN without optimizing for a perturbation. The results are significantly worse than DAD.
ImageNet	V2	R	Sketch	A	Avg
VQGAN - Sample	80.9	70.1	49.3	34.9	24.0	51.8
VQGAN - Grad	79.6	69.9	65.1	46.1	31.8	69.5
text-to-image generative model. We use the generic prompt "A photo of an object". We observe in Tab. 10 a significant decrease in performance when trained using DAD compared to VQGAN. This suggests the importance of using a discretizer for DAD. Perhaps modifying the text prompt for could boost performance and be an interesting avenue for future work, especially since CLIP also requires a text prompt.
B.2 Use of gradients