SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Therefore, in the previous simplified scenario described in Section 3.2, conducting the randomly selected targeted attack could increase the range of the perturbation that is generated with positive-pair only similarity loss as follow,
$$
\delta_ {\text {t a r g e t e d - a t t a c k}} = \underset {\delta} {\arg \max } | f (x + \delta) - f \left(x _ {\text {t a r g e t}}\right) |. \tag {9}
$$
Through triangle inequality, the targeted attack may increase the range of the perturbation and eventually leverage the overall robustness.
Theorem 3.2 (Perturbation range of targeted attack). Given a model trained under the  $\mathcal{L}_{\text{targeted-attack}}$  loss, the adversarial perturbations  $\delta_{\text{targeted-attack}}$  are larger than the adversarial perturbations  $\delta_{ss}$  from a model trained under the  $\mathcal{L}_{ss}$ . Formally,  $\|\delta_{\text{targeted-attack}}\|_{\infty} > \|\delta_{ss}\|_{\infty}$ .
However, these are theoretical expectations in a simplistic scenario. To further substantiate this, we empirically observed that even a simple targeted attack, with a random target in the batch, significantly improves robustness in a positive-pair only SSL scenario, as shown in Table 2. Therefore, based on these theoretical and empirical insights, we propose to search more effective target for positive-pair targeted attack to boost the robustness of the self-supervised learning frameworks
Table 2: Effect of random targeted attack in positive-pair only SSL in CIFAR-5.
SSL	Attack Type	Clean	PGD
BYOL	untargeted attack	75.4	4.34
targeted attack	83.50	31.62
SimSiam	untargeted attack*	66.36	36.53
targeted attack	77.08	47.58
*adversarial training applied in SimSiam
through experimental observations. The detailed proof of Theorem 3.2 is in the Supplementary.
Similarity and entropy-based target selection for targeted attack In our theoretical analysis and empirical observations, we established that targeted attacks can significantly enhance overall robustness in SSL, except for the target itself. To this end, we propose a score function, denoted as  $S(x,\cdot)$ , which aims to identify the most suitable target that is distinct from the input while effectively contributing to improved robustness. Following the studies of Kim et al. [24], Ding et al. [10], Hitaj et al. [21], we prioritize high-entropy examples or those located near decision boundaries as crucial for generating effective adversarial examples in supervised adversarial training. Accordingly, we recommend selecting a target distinct from itself, yet induces confusion, creating adversarial examples that are located close to decision boundaries (Eq.11). The score function yields the most potent target  $(x^{\prime})$  for a given base image  $(x)$ . Subsequently, the targeted attack generates a perturbation, maximizing the similarity to the target  $x^{\prime}$  for the base image  $x$ .
To this end, we design the score function based on the similarity and entropy values, without using any class information, as follows:
$$
\mathcal {S} _ {\text {e n t r o p y}} \left(x, x ^ {\prime}\right) = p ^ {\prime} / \tau \log \left(p ^ {\prime} / \tau\right), \mathcal {S} _ {\text {s i m i l a r i t y}} \left(x, x ^ {\prime}\right) = \frac {e}{| e | _ {2}} \cdot \frac {e ^ {\prime}}{| e ^ {\prime} | _ {2}}, \tag {10}
$$
$$
\mathcal {S} _ {\mathrm {T A R 0}} \left(x, x ^ {\prime}\right) = \mathcal {S} _ {\text {e n t r o p y}} + \mathcal {S} _ {\text {s i m i l a r i t y}}. \tag {11}
$$
where  $p = h \circ g \circ f(x)$  and  $e = f(x)$  are output vectors of predictor  $h$  and encoder  $f$ , respectively. Overall, the score function  $S$  incorporates both cosine similarity and entropy. The cosine similarity
Table 3: Experimental results against white-box attacks on CIFAR-10. To see the effectiveness, we test TARO on positive-pair only self-supervised learning approaches, i.e., SimSiam, and BYOL.
Evaluation type	SSL	Attack Type	Clean	PGD	AutoAttack
Self-supervised linear evaluation	BYOL	\( \mathcal{L}_{\text{byol}} \)	72.65	16.20	0.01
BYOL	\( \mathcal{L}_{\text{ours-byol}} \)	84.52	31.20	22.01
SimSiam	\( \mathcal{L}_{\text{ss}} \)	71.78	32.28	24.41
SimSiam	\( \mathcal{L}_{\text{ours-ss}} \)	74.87	44.71	36.39
Self-supervised robust linear evaluation	BYOL	\( \mathcal{L}_{\text{byol}} \)	54.01	27.24	4.49
BYOL	\( \mathcal{L}_{\text{ours-byol}} \)	74.33	40.84	29.91
SimSiam	\( \mathcal{L}_{\text{ss}} \)	68.88	37.84	31.44
SimSiam	\( \mathcal{L}_{\text{ours-ss}} \)	76.19	45.57	39.25
is calculated between features of base images and candidate images in the differently augmented batch. The entropy is calculated with the assumption that the vector  $p$  represents the logit of an instance as Caron et al. [4], Kim et al. [24]. Our score function is designed to select an instance  $(x')$  that is different but confused with the given image  $(x)$ , thus facilitating the generation of effective adversarial examples for targeted attack (Figure 1). The experimental results in Figure 2b verify that the score function successfully selects such instances, as intended.
Robust self-supervised learning with targeted attacks The TARO framework starts by selecting a target image based on the score function  $(S)$ . It then generates adversarial examples using the selected target and performs adversarial training with them.
For a positive pair, represented as differently transformed augmentations  $\mathbf{t}_1(x),\mathbf{t}_2(x)$ , the target images  $\mathbf{t}_2(x')$  and  $\mathbf{t}_1(x')$  are selected respectively, as ones with the maximum score within the batch from the score function  $(S)$  in Eq. 11. Then, we generate adversarial examples, i.e.,  $\mathbf{t}_1(x)^{adv}$ ,  $\mathbf{t}_2(x)^{adv}$ , for each transformed input with our proposed targeted attack (Eq. 8), where the targeted loss  $\mathcal{L}_{\mathrm{targeted - attack}} = -\mathcal{L}_{\mathrm{ss}}$  maximizes the similarity to the selected target  $\mathbf{t}_2(x')$  and  $\mathbf{t}_1(x')$ , respectively. Finally, we maximize the agreement between the representations of adversarial images  $(\mathbf{t}_1(x)^{adv}$  and  $\mathbf{t}_2(x)^{adv}$  and the clean image  $t_1(x)$  as follows:
$$
\mathcal {L} _ {\mathrm {T A R O}} = \mathcal {L} \left(\mathbf {t} _ {1} (x), \mathbf {t} _ {1} (x) ^ {\text {a d v}}\right) + \mathcal {L} \left(\mathbf {t} _ {1} (x) ^ {\text {a d v}}, \mathbf {t} _ {2} (x) ^ {\text {a d v}}\right) + \mathcal {L} \left(\mathbf {t} _ {2} (x) ^ {\text {a d v}}, \mathbf {t} _ {1} (x)\right), \tag {12}
$$
where  $\mathcal{L}$  is Eq. 3 for the SimSiam framework. Since all three instances have the same identity, we maximize the similarity between the clean and adversarial examples.
TARO could be also applied to positive pairs in contrastive adversarial SSL methods (e.g., RoCL [23], ACL [22]). Since contrastive SSL does not have a predictor, we use the output of the projector as  $p$  in Eq. 10 to select the target for positive-pair. Then, when we apply our targeted attack to their instance-wise attacks, as follows:
$$
\mathcal {L} _ {\text {o u r s - r o c l}} = \mathcal {L} _ {\text {n t - x e n t}} \left(\mathbf {t} _ {1} (x), \{\emptyset \}, \mathbf {t} _ {1} (x) _ {\{\text {n e g} \}}\right) + \mathcal {L} _ {\text {s i m i l a r i t y}} \left(\mathbf {t} _ {1} (x), \mathbf {t} _ {2} (x)\right), \tag {13}
$$
where the adversarial loss is a sum of the modified nt-xent loss [6] and similarity loss. Since TARO alters the untargeted attack of the positive pair with a targeted attack between the base image  $(\mathbf{t}_1(x))$  and target image  $(\mathbf{t}_1(x'))$ , we eliminate the positive pair term in nt-xent loss and add similarity loss instead. The similarity loss maximizes the cosine similarity between the  $\mathbf{t}_1(x)$  images and the  $\mathbf{t}_1(x')$  images which are searched by the score function. Overall, we generate adversarial examples that maximize the  $\mathcal{L}_{\mathrm{ours - rocl}}$  loss as shown in Algorithm 1.
In this section, we extensively evaluate the efficacy of TARO with both contrastive and positive-pair only adversarial SSL frameworks. First, we compare the performance of our model to previous adversarial SSL methods that do not utilize any targeted attacks in Section 4.1. Moreover, we evaluate the robustness of the learned representations across different downstream domains in Section 4.2. Finally, we analyze the reason behind the effectiveness of targeted attacks in achieving better robust representations compared to models using untargeted attacks in Section 4.3.
Experimental setup We compare TARO against previous contrastive and positive-pair only adversarial SSL approaches. Specifically, we adapt TARO on top of two contrastive adversarial SSL frameworks, RoCL [23], ACL [22] and a positive-pair only SSL framework, SimSiam [7], to demonstrate its efficacy in enhancing their robustness. All models use the ResNet18 backbones that are trained on CIFAR-10 and CIFAR-100 with  $\ell_{\infty}$  PGD attacks with the attack step of 10 and epsilon  $8/255$ . We evaluate the robustness of our method against two types of attack, AutoAttack* [8] and  $\ell_{\infty}$  PGD attacks, with the epsilon size of  $8/255$ , using the attack step of 20 iterations. Clean denotes the classification accuracy of the ResNet18 backbone on the original images. We further describe the experimental details in Appendix B. Code is available in https://github.com/Kim-Minseon/TARO.git
4.1 Efficacy of Targeted Attacks in Adversarial SSL
We first validate whether the proposed targeted attacks in TARO contribute to improving the robustness of positive-pair adversarial SSL frameworks. To evaluate the quality of the learned representations with the SSL frameworks, we utilize linear and robust linear evaluation, as shown in Table 3. Then, we validate the generality of TARO to contrastive-based adversarial SSL frameworks (Table 5).
Robustness improvements in positive-pair only SSL We evaluate the efficacy of TARO by comparing those to untargeted attacks on positive-pair only SSL frameworks, i.e., SimSiam and BYOL. As shown in Table 3, when replacing untargeted attacks with TARO in the positive-only SSL, TARO contributes to attaining significant gains in both robustness accuracy against PGD attacks and clean accuracy. This is due to the inherent limitations of untargeted attacks in positive-pair only SSL frameworks. In such frameworks, perturbations in any direction away from the other pair of samples will
inevitably increase the SSL loss, making it challenging to generate effective adversarial examples. However, with the guidance provided by TARO, the model is able to generate stronger attack images, leading to meaningfully improved performance both on clean and adversarily perturbed images. Furthermore, we show that the untargeted attacks are not only ineffective for learning robust features, but also hinder the learning of good visual representation for clean images.
Table 4: Ablation results on target selection.
Method	Selection	Clean	PGD
RoCL	None	78.14	42.89
Random	79.26	43.45
Ours	80.06	45.37
SimSiam	None*	71.78	32.28
Random	73.25	42.85
Ours	74.87	44.71
\*naive adversarial training applied in SimSiam
Switching from an untargeted to a targeted attack approach leads to a substantial increase in performance across both contrastive-based and positive-pair only approaches, as shown in Table 4. This advancement is particularly evident when addressing the challenge of selecting appropriate targets within positive pairs. As we have discussed in the Limitations section, our empirical score function may not be the absolute optimal algorithm for target selection. Nevertheless, it is clear that concentrating on targeted attacks in the context of positive pairs is crucial for enhancing robust representation, applicable to both clean and adversarial examples.
Robustness improvements in contrastive adversarial SSL The robustness gains through TARO in contrastive adversarial SSL, specifically RoCL and ACL, are demonstrated in Table 5. Given that our TARO algorithm mines the positive-pair in contrastive loss, its effects on contrastive-based SSL might be more limited compared to positive-pair SSL. Despite this, TARO enhances RoCL's robustness against PGD attacks from  $42.89\%$  to  $45.37\%$  without compromising the clean accuracy. In the case of ACL, TARO fortifies the robustness against PGD attacks while maintaining performance comparable to AutoAttack.
4.2 Evaluation on CIFAR-100
Robustness on larger benchmarks datasets We further validate our method on a larger dataset, CIFAR-100. In Table 6, Taro demonstrates consistent robust accuracy when compared with those of the adversarial SSL frameworks using untargeted attacks, with notably significant robustness improvements on the positive-pair only SSL. Although the clean and original robust accuracy of the positive-only SSL method is noticeably lower than that of the contrastive learning method on this particular dataset, it achieves significantly higher robust accuracy than the contrastive counterpart
\*https://github.com/fra31/auto-attack
Table 5: Experimental results against white-box attacks on ResNet18 trained on the CIFAR-10 dataset. To see the effectiveness, we test TARO on contrastive adversarial SSL, i.e., RoCL, and ACL.
Evaluation type	Method	Attack Type	Clean	PGD	AutoAttack
Self-supervised linear evaluation	RoCL [23]	Lroc1	78.14	42.89	27.19
+TARO	Lours-roc1	80.06	45.37	27.95
ACL [22]	Lac1	79.96	39.37	35.97
+TARO	Lours-ac1	78.45	39.71	35.81
Table 6: Results of linear evaluation in a larger dataset, CIFAR-100.
Method	Clean	PGD
RoCL	45.99	17.17
+TARO	46.54	18.91
SimSiam*	24.43	13.34
+TARO	36.02	22.18
when using our targeted attack. The results further suggest that the proposed targeted attack plays a crucial role in creating effective adversarial examples.
Transferable robustness The main objective of SSL is to learn transferable representations for diverse downstream tasks. Therefore, we further evaluate the transferable robustness of the pretrained representations trained using our targeted attack on novel tasks from a different dataset. We adopt the experimental setting from the previous works on supervised adversarial transfer learning [32] which freeze the encoder and train only the fully connected layer. We pretrained the model on CIFAR-100 and evaluate the robust transferability to
Table 7: Results of adversarial transfer learning to CIFAR-10 from CIFAR-100.
Method	Clean	PGD
RoCL	73.93	18.62
+TARO	65.21	19.13
SimSiam*	53.34	11.24
+TARO	50.50	25.44
CIFAR-10. In Table 7, our model also shows impressive transferable robustness both with contrastive and positive-pair only SSL, compared to those obtained by the representations learned with untargeted adversarial SSL.
4.3 Effectiveness of TARO
In this section, we further analyze the effect of the targeted attacks in adversarial SSL to see how and why it works. 1) Analysis of the selected images by  $S$ , 2) Visual representation of adversarial examples that are generated with untargeted attack/targeted attack, and 3) ablation experiment on each component of the score function.
Analysis of the selected target To analyze which target images are selected by our score function  $(S)$ , we use a supervised adversarial training (AT) model. We select the target images of a single class (airplane) with the score function, and forward them to the supervised AT model to obtain their class distribution. To further examine which are the most confusing classes for the original images, we forward the base airplane images to the supervised AT model as well. As shown in Figure 2a, airplane images are easily confused with the ship class and the bird class. Surprisingly,  $1/3$  of the target images are selected using our target selection function for airplane images belonging to either ship or the bird class, which are the most confusing classes for the images belonging to the airplane class (See Figure 2b). These results strongly support that our score function effectively selects targets that are similar yet confused, as intended, without using any label information.
(a) Mean predict probability of base images
(b) Distribution of class of targeted images
Figure 2: Analysis of target from score function  $(S)$
(a) Untargeted attack
Figure 3: Visualize embedding
(b) Targeted attack
Visualization of embedding space To examine the differences between images that are generated with targeted and untargeted attacks, we visualize their embedding space. In Figure 3, black markers represent adversarial examples, and light blue markers represent clean examples, both belonging to the same class. As shown in Figure 3a, untargeted adversarial examples are located near clean examples,
*naive adversarial training applied in SimSiam
and far from the class boundaries. On the other hand, targeted adversarial examples are located near the class boundaries (Figure 3b), although it is generated in an unsupervised manner without any access to class labels. This visualization shows that our targeted attack generates relatively more effective adversarial examples than untargeted attacks, which is likely to push the decision boundary to learn more discriminative representation space for instances belonging to different classes.
Ablation study of the score function To demonstrate the effect of each component in our score function, we conduct an ablation study of the score function  $S$ . The score function consists of two terms: the entropy term and the cosine similarity term (Eq. 10), which together contribute to finding an effective target that is different but confusing. We empirically validate each term by conducting an ablation
Table 8: Results of ablation study on score function on CIFAR-10.
Clean	PGD	AutoAttack
Sentropy	78.43	40.35	32.51
Ssimilarity	72.90	44.59	36.12
STARO	74.06	44.71	36.39
experiment using only a single term in the score function during adversarial SSL training in Eq. 11. The experimental results in Table 8, suggest that the entropy term leads to good clean accuracy while the similarity term focuses on achieving better robust performance. Thus the combined score function enables our model to achieve good robustness while maintaining its accuracy on clean examples.
In this paper, we demonstrate that a simple combination of supervised adversarial training with self-supervised learning is highly suboptimal due to the ineffectiveness of adversarial examples generated by untargeted attacks in positive-pair only SSL, which perturb to random latent space without considering decision boundaries. To address this limitation, we proposed an instance-wise targeted attack scheme for adversarial self-supervised learning. This scheme selects the target instance based on similarity and entropy, such that the given instance is perturbed to be similar to the selected target. Our targeted adversarial self-supervised learning yields representations that achieve better robustness when applied to any type of adversarial self-supervised learning, including positive-pair only SSL and contrastive SSL. We believe that our work paves the way for future research in exploring more effective attacks for adversarial self-supervised learning.
Our method's main constraint is that our score function's design relies on empirical design based on the previous works. Establishing the most optimal score function theoretically for a high-dimensional, non-linear deep learning model is a complex task. Despite this, we've provided a theoretical basis for how a targeted attack can improve robustness in a simple scenario for positive pairs. Our experimental results also confirm our score function's effectiveness, suggesting we've made various efforts to counterbalance our limitations. Additionally, our method demands more computational time than a simple untargeted adversarial training, given the need to select a target instance. Yet, this extra computational time is less than  $5\%$  compared to original training time. Considering the significant boost in robustness, we believe it's a reasonable trade-off to implement our method. Despite these limitations, we've identified a significant vulnerability in the untargeted attack method—an essential discovery for adversarial self-supervised learning. Moreover, we suggest a simple yet effective way to address this vulnerability in adversarial self-supervised learning.
This work was supported by Institute of Information & communications Technology Planning & Evaluation (IITP) grant funded by the Korea government (MSIT) (No.2020-0-00153) and by Institute of Information & communications Technology Planning & Evaluation (IITP) grant funded by the Korea government(MSIT) (No.2019-0-00075, Artificial Intelligence Graduate School Program(KAIST)). We thank Jin Myung Kwak, Eunji Ko, Jihoon Tack, and Yulmu Kim for providing helpful feedbacks and support in journey of this research. We also thank the anonymous reviewers for their insightful comments and suggestions.
[34] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.
[35] Yonglong Tian, Dilip Krishnan, and Phillip Isola. Contrastive multiview coding. In European Conference on Computer Vision, 2020.
[36] Yonglong Tian, Chen Sun, Ben Poole, Dilip Krishnan, Cordelia Schmid, and Phillip Isola. What makes for good views for contrastive learning. In Advances in Neural Information Processing Systems, 2020.
[37] Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In International Conference on Learning Representations, 2019.
[38] Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. Advances in Neural Information Processing Systems, 33, 2020.
[39] Jure Zbontar, Li Jing, Ishan Misra, Yann LeCun, and Stéphane Deny. Barlow twins: Self-supervised learning via redundancy reduction. In International Conference on Machine Learning, pages 12310–12320. PMLR, 2021.
[40] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P Xing, Laurent El Ghaoui, and Michael I Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning, 2019.
[41] Richard Zhang, Phillip Isola, and Alexei A Efros. Colorful image colorization. In European Conference on Computer Vision, pages 649-666. Springer, 2016.
Effective Targeted Attack for Adversarial Self-Supervised Learning
A Baselines.