SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Minseon Kim $^{1}$ , Hyeonjeong Ha $^{1}$ , Sooel Son $^{1}$ , Sung Ju Hwang $^{1,2}$ $^{1}$ Korea Advanced Institute of Science and Technology (KAIST),  $^{2}$ DeepAuto.ai {minseonkim, hyeonjeongha, sl. son, sjhwang82}@kaist.ac.kr
Recently, unsupervised adversarial training (AT) has been highlighted as a means of achieving robustness in models without any label information. Previous studies in unsupervised AT have mostly focused on implementing self-supervised learning (SSL) frameworks, which maximize the instance-wise classification loss to generate adversarial examples. However, we observe that simply maximizing the self-supervised training loss with an untargeted adversarial attack often results in generating ineffective adversaries that may not help improve the robustness of the trained model, especially for non-contrastive SSL frameworks without negative examples. To tackle this problem, we propose a novel positive mining for targeted adversarial attack to generate effective adversaries for adversarial SSL frameworks. Specifically, we introduce an algorithm that selects the most confusing yet similar target example for a given instance based on entropy and similarity, and subsequently perturbs the given instance towards the selected target. Our method demonstrates significant enhancements in robustness when applied to non-contrastive SSL frameworks, and less but consistent robustness improvements with contrastive SSL frameworks, on the benchmark datasets.
Enhancing the robustness of deep neural networks (DNN) remains a crucial challenge for their real-world safety-critical applications, such as autonomous driving. DNNs have been shown to be vulnerable to various forms of attacks, such as imperceptible perturbations [14], various types of image corruptions [20], and distribution shifts [25], which can lead DNNs to make incorrect predictions. Many prior studies have proposed using supervised adversarial training (AT) [29, 40, 38, 37] to mitigate susceptibility to imperceptible adversarial perturbation, exploiting class label information to generate adversarial examples. However, achieving robustness in the absence of labeled information has been relatively understudied, despite the recent successes of self-supervised learning across various domains and tasks.
Recently, self-supervised learning (SSL) frameworks have been proposed to obtain transferable visual representations by learning the similarity and differences between instances of augmented training data. Such prior approaches include those utilizing contrastive learning between positive and negative pairs (e.g., Chen et al. [6] (SimCLR), He et al. [19] (MoCo), Zbontar et al. [39] (Barlow-twins)), as well as those utilizing similarity loss solely between positive pairs (e.g., Grill et al. [17] (BYOL), Chen and He [7] (SimSiam)). To achieve robustness in these frameworks, Kim et al. [23] and Jiang et al. [22] have proposed adversarial SSL methods using contrastive learning [6], which generate adversarial examples that maximize the instance-wise classification loss.
Unfortunately, deploying this contrastive framework often becomes computationally expensive as it requires a large batch size for training in order to attain a high level of performance [6]. Specifically, when a given memory and computational budget is limited, such as with edge devices, performing
(a) Supervised attack
Figure 1: Motivation. In supervised adversarial learning (a), perturbation is generated to maximize the cross-entropy loss, which pushes adversarial examples to the decision boundaries of other classes. In adversarial contrastive SSL (b), perturbation is generated to minimize the similarity (red line) between positive pairs while maximizing the similarity (blue lines) between negative pairs. In positive-only adversarial SSL (c), minimizing the similarity (red) between positive pairs. However, adversarial examples in adversarial SSL impose weaker constraints in generating effective adversarial examples than does supervised AT due to ineffective positive pairs. To overcome this limitation, we suggest a selectively targeted attack for SSL that maximizes the similarity (blue) to the most confusing target instance (yellow oval in (b) and (c)).
(b) Contrastive based attack
(c) Positive-pair only attack
contrastive SSL becomes no longer viable or practical as an option, as it may not obtain sufficiently high performance using a small batch size.
Alternatively, non-contrastive, positive-only SSL frameworks have been proposed resort to maximizing consistency across two differently augmented samples of the same instance, i.e., positive pairs, [17, 7, 39], without the need of negative instances. These approaches improve the practicality of SSL for those limited computational budget scenarios. However, leveraging prior adversarial attacks that maximize the self-supervised learning loss in these frameworks results in extremely poor performance compared to those of adversarial contrastive SSL methods (Table 1). The suboptimality of the deployed attacks causes to learn limited robustness and leads to the generation of ineffective adversarial examples, which fail to improve robustness in the SSL frameworks trained using them. As shown in Figure 1c, the attack in the inner loop of the adversarial training loss, designed to maximize the distance between two differently augmented samples, perturbs a given example to a random position in the latent space. Thus, the generated adversarial samples have little impact on the final robustness. The suboptimality of the attacks also can be occurred in contrastive adversarial SSL that also contains positive pairs, when simply maximizing the contrastive loss. As shown in Figure 1b, contrastive learning treats all positive and negative pairs equally regardless of their varying importance in generating effective adversarial examples.
To address this issue, we propose Targeted Attack for RObust self-supervised learning (TARO). TARO is designed to guide the generation of effective adversarial examples by conducting targeted attacks that perturb a given instance toward a target instance to enhance the robustness of an SSL framework (Figure 1). The direction of attacks is assigned using our target selection algorithm that chooses the most confusing yet similar sample for a given instance based on the entropy and similarity. By targeting the attacks toward specific latent spaces that are more likely to improve robustness on positive-pairs, TARO improves the robustness of SSL, regardless of the underlying SSL frameworks. Notably, as the positive-pair only SSL has gained attention in recent times, our proposed method becomes crucial for the ongoing safe utilization of these frameworks in real-world applications.
The main contributions can be summarized as follows:
- We observe that simply maximizing the training loss of self-supervised learning (SSL) may lead to suboptimality of attacks as the main cause of the limited robustness in SSL frameworks, especially those that rely on maximizing the similarity between the single pair of augmented instances.
- To address this issue, we propose a novel approach, Targeted Attack for RObust self-supervised learning (TARO), which aims to improve the robustness of SSL by conducting targeted attacks on the positive-pair that perturb the given instance toward the most confusing yet similar latent space, based on entropy and similarity of the latent vectors.
- We experimentally show that TARO is able to obtain consistently improved robustness of SSL, regardless of underlying SSL frameworks, including contrastive- and positive-pair only SSL frameworks.
Adversarial training Szegedy et al. [34] showed that imperceptible perturbation to a given input image may lead a DNN model to misclassify the input into a false label, demonstrating the vulnerability of DNN models to adversarial attacks. Goodfellow et al. [14] proposed the fast gradient sign method (FGSM), which perturbs a given input to add imperceptible noise in the gradient direction of decreasing the loss of a target model. They also demonstrated that training a DNN model over perturbed as well as clean samples improves the robustness of the model against FGSM attacks. Follow-up works [27, 2] proposed diverse gradient-based strong attacks, and Madry et al. [29] proposed a projected gradient descent (PGD) attack and a robust training algorithm leveraging a minimax formulation; they find an adversarial example that achieves a high loss while minimizing the adversarial loss across given data points. TRADES [40] proposed minimizing the Kullback-Leibler divergence (KLD) over clean examples and their adversarial counterparts, thus enforcing consistency between their predictions. Recently, leveraging additional unlabeled data [3] and conducting additional attacks [38] have been proposed. Carmon et al. [3] proposed using Tiny ImageNet [28] images as pseudo labels, and Gowal et al. [16] proposed using generated images from generative models to learn richer representations with additional data.
Self-supervised learning Due to the high annotation cost of labeling data, SSL has gained a wide attention [11, 41, 35, 36]. Previously, SSL focused on solving a pre-task problem of collaterally obtaining visual representation, such as solving a jigsaw puzzle [30], predicting the relative position of two regions [11], or inpainting a masked area [31]. However, more recently, SSL has shifted to utilizing inductive bias to learn the invariant visual representation of paired transformed images. This is accomplished through contrastive learning, which utilizes both positive pairs and negative pairs, that is differently transformed images and other images from the same batch, respectively [6, 19]. Additionally, some studies have proposed using only positive pairs in SSL and have employed techniques such as momentum networks [17] or stop-gradient [7]. In this paper, we annotate these approaches as contrastive SSL, and positive-pair only SSL, respectively.
Adversarial self-supervised learning The early stage of adversarial SSL methods [23, 22] employed contrastive learning to achieve a high level of robustness without any class labels. Adversarial self-supervised contrastive learning [23, 22] generated an instance-wise adversarial example that maximizes the contrastive loss against its positive and negative samples by conducting untargeted attacks. Both methods achieved robustness, but at the cost of requiring high computation power due to the large batch size needed for contrastive learning. On the other hand, Gowal et al. [15] utilized only positive samples to obtain adversarial examples by maximizing the similarity loss between the latent vectors from the online and target networks, allowing this method greater freedom regarding the batch size. However, it exhibited relatively worse robustness than the adversarial self-supervised contrastive learning frameworks. Despite the advances in the SSL framework (i.e., positive-pair only SSL), a simple combination of untargeted adversarial learning and advanced SSL does not guarantee robustness. To overcome such a vulnerability in positive-pair only SSL, we propose a targeted attack leveraging a novel score function designed to improve robustness.
3 Positive-Pair Targeted Attack in Adversarial Self-Supervised Learning
Adversarial SSL and supervised adversarial learning utilize adversarial examples in a similar manner. Specifically, adversarial SSL generates instance-wise adversarial examples in the direction of maximizing the training loss for better robustness. However, this approach exhibits an insufficient level of robustness especially in the positive-pair only self-supervised learning framework due to generating highly suboptimal adversarial examples.
We argue that simply maximizing the training loss, dubbed as an untargeted attack, in positive-pair only SSL limits the diversity of adversarial examples which eventually leads to limited robustness. We theoretically show that range of perturbation is smaller when the positive-pair only SSL objective is employed in an untargeted attack than the contrastive objective in simple two-class tasks. Furthermore, we empirically demonstrate poorer robustness when we naively merge untargeted attack and positive-pair only SSL approaches [17, 7], compared to contrastive-based adversarial SSL [23, 22].
To remedy such a shortcoming, we propose a simple yet effective targeted adversarial attack to increase the diversity of the generated attack. Moreover, we empirically suggest novel positive mining the target for the targeted adversarial attack that contributes to generating more effective and stronger adversarial examples, thus improving the robustness beyond that of previous adversarial SSL approaches. In this section, we first recap supervised adversarial training, self-supervised learning, and previous adversarial SSL methods. We then demonstrate theoretical intuition on our motivation and describe our proposed targeted adversarial SSL framework, TARO, in detail.
Supervised adversarial training We first recap supervised adversarial training with our notations. We denote the dataset  $\mathcal{D} = \{(x_i, y_i)\}$ , where  $x_i \in R^D$  is a input, and  $y_i \in R^N$  is its corresponding label from the  $N$  classes. In this supervised learning task, the model is  $f_\theta: X \to Y$ , where  $\theta$  is a set of model parameters to train.
Given  $\mathcal{D}$  and  $f_{\theta}$ , an adversarial attack perturbs a given source image that maximizes the loss within a certain radius from it (e.g.,  $\ell_{\infty}$  norm balls). For example,  $\ell_{\infty}$  attack is defined as follows:
$$
\delta^ {t + 1} = \Pi_ {B (0, \epsilon)} \left(\delta^ {t} + \alpha \operatorname {s i g n} \left(\nabla_ {\delta^ {t}} \mathcal {L} _ {\mathrm {C E}} \left(f (\theta , x + \delta^ {t}), y\right)\right)\right), \tag {1}
$$
where  $B(0,\epsilon)$  is the  $\ell_{\infty}$  norm-ball of radius  $\epsilon$ ,  $\Pi$  is the projection function to the norm-ball,  $\alpha$  is the step size of the attacks, and  $\mathrm{sign}(\cdot)$  is the sign of the vector. Also,  $\delta$  represents the perturbations accumulated by  $\alpha \mathrm{sign}(\cdot)$  over multiple iterations  $t$ , and  $\mathcal{L}_{\mathrm{CE}}$  is the cross-entropy loss. In the case of PGD [29], the attack starts from a random point within the epsilon ball and performs  $t$  gradient steps, to obtain a perturbed sample. Adversarial training (AT) is a straightforward way to improve the robustness of a DNN model; it minimizes the training loss that embeds the adversarial perturbation  $(\delta)$  in the inner loop (Eq. 1).
Self-supervised learning Recent studies on self-supervised learning (SSL) have proposed methods to allow their models to learn invariant features from transformed images, thus learning semantic visual representations that are beneficial for diverse tasks [6, 19, 17, 7, 39]. In this paper, we aim at improving the robustness of the two most popular types of SSL frameworks: positive-pair only SSL (e.g., BYOL, SimSiam) and contrastive SSL (e.g., SimCLR) frameworks.
We start by briefly describing a representative contrastive SSL, SimCLR [6]. SimCLR is designed to maximize the agreement between different augmentations of the same instance in the learned latent space while minimizing the agreement between different instances. Differently augmented examples from the same instance are defined as positive pairs, and all other instances in the same batch are considered negative examples. Then, the training loss of SimCLR is defined as follows:
$$
\mathcal {L} _ {\mathrm {n t - x e n t}} \left(x, \left\{x _ {\text {p o s}} \right\}, \left\{x _ {\text {n e g}} \right\}\right) := - \log \frac {\sum_ {\mathrm {z} _ {p} \in \left\{\mathrm {z} _ {\text {p o s}} \right\}} \exp \left(\sin \left(\mathrm {z} , \mathrm {z} _ {p}\right) / \tau\right)}{\sum_ {\mathrm {z} _ {p} \in \left\{\mathrm {z} _ {\text {p o s}} \right\}} \exp \left(\sin \left(\mathrm {z} , \mathrm {z} _ {p}\right) / \tau\right) + \sum_ {\mathrm {z} _ {n} \in \left\{\mathrm {z} _ {\text {n e g}} \right\}} \exp \left(\sin \left(\mathrm {z} , \mathrm {z} _ {n}\right) / \tau\right)},
$$
where  $z$  is the latent vector of input  $x$ , pos, neg stands for positive pair and negative pairs of  $x$ , respectively, and sim denotes the cosine similarity function.
A representative positive-pair only SSL framework is SimSiam [7]. SimSiam consists of the encoder  $f$ , followed by the projector  $g$ , and then the predictor  $h$ ; both  $g$  and  $h$  are multi-layer perceptrons (MLPs). Given the dataset  $\mathcal{D} = \{X\}$  and the transformation function  $\mathbf{t} \sim \mathbf{T}$  that augments the images  $x \in X$ , it is designed to maximize the similarity between the differently transformed images and avoid representational collapse by applying the stop-gradient operation to one of the transformed images as follows:
$$
\mathcal {L} _ {\mathrm {s s}} (x, x _ {\mathrm {p o s}}) = - \frac {1}{2} \frac {p}{\| p \| _ {2}} \cdot \frac {z _ {\mathrm {p o s}}}{\| z _ {\mathrm {p o s}} \| _ {2}} - \frac {1}{2} \frac {p _ {\mathrm {p o s}}}{\| p _ {\mathrm {p o s}} \| _ {2}} \cdot \frac {z}{\| z \| _ {2}}, \tag {3}
$$
where  $z = g \circ f(\mathrm{t}_1(x))$ ,  $z_{\mathrm{pos}} = g \circ f(\mathrm{t}_2(x))$ , and  $p = h \circ z$ ,  $p = h \circ z_{\mathrm{pos}}$  are output vectors of the projector  $g$  and predictor  $h$ , respectively. Before calculating the loss, SimSiam detaches the gradient on the  $z$ , which is called the stop-gradient operation. This stop-gradient operation helps the model prevent representational collapse without any momentum networks, by making an encoder to act as a momentum network.
Adversarial SSL To achieve robustness in SSL frameworks, prior studies have proposed adversarial SSL methods [22, 23, 15]. They generate adversarial examples by maximizing the training loss, dubbed as an untargeted attack, of their base SSL frameworks. For example, the inner loop of an adversarial attack for Kim et al. [23] is structured as follows:
$$
\delta^ {t + 1} = \Pi_ {B (0, \epsilon)} \left(\delta^ {t} + \alpha \operatorname {s i g n} \left(\nabla_ {\delta^ {t}} \mathcal {L} \left(\mathbf {t} _ {1} (x) + \delta^ {t}, \mathbf {t} _ {2} (x)\right)\right)\right), \tag {4}
$$
where the perturbation maximizes the  $\mathcal{L}$ . For adversarial contrastive SSL approaches [22, 23],  $\mathcal{L} = \mathcal{L}_{\mathrm{nt - xent}}$  is the contrastive loss in Eq. 2, so that adversarial examples are generated to minimize the similarity between positive pairs and maximize the similarity between negative pairs. For the positive-pair only SSL, adversarial examples are generated to maximize the similarity loss,  $\mathcal{L} = \mathcal{L}_{\mathrm{ss}}$  (Eq. 3), between positive-pairs only. However, as shown in Table 1, positive-pair only SSL results in significantly poor robustness compared to the adversarial contrastive SSL approaches. This is because using the naive training loss function of positive-pair only SSL in the attack hinders the generation of effective attack images for robust representation, as we theoretically show the range of perturbations is smaller (Section 3.2). To address this issue, we propose a targeted adversarial attack that can select more effective examples to make more diverse perturbations.
3.2 Theoretical Motivation: Adversarial Perturbations in Positive-only SSL
A model is considered to have a better generalization of adversarial robustness when the model can maintain its performance across a wide range of adversarial perturbations. Hence, the ability of the attack loss to generate a diverse range of perturbations during training is a crucial factor that influences the model's final robust generalization.
However, we found the theoretical motivation that positive-pair only SSL loss  $(\mathcal{L}_{\mathrm{ss}})$  could not provide
a wide range of adversarial perturbations as contrastive loss  $(\mathcal{L}_{\mathrm{nt - xent}})$  does. We simplify the problem into simple binary classification with the linear layer model to demonstrate our theoretical motivation. Let us denote adversarial perturbations that are generated with both losses as follows,
Table 1: Comparison of different attack losses on CIFAR-10 using PGD attack.
Attack loss	Method	Clean	PGD
Contrastive	ACL [22]	79.96	39.37
RoCL [23]	78.14	42.89
Positive-only similarity	BYORL [15]	72.65	16.20
SimSiam*	71.78	32.28
*naive adversarial training applied in SimSiam
$$
x _ {\mathbf {s s}} ^ {\mathrm {a d v}} = x + \arg \max  _ {\delta} \left\{\frac {f (x + \delta)}{\| f (x + \delta) \|} \cdot \frac {f (x)}{\| f (x) \|} \right\} \quad \text {s u b j e c t t o} \quad \| \delta \| \leq \epsilon ,
$$
$$
x _ {\mathrm {n t - x e n t}} ^ {\mathrm {a d v}} = x + \arg \max  _ {\delta} \left\{- \log \frac {\left(\exp \left(\frac {f (x + \delta)}{\| f (x + \delta) \|} \cdot \frac {f (x)}{\| f (x) \|} / \tau\right)\right)}{\sum \exp \left(\frac {f (x + \delta)}{\| f (x + \delta) \|} \cdot \frac {f (x _ {\mathrm {n e g}})}{\| f (x _ {\mathrm {n e g}}) \|} / \tau\right)} \right\} \quad \text {s u b j e c t t o} \quad \| \delta \| \leq \epsilon \tag {5}
$$
where we approximate the loss of  $\mathcal{L}_{\mathrm{ss}}$  in the  $\ell_1$  distance function between the positive pair and the loss of  $\mathcal{L}_{\mathrm{nt - xent}}$  into combination of two  $\ell_1$  distance functions of one positive- and one negative- pair. In both cases, a  $\delta$  maximizes the respective loss, subject to the constraint that the norm of  $\delta$  is less than or equal to  $\epsilon$ . The objective in positive-only SSL is to make the perturbed and original samples dissimilar as follows,
$$
\delta_ {\mathrm {s s}} = \underset {\delta} {\arg \max } | f (x) - f (x + \delta) |. \tag {6}
$$
while the objective of nt-xent is to make the perturbed sample dissimilar to the positive pair and similar to the negative pair as follows,
$$
\delta_ {\mathrm {n t - x e n t}} = \arg \max  _ {\delta} | f (x) - f (x + \delta) | - | f \left(x _ {n e g}\right) - f (x + \delta) |. \tag {7}
$$
Theorem 3.1 (Perturbation range of self-supervised learning loss). Given a model trained under the positive-only distance loss, the adversarial perturbations  $\delta_{ss}$  are likely to be smaller than those perturbations  $\delta_{nt - xent}$  from a model trained under the positive-pair and negative-pair distance loss. Formally,  $\| \delta_{ss}\|_{\infty} < \| \delta_{nt - xent}\|_{\infty}$ .
These theoretical insights are also supported by the empirical experiments in Table 1 that a model trained with adversarial examples generated using positive- and negative- paired contrastive loss  $(\mathcal{L}_{\mathrm{nt - xent}})$  have better adversarial robustness generalization because it is exposed to a wider range of perturbations during training than models that are trained with the positive-only similarity loss  $(\mathcal{L}_{\mathrm{ss}})$ . The detailed proof and the empirical analysis are in the Supplementary.
3.3 Targeted Adversarial SSL
We propose a simple yet effective targeted adversarial attack to generate effective adversarial examples in a positive-only SSL scenario. In this section, we first show the theoretical intuition of our approach and describe our overall framework to further improve the robustness of the adversarial SSL method by performing targeted attacks wherein targets are selected according to the proposed score function.
Targeted adversarial attack to different sample We argue that leveraging untargeted adversarial attacks in positive pairs only SSL still leaves a large room for better robustness. To enlarge the diversity of the attacks, we propose simple targeted adversarial attacks for positive-pair only SSL. The loss for such adversarial attacks is as follows:
$$
\delta^ {t + 1} = \Pi_ {B (0, \epsilon)} \left(\delta^ {t} + \alpha \operatorname {s i g n} \left(\nabla_ {\delta^ {t}} \mathcal {L} _ {\text {t a r g e t e d - a t t a c k}} \left(x + \delta^ {t}, x ^ {\prime}\right)\right)\right), \tag {8}
$$
where  $\mathcal{L}_{\text{targeted-attack}}$  is  $\mathcal{L}_{\text{ours-ss}} = -\mathcal{L}_{\text{ss}}$ , and  $x'$  is a selected target within the batch.