Self-supervised Adversarial Robustness for the Low-label, High-data Regime
Authors: Sven Gowal
Po-Sen Huang
Aaron van den Oord
Timothy Mann
Pushmeet Kohli
Venue: ICLR 2021 Poster (2021)
Keywords: self-supervised
adversarial training
robustness

Abstract: Recent work discovered that training models to be invariant to adversarial perturbations requires substantially larger datasets than those required for standard classification. Perhaps more surprisingly, these larger datasets can be "mostly" unlabeled. Pseudo-labeling, a technique simultaneously pioneered by four separate and simultaneous works in 2019, has been proposed as a competitive alternative to labeled data for training adversarially robust models. However, when the amount of labeled data decreases, the performance of pseudo-labeling catastrophically drops, thus questioning the theoretical insights put forward by Uesato et al. (2019), which suggest that the sample complexity for learning an adversarially robust model from unlabeled data should match the fully supervised case. We introduce Bootstrap Your Own Robust Latents (BYORL), a self-supervised learning technique based on BYOL for training adversarially robust models. Our method enables us to train robust representations without any labels (reconciling practice with theory). Most notably, this robust representation can be leveraged by a linear classifier to train adversarially robust models, even when the linear classifier is not trained adversarially. We evaluate BYORL and pseudo-labeling on CIFAR-10 and ImageNet and demonstrate that BYORL achieves significantly higher robustness (i.e., models resulting from BYORL are up to two times more accurate). Experiments on CIFAR-10 against $\ell_2$ and $\ell_\infty$ norm-bounded perturbations demonstrate that BYORL achieves near state-of-the-art robustness with as little as 500 labeled examples. We also note that against $\ell_2$ norm-bounded perturbations of size $\epsilon = 128/255$, BYORL surpasses the known state-of-the-art with an accuracy under attack of 77.61% (against 72.91% for the prior art).

Published as a conference paper at ICLR 2021
SELF-SUPERVISED ADVERSARIAL ROBUSTNESS FOR THE LOW-LABEL, HIGH-DATA REGIME
Sven Gowal Po-Sen Huang*, Aaron van den Oord, Timothy Mann & Pushmeet Kohli DeepMind London, United Kingdom
(agowal, p
ABSTRACT
Recent work discovered that training models to be invariant to adversarial per- turbations requires substantially larger datasets than those required for standard classification. Perhaps more surprisingly, these larger datasets can be "mostly" unlabeled. Pseudo-labeling. a technique simultaneously pioncered by four separate and simultancous works in 2019, has been proposed competitive alternative labeled data for training adversarially robust models. However, when the amount of labeled data decreases, the performance of pseudo-labelie catastrophically drops, thus questioning the theoretical insights put forward by [Uesato et al. (2019), which suggest that the sample complexity for learning an adversarially robust model from unlabeled data should match the fully supervised case. We introduce Bootstrap Your Own Robust Latents (B YORL). a self self-supervised learning technique based on BYOL for training adversarially robust models. Our method enables us to train robust representations without any labels (reconciling practice with theory). Most notably, this robust representation can be leveraged by a linear classifier to train adversarially robust models, even when the linear classifier not trained adversari- ally. We evaluate BYORL and pseudo-labeling demonstrate that YORL achieves significantly higher robustness in the low-label regime (i.e., models resulting from BYRL up to times more accurate). Experiments on CIFAR- 10 against & and lo norm-bounded perturbations demon- strate that YORL achieves near sfate-of-the-art robustness with as little 500 labeled examples. We also note that against & norm-bounded perturbations of size 128 1228/255 /55, BYORL surpasses the known state-of-the thethrr with accuracy under attack of 77.61% % (against 72.91% % for the prior art).
CIFAR- 10 and IMAGENET and
INTRODUCTION
As neural networks tackle challenges ranging from ranking content on the web (Covington et al. 2016) autonomous driving (Bojarski al. 2016) via medical diagnostics (De Fauw al. 2018). has becomes increasingly important to ensure that deployed models are robust and generalize to various input perturbations. Unfortunately, despite their success, neural networks are not intrinsically robust. In particular, the addition of small but carefully chosen deviations to the input, called adversarial perturbations, can cause the neural network make incorrect predictions with high confidence CCallini & Wagner, 2017a; Goodfellow et al., 2014 Kurakin et al. 2016 SZegedy et al., 2013). Starting with (Szegedy al. (2013). there has been lot of work on understanding and generating adversarial perturbations (Carlini & Wagner, 201 Athalye & Sutskever| (011)) and on building models that are robust to such perturbations (Papernot et al. 2015) Madry et al.] 2017 Kannan et al.. 2018). Robust optimization techniques, like the one developed by Madry et al. (2017). learn robust models by trying to find the worst-case adversarial examples (by using gradient ascent on the training loss) each training step and adding them the training data.
Since Madry et al. (0117). ) various modifications to their original implementation have been proposed
(Zhang et al. 2019 Pang et al.) 2020) Huang al.) 2020, Qin et al.) 2019). We highlight the simultaneous work from Carmon et al. (2019); Uesato et al. (2019); Zhai et al. (2019a); Najafi et al. (2019) that pioneered the use of additional unlaheled data using pseudo- While, theoretically,

---

Published as a conference paper at ICLR 2021
Clean query Image
Retrieved neighbers
Moditted query Image
Figure I: Dangers of using non-robust representation learning. We use non-robust self-supervised learning technique to learn image representations (i.e., BYOL; et al., 2020). The right-hand side shows CIFAR-10 images closest (in representation space using cosine similarity) to the query image on the left. The top row demonstrates that, when given an unmodified image of an airplane, the nearest matches resemble that query image either visually or semantically. The bottom row demonstrates that a seemingly identical image can be used to retrieve images of animals which are both visually and semantically far from the query image.
robustness can be achieved with only limited amount of labeled data, in practice, it remains difficult to train models that are both robust and accurate in the low-label regime.
Finally, we note that there has been little work towards learning adversarially robust representations that allow for efficient training on multiple downstream tasks (with the exception of Ceemiil et al.
2019 Kim al.) 2020 Learning good image representations is a key challenge in computer Vision (Wiskott & Sejnowski 2002, Hinton et al., 2006), and many different approaches have been proposed. Among them ofate-of-the-ae methods include contrastive methods (Chen al.] 2020b Oord et al. 2018 He et al. (020) and latent bootstrapping (Grill et al.) (020). However, none of these recent works consider the impact of adversarial manipulations, which can render the widespread use of general representations difficult. As an example, Fig. demonstratees the effect that a non-robust representation has on a content retrieval task, where two scemingly identical query images are matched to widely different images (i.e., their nearest neighbors in representation space).
In this paper, we tackle the issue of learning robust representations that are adversarially robust on multiple downstream tasks in the low-label regime. Our contributions are as follows:
We formulate Bootstrap Your Own Robust Latents (BYORL) a modification of Bootstrap Your Own Latents (BY Grill et 2020) that enables the training of robust representations without the need for any label information. These representations allow for efficient training on multiple downstream tasks with fraction of the original labels.
Most notably, even with only 1 % of the labels, B BORL_coomm comes close to or even exceeds previous state-of-the-art which uses all labels. For example, for l2 norn-bounded perturbations of size e 128 255 on CIFAR- 10, (BBOR achievess 75.50% robust accuracy compared to 72.91 % for the previous sate-of-the-ard using all labels. BOOLL reaches 77.61% % robust accuracy when using all available labels (and additional unlabeled data extracted from COM-TINYIMAGER Torralba et al. 2008).
Finally, we show that the representations learned through BYRL transfer much better to downstream tasks (i.e., downscaled STL-10 (Coates al., 2011) and CIFAR-100 (Krizhessky et al. 20144) than those obtained through pseudo-labeling and standard adversarial training. Importantly, we also highlight that classifiers trained on top these robust representations do not need to be trained adversarially to be robust.
2 RELATED WORK
Adversarial robustness. Biggio et al. (2013) and Szegedy et al. (2013) observed that neural
networks, while they achieve high accuracy on test data, are vulnerable to carefully crafted inputs perturbations, called adversarial examples. Since then, there has been several work on building
stronger adversarial examples as well as defense against such adversarial examples (Carlini &
Wagner 2017b; Athalye & Sutskever] 2017: Goodfellow et al. 2014 Papernot et al. 2015 Madry
In Uesato al. (2018) and Carmon et al. 2019 robust accuracy drops by 10% when limiting the number
of labels to about 10%.
2

---

Published as a conference paper at ICLR 2021
et al. 2017 Kannan al. 2018 Arguably, the most successful approach for learning adversarially robust models is adversarial training as proposed by Madry et al. (Athalye et al. 2018 Uesato et al.] 2018). This classic version of adversarial training has been augmented in different ways
with changes in the attack procedure (e.g.. R. by incorporating momentum; Dong et al., 2017). loss function (e.g., logit pairing: Mosbach et al., 2018)) or model architecture (e.g.. using attention: Zoran ct al. (2020). We also highlight Zhang et al. (2019), who proposed TRADES which balances the trade-off between standard and robust accuracy. By construction, the contrary of our proposed method, all aforementioned approaches use label information and are not capable of learning generic representations that might be useful multiple downstream tasks.
Semi- and self-supervised learning. Since human annotations can be expensive, semi- and self- supervised learning approaches that leverage both labeled and unlabeled data have been proposed
to improve model performance (Chapelle et al. 2009 Bachman et al.
2014 [Brrtheltt al. 2019
Laine & Aila 2017 Miyato et al. 20118 (aajaadi et al. 2016 Xie et al. 2019). common approach
train networks to solve manually-predefine
pretext task (e.g., predicting the relative location
of image patches) for representation learning, and later use the learned representation for a specific supervised learning task (Dosovitskiy et al., 2014, Doersch et al.) 2015 Noroozi & Favaro 2016). Recently, contrastive learning that uses different views of multiple augmented images has been an effective tool to learn rich representation from unsupervised data (Oord et al. 2018 Chen et al., 2020b He et al., 2020) Tian et al.] (020), as these methods achieve comparable performance to fully-supervised models. While these works focus on improving standard generalization, we leverage representation learning, as proposed by Grill et al. 22020), to improve adversarial generalization.
Semi- and self-supervised learning for adversarial robustness. Schhidtt et al. (2018) showed that learning adversarially robust models requires more data. As such, adversarial robustness with unlabeled data has recently drawn lot of attention. We highlight the works by [esato et al. (2019);
Carmon et al.] (2019); Zhai et al. (2019a) which leveraged labeled data to train standard classifier that is in turn used to pseudo-label the remaining unlabeled data. However, as shown by Uesato al. 2019); Carmon et al.] (2019): Zhai et al. (2019a), when only 10% of the CIFAR- labels are available the robust accuracy drops significantly. In this paper, we focus on improving adversarial robustness in the lowelabel regime by leveraging unlabeled data (e.g.. when 1%-10% of labels are available) to build robust representations. The result is a technique that significantly outperforms of-te-- pseudo-labes labelin techniques in the low-label regime and remains competitive with adversarial training when all labels are available. [Cen et al. (2020a) also study adversarial pre- training on self-supervised tasks and demonstrate that they can train robust representations. However, to the contrary of our approach, their method does not preserve the robustness of their resulting representations on downstream tasks (unless robust fine-tuning is used). [Hendrycks et al. (2019) combine supervised adversarial training with an additional self-supervised head. They demonstrate that they can improve on standard adversarial training, but do not learn general representations. We also highlight the recent work by Kim et al. (2020) which combines adversarial training with contrastive learning. Our method reaches comparable robust accuracy, but is more scalable (as it is not based on contrastive learning which requires large batch sizes). To the contrary of Kim et al., we also study the transferability of robust representations and focus on the low-label regime.
3 METHOD
In this section, we explain B YORL which elegantly combines adversarial training with BYOL Hence, we start by giving a brief description of adversarial training and BYOL
3.1 ADVERSARIAL TRAINING
Madry et al. (017)) formulate saddle point problem whose goal is to find model parameters 0 that minimize the adversarial risk:
E
max [[f(x 6:0).
SEB
where D is data distribution over pairs of examples and corresponding labels y. f(; 0) is a model parametrized by 0, / is a suitable loss function (such as the 0 - loss in the context of classification tasks), and S defines the set of allowed perturbations (i.e., the adversarial input set or threat model).
3

---

Published as a conference paper at ICLR 2021
maNo
Tete 10
for P0.2
(==: 0)
2: 0)
((:0)
a(:
o(-;0)
((:00
Representation
c(::5)
e(;00
ming (o(t:)),=()
e(:00)
I T
BYORL
Figure 2: Flow diagram that highlights the difference between BYOL and BYORL. Whereas BYOL directly tries to maximize the cosine similarity between ((2; 0) and z', BYORL first executes an adversarial attack to retrieve an alternative image é.
Several methods (also known as "attacks") have been proposed to find adversarial examples (and effectively solve the inner maximization problem Eq. Classical adversarial training as proposed
by Madry et al. (017)) uses Projected Gradient Descent (PGD) which replaces the impractical () -
loss I with the cross-entropy loss and computes adversarial perturbation å ((K) in K gradient ascent steps of size a as
(k+1) projs (8(*) + V + -0));
0),,,)
(2)
where (0) is chosen at random within S, and where proja (a) projects point back onto a set A.
Finally, for each example æ with label y, adversarial training minimizes loss given by
i(f(= + 0)0), max maxi(((( i(f(x + 5; 0),),.0
(3)
SE8
where 8 is given by Eq. 2 and i is the softmax cross-entropy loss.
3.2 BOOTSTRAP YOUR OWN LATENTS
Many successful self-supervised learning approaches learn image representations by identifying whether different views belong to the same image (Dosovitskiy et al. 2014: Wu et al.) 2018). Whereas contrastive methods formulate this prediction problem into one discrimination (i.c., from the representation of an augmented view, they learn to discriminate between the representation of another augmented view of the same image, and the representations of augmented views other images), BYOL relies relies from each other. The goal of the online network is to predict the target network representation of the same image under different augmented views, where the target network itself is defined by an exponential moving average of the online network parameters. We selected BOL as the basis of our proposed method not only because it currently the most successful representation learning technique, but also because it is more amenable to adversarial training, to contrary of contrastive methods which require large batch sizes (Chen et 2020b) Oord al. 2018) or memory banks He
neural networks: online and target network, that interact and learn
et al. 2020).
As shown in Fig. 2 the online network is composed of three stages: an encoder e(:; 0), a projector g( 0) and a predictor g(:: 0). Omitting the predictor, the target network has the same architecture
There exists few variants of PGD which normalize the gradient step differently (e.g., using its sign Eg norm depending on the threat model).
4

---

Published as a conference paper at ICLR 2021
as the online network, but uses different set of weights As explained by Grill al. (2020), in order to enhance representations while preventing their collapse, the target network's s weights are allowed to change slowly throughout training. More precisely, given decay rate E [0, 1]. after each training step, the parameters & are updated as & <- - + (1 r) Given an image æ, and two augmentations t' T sampled from set of augmentations (e.g.. random crops recolorizations), BYOL produces two augmented views u = t(x) and v' = f'(x) The first view passes through the online network, producing representation h e(2; 0) and projection = g(:; 0). The second view similarly passes through the target network, producing target projection z' g e(v': E). Finally, given an online prediction (2 0) (which should be predictive of the target projection). BYOL minimizes the loss
(z: 0)
z'
(z 0),
CBYOL Cg
2 2-
(4)
11q(2; 0)
|
(z; 0)(l2 1
At the end of training, everything but e and 0 discarded and only the representation e( 0) of an image x: is used by downstream applications.
3.3 BOOTSTRAP YOUR OWN ROBUST LATENTS
We now introduce an effective and elegant approach to learn adversarially robust representations. Whereas previous nemii))upeerviee techniques that are directly based on adversarial training require the presence of labels to produce adversarially robust neural networks (from which robust representa- tions can be extracted intermediate layers), method can operate without any labels. As shown in the experimental section, the resulting representations can then be used to train linear classifiers (on top of these representation) that are intrinsically robust to adversaries. Our method, named Bootstrap Your Own Robust Latents or B BYOLL, consists of combining BYOL with adversarial training. A diagram summarizing B YORL is visible Fig.
For conciseness, we will denote by 7 = g the composition of the encoder and projector and by qo o g the composition of the encoder, projector and predictor. Similarly to BYO BYORL starts by generating two views view goes through the target network unmodified to produce a target projection z' = (0'; E), the first view is further augmented via an adversarial attack. The goal of the adversarial attack is to maximize the disagreement between the online and target networks while respecting the threat model described by S (see subsection 3.1p. To this end, would like find optimal perturbation 6* S that minimizes the resulting cosine similarity between the online prediction k(v + 5; 0) and target projection z':
t(x) and e' = t' f'(x)) of the same image While the second
(n(v 8: 6)0), 2') [K(0 + 8:0) |
8* = arg min
(5)
8E
Like adversarial training, we can leverage resulting in 8 = ((K), we have
PGD
approximate 5t by 8. Taking K steps of size a,
(K(u + 800) 0). x²) [ 800; 0) 1
8(++1) + projs (k)) a ((t)
(6)
where 5(0) is chosen at random within S. Finally, we seek to maximize the agreement between the adversarially modified online prediction <(v + d; 0) and the target projection z' by updating the online weights & as minimize the following loss:
(x(u 8:0), ()): R 2 - 2 min
(x(v + 8;0), x²)
BYORL (0, 0') = 2- 2-
[]<(( + 8; 0)11 (l
des
| + 8;0)11 22 ||
Here are a few additional considerations. First, we symmetrize the loss C in Eq. 7 by feeding o' the online network and u to the target network. The adversarial attack is executed on v' instead of u and tries to minimize the cosine similarity between the online prediction x(('' + 8; 0) and target projection 7(:; E): L Csymmeetrie (v, e') 2 CBYORI. (v, v') Se
CBYORI (w', v). Second, that the adversarial attack is always performed through the online network. We could similarly perform the attack through the target network, but found that training was less stable as batch
can observe
5

---

Published as a conference paper at ICLR 2021
statistics (needed by batch normalization) were not representative of statistics induced by adversarial examples (as the online network would receive clean rather than adversarial images). Third, instead of the proposed method, could imagine making two passes through the online network (for both the clean and adversarial images) and maximizing the agreement between both online predictions (in addition maximizing the agreement with the target projection). We found that this increased the risk of representation collapse as this adds an incentive for the online network to output constant predictions (i.e., collapsed representations are the perfect defense against adversarial attacks).
EXPERIMENTS
We assess the performance of BYORL across multiple axes. We evaluate the robustness of the resulting representations by training robust linear classifiers on top of these representations. First, we compare the performance of various classifiers (comparing B YORL with pseado-labeling). Second, we study how these robust representations transfer to unseen new tasks. Finally, we also evaluate whether robustness transfers downstream tasks even when the final task not treated as being adversarial.
4.1 SETUP AND IMPLEMENTATION DETAILS
We highlight here the most important components and defer some of the details to Appendix A
Architecture. We use convolutional residual network (He al.) 2015) with 34 layers (Pre- Activation ResNet-34) as our encoder e. We also use wider (from x to x4) ResNets. The projector g and predictor & networks are MLPs with hidden dimension 4096 and output dimension 256.
Outer optimization. We the LARS optimizer (You et al., 2017) with cosine learning rate schedule (Loshchilov & Hutter 2017) over 1000 epochs. We set the learning rate to 2 and use a global weight decay parameter of 10-4 4. For the target network, the exponential moving average parameter T starts from 0.996 and is increased to one during training. We use a batch size of 512.
Inner optimization. The inner minimization in Eq. 7 is implemented using PGD steps (con- strained by an &2 or loc. norm-bounded ball). Unless specified otherwise, we set K to 40 and use an adaptive step size a (see Algorithm
Croce& & Hein 2020). For fox and & norm-bounded perturbations, the gradients in Eq. are first normalized to their sign or by their Eg norm, respectively.
Evaluation protocol. We evaluate the performance of B YORL on CIFAR-10 against adversar- ial & and foe norm- boun-eounde perturbations (CIFAR-100 and IMAGENET results are in the ap- pendix). For that purpose, we train linear classifier parametrized by coefficients W and off- sets b on top of frozen (oo
following the procedure described in /KKoeesnkkv/ ee al. (2019): Chen et al. (2020b). The linear model is either trained in non-robust manner (i.e., minw.6 & (a W c(2; 0) b, v)) or adversarially (i.e., minw ,& (D maxses i(Wel(a e(x 0: + b. v)). We then compute the robust accuracy, which is the accuracy of the combined model We(-;0) + against adversarial attacks (i.e., we count a successful attack as misclassification): 1 1-E(a,y)e maxses ((We(at + 8: 0) + b, 3). In order to get faithful results, all models are evaluated using a strong attack which combines elements of the AutoAttack procedure (Croce & Hein 2020) with the Multi Turgeter attack (Gowal et al. 2019). Namely, we use sequence of AutoPGI on the cross-entropy loss with 5 restarts and 100 steps, AutoPGD on the difference of logits ratio loss with 5 restarts and 100 steps, MultiTargeted Square (Andriushchenko et al. 2019), an efficient black-bor box attack, with 5000 queries.
the margin loss with 20 restarts and 200 steps and
Baseline. Throughout the experimental section, we compare B YORL with adversarial training (combined with pseudo-labeling to handle missing labels). Pseudo-labelinn is currently, to the best of our knowledge, the most successful sumisuuerriieed method for learning adversarially robust models (Carmon et al., 2019 Uesato et al.) 2019; Zhai et al., 2019a Najafi et al.) 2019). More specifically, we use (Ussupevvsed Adversarial Training with Fixed Targets (UAT-FT) (Uesato et al., 2019). When 100% of the labels are available (AT-FT is equivalent to classical adversarial training, as proposed by Madry et al. (017)). 7). In settings where less than 100% of the labels are available, we train a separate non- robust model (with an architecture identical to the robust model being trained) on the available labeled data and use it to pseudo- labell the rest of the unlabeled images. UAT-FT uses the same network architectures than those used by BYORL.

---

Published as a conference paper at ICLR 2021
80%
80%
sccuracy
70%
sccuracy
70%
60%
60%
50%
50%
40%
30%
30%
LAT-FT
UAT-FT
20%
20%
156
2%
5%
10%
20%
50%
100%
1.%
2%
5%
10%
20%
50%
100%
Percentage of labeled training data
Percentage of labeled traiiinng data
(a) CIFAR-10 10 only
(b) CIFAR-10 and SOM-TINYIMAGES
Figure 3: Accuracy under &2 attack of size e 128/225 255 for different CIFAR- 10 models function of the ratio of available labels. Panel restricts the available data to CIFAR- 1 only (labeled and unlabeled), while panclbuusss 500K additional unlabeled images extracted from
60%
60%
Robust sccuracy
best accuraaa sccuracy
50%
50%
30%
30%
UAT-FT
UAT-FT
20%
20%
156
295
5%
100%
20%
50%
100%
186
205
5%
100
20%
50%
100%
Percentage labeled training data
Parcentage labeled tralinnng data
(a) CIFAR- only
(b) CIFAR-10 8OM-TINYIMAGES
Figure 4: Accuracy under fox attack of size 8/255 for different CIFAR- 10 models function of the ratio of available labels. Panel [ restricts the available data to CIFAR- 1 0 only (labeled and unlabeled), while panel b uses 500K additional unlabeled images extracted from SOM-TINY TINNIMMAES..
4.2 RESULTS
Robustness on CIFAR-10. We evaluate BYORL and UAT-FT on a wide range of tasks across different threats for various amounts of available labels. As typical in the literature (Rice al. 2020 Augustin et al. 2020). we evaluate our models on CIFAR- 10 against Eg and &oo norm- norm-bounded perturbations size e 128/20 255 and 8/2 6/255 (CIFAR- 100 and IMAGENET are evaluated in the appendix). CIFAR- 10 contains 60K images (i.e., 50K in the train set and 10K in the test set). As such, when we evaluate on 1% of labeled data, we only use 500 random labeled images from CIFAR- 10 (we do not artificially balance the number of labels per class). As done in Carmon al. (2019) and Uesato et al. 2019), we also explore the limits B YORL in the setting where additional unlabeled IMAGES unlabeled 32 32 images In settings without this additional data, we use a ResNet-34 x 2, whereas in settings with this additional data, we
data is available. This additional data is extracted from 80M-TINE IIM-IINIIMAGES and consists of 500K
ResNet-34 4.
Fig. 3 shows the robust accuracy of B YOBL and UAT-FT on the full CIFAR- 10 test set against & norm-bounded perturbations (similar figures that show clean accuracy are available inpppendix B). We observe that linear classifiers trained on top of robust|BYORk BORL represettttt are more robust than those trained with UAT-FT In particular, available, YORL remains competitive with state-of-the- methods that use all labels: without additional data from 80M-TINE I
highlight than when only 500 labeled images are
BYORL reaches 65,43% compared to 69 24% (Engstrom et al. 2019); with additional data from 80M-TINYIMAGESS BYORL reaches 75.50% compared to
72.91 % (Augustin et 2020).
Fig. shows the robust accuracy of B BYORL and UAT-FT on the full CIFAR-10 test set against 2 norm-bounded perturbations. Again, we can observe that BYOR competitive: the low-label regime, B YORL surpasses UAT-FT significant margin (up to 2x more accurate); in the high-label regime B BYRL loses a few percentage points. Perhaps surprisingly, under both threat models (i.e.. loo and 22) BYORI reaches peak performance with 5% of the labels (and beyond).
We the dataset from Carmon al. (019) available http://ghhha..cmmmamcccoonneinis
7

---

Published as a conference paper at ICLR 2021
Table 1: Robust accuracy (under adversarial attack) obtained by finetuning a linear head on top of robust representations trained on CIFAR- 10.
STL-10
CIFAR-100
METHOD
NORM
RAdIUS
1%
10%
100%
1%
10%
100%
BYORL
E2
128/255
33.85%
53.23%
57.88%
10.09%
22.51%
28.24% 10.80%
UATFF
37.71%
42.16%
53.23%
3.689
14.43%
BYORL
UAT-FT
Exc
8/255
24.18%
23.47%
36.52%
36.30%
37.28%
37.79%
5.28
2.18%
10.12%
4.88%
14.82%
7.21%
Table 2: Clean (no perturbations) and robust (under adversarial attack) accuracy obtained when training robust and non-robust representations on CIFAR- 10 against Eg norm-bounded perturbations of size 128/255, We evaluate the representations by finetuning a robust and non-robust linear head on CIFAR- 10, STL- 10 and CIFAR 100. Table 6 the appendix shows eo perturbations.
TRAINING OF
CIFAR-10 10
REPRESENTATION
LINEAR HEAD
NORM
RADIUS
Clean
Robust
Robust (BYORL.)
Robust (AT) CIFAR-10
93.01%
77.61% %
Non-robust (BYOL.)
Robust (BYORL.
Non robust on CIFAR
Robust (AT) CIFAR-10
82
128/ /85
93. 19%
91.23%
77.09%
0.05%
Non-robust (BYOL)
Non-robust on CIFAR-10
94.76%
0.00%
FINETUNING OF LINEAR HEAD
STG-10
Robust (BYORL.)
Robust (AT) -10
62
/28/255
76. 49%
57.88% %
Robust (BYORL.)
Non robust on STL-10
77.54% %
57.66%
FINETUNING OF
HEAD
CIFAR-
Robust (BYORL)
Robust (AT) CIFAR-100
48.34%
28.24%
125/255
Robust (BYORL)
Non robust on CIFAR 100
49.20 %
27.17%
Transfer to unseen tasks. We evaluate our robust representations other classification datasets to assess whether the features learned on CIFAR- 10 are generic and thus useful across image domains, or if they are CIFAR- SETAR-10-specie 10-specffic As comparison, we test whether pre-logits activations resulting from training a model using UAT-FT can also be used for transfer learning. For both representations, we train robust linear model using adversarial training (see subsection 3.1) with different label availability on STL- 10 and CIFAR- 100 against f and & norm- bounded perturbations. Table Issows result in equivalent more robust models than UAT-FT representations. We note, however, that - at least on CIFAR- 100 - the robust accuracy remains significantly lower than models trained directly on CIFAR-100.
that B repreeentttetttatttoo
Transfer without adversarial training. So far, the linear classifiers trained on top of B BYRL representations were trained robustly using adversarial training. We now evaluate whether adversarial training is needed for downstream tasks. Conversely, we also verify that learning robust repre- sentations is needed to obtain robust linear classifiers. Table 2 shows the robust accuracy of four models: (i) an adversarially trained linear model top of robust BORL represettts,,tnatinonnn (ii) classically trained (not necessarily robust) linear model on top of robust BYOR representations, (iñi) adversarially trained linear model top of non-robust B YOL classically trained linear model on top of non-robust[B B BBOL representations, and (fv) Although not a guarantee in theory (Allen-Zhu & Li (2000), we observe that the adversarial training of the linear classifier is, in practice, not necessary and that it is enough to train robust representations to obtain robust classifiers. Indeed, for all three considered downstream tasks (CIFAR- 10, STL- 10 and CIFAR- 100), the resulting non-robustly trained linear classifiers are within a few percentage points of the robustly trained ones (similar results for IMAGENET are available in the appendix in Table 5)
CONCLUSION
In this work, we present BYORL modification of BYOL. that enables us to train robust image representations. To the contrary of previous methods, BYORL does not require the presence of label information. In fact, it is even possible to use these robust representations to train adversarially robust classifiers multiple downstream tasks (without the need to use adversarial training). Interestingly, classifiers using B represennt
can be trained with as little as 500 labeled examples. Across all experiments, BYORL with 1% of labels (i.e., 500 labeled examples) matches surpasses the performance of pseudd-labbllig (implemented through UAT-FT) with 10-20% of labels (i.e., between 5K and 10K labeled examples).
8

---

Published as a conference paper at ICLR 2021
ACKNOWLEDGMENTS
We would like to thank Jean-Baptiste Alayrac, Olivier Hénaff, Jean-Bastien Grill, Florian Strub and Florent Altché for helpful discussions throughout this work.
REFERENCES
Zeyuan Allen-Zhu and Yuanzhi Li. Feature purification: How adversarial training performs robust deep learning. arXiv preprint arXiv:200S.10190 2020. URL https://anixxorrg//t//200 10190
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square Attack: query-efficient black-box adversarial attack via random search. arXiv preprint arXiv:1912.00044 2019. URL hatps:/aanixaarhhhff///....
Anish Athalye and Ilya Sutskever. Synthesizing robust adversarial examples. arXiv preprint arXiv:1707.07339, 2017.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of
security: Circumventing defenses to adversarial examples. arXiv preprint arXiv:1802.00422 2018.
URL httpss//aandivoor//d///// 882.00420)
Maximilian Augustin, Alexander Meinke, and Matthias Hein. Adversarial Robustness on In-and
Out-Distribution Improves Explainability. arXiv preprint arXiv:2003.0945 2020. URL
hllps
Warsiv.org/pl//220300444
Philip Bachman, Ouais Alsharif, and Doina Precup. Learning with pseudo-ensembles. In NeurlPS, 2014.
David Berthelot, Nicholas Carlini, Ian Goodfellow, Nicolas Papernot, Avital Oliver, and Colin Raffel. MixMatch: A Holistic Approach to Semi-Supervised Learning.
092499 2019.
Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Šrndié, Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases, pp. 387-402 Springer, 2013.
Mariusz Bojarski, Davide Del Testa, Daniel Dworakowski, Bernhard Firner, Beat Flepp, Prasoon Goyal, Lawrence D. Jackel, Mathew Monfort, Urs Muller, Jiakai Zhang, Xin Zhang, Jake Zhao, and Karol Zieba. End to end learning for self-driving cars. arXiv preprint arXiv: 160::00003331 2016. URL hatps://axiv.oor////////6...
Nicholas Carlini and David Wagner. Adversarial examples not easily detected: Bypassing ten detection methods. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, pp. 3-14. ACM, 2017a.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposiun Security and Privacy, pp. 39-57. IEEE, 2017b.
Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C Duchi, and Percy Liang. Unlabeled data improves adversarial robustness. In Advances in Neural Information Processing Systems, pp. 11190-1 1201, 2019. URL https://aapersnissscc//ppppppppp
unlaheled data-d-tt-aaaa data-daatnnnnn andervesaavveeaaiillll sabusttesss.pif
Taylan Cemgil, Sumedh Ghaisas, Krishnamurthy (Dj) Dvijotham, and Pushmeet Kohli. Adversar- ially Robust Representations with Smooth Encoders. In International Conference on Learning Representations, 2019, URL http:://wweennwvw.....////aadal/
Olivier Chapelle, Berhard Scholkopf, and Alexander Zien. Semi-Supervised Learning. MITPress, 2009.
Tianlong Chen, Sijia Liu, Shiyu Chang, Yu Cheng, Lisa Amini, and Zhangyang Wang. Adversarial robustness: From self-supervised pre-training to fine-tuning. arXiv preprint arXiv 12862, 2020a. URL http:///aarii.oo////r/o.........

---

Published as a conference paper at ICLR 2021
Ting Chen, Simon Korblithh, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. arXiv preprint arXi::2002.05709 2020b. URL
https//wwkkkoog//////2222220000
Adam Coates, Andrew Ng. and Honglak Lee. An analysis of single-layer networks in unsupervised feature learning. Proceedings of Machine Learning Research, pp. 215-223. JMLR Workshop and Conference Proceedings, 2011 1. URL http://proceeddingg mlr press// S/contess la.html
Paul Covington, Jay Adams, and Emre Sargin. Deep neural networks for YouTube recommendations. In Proceedings of the 10th ACM Conference on Recommender Systems, 2016.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. arXiv preprint arXiv:2003.016690 2020. URL hups///arxivvoog/pdfff
2003.01690
Jeffrey De Fauw, Joseph R Ledsam, Bernardino Romera-Paredes. Stanislav Nikolov, Nenad Tomasev, Sam Blackwell, Harry Askham, Xavier Glorot, Brendan O' O'Donoguee, Daniel Visentin, George van den Driessche, Balaji Lakshminarayanan, Clemens Meyer, Faith Mackinder, Simon Bouton, Kareem Ayoub, Reena Chopra, Dominic King, Alan Karthikesalingam, Cían O Hughes, Rosalind Raine, Julian Hughes, Dawn A Sim, Catherine Egan, Adnan Tufail, Hugh Montgomery, Demis Hassabis, Geraint Rees, Trevor Back, Peng T Khaw, Mustafa Suleyman, Julien Cornebise, Pearse Keane, and Olaf Ronneberger. Clinically applicable deep learning for diagnosis and referral in retinal disease. In Nature Medicine, 2018. URL https://www.naaure.ommm http///fioeess/1151--11----00000 -01-00077---
Carl Doersch, Abhinav Gupta, and Alexei Efros. Unsupervised visual representation learning by context prediction. In Computer Vision and Pattern Recognition, 2015.
Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting Adversarial Attacks with Momentum. arXiv preprint arXiv: 10.081,, 2017. URL
http://aarvvoorgg//////77..00.
Alexey Dosovitskiy, Jost Tobias Springenberg, Martin Riedmiller, and Thomas Brox. Discrimina- tive unsupervised feature learning with convolutional neural networks. In Neural Information Processing Systems, 2014.
Logan Engstrom, Andrew Ilyas, Hadi Salman, Shibani Santurkar, and Dimitris Tsipras. Robustness (python library), 2019. URL
lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv: 12,66577, 2014.
Sven Gowal, Jonathan Uesato, Chongli Qin, Po-Sen Huang, Timothy Mano, and Pushmeet Kohli. An Alternative Surrogate Loss PGD-based Adversarial Testing. arXiv preprint arXiv: 1910.09338,
2019. URL https://arsivoorg//////1.....
Jean-Bastien Grill, Florian Strub, Florent Altché. Corentin Tallec, Pierre H. Richemond, Elena Buchatskaya, Carl Doersch, Bernardo Avila Pires, Zhaohan Daniel Guo, Mohammad Gheshlaghi Azar, Bilal Piot, Koray Kavukcuoglu, Rémi Munos, and Michal Valko. Bootstrap Your Own Latent: A New Approach to Self-Supervised Learning. arXiv preprint arXiv:2006.07733 2020.
URL http:://aaiiiooom///////oo....20
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. arXiv preprint 15Xiv:1512.03385, 2015. URL hattps://arxivvorr/ddttt 1a1.tt//51113333...3
Kaiming Hc, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp.
2020.
Dan Hendrycks, Mantas Mazcika, Saurav Kadavath, and Dawn Song. Using self-supervised learning can improve model robustness and uncertainty. arXiv preprint arXiv: 12340, 2019. URL
hutps://arxx.orr//d/////0 120
Geoffrey E Hinton, Simon Osindero, and Whe-Whye Tch. A fast learning algorithm for deep belief' nets. Neural computation, 18(7):157-11544 2006.
10

---

Published as a conference paper at ICLR 2021
Lang Huang, Chao Zhang, and Hongyang Zhang. Self-Adaptive Training: beyond Empirical Risk Minimization. arXiv preprint arXiv:2002.10319, 2020. URL https://wrii..orrpooo//0.....
Sergey Ioffe and Christian Szegedy. Batch normalization: Accelerating deep network training by reducing internal covariate shift. In International Conference on Muchine Leurning, 2015.
Harini Kannan, Alexey Kurakin, and Ian Goodfellow. Adversarial Logit Pairing. arXiv preprint (eXiv:8803006773 2018.
Minseon Kim, Jihoon Tack, and Sung Ju Hwang. Adversarial Self-Supervised Contrastive Learning. arXiv preprint arXiv:2006.075500 2020. URL https///ariinooggof2000000....
Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014.
Alexander Kolesnikov, Xiaohua Zhai, and Lucas Beyer. Revisiting self-supervised visual representa- tion learning. In Computer Vision and Pattern Recognition, 2019.
Simon Kornblith, Jonathon Shlens, and Quoc V Le. Do better ImageNet models transfer better? In Computer Vision and Pattern Recognition, 2019.
Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton. The CIFAR-10 dataset. 2014. URL http
/www.cs toronto hdu//rriz/cifrrhtmll
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world.
arXiv preprint arXiv:/607.02555 2016. URLLL//gss/aarrsioo///////000..0
Samuli Laine and Timo Aila. Temporal ensembling for semi-supervised learnings. In ICLR, 2017.
Ilya Loshchiloy and Frank Hutter. SGDR: stochastic gradient descent with warm restarts. In International Conference Learning Representations, 2017.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks, arXiv preprint arXiv: 1706.06083, 2017.
Takeru Miyato, Shin ichi Maeda. Masanori Koyama, and Shin Ishii Virtual Adversarial Training: A Regularization Method for Supervised and Semi-Supervised Learning. TPAMI, 2018.
Marius Mosbach, Maksym Andriushchenko, Thomas Trost, Matthias Hein, and Dietrich Klakow. Logit Pairing Methods Can Fool Gradient-Basse Attacks. arXiv preprint 1810. 2018. URL https://arxxv.oo///d//////
Vinod Nair and Geoffrey E. Hinton. Rectified linear units improve restricted boltzmann machines. In International Conference Machine Learning, 2010.
Amir Najafi, Shin-ichi Maeda, Masanori Koyama, and Takeru Miyato. Robustness to adversarial perturbations in learning from incomplete data. arXiv preprint arXiv:1905.13021, 2019, URL
hutps:/arxiv.orrg//////100 908. 1302
Mehdi Noroozi and Paolo Favaro. Unsupervised learning of visual representations by solving jigsaw puzzles. European Conference on Computer Vision, 2016.
Aaron van den Oord, Yazhe Li, and Oriol Vinyals. Representation learning with contrastive predictive coding. arXiv preprini urXiv:1807.008
2018.
Tianyu Pang, Xiao Yang, Yinpeng Dong, Kun Xu, Hang Su, and Jun Zhu. Boosting Adversarial Training with Hypersphere Embedding. arXiv preprint arXiv:2002.08619, 2020. URL hilps
Varsiv.org/pl//2202..666
Nicolas Papemot, Patrick McDaniel, Xi Wu. Somesh Jha, and Ananthram Swami. Distillation defense to adversarial perturbations against deep neural networks. arXiv preprint 1.X.5:1511.04558, 2015.
11

---

Published as a conference paper at ICLR 2021
Chongli Qin, James Martens, Sven Gowal, Dilip Krishnan, Krishnamurthy Dvijotham, Alhussein Fawzi, Soham De, Robert Stanforth, and Pushmeet Kohli. Adversarial Robustness through Local Lincarization. arXiv preprint 10t.v::9970022600. 2019. URL https///waiivoogg///////00000000
Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in adversarially robust deep learning, arXiv preprint urXiv:2002./1500 2020. URL httpps//aaxxw..on///////0000
Mehdi Sajjadi, Mehran Javanmardi, and Tolga Tasdizen. Regularization with stochastic transforma- tions and perturbations for deep cemi-superviee learning. In NeurlPS, 2016.
Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. Adver- sarially Robust Generalization Requires More Data. In Advances in Neural Information Processing Systems. 2018. URL
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 2013.
Yonglong Tian, Chen Sun, Ben Poole, Dilip Krishnan, Cordelia Schmid, and Phillip Isola. What makes for good views for contrastive learning. arXiv preprint arXiv:2005. 10243, 2020.
Antonio Torralba, Rob Fergus, and William T. Freeman. 80 million tiny images: a large dataset for non-parametric object and scene recognition. TPAMI, 2008.
Jonathan Uesato, Brendan O' Donoghue, Aaron van den Oord, and Pushmeet Kohli. Adversarial Risk and the Dangers of Evaluating Against Weak Attacks. arXiv preprint arXiv:1802.05666 2018.
Jonathan Uesato, Lean-Baptiss Alayrac Po-Sen Huang, Robert Stanforth, Alhussein Fawzi, and Pushmeet Kohli. Are labels required for improving adversarial robustness? arXiv preprint
1rXiv:1905.13725, 2019. URL httpss//anii..oo/////////1/111 13725
Laurenz Wiskott and Terrence Sejnowski. Slow feature analysis: Unsupervised learning of invariances. Neural Computation, 14(4):715-770, 2002.
Eric Wong, Leslie Rice, and J. Zico Kolter. Fast is better than free: Revisiting adversarial training. arXiv preprint arXiv:2001.03994 2020. URL https///axxi.orrpooo000..... .03994
Zhirong Wu, Yuanjun Xiong, Stella Yu, and Dahua Lin. Unsupervised feature learning via non-
parametric instance-level discrimination. arXiv preprint arXiv:1805.01975, 2018. URL
hipps
/arxiv.org/ull/1885000777
Qizhe Xie, Zihang Dai, Eduard Hovy, Minh-Thang Luong, and Quoe V. Le. Unsupervised Data Augmentation. arXiv: 12848, 2019.
Yang You, Igor Gitman, and Boris Ginsburg. Scaling SGD batch size to 32k for ImageNet training. arXiv preprint arXiv: 1708. 03888, 2017.
Runtian Zhai, Tianle Cai, Di He, Chen Dan, Kun He, John Hopcroft, and Liwei Wang. Adversarially Robust Generalization Just Requires More Unlabeled Data. arXiv preprint arXiv: 0000v:99060000 1906.00555, 2019a. URL httpss//aaaii.or//////////...0.0
Xiaohua Zhai, Avital Oliver, Alexander Kolesnikov, and Lucas Beyer. S41: Self-supervised semi- supervised learning. arXiv preprint arXiv: 1905003600 2019b. URL http://p///mmiioor////////0000.0
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael I.
Jordan. Theoretically Principled Trade-off between Robustness and Accuracy. arXiv preprint 17X1v:1901.08573, 2019. URL httpss//axxivogg///////0....0
Richard Zhang, Phillip Isola, and Alexei A. Efros. Colorful image colorization. In European Conference Computer Vision, 2016.
Daniel Zoran, Mike Chrzanowski, Po-Sen Huang, Sven Gowal, Alex Mott, and Pushmeet Kohli. Towards robust image classification using sequential attention models. In CVPR, 2020.
12

---

Published as a conference paper at ICLR 2021
A EXPERIMENTAL SETUP
Image augmentations. BORL uses similar image augmentations to SimCLR (Chen et al. 2020b and B (Grill et al. 2020). First, a random patch of the image is selected and resized to 32 x 32 with random horizontal flip, followed by a color distortion, consisting of random sequence of brightness, contrast, saturation, hue adjustments, and an optional grayscale conversion. Because of the low image resolution of CIFAR- 10 and CIFAR- 100, we do not apply final Gaussian blur and solarization to the patches.
Architecture. For consistency with prior work on adversarial robustness (Rice et al. 2020; Wong al.) 2020), we use convolutional residual network (He et al. 2015) with 34 layers (Pre-Activation ResNet-34) as our encoder e. We also use wider (from to x4 ResNets. The final representation h is the output of the final average pooling layer, which has feature dimension of 2048 (when the width multiplier is x x1). The projector g and predictor ş networks are multi-layer perceptrons. They consist of linear layer with output size 4096 followed by batch normalization (loffe & Szegedy 2013). rectified linear units (ReL.U) (Nair & Hinton 2010), and a final linear layer with output dimension 256.
Outer optimization. We use the LARS optimizer You et al. 2017) with a cosine decay learning rate schedule (Loshchilov & Hutter 2017) over 1000 epochs, with a warm-up period of 10 epochs. We set the learning rate to 2 and use global weight decay parameter of 5 10-4, For the target network, the exponential moving average parameter 7 starts from 0.996 and is increased to one during training using cosine schedule. We use a batch size of 512 split over 32 Google Cloud TPU v3 cores. We train linear classifiers using the Adam optimizer (Kingma & Ba 2014) for 50 epochs with an initial learning of 2 10 3 (the learning rate is decayed by factor 10x after 25 epochs). For linear classifiers, we perform early stopping as suggested by Rice et al. 2020) using a separate set of 1024 validation images (we do the same when training [UAT-FT] models). Note that linear models trained on frozen [B represetttttttnationnn do not really need early stopping (as the linear model do not overfit significantly). However. [AT--FT and adversarial training are prone to robust overfitting and obtain significantly higher robust accuracy using early stopping.
Inner optimization. The inner minimization in Eq. 7 implemented using PGD steps (con- strained by an E2 or Loo norm-bounded ball). In particular, unless specified otherwise, we set K to 40 and use an adaptive step size (as specified in Algorithm 1 in Croce & Hein 2020). For foo and & perturbations, the gradients in Eq. 6 are first normalized to their sign by their lz norm, respectively. With this setup, training takes approximately 19 hours for a ResNet-34 x 2 and 3 days for ResNet-34 x 4.
Evaluation protocol. We evaluate the performance of BYRL on CIFAR- 10 and CIFAR- against adversarial &g and lo norn-bounded perturbations. For that purpose, we train a linear classifier parametrized by coefficients W and offsets b on top of frozen BYORI following the procedure described in Kolesnikov et al.) (2019); Kornblith et al. (2019); Zhang et al. (2016); Chen al. (2020b). The linear model is either trained in non-robust manner (i.c., minw.b .o (( (WelellWee(ee))) c( 0) b, vy) or adversarially (i.e., minlw, . ED maxses i(Wel e(x + 0) + b. b.))). We then freeze the linear model and compute the accuracy of the combined model We(x; 0) + b against adversarial attacks (i.e., we count successful attack as a misclassification) In other words, we approximate the result of EEq. I using an inner-maximizatee adversarial attack). In order to get faithful results, all models are evaluated using a strong attack which combines elements of the AutoAttack procedure (Croce & Hein 2020) with the MultiTargetedd attack (Gowal et al. 2019). Namely, we use sequence of AutoPGD on the cross-entropy loss with restarts and 100 steps, AutoPGD
BeoRer representations.
procedure (i.e.,
the difference of logits ratio loss with 5 restarts and 100 steps. MultiTargeted on the margin loss with 20 restarts and 200 steps and Square (Andriushchenko et al. 2019) an efficient black-box attack, with 5000 queries.
13

---

Published as a conference paper at ICLR 2021
B ADDITIONAL EXPERIMENTS
In this section, we perform ablation studies on network architectures, strength of the attack used during representation learning, and color augmentation strength.
we study the impact of model architectures on CIFAR-10 10 against &oo corm-bounded perturbations of size 8/255. We train robust representations using wider ResNet, as in (Chen et al. 2020b Grill et al., 2020), with 34 layers and a width multiplier 1, 2 and 4, and denoted by ResNet34x1, x ResNet34 x4. We observe that models increase performance in both clean and robust aceuracy when model size increases. Without using additional unlabeled data, the robust accuracy saturates when using ResNe(34x2. Hence, unless mentioned explicitly, in this paper, we use ResNet34x2 for settings without additional data.
Network size. In Table 3
Table 3: Clean (no perturbations) and robust (under adversarial attack) accuracy obtained by networks of different sizes CIFAR-10 against lo norm-bounded perturbations of size 8/255.
CIFAR- 10
ARCHITECTURE
NORM
RADIUS
Clean
Robust
RESNET 34x1
78.02%
41.30%
RESNET 34x2
foc
6= 8/255
80.80%
43.24%
RESNET 34x4
81.32%
43.19%
Attack strength. Table shows results of training robust representations using different attack strengths on CIFAR- 10 against &oc norm-bounded perturbations of size 8/255. We study the effect of using standard PGD as well as its adaptive variant named AutoPGD (Croce & Hein 2020), with different step sizes using ResNet34x2 x models. We observe that more robust representations are obtained as the attack strength increases. Although this finding is similar to previous observations (Qin et al. 2019), notice that robust representation learning is more prone to gradient masking (resulting from using weak attacks during training) and requires stronger attacks then typically used in classical adversarial training. Throughout the paper, unless mentioned explicitly, used AutoPGD with 40 steps.
Table 4: Clean (no perturbations) and robust (under adversarial attack) accuracy obtained by rep- resentations trained against attacks of different strength on CIFAR- 10 against foo norm-bounded perturbations of size = 8/255.
CIFAR- 10
ATTACK
STEPS
NORM
RADIUS
Clean
Robust
5
85.26%
1.05%
10
81.44%
37.88%
PGD
foo
é 8/255
20
80.29%
42.58%
40
79.60%
43.41%
10
80.49%
40.59%
20
80.53
43.27%
AUTOPOD
too
8/255
80.47%
43.64%
60
80.69%
43.64%
Impact color augmentations. In Chen al. (020b) and Grill al. 2020). the authors demon- strate the importance of using color augmentations, which is composed color jittering and color dropping. We follow the same setup as Chen et al. (2020b) and Grill et al. (2020), Fig. 5] we perform ablation study the strength of color augmentations. We use AutoPGD with 20 steps on ResNet34 x2 model. We observe that B YORL is relatively stable in both clean and robust accuracy for color augmentation strength between O.I and 0.5. In this paper, had fixed the color augmentation strength to be 0.5 across all the experiments. A better choice in retrospect would have been 0.3 which provides improvement of 0.34%.
14

---

Published as a conference paper at ICLR 2021
45%
90%
cocurrr acuraacy
Testt accurscy
40%
Robust test
70%
60%
30%
50%
Strength of color augmentation
Strength of color augmentation
(a) Accuracy under attack
(b) Clean accuracy
Figure 5: Accuracy CIFAR- 10 for different strengths of the color augmentation. Panel shows the accuracy under foo attacks of size = 8/255, while panel [b shows the corresponding clean accuracy.
30%
Robust test accuracy
20%
10%
BYORL
0%
10%
50% 100%
Percenlage labeled training data
(a) CIFAR 100 only
Figure 6: Accuracy under for attack of size 8/255 for different CIFAR- 100 models function of the ratio of available labels. The available data restricted to CIFAR-106 only (labeled and unlabeled).
CIFAR-106 100. We repeat the experiments in subsection 4.2 on CIFAR-100. For CIFAR- 1000, we expected BYORL perform significantly better than UAT-FT as the number of classes is times larger than on CIFAR-10 10. However, Fig. shows more nuanced story and remains similar to Fig.F.. 4 It is interesting to observe that BYORL struggle with & norm-bounded perturbations size 8/255. As it has long been known that loo norm-bounded perturbations of size 8/255 are harder to cope with than l2 norm-bounded perturbations of size = 128 225, we posit that, equal model capacity, the pretext task (consisting of augmenting two different views of the same image) needs to be slightly modified to accommodate the more difficult threat. Indeed, the investigation on the impact of the color augmentation strength showed that it is possible improve robust representations by reducing the strength of these augmentations.
IMAGENET. We repeat a subset of the experiments from subsection 4.2 on IMAGENET. For IMAGENET, we train BOOL representations with ResNet 50x4 for 300 epochs. Following Grill al. 2020) and Chen al. (2020b), we add random blur the image preprocessing pipeline. We also change the learning rate from 2 to 1.2 and the initial target network weight decay rate 7 to 0.999. We use a batch size of 1024 split over 128 Google Cloud TPU v3 cores. All other parameters remain identical other experiments.
Table 5 shows that B YORLiis is capable of learning robust representations for larger datasets such as IMAGENET. In particular, our best model achieves 45. 44% robust accuracy against foo norm-bounded perturbations of size e = 4/255 (as evaluated by the combined set of attacks consisting of AutoPGD on the cross-entropy loss with 5 restarts and 100 steps, AutoPGD the difference of logits ratio loss with restarts and 100 steps). Note that classical adversarial training achieves 39.7% (when evaluated against PGD the cross-entropy loss with I restart and 100 steps), while the current state-of-the-art
15

---

Published as a conference paper at ICLR 2021
is 47.00% (Qin et al., 2019). While BYORL does not reach the sftt-of-ttheart in robustness, it remarkable to see perform so well with only 1% of available labels and reach 31.57% robust accuracy (e.g., classical non-robust supervised finetuning achieves 25.4% top-1 accuracy when adversarial perturbations are present as stated in /Zhai et al., 2019b). Finally, these results also confirm the results from TTble whereby training non-robust linear classifier still achieves significant robust accuracy.
Table 5: Clean (no perturbations) and robust (under adversarial attack) accuracy obtained when training robust representations on IMAGENET against &o norm-bounded perturbations of size 4/255. We evaluate the representations by training/fnettningg robust and non-robust linear head on IMAGENET with varying numbers labels. For completeness, we also add results for & norm- bounded perturbations of size e 255
TRAINING
IMAGENET (100%)
IMAGENET (10%)
IMAGENET (1%)
LINEAR HEAD
NORM
RADIUS
Clean
Robust
Clean
Robust
Clean
Robust
Robust (AT)
65. 14%
45,44%
62.39%
41.58%
47.07%
31.57%
lxc
4/255
Non-robust
65.27%
43.83%
62.40%
41.06%
47.64%
31.99%
Rohust (AT)
82
128/255
69.64%
65.48%
66.39%
61.90%
55.06%
51.00%
Transfer without adversarial training against foo norm-bounded perturbations. In subsec fion 4.2 we evaluate how robust accuracy degrades when linear classifiers trained on top of BY ORL representations are not trained robustly. In Table we evaluate models trained against & norm-bounded perturbations. In Table 6) we evaluate models trained against & norm- corm-bounded perturbations. both cases, non-robust downstream classifiers are able to exhibit non- non-trivial levels of robustness that remain within few percentage points of the robustly trained ones.
Table 6: Clean (no perturbations) and robust (under adversarial attack) accuracy obtained when training robust and non-robust representations on CIFAR- 10 against loo norm-bounded perturbations of size 8/255. We evaluate the representations by training/finetuning robust and non-robust linear head on CIFAR- 10, STL- 10 and CIFAR- 100.
TRAINING
CIFAR- 10
REPRESENTATION
LINEAR HEAD
NORM
RADIUS
Clean
Robust
Robust (BYORL)
Robust (AT) CIFAR-I0
84.96% 86.57%
52.75% 50.94%
Foo 8/255
Robust YORL)
Non-robust on CIFAR-10
FINETUNING OF LINEAR HEAD
STL-10
Robust (BYORL.) Robust (AT) STL-110
65.40%
37.79%
Exo
6 8/255
Robust (BYORL)
Non-robust on STL-10
65.75%
36.51%
FINETUNING OF LINEAR HEAD
CIFAR-100 100
Robust (BYORL)
Robust (AT) on CIFAR-100
37.80%
14.82%
8/255
Robust (BYORL.)
Non-robust on CIPAR- 100
39.51 %
12.21 26.1%
16

---

Published as a conference paper at ICLR 2021
C ADDITIONAL FIGURES
Robust test accuracy
90%
Robust tast accuracy
90%
80%
80%
70%
70%
60%
60%
50%
50%
UAT-FT
UAT-FT
40%
40%
1%
2%
5%
10%
20%
50%
100%
1%
2%
5%
10% 20%
50%
100%
Percentage labeled training
Percentage of labeled training data
(a) CIFAR-10 only
(b) CIFAR-10 10 and 80M-TINYIMAGES
Figure 7: Clean accuracy of same models presented in Fig. 3
100%
100%
Robust accuracy
90%
Robust test accuracy
90%
80%
80%
60%
60%
50%
BYORL UAT-FT
50%
BYORL UAT-FT
40%
40%
20%
100%
50% Percentage of labeled training data
Percentage of labeled training data
(a) CIFAR-10 only
(b) CIFAR-10 80M-TINYIMAGES
Figure 8: Clean accuracy of same models presented Fig.
D ANALYSIS OF RESULTING MODELS
In this section, we perform analysis on the adversarial loss landscape from the BYOL models L2 and fo cases to further examine whether adversarial accuracy is due gradient masking (Uesato al. 2018 AAthalye al. 2018). The analysis made here complements the use of the black-box Square (Andriushchenko et al. 2019) attack used by AutoAttack within our evaluation pipeline. For generating a loss landscape, we vary the input along linear space defined by the worse perturbations found by PGD (u direction) and random Rademacher direction (v direction). The and axes represent the magnitude of the perturbation added in each of these directions respectively and the axis represents the adversarial margin loss (Carlini & Wagner 2017b).
l2 model. In Fig. we show the adversarial loss landscapes randomly selected CIFAR- 10 test images from the B BORL model trained against l2 perturbations both CIFAR-11 and subset of SETTIIIIMGGES The loss surfaces are generally smooth in Fig. 9 which provides evidence that the model performance is not due gradient obfuscation. We also note that rigorous evaluation already uses a black-box attack (i.e., Square Andrüushchnnko et al." 2019).
too model. Fig. 10 shows the adversarial loss landscapes of 4 randomly selected CIFAR- 10 test images from the B BOOLL trained against &oo perturbations on both CIFAR- 10 and subset of SOM-TINYIMAGES We observe that the loss landscapes further suggests the model performance is not due to gradient obfuscation. We also note that our rigorous evaluation already uses black-bo box attack (i.e., Square by Andriushchenkko al. 2019).
generally smooth in Figure I0, which
17

---

Published as a conference paper at ICLR 2021
128/255
-128/23
-128/255
128/255
128/555
128/255
(a) airplane
(b) frog
( :01
trakk
dog
22/255
12//555
-128/255
-128/255
128/255
128/255
128/255
128/255
(c) truck
(d) frog
Figure Loss landscapes around different CIFAR-10 test images. is generated by varying the input to the model, starting from the original input image toward either the worst attack found using PGD (u direction) or a random Rademacher direction (v direction). The loss used for these plots the margin loss Zy maxiáy (i.c.. misclassification occurs when this value falls below zero). The model used is the YORL trained against & perturbations on both CIFAR- 10 and subset of SOM-TINYIMACE The circular-shape represents the projected & ball of size 128/255 around the nominal image.
18

---

Published as a conference paper at ICLR 2021
automobiic
dog
8/355
.8/255
.8/255
8/255
8/255
0/255
(a) airplane
(b) frog
truck
(4 XX)
trog
dog
A255
47555
-8/255
-8/255
8/255
8/255
8/255
8/235
(c) truck
(d) frog
Figure 10: Loss landscapes around the clean image of different CIFAR- 10 test images. is generated by varying the input to the model, starting from the original input image toward either the worst attack found using PGD (u direction) or a random Rademacher direction (u direction). The loss used for these plots is the margin loss Zy maxiáy 2j (i.c., misclassification occurs when this value falls below zero). The model used the BYOL model trained against &oo perturbations on both CIFAR-10 10 and subset of TOM-TINYIMAGES. The diamond-she represents the projected & ball of size = 8/255 around the nominal image.
19


Reviews:
[{"review_id": "k8cwa0R9_j", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 7, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "##########################################################################\nSummary: \n\nThe paper proposes a new self-supervised technique, Bootstrap Your Own Robust Latents (BYORL), based on an existing technique, BYOL. BYORL proposes to provide adversarially robust representations for low-label regimes. The paper claims that BYORL achieves state-of-the-art performance on CIFAR-10 even with data that is labeled as low as 1%. In fact, the authors highlight that the representations resulted from BYORL avoid the explicit training for adversarial robustness, because they are already robust.\n\n##########################################################################\n\nReasons for score: \n \nOverall, the paper in its current form is above the acceptance threshold. The proposed idea looks very encouraging. Provided the authors address some of the concerns the proposed method has a significant potential to the self-supervised adversarial robustness. If we look at the low-label regime alone, probably the paper has good contributions, that on ImageNet is not entirely convincing. If the authors convince me on that, happy to increase the score to clearly accept.  \n##########################################################################\n\n\nPros:\n\n1. Overall, the paper is well written except for a few minor grammatical errors, easy to follow and understandable. \n\n2. The paper discusses the existing literature and positions the proposed approach with respect to the state-of-the-art. The proposed method is definitely a decent contribution towards the field.\n\n3. While robustness evaluations are good, the transfer to unseen and without adversarial training are much more encouraging.\n\n\nCons:\n\n1. In abstract “... pioneered by four separate and simultaneous work in 2019,” should be “... pioneered by four separate and simultaneous works in 2019,”\n\n2. “Since Madry et al. (2017), various modification to their ...” should be “Since Madry et al. (2017), various modifications to their ...”\n\n3. As the % of labeled training data increases, there is not a significant improvement in robust test accuracy for CIFAR-10, that increases for CIFAR-100. Why is that happening for CIFAR-10? \n\n4. On CIFAR-100, for anything over 10% labeled training data the other methods are still the state-of-the-art, the proposed method does not perform well. It again probably is due to the above observation of robust accuracy not increasing with a steep slope like the other methods. \n\n5. What is robust accuracy, Zhang et al. 2019 or Uesato et al 2019 or others have it defined, nevertheless, please say in a sentence what it is.\n\n6. On the ImageNet, the hypothesis of BYORL to get better as the labeled data increases is hard to buy given what we saw on CIFAR-10 and CIFAR-100. For those two, BYORL starts better and the state-of-the-art methods either reach BORL or outperform it. In ImageNet case, BYORL is outperformed with 1% itself, unless supported with empirical evidence, it is hard to believe the above statement of improvement.\n\n7. Overall, the empirical results are satisfactory but not entirely convincing.\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "RCQOECCAsis", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "\nThis paper proposes some modifications to BYOL (Bootstrap Your Own Latents) in an attempt to address adversarial robustness in low-label high data regimes. The paper is well written and very easy to follow. Overall, the idea is clear and well presented. \n\nAlthough the author's claim their approach to be novel, as is, the main contribution of the paper is adding adversarial training to BYOL, which already does not require labels. \n\nThe authors also claim that their approach is better than pseudo-labeling training for downstream tasks. Yet, this is not always the case. The authors also mention that their approach reaches optimal performance with 5% of labels (and seems to deteriorate with more labelled data). There is no analysis on why this is the case. \n\nThere is also a lack of comparison against contemporary SOTA self-supervised approaches.\n\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "QJyNp6a1Jk", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 7, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper introduces a new algorithm for learning adversarially robust models in the semi-supervised setting, where a small amount of labeled data is available together with a sizeable unlabeled dataset. The proposed approach BYORL adapts an existing self-supervised learning method BYOL by introducing a new adversarial augmentation technique based on maximizing the cosine similarity between representations. BYORL is evaluated on CIFAR-10 and compared against a recent pseudo-labelling based approach UAT-FT for the semi-supervised setting, and is shown to outperform UAT-FT in terms of robust accuracy under $\\ell_2$ and $\\ell_\\infty$ attacks under the low-labelled data regime. The representations learnt by BYORL are also shown to be better than that of UAT-FT when transferred to other datasets. Finally, robust representations are shown to be more important than learning a robust linear classifier on top.\n\nStrengths:\n- Significant improvements in robust accuracy in the low-label regime\n- Interesting observations regarding transferability of robust representations and importance of final robust linear classifier\n- Paper is generally clear and well-written\n\nWeaknesses:\n- RoCL as introduced by \"Adversarial Self-Supervised Contrastive Learning\", NIPS 2020 can also be applied to the semi-supervised setting, which somewhat compromises novelty. Ideally this method should be included in the experimental evaluations. This paper was cited but not discussed in the context of related work, but should be.\n- Label budgets claimed do not include sizeable validation set used for early stopping, which can sometimes exceed the label budget (e.g. result with 500 labeled images also uses validation set of 1024 examples).\n- Experimental evaluation could be strengthened in a few ways:\n  * Clean accuracy comparison for Fig 3/4 - does UAT-FT do better in terms of clean accuracy?\n  * It would be informative to include the robust accuracy of a model trained directly on STL-10 and CIFAR-100 in Table 2 to show how good the transferred representations are.\n  * Experimental results seem to be from a single run; multiple runs would give an idea of the variance.\n\nOverall, the robust accuracy improvements achieved in the low-label regime by BYORL are significant and the method is somewhat novel. The paper could be further strengthened by improving the experimental evaluation as described above. The highly related work RoCL should be discussed and ideally compared with.\n\nOther comments:\n- The paragraph after Eq 8 was confusing to me. What is meant by symmetrizing the loss? What is the final loss used to train the model after symmetrization? And why does the argument about batch-norm statistics not apply to the online network as well if the loss is symmetrized (which I took to mean that both models would be separately attacked and the losses added up)?\n- Some analysis into the representations learnt would be helpful to give some insight into why the method works.\n- Why does the method work better under $\\ell_2$ attacks as compared to $\\ell_\\infty$ attacks?\n- What is the effect of different transformations on robustness? Are the transformations important for robustness different from those important for clean classification?\n\n*** Post Response Comments ***\nI thank the authors for addressing the points raised. I am raising my score accordingly to 7.\n\nNit: The y-axis labels on Figure 7 and 8 should probably say \"Clean accuracy\" instead of \"Robust test accuracy\".", "extra_scores": {}, "extra_text": {}}, {"review_id": "JsjYtTIslq", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "In this paper, adversarial self-supervised learning is proposed to render robust data representations for down-stream fine-tuning tasks. The core idea is to integrate BYOL with adversarial training. The paper is well written in general. However, I do have several concerns about this submission.  \n\n1. Robust self-supervised pre-training + fine-tuning has been studied in two recent works at least.\n\n[1] Hendrycks, Dan, et al. \"Using self-supervised learning can improve model robustness and uncertainty.\" Advances in Neural Information Processing Systems. 2019.\n\n[2] Chen, Tianlong, et al. \"Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuning.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2020.\n\nThe comparison with [1-2] is recommended. \n\n2. Unclear algorithm implementation. \n\na) In Figure 2, why is additional prediction head $q(\\cdot, \\theta)$ in BYOL and BYORL needed? Please clarify it. \n\nb) It is not clear why a very large eps used in $\\ell_2$ robust training, e.g., eps = 128/255. \n\nc) In Table 2, it is not clear why $\\ell_\\infty$ robust pre-training results are missing?\n\n3. Not convinced transfer results on unseen tasks. \n\nIn the paper, the authors claimed that \"For both representations, we train a robust linear model using adversarial training (see subsection 3.1) with a different label availability on STL-10 and CIFAR-100 against `$\\ell_\\infty$ and `2 norm-bounded perturbations.\"\n\nThus, I supposed that during fine-tuning, the robust representation is frozen, and only the linear classifier is adversarially trained, correct?\n\nIf so, in Table 2, the results on Robust (BYORL) + Non-robust on CIFAR-10 seem very strong. It indicated that the standard partial fine-tuning is able to preserve robustness from self-supervised robust representation. However, [2] founds a different conclusion. Thus, it is important to provide additional explanations and comparisons for the achieved results. \n\nI also suggest the authors check if the proposed defense yields obfuscated gradients, e.g., having a plot of robustness versus different attack strength eps during evaluation. \n\nLastly, if the pre-training task is conducted over CIFAR-10, can the results be further improved?\n\n", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper considers the use of adversarial self-supervised learning to render robust data representations for various tasks, in particular to integrate the Bootstrap Your Own Robust Latents (BYOL) with adversarial training, where a small amount of labeled data is available together with a sizable unlabeled dataset.  Especially the low-data regime is of interest.  It extends a previous method with a new adversarial augmentation technique, it is compared against several methods, and the robust representations are shown to be useful more generally.  There were some confusing presentations and questions that were resolved in a detailed discussion with the reviewers.
Decision: Accept (Poster)