Part-Based Models Improve Adversarial Robustness
Authors: Chawin Sitawarin
Kornrapat Pongmala
Yizheng Chen
Nicholas Carlini
David Wagner
Venue: ICLR 2023 poster (2023)
Keywords: adversarial robustness
adversarial examples
computer vision
part-based model

Abstract: We show that combining human prior knowledge with end-to-end learning can improve the robustness of deep neural networks by introducing a part-based model for object classification. We believe that the richer form of annotation helps guide neural networks to learn more robust features without requiring more samples or larger models. Our model combines a part segmentation model with a tiny classifier and is trained end-to-end to simultaneously segment objects into parts and then classify the segmented object. Empirically, our part-based models achieve both higher accuracy and higher adversarial robustness than a ResNet-50 baseline on all three datasets. For instance, the clean accuracy of our part models is up to 15 percentage points higher than the baseline's, given the same level of robustness. Our experiments indicate that these models also reduce texture bias and yield better robustness against common corruptions and spurious correlations. The code is publicly available at https://github.com/chawins/adv-part-model.

Published as a conference paper at ICLR 2023
PART-BASED MODELS IMPROVE ADVERSARIAL ROBUSTNESS
Chawin Sitawarin'
Kornrapat Pongmala'
Yizheng Chen'
Nicholas Carlini
David Wagner!
EECS Department, University of California, Berkeley
Google
ABSTRACT
We show that combining human prior knowledge with end-to-end learning can improve the robustness of deep neural networks by introducing a part-based model for object classification. We believe that the richer form of annotation helps guide neural networks to learn more robust features without requiring more samples or larger models. Our model combines a part segmentation model with a tiny classifier and is trained end-to-end to simultaneously segment objects into parts and then classify the segmented object. Empirically, our part-based models achieve both higher accuracy and higher adversarial robustness than ResNet-50 baseline on all three datasets. For instance, the clean accuracy of our part models is up to 15 percentage points higher than the baseline's, s, given the same level of robustness. Our experiments indicate that these models also reduce texture bias and yield better robustness against common corruptions and spurious correlations. The code is pub- licly available at /tttps://giteen
com/ chawins/ aavaadvpppp -part- -model.
INTRODUCTION
As machine learning models are increasingly deployed in security or safety-critical settings, robustness becomes an essential property. Adversarial training (Madry et al., 2018) is the state-of-the-an method for improving the adversarial robustness of deep neural networks. Recent work has made substantial progress in robustness by scaling adversarial training to very large datasets. For instance, some defenses rely on aggressive data augmentation (Rebuffi al., 2021) while others utilize a large quantity of extra data (Carmon et al., 2019) even larger models (Gowal et al., 2021a). These works fall in line with a recent trend of deep learning on "scaling up." i.c., training large models on massive datasets (Kaplan et al., 2020). Unfortunately, progress has begun stagnate here a point diminishing returns: for example, Gowal et al. (2021a) show that an exponential increase in model size and training samples will only yield a linear increase in robustness.
have reached
Our work presents a novel alternative to improve adversarial training: we propose to utilize additional supervision that allows for richer learning signal. We hypothesize that an auxiliary human-aligned learning signal will guide the model to learn more robust and more generalized features.
To demonstrate this idea, we propose to classify images with a part-based model that makes pre- dictions by recognizing the parts of the object in a bottom-up manner. We make use of images that annotated with part segmentation masks. We propose simple two-stage model that combines a segmentation model with a classifier. An image is first fed into the segmenter which outputs pixel-wise segmentation of the object parts in given input: this mask then passed tiny classifier which predicts the class label based solely on this segmentation mask. The entire part-based model is trained end-to-end with a combination of segmentation and classification losses. Fig. 1 illustrates model. The idea is that this approach may guide the model to attend more global shape than to local fine-grained texture, hopefully yielding better robustness. We then combine this part- architecture with adversarial training to encourage it to be robust against adversarial examples.
We show that our model achieves strong levels of robustness on three realistic datasets: Part- ImageNet (He et al., 2021), Cityscapes (Meletis et al., 2020), and PASCAL-Part (Chen et al., 2014). Our part-based models outperform the ResNet-50 baselines on both clean and adversarial accuracy simultaneously. For any given value of clean accuracy, our part models achieve more than 10

---

Published as a conference paper at ICLR 2023
Part-IaageNet
Pur Beacd Model
Adversarial Accuracy
30
"De
Caeiliz
20
Tering
Predicted
Trimn
Cluss Label
15
10
ResNei-50
S
Our Pust-Rood Madel
Scamiestaiin Mick
Unserdirah
"Brdd
Tuude"
Label
84
86
88
90
92
Clean Accuracy
Figure I: Our part-based model consists of (1) the part segmenter and (2) tiny classifier. We train it for the object classification task end-to-end using part-level segmentation labels to improve its robustness.
Figure 2: Accuracy-robusteess trade-off of our part model and the ResNet-50 baseline on the Part-ImageNet dataset.
percentage points higher adversarial accuracy compared to the baseline on Part-ImageNet (see Fig. 2). This improvement can be up to 25 percentage points in the other datasets we evaluate on (see Fig. 4). Alternatively, given the same level of adversarial robustness, our part models outperform the baseline by up to 15 percentage points on clean accuracy (see Table 1).
Our part-based models also improve non-adversarial robustness, without any specialized training or data augmentation. Compared to a ResNet-50 baseline, our part models are more robust to synthetic corruptions (Hendrycks Dietterich, 2019) as well as less biased toward non-robust "texture features" (Geirhos et al., 2019). Additionally, since our part models can distinguish between the background and the foreground of an image, they are less vulnerable to distribution shifts in the background (Xiao et al., 2021). These three robustness properties are all highly desirable and enabled by the part-level supervision. We believe that our part-based model is the first promising example of how richer supervised training signal can substantially improve the robustness of neural networks.
2 RELATED WORK
2.1 ADVERSARIAL ROBUSTNESS
Adversarial training (Madry et al., 2018) has become standard method for training robust neural networks against adversarial examples. Many improvements on this technique have been pro- posed (Zhang et al., 2019; Xie et al., 2019; Pang et al., 2019; Huang et al., 2020: Qin et al., 2019; Rice et al., 2020; Wong et al., 2020; Hendrycks al., 2019; Kireev et al., 2021). Among these, TRADES (Zhang et al., 2019) improves the trade-off between robustness and clean accuracy of ad- versarial training. More recent state-of-the-art methods focus on improving the adversarial robustness through scales. Carmon et al. (2019) and Gowal et al. (2021a) rely large number of unlabeled training data while others utilize large generative models for data augmentation (Rebuffi et al., 2021) or synthetically generating more training samples (Gowal et al., 2021b; Sehwag et al., 2022).
These works follow a recent trend of "large-scale learning from weak signals," " which stemmed from recent progress vision language models such as CLIP (Radford et al., 2021). The improvement from scaling up, however, has started to reach its limit (Gowal et al., 2021a). We take a different route to improve robustness. Our part-based models utilize supervision and high-quality part segmentation annotations to improve robustness without using more training samples or complex data augmentation.
2.2 PART-BASED MODELS
Part models generally refer to hierarchical models that recognize objects from their parts in bottom- up manner, e.g., Deformable Part Models (Endres et al., 2013; 3; Felzenszwalb et al., 2010 0; Chen et al., 2014; Girshick al., 2015; Cho et al., 2015). Historically, they are most often used human recognition (Chen & Yuille, 2014; Gkioxari et al., 2015; Xia et al., 2017: Ruan et al., 2019) and have shown success in fine- fine-grained classification (Zhang et al., 2018; Bai et al., 2019) as well as pose estimation (Lorenz al., 2019; Georgakis al., 2019). We revisit part-based models from the robustness perspective and design a general model that can be trained end-to-end without any feature engineering. Our technique is also agnostic particular type of object.
Several works have explored bast- models in the context of adversarial robustness. Freitas et al. (2020) detect adversarial examples by using Mask R-CNN extract object parts and verify that
2

---

Published as a conference paper at ICLR 2023
they align with the predicted label. If the predicted and the expected parts do not align, the input is regarded as an attack. However, unlike our work, their scheme not evaluated against an adaptive adversary. Chandrasckaran et al. (2019) propose robust classifier with hierarchical structure where each node separates inputs into multiple groups, each sharing a certain feature (e.g., object shape). Unlike part model, its structure depends heavily on the objects being classified and does not utilize part segmentation or richer supervision. A concurrent work by Li et al. (2023) also investigates segmentation-base part-based models for robustness.
3 PART-BASED MODELS
3.1 GENERAL DESIGN
Data samples. Each sample (z. y) contains an image a E R and a class label y E y. where H and W are the image's height and width. The training dataset for part models are also accompanied by segmentation masks M E (0, 1](K+))xxxX corresponding to K + binary masks for the K object parts (M, M&,) and one for the background (Mg).
Architecture. Our part-based model has two stages: the segmenter faz R3xHxW +))+)) and tiny classifier fels [R(+ + C. The overall model is denoted by f == fel o fseg- More specifically, the segmenter takes the original image x as the input and outputs logits for the K + masks, denoted by M = fz)g()), of the same dimension as .. The second-stage classifier then processes M and returns the predicted class probability f(x) = Jas (M) fets(Jsng (x)). The predicted label is given by 9 = arg max [(x);; Fig. 1 visually summarizes our design.
We use DeepLabv3+ (Chen et al., 2018) with ResNet-50 backbone (He al., 2016) as the segmenter, but our part-based model is agnostic to the choice of segmenter architecture. Additionally, all of the classifiers are designed to be end-to-end differentiable. This facilitates the evaluation process as well making our models compatible with adversarial training.
Classifier design principles. We experimented with various classifier architectures, each of which processes the predicted masks differently. Our design criteria were:
Part-based classification: The classifier should only predict based on the output of the segmenter. It does not see the original image. If the segmenter is correct and robust, the class label can be easily obtained from the masks alone.
2. Disentangle irrelevant features: The background is not part of the object being classified so the segmenter should separate it from the foreground pixels. Sometimes, background features could result in spurious correlation (Xiao et al., 2021; Sagawa et al., 2020). Thus, could simply drop the predicted background pixels or leave it to the second-stage classifier to correctly utilize them. This design choice is explored further in Appendix D).7.
3. Location-aware. The second-stage classifier should utilize the location and the size of the parts, in addition to their existence.
Following these principles, we designed four part-based classifiers, Downsampled, Bounding-Bow Two-Headed, and Pixel. The first two perform as well better than the others, so we focus only on them in the main text of the paper. Appendix C has details on the others.
3.2 DOWNSAMPLED PART-BASED MODEL
This model first applies softmax on the predicted mask logits MM to normalize the masks pixel-wise to number between 0 and 1. This potentially benefits robustness: if the masks were not normalized, few pixels could be manipulated to have very large value and outweigh the benign pixels. Empirically, this softmax doesn't 't lead to gradient obfuscation (Athalye et al., 2018) (Appendix D.3).
After that, the masks are downsampled to size 4 x 4 <4xx4 by adaptive average pooling layer before being passed to a tiny neural network with one convolution layer and two fully-com fully-connected layers. Fig. 3a illustrates this model. Downsampling maintains coarse-grained spatial information about each part's 's rough shape and location while compressing high-dimensional masks to a low- dimensional feature vector. This keeps the classifier small, making the past-based model comparable
3

---

Published as a conference paper at ICLR 2023
Inper Images
Part Segmenter
(Deglannde
Average Peoting
"Dog"
Profised Scuncetatio Mank
Smaal Classfier
(a) Downsampled Part-based Model
Exper Inrages
Part Segmentter
"Dok"
(Quz and
Posliceed Segnematiin Mask
Bounding
Small Canetter
(b) Bounding- Box Part-based Model
Figure 3: Illustration of our two part-based models: (a) downsampled and (b) bounding-box
to the normal ResNet-50 in size. We find that the particular size of the downsampled mask has little effect on the accuracy of the model (see Appendix D.8 for the comparison).
3.3 BOUNDING-BOO PART-BASED MODEL
Similar to the downsampled classifier, the bounding-boo classifier also compresses M to lower- dimensional representation, but instead of downsampling, uses bounding boxes. Specifically, processes each of the logit segmentation masks, M,. into K "soft" bounding boxes, one for each object part, excluding the background channel (see Fig. 3b). Each bounding box is represented by five features: a logit score (s; E [0, 1)), a centroid (c), o E [-1, 1)) representing the (normalized) 2D coordinates of the center of the bounding box, and a standard deviation (a! of [o, 1)) capturing the height and the width of the box. We describe how these features are computed below. This gives us a dense feature vector neural network predicts the class label given v and no other information.
[0 (i...... uK] R.K where v; [s ct. of of of E RR Finally,
tiny fully-commen
Crucially, ensure that the computation of these features differentiable to enable effective training as well as reliable evaluation of adversarial robustness. First, we compute a mask F that for all foreground pixels. Then, the confidence score for each part mask, is the weighted average of the part logit mask M, over all pixels, weighted by F.
A1=1 ΣW - M.(h.u (l.w))
where ((,,w) Sigmoid
Σ Mr
s7ghee)) (1)
8,
E Ew=1 F(h,0))
The other four bounding- box features are computed as follows:
H1
11 pi(h) (h c2)2
d = Σ
pi(h)
h,
of
Σ
(2)
h=1
h=1
W
W
c
pi (w) w,
of
Σ
pi(w) (w - c?y²
(3)
ΣH - M(!w.)> Pe(w') ΣH M, (h.
L==1 ((h,'w))
where P:(h')
(4)
ΣH Σw M, (h,w)
and (h, Softmax (h,
is the softmax mask with the background channel removed.
[I.....K] Note that (f) and pi(w) can be interpreted as the (normalized) density of the i-th object part in row or column w, and 1M (h..e)) as its mass. Hence, of and of are simply the centroid of the i-th part. af and of measure the spread of mass we use them as proxy for the height and the width of the part.
3.4 TRAINING LOSSES
Normal loss. These bart- models are trained end-to-end with a combined segmentation- classification loss, i.e., weighted sum of two cross-entropy losses, for the classification task and
4

---

Published as a conference paper at ICLR 2023
one for the pixel pixel-wise segmentation task. A hyperparameter, Cseg [0, 1}, balances these two losses. Lnormal (I, 3) (1 Gseg) Lels (z, y) + Ceeg Lseg(I,))
(5)
where
(I, 3) LCB (f(z). v)
(6)
HxW
and
Leog (I,, 2) (K 1)HW
Σ k=
ΣΣ
LCE (fug(e))
Adversarial loss. We construct adversarial version of this loss, that measures susceptibility to adversarial examples. The adversary's 's goal is maximize the classification loss (since the main task we evaluate on). The same adversarial example x² generated from the classification loss is also used compute the segmentation loss.
Ladv (I, v) = (1 CoeR) ) Lota(x" + Coea Looog (x= ,
(8)
where
x² arg max Tecl
=:Il=~xll,Se
TRADES loss. We combine this with TRADES loss (Zhang et al., 2019) which introduces an extra term, Kullback-Leibler divergence (DRL) between the clean and the adversarial probability output.
LTRADES (x, y) = (1 CSag)) Lota( y) + Oseg Looa . + 3 DKL. ((()),
(10)
where x² arg max =;||=~x|I,S$
DKL f(x))
(11)
3.5 EXPERIMENT SETUP
3.5.1 DATASET PREPARATION
We demonstrate part models on three datasets where part-level annotations are available: Part- ImageNet (He et al., 2021), Cityscapes (Meletis et al., 2020), and PASCAL-Part (Chen et al., 2014).
Cityscapes and PASCAL-Part were originally created for segmentation, we construct classifi- cation task from them. For Cityscapes, we create a human-vs-vehine ve-ehille classification task. For each human vehicle instance with part annotations, amount of padding and assign the appropriate class label. PASCAL-Part samples do not require cropping because each image contains only few objects, based on the largest object in that image. To deal with the class imbalance problem, we select only the top five most common classes. Appendix A presents additional detail the datasets.
crop square patch around it with some random
simply assign label to each image
3.5.2 NETWORK ARCHITECTURE AND TRAINING PROCESS
ResNet-50 (He et al., 2016) is our baseline. Our part-based models (which use Deepl .abv3+ with ResNet-50 backhone) have similar size the baseline: our part-based models have 26.7M parame- ters, compared to 25, 65.6M parameters for ResNet-50. All models are trained with SGD and batch size of 128, using either adversarial training or TRADES, with 10-step -PG with e = 8/255 and step size of 2/255. Training early stopped according adversarial accuracy computed the held-out validation set. All models, both ResNet-50 and part- based models, are pre-trained on unperturbed images for 50 epochs speed up adversarial training (Gupta et al., 2020).
3.5.3 HYPERPARAMETERS
Since our experiments are conducted new datasets, we take particular care in tuning the hyper- parameters (e.g, learning rate, weight decay factor, TRADES' 8, and (sog) for both the baseline and our part-based models. For all models, and the weight decay (1 10 10-4, x 10-4) during PGD adversarial training. For the past- models, after obtaining the best learning rate and weight decay, then further tune Gseg by sweeping values 0.1, 0.2, ...., 0.9 and report on the model with comparable adversarial accuracy to the baseline. Results for other values of Caeg are included in Section D.2.
grid search the learning rate (0.1, 0.05, 0.02)
For TRADES, we reuse the best hyperparameters obtained previously and sweep range of the TRADES parameter 8, from 0.05 to 2, generate the accuracy cccuracy-rbbustness trade-off curve. However,
5

---

Published as a conference paper at ICLR 2023
Table I: Comparison of normal and part-based models under different training methods. Adversarial accuracy computed with AutoAttack (c = 8/255). For TRADES, we first train a ResNet- model with clean accuracy of at least 90%, 96%, and 80% for Part-ImageNet, Cityscapes, and PASCAL-Part, respectively, then we train part-based models with similar or slightly higher clean accuracy.
Part- Imageemaeeeet
Cityscapes
PASCAL Part
Training Method
Models
Clean
Adv.
Clean
Adv.
Clean
Adv.
ResNet-50
74.7
37.7
79.5
68.4
47.1
37.8
PGD
Downsampled
85.6
39.4
94.8
70.2
49.6
38.5
(Madry et al., 2018)
Part Model
(t 10.9)
(t 1.7)
(t 15.3)
(1 1.8)
(t 2.5)
(t 0.7)
Bounding- BBx
86.5
39.2
94.2
69.9
52.2
38.5
Part Model
(t 11.8)
(t 1.5)
(1 14.7)
(1 1.4)
(t 5.1)
(1 0.7)
ResNet-50
90.6
7.7
96.7
52.5
80.2
12.6
TRADES
Downsampled
90.9
19.8
97.1
62.5
83.1
29.9
(Zhang et al., 2019)
Part Model
(1 0.3)
(t 12.1)
(1 0.4)
(t 10.0)
(.
(1 17.3)
Bounding-
90.8
24.1
97.1
63.0
88.5
29.5
Part Model
(1 0.2)
(t 16.4)
0.4)
(t 10.5)
(t 8.3)
(1 16.9)
Pet-eeageeee
Cityseapes
PASCAL
40
Adversnnll Acangg (c- 8/2330
82305)
40
35
30-
65
Alvaraniial Armmay
255
60
25-
30
201
15-
55
20
20-
RoNo:50
50
Boanding Mocel
75
40
90
95
75
50
90
95
100
50
60
70
Clean Accrrncy
Clean Accunecy
Claa Accuncy
(a) Pmat--Tm
(b) Cityscapes
(c) PASCAL-Part
Figure 4: Accuracy and robustness trade-off plots of normal and part-based models trained on (a) Part-ImageNet, (b) Cityscapes, and (c) PASCAL-Part. The filled dots represent PGD adversarial training while the unfilled ones denote TRADES with different values of its parameter 3.
we do not tune Gseg here and keep it fixed at 0.5 which puts equal weight the classification and the segmentation losses. The same hyperparameter tuning strategy is used on both the baseline and part models. We include our code along with the data preparation scripts in the supplementary material. Appendix B contains a detailed description of the experiment.
ROBUSTNESS EVALUATION
We compare the adversarial robustness and the clean accuracy of the part-based models to the ResNet- 50 baseline. We must examine both metries at the same time since there is known trade-off between them (Tsipras et al., 2019). We use AutoAttack (Croce & Hein, 2020), a standard and reliable ensemble of attacks, to compute the adversarial accuracy of all models. We also follow the suggested procedures from Carlini et al. (2019) to ensure that our evaluation is free from the notorious gradient obfuscation problem. For further discussion, see Appendix D.3.
Table I compares the part-based models to the baseline ResNet-50 under two training methods: PGD adversarial training (Madry et al., 2018) and TRADES (Zhang et al., 2019). For PGDD-raiine models, both of the part-based models achieve about 3-15 percentage points higher clean accuracy than the baseline with similar adversarial accuracy. The models trained on Cityscapes show the largest improvement, followed by ones on Part-ImageNNt and PASCAL-Part. TRADES allows controlling the tradeoff between clean vs adversarial accuracy, so we choose models with similar clean accuracy and compare their robustness. The part models outperform the baseline by about 16, 11, and 17 percentage points on Part-ImageNet, Cityscapes, and ASSAA--Part, respectively. These results show that part-based models significantly improve adversarial robustness.

---

Published as a conference paper at ICLR 2023
Quadrupred
Quadrupred
Quadrupred
Biped
Regeile
Quadrupred
Biged
Bleycle
Acroplane
Groundtruth Segmentation
Prodicted segmentation clean images
Reptle
Biped
Quadrupted
Quadiupred
Biped
Quadrupred
Bird
Snake
Bicycle
Car
Predicted segmentation
PGD adversarial images
Figure 5: Visualization of the part segmentation predicted by the segmenter of the bounding box part model adversarially trained on Part-ImageNet. All of the clean samples shown in the second and the third rows are correctly classified. The last two rows show PGD adversarial examples and their predictions. The misclassified (resp. correctly classified) samples are indicated with red (resp. green) box, and the misclassified class labels are shown below in red (resp. green). The ground-truth labels and segmentation mask can be found on the top row.
Fig. 4 plots the aobustness-accureeg trade-off curves for all three datasets, generated by sweeping the TRADES hyperparameter (see Section 3.5.3). Our part-based models are closer to the top-right comer of the plot, indicating that they outperform the baseline both clean and adversarial accuracy.
Fig. shows ten randomly chosen test samples from Part- Part-ImageNet along with their predictions from the adversarially trained bounding box part model, with and without the attack. Most of the part-based models, including this one, achieve above 80% pixel-wise segmentation accuracy on clean samples and about 70% adversarial ones. Successful attacks change most, but not all, foreground pixels to the wrong class, but the shape and foreground -es----kgbbbuudddd prediction for each part remains correct; the attack changes only the predicted class for each part. This suggests that part-based models may learn shape features that are more difficult to manipulate, an observation that aligns with our quantitative results on shape-vs- ve-texurre bias Section 5.1. We suspect the robustness of these part shapes might account for the model's improved robustness.
Attacking the segmenter model. ensure that we evaluate our models with the strongest attack possible, we come up with two additional attacks that target the segmenter. First is the single-staged attack which optimizes a combination of the classification and the segmentation losses as Eqn. The second attack is the two- wwo-staged attack where the first stage attacks the segmenter alone to produce the worst-case mask. This step generates "guiding samples" which are then used to initialize the second stage that attacks the part model end-to-end. For this attack, variations that differ in how the target masks are chosen in the first stage. We find that the single-stage attack is always worse than the normal PGD attack. A small subset of the two-stage attacks performs better than PGD, but all of them are worse than AutoAttack. For more details, see Appendix D.3.
experiment with four
UNDERSTANDING THE PART-BASED MODELS
5.1 EVALUATING NON-ADVERSARIAL ROBUSTNESS
Part-based models improve adversarial robustness, but what about robustness to non con-adversarial distribution shift? We evaluate the models three scenarios: common comupttioss, foreground background spurious correlation, and shape-vs-texture bias. We generate benchmarks from Part- ImageNet following the procedure ImageNet-C (Hendrycks Dietterich, 2019) for common
7

---

Published as a conference paper at ICLR 2023
Table 2: Accuracy the common corruption benchmark. We report 95% confidence interval across different random seeds for training.
Table 3: Accuracy the background/foreground spurious correlation benchmark, with 95% CI across different random seeds.
Model
Corruption Robustness
Model
Spurious Correlation
ResNet-50
82.3 + 1.6
ResNet-50
58.6 + 4,2
Downsampled Part Model
85.5 + 0.8
Downsampled Part Model
65.1 + 0.8
Bounding-Bow Box Part Model
85.8 + 0.7
Bounding-Bov Box Part Model
65.1 + 2.1
Table 4: Accuracy on the shape-vs -iape--s-texture bias benchmark. We report 95% confi- dence interval across 10 different random seeds for training. Higher accuracy is better, suggesting that the model is less dependent on the texture features and more biased to- ward robust shape features.
Table Clean and adversarial accuracy of part-based models trained with and without the part segmentation labels compared to the ResNet-50 baseline. The im-
provement from the segmentation labels is highlighted.
Models
Seg. Labels?
Clean
Adv.
ResNet-50
N/A
74.7
37.7
No
76.9
39,6
Model
Shape-vs Textuxe
Downsampled
Yes
85.6
39.4
Part Model
ResNet-50
40.6
(t 8.7)
(4 0.2)
Downsampled Part Model Bounding- Box Part Model
44.7 + 2.6
No
78.1
39.9
45.7 + 2.7
Bounding-Box Part Model
Yes
86.5
39,2
(1 8.4)
(4 0.7)
corruptions, ImageNet-9 (Xiao et al., 2021) for forgrouudd-ss-bacgrroud spurious correlation, and Stylized ImageNet (Geirhos et al., 2019) for chape-vs-textin bias. For the common corruptions, the benchmark is composed of 15 corruption types and five severity levels. The spurious correlation benchmark is generated from a subset of foreground ("Only-FG") and background ("Only-BG-T") of ImageNet-9, filtering out classes not present in Part- Imaeeem. Each foreground image is paired with randomly chosen background image of another class. For shape-vs-texture bias, the data generated by applying styles/textures using neural style transfer.
We train ResNet-50 model and two part-based models using conventional training (not adversarial training) on clean Part-ImageNet samples. We tune the hyperparameters as described Section 3.5.3. For each benchmark, the best-performing set of hyperparameters is used train 10 randomly initialized models to compute the confidence interval.
On all of the benchmarks, the part-based models outperform the baseline by 3-7 percentage points (see Tables 2, 3, and 4). The improvement over the ResNet-50 baseline is statistically significant (two-sample t-test, p-values below 10-"). We note that these robustness gains do not come at cost of clean accuracy as the clean accuracy of our part models is about 1% higher on average than that of the ResNet-50.. This suggests that part-based models are more robust common corruptions, better disentangle foreground and background information, and have higher shape bias compared to typical convolutional neural networks.
5.2 EFFECTS OF PART SEGMENTATION LABELS VS ARCHITECTURE
Where does the robustness improvement come from? Does it come from the additional information provided by part annotations, or from the new architecture we introduce?
To answer these questions, we train bast- models on Imrt-ImageNet without using the part segmentation labels while keeping the model architecture and hyperparameters fixed (i.e., setting Towg in Eqn. zero). We found that most of the improvement comes from the additional supervision provided by part annotations. In particular, the architecture provides 2-4 percentage points of improvement over ResNet-50, while the additional supervision provides another 8-9 points of improvement in clean accuracy (see Table 5). This experiment confirms that most of the gain comes from the additional information provided by fine mee-grineed segmentation labels.
We also extend this ablation study and consider other backbone architectures. We replace ResNet-50 with EfficientNet-Be B4 and SosNeet-50-32xdd We find that the part-level supervision still improves the model's accuracy and robustness by large margin (see Appendix D.8.1 and Table 18).
8

---

Published as a conference paper at ICLR 2023
Table 6: Comparison of accuracy of part models trained using different types of auxiliary labels. The part bounding-box and centroid models are PGD adversar- ially trained. We select the part segmentation model with similar accuracy from Section 4 for comparison.
Emncregle Clecc
Part-ImageNet Cityscapes PASCAL-Paas
Types of Labels
Clean
Adv.
Clean Adv. Clean
Adv.
Segmentation
85.6
39.4
94.8 70.2
77.3
34.5
Bounding Boxes
84.1
39.7
95.4
69.1
66.2
33.5
Segmentzion
Centroids
82.6
39.7
94.0
70.9
62.9
33.5
Figure 6: Performance of the part models when only a fraction of training samples accompanied by segmentation label.
ResNet-50
74.7
37.7
79.5
68.4
54.0
29.1
5.3 TRAINING WITH FEWER PART SEGMENTATION LABELS
The main limitation of our approach the extra labeling cost to obtain part segmentation labels. We investigate how the performance of our models changes when fewer part annotations are available. We train part models with the same number of training samples and class labels but a reduced number of segmentation labels, some (10-90%) of training samples have both class and segmentation labels while the rest have only the class label. As expected, the clean accuracy degrades when the model receives less part-level supervision; see Fig. 6. Adversarial accuracy, however, remains more or less the same, and all of the part models still outperform the ResNet-50.
Given this observation, we attempt to reduce the reliance on the part segmentation labels. Surprisingly, we find that simple pseudo-labeling can reduce the required training labels down by 90%! Using labels generated by another segmentation model results in part models with almost the same accuracy and robustness as the fully-supervised models. See Appendix D.6 and Table 15 for more details.
5.4 ALTERNATIVES TO PART SEGMENTATION LABELS
We additionally explore two labeling strategies for reducing labelling costs: (1) bounding box segmentations for each part, (2) keypoints centroids for each part (Fig. 10, Appendix D.4). These annotations provide less precise spatial information about each part but are much faster to label. Bounding-box labels are nearly as effective as segmentation masks on Part-ImageNet and Cityscapes (within ~ % difference in accuracy; see Table 6). However, the difference is much larger on PASCAL-Part where the clean accuracy is 11% lower. Models trained on centroid labels perform slightly worse than the ones trained on bounding-bow -bx labels, which is unsurprising as centroids are even more coarse-grained. Nonetheless, all part models trained on any kind of part label still outperform the ResNet-50 baseline. We hope our work draws attention to the opportunity for stronger robustness through rich supervision and stimulates research into reducing the labeling cost.
We also conduct an ablation study by replacing part segmentation labels with object segmentation labels. Models trained on object segmentation labels are less effective than ones trained on part labels (Appendix D.5). Even though models trained with object-level labels outperform the baseline, this implies that part-level annotation is still important.
6 CONCLUSION
In this work, propose new approach to improve adversarial training by leveraging a richer learning signal. We materialize this concept through part-based models that are trained simultaneously on object class labels and part segmentation. Our models outperform the baseline, improving the accuracy- accuracy-robustness robustness trade-off, while also benefiting aon-adversarial robustness. This work suggests a new direction for work robustness, based richer supervision rather than larger training sets.
Herre refer to the labels provided for training. This should not be confused with the architecture of the Bounding- Box Part Model.

---

Published as a conference paper at ICLR 2023
ACKNOWLEDGEMENTS
The authors would like to thank Vikash Sehwag and Jacob Steinhardt for their feedback on the paper. We also thank the anonymous ICLR reviewers for their helpful comments and suggestions. This research was supported by the Hewlett Foundation through the Center for Long-Term Cybersecu- rity (CLTC), by the Berkeley Deep Drive project, and by generous gifts from Open Philanthropy and Google Cloud Research Credits program under Award GCP19980904 Jacob Steinhardt also generously lent us the computing resources used in this research.
REFERENCES
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: A query- efficient black-box adversarial attack via random scarch. In Andrea Vedaldi, Horst Bischof, Thomas Brox, and Jan-Michael Frahm (eds.). Computer Vision ECCV 2020, volume 12368, pp. 484-501, Cham, 2020. Springer International Publishing. ISBN 000--0000000001111999000000---00 18
doi: 00.1007977--3-00-55899
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In Jennifer Dy and Andreas Krause (eds.). Proceedings of the 35th International Conference on Machine Learning, volume 80 of Proceedings of Machine Learning Research, pp. 274-283, Stockholmsmässan, Stockholm Sweden, July 2018. PMLR.
Yutong Bai, Qing Liu, Lingxi Xie, Weichao Qiu, Yan Zheng, and Alan L Yuille. Semantic part detection via matching: Learning generalize to novel viewpoints from limited training data. In Proceedings of the JEEE/CVF International Conference on Computer Vision, pp. 7535-7545, 2019.
Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. urXiv:1902.06703 [cs, stut], February 2019. 6, 18
Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C Duchi, and Percy S Liang. Unlabeled data improves adversarial robustness. In H. Wallach, H. Larochelle, A. Beygelzimer, F. dAlché-Buc, F. Fox, and R. Garnett (eds.), Advances Neural Information Processing Systems, volume 32, Curran Associates, Inc., 2019.
Varun Chandrasekaran, Brian Tang, Nicolas Papernot, Kassem Fawaz, Somesh Jha, and Xi Wu. Rearchitecting classification frameworks for increased robustness. arXiv preprint 10.Kv::9955.00000 2019.
Jinghui Chen and Quanquan Gu. RayS: A ray searching method for hard-label adversarial attack. Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery Data Mining, pp. 1739-1747, Virtual Event CA USA, August 2020. ACM. ISBN 978-1-45033-799844 doi: 10.1 111443394486.44032222 18
Liang-Chiee Chich Chen, Yukun Zhu, George Papandreou, Florian Schroff, and Hartwig Adam. Encoder-decoder with atrous separable convolution for semantic image segmentation. In Vittorio Ferrari, Martial Hebert, Cristian Sminchisescu, and Yair Weiss (eds.). Computer Vision ECCV 2018, pp. 833 851, Cham, 2018. Springer International Publishing. ISBN 978-3-033-01124--22
Xianjie Chen and Alan Yuille. Articulated pose estimation by graphical model with image dependent pairwise relations, Proceedings of the 27th International Conference on Neural Information Processing Systems Volume 1, NIPS' 14, pp. 1734-1744 Cambridge, MA, USA, 2014. MIT Press. 2
Xianjie Chen, Roozbeh Mottaghi, Xiaohai Liu, Sanja Fidler, Raquel Urtasun, and Alan Vuille. Detect what you cam: Detecting and representing objects using holistic models and body parts. In Proceedings of the IEFE Conference on Computer Vision and Pottern Recognition (CVPR), June 2014. 1, 2, 14
Minsu Cho, Suha Kwak, Cordelia Schmid, and Jean Ponce. Unsupervised object discovery and localization in the wild: Part-based based matching with bottom-up up region proposals. In Proceedings the IEEE conference on computer vision and pattern recognition, pp. 1201 1210, 2015. 2
Marius Cordts, Mohamed Omran, Sebastian Ramos, Timo Rehfeld, Markus Enzweiler, Rodrigo Benenson, Uwe Franke, Stefan Roth. Bernt Schiele. The cityscapes dataset semantic urban scene understanding. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2016. 14
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free free attacks. In Hal Daumé III and Aarti Singh (eds.), Proceedings of the 37th International Conference on Machine Learning, volume 1 119 of Proceedings of Machine Learning Research, pp. 2206-2216. PMLR,, July 2020. 6, 15, 18
10

---

Published as a conference paper at ICLR 2023
Ian Endres, Kevin J. Shih, Johnston Jiaa, and Derek Hoiem. Learning collections of part models for object recognition. In 2013 IEEE Conference Computer Vision and Pattern Recognition, pp. 939 946, Portland, OR, USA, June 2013. IEEE. ISBN 978-0-7695-498977 7, doi: 10. 10.1109/CVPR.22 2013..220111222 2
Mark Everingham, Luc Van Gool, Christopher K. I. Williams, John M. Winn, and Andrew Zisserman. The pascal visual object classes (VOC) challenge. International Journal of Computer Vision. 88(2):303-338, 2010. 14
Pedro F Felzenszwalb, Ross B Girshick, David McAllester, and Deva Ramanan. Object detection with discrimi- natively trained part-based models. IEEE transactions on pattern analysis and machine intelligence, 32(9): 1627 1647,1645, 2010. 2
Scott Freitas, Shang- Tse Chen, Zijie J. Wang, and Duen Horng Chau. UnMask: Adversarial detection and defense through robust feature alignment. In IEEE BigDala, pp. 1081-1088, November 2020. 2
Robert Geirhos, Patricia Rubisch, Claudio Michaclis, Matthias Bethge, Felix A. Wichmann, and Wieland Brendel. ImageNet-trained cnns biased towards texture; increasing shape bias improves accuracy and robustness. In International Conference on Learning Representations. 2019. 2,8
Georgios Georgakis, Srikrishna Karanam, Ziyan Wu, and Jana Kosecka. Learning local rgb-to-cad correspon- dences for object pose estimation. In Proceedings of the IEEF/CVF International Conference on Computer Vision, pp. 8967-8976, 2019. 2
Ross Girshick, Forrest landola, Trevor Darrell, and Jitendra Malik. Deformable part models are convolutional ncural networks. Proceedings of the IEEE conference on Computer Vision and Pattern Recognition, pp. 437-446, 2015.
Georgia Gkioxari, Ross Girshick, and Jitendra Malik. Actions and attributes from wholes and parts. In Proceedings of the IEEE international conference on computer vision, pp. 2470-2478, 2015. 2
Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against coon-dounded adversarial examples. arXiv:2010.03593 fes, star), March 2021a.
Sven Gowal, Sylvestre- Sylvestre-Alvise Alvise Rebufti, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy Mann. Improving robustness using generated data. In A. Beygelzimer, Y. Dauphin, Liang, and J. Wortman Vaughan (eds.). Advances in Neural Information Processing Systems, 202 2, 20
Sidharth Gupta, Parijat Dube, and Ashish Verma. Improving the affordability of robustness training for DNNs. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR) Workshops, June 2020. 5,
He, Shuo Yang, Shaokang Yang, Adam Kortylewski, Xianding Yuan, Jie-Neng Chen, Shuai Liu, Cheng Yang. and Alan Yuille. PartImageNet: A large, high-quality dataset of parts. arXiv:2112.00933 [cs], December 2021. 5, 14
K. He, X. Zhang, S. Ren, and J. Sun. Deep residual learning for image recognition. In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 770-778, 2016. doi: 10.1 10.11099VPR.2201.9990 5.5
Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness common corruptions and perturbations. In International Conference on Learning Representations, 2019. 2,7
Dan Hendrycks, Kimin Lec, and Mantas Mazcika. Using pre-training can improve model robustness and uncertainty. In International Conference on Machine Learning, pp. 2712-2721. PMLR, 2019. 2
Lang Huang, Chao Zhang, and Hongyang Zhang. Self-adaptive training: beyond empirical risk minimization. Advonces neural information processing systems, 33:19365 11119966-11776,,,.111111 2020. 2
Jared Kaplan, Sam McCandlish, Tom Henighan, Tom B. Brown, Renjamin Chess, Rewon Child, Scott Gray, Alec Radford, Jeffrey Wu, and Dario Amodei. Scaling laws for neural language models, January 2020.
Klim Kireev, Maksym Andriushchenko, and Nicolas Flammarion. On the effectiveness of adversarial training against common corruptions. arXiv preprint arXiv:2103.02325, 2021.
Xiao Li. Ziqi Wang. Bo Zhang, Fuchun Sun, and Xiaolin Hu. Recognizing object by components with human prior knowledge enhances adversarial robustness of deep neural networks. IEEF Transactions Pattern Analysis and Machine Intelligence, pp. 1-13, 2023. doi: 10.1 109/ 2D00TPAAM.202233337995... 3
11

---

Published as a conference paper at ICLR 2023
Dominik Lorenz, Leonard Bereska, Timo Milbich, and Bjom Ommer. Unsupervised part-based disentangling of object shape and appearance. Proceedings of the IEEE/CVF Conference on Computer Vision and Pottern Recognition (CVPR), June 2019. 2
Ilya Loshchilov and Frank Hutter. SGDR: Stochastic gradient descent with warm restarts. In International Conference on Learning Representations. 2017. 15
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018. 6
Panagiotis Meletis, Xiaoxiao Wen, Chenyang Lu, Daan de Geus, and Gijs Dubbelman. Styseapes-panoptic and AASCAL-panoptic-partt datasets for scene understanding, April 2020. 1,5, 14
Tianyu Pang, Kun Xu, Chao Du Ning Chen, and Jun Zhu. Improving adversarial robustness via promoting ensemble diversity. arXiv: (eeer9901.08888 [es, stat], May 2019. 2
Chongli Qin, James Martens, Sven Gowal, Dilip Krishnan, Krishnamurthy Dvijotham, Alhussein Fawzi, Soham De, Robert Stanforth, and Pushmeet Kohli. Adversarial robustness through local linearization. Advances in Neural Information Processing Systems, 32, 2019.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and llya Sutskever. Learning transferable visual models from natural language supervision. In Marina Meila and Tong Zhang (eds.), Proceedings of the 38th International Conference Machine Learning, volume 139 of Proceedings of Machine Learning Research, pp. 8748 8763. PMLR, July 2021.
Sylvestre-Alvic Rebuffi, Sven Gowal, Dan A. Calian, Florian Stimberg, Olivia Wiles, and Timothy Mann. Fixing data augmentation to improve adversarial robustness. arXiv:2103.0194 [cs], March 2021. 1,2
Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in adversarially robust deep learning. In Hal Daumé III and Aarti Singh (eds.), Proceedings of the 37th International Conference on Machine Learning, volume 119 of Proceedings of Machine Learning Research, pp. 8093-8104. PMLR, July 2020. 2
Tao Ruan, Ting Liu, Zilong Huang, Yunchao Wei, Shikui Wei, and Yao Zhao. Devil in the details: Towards accurate single and multiple human parsing. In Proceedings of the Thirty-Third Third AAAI Conference on Artificial Intelligence and Thirty-First Innovative Applications of Artificial Intelligence Conference and Ninth AAAI Symposium Educational Advances in Artificial Inselligence, AAAI' 19/TAF 19/AA1 19, Honolulu, Hawaii, USA, 2019. AAAI Press. ISBN 978-1-57735-809-1
doi: 10. 1609/a9aa.i wtt99/aaii.33101.3333 33000.33010111114444 2
Shiori Sagawa, Pang Wei Koh, Tatsunori B. Hashimoto, and Percy Liang. Distributionally robust neural networks group shifts: On the importance of regularization for worst-case generalization. International Conference on Learning Representations, 2020. 3
Vikash Sehwag, Caner Hazirbas, Albert Gordo, Firat Ozgenel, and Cristian Canton Ferrer. Generating high fidelity data from low-density regions using diffiusion models. 2rXiv:2203.17264 [cs]. March 2022. 2
Rohan Taori, Achal Dave, Vaishaal Shankar, Nicholas Carlini, Benjamin Recht, and Ludwig Schmidt. Measuring robustness natural distribution shifts in image classification. In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin (eds.), Advances Neural Information Processing Systems, volume 33, pp. 18583- 18599. Curran Associates, Inc., 2020. 25
Dimitris Tsipras, Shibani Santurkar. Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. In International Conference on Learning Representations, 2019. 6
Eric Wong, Leslie Rice, and J. Zico Kolter. Fast is better than free: Revisiting adversarial training. In International Conference on Learning Representations, 2020. 2
Fangting Xia, Peng Wang. Xianjie Chen, and Alan I.. Yuille. Joint multi-person pose estimation and semantic part segmentation. 2017 IEFE Conference on Computer Vision and Pattern Recognition (CVPR), pp- 6080-6089, 2017. doi: 10.11099CVPR.22017.644 2
Kai Yuanqing Xiao, Logan Engstrom, Andrew Ilyas, and Aleksander Madry. Noise or signal: The role of image backgrounds in object recognition. In International Conference Learning Representations, 2021. 2, 3,
Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. Adversarial examples for semantic segmentation and object detection. arXiv: 3oXY:/703.0860) [cs], July 2017. 20
12

---

Published as a conference paper at ICLR 2023
Cihang Xie, Yuxin Wu, Laurens Van Der Maaten, Alan L. Yuille, and Kaiming He. Feature denoising for improving adversarial robustness. Proceedings the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, 2019-Junc:301-500 2019. ISSN 9781728132938. doi: N0.1109CVPR.2201.00000 2
Hongyang Zhang, Yandong Yu, Jiantao Jiao, Eric Xing, Laurent Ghaoui, and Michael Jordan. The- orctically principled trade-off between robustness and accuracy. In International Conference on Machine Learning, 2019. 2, 6
Zhishuai Zhang, Cihang Xie, Jianyu Wang. Lingxi Xie, and Alan L Yuille. Deepvoting: A robust and explainable deep network for semantic part detection under partial occlusion. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1372-1380, 2018. 2
13

---

Published as a conference paper at ICLR 2023
A DATASETS
Part-ImageNet. Proposed by He et al. (2021). this dataset a subset of ImageNet-IK where the 158 of the original classes are grouped into 11 -oarse-grained classes, e.g., "Quadruped." "Biped," "Reptile," etc. Each object is accompanied by pixel-wise annotation of 2-5 parts. For instance, a quadruped may have up to four segmentation masks for its head, body, feet, and tail. The dataset is originally proposed for part segmentation or part discovery tasks and is publicly available to download." We note that the Part-ImageNet dataset splits the data by their original ImageNet- - classes, i.c. 109, 19, and 30 classes for training. validation, and test sets, respectively. This allows one to measure generalization across sub- uub-poulatiion under the same group. However, our focus is different; we want to evaluate the robustness under a similar setting to CIFAR-10 whose samples are split i.i.d. Hence, for this paper, we ignore the original ImageNet class and re- partition the dataset randomly, independent of its original class. The Part- Part-ImageNet dataset has 24,095 samples in total.
Cityscapes. The Cityscapes dataset is a driving-oriented image dataset whose data were collected from a dashboard camera (Cordts et al., 2016). We use the part-aware panoptic annotations on Cityscapes from Meletis et al. (2020) to create our classification dataset. The Cityscapes dataset is available under a non-commercial license", and the annotation is available under Apache-2.0. Five kinds of objects are part-annotated, and we group them into two classes. Specifically, "person" and "rider" are grouped as "human," and "car," " "truck," and "bus" as "vehicle." " We use the same part labels as Meletis et al. (2020) where humans are annotated with "torso," "head," " "arms," and "legs," and vehicles with "windows," "wheels," "lights," "license plate," and "chassis."
Since the samples in Cityscapes are aide-angle photos containing numerous objects, we crop each annotated object out to create a classification dataset. In particular, we crop each patch into square and then add small amount of extra random padding (0-10% of the image size). Additionally, we also filter out small objects that have the total area, determined from the segmentation mask of the entire object, less than 1000 pixels. After filtering, we are left with 29,728 samples in the dataset.
The PASCAL-Part dataset (Chen et al., 2014) provides part-aware segmentation annotation of the PASCAL VOC (2010) dataset (Everingham al., 2010) which an object recognition and detection dataset. Both the annotations and the original dataset are available to the public. The original PASCAL-Part dataset comprises 20 classes, but most of them have 500 or fewer samples. To ensure that we have a sufficient number of samples per class and avoid the class imbalance problem, we opt to select only the top-five most common classes: "aaeropanne"" "bird," "car," "cat," and "dog." In PASCAL-Part, the parts are annotated in a more fine- tuee-griied manner, compared to the other two datasets. For example, the legs of dog are labeled as front or back and left or right. To make the number of parts per object manageable and comparable to the other two datasets, we group multiple parts of the same type together, e.g., all legs are labeled as "legs." Our PASCAL-Part dataset has 3,662 samples in total.
PASCAL-Part.
We also emphasize that we do not use a common benchmark dataset such as CIFAR- 10 since it is not part-annotated and is too low-resolution be useful in practice. The datasets we use are more realistic and have much higher resolution. For training and testing the models, we use the same preprocessing and data augmentation as commonly used for the ImageNet dataset. Specifically, the training samples are randomly cropped and resized to 224 x 224 pixels, using PyTorch's 's RandomRes i zedCrop function with the default hyperparameters, and applied a random horizontal flip. Test and validation samples are center cropped to 256 x 256 pixels and then resize to 224 x 224 pixels.
Pnttps://githini http:///tcoottttc/otaaaaaa http:///hh.attaooooooaocaaaaaaae
'For the Cityscape dataset, http:://ww..ccyyooseseeeeeeeee com/, and for the annota- tion. http://www..yappeeaaaattttt..tea
httpa//ttttt///oo....oooooooo.o. voc2010/, and for PASCAL-PPart see htt http:pppaaaalpppppssssasclllllla -parts. html.
'PASCAL VOC and its license can be at
14

---

Published as a conference paper at ICLR 2023
B DETAILED EXPERIMENT SETUP
Here, we provide information regarding the model implementation in addition to Section 3.5, All models are adversarially trained for 50 epochs. To help the training converge faster, we also pre-train every model on clean data for 50 epochs before tuning on adversarial training as suggested by Gupta al. (2020). We save the weights with the highest accuracy on the held-out validation data which does not overlap with the training or the test set. We use the cosine annealing schedule to adjust the learning rate as done in Loshchilov Hutter (2017). Our experiments are conducted on Nvidia GeForce RTX 2080 TI and V100 GPUs.
To evaluate all the models, we rely on both the strong ensemble AutoAttack and the popular PGD attack. However, the AutoAttack is always stronger than the PGD attack in all of the cases experiment with so we only report the adversarial accuracy corresponding to the AutoAttack in the main paper. Auto/ttack comprises four different attacks: adaptive PGD with cross-entropy loss (apgd-ce), targeted adaptive PGD with DLR loss (apgd-t), targeted FAB attack (fab-t), and Square attack (square) re) (Croce & Hein, 2020). However, since the DLR loss requires that there are four or more classes, we have to adapt the AutoAttack on the Cityscapes dataset which has two classes. As result, PGD with cross-entropy loss (apgd-ce), FAB attack (fab), and Square attack (square). We use the default hyperparameters for all of the attacks AutoAttack. For the PGD attack, we use step size of 0.001 with 100 iterations and five random restarts.
only three attacks and remove the targeted ones which leave adaptive
C DESCRIPTIONS AND RESULTS ON THE REMAINING CLASSIFIER ARCHITECTURE
C.I TWO-HEADED PART MODEL.
Input Images
r 1 Dense Representation
+
Part Segmenter
-
-
"Dog"
(Desplabbee w! RN-50 buckbons)
Predicted Segmentation
Classifier
Figure 7: Diagram of the two-headed part model.
The two-headed part model uses similar architecture to multi-task models with multiple heads. Here, there are two heads, one for segmentation and one for classification, sharing the same dense representation from the bottleneck layer of DeepLaby3+, as illustrated by Fig. 7. It is important to note that the two-headed part model does not explicitly use the predicted segmentation masks in classification. Instead, the classifier only sees the dense representation that will later be turned into the segmentation mask by the remaining layers of the segmenter. From an information-theoreticc standpoint, the classifier of the two-headed part model should receive equal or information than the classifier the bounding box or the downsampled part model. The difference is that this information is represented as dense vectors the two-headed part model. However, the other two models, the information is more numan-interpretabb and more compressed.
C.2 PIXEL PART MODEL.
The pixel part model is arguably the simplest among all of our part-based models. does not use small neural network classifier and involves only two simple steps. First, for each pixel, it sums together the part logits belonging to the same object class. In other words, the part segmentation mask is turned into the object segmentation mask, i.c., [X the numbers of parts and classes, respectively. Then, the object scores averaged across all pixels in the segmentation mask to obtain the final class logits. This model is summarized Fig. It is also possible to treat the pixel part model specific of the downsampled where the
C xW where K and C
15

---

Published as a conference paper at ICLR 2023
Input Images
Part Segmenter
"Dog"
(Deepl albepl.abv3++ wi RN-50 backkoons)
Averige
Class Logits
Prodicted Segmentation Mask
Figure 8: Diagram of the pixel part model.
Table 7: Clean and adversarial accuracy of the ResNet-50 baseline obtained over our hyperparameter sweep Part-ImageNet.
Training Method
Learning Rate
Weight Decay
TRADES 3
Clean
AutoAttack
PGD
Normal
0.1
5 x 10
N/A
92.9
0.0
0.0
5 10
N/A
74.7
37.7
43.3
0.1
x 10
N/A
69.2
36.5
40.7
PGD
5 x 10
N/A
76.4
36.6
42.2
0.05
1 x 10
N/A
74.8
34.4
40.3
5 10
N/A
73.0
33.6
39.6
0.02
x 10
N/A
70.5
32.0
37.6
0.05
91.6
1.2
0.1
90.6
7.7
10.3
0.15
89.6
13.0
16.0
0.2
88.7
18.2
21.5
0.3
87.9
22.9
26.0
86.6
25.0
28.5
TRADES
0.1
5 x 10
0.5
85.7
27.1
29.8
0.6
85.4
27.5
31.5
0.7
84.7
29.0
32.2
84.0
29.0
0.9
83.8
30.6
34,2
1.0
83.4
31.2
35.1
2.0
74.4
30.5
34,9
convolution layer with kernel size of 1 x 1 mimics the first step, and the classifier represents the average function in the second.
Importantly, averaging the logits across pixels means that the spatial information is ignored completely the classification process. This eventually results in minor reduction in the accuracy compared to the downsampled or the bounding- box model as shown in Appendix D.9 and Table 19, We do not recommend this model in practice, and it partially serves as an ablation study in our work.
D ADDITIONAL ROBUSTNESS RESULTS
D.1 HYPERPARAMETER SWEEP RESULTS
this section, we include detailed results from our hyperparameter sweep on the ResNet-50 baseline (Table 7), the downsampled (Table 8), and the bounding-box part models (Table 9). The results suggest that all of the adversarially trained models are, to some degree, sensitive to the training hyperparameters, e.g., learning rate and weight decay. Nevertheless, the best setting is rather consistent across most of the models as well as the datasets, i.e., learning rate of 0.1 and weight decay of 5 10-1
16

---

Published as a conference paper at ICLR 2023
Table 8: Clean and adversarial accuracy the downsampled part models obtained over our hyperpa- rameter sweep Part-ImageNet.
Training Method
Learning Rate
Weight Decay
TRADES 8
Clean
AutoAttack
PGD
Normal
0.1
5 x 10-4
0.5
N/A
95.2
0.0
0.0
5 10
0.5
N/A
83.9
39.9
45.3
1 10-4
0.5
N/A
79.1
39.6
45.8
PGD
5 10
0.5
N/A
85.1
38.8
44.7
0.05
1 x 10
0.5
N/A
82.3
37.5
43.7
5 10
0.5
N/A
80.4
36.9
43,4
0.02
1 10-4
0.5
N/A
82.3
35.1
42.4
0.05
90.9
19.8
23.8
90.0
25.8
29.5
0.2
89.6
30.6
34.7
0.3
88.7
33.0
37.5
TRADES
0.1
5 x 10
0.5
0.4
88.4
33.7
37.7
0.5
87.7
35.7
40.0
0.8
85.3
37.2
41.2
1.0
83.4
38.0
42.2
Table 9: Clean and adversarial accuracy of the bounding-bor box part models obtained over hyperpa- rameter sweep on Imateem
Training Method
Learning Rate
Weight Decay
Cong
TRADES 3
Clean
AutoAttack
PGD
Normal
5 10
0.5
95.4
0.0
0.0
5 10
0.5
83.1
37.0
43.7
0.1
1 10
0.5
N/A
84.4
39.5
45.2
PGD
5 10
0.5
N/A
86.2
37.7
43.6
0.05
10
0.5
83.1
37.5
43.2
5 10-4
0.5
N/A
84.1
36.0
42.3
0.02
1 x 10
0.5
N/A
81.6
37.1
43.3
0.05
91.8
16.7
19.4
0.1
90.8
24.1
27.5
0.2
89.8
29.7
33.5
0.3
89.6
32.5
36.2
TRADES
0.1
5 x 10
0.5
0.4
89.2
38.0
38.0
0.5
87.8
35.3
39.3
0.6
87.9
36.1
40.1
0.8
86.1
37.4
41.5
1.0
85.3
39.0
43.0
D.2 EFFECTS THE Cseg HYPERPARAMETER
To test the effect of the segmentation loss, we train multiple part-based models with Cseg varied from to With Gseg closer to the loss function prioritizes the pixel-wise segmentation accuracy. With Cseg closer to 0, less emphasis is put on the accuracy of segmentation masks. Fig. 9 shows accuracy with respect to different Cseg values for both downsampled and bounding- models. It is, however, inconclusive whether the smaller or the larger value of Gseg is most preferable in this case. There vague trend that larger Geeg improves the clean accuracy but reduces the adversarial accuracy, exhibiting some form of trade-off. This overall trend can be explained by the fact that smaller Cseg places more weight on the adversarial classification loss and hence, improves the robustness.
part
17

---

Published as a conference paper at ICLR 2023
0.5
Adversarial Accuracy (e 3/255)
40.00
0.0
39.75
0.0
0.6
39.50
0.4
0
39.25
0.1
0.70.8
0.2
0.5
39.00
38.75
0.7
38.50
Bounding Box Part Model
Downsampled
0.8
78
80
82
84
86
Clean Accuracy
Figure 9: Clean and adversarial accuracy of the downsampled (orange) and the bounding-box (green) part models trained Part-ImageNer. The number the top right of each data point indicates the value of Cseg that model trained with. All models are trained with a learning rate of 0.1 and weight decay of 5 x 10-4
Table 10: Adversarial accuracy of our part- part-based models at different values of This table shows that the adversarial accuracy does reach zero becomes larger which confirms that our part models are unlikely to experience the gradient obfuscation.
Adversarial Accuracy
Datasets
Part-Based Models
8/255
16/255
24/255
32/255
Downsampled
39.4
13.6
3.5
Part-ImageNet
Bounding-Bil Box
39.2
12.6
3.9
1.7
Downsampled
0.4
Cityscapes
Bounding-Boo -ox
69.9
16.6
0.9
0.0
Downsampled
38.5
PASCAL-Part
Bounding-Boo
38.5
20.1
4.3
0.7
D.3
OPTIMALITY OF THE ATTACKS
Gradient Obfuscation. We do not believe our models suffer from gradient obfuscation. First, our models do use any con-differentiable operations or randomization; they use only standard neural network layers.
Second, conduct sanity check suggested by Carlini al. (2019) by making sure that simple PGD attack can reduce the accuracy close to zero when the perturbation norm increases. Our new experiment, reported in Table 10, confirms this the adversarial accuracy of our part-based models does drop to 2% at 32/255.
Third, we have also experimented with decision-based based black-box attacks that do not rely on gradient information. We use AutoAttack (Croce & Hein, 2020), which incorporates Square Attack (An- driushchenko et al., 2020) which does not rely on gradients and only uses the output scores. We also use the Mate-offthh-aan -atakk,,,, RayS (Chen & Gu, 2020), to evaluate model on the Part-ImageNet dataset. RayS manages to reduce the accuracy to 71.0 (at 10k steps), which is still much higher than that achieved by the PGD attack and Auto/ttack (45.4 and 39.4). This confirms that the non- conggiadient attacks are not better than the gradient- based ones, suggesting that there is no gradient obfuscation problem.
Downsampled part
Single-staged attack. We have experimented with multiple ways to attack the part models, including attempts to fool the segmenter using both losses in the attack objective. However, these alternatives
18

---

Published as a conference paper at ICLR 2023
Table 11:
Effects of the Gzeg parameter in the loss function of PGD attack on the Downsample part model trained on Part-ImageNet. We emphasize that this is the value of Gzog used during the evaluation attack, not during adversarial training.
Values of Cang in PGD Attack
PGD Accuracy
(normal PGD)
45.4
0.1
45.9
48.0
0,5
50.4
0.7
53.7
0.9
57.5
Table 12: Adversarial accuracy measured by the two-staged attack on our part-based models compared PGD and AutoAttack (AA). "MC" denotes the most-confident strategies.
Adversarial Accuracy
Datasets
Part-Based Models
PGD
AA
Untargeted
Random
MC (Random)
MC
(Sorted)
Downsampled
45.4
39.4
45.1
44.0
47.5
47.5
Part Hart-ImaeeNet
Bounding-Box
45.7
39.2
45.3
43.3
47.3
53.4
Downsampled
73.8
70.2
75.4
75.5
75.4
75.5
Cityscapes
Bounding-Boo
73.4
69.9
74.7
74.8
74.7
74.6
Downsampled
40.6
38.5
40.3
39.9
44.6
44.6
PASCAL-Part
Bounding Box
40.6
38.5
40.6
41.0
43.9
43.2
actually decrease the attack success rate. In experiments, using only classification loss always yields the strongest attack.
In particular, consider PGD attack with objective that is linear combination of the classification loss and the segmentation loss, i.e., L = (1 Gseg Lett + Eseg-seee as in Eqn. 7. Table 11 reports the adversarial accuracy under this attack with varying values of Cseg- This shows that using the segmentation loss does not improve the attack. In fact, a larger Cang (more weight on the segmentation loss) actually results in worse attack.
Two-staged attack. Since we previously found that optimizing over both losses at same time results in worse attack, we separate the attack into two stages and make sure that the second stage only optimizes over the classification loss. The difference now lies in the first stage which we use to generate "guiddig sample" initialize the second attack by focusing fooling the segmenter first. experiment with four strategics for the first-stage attack:
Untargeted: Maximize the loss of the segmenter directly with an untargeted PGD.
2. Random: Pick random target mask from random incorrect class and run PGD to fool the segmenter into predicting this target mask.
3. Most-confident (random): Similar to the random strategy, but instead of sampling from a random class, only sample target masks from the most-confident class predicted by the part model, excluding the ground-truth class.
4. Most-confident (sorted): Similar to the most-confident (random) strategy, but instead of randomly choosing the masks, we run each mask the test set through the classifier and choose the ones that the model assigns the highest score/confidence to the target class.
We note that similarly to PGD, repeat all the two-staged attacks five times with different random seeds and select only the best out five. This means that the first stage the attacks uses five different target masks, apart from the untargeted strategy, and produces five different initialization points. Table 12 demonstrates that the two-staged attacks are about as effective as the normal PGD. The untargeted and the random strategies usually perform the best and can be slightly (~1%% lower
19

---

Published as a conference paper at ICLR 2023
Table 13: Comparison of the clean and the adversarial accuracies of the part models with and without adversarial training.
Models
Adv. Train
Class Adv. Acc.
Seg. Adv. Acc.
N
34.9
9.6
Downsampled part model
Y
60.9
62.6
N
30.5
7.8
Bounding- Baaading-BBxuaoe part model
Y
64.4
65.5
adversarial accuracy) better than the normal PGD attack. Nevertheless, no attack beats AutoAttack in any setting. This suggests that it is likely sufficient to use the AutoAttack alone for evaluation.
Why is this attack ineffective when Xie et al. (2017) have shown that it is possible to attack segmentation and detection models? The answer to this lies in the fact that our segmenter has been adversarially trained (end-to-end together with the classifier) whereas the models used in Xie et al. (2017) are only normally trained. To confirm this, run PGD attacks the segmenter part of our part models. Table 13 shows that without adversarial training, it is easy to attack the part model and reduce the segmentation accuracy to under 10% (the right-most column). This is in line with Xie et al. (2017). On the other hand, once adversarial training is used, we have a much more robust segmenter with over 60% adversarial accuracy. Since our segmenter robust, the part model as a whole is also robust.
D.4 CHEAPER FORMS OF AUXILIARY LABELS
The main limitation of approach is the need for part segmentation labels. Our primary goal in this paper is to demonstrate that is possible to achieve significant improvements in robust accuracy using additional supervision. This result is particularly important since progress in the field has somewhat stagnated, and recent improvements through more training samples show diminishing returns (Gowal al., 2021b). is an open question whether the most cost-effective way gain robustness is with more training samples or with richer supervision; our paper provides evidence for the first time that richer (segmentation-like findings will stimulate follow-on research that explores how to achieve these benefits as cheaply as possible. That said, we have tried a few approaches to reduce the labeling cost as already mentioned in Section 5.4. Here, we expand on the experiments that use the hounding-bow labels and the centroid labels.
labels might cost-effective route stronger robustness. We hope our
Bounding-hox labels. The part bounding boxes are generated directly from the part segmentation by drawing tight box around all the pixels that belong to each part. Fig. 10 provides examples of the bounding box labels from the Part-ImageNet dataset. We want to keep the segmenter unchanged we train the Downsampled part models with unmodified Lyeg. as described in Eqn. 7, on the new bounding-bel box labels. We note that our bounding-bue labels are still pixel-wiss masks unlike the typical bounding boxes used in the object detection task. In practice, is likely more efficient to replace the segmenter with an object detection model that outputs bounding boxes directly.
Centroid labels. Similarly to the bounding boxes, the centroid labels are also directly derived from the segmentation mask. We go through the same calculation in Eqn. generate the centroids from the ground-trutt instead of predicted, segmentation masks. Here, we train the bounding box part model on the centroid labels, but instead of calculating the segmentation loss, we compute the loss directly on the dense features excluding the standard deviations. More precisely, the loss function, Treens can be written as follows:
K
Lren
((n)))))))))) - (M + + ((= (Ma))
(12)
K
1=1
ENEO Eイ=1 HxW
feeg(z)
+ LCE
EC Eneo E fseg(x) 11
(13)
20

---

Published as a conference paper at ICLR 2023
Original Images Part-ImageNet
Original Lixel-Level Segmentation
Segmentation
Keypoint/Centroid Segmentation
Figure 10: Random examples of part bounding- labels and centroid labels used in the experiment in Section 5.4.
Table 14: Clean and adversarial accuracy of the downsampled part models trained with object-level segmentation labels instead of part-level. The model adversarially trained (PGD) on Part- meteeetteeet with different values of Coeg. The adversarial accuracy is computed by AutoAttack and PGD attack.
Models
Gseg
Clean Accuracy
AutoAttack Accuracy
PGD Accuracy
Downsampled Part Model (Best)
85.6
39.4
45.4
83.55
39.2
0.3
81.3
37.9
44.2
Downsampled Part Model
0.5
82.8
39.3
45.5
w/ Object Segmentation
0.7
81.6
38.0
45.1
82.0
37.9
The first term is the mean squared errоr the predicted centroids and the ground truth. The second ensures that the segmenter predicts masks of the correct class. For this, we use the cross-entropy loss with the logits being the sum of pixel-wise predictions across all parts of each object class.
D.5 PART SEGMENTATION OBJECT SEGMENTATION
We conduct ablation study to test whether the part-level annotation is necessary to improve the adversarial training. Can it be substituted with an object-level annotation which is cheaper to label? To answer this question, we train downsampled "part" models using the object-segmentttiion labels instead of the lert-level annotation. Table 14 clearly indicates that the models trained on the object-level annotation achieve lower clean and adversarial accuracy compared ones trained the
21

---

Published as a conference paper at ICLR 2023
Table 15: simple semi-supervised technique (pseudo-labeling) can almost completely replace the full supervision needed for the part segmentation labels.
Models
Num. Train Samples
Num. Seg. Labels
Clean Acc.
Adv. Acc.
20K
None
74.7
37.7
ResNet-50 (baseline)
20K
(GT)
78.7
38.9
Downsampled part model
20K
2K (GT) + 18K (pseudo)
84.9
39.8
20K
20K (GT)
85.6
39.4
ResNet-50 (baseline)
40K
None
77.7
41.9
Downsampled part model
40K
2K (GT) + 38K (pseudo)
87.1
44.5
Table 16: Accuracy the three generalized robustness benchmarks comparing the Downsampled part models with and without the background channel.
Models
Common Corruptions
Background--s--Prrgroonm
Shape-vs-Texture
ResNet-50
82.3 = 1.6
58.6 + 4.2
40.6 + 1.8
Downsampled Part Models (w/ Background)
85.5 = 0.8
+
44.7 +: 2.6
Downsampled Part Models (w/o Background)
85.5 = 1.8
64.2 + 2.2
45.1 + 2.3
part-level annotation. This experiment suggests that training with object segmentation does improve adversarial training compared to the baseline, but using part segmentation can achieve even better results. Intuitively, the part annotation is more fine-grained and contains more information than the object one. So it likely that stronger learning signals lead to higher robustness.
D.6 EXTENDED EXPERIMENTS ON TRAINING WITH FEWER PART SEGMENTATION LABELS
In this section, we attempt to further reduce the labeling costs, using semi-supervised learning. We show that using only 10% of all the segmentation labels (-2K samples) yields model almost as good as the one using all the labels. Specifically, we first train part segmentation model on those 10% of images (-2K images 175 per class) and use that model to generate pseudo-labels (predicted segmentation masks) on the remaining 90% images. Then, we combine these pseudo-labed and the ground-He tround-truth labels to train as well as the one trained with segmentation labels for 100% of training images (3rd vs 4th row or 84.9% 99% clean/robust accuracy 85.6% 39) and performs significantly better than model trained with no segmentation labels (3rd vs 1st row or 84, 1e..9%%/999999 9.% vs 74.7%
part model. As shown in Table 15, this model performs about
Next, test scaling, we double the training set size (from 20K 40K) of PartImageNet by drawing additional samples from ImageNet, with class labels but no additional segmentation labels. The two bottom rows of Table 15 compares our part model to the baseline where model trained with this extra data but no segmentation labels. It shows that our part model scales well with more training data: benefits from extra training data similarly to the normal model and still outperforms it by large margin (10% clean and 3% adversarial accuracy). Here, the effective number of part segmentation labels is only 5% of all training samples (2K of 40K).
D.7 EFFECTS OF BACKGROUND REMOVAL
We repeat the same experiments, measuring both adversarial and generalized robustness, on the Downsampled part models that remove the background. Specifically, drop the background channel of the predicted segmentation mask by the segmenter before passing it to the second-stage classifier.
In summary, results show that whether the predicted background channel is included or not has little effect on the accuracy. The model without background has 0.8% lower clean accuracy and the same adversarial accuracy the with the background channel. The result the generalized robustness benchmarks in Table 16 also portrays a similar story: the Downsampled part models with and without the background perform similarly (within margins of error) but still clearly better
22

---

Published as a conference paper at ICLR 2023
Table 17: Clean and adversarial accuracy of the downsampled part models trained on Part-ImageNet with different values of downsampling output sizes. All of the models here are trained with learning rate of 0.1, weight decay of 5 10-4, and Gzeg of 0.5. The adversarial accuracy is computed by AutoAttack and PGD attacks.
Downsampling Output Sizes
Clean Accuracy
AutoAttack Accuracy
PGD Accuracy
1
83,9
39.9
45.9
2 2
84,0
39.4
45.5
4 4
83.9
39.9
45.3
8 8
83.0
39.5
45.9
32 x 32
38.7
45.4
128 x 128
84.3
40.0
45.7
Table 18: Clean and adversarial accuracy of the part model variants trained on Part- Part- Bart-ImaeeNet with different backbone architectures.
Backbone Arch.
Models
Clean Acc.
Adv. Acc.
Baseline Part Model
83.1
37.1
EfficientNet B4
88.4
41.4
Baseline
77.4
36.9
ResNeXt-50 32x4d
Part Model
86.4
39.6
than ResNet-50. This experiment suggests that the second-stage classifier can learn to ignore the background pixels automatically. So there no clear benefit to dropping them.
D.8 EFFECTS THE DOWNSAMPLED SIZE
Table 17 shows the performance of the downsampled part model when the output size of the pooling layer changes. Across all the sizes from to 128, both the clean and the adversarial accuracy barely change; the gap between the largest and the smallest numbers is under 1.3 percentage points. This suggests that the performance downsampling output size. We the downsampling size of x throughout this paper, but almost any other number can be used since the difference is not significant.
the downsampled part model insensitive to the choice of the
D.8.1 EFFECTS OF THE BACKBONE ARCHITECTURE
We train both the baseline and part models with two additional backbone architectures with similar size to ResNet-50 (EfficientNet- B4 and ResNeXt-50-333 50x4ddd)). We find that our part model consistently improves over the baseline across all architectures (5-9% % increase in clean and 3-4% in adversarial accuracy).
D.9 ADVERSARIAL ROBUSTNESS RESULTS THE REMAINING PART MODELS
In this section, we include the robustness results on the other two part-based models omit from the main text, i.e., the two-headed and the pixel part models. report the accuracy of the models trained with five different values of Cseg for completeness and for displaying minor trade-off between the clean and the adversarial accuracy. However, comparing the best models alone would be sufficient.
Table 19 suggests that the two-headed part models perform similarly to the downsampled variant and slightly worse than the bounding- box one when all of them are adversarially trained with PGD. On the other hand, the pixel part models have consistently lower accuracy than the other part models by roughly 1 1-2 percentage points. This result confirms our hypothesis on the importance of the spatial information mentioned in Section 3.1 well as Appendix C.2.
23

---

Published as a conference paper at ICLR 2023
Table 19: Clean and adversarial accuracy of the part model variants adversarially trained (PGD) on Part-Iman Fart-ImageNet with different values of Caeg. The adversarial accuracy is computed by Auto/ttack and PGD attack = 8/255). For comparison, we add the first two rows for the two best part models we reported in the main paper. The highest accuracy in each column of each model is bold.
Models
Gseg
Clean Accuracy
AutoAttack Accuracy
PGD Accuracy
Downsampled Part Model (Best)
85.6
39.4
45.4
Bounding-Boo Box Part Model (Best)
86.5
39.2
45.7
0.1
86.1
38.9
44.7
0.3
84.6
38.2
44.5
Two-Headed Part Model
0.5
85.4
39.2
44.6
0.7
38.9
44.7
0.9
85.7
39.4
44,9
84.5
45.4
0.3
83.0
38.5
45.1
Pixel Part Model
0.5
83.1
37.8
45.0
0.7
83.3
39.7
46.0
0.9
84.3
39.6
45.5
Table 20: Clean and adversarial accuracy of the downsampled part models with concatenated input images (see Appendix D.1 The model adversarially trained (PGD) with different values of Czeg on Part-ImageNee The adversarial accuracy is computed by AutoAttack and PGD attack (c 8/255).
Models
Cseg
Clean Accuracy
AutoAttack Accuracy
PGD Accuracy
Downsampled Part Model (Best)
85.6
39.4
45.4
82.2
37.7
0.3
82.6
38.7
45.0
Downsampled Part Model
0.5
79.9
38.7
44.8
w/ Concat. Input
0.7
76.9
39.1
45.3
0.9
72.7
39.5
44.1
D.10 FEEDING INPUT IMAGES TO THE PART MODEL
In Section 3.1, we suggest that the classifier stage of the part models should not see the input image directly. We hypothesize that doing so opens up an opportunity for the attacker to bypass the more robust segmenter and influence the small and less robust classifier. This essentially defeats the purpose of the segmentation and the part model overall. However, there also a counterargument to this hypothesis. In theory, if the model is fed with both the image and the predicted segmentation mask, it strictly receives more information. When adversarially trained, the model can then learn to ignore the image if it is deemed non-robust. Hence, this model should be strietly better at least the same as the one that sees only the segmentation mask.
To find out which hypothesis holds, create variant of the downsampled part model by concate- nating the input image to the predicted segmentation mask before being fed to the classifier stage. We then compare this model to the original downsampled part model. The empirical results support hypothesis. Table 20 shows that this input-concatenated downsampled part model performs slightly worse compared the original version. We leave it to future work unveil the underlying reasons that make the model less robust when more information is presented to it.
D.11 DETAILED RESULTS ON GENERALIZED ROBUSTNESS
We also evaluate adversarially trriaaddlly-triineed models on the generalized robustness datasets, in addition to the normally trained ones reported Section 5. Fig. 11 shows the robust accuracy" on the three benchmarks with respect to the clean accuracy of the models. The number next each data point
'In this section, will refer the accuracy the generalized robustness benchmarks as the robust accuracy. On the other hand, the adversarial accuracy still denotes the accuracy under adversarial attacks.
24

---

Published as a conference paper at ICLR 2023
Table 21: Comparisons of the models on their generalized robustness. Higher is better. For each of the model types, we report two models, (A) and (B), trained with different set of hyperparameters. Model (A) is the one with the highest accuracy on the shape-vs- eeaeeue-- benchmark, and model (B) the one with the highest accuracy on both the spurious correlation and the common corruption benchmarks. All models are trained on Part-lmageNet without adversarial training.
Models
Shape-vs- Textuur Bias
Spurious Correlation
Comupttin Robustness
ResNet-50 (A)
40.6 + 1.8
57.7 + 2.0 58.6 4.2
81.5 +: 1.2 82.3
ResNet-50 (B)
40.5 = 1.9
Downsampled Part Model (A)
44.7 + 2.6
62.9 2.1
84.3 0.4
Downsampled Part Model (B)
43.4 2.1
65.1 + 0.8
85.5 +
Bounding- Box Part Model (A)
45.7 2.7
60.0 + 2.0
82.0 1.1
Bounding Box Part Model (B)
44.4 3.2
65.1 + 2.1
85.8 + 0.7
Table 22: Accuracy for each corruption type from the common corruption benchmark, averaged across 10 random seeds during training. The highest number on each row is bold.
Corruption Type
ResNet-50
Downsampled Part Model
Bounding Box Part Model
Gaussian Noise
82.3
84.3
Shot Noise
82.4
84.1
84.5
Impluse Noise
80.8
83.6
84.2
Defocus Blur
81.7
86.1
86.3
Glass Blur
80.3
84.0
83.5
Motion Blur
79.1
83,5
83.5
Zoom Blur
67.4
70.1
70.8
Snow
75.1
80.1
80.7
Frost
78.8
83.4
83.6
Fog
86.7
90.5
Brightness
94.4
96.2
96.4
Contrast
71.0
74.5
75.2
Elastic Transform
88.2
92.3
92.4
Pixclate
92.6
94.6
94.8
JPEG Compression
93.4
95.1
95.2
represents the adversarial accuracy, and due to the (adversarial) robustness- -assstress-acuracyy trade-off, the points the top right corner generally have higher clean accuracy but lower adversarial accuracy.
is clear that there is a strong correlation between the clean accuracy and the robust accuracy on all three benchmarks. A similar trend is also observed in Taori et al. (2020). In contrast, do not find that adversarial training improves the common corruption robustness, spurious correlation robustness, shape bias. Nonetheless, emphasize that the part models still outperform the ResNet-50 at almost all levels of clean accuracy across all types of robustness studied.
Table 21 depicts the full results of the generalized robustness evaluations the part-based models and the baseline. As mentioned in Section 5.1, we conduct hyperparameter search in order to find the best model for each of the benchmarks we on. In this section, report the robust accuracy of these models on all the benchmarks, not only the one that they perform the best in. Generally, we would have three rows per model architecture, one per dataset. However, interestingly, the best-performing models on the spurious correlation benchmark and the best- pest-performing models on the corruption robustness benchmark are coincidentally the same models, i.e., model (B) in Table 21. bias benchmark. This
On the other hand, the models (A) only the best in the shape-vs-textee trend is consistent on the ResNet-50 as well as our part models. This phenomenon could be some sort of trade-off behavior. However, more experiments
needed make further conclusions.
Table 22 shows a breakdown the corruption robustness accuracy for each corruption type. This result confirms that the two part-based models outperform the ResNet-50 baseline on all corruption types, not only the mean. The bounding-bow box part model also achieves very slightly higher robust accuracy than the downsampled across most of the corruption types.
25

---

Published as a conference paper at ICLR 2023
Corruption Robustness Dataset Accuracy
Spurious Correlation Datasct Accuracy
50
72
ResNet-S0
ReaNet-30
Downsampled Part Model
49
Downsumpled Part Model
70
48
1822
68
47
36.4
7.7
46
66
18.2
45
44
43
62
42
80
82
84
86
88
80
82
84
90
Clean Accuracy
Clean Accuracy
(a) Common Corruptions
(h) Spurious Correlation
47
ShapeV VTexiure Datusel Accuracy
ResNet-50
46-
Downsampled Part Model
45
31.5
30,0
13.4
44
$5.7
43
42
41
39
80
82
84
86
88
90
Clean Accuracy
(c) Shape vs Texture Bias
Figure 11: Plots of the robust accuracy each of the three generalized robustness benchmark with respect to the clean accuracy. Each data point represents one adversarially trained model. The number next each point is the adversarial accuracy (AutoAttack, e 8/255). Generally, in the region where the clean accuracy is high, the part-based models outperform the ResNet-50 baseline on all accuracy metrics.
D.12 ADDITIONAL VISUALIZATION OF THE PART MODELS
We provide additional visualization of the outputs of our part-based models on all three datasets. Fig. shows a similar visualization Fig. 5 but for the downsampled part model. The same visualization for Cityscapes (resp. PASCAL-Part) on the downsampled and the bounding- box part models can be found in Fig. 13 (resp. Fig. 14).
Apart from the ones trained on PASCAL-Part, our part-based models segment the object part fairly well even though some amount of detail and small parts are sometimes missed. In most of the misclassified samples, the predicted segmentation masks also incorrect. This is particularly true for the PGD adversarial images. This observation qualitatively confirms that the classifier stage of the part model depends and agrees with the segmentation mask expected.
We suspect that the poor prediction of the segmentation on the PASCAL-Pare dataset may be attributed to the small number of training samples. PASCAL-Part has about one order of magnitude fewer training samples compared to the other two datasets. Nevertheless, the segmentation labels still prove be very helpful in improving the adversarial training, potentially also due the fact that the
26

---

Published as a conference paper at ICLR 2023
(a) Benign test samples.
(b) Groundtruth segmentation.
(c) Predicted segmentation from clean samples.
(d) Predicted segmentation from PGD-attack samples.
Visualization of the downsampled purt model on Purt-ImageNet: (a) randomly selected clean test samples, (b) the corresponding groundtruth segmentation mask, (c) their predicted seg- mentation mask from the segmenter, and (d) the predicted segmentation mask when the samples are perturbed by PGD attack (c = 8/255). Segmentation masks corresponding misclassified samples are indicated by a red box.
Figure 12:
number of training data is small. One interesting future direction study the relationship between the numbers of class labels and segmentation labels with respect to robustness.
E SOCIETAL IMPACT
Our work focuses on improving the adversarial robustness of neural networks with the goal of creating secure and reliable models. We strictly propose a new "defense" technique and do not contribute to any attack algorithm. We believe that our work will benefit not only the research community but also machine learning practitioners and eventually, society overall. We hope that our work will be extended to improve the effectiveness of adversarial training in practice, leading to broader adoption of deep learning as well as preventing potential vulnerabilities and failures in the future.
27

---

Published as a conference paper at ICLR 2023
(a) Benign test samples.
(b) Groundtruth segmentation.
(c) Clean sample segmentation (downsampled).
(d) Adversarial example segmentation (downsampled)
(c) Clean sample segmentation (ouuding--bxx).
(f) Adversarial example segmentation (bounding- box).
Visualization of the part model trained on Cityscapes: (a) randomly selected clean test samples, (b) the corresponding groundtruth segmentation mask. (c) and (d) are the predicted segmentation mask from downsampled part model on clean and adversarial samples (PGD attack with 8/255), respectively. (e) and (f) the segmentation masks from the bounding- box model. Segmentation masks corresponding to misclassified samples are indicated by a red box.
Figure 13:
28

---

Published as a conference paper at ICLR 2023
(a) Benign test samples.
(b) Groundtruth segmentation.
(c) Clean sample segmentation (downsampled).
(d) Adversarial example segmentation (downsampled),
(e) Clean sample segmentation (bounding-box).
(1) Adversarial example segmentation (bounding-box).
Figure 14: Visualization of the part model trained on PASCAL-Part: (a) randomly selected clean test samples, (b) the corresponding groundtruth segmentation mask. (c) and (d) the predicted segmentation mask from the downsampled part model on clean and adversarial samples (PGD attack with 8/255), respectively. (e) and (f) are the segmentation masks from the bounding box model. Segmentation masks corresponding to misclassified samples are indicated by a red box.
29


Reviews:
[{"review_id": "vtDDKeAPUJ", "reviewer": "Reviewer_WbK2", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper aims at improving adversarial robustness especially for the classification task, under the white box attack settings. Authors argue that richer annotations such as part segmentation can be helpful to improve the robustness. To this end, authors crafted several classification datasets with part segmentation masks available, and proposed a semantic segmentation based classification framework. Experiments with AutoAttack demonstrate the effectiveness of the proposed framework.", "summary_of_the_review": "This paper proposes to improve adversarial robustness, however it requires extra annotation and does not improve adversarial accuracy with PGD adversarial training.\n\n---\nPost rebuttal updates:\nI thank authors' response, and it partially addresses my concerns and explains why part segmentation is more robust. However, the Table 1 still concerns me that the proposed method is not very effective on the strong PGD trained model, when defending adversarial attack (e.g. 37.8->38.5). Thus I keep my initial ratings unchanged.", "strength_and_weaknesses": "### Strength\n* The investigated problem is very important and difficult, to defend against white box adversarial attack.\n* The model architecture is somewhat straightforward and can be adapted to many other segmentation models.\n\n### Weaknesses\n* The conclusion in Table 1 is a bit confusing: the PGD adversarial training is more robust under adversarial attack, but the proposed method does not improve the robustness a lot with PGD adversarial training (e.g. 37.8 -> 38.5 on the Pascal-Part dataset). Considering the results reported in Table 5, training without segmentation supervision even leads to better adversarial robustness. So that means the extra supervision is more helpful towards clean accuracy but not on adversarial accuracy?\n* The proposed method need extra annotation of segmentation masks, which may not readily available and existing datasets with segmentation masks may not fit the classification task without non-trivial modification. This limits the scopes the proposed approach can be applied on.\n* It's a bit surprising that in appendix D.3, directly attacking the segmentation module does not work well. Can the authors give a bit more explanation about the reason and the detailed analysis of the segmentation attack results (in addition to the classification accuracy). As in [a], it seems that the segmentation task can be easily attacked.\n\n[a] Adversarial Examples for Semantic Segmentation and Object Detection", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "fqdrYV3bFw", "reviewer": "Reviewer_8aoz", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a segmentation-based robust classification framework, combining a part segmentation model with a tiny classifier, and achieves a good performance. Furthermore, this paper offers two part-based models, a down-sampled part-based model and a bounding-box part-based model. Both achieve both higher accuracy and higher adversarial robustness than a ResNet-50 baseline.", "summary_of_the_review": "This paper proposes a segmentation-based robust classification framework, combining a part segmentation model with a tiny classifier, and achieves a good performance. But my major concern is that its application scenario is limited because of the need for segmentation labels. ", "strength_and_weaknesses": "Strengths:\n+ This paper proposes an interesting framework to use the segmentation results to help the classification robustness.\n+ The experiments are sufficient, and the results demonstrate that the proposed method is effective compared with baselines.\n+ This paper is technically sound and well-written.\n\nWeakness:\n+ This segmentation-based classification framework needs the introduction of segmentation labels, greatly limiting its application scenarios.\n+ This paper only considers a ResNet baseline. It’s hard to identify its effectiveness across different model architectures.\n+ Because the proposed method is based on a segmentation framework, the segmentation results will affect the classification. I wonder whether segmentation parts’ training will affect the training time and convergence speed.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "b6Pa5wGjl2", "reviewer": "Reviewer_cNQX", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper studied how to further improve deep learning model robustness with fine-grained annotations (object parts in 2D images). They proposed a part-based classification model and compared it with a vanilla ConvNet-based classifier (ResNet-50). On three common benchmarks (Part-ImageNet, Cityscapes, and PASCAL-Part), their experiments show the proposed part-based method consistently outperforms the holistic counterpart. They also conducted experiments around attacking the segmentation model and utilizing part-(Segmentation, BB, Centroids) information to further prove the effectiveness of the proposed method. ", "summary_of_the_review": "Overall, the reviewer believes the empirical studies included in this paper can help the related community. However, the requirement of image-part (ill-defined) masks may significantly limit the practical use of the proposed approach.", "strength_and_weaknesses": "The studied direction is important, and this paper takes a step further on deep learning robustness with the help of fine-grained annotations. Overall the use of previous techniques and the design principles (part-based, disentangling irrelevant features, and location-aware) are reasonable. Their approach is properly motivated, and the paper is easy to follow. \n\nExperiments are conducted on three datasets, Part-ImageNet, Cityscapes, and PASCAL-Part, and shown the proposed part-based model achieved consistent improvements under both vanilla training and adversarial training, while the improvements further with adversarial training are limited. The experiments of attacking the segmenter model strongly prove the robustness of the proposed method. Table 6 shows the proposed method can also utilize BB and Centroids to improve model robustness. \n\nOne of the major limitations of the proposed method is the use of extra data annotations (part mask/BB). Also, the part of objects in 2D images is not well defined. It is unknown if Vision Community has a generable \"object part segmentor\" for general 2d images. It is ok to study this in the existing dataset for academic purposes, while the reviewer is unsure if the proposed method can scale up to real-world questions. \n\nAccording to 3.5.2, the author has similar #params and training epochs for the baseline and the part-based model. It is good for fair comparisons, but, the reviewer wonders if the part-based model can achieve higher performance with more training epochs? By using more fine-grained information, it is expected to train longer somehow.\n\nFor the current manuscript, the proposed method is only examined in ResNet-50. The reviewer is curious if the proposed method can work on other ConvNets and ViTs? The use of part masks is natural to introduce Vision-Transformers, which is one of the popular backbones for vision tasks nowadays. It would be good to see the proposed method can model-agnostically improve the robustness.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "1PHwvCrOxo", "reviewer": "Reviewer_moqQ", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper presents two stage end-to-end image recognition model that is robust against adversarial attacks. The model consists of the semantic segmentation module that tries to divide the objects of interest in the scene into several sub-regions and a part-based recognition model that makes the final outputs. Experimental results show that the proposed model can make the model very robust to the adversarial attacks. Detailed discussion on its performance is also given.", "summary_of_the_review": "I admit that the paper is interesting and well-written. However, there are pros and cons in this paper. By considering the trade-off between them, I am a bit on the rejection side of the paper. Please see my weakness section.", "strength_and_weaknesses": "[Strength]\nI think the part-based model is a new idea and interesting.\nIt was interesting to me to see that even the clean dataset accuracy can be improved by the proposed method. In conventional approaches, it was common that the robustness to attacks can be enhanced by sacrificing the clean dataset accuracy.\n\n[Weaknesses]\nI have some concerns in the proposed method.\n\nI am afraid the comparison to the prior work is not well demonstrated. The authors should compare their method with previous methods that can enhance the robustness to the attacks.\n\nI am afraid that the practicability of the proposed model is quite limited because the labels for the semantic segmentation are required. I understand a smaller number of labels will still be valid as shown in the experimental validation, the requirement to have semantic segmentation labels would severely limit the applications of the proposed model.\n\nThe robustness to the adversarial attacks that attack semantic segmentation models is not discussed. Once this method is known to the attackers, it is apparent the attackers would attack the semantic segmentation model first. So, the authors may want to discuss its robustness.\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Accept: poster