Robustness of Unsupervised Representation Learning without Labels
Authors: Aleksandar Petrov
Marta Kwiatkowska
Venue: Submitted to ICLR 2023 (2023)
Keywords: robustness
representation learning

Abstract: Unsupervised representation learning leverages large unlabeled datasets and is competitive with supervised learning. But non-robust encoders may affect downstream task robustness. Recently, robust representation encoders have become of interest. Still, all prior work evaluates robustness using a downstream classification task. Instead, we propose a family of unsupervised robustness measures, which are model- and task-agnostic and label-free. We benchmark state-of-the-art representation encoders and show that none dominates the rest. We offer unsupervised extensions to the FGSM and PGD attacks. When used in adversarial training, they improve most unsupervised robustness measures, including certified robustness. We validate our results against a linear probe and show that, for MOCOv2, adversarial training results in 3 times higher certified accuracy, a 2-fold decrease in impersonation attack success rate and considerable improvements in certified robustness.

Under review as a conference paper at ICLR 2023
ROBUSTNESS OF UNSUPERVISED REPRESENTATION LEARNING WITHOUT LABELS
Anonymous authors Paper under double-blind review
ABSTRACT
Unsupervised representation learning leverages large unlabeled datasets and is com- petitive with supervised learning. But non-robust encoders may affect downstream task robustness. Recently, robust representation encoders have become of interest. Still, all prior work evaluates robustness using downstream classification task. In- stead, we propose a family of unsupervised robustness measures, which are model- and aask-agnostic and label-free. We benchmark state-of-the-ard representation encoders and show that none dominates the rest. We offer unsupervised extensions the FGSM and PGD attacks. When used in adversarial training, they improve most unsupervised robustness measures, including certified robustness. We validate our results against linear probe and show that, for MOCOv2, adversarial training results in 3 times higher certified accuracy, a 2-fold decrease in impersonation attack success rate and considerable improvements certified robustness.
INTRODUCTION
Unsupervised and self-supervised models extract useful representations without requiring labels. They can learn patterns in the data and are competitive with supervised models for image classification by leveraging large unlabeled datasets (He al., 2020; Chen et al., 2020b;d;e; Zbontar al., 2021; Chen & He, 2021). Representation encoders do not use task-specific labels and can be employed for various downstream tasks. Such reuse attractive as large datasets can make them expensive to train.
Therefore, applications are often built on top of public domain representation encoders. However, lack of robustness of the encoder can be propagated to the downstream task. Consider the impersonation attack threat model in Fig. 1. An attacker tries to fool a classifier that uses representation encoder. The attacker has white-box access to the representation extractor (e.g. an open-source model) but they do not have access to the classification model that uses the representations. By optimizing the input to be similar to a benign input, but to have the representation of a different target input, the attacker fool the classifier. Even if the classifier is private, one attack the combined system if the public encoder conflates two different concepts onto similar representations. Hence, robustness against such conflation is necessary to perform downstream inference on robust features.
We currently lack ways to evaluate robustness of representation encoders without specializing for particular task. While prior work has proposed improving the robustness of self-supervised representation learning (Alayrac et al., 2019; Kim et al., 2020; Jiang et al., 2020; Ho & Vasconcelos, 2020; Chen et al., 2020a; Cemgil al., 2020; Carmon et al., 2020; Gowal al., 2020; Fan et al., 2021; Nguyen et al., 2022; Kim et al., 2022), they all require labeled datasets to evaluate the robustness of the resulting models.
Instead, we offer encoder robustness evaluation without labels. This is task-agnostic, in contrast to supervised assessment, as labels are (implicitly) associated with a specific task. Labels can also be incomplete, misleading or stereotyping (Stock & Cisse, 2018; Steed & Caliskan, 2021; Birhane & Prabhu, 2021), and can inadvertently impose biases in the robustness assessment. this work, we propose measures that do not require labels and methods for unsupervised adversarial training that result in more robust models. To the best of our knowledge, this is the first work on unsupervised robustness evaluation and we make the following contributions address this problem:
Novel representational robustness measures based on gences, requiring labels or assumptions about underlying decision boundaries.
representation diver-

---

Under review as a conference paper at ICLR 2023
tarpats Irge 1aperonerrr orght
encoder
Minimize
Public
Dog
Svergence
encoder
classifer
Public
encoder
Figure/ 1: Impersonation attack threat model. The attacker has access only to the encoder which the classifier is built. By attacking the input to have a similar representation to a sample from the target class, the attacker can fool the classifier without requiring any access to it. Cats who successfully impersonate dogs under the MOCOv2 representation encoder and a linear probe classifier are shown.
2. A unifying framework for unsupervised adversarial attacks and training, which generalizes the prior unsupervised adversarial training methods.
3. Evidence that even the most basic unsupervised adversarial attacks in the framework result in more robust models relative both supervised and unsupervised measures.
4. Probabilistic guarantees on the unsupervised robustness measures based on center smoothing.
RELATED WORK
Adversarial robustness of supervised learning Deep neural networks can have high accuracy on clean samples while performing poorly under imperceptible perturbations (adversarial examples) (Szegedy et al., 2014; Biggio et al., 2013). Adversarial examples can be viewed as spurious cor- relations between labels and style (Zhang et al., 2022; Singla & Feizi, 2022) or shorteut solutions (Robinson et al., 2021). Adversarial training, i.e. incorporating adversarial examples in the training process, is a simple and widely used strategy against adversarial attacks (Goodfellow al., 2015; Madry et al., 2018; Shafahi et al., 2019; Bai et al., 2021).
Unsupervised representation learning Representation learning aims to extract useful features from data. Unsupervised approaches are frequently used to leverage large unlabeled datasets. Siamese networks map similar samples to similar representations (Bromley et al., 1993; Koch al., 2015), but may collapse to constant representation. However, Chen & He (2021) showed that a simple stop-grad can prevent such collapse. Contrastive learning was proposed to address the representational collapse by introducing negative samples (Hadsell et al., 2006; Le-Khar from pretext tasks (Xie et al., 2021; Bachman et al., 2019; Tian et al., 2020; Oord et al., 2018; Ozair et al., 2020; McAllester & Stratos, 2020). Some methods that do not need negative samples VAES (Kingma & Welling, 2014), generative models (Kingma et al., 2014; Goodfellow et al., 2014; Donahue & Simonyan, 2020), or bootstrapping methods such BYOL by Grill al. (2020).
al., 2020). It can benefit
Robustness of unsupervised representation learning Most robustness work has focused on supervised tasks, but there has been recent interest in unsupervised training for representation encoders. Kim et al. (2020), Jiang et al. (2020), Gowal et al. (2020) and Kim et al. (2022) propose generating instance-wise attacks by maximizing contrastive loss and using them for adversarial training. Fan et al. (2021) complement this by figh-frequency view. Ho & Vasconcelos (2020) suggest attacking batches instead of individual samples. KI--divergence can also be used as loss (Alayrac et al., 2019) or as a regularizer (Nguyen et al., 2022). Alternatively, classifier can be trained on a small labeled dataset with adversarial training applied to it (Carmon et al., 2020; Alayrac al., 2019). For VAEs, Cemgil et al. (2020) generate attacks by maximizing the Wasserstein distance to the clean representations in representation space. Peychev et al. (2022) address robustness from the perspective of individual faimess: they certify that samples close in feature directions are close in representation space. However, their approach is limited to invertible encoders. While these methods obtain robust unsupervised representation encoders, they all evaluate robustness single
2

---

Under review as a conference paper at ICLR 2023
supervised classification task. To the best of our knowledge, prior work has proposed measures for robustness evaluation without labels.
3 PROBLEM SETTING
Let f : X + R be differentiable encoder from X = [0, 1 to a representation space R. require f to be white-box: we can query both f(x) and d(wr), R endowed with a divergence de
Breakaway risk
Overlap risk
aay em drtch s1a)
r'r, function that has the non-negativity (d(r,r') 2 0. Vr, E R) and identity of indis- cernibles (d(r,r') 0
Nata
flale,
(ata")
r') properties. This includes metrics on R and statistical dis- tances, e.g. the KL--divegeence D is dataset of iid samples from distribution D over X.
Fin)
Rel
7
flate mi)
Breakaway and overlap risks. Diver- gences that increase the corresponding risks are in red and those reducing them are in green.
Figure 2:
We denote perturbations of as 8= || S, with small enough so that i is indis- tinguishable from z. We assume to be desirable
that f maps close to ie. dzf(z), f())) should be "small". We call this property unsupervised robustness. It is related to the smoothness encoders (Bengio et al., 2013). Intuitively, (Lipschitz) continuous downstream tasks would translate such unsupervised robustness to supervised robustness.
We propose two risk measures for unsupervised robustness. First, the breakaway risk is the probability that the worst-case perturbation of in the ball (xx, c) is closer to different sample x' than to
I
[d [d)f()). f(x()) < d(f(2), f(z))) å E arg sup aEB(z,e)
f(f()
(1)
Another indication of the lack of unsupervised robustness is if (B c)) and f(B('', <)) overlap, then there exist perturbations 8, 8' under which downstream tasks would not be able distinguish between the two samples, i.c. f(x + 6) = f(x' + 6'). We call this the overlap risk and define as:
x))) < < [(((,,, ))), a(o, 1) arg inf d(S(1), (())). (2) aEB(o,c)
2,2'~D
The breakaway risk is based on the perturbation causing the largest divergence in R, while the overlap risk measures if perturbations are well-separated from other instances (see Fig. 2). Labels are not required: the two risks are defined with respect the local properties of the representation manifold of f under D and not relative to a task. In fact, we neither explicitly nor implicitly consider decision boundaries or underlying classes and make no assumptions about the downstream task.
What if x and x' are very similar? Perhaps we shouldn' 't consider breakaway and overlap in such cases? We argue against this. First, the probability of very similar pairs would low a sufficiently diverse distribution D. Second, there is no clear notion of similarity on . without making assumptions about the downstream tasks. Finally, even if x very similar to x', it should still be more similar to any as and â are defined to be visually indistinguishable. We call this the self-similarriy assumption.
UNSUPERVISED ADVERSARIAL ATTACKS ON REPRESENTATION ENCODERS
It is not tractable to compute the supremum and infimum in Eqs. (1) and (2) exactly for general f. Instead, approximate them via constrained optimization in the form of adversarial attacks. This section shows how to modify the FGSM and PGD supervised attacks for these objectives (Secs. 4.1 and 4.2), as well as how to generalize these methods to arbitrary loss functions (Sec. 4.3). The adversarial examples can also be used for adversarial training (Sec. 4.4).
"Concurrent work by Wang & Liu (2022) proposed RVCL: method to evaluate robustness without labels. However, it focuses contrastive learning models while the methods here work with arbitrary encoders.
3

---

Under review as a conference paper at ICLR 2023
4.1 UNSUPERVISED FAST GRADIENT SIGN METHOD (U-FGSM) ATTACK
The Fast Gradient Sign Method (FGSM) is a popular one-step method to generate adversarial examples in the supervised setting (Goodfellow al., 2015). Its untargeted mode perturbs the input by taking step of size E Rso in the direction of maximizing the classification loss La relative the true label y. In targeted mode, it minimizes the loss of classifying æ as target class f # y:
clip(æ + a (aaa)((()))))))))))) x- clip(æ a sign =ig
untargeted FGSM,
targeted FGSM,
where clip(x)) clips all values of be between and 1.
We can approximate the supremum in Eq. (1) by replacing La with the representation divergence d, using a small perturbation E IR to ensure non-zero gradient:
Untargeted U-FGSM
= clip(x + siiign( VV f(x n)))).
Ho & Vasconcelos (2020) also propose an untargeted FGSM attack for the unsupervised setting, which requires batches rather than single images and uses specific loss function, and hence is an instance of the FFGGMM attack in Sec. 4.3. The untargeted U-FGSM proposed here is independent of the loss used for training, making it more versatile.
Targeted U-FGSM We can also perturb z; E D so that its representation becomes close to f(x)) for zy D, # r4. Then downstream model would struggle to distinguish between the attacked input and the target zj. This approximates the infimum in Eq. (2):
clip(r; - sign V., (z,)(
4.2 UNSUPERVISED PROJECTED GRADIENT DESCENT (U-PGD) ATTACK
PGD attack is the gold standard of supervised adversarial attacks (Madry al., 2018). comprises iterating FGSM and projections onto Bxx, e), the &o ball of radius e centered at r:
5o T = clip (æ + ())
randomized initialization,
Ju+1 clip (Il.,, [& a sign ( (f
untargeted PGD,
4 u+ cll. [ sign (V 2. (f af ()))
targeted PGD.
We construct the unsupervised PGD (U-PGD) attacks similarly to the U-FGSM attack: do 20t = clip (a (x+
randomized initialization, untargeted U-PGD, targeted U-PGD.
Lo+1 = clip (&. + a
4 a.f1 clip [4 - sigu(V ((x))))
By replacing the randomized initialization with the perturbation in the first iteration of the untargeted case, one obtains an unsupervised version of the BIM attack (Kurakin et al., 2017). The adversarial training methods proposed by Alayrac et al. (2019); Cemgil et al. (2020); Nguyen al. (2022) can be considered using U-PGD attacks with specific divergence choices (see App. A.
4.3 LOSS-BASED ATTACKS
In both their supervised and unsupervised variants, FGSM and PGD attacks work by perturbing the input in order to maximize or minimize the divergence By considering arbitrary differentiable loss functions instead, we can define more general class of loss-based altacks.
Instance-wise loss-based attacks (L'FGSM, L'-PGD) Given an instance E X' and loss function L': (X + R) x X the L'-FGSM attack takes step in the direction maximizing L':
f clip (xr a sign (V.d v..((x))))
4

---

Under review as a conference paper at ICLR 2023
Similarly, for loss function L (XC - R) x J X R taking representation encoder, sample, and the previous iteration of the attack, the loss-based PGD attack is defined as:
Co clip (a: ('))),
8u+1 = clip , [.. + a sign( V Lff fn)l).
If we do not use random initialization for the attack, get the --BIM attack.
The supervised and unsupervised FGSM and PGD attacks are special cases of the L-FGSM and _L-PGD attacks. Furthermore, prior unsupervised adversarial training methods can also be represented as L'DPGD attacks (Kim et al., 2020; Jiang et al., 2020). A full description is provided in App. A.I.
Batch-wise loss-based attacks (f'FFGMM LPGGD) Attacking whole batches instead of single inputs can account for interactions between the individual inputs in batch. The above attacks can be naturally extended work over batches by independently attacking all inputs from X [.1...., xN) This can be done with more general loss function L (X + R) x X - I. The batch-wise loss-based FGSM attack F--FSSM is provided in Eq. (3) with LGG and LI- defined similarly.
X clip (X asginn V (xx(f,x)))
Any instance-wise loss-based attack can be trivially represented as batch-wise attack. Additionally, prior unsupervised adversarial training methods can also be represented as L'-FGSM and L'PGG attacks (Ho & Vasconcelos, 2020; Fan et al., 2021; Jiang et al., 2020) (see App. A.2).
4.4 ADVERSARIAL TRAINING FOR UNSUPERVISED LEARNING
Adversarial training is a min-max problem minimizing a loss relative to a worst-case perturbation that maximizes (Goodfellow et al., 2015). As the worst-case perturbation cannot be computed exactly (similarly to Eqs. (1) and (2)), adversarial attacks are usually used to approximate it. Any of the aforementioned attacks can be used for the inner optimization for adversarial training. Prior works use divergence-basedn (Alayrac et al., 2019; Cemgil et al., 2020; Nguyen et al., 2022) and loss-based attacks (Kim et al., 2020; Jiang et al., 2020; Ho & Vasconcelos, 2020; Fan et al., 2021). These methods tend to depend complex loss functions and might work only for certain models. Therefore, we propose using targeted or untargeted U-PGD, as well as L'-PGD with the loss used for training. They simple to implement and can be applied to any representation learning model.
ROBUSTNESS ASSESSMENT WITH NO LABELS
The success of supervised attack is clear-cut: whether the predicted class is different from the one of the clean sample. the unsupervised case, however, is not clear when an adversarial attack results in representation that is "too far" from the clean one. In this section, propose using quantiles to quantify distances and discuss estimating the breakaway and overlap risks (Eqs. (1) and (2)).
Universal quantiles (UQ) for untargeted attacks For untargeted attacks, propose measuring (() ((x) relative to the distribution of divergences between representations of samples from D. In particular, we suggest reporting the quantile q = F. ~~ [d(f(x') (x'), f= I d(f(2), f())). This measure is independent of downstream tasks and depends only on the properties of the encoder and D. We can use compare different models,
agnostic the different representation
magnitudes models may have. In practice, the quantile values can be estimated from the dataset D.
Relative quantiles (RQ) for targeted attacks Nothing prevents universal quantiles to applied to targeted attacks. However, considering that targeted attacks try to "impersonate" particular target sample, we propose using relative quantiles to assess their success. We assess the attack as the distance d(f (a fxz)) induced by the attack relative to (x:)), (I,)), the original distance between the clean sample and the target. The relative quantile for a targeted attack á; is then the ratio (a,"") (xz)))d(ff ( f(z)))
Quantiles are a good way to assess the success of individual attacks or to compare different models. However, they do not take into account the local properties of the representation manifold, i.e. that
5

---

Under review as a conference paper at ICLR 2023
some regions of R might be more densely populated than others. The breakaway and overlap risk metrics were defined with this exact purpose. Hence, we propose estimating them.
Estimating the breakaway risk While the supremum in Eq. (1) cannot be computed explicitly, it can be approximated using the untargeted U-FGSM and U-PGD attacks. Therefore, we can compute Monte Carlo estimate of Eq. (1) by sampling pairs (æ,x²') from the dataset D and performing an untargeted attack on z, for example with U-PGD.
Nearest neighbour accuracy As the breakaway risk can be very small for robust encoders propose also reporting the fraction of samples in D' S whose untargeted attacks would have their nearest clean neighbour in D being their corresponding clean samples That is:
Σ D
1
D. + s.t. ((('), d(f(2),
(4)
Estimating the overlap risk The infimums in Eq. (2) can be estimated with unsupervised
targeted attack. Hence, an estimate of Eq. (2) can be computed by sampling pairs (I;, from the dataset D and computing the targeted attacks 2, and 65 The overlap risk estimate is then the fraction of pairs for which (z:), f(071)) < f(a)
Adversarial margin In Eq. (2) one takes into account only whether overlap occurs but not the magnitude of the violation. Therefore, we also propose looking at the margin between the two attacked representations, normalized by the divergence between the clean samples:
d(f(z.), f(77") d(f( -()"")))((())))))) f(2, (($,))
d(f(x.).
for randomly selected pairs (z,, from D. overlap occurs, this ratio would negative, with more negative values pointing to stronger violations. The overlap risk is therefore equivalent to the probability of occurrence of a negative adversarial margin.
Certified unsupervised robustness The present work depends gradient- attacks, which can be fooled by gradient masking (Athalye al., 2018; Uesato al., 2018). Hence, we also assess the certified robustness of the encoder. By using center smoothing (Kumar & Goldstein, 202 I) we can compute probabilistic guarantee on the radius of the f2-ball in that contains at least half of the probability mass of f(x (0,0 o))). The smaller this radius is, the closer maps similar inputs. Hence, this a probabilistically certified alternative to assessing robustness via untargeted attacks. In order compare certified radius values in R across models we report them universal quantiles.
6 EXPERIMENTS
We assess the robustness of state-of-the-arr representation encoders against the unsupervised attacks and robustness measures from Secs. 4 and 5. We consider the ResNet50-based seff-supervised models MOCOv2 (He et al.. 2020; Chen et al.. 2020d). MOCO with non-semantic negatives (Ge et al., 2021), PixPro (Xie al., 2021). 1). AMDIM (Bachman et al., 2019), SimCLRv2 (Chen al., 2020c), and SimSiam (Chen & He, 2021). To compare self-supervised and supervised methods, we also evaluate the penultimate layer of ResNet50 (He et al., 2016) and supervised adversarially trained ResNet50 (Salman et al.. 2020). We assess the effect of using different unsupervised attacks by fine-tuning MOCOv2 with the untargeted U-PGD, targeted U-PGD, as well as with L'-PGD using MOCOv2's contrastive loss, as proposed in Sec. 4.4. App. B reports the performance of unsupervised adversarial training on ResNet50 and the transformer- based MOCOv3 (Chen et al., 2021).
The unsupervised evaluation uses the PASS dataset it does not contain people and identifiable information and has proper licensing (Asano et al., 2021). ImageNet (Russakovsky et al., 2015) is used for accuracy benchmarking and the adversarial fine-tuning of MOCO, to be consistent with how the model was trained. Assira (Elson et al., 2007) is used for the impersonation attacks.
We report median UQ and RQ for the & divergence for the untargeted and targeted U-PGD attacks with e = 0.05 and e = 0.10. We also estimate the breakaway risk, nearest neighbour accuracy, overlap risk and adversarial margin, and certified unsupervised robustness, described in Sec. 5.

---

Under review as a conference paper at ICLR 2023
Table 1: Standard and lowpass ImageNet accuracy of linear probes of ResNet50-based encoders.
Robust ResNet50
Stundard ResNet-- bosed unsupervised models
Adversarially fine- tuned MOCOv2
Accuracy
ResNet50
PixPro AMDIM SimCLR SimSiam
Nonsem MOCOv2
TAR
UNTAR
Z-PGD
Standard
74%
62%
58%
62%
67%
63%
50%
60%
60%
57%
Lowpass
68%
59%
50%
53%
60%
56%
62%
59%
58%
55%
Table 2: Robustness of ResNet50 and ResNet50-based unsupervised encoders on PASS (except the average certified radius measured on ImageNet). Arrows show if larger or smaller values are better.
Robust
Standurd ResNet-based unsupervised models
ResNet50
ResNet
PixPro
AMDIM
SimCLR
SimSiam
Nonsem MOCOv2
Targoted U-PGD
iter. (RQ) T
66.38%
98.14%
80.51%
80.82%
75.04%
73.25%
61.54%
65.64%
0.05
10 iter. (RQ) 1
52.68%
96.45%
67.91%
70.26%
65.77%
65.94%
46.52%
52.08%
50 iter. (RQ) 1
27.42%
86.89%
37.57%
44.28%
36. 38%
28.13%
22.23%
20.51%
iter. (RQ) 1
69.27%
97.92%
83.06%
85.59%
78.02%
78. 78%1
64.28%
68.68%
0.10
10 (RQ) 1
55.63%
96.03%
71.18%
75.93%
69.01%
70.45%
48.57%
55.02%
50 iter. (RQ) 1
27.92%
83.90%
38.07%
47.28%
38.60%
30.33%
22.32%
21.88%
iter. (UQ) |
98.70%
0.00%
14.35%
81.30%
43.65%
72.55%
46.80 46.80%
65.10%
Untar: U-PGD
c- 0.05
10 iter. (UQ) 1
99.90%
0.00%
85.60%
98.50%
99.40%
98.60%
98. 10%
99.00%
50 itcr. (UQ) 1
99.90%
0.01%
99.90%
99.90%
99.90%
99.90%
99.90%
99.90%
5 iter. (UQ) |
99.40%
0.00%
11.25%
92.10%
48.30%
65.65%
43.20%
69.25%
r- 0.10
10 iter. (UQ) |
99. 90%%
0.00%
77.50%
98.90%
98.70%
98.00%
96.65%
98.80%
50 iter. (UQ)
99.90%
0, 0.90%
99.90%
99, 99.90%
99.90%
99, 99.90%
99, 99.90%
99.90%
Breakaway risk I
0.100
0.000%
0.190%
0.414%
0.039%
0.146%
0.211
0.254%
Nenrest neighbor acc. 1
0.00%
95.00%
0.00%
0.10%
0.10%
0.00%
0.00%
0.00%
Overlap risk I
92.48%
0.00%
39.65%
34.30%
45.61%
40.72%
93.46%
91.80%
Med. adversarial margin 1
18.57%
84.86%
4.08%
2.72%
1.23%
1.60%
-27.18%
-16.50%
Avg. Certified Radius 1
0.11
0.13
0.14
0.02
0.24
0.21
0.14
0.22
As customary, we measure the quality of the representations with the top-1 and top-5 accuracy of a linear probe. We also report the accuracy on samples without high-frequency components, as models might be overly reliant on the high-frequency features in the data ( (Wang et al., 2020). Additionally, we assess the certified robustness via randomized smoothing (Cohen et al., 2019) and report the resulting Average Certified Radius (Zhai et al., 2020).
In line with the impersonation threat model, we also evaluate to what extent attacking a representation encoder can fool a private downstream classifier, Pairs of cats and dogs from the Assira dataset (Elson al., 2007) are attacked with targeted U-PGD so that the representation of one is close to the other. We report the percentage of impersonations that successfully fool the linear probe.
7 RESULTS
In this section, present the results of the experiments on ResNet50 and the ResNet50-bbsed unsupervised encoders. Further results can be found in App. B.
Supervised adversarial training performs well on all unsupervised measures. We validate our unsupervised robustness measures by comparing the robustness at the penultimate layers of ResNe150 and a supervised adversarially trained version of it. The first two columns of Tab. show that ad adversarially trained ResNet50 scores significantly better on all unsupervised measures. This demonstrates that our measures successfully detect models which we know to be robust in a supervised setting.
There is no "most robust" standard model. Amongst the standard unsupervised models, none dominates on all unsupervised robustness measures (see Tab. 2). AMDIM is least susceptible to targeted U-PGD attacks but has the worst untargeted U-PGD, breakaway risk and nearest neighbor accuracy. PixPro significantly outperforms the other models on untargeted attacks. AMDIM and PixPro also have the lowest overlap risk and largest median adversarial margin. At the same time, the model with the lowest breakaway risk and the highest average certified radius is SimCLR. While either AMDIM or PixPro scores the best at most measures, they both have significantly higher
7

---

Under review as a conference paper at ICLR 2023
breakaway risk and lower average certified radius than SimCLR. Therefore, model is clear choice for the "most robust model".
Unsupervised robustness measures reveal significant differences among standard models. The gap between the best and worst performing unsupervised models for the six measures based on targeted U-PGD attacks is between 19% and 27%. The gap reaches almost 81 % for the untargeted case (PixPro vs AMDIM, 5 it.), demonstrating that standard models on both extremes do exist. AMDIM has 10.5 times higher breakaway risk than SimCLR while at the same time 2.7 times lower overlap risk than MOCOv2. Observing values on both extremes of all unsupervised robustness metries testifies to them being useful for differentiating between the different models. Additionally, AMDIM having the highest breakaway risk and lowest overlap risk indicates that unsupervised robustness is multifaceted problem and that models should be evaluated against an array of measures.
Unsupervised adversarial training boosts robustness across all measures. Across every single unsupervised measure, the worst adversarially trained model performs better than the best standard model (Tabs. 2 and 3). Comparing the adversarially trained models with MOCOv2, we observe a signif-
Table 3: Robustness of MOCOv2 and its adversarially fine-tuned versions measured PASS and ImageNet.
MOCOy2
TAR
UNTAR
Z-PGD
Unter. U-PGD Targetel U-PGD
iter. (RQ)
65.64%
92.97%
94.00%
95.41%
c- 0.05 10 iter. (RQ)
52.08%
87.38%
88.86%
91.57%
50 iter. (RQ)
20.51%
62.79%
64.83%
71.65%
5 iterr (RQ)
68.68%
93.01%
93.92%
95.24%
icant improvement across the board (Tab. 3). They are also more certifiably robust (Fig. 4). However, the added robustness comes at the price of reduced accuracy (7% 10%,
e
0.10 10 iter. (RQ)*
55.02%
87.23%
88.59%
91.11%
50 iter. (RQ)
21.88
59.67%
61.21%
68.19%
5 iter. (UQ)
65.10%
0.00%
0.00%
0.00%
0.05 iter. (UQ)
99.00%
0.00%
0.00%
0.00%
iter. (UQ)
99.90%
75.35%
30.35%
3.40%
Tab. 1), as is typical for adversarial training (Zhang et al., 2019; Tsipras al., 2019).
5 iter. (UQ)
69.25%
0.00%
0.00%
0.00%
0.10 iter. (UQ).
98.80%
0.01%
0.00%
0.00%
This gap can likely be reduced by fine- tuning the trade-off between the adversar- ial and standard objectives and by having separate batch normalization parameters for standard and adversarial samples (Kim et al., 2020; Ho& Vasconcelos, 2020). Adversar- ial training also reduces the impersonation rate of a downstream classifier at 5 iterations by a half relative to MOCOv2 (Tab. 4). For 50 iterations, the rate is similar to MOCOv2 but the attacked images of the adversarially fine-tuned models have more semantically meaningful distortions, which can be detected by a human auditor (see App. D for examples). These results are for only 10 iterations of fine-tuning of standard encoder. Further impersonation rate reduction can likely be achieved with adversarial training for all 200 epochs.
50 iter. (UQ)
99.90%
91.65%
65.30%
18.40%
Breakaway risk
0,254%
0.049%
0.001%
0.000%
Nearest neighbor acc.
0.00%
17.00%
35.60%
64.40%
Overlap risk
91. 80%
0.00%
0.00%
0.04%
Med, adversarial margin
16.50%
61.54%
67.50%
76.09%
Avg. Certified Radius
0.22
0.30
0.30
0.31
Unsupervised adversarial training results in cer- tifiably more robust classifiers. Fig. 3 shows how the randomized smoothened linear probes of the ad- versarially trained models uniformly outperform MO- COv2. The difference is especially evident for large radii: 3 times higher certified accuracy when consid- ering perturbations with radius of 0.935. These re- sults demonstrate that unsupervised adversarial train- ing boosts the downstream certified accuracy.
Table 4: Impersonation attack success rate on Assira of MOCOy2 and its label-free ad- versarially fine-tuned versions for different attack iterations.
Iterations
MOCOv2
TAR
UNTAR
I 7-PGD
iter.
34.20%
18.91%
15.67%
15.20%
10 iter.
62.78%
60.15%
56.27%
54.59%
50 iter. 76.43%
76.22%
71.79%
71.89%
Adversarially trained models have better consistency between standard and low-pass accuracy. The difference between standard and low-pass accuracy for the adversarially trained models is between 1.7% and 2.1%, compared to 2.2% to 9.7% for the standard models (Tab. 1). This could be in part due to the lower accuracy of the adversarially trained models. However, compared with PixPro, AMDIM and SimSiam, which have similar accuracy but larger gaps, indicate that the lower accuracy cannot fully explain the lower gap. Therefore, this suggests that unsupervised adversarial training can help with learning the robust frefrreuency features and rejecting high-frequency non-semantic ones.
8

---

Under review as a conference paper at ICLR 2023
0.8
of cataret
0.30
0.25
Cartifee
0.20
0.15
MOCOv2
0.2
MCCOV2 TAR
MOCOv2 UNITRR
MOC0V2 UNTAR
MOCDv2 Z-PGD
MO00=2 Z-PGO
0.6
10-1
10-1 representation radius
10
10-2
Ingut radius
Figure 3: Certified accuracy of randomized smoothed MOCOv2 and its adversarially trained variants on ImageNet. The udversarially trained models are uniformly more robust.
Certified robustness of MOCOv2 on PASS using center smoothing. The certified rep- resentation radius represented as percentile of the distribution of clean representation distances.
Figure
.PGG is the overall most robust model, albeit with lower accuracy. LCPPG dominates across all unsupervised robustness measures. These results support the findings of prior work on unsupervised adversarial training using batch loss optimization (Ho & Vasconcelos, 2020; Fan al., 2021; Jiang et al., 2020). However, L'PGGD also has the lowest supervised accuracy of the three models (Tab. 1), as expected due the rccuracy-robustre between the three models are small, and hence all three adversarial training methods can improve the robustness of unsupervised representation learning models.
trade-off. Still, the differences
DISCUSSION, LIMITATIONS AND CONCLUSION
Unsupervised lusk-independent adversarial training with simple extensions to classic adversarial attacks can improve the robustness of encoders used for multiple downstream tasks, especially when released publicly. That is why we will release the adversarially fine-tuned versions of MÓCOv2 and MOCOv3, which can be used as more robust drop-in replacements for applications built on top of these two models. We showed how to assess the robustness of such encoders without resorting to labeled datasets proxy tasks. However, there is single "unsupervised robustness measure", models can have drastically different performance across the different metrics. Still, unsupervised robustness is stronger requirement than classification robustness it requires not only the output but also an intermediate state of the model to not be sensitive to small perturbations. Hence, we recommend unsupervised assessment and adversarial training also be applied to supervised tasks.
We do not compare with the prior methods in Sec. 2 as different base models, datasets and objective functions hinder fair comparison. Moreover, the methods we propose generalize the previous works, hence this paper strengthens their conclusions rather than claiming improvement over them.
This work is not an exhaustive exploration of unsupervised attacks, robustness measures and defences. We adversarially fine-tuned only three models: two based on ResNet50 and one transformer-bat based (in App. B); assessing how these techniques work on other architectures further required. There are many other areas warranting further investigation, such as non non-gradient based attacks, measures which better predict the robustness of downstream tasks, certified defences, as well as studying the accuracy- robusteessss trade-off for representation learning. Still, we believe that robustness evaluation of representation learning models is necessary for comprehensive assessment their performance and robustness. This is especially important for encoders used for applications susceptible to impersonation attacks. Therefore, we recommend reporting unsupervised robustness measures together with standard and low-pass linear probe accuracy when proposing new unsupervised and supervised learning models. We hope that this paper illustrates the breadth of opportunities for robustness evaluation in representation space and inspires further work on it.

---

Under review as a conference paper at ICLR 2023
ETHICS STATEMENT
This work discusses adversarial vulnerabilities unsupervised models and therefore exposes potential attack vectors for malicious actors. However, it also proposes defence strategies in the form of adversarial training which can alleviate the problem, as well as measures to assess how vulnerable representation learning models Therefore, believe that it would empower the developers of safery-, reliability- and fairnes--critial systems to develop safer models. Moreover, we hope that this work inspires further research into unsupervised robustness, which can contribute more robust and secure machine learning systems.
REPRODUCIBILITY STATEMENT
The experiments this paper were implemented using open-source software packages (Harris et al., 2020; Virtanen et al., 2020; McKinney, 2010; Paszke et al., 2019), well the publicly available MOCOv2 and MOCOv3 models (He et al., 2020; Chen et al., 2020d; 2021). We provide the code used for the adversarial training, well all the robustness evaluation implementations, together with documentation on their use. We also release the weights of the models and linear probes. The code reproducing all the experiments in this paper is provided well. The details available here.
REFERENCES
Jean-Baptiste Alayrac, Jonathan Uesato, Po-Sen Huang, Alhussein Fawzi, Robert Stanforth, and Pushmeet Kohli. Are labels required for improving adversarial robustness? In 32nd Conference on Neural Information Processing Systems, pp. 12214-12221 122233, 2019.
Yuki M. Asano, Christian Rupprecht, Andrew Zisserman, and Andrea Vedaldi. PASS: An ImageNet replacement for self supervseee pretraining without humans. In NeurlPS Track on Datasets and Benchmarks, 2021.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses adversarial examples. 35th International Conference on Machine Learning, pp. 274-283, 2018.
Philip Bachman, R. Devon Hjelm, and William Buchwalter. Learning representations by maximizing mutual information across views. In 32nd Conference on Neural Information Processing Systems, pp. 15535-15545, 2019.
Tao Bai, Jinqi Luo, Jun Zhao, Bihan Wen, and Qian Wang. Recent advances in adversarial training for adversarial robustness. In 30th International Joint Conference Artificial Intelligence, pp. 4312-4321, 2021.
Yoshua Bengio, Aaron Courville, and Pascal Vincent. Representation learning: A review and new perspectives. IEEE Transactions on Pattern Analysis and Machine Intelligence, 3788):1798-1828. 2013.
Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Šmdií Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. In European Conference Machine Learning and Knowledge Discovery in Databases, pp. 387-402, 2013.
Abeba Birhane and Vinay Uday Prabhu. Large image datasets: A pyrrhic win for computer vision? In IEEE Winter Conference on Applications of Computer Vision (WACV), pp. 1536-1546. 2021.
Jane Bromley, Isabelle Guyon, Yann LeCun, Eduard Säckinger, and Roopak Shah. Signature verification using a "Siamese" time delay neural network. In Advances in Neural Information Processing Systems, pp. 737-744, 1993.
Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, Percy Liang, and John C Duchi. Unlabeled data improves adversarial robustness. In 33rd Conference on Neural Information Processing Systems, pp. 11192-1 1203, 2020.
10

---

Under review as a conference paper at ICLR 2023
Taylan Cemgil, Sumedh Ghaisas, Krishnamurthy Dvijotham, and Pushmeet Kohli. Adversarially robust representations with smooth encoders. In International Conference on Learning Represen- tations, 2020.
Taalong Chen, Sijia Liu, Shiyu Chang, Yu Cheng, Lisa Amini, and Zhangyang Wang. Adversar- ial robustness: From supervid pre-training to fine-tuning. In JEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), pp. 696-705, 2020a.
Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. Proceedings of the 37th International Conference Machine Learning, pp. 1597-1607, 2020b.
Ting Chen, Simon Komblith, Kevin Swersky, Mohammad Norouzi, and Geoffrey Hinton, Big self- supervised models are strong semi-super learners. In 34th Conference Neural Information Processing Systems, pp. 22243-22255, 2020c.
Xinlei Chen and Kaiming He. Exploring simple siamese representation learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 15750-15758, 2021.
Xinlei Chen, Haoqi Fan, Ross Girshick, and Kaiming He. Improved baselines with momentum contrastive learning. Preprint arXiv:2003. 04297, 2020d.
Xinlei Chen, Saining Xie, and Kaiming He. An Empirical Study of Training Self-Supervised Vision Transformers. In International Conference on Computer Vision, pp. 9640-9649, 2021.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In 36th International Conference on Machine Learning, pp. 1310-1320, 2019.
Jeff Donahue and Karen Simonyan. Large scale adversarial representation learning. In 33rd Conference on Neural Information Processing Systems, pp. 10542-10552, 2020.
Jeremy Elson, John Douceur, Jon Howell, and Jared Saul. Asirra: A CAPTCHA that exploits interest- aligned manual image categorization. In ACM Conference on Computer and Communications Security, 2007.
Lijie Fan, Sijia Liu, Pin- Yu Chen, Gaoyuan Zhang, and Chuang Gan. When does contrastive learning preserve adversarial robustness from pretraining to finetuning? In 35th Conference on Neural Information Processing Systems, pp. 21 21480-21492, 2021.
Songwei Ge, Shlok Mishra, Haohan Wang. Chun-Liang Li, and David Jacobs. Robust contrastive learning using negative samples with diminished semantics. In 34th Conference on Neural Information Processing Systems, pp. 27356-27368, 2021.
Ian J. Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In 27th Conference on Neural Information Processing Systems, pp. 2672-2680, 2014.
lan Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples, In International Conference on Learning Representations, 2015.
Sven Gowal, Po-Sen Huang, Aaron van den Oord, Timothy Mann, and Pushmeet Kohli, Self- supervised adversarial robustness for the low-label, high-data regime. In International Conference on Learning Representations, 2020.
Jean-Bastien Grill, Florian Strub, Florent Altché, Corentin Tallec, Pierre H Richemond, Elena Buchatskaya, Carl Doersch, Bernardo Avila Pires, Zhaohan Daniel Guo, Mohammad Gheshlaghi Azar, Bilal Piot, Koray Kavukcuoglu, Rémi Munos, and Michal Valko. Bootstrap your own latent a new approach to self-supervised learning. In 33rd Conference on Neural Information Processing Systems, pp. 21271-21284 2020.
Raia Hadsell, Sumit Chopra, and Yann LeCun. Dimensionality reduction by learning an invariant mapping. In IEEE Conference Computer Vision and Pottern Recognition, pp. 1735-1742, 2006.
11

---

Under review as a conference paper at ICLR 2023
Charles R. Harris, K. Jarrod Millman, Stéfan J. van der Walt, Ralf Gommers, Pauli Virtanen, David Cournapeau, Eric Wieser, Julian Taylor, Sebastian Berg, Nathaniel J. Smith, Robert Kern, Matti Picus, Stephan Hoyer. Marten H. van Kerkwijk, Matthew Brett, Allan Haldane, Jaime Fernández del Río, Mark Wiebe, Pearu Peterson, Pierre Gérard-Marchant, Kevin Sheppard, Tyler Reddy, Warren Weckesser, Hameer Abbasi, Christoph Gohlke, and Travis E. Oliphant. Array programming with NumPy, Nature, 585(7825):357-362, 2020.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In IEEE Conference on Computer Vision and Pattern Recognition, pp. 770-778, 2016.
Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 9729-9738, 2020.
Kaiming He, Xinlei Chen, Saining Xie, Yanghao Li, Piotr Dollár, and Ross Girshick. Masked autoencoders are scalable vision learners. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 16000-16009, 2022.
Chih-Hui Ho and Nuno Vasconcelos. Contrastive learning with adversarial examples. In 34th Conference on Neural Information Processing Systems, pp. 17081-17093, 2020.
Ziyu Jiang, Tianlong Chen, Ting Chen, and Zhangyang Wang. Robust pre-training by adversarial contrastive learning. In 34th Conference on Neural Information Processing Systems, pp. 16199- 16210, 2020.
Minseon Kim, Jihoon Tack, and Sung Ju Hwang. Adversarial self-supervised contrastive learning. In 34th Conference on Neural Information Processing Systems, pp. 2983-2994, 2020.
Minseon Kim, Hyeonjeong Ha, Sooel Son, and Sung Ju Hwang. Targeted adversarial self self-supervised learning. Preprint arXiv:2210. 10482, 2022.
Diederik P. Kingma and Max Welling. Auto-encoding variational Bayes. In International Conference on Learning Representations, 2014.
Diederik P. Kingma, Shakir Mohamed, Danilo Jimenez Rezende, and Max Welling. Semi-supervised learning with deep generative models. 27th Conference on Neural Information Processing Systems, pp. 3581-3589, 2014.
Gregory Koch, Richard Zemel, and Ruslan Salakhutdinov. Siamese neural networks for one-shot image recognition. In Proceedings of the 32nd International Conference on Machine Learning, 2015.
Aounon Kumar and Tom Goldstein. Center smoothing: Certified robustness for networks with structured outputs. 34th Conference on Neural Information Processing Systems, pp. 5560-5575, 2021.
Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial machine learning at scale, In International Conference Learning Representations, 2017.
Phuc H. Le-Khae, Graham Healy, and Alan F. Smeaton. Contrastive representation learning: A framework and review. IEEE Access, 8: 199934, 2020.
Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified robustness to adversarial examples with differential privacy. In IEEE Symposium on Security and Privacy (SP), pp. 656-672, 2019.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
David McAllester and Karl Stratos. Formal limitations on the measurement of mutual information. In 23rd International Conference Artificial Intelligence and Statistics, pp. 875-884, 2020.
12

---

Under review as a conference paper at ICLR 2023
Wes McKinney. Data structures for statistical computing in Python. In 9th Python in Science Conference, pp. 56 61, 2010.
Takeru Miyato, Shin-ichi Maeda, Masanori Koyama, and Shin Ishii. Virtual adversarial training: A regularization method for supervised and semi -umi-vspee learning, IEEE Transactions on Pattern Analysis and Machine Intelligence. 41(8):1979-199 2019.
A. Tuan Nguyen, Ser Nam Lim, and Philip Torr. Task-agnostic robust representation learning. Preprint arXiv:2203.07596, 2022.
Aaron den Oord, Yazhe Li, and Oriol Vinyals. Representation learning with contrastive predictive coding. Preprint 100X:::8077.0748,, 2018.
Sherjil Ozair, Corey Lynch, Yoshua Bengio, Aaron van den Oord, Sergey Levine, and Pierre Sermanet. Wasserstein dependency measure for representation learning. In 33rd Conference on Neural Information Processing Systems, pp. 15578-15588, 2020.
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Kopf, Edward Yang. Zachary Vito,, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala. PyTorch: An imperative style, high-performance deep learning library. In 32nd Conference on Neural Information Processing Systems, pp. 5024-8035, 2019.
Momchil Peychev, Anian Ruoss, Mislav Balunovic, Maximilian Baader, and Martin Vechev. Latent space smoothing for individually fair representations. In European Conference Computer Vision, pp. 535-554, 2022.
Joshua Robinson, Li Sun, Ke Yu, Kayhan Batmanghelich, Stefanic Jegelka, and Suvrit Sra. Can contrastive learning avoid shortcut solutions? In 35th Conference on Neural Information Processing Systems, pp. 4974 4986, 2021.
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander C. Berg, and Li Fei-Fei. ImageNet large scale visual recognition challenge. International Journal of Computer Vision, 115(3):2112253 2015.
Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adversari- ally robust imagenet models transfer better? In 33rd Conference on Neural Information Processing Systems, pp. 3533-3545, 2020.
Ali Shafahi. Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! In 33rd Conference on Neural Information Processing Systems, pp. 1358-3369, 2019.
Sahil Singla and Soheil Feizi. Salient ImageNet: How to discover spurious features in deep learning? In International Conference on Learning Representations, 2022.
Ryan Steed and Aylin Caliskan. Image representations learned with unsupervised pre-training contain human-like biases. In ACT Conference on Fairness, Accountability, and Transparency, pp. 701-713, 2021.
Pierre Stock and Moustapha Cisse. ConvNets and ImageNet beyond accuracy: Understanding mistakes and uncovering biases. In European Conference on Computer Vision, pp. 504-519, 2018.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. International Conference on Learning Representations, pp. 23296-23308, 2014.
Yonglong Tian, Dilip Krishnan. and Phillip Isola. Contrastive multiview coding. In European Conference Computer Vision, pp. 776-794, 2020.
13

---

Under review as a conference paper at ICLR 2023
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Tumne,, and Aleksander Madry. Ro- bustness may be odds with accuracy. In International Conference on Learning Representations, 2019.
Jonathan Uesato, Brendan O' O'Donoguue, Pushmeet Kohli, and Aaron Oord. Adversarial risk and the dangers of evaluating against weak attacks. In 35th International Conference on Machine Learning, pp. 5025-5034 2018.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is All you Need. In 30th Conference Neural Information Processing Systems, 2017.
Pauli Virtanen, Ralf Gommers, Travis E. Oliphant, Matt Haberland, Tyler Reddy, David Cournapeau, Evgeni Burovski, Pearu Peterson, Warren Weckesser, Jonathan Bright, Stéfan J. der Walt, Matthew Brett, Joshua Wilson, K. Jarrod Millman, Nikolay Mayorov, Andrew R. J. Nelson, Eric Jones, Robert Kern, Eric Larson, CJ Carey, ilhan Polat, Yu Feng, Eric W. Moore, Jake VanderPlas, Denis Laxalde. Josef Perktold, Robert Cimrman, lan Henriksen, E. A. Quintero, Charles R. Harris, Anne M. Archibald, António H. Ribeiro, Fabian Pedregosa, Paul van Mulbregt, and SciPy 1.0 Contributors. SciPy 1.0: Fundamental algorithms for scientific computing in Python. Nature Methods, 17:261-272. 2020.
Haohan Wang, Xindi Wu, Zeyi Huang, and Eric Xing. High-frequency component helps explain the generalization of convolutional neural networks. In /EEE/CVF Conference on Computer Vision and Puttern Recognition (CVPR), pp. 8681-8691, 2020.
Zekai Wang and Weiwei Liu. Robustness verification for contrastive learning. In Proceedings of the 39th International Conference on Machine Learning, pp. 22865-22622 228833, 2022.
Zhenda Xie, Yutong Lin, Zheng Zhang, Yue Cao, Stephen Lin, and Han Hu. Propagate yourself: Exploring pixel-level consistency for unsupervised visual representation learning. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 16679-16688, 2021.
Jure Zbontar, Li Jing, Ishan Misra, Yann LeCun, and Stephane Deny. Barlow Twins: Self-supervised learning via redundancy reduction. In Proceedings of the 38th International Conference Machine Learning, pp. 12310-12320, 2021.
Runtian Zhai, Chen Dan. Di He, Huan Zhang, Boqing Gong, Pradeep Ravikumar, Cho-Jui Hsich, and Liwei Wang. MACER: attack-free and scalable robust training via maximizing certified radius. In International Conference on Learning Representations, 2020.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In Proceedings of the 36th International Conference Machine Learning, pp. 7472-7482, 2019.
Yonggang Zhang, Mingming Gong, Tongliang Liu, Gang Niu, Xinmei Tian, Bo Han, Bernhard Schölkopf, and Kun Zhang. Adversarial robustness through the lens of causality. In International Conference on Learning Representations, 2022.
14

---

Under review as a conference paper at ICLR 2023
A EXAMPLES OF LOSS-BASED ATTACKS
In this appendix demonstrate how various supervised and unsupervised attacks can be represented as loss-based attacks. This generalizes the unifying view presented by Madry et al. (2018) by incorporating also unsupervised attacks. We also illustrate the resulting structure of which attacks are generalizations of other attacks in Fig. 5. the following, T(x) is the true class of the instance r, T(2) is any other class, (xx) is function that returns a sample from D such that o (xz) * and <(x) provides a different view of x, e.g. different augmentation.
A.1 EXAMPLES OF INSTANCE- WISE LOSS- ATTACKS (C-FGSM, L-PGD, C-BIM)
The supervised FGSM and PGD attacks can be considered as special cases of the unsuper- vised J'-FGSM and L'-PGD, where f is a classifier rather than an encoder and we use classification loss:
Untargeted FGSM attack: f.-FGMM with z(f.z) fa((())
Targeted FGSM attack: J'-FGSM with z(f = =a)(
Untargeted PGD attack: .L-PGD with (f,xr, La(f(
Targeted PGD attack: L'-PGD with L' 2. = -da((((.),
The U-LGSM and U-PGD attacks can be represented as LL-FGSM and 2'PPGD attacks where the loss is the divergence d:
Untargeted U-FGSM attack: L.-FGSM with -(f,)) d(f(z), n)).
Targeted U-FGSM attack: L-FGSM with L(f(x) d(f()),
Untargeted U-PGD attack: .L'PGD with L((f,2 d(f().).
Targeted U-PGD attack: L'PGD with _(,,r,ū,) = -d(((E,)
Untargeted U-PGD with the Kullback-Leibler divergence corresponds to the adversarial example generation process of UAT-OT (Alayrac et al., 2019) which is based on the Virtual Adversarial Training method for semi-supervised adversarial learning (Miyato et al., 2019). Untargeted U-PGD with the Kullback-Leible also corresponds to the robustness regularizer proposed by Nguyen et al. (2022).
Cemgil al. (2020) propose an unsupervised attack for Variational Auto-Encoders (VAEs) (Kingma & Welling, 2014) based on the Wasserstein distance. It can be represented as the untargeted U-PGD attack with the Wasserstein distance, or equivalently, as the LLPGD attack with the loss
L() W (M((())) ((())) M((() [((())))))
where / is the Wasserstein distance, 77 is the normal distribution, I the identity matrix and the subscripts μ and designate the respective outputs of the VAE encoder f.
The BYORL method by Gowal et al. (2020) is equivalent the untargeted U-PGD attack when the divergence d is chosen to be the cosine similarity.
The instance-wise unsupervised adversarial attack proposed by Kim et al. (2020) is equiva- lent to LPD with the contrastive loss
exp (f(E.)
x( - -log exp (((()))((((())TTT)))((((( + exp (f(a.) f(o(z))/T)
where T' is a temperature parameter. This loss encourages that the cosine similarity between the adversarial example and another view of the same sample small relative cosine similarity between the adversarial example and another sample from D.
The concurrent work by Kim al. (2022) proposing targeted adversarial self-supervised learning can also be considered to be an instance of the targeted L''PGD attack.
Using the NT-Xent loss with L-PGD results in the attack used for the Adversarial-to- Standard adversarial contrastive learning proposed by Jiang et al. (2020).
15

---

Under review as a conference paper at ICLR 2023
L-FFGMM
L-PGD
.L-FGSM
(Ho & Vascon- celos, 2020)
AtA, DS (Jiang et al., 2020)
LPPGD
(Fan et al., 2021)
Untargeted U-FGSM
Targeted U-FGSM
AIS (Jiang et al., 2020)
Untargeted U-PGD
(Kim al., 2020)
(Kim et al., 2022)
Targeted U-PGD
Untargeted FGSM
Targeted FGSM
Untargeted PGD
(Cemgil al., 2020)
(Alayrac al., 2019)
(Nguyen
(Gowal al., 2022) al., 2020)
Targeted PGD
Figure 5: The hierarchy of supervised and unsupervised attacks.
A.2 EXAMPLES OF BATCH-WISS LOSS-BASED ATTACKS (f-FGSM, LGG. L -BM)
Any L'-FGSM attack with loss L is trivially an L'FGSMM attack by taking N and considering the loss function _ L.
Similarly, any L'PGD attack is trivially an L'-GG attack.
The adversarial attack proposed by Ho & Vasconcelos (2020) is equivalent to L-FGSM with the contrastive loss
exp(S(xx)] exp(/(())T<<<(()))) ((((x:))T
x) log 1=1 cxp
Here adversarial examples are selected to jointly maximize the contrastive loss.
The adversarial training of AdvCL generates adversarial attacks by maximizing multi-view contrastive loss computed over the adversarial example, two views of and its high- frequency component (ighPass(r) (Fan et al., 2021). It corresponds to L'PGG with the loss
1 N
8(f.X,8,,)
L' (21( 24,u, HighPass (z:); X),
exp(sim(f(z)) f2z))) (2z))/T)
L 2mi f.mifx)=
log
Laxx _me(m exp(sim (s (f(z), ((s())))))
1=1
with sim(-,-) being the cosine similarity.
Using the NT-Xent loss and the fPGGD attack on pair views of x is identical to the Adversarial-to Adversrrrial and Dual Stream adversarial contrastive learning methods by Jiang et al. (2020).
B EXTENDED RESULTS
This appendix presents more comprehensive experimental results in Tabs. 5 to and Figs, 6 to 11.
We consider ResNet50 (penultimate layer) (He et al., 2016), a supervised adversarially trained ResNet50 (foc, 4/255, penultimate layer) (Salman et al., 2020) and the ResNet50-based self- supervised learning models MOCOv2 (200 epochs) (He et al., 2020; Chen et al., 2020d), MOCO with non-semantic negatives (+Patch, k=16384, a=3) (Ge al., 2021), PixPro (400 epochs) (Xie et al., 2021), AMDIM (Medium) (Bachman et al., 2019), SimCLRv2 (depth 50, width 1x, without selective kernels) (Chen al., 2020c), and SimSiam (100 epochs. batch size 256) (Chen & He, 2021). In addition to the ResNet50-boo based models, we also present results from two models with transformer architectures (Vaswani et al., 2017). MAE uses masked autoencoders (He et al., 2022) and its
16

---

Under review as a conference paper at ICLR 2023
Table 5: Extended results for ResNet50- based self- self-supervised models and unsupervised adversarially fine-tuned MOCOv2. Arrows show if larger or smaller values are better. UQ and RQ respectively designate values reported in universal and relative quantiles.
Standar RosN abbssed unsupervised models
Unsup, adv. fine-tuned MOCOv2
PixPro
AMDIM
SimCLR
SimSiam
Nonsem
MOCOv2
TAR
UNTAR
Z-PGD
Top-I accurscy
58.0%
62.3%
67.2%
62.7%
49.7%
67.4%
60.2%
59.9%
57.2%
Top-5 accurny
80.5%
82.2%
86.6%
85.2%
73.5%
87.7%
82.4%
82.2%
80.0%
Lowpass Top-1 accuracy
50.0%
52.7%
59.7%
56.3%
47.3%
62.2%
58.6%
58.2%
55.4%
Lowpass Top-5 accuracy
73.3%
73.9%
81.2%
80.2%
71.2%
84.0%
81.2%
80.7%
78.4%
1, distince
5 iter. (RQ)
80.5%
80.8%
75.0%
73.3%
61.5%
65.6%
93.0%
94,0%
95,4%
10 iter. (RQ)
67.9%
70.3%
65.8%
65.9%
46.5%
52, 19
87.4%
88.9%
91,66 11.6%
30 ker. (RQ)
45.6%
52.5%
45.3%
44.1%
28.3%
29.3%
72.4%
74.3%
79.9%
50 heer. (RQ)
37.6%
44.3%
36.4%
28.1%
22.2%
20.5%
62.8%
64.8%
71.6%
L. distance
5 Bor. (RQ) 1
85.5%
62.0%
89.4%
76.0%
62.2%
65.2%
93.3%
94.3%
95.6%
= D.05
(RQ)
69.4%
46.8%
76.7%
66.9%
46.0%
52.3%
87.8%
89.3%
91.9%
(RQ)
39.9%
29.4%
43,4%
45,7%
27.3%
72.5%
74.9%
80.2%
Box.. (RQ)
30.7%
24.2%
32.7%
28.4%
21.1%
20.5%
62.9%
65.2%
72.0%
Targeta U-PGD aiteck
simmleci
5 Ber.
0.89
0.49
0.40
0.09
0.98
0.57
0.29
0.29
0.32
10 iior.
0.92
0.59
0.57
0.18
0.99
0.75
0.34
0.34
0.36
30 licr.
0.97
0.78
0.83
0.74
1.00
0.93
0.51
0.50
0.47
lter.
0.98
0.84
0.90
0.91
1,00
0.97
0.64
0.62
0.56
&, distance
(RQ2) f
83.1%
85.6% 69.6%%
78.0%
78.1%
64.3%
68. 68.7%
93.0%
93.9%
25.2%
iee.. (RQ)
71.2%
75.9%
69.0%
70.4%
48.6%
55.0%
87.2%
88.6%
91.1%
30 fier. (RQ)
47.2%
56.4%
48.6%
48.0%
29. 0%
31.4%
70.9%
72.5%
77.9%
50 Ber. (RQ)
38.1%
47.3%
38.6%
30.3%
22.3%
21.9%
59.7%
61.2%
68.2%
c, distance
5 Ser. (RQ)
89.0%
68.0%
90.9%
78.6%
65.8%
68.8%
93.1%
94.1%
95.3%
==
fier. (RQ)
74.2%
54.0%
80.5%
69 69.4%
48.3%
58.4%
87.3%
88.9%
91.2%
Ber. (RQ)
42.1%
30.7%
48.6%
48.0%
28.0%
31.4%
70.9%
72.8%
78.2%
heer. (RQ1
31.2%
24.0%
35.3%
29.8%
21.2%
22.1% 1%
60.3%
62.1%
68.2%
Cosine simibritty
5 fier.
0.88
0.41
0.36
0.09
0.98
0.53
0.29
0.30
0.32
10 ber.
0.92
0.50
0.52
0.17
0.99
0.72
0.34
0.35
0.36
30 hier.
0.97
0.71
0.80
0.68
1.00
0.92
0.54
0.53
0.49
0.98
0.80
0.88
0.90
1.00
0.96
0.69
0.67
0.61
& disuacc
(UQ)
14.4%
81.3%
43.7%
72.6%
46.8%
65.1%
0.0%
0.0%
0.0%
(UQ)
85.6 6%6
98.5%
99.4%
98.6%
98. 1%
99.0%%
0.0%
0.0%
0.0%
30 ior (UQ)
99.9%
99.9%
99.9%
.%%9%
99.90 .%%
99.9%
9.8%
0.7%
0.0%
50 iter. (UQ)
99.9%
99.9%
99.9%
99.9%
99.9%
99.9%
75.4%
30.4%
3.4%
( distamce
5 iter. (UQ)
25.0%%
76.4%
64.2%
43.8%
51.7%
62.3%
0.0%
0.0%
0.0%
== 0,08
iter (UQ)
72.7%
95.7%
89.9%
96.8%
97.7%
98.7%
0.0%
0.0%
0.0%
(UQ)
97.4%
99.9%%
99.8%
99.99 99.9%
99. 9%
99.9%
15.1%
2.0%
0.1%
(UQ)
98.7%
99.9%
99.9%
99.9%
99.9%
99.9%
5.7%
Unargeted U-PGD ottuck
5 der.
0.88
0.44
0.63
0.30
0.97
0.49
0.98
0.98
0.99
Cosine siniteit
10 ite.
0.78
0.32
0.52
0.16
0.91
0.31
0.93
0.95
0.97
30 bet.
0.62
0.11
0.40
0.08
0.78
0.18
0.69
0.75
0.85
her.
0.56
0.04
0.36
0.06
0.73
0.15
0.52
0.59
0.72
& disaance
5 Harr (UQ) I
11.3%
92.1%
48.3%
65.7%
43.2%
69.3%
0.0%
0.0%
0.0%
(UQ)
77.5%
98.9%
98.7%
98.0%
96. 96.6%
98.8%
0.0%
0.0%
0.0%
iter. (UQ)
99.9%
99.9%
99.9%
99. 9%
99. 9%
99.9%
30.6%
6.1%
0.4%
50 iter. (UQ)
99.9%
99.9%
99.9%
99.9%
99.99 .%%9%
99.9%
91.7%
65,3%
18.4%
C. distance
5 fter. (UQ)
24.6%
87.1%
67.1%
43.8%
49.1%
63.6%
0.0%
0,0%
0.0%
0.10
10 iter: (UQ)
69.6%%
97.3%
89.5%
95.6%
96.0%
98.0%
0.0%
0.0%
0.0%
30 fter. (UQ)
97.4%
99.9%
99.8%
99.9%
99. 9%
99.9%
37.7%
11.2%
1.0%
(UO)
98.9%
99.9%
99.9%
99.9%
99.9%
99.9%
90.2%
66.6%
23.7%
Cosine simibbrity
iter.
0.89
0.37
0.54
0.21
0.96
0.41
0.94
0.95
0.98
10 det.
0.79
0.27
0.45
0.08
0.91
0.26
0.88
0.90
0.95
30 hee..
0.62
0.08
0.35
0.03
0.77
0.15
0.57
0.64
0.78
50 bor.
0.55
0.00
0.32
0.02
0.71
0.13
0.39
0.45
0.60
Breakaway risk
0.190%
0.414%
0.039%
0.146%
0.211%
0.254%
0.049%
0.001%
0.000%
Nearest neightbor accuracy
0.0%
0.1%
0.1%
0.0%
0.0%
0.0%
17.0%
35.6%
64.4%
Ovelaap risk
39.6%
34.3%
45.6%
40.7%
93.5%
91.8%
0.0%
0.0%
0.0%
Median adiversaiial margin
4.1%
2.7%
1.2%
1.6%
-27.2%
-16.5%
61.5%
67.5%
76.0%
Average Coriified Radius
0.14
0.02
0.24
0.21
0.14
0.22
0.30
0.30
0.31
3 itr.
43.0%
23.2%
40.0%
21.0%
48.7%
34.2%
18.9%
15.7%
15.2%
Impersonation
10 her.
71.3%
71.9%
74.5%
52.4%
75.5%
62.8%
60.1%
56.3%
54.6%
her.
83. 33.3%%
88.9%
85.6%
76.3%
83. K3.9%
74.4%
75.1%
69.5%
70.0%
ätr.
86.7%
91.0%
88.6%
80.6%
85.6%
76.4%
76.2%
71.8%
71.9%
17

---

Under review as a conference paper at ICLR 2023
ResNet50
MAE
0.4
MOCOV3
SimSiam
0.8
Pooroo AMDIM
MOCO Nonsem
Tradion of dataset.
Corthed accuraty
ResNei50
MOCOVS
0.2
0.4
PxPro
AMDIM
MAE
0.1
SimCLR
SimSiam
0.0
0.0
0.2
0.4
0.6
0.8
1.0
10
10
10a
Input radius
Cartified reprosentation radius
Figure 6: Certified accuracy of the standard mod- els on ImageNet.
Figure 7: Certified robustness of the standard models on PASS using center smoothing. The distribution of certified radii in R is reported as percentile of the clean representation distances. Smaller values indicate higher unsupervised ro- bustness.
ViT-Large variant. MOCOv3 a modification of MOCOv2 to work with a transformer backbone (ViT-Small) (Chen al., 2021).
We also apply the targeted and untargeted unsupervised adversarial fine-tuning techniques from the main text to the ResNet50 encoder and the targeted, untargeted and loss-based unsupervised adversarial fine-tuning to MOCOv3 to compare how our findings from Sec. 7 transfer to supervised learning encoders and transformers. We use the exact same attack types and parameter values for MOCOv2. The implementation details are in App. C.
For all models. we present top-1 and top-5 accuracy for both the standard and the lowpass settings in Tabs. 5 to 7. We report the results for the lz- and fo -iduueed divergences in representation space, iterations 5, 10, 30 and 50 for U-PGD attacks with both e 0.05 and e 0.10. The attacks are 0.001. These are reported as universal quantiles for
performed with d(x., x') = I x' ll2 and the untargeted attacks and relative quantiles for the targeted attacks. We also report the breakaway and overlap risks, as well the nearest neighbor accuracy. median adversarial margin, average certified radius and impersonation rates as in the main text. Figs. to show the certified robustness and accuracy of the models which were omitted from the main text.
Some of the models, including MOCOv2, are trained with contrastive objective based on the cosine similarity. Therefore, using the Euclidean distances as the divergence in representation space could be considered an unfair comparison as the adversarially trained models are optimized for while the standard models are optimized for the cosine similarity. Therefore, for targeted attacks, also report the median cosine similarity between the representations of the adversarial examples and the representations of the target samples. Higher values mean that the attack is more successful and that the model is less robust. For the untargeted attacks, we report the median cosine similarity between the representations of the adversarial examples and the representations of the original samples. Hence, higher values mean that the attack is less successful and the model is more robust. The results in Tabs. show that adversarial training with the fz-induced divergence leads also improvements when measuring the cosine similarity: the divergence that the standard models are trained for but the adversarial ones are not. This evidence supports our claim that the improvements we see from unsupervised adversarial fine-tuning are not due to choice of divergence.
B.1 SUPERVISED BACKBONE MODELS BASED ON RESNET50
In Tab. 6 and Figs. 8 and 9 compare the penultimate layer of ResNet50, the penultimate layer of ResNet50 trained with supervised adversarial training, as well as fine-tuned ResNet50 (same as the first model) using ResNet does not have a corresponding loss representation space due to its supervised nature. The technical details are in App. C.3.
targeted and untargeted U-PGD attacks. We did not consider .-PGD as
18

---

Under review as a conference paper at ICLR 2023
Table 6: Extended results for ResNet50, supervised adversarially trained ResNet50, and unsupervised adversarially fine-tuned ResNet50. Arrows show if larger or smaller values are better. UQ and RQ respectively designate values reported in universal and relative quantiles.
ResNet50
Sup. Robust
Unsup. line tuned ResNet50
ResNet50
TAR
UNTAR
Top-1 accuracy 1
74.1%
62.0%
65.2%
54.2%
Top-5 accuracy I
91.0%
82.1%
84.1%
76.2%
Lowpass Top-1 accuracy 1
67.7%
59.25
58.0%
Lowpass Top-5 accuracy
86.4%
79.8%
78.3%
distance
Her. (RQ)
66.4%
98.1%
69.5%
88.4%
10 iter. (RQ) 1
52.7%
96.5%
57.1%
80.6%
30 itr. (RQ) 1
33.5%
91.0%
37.4%
62.2%
50 iter. (RQ)
27.4%
86.9%
30.8%
52.0%
0.05
distamoe
Rcr. (RQ) 1
70.3%
98.6%
72.8%
92.5%
(RQ) 1
52.3%
(RQQ
31.3%
92.5%
35.8%
50 ier. (RQ)
24.5%
88.8%
28.7%
53.1%
Targeted U-PGD attack
Covine
similariy
10 fir.
Ser.
0.77
0.86
0.48
0.47
0.85
0.76
0.97
0.97
30 itr.
0.95
0.51
0.94
0.97
0.96
distance
(RQQ)
69.3%
97.9%
81.3%
89.2%
(RQ)
55.6%
96.0%
70.0%
81.4%
30 iter (RQ) 1
34.7%
89.4%
46.4%
61.1%
50 ier. (BQ)
27.9%
83.9%
36.9%
49.3%
distance
ier. (RQ) 1
74.3%
98.6%
90.1%
93.2%%
8-0,10
(RQ) 1
97.3%
78.0%
(RQ)
34.5%
46.7%
50 iter. (RQ)
27.0%
86.6%
34,8%
48.3%
fir.
0.74
0.47
0.67
0.97
Cisine simikanty
10 atr. |
0.84
0.48
0.76
0.97
30 seer
0.94
0.53
0.90
0.98
50 itr. 1
0.96
0.57
0.94
iter. (UQQ 1
93.4%
iter. (UQ)
99.9%
0.0%
0.7%
30 iter. (UQ)
99.9%
0.0%
99.9%
21.4%
50 iter. (UOQ)
99.9%
0.0%
99.9%
47.6%
t.. dintamce
iter. (UQQ) 1
74.1%
0.0%
88.8%
0.8%
10 iter. (UQ) 1
99.3%
0.0%
97.9%
4.7%
(UQQ
99.9%
(UQ)
0.0%
Unargeted U-PGD attck
Ser.
0.72
0.99
0.69
1.00
Covine sinikeiyt
10 ic..
0.64
0.99
0.63
0.99
30 act.
0.56
0.95
0.56
0.98
50 str.
0.52
0.91
0.53
0.96
divancc
iter. (UQ)
99.4%
0.0%
34.4%
0.4%
(UQ) |
0.0%
2.5%
30 iter.
99.9%
0.1%
99.9%
34.7%
50 iter. (UQQ 1
99.9%
0.9%
99.9%
65.4%
C, distance
iter. (UQQ)
78.6%
0.0%
84.9%
1.9%
10 iter. (UQQ 1
99.0%
0.0%
93.3%
6.9%
30 iter. (UQ) 1
99.9%
0.4%
99.9%
39.6%
50 iter. (UTQ)
99.9%
4.3%
99.9%
64.6%
str.
0.68
0.69
0.99
Cosine Sinzaritt
10 scr.
0.62
0.94
0.63
0.99
30 ster
0.54
0.86
0.55
0.97
50 Act.
0.52
0.78
0.53
0.94
Breakaway risk
0.120%
0.000%
0.073%
0.111%
Nearest neighboor accuracy
0.0%
95.0%
0.0%
2.0%
Overlap
92.5%
0.0%
78.5%
0.9%
Median adversarial margin
-8.6%%
84.9%
-9,8%
47.6%
Average Coniified Radius
0.11
0.13
0.22
0.16
Acx.
41.5%
6.4%
25.3%
25.3%
Impersonation
10 iter.
76.5%
49 49.9%
70.2%
63 63.6%
rute
30 ite. 1
83.7%
85.3%
80.7%
89.9%
19

---

Under review as a conference paper at ICLR 2023
ResNei5
0.35
ResNetS0 UNTAR
0.8
Robust ResNet50
fradion or dataset.
Centices acuuni
0.25
0.20
0.4
0.10
RecNet50
0.2
ResNetbo 1AR
ResNei50 UNTAR
Robust ResNet50
0.0
0.2
0.4
0.6
0.8
1.0
10 Cartified reprosentation radius
10
10a
Input radius
Figure 8: Certified accuracy of Robust ResNet50, ResNet50 and its adv. trained variants on Ima- geNet computed via randomized smoothing. The adversarially trained models are uniformly certi- fiably more robust for almost all radius values.
Figure 9; Certified robustness of ResNet50 on PASS using center smoothing. The distribution of certified radii in R is reported as a percentile of the clean representation distances. Smaller values indicate higher unsupervised robustness.
1.0
0.10
MOCOV3 TAR
MDCOv3 UNTAR
0.8
Traction dateset
Centried accumoc
0.08
0.06
0.4
0.04
MODOVS
MOCOV3
0,02
MO00v3 UNTAR
0.0
MOCDVS 2-PGD
0.00
0.0
0.2
0.4
0.6
0.8
10
Input radius
Cartifie reposentation radius
Figure 10: Certified accuracy of MOCOv3 and its adversarially trained variants ImageNet computed via randomized smoothing. The adver- sarially trained models uniformly certifiably more robust for almost all radius values.
Figure 11: Certified robustness of MOCOv3 on PASS using center smoothing. The distribution of certified radii in R reported as a percentile of the clean representation distances. Smaller values indicate higher unsupervised robustness.
As mentioned in Sec. the supervised adversarially trained ResNet50 has by far the best robustness scores across all measures. It also significantly surpasses our unsupervised adversarialyy fine-tuned models. However, this is not enough to conclude that supervised adversarial training works better than unsupervised adversarial training. The supervised adversarially trained ResNet50 has been trained with attacks for 150 epochs, while our unsupervised adversarially trained models were fine-tuned for 10 epochs. Therefore, the gap in robustness could be due to the quantity of adversarial training rather than the quality of the technique.
Both the targeted and untargeted unsupervised adversarially fine-tuned ResNet50 models score better on all robustness measures than the standard ResNet50. The improvements are markedly larger for the untargeted fine-tuned model. Though this comes the price of lower accuracy and lower certified accuracy (Fig. 8). Furthermore, both models have very similar certified robustness, as shown in Fig. 9. Both the supervised adversarially trained and the unsupervised adversarially with untargeted attacks models have lower certified accuracy than the standard model at lower radií. However, they compensate that with higher certified accuracy for larger radii resulting in overall improvement the average certified radius (Tab. 6).
B.2 TRANSFORMER BACKBONE MODELS: MAE AND MOCOV3
Among the standard models, MAE outperforms the standard models on most measures. MAE has the highest accuracy of all models trained in the unsupervised regime, i.e. excluding the supervised
20

---

Under review as a conference paper at ICLR 2023
Table 7: Extended results for transformer-basee models and adversarially fine-tuned MOCOv3. Arrows show if larger or smaller values are better. UQ and RQ respectively designate values reported in universal and relative quantiles.
Transformer models
Unsup, adv. fine-tuned MOCOx3
MAE
MOCDv3
TAR
UNTAR
Z-PGD
Top-I accuracy
71.8%
68.6%
67.9%
66.5%
63.3%
Top-5 necumecy
88.9%
87.7%
87.5%
86.6%
85.8%
Lowpass Top-1 accuracy
66.2%
63.4%
64.2%
63.3%
62.6%
Lowposs
Top-5 securacy
85.1%
83.8%
84.7%
84.0%
83.4%
1s distance
5 itrr. (RQ)
80.6%
72.0%
86.2%
87.1%
89.8%
10 iter. (RQ)
66.3%
63.2%
77.3%
79.3%
82.3%
30 iter. (RQ)
42.2%
31.0%
50.6%
49.9%
47.8%
iter. (RQ)
33.7%
20.3%
31.3%
30.6%
26.2%
L. distonce
5 iter. (RQ) 1
72.4%
72.6%
87.9%
89.0%
90.5%
0.05
(RQ)
54.4%
(RQ)
27.6%
30.6%
52.3%
51.3%
48.3%
iter. (RQ)
20.0%
19.7%
32.1%
30.4%
26.2%
Targeted U. U.PGD atback
Cosine simblarit
5 iter.
0.99
0.26
0.06
0.06
0.06
10 iter.
0.99
0.44
0.14
0.14
0.15
iter.
1.00
0.91
0.65
0.70
0.76
1.00
0.96
0.89
0.91
0.94
t, distance E distance
(RQ)
83.6%
76.1%
87.2%
89.2%
91.2%
iter. (RQ)
71.7%
66. 9%
78.8%
81.0%
83.4%
30 iter. (RQ)
44.7%
33.7%
51.5%
47.9%
46, 1%
50 iter. (RQ)
33.7%
21.4%
30.5%
27.9%
24.2%
5 iter. (RQ) 1
76.4%
76.1%
88.7%
90.2%
91.8%
--0.0
(RQ)
60.6%
64.9%
(RQ)
29.5%
33.0%
iter. (RQ)
20.3%
20.7%
31.2%
27.8%
24.7%
similirity
5 iter.
0.99
0.26
0.06
0.06
0.07
10 iter.
0.99
0.42
0.14
0.16
0.17
30 iter.
1.00
0.90
0.63
0.77
0.80
iter.
1.00
0.96
0.90
0.94
0.95
Es distance
(UQ)
91.1%
0.4%
0.1%
(UQ)
68.7%
99 0%
36.0%
4.9%
0.5%
30 icr. (UQ)
99.9%
99.8%
99.3%
98.7%
96.5%
50 iter. (UQ)
99.9%
99.9%
99.8%
99.9%
99.9%
t. dismmee
5 iter. (UQ)
8.7%
88.2%
1.7%
0.4%
0.1%
c- 0.05
10 iter. (UQ)
40.3%
99.0%
35.9%
4.1%
0.7%
(UQ)
9%%9%%
98.3%
(UQ)
99.9%
99.9%
Unargend U.PGD sttuck
Cosine simblrit
5 iter.
0.99
0.22
0.72
0.74
0.80
10 iter.
0.98
0.12
0.47
0.56
0.68
30 iter.
0.26
0.07
0.16
0.10
0.16
iter.
-0.12
0.06
0.12
0.05
0.08
G disance
itrr. (UQ)
58.9%
91.6%
3,4%
0.8%
0.1%
(UQ)
0%
9.5%
1.0%
(UQ)
99.9%
99. 8%
99.5%
99.3%
98.9%
50 iter. (UQ)
99.9%
99.9%
99.9%
99.9%
99.9%
C, disaace
5 iter. (UQ)
50.5%
92.3%
3,4%
0.8%
0.2%
c- 1--0.00
10 iter. (UQ)
99.5%
99.2%
42. 8%
8.7%
1.4%
30 iter. (UQ)
99.9%
99.9%
99.4%
99.2%
98.4%
(UQ)
99.9%
99.9%
99.9%
99.9%
Cosine simvlurit
0.99
0.16
0.66
0.71
0.78
0.94
0.08
0.40
0.49
0.62
30 iter.
.0.06
0.03
0.13
0.08
0.12
50 iter.
-0.23
0.02
0.10
0.04
0.06
Breakaway ay risk
0.238%
0.230%
0.406%
0.401%
0.285%
Nearest neighber accuracy
0.0%
0.0%
0.0%
0.0%
0.0%
Overlap
19.8%
62.8%
9.6%
5.7%
4.4%
Madiaa adversarial margin
11.1%
-3.4%
Average Certified Radius
0.18
0.00
0.03
0.03
0.04
3 iter.
12.5%
21.0%
38.3%
29.7%
22.7%
Impersonation
iter.
43.2%
52.4%
77.5%
75.1%
76.0%
rate
74.6%
82.7%
93.4%
93. 13.
92.9%
90.2%
21

---

Under review as a conference paper at ICLR 2023
ResNet50. MAE also has some of the best robustness against targeted U-PGD attacks and is competitive to PixPro for the untargeted case. attains the lowest breakaway and overlap risks among all standard models as well as the largest median adversarial margin and is most robust to impersonation attacks.
In comparison, MOCOv3 scores rather poorly most measures. Hence, the robustness of MAE cannot be solely attributed to the transformer backbone. This complements the observed variation in robustness performance among the ResNet50 models and provides evidence that is likely the objective function, rather than the backbone architecture, that determines robustness.
The three adversarially trained MOCOv3 models witness a lower accuracy penalty than the corre- sponding MOCOv2 models: between 0.2% and 3,3% for the clean and between -0.9% and 0.8% for the lowpass accuracy for MOCOv3 compared with correspondingly 1.3%-10.2%% and 2.8%-6.8% for MOCOv2. In fact, the adversarially trained MOCOv3 TAR model has a higher lowpass accuracy than the standard MOCOv3. Unsupervised adversarial training also leads to a uniformly better robustness against targeted and untargeted U-PGD attacks, albeit with a lower improvement compared to MO- COv2. We similarly witness large improvements measures. The average certified radius and the certified accuracy (Fig. 10) are also significantly improved by adversarial training. Fig. 11 shows that the adversarially trained models are also more certifiably robust than the baseline MOCOv3.
the overlap risk and median adversarial margin
However, the three adversarially trained models actually fare worse than the baseline MOCOv3 for breakaway risk and are less robust impersonation attacks. The impersonation attacks are also less semantic in nature than the ones for the MOCOv2 adversarially trained models (Figs. 21 to 23 vs Figs. 26 28). This could also be due to the learning rate being too low, rather than due to transformer models being inherently more difficult to adversarially fine-tune in an unsupervised setting. The lower accuracy gap and the lower robustness further indicate that the adversarial training might not have been as "aggressive" for MOCOv3 as it was for MOCOv2. Still, while the improvements for MOCOv3 are not as drastic as for MOCOv2, unsupervised adversarial training does improve most robustness measures. The lower effectiveness for MOCOv3 of unsupervised adversarial training, especially in its role as a defence against impersonation attacks, an avenue for future work that should examine whether there are fundamental differences between unsupervised adversarial training of CNN and Transformer models.
C TRAINING AND EVALUATION DETAILS
This section provides further details on the unsupervised adversarial training and the evaluation metries implementations.
C.I UNSUPERVISED ADVERSARIAL TRAINING FOR MOCOv2
The three variants for the adversarially fine-tuned MOCOv2 are obtained by using a modification of the official MOCO source code. We perform additional 10 epochs but with the modified training loop. The unsupervised adversarial examples are concatenated to the model's q-inputs and the k-inputs are correspondingly duplicated as shown in List. 1. For LPGGD we use InfoNCE (Oord et al., 2018), the loss that MOCOv2 trained with. All parameters, including the learning rate and its decay are as used for the original training and as reported by He et al. (2020). We only reduced the batch size from 256 to 192 in order to be able to train on four GeForce RTX 2080 Ti GPUs.
by resuming the training procedure for
Listing 1: Pseudocode of adversarial fine-tuning for MoCo (modified from (He et al., 2020)).
f_g, f_k: encoder networks for query and key queue: dictionary as a queue of K. keys (CxK) m: momentum
temperature
f. k.k.param f.q. paramas F initialize
for in lcader: # load minibatch x with N samples
x_q aug(x) (x) randomly augmented version
22

---

Under review as a conference paper at ICLR 2023
x_k aug(x) another randemly augmented version
perform the attack
switch attack_type:
case targeted:
target_representatio. roll(f_q(x_k), shifts-1)
__adv cargeted_upge (x_q, target_
case untargeted: adv untargeted_upgll..
case less:
x_adv batch_loss_upgd 8_9 f_k, x_k, queue, m, t)
get the representations
q_clean f_q. forwrrd
queries: NxC
aaa = f_q. (x
adversarial; NxC = cat ([q_clean, g_adv], dim=0)
for.forwadd F keys: NxC
k.detach() no gradient keys
positive logits: 2Nx1
I pos = bmm bum
cat (lk, k), dim=0) wveww (2*M, c, 1
negative logits: 2NxK
neg = view C), queue. (C,
logits: 2Nx (1+K)
logits - cat pos, L_nel, dim=1) contrastive loss
labels zeros (2N) positives the 0-th
loss CrossEntropyLoss (logits/t, labels)
SGD update: query network
loss. loss.oosccle wtt.kaarckw))))
update (f_q.params)
momentum update: key network
f_k. Fak.parmms mar_akppramst (1-m) +f.. update dictionary
enqueue (queue, k) # enqueue the current minibatch dequeue (queue) dequeue the earliest minibatch
C.2 UNSUPERVISED ADVERSARIAL. TRAINING FOR MOCOV3
Similarly to MOCOv2, the three variants for the adversarially fine-tuned MOCOv3 are obtained by using a modification of the official MOCOv3 source code. We perform fine-tuning by resuming the training procedure for additional 10 epochs but with the modified training loop. The unsupervised adversarial examples are added to the contrastive loss as shown in List. 2. All parameters, are used for the original training and as reported by Chen et al. (2021). We only increased the learning rate from 1.5 10 4 1.5 10 and reduced the batch size from 256 192 in order be able train on four Geffrce RTX 2080 Ti GPUs.
Listing 2: Pseudocode of adversarial fine-tuning for MOCOv3.
f f_base: base encoder network
f [prreiccoo: predictor network
m: momentum
w.mommeetttt um. params params f L_baas.ppran initialize momentum encoder
for in lcader: # load minibatch with N samples x_0 aug (x)
randomly augmented version
x aug (x) # another randomly augmented version
perform the attack switch attack_type:
23

---

Under review as a conference paper at ICLR 2023
targeted:
target_representation rollif_predictor (f_base (x_1)), shifts=1) __ady uprg (x_0, target_representatioon)
case untargeted:
__a untargeted_ (x_0)
case loss:
ady lotsch
t_predictor, x_0, x_
update the momentum encoder mwmemttumppaams.. ummmennuu.ppaaaaee m f_base, params (1-m)
get the base representations
9_0 predictor forward base. 00) x_ reps: NxC
9_ f_predictor, forward (f_ base. (xr x reps: NxC
adv = f_prodictor. (fo.aorrr..oorrrrf__aooooo (x attacked reps: NxC
get the momentum representatiens
k_0 =_mementum. forward (x_0) x_0 reps: NxC
k_1 [_momentumm. forward (x_1) x_1 reps: NxC
k adv f u_moment.um forward (x_adv) # attacked reps: NxC
compute the loss
loss contrastive_ (g_0, k_1) contrastive_loss (q_1 k_0) +
contrastive_lose (d_adv, k_1) + contrastive_loss (q], k_adv)
parameter update: query network
loss bbckkardd()))
update (aeattee_qq.paaa (f_q.params)
C.3 UNSUPERVISED ADVERSARIAL TRAINING FOR RESNET
The two unsupervised adversarially fine-tuned ResNet50 models are obtained by using an implemen- tation similar the one for MOCOv2 and MOCOv3. However, as the ResNet model is trained in supervised setting there is no natural contrastive loss to use. That is why we use the MSE loss on the representations. For the targeted case, we also ensure that the clean samples are still mapped to the original representations, The full procedure is outlined in List. 3.
Listing 3: Pseudocode of adversarial fine-tuning for ResNet.
F base: base encoder network f_finctuned; the finctuned network
f_finetuned, params f_aase params initialize momentun. encoder
for x in loader: # load a minibatch x with N samples aug (x) # randomly augmented batch
clean reps base (x)
perform the attack
switch attack_type:
case targeted:
target_repressntaate
rcll shifts=1)
x_adv targeted_ upgdd_pppp (x, sareet_representation)
loss = MSELoss (cat ([clean_reps, clean_reps]] axis=0),
f (cat [x, x_adv], axis=0))
case untargeted:
__a untargeted_upgd (x)
cos MSKLoss (clean_reps, f_funetuned (x_adv))
24

---

Under review as a conference paper at ICLR 2023
parameter update
loss .backward update (f_ (f_finetuned, params)
C.4
LINEAR PROBES
As part of the evaluation train three linear probes for each model.
Standard linear probe: for computing the top-1 and top-5 accuracy clean samples, as well as for the impersonation attack evaluation.
Lowpass linear probe: for computing the top-1 and top-5 accuracy on samples with removed high-frequency components. We use the implementation of Wang al. (2020) and keep only the Fourier components that are within a radius of 50 from the center of the nourier-transformeet image.
Gaussian noise linear probe: trained on samples with added Gaussian noise for computing the certified accuracy as randomized smoothing results in more robust model when the base model trained with aggressive Gaussian noise (Lecuyer et al., 2019). Therefore, we add Gaussian noise with 0.25 to all inputs.
All linear probes are trained with the train set of ImageNet Large Scale Visual Recognition Challenge 2012 (Russakovsky et al., 2015) and are evaluated on test set. For training we use modification of the MOCO linear probe evaluation code for 25 epochs. The starting learning rate is 30.0 with 10-fold reductions applied at epochs and 20.
For fairness of the comparison, there might be differences between the accuracy values reported by us and the ones reported in the original publications of the respective models.
the same implementation to evaluate all models. Therefore,
C.5 COMPUTING THE DISTRIBUTION OF INTER INTEE-REPPRSSENTTIIONNL DIVERGENCES
The distribution of and -icducde divergences between the representations of clean samples of PASS (Asano et al., 2021) is needed for computing the universal and relative quantiles. Due to computational restrictions, we compute the representations 10,000 samples and the divergences between all pairs of them in order to construct the empirical estimate of the distribution of inter- representational divergences. We observe that 10,000 samples are more than sufficient for the empirical estimate of the distribution to converge.
C.6 ADVERSARIAL ATTACKS
In Tabs. 2, 3 and 5 to report U-PGD attacks performed with d(x,,'' || x/11, and a 0.001. We report median values over the same 1000 samples from PASS (Asano et al., 2021). The median universal quantile is reported for targeted attacks and the median relative quantile is reported for targeted attacks as explained in Sec. 5. In Tabs. 2 and 3 we report only the resulting '2 quantiles, while the extended results (Tabs. to we also show the fo quantiles and cosine similarities.
C.7 BREAKAWAY RISK AND NEAREST NEIGHBOR ACCURACY
The breakaway risk and nearest neighbor accuracy are also computed by attacking the same 1000 samples from PASS (D') and computing their divergences with all other samples from PASS (D). Our empirical estimate is then
Σ Σ
Phreakaway
D'(
EE (T.D/(m.)
where &; the untargeted U-PGD attack with d(x,x')= = || 21112,- 0.05 and a = 0.001 for 25 iterations.
25

---

Under review as a conference paper at ICLR 2023
C.8 OVERLAP RISK AND MEDIAN ADVERSARIAL MARGIN
The overlap risk and median adversarial margin are computed over 1000 pairs of samples from PASS (D'). Each element of the pair is attacked to have representation similar to the other element.
1
Σ
Poveriap
|
(2,z")ED'
where i, is the targeted U-PGD attack on towards 2, with d(x,, x') = || x x'1l2- = 0.05 and 0.001 for 10 iterations.
C.9 CERTIFIED ACCURACY
We use the randomized smoothing implementation by Cohen et al. (2019). We evaluate the Gaussian noise linear probe (see App. C.4) over 200 samples from the ImageNet test set (Russakovsky et al., 2015). We use = 0.25, No = 100, N = 100, 000 and an error probability a = 0.001, as originally used by Cohen al. (2019). Figs. 3 and 10 show the resulting certified accuracy for MOCOv2, MOCOv3, and their unsupervised adversarially trained versions. Fig. 6 shows the certified accuracy for the other models. These plots show the fraction of samples which are correctly classified and which certifiably have the same classification within a given & radius of the input space.
Tabs. 5 to 7 also show the Average Certified Radius for all models. The Average Certified Radius was proposed by Zhai et al. (2020) as a way to summarize the certified accuracy vs radius plots with single number. The average certified radius be computed
ACR Σ [correct((:)] certified (z) ZED
C.10 CERTIFIED ROBUSTNNESS
The certified robustness evaluation in Figs. 4 and 10 was done with the center smoothing implemen- tation by Kumar & Goldstein (2021). We evaluate the models over the same 200 samples from the ImageNet test set (Russakovsky et al., 2015). We use a 0.25, No = 10, 000, 100, 000 and error probabilities a1 = 0.005, 02 0.005, as originally proposed by Kumar & Goldstein (2021).
C.11 IMPERSONATION ATTACKS
The impersonation attack evaluation is performed using targeted U-PGD attacks. We the Assira dataset that contains 25,000 images, equally split between cats and dogs (Elson et al., 2007). When evaluating model, consider only the subset of images that the standard linear probe (see App. C.4) for the given model classifies correctly. Then, we construct pairs of an image of a cat and an image of a dog. We perform two attacks: attacking the cat have representation as close as possible that of the dog and vice-versa. The attacked images are then classified with the clean linear probe. The success rate of cats impersonating dogs and dogs impersonating cats are computed separately and then averaged to account for possible class-based based differences. Note that the linear probe is nor used for constructing the attack, i.e. we indeed fool it without accessing it. App. shows examples the impersonation attacks for all models.
D IMPERSONATION ATTACKS
This appendix showcases samples of the impersonation attacks on the models discussed in the paper. The first and third row in each sample are the original images of cats and dogs respectively. The second row is the result when each cat image attacked to have a representation close to the representation of the corresponding dog image. The fourth row is the opposite: the dog image attacked to have representation close to the representation of the cat image. The attack used was targeted U-PGD with d(r, r') ||r r'll2 for 50 iterations with 0.10 and 0.01. The samples shown differ from model to model as we restrict the evaluation to the samples that are correctly predicted by the given model, see App. C.11 for details.
26

---

Under review as a conference paper at ICLR 2023
A key observation is that the perturbations necessary fool the standard models visually appear as noise (Figs. 12 and 16 to 20). However, the perturbations applied to the three adversarially trained MOCOv2 models (Figs. 21 to 23), well as the supervised adversarially trained ResNet50 (Fig. 13), are more "semantic" nature, and some cases even resemble features of the target class. Still, this not the when comparing the impersonation attacks MOCOv3 (Fig. 25) with the attacks the adversarially trained versions (Figs. 26 to 28).
Figure 12: Impersonation attack samples for ResNet50 (He et al., 2016).
Figure 13: Impersonation attack samples for supervised adversarially trained ResNet50 (Salman
al., 2020).
27

---

Under review as a conference paper at ICLR 2023
Figure 14: Impersonation attack samples for ResNet50 TAR.
Figure 15: Impersonation attack samples for ResNet50 UNTAR.
Figure 16: Impersonation attack samples for MOCO with non-semantic negatives (Ge et al., 2021).
28

---

Under review as a conference paper at ICLR 2023
Figure 17: Impersonation attack samples for PixPro (Xie al., 2021).
Figure 18: Impersonation attack samples for SimCLRv2 (Chen et al., 2020c).
Figure 19: Impersonation attack samples for SimSiam (Chen & He, 2021).
29

---

Under review as a conference paper at ICLR 2023
Figure 20: Impersonation attack samples for MOCOv2 (He al., 2020; Chen et al., 2020d).
Figure 21: Impersonation attack samples for MOCOv2 TAR.
Figure 22: Impersonation attack samples for MOCOy2 UNTAR.
30

---

Under review as a conference paper at ICLR 2023
Figure 23: Impersonation attack samples for MOCOv2 LOSS..
Figure 24: Impersonation attack samples for MAE (He et al., 2022).
31

---

Under review as a conference paper at ICLR 2023
Figure 25; Impersonation attack samples for MOCOv3 (Chen al., 2021).
Figure 26: Impersonation attack samples for MOCOy3 TAR.
32

---

Under review as a conference paper at ICLR 2023
Figure 27: Impersonation attack samples for MOCOV3 UNTAR.
Figure 28: Impersonation attack samples for MOCOy3 LOSS.
33


Reviews:
[{"review_id": "l902qlnji3", "reviewer": "Reviewer_rApq", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes several evaluations of unsupervised robustness which are model agnostic and tasks agnostic. This paper examines recent unsupervised models with proposed unsupervised robustness evaluations. Specifically, the paper proposes universal quantiles for untargeted attacks and relative quantiles for targeted attacks as an evaluation metric for unsupervised robustness. The former metric represents the percentage of paired samples that are closer than the clean and adversarial pairs. The latter metric represents the ratio that the targeted attack moves the original image to the target image.", "summary_of_the_review": "Overall, I recommend marginally below the acceptance threshold. Because whether the proposed evaluation metric could represent robustness seems unclear I hope the authors could resolve my concerns in the rebuttal.", "strength_and_weaknesses": "**Strength**\n- This paper first tackles the problem that previous unsupervised adversarial methods only evaluated the classification task as a downstream task. To overcome such limitations, this paper proposes evaluation metrics that do not use any class labels.\n- The idea and the approach to making the evaluation metric for unsupervised robustness are quite novel to me.\n\n**Weakness**\n- I am not quite sure why proposed universal quantiles and relative quantiles are able to represent the robustness of the models. Intuitively, robust models could have a relatively low ratio of universal quantiles but these metrics could represent the vulnerability that induces wrong decisions or unintended actions in downstream tasks. I think the authors could describe how we can interpret these metrics in terms of robustness.\n- I think there is no big difference between U-PGD and L-PGD since the distance function is also a loss function. Further, KL divergence as a distance function could not be used in unsupervised models since there is no class probability in the unsupervised models. I might have missed but what kind of distance function is used for evaluation metric? Moreover, it seems that the L-PGD is already proposed in the previous unsupervised adversarial learning which seems to lack novelty.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "jO5iawtqU1", "reviewer": "Reviewer_TA8W", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes two unsupervised adversarial risks, i.e., breakaway risk and overlap risk, that evaluate the adversarial robustness without requiring labels. Further, this paper generates unsupervised adversarial attacks via FGSM and PGD maximizes or minimizes the distance between benign and adversarial data. The authors also propose to use adversarial training based on the unsupervised FGSM or PGD to improve the robustness. Then, this paper provides a series of robustness measurements and empirically shows that adversarial-trained models are more robust than standard-trained models.", "summary_of_the_review": "This paper proposes two unsupervised adversarial risks and realizes them based on PGD and conventional distance metrics. However, I have several concerns that have been illustrated in Weaknesses section to be solved. ", "strength_and_weaknesses": "Strength\n+ This paper proposes two interesting unsupervised adversarial risks based on the distance between benign and adversarial data. The risks indeed solve the problem that what value of the distance being “small”.  \n+ This paper gives several robustness metrics, including quantiles for (un)targeted attacks, estimation of breakaway risk and overlap risk, nearest neighbour accuracy, adversarial margin, and certified robustness.\n\nWeaknesses:\n- This paper seems to have minor technical novelty. The main techniques of adversarial attacks and adversarial training are based on PGD or FGSM and even the loss function is simply the conventional distance.\n- The relationship (such as differences and similarities) between breakaway risk and overlap risk is not very clear. I am confused about which risk really evaluates unsupervised adversarial robustness. \n- It is somewhat difficult to understand how the metric “universal quantiles for untargeted attacks” can evaluate robustness. This metric closely depends on the sampling procedure. It is hard to say a model is non-robust if the fraction of distance between $x’$ and $x’’$ is smaller than the distance between $\\hat{x}$ and $x$ is smaller since it could be incurred by the sampling procedure.\n- The claim that “the breakaway risk can be very small” is somewhat confusing. Due to this claim, the author proposes nearest neighbour accuracy. However, Table 2 seems to show that breakaway risk can better differentiate the robustness of each model than nearest neighbour accuracy since nearest neighbour accuracy is almost very low and the same among different models.\n- It seems that different unsupervised adversarial metrics do not provide a consistent evaluation. For example, in Table 2, ResNet50 has a lower breakaway risk while a higher overlap risk and PixPro has a higher breakaway risk while a lower overlap risk. Therefore, it is hard to compare the unsupervised robustness between these models using these two proposed metrics.\n- It is not very clear the relationship between unsupervised robustness evaluation and supervised robustness evaluation. Will the unsupervised robust accuracy and supervised robust accuracy be positively correlated between them?\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "6yX9Rfwa4jO", "reviewer": "Reviewer_v4fr", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper tackles the problem of quantifying and improving the robustness of representation models in a task-agnostic fashion. Being one of the first papers to approach the problem, the authors also motivate and provide a mathematical definition for unsupervised robustness. To evaluate the unsupervised robustness of the representation models, the authors propose a generalized attack framework and use it to propose a set of metrics representation-agnostic metrics that can be used to measure the relative robustness of various representation models. Using the attacks, the authors also train adversarially robust representation models and provide a detailed empirical analysis of the relative performance of different representation models with respect to each other and adversarially trained models.", "summary_of_the_review": "The paper points out and addresses an important problem for representation models. The paper approaches the problem by considering two possible sources of risk: breakaway risk and overlap risk. Then the authors use this to motivate various metrics for measuring the unsupervised robustness of the classifier. However, the later analysis does not use the estimated values of the two risks. So, I feel some of the empirical investigations are not well motivated. Some of the presented empirical results also need further investigation. Especially the impersonation bounds need to be recalculated with better attacks. The paper has some great ideas which could benefit the community, but I think it could use some rewriting.", "strength_and_weaknesses": "Strengths\n- The paper brings up an essential issue of the robustness of unsupervised representation models and identifies some novel task-independent metrics to measure their robustness.\n- The quantile-based metrics proposed in the paper give a representation-agnostic view of robustness that allows users to compare multiple representation models.\n- The authors also propose some adversarial training methods that improve the randomized smoothing-based certified robustness of the trained models. \n\nWeaknesses\n- Although the empirical attack evidence suggests that the adversarially trained representation models require more PGD iterations, this can also be explained by gradient masking. Moreover, these benefits are also not present for MOCOv3 models. Using a different attack method for the evaluation would resolve this issue.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "Not applicable"}, "extra_text": {}}, {"review_id": "5ZiSYi3uJDu", "reviewer": "Reviewer_HYfP", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "In this work, the authors define what it means for an encoder to be robust and describe metrics for measuring robustness.  Using these metrics, they then evaluate existing SOTA representation encoders with and without adversarial finetuning (based on the proposed metrics).", "summary_of_the_review": "I find this paper very interesting as it rigorously defines what it means for an encoder to be robust, and I think that the proposed metrics will be very useful to the adversarial ML research community especially since recently there have been works proposing methods for robust pretraining.  I am a little disappointed by the experiments though, not that they are bad or uninteresting, I just feel like the authors introduced a very powerful toolkit but did not use this toolkit to its full potential.", "strength_and_weaknesses": "Strengths:\n- Definitions for breakaway risk and overlap risk are well-motivated and easy to understand.\n- Interesting problem setting (measuring robustness without labels)\n- Well-motivated metrics\n- Show that fine tuning based on some of the proposed metrics can greatly improve robustness of encoder\n- Writing is clear\n\nWeaknesses:\n- The proposed metrics could be used to analyze encoders trained using any technique: supervised learning, self-supervised learning, and unsupervised learning, but the experiments are restricted to unsupervised encoders.  I think it would be interesting to perform evaluations on encoders of adversarially trained models (supervised learning but drop the final classifier layer) and see if these learned representations actually satisfy the definitions proposed.  Additionally, it would be interesting to see whether the pretraining approaches proposed by works for adversarially robust self-supervised learning (ie. Kim et al 2020) lead to more robust encoders.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject