Targeted Adversarial Self-Supervised Learning
Authors: Minseon Kim
Hyeonjeong Ha
Sooel Son
Sung Ju Hwang
Venue: Submitted to ICLR 2023 (2023)
Keywords: adversarial self-supervised learning
self-supervised learning
targeted attack
robustness

Abstract: Recently, unsupervised adversarial training (AT) has been extensively studied to attain robustness with the models trained upon unlabeled data. To this end, previous studies have applied existing supervised adversarial training techniques to self-supervised learning (SSL) frameworks. However, all have resorted to untargeted adversarial learning as obtaining targeted adversarial examples is unclear in the SSL setting lacking of label information. In this paper, we propose a novel targeted adversarial training method for the SSL frameworks. Specifically, we propose a target selection algorithm for the adversarial SSL frameworks; it is designed to select the most confusing sample for each given instance based on similarity and entropy, and perturb the given instance toward the selected target sample. Our method significantly enhances the robustness of an SSL model without requiring large batches of images or additional models, unlike existing works aimed at achieving the same goal. Moreover, our method is readily applicable to general SSL frameworks that only uses positive pairs. We validate our method on benchmark datasets, on which it obtains superior robust accuracies, outperforming existing unsupervised adversarial training methods. 

Under review as a conference paper at ICLR 2023
TARGETED ADVERSARIAL
LEARNING
Anonymous authors Paper under double-blind review
ABSTRACT
Recently, unsupervised adversarial training (AT) has been extensively studied to attain robustness with the models trained upon unlabeled data. To this end. previous studies have applied existing supervised adversarial training techniques to self- supervised learning (SSL.) frameworks. However, all have resorted to untargeted adversarial learning obtaining targeted adversarial examples is unclear in the SSL setting lacking of label information. In this paper, we propose a novel targeted adversarial training method for the SSL frameworks, especially for positive-pairs in SSL framework. Specifically, we propose a target selection algorithm for the adversarial SSL frameworks; it is designed to select the most confusing sample for each given instance based on similarity and entropy, and perturb the given instance toward the selected target sample. Our method significantly enhances the robustness of positive-only SSL model without requiring large batches of images or additional models, unlike existing works aimed at achieving the same goal. Moreover, our method is readily applicable to general SSL frameworks that only uses positive pairs. We validate our method on benchmark datasets, on which it obtains superior robust accuracies, outperforming existing unsupervised adversarial training methods.
INTRODUCTION
Enhancing the robustmess of deep neural networks (DNN) is critical challenge for their real-world applications. DNNs have been known to be vulnerable to adversarial attacks using imperceptible perturbations (Goodfellow et al., 2015), corrupted images (Hendrycks & Dietterich, 2019), and images with shifted distributions (Koh et al., 2021), which cause the attacked DNN models to perform incorrect predictions. A vast volume of prior studies has proposed to leverage adversarial training (AT) (Madry et al., 2018); AT explicitly uses generated adversarial examples with specific types of perturbations (e.g., -nom attack) when training a DNN model. Most of these previous AT studies have considered supervised learning settings (Madry et al., 2018; Zhang et al., 2019; Wu et al., 2020; Wang et al., 2019) in which we can utilize class label information to generate adversarial examples. On the other hand, achieving robustness in self-supervised learning (SSL) setting has been relatively understudied despite the recent success of SSL in variety of tasks and domains.
SSL frameworks (Dosovitskiy al., 2015; Zhang et al., 2016; Tian al., 2020b; Chen al., 2020; He et al., 2020; Grill et al., 2020; Chen & He, 2021) have been proposed to learn transferable visual representations by solving for pretext tasks constructed out of the training data (Dosovitskiy et al., 2015; Zhang et al., 2016). A popular SSL approach is contrastive learning (e.g., SimCLR (Chen et al., 2020), MoCo (He et al., 2020)), which learns maximize the similarity across positive pairs, each of which contains differently augmented samples of the same instance, while minimizing the similarity across different intances. Recently, to establish robustness in these SSL frameworks, RoCL. (Kim al., 2020) and ACL (Jiang et al., 2020) have proposed adversarial SSL methods based contrastive learning frameworks. They have demonstrated improved robustness without leveraging any labeled data. However, both of these adversarial SSL frameworks inefficient as they require a large batch size in order to attain good performances either on clean or adversarial samples.
Recent SSL frameworks (Grill et al., 2020; Chen & He, 2021; Zbontar et al., 2021) mostly resort to maximizing the consistency across two differently augmented samples of the same instance, using additional momentum encoder (Grill et al., 2020), without any negative pairs additional

---

Under review as a conference paper at ICLR 2023
Degechon pairs
clean
tangat
dean
adversarial
Effectived
efter perturbation
adversarial
maximize
efter porturbation cen
minimize
after perturbation
pesitue
Non-effective
adversorial
[a] supervised adversarial attack
(b) contrastive adversarial attack
(c) pasitive only similarity adversarial attack
Figure I: Motivation. In supervised adversarial learning (a), perturbation is generated to maximize the cross- entropy loss, which will push adversarial examples to the decision boundarics of other classes. In adversarial contrastive SSL (b), perturbation is generated to minimize the similarity (red line) between positive pairs while maximizing the similarity (blue lines) between negative pairs. Then, the adversarial examples may be pushed to the space of other classes as negative samples may mostly contain samples from other classes. However, in positive-only adversarial SSL (c), minimizing the similarity (red) between positive pairs have weaker constraints in generating effective adversarial examples than supervised AT contrastive- -bsed SSL. To overcome such a limitation, we suggest a selective targeted attack that maximizes the similarity (blue) to the most confusing target instance (yellow square in (c)).
networks (Chen & He, 2021; Zbontar et al., 2021). Such non-contrastive SSL frameworks using only positive pairs are shown to obtain representations with superior generalization performance compared to contrastive counterparts in a more efficient manner. However, leveraging untargeted adversarial attacks in these SSL frameworks results in a suboptimal performance. BYRL (Gowal al., 2021a), an ad adversarial SSL framework using only positive pairs, obtains much lower robust accuracies than those of adversarial contrastive-learning SSL methods on the benchmark datasets (Table 3). Then, what is the cause of such suboptimal robustness in non-contrastive adversarial SSL framework?
We observe that this limited robustness mainly comes from the suboptimality of untargeted attacks; adversarial examples generated by the deployed untargeted attacks are ineffective in improving robustness in non-contrastive adversarial SSL frameworks. As shown in Figure I, the attack in the inner loop of the adversarial training loss, designed to minimize the distance between two differently augmented samples, perturbs given example to a random position the latent space. Thus, the generated adversarial samples have little impact on the final decision boundaries. Contrarily, in contrastive SSL frameworks, the samples are perturbed toward negative samples to maximize the instance classification loss, most of which belong to different classes. Thus, the ineffectiveness of the untargeted attacks in non-contrastive SSL frameworks mostly comes from their inconsideration of other instances.
To tackle this issue, we propose Targeted Attack for RObust Self-Supervised learning (TAROSS). TAROSS is designed enhance robustness of non-contrastive SSL framework with only positive pairs, such as BYL (Grill et al., 2020) and SimSiam (Chen & He, 2021). by conducting targeted attacks, which perturbs the given instance toward a target. However, this leads the question of which direction we want to perform the targeted attack to, that is unclear in unsupervised adversarial learning without class labels. To address this point, we consider attacking the instance toward another instance, and further perform empirical study of which target instances help enhance robustness as opposed to randomly selected target instances, in a targeted attack. Based on our observation, we propose a simple yet effective target selection algorithm based on the similarity and entropy between instances.
Our main contributions can be summarized as follows:
We demonstrate that achieving comparable robustness in the positive-only self-supervised lcarning (SSL) with contrastive- SSL is difficult due to ineffective adversarial inputs generated by untargeted attacks.
We perform an empirical study of different targeted attacks for non-contrastive ad adversarial SSL frameworks using only positive pairs. Then, based on the observation, we propose a novel targeted adversarial attack scheme which perturbs the target sample in the direction to the most confusing instance to it, based on similarity and entropy.
We experimentally confirm that the proposed targeted adversarial SSL framework is able to obtain significantly high robustness, outperforming the state-of-the-aa contrastive- and posltive-only adversarial SSL methods.
2

---

Under review as a conference paper at ICLR 2023
Target selection based on function (S)
Targeted attack
Adversarial Self-supervised learning
Base image
Target image
Bky |
similarity
Projector 8
Predictor
Predictor
Projector
Projector
Projector g
X
Ing(p,) K))
Encoder
Encoder
Encoder f
Encoder
315 31
3p
3g
3xx
x
7,(xr)
T2(x))
Figure 2: Overview of TAROSS on SimSiam. Our approach consists of three parts: target selection, targeted attack, and adversarial self-supervised learning (SSL.. We propose simple and effective similarity- and entropy- based target selection algorithm that seleets the maximum score target based on score function (S) (left). When select the target image (I²) for each instances, we conduct a targeted attack, which maximizes the similarity between the instance (æ;) and the targeted (x:) (middle). Then, train the model with targeted adversarial examples (right).
RELATED WORK
Adversarial Training Szegedy et al. (2013) showed that imperceptible perturbation to an input image may lead DNN model to misclassify given input into false label, demonstrating the vulnerabilities of DNN models against adversarial attacks. Goodfellow et al. (2015) proposed the Fast Gradient Sign Method (FGSM), which perturbs given input add imperceptible noise in the gradient direction of decreasing the loss of a target model. They also demonstrated that training a DNN model over perturbed well as clean samples improves the robustness of the model against FGSM attacks. Follow-up works (Kurakin et al., 2016; Carlini & Wagner, 2017) proposed diverse gradient-based strong attacks, and Madry al. (2018) proposed a projected gradient descent (PGD) attack and a robust training algorithm leveraging minimax formulation; it finds an adversarial example that achieves high loss while minimizing the adversarial loss over given data points. Due to surge of interest in achieving robustness, various defense mechanisms (Song et al., 2017; Buckman et al., 2018; Dhillon et al., 2018) have been proposed.
However, Athalye et al. (2018) showed that many of the previous studies depend on gradient masking, which results in obfuscated gradients in the representation space. At the same time, this renders a target model highly vulnerable to stronger attacks that circumvent obfuscated gradients. TRADES (Zhang et al., 2019) proposed to minimize the Kullback-Leible divergence (KLD) over clean examples and their adversarial counterparts, thus enforcing consistency between their predictions. They further showed that there is a theoretical trade-off relationship in achieving both clean accuracy and robustness. Recently, leveraging additional unlabeled data (Carmon al., 2019) and conducting additional attacks (Wu et al.. 2020) have been proposed. Carmon et al. (2019) proposed using Tiny ImageNet (Le & Yang, 2015) as pseudo labels, and Gowal al. (2021b) proposed using generated images from generative models to learn richer representations with additional data.
Self-Supervised Learning Due to the high annotation cost of labeling data, SSL has recently gained a large attention (Dosovitskiy et al., 2015; Zhang et al., 2016; Tian et al., 2020a;b; Zbontar et al., 2021). Previously, SSL focused on solving a pre-task problem of collaterally obtaining visual representation, such as solving the jigsaw puzzle (Noroozi & Favaro, 2016), predicting the relative position of two regions (Dosovitskiy et al., 2015), or impainting the masked area (Pathak et al., 2016). Contrastive SSL coined with data augmentation (Chen et al., 2020; He et al., 2020) has achieved impressive performance in SSL. On the other hand, other previous studies employed a momentum network to learn visual differences between two augmented images (Grill et al., 2020) or to mimic the momentum network with -oagdrnd (Chen & He, 2021).
Adversarial Self-Supervised Learning The first adversarial SSL method employed contrastive learning to achieve a high level of robustness (Kim et al., 2020; Jiang et al., 2020) without any class labels. Adversarial self-supervised contrastive learning (Kim et al., 2020; Jiang et al., 2020) generated an instance wise adversarial example that maximizes the contrastive loss against their positive and negative samples by conducting untargeted attacks. Both methods achieved robustness
3

---

Under review as a conference paper at ICLR 2023
Table 1: Experimental results against PGD &oo attacks on ResNet18 where all models are trained on CIFAR-5 for simple observation. The CIFAR-5 includes airplane, automobile, bird, cat, and deer from CIFAR-10.
Self-supe framework
Method
Clean
PGD E
Contrastive bused approuch
SimCLR
ACL Jiang et al. (2020) RoCL. Kim et al. (2020)
80.84 87.74
39.16
SimCLR
47.60
Non-contrastive based approach with untargeted attack
BYOL
Untargeted uttack
75.40
21.00
SimSiam
Untargeted attack
66.36
36.53
Non-contrastive based approach with targeted attack (Ours)
BYOL
Randomly targeted attack
83.50
36.50
BYOL
Entropy and Similarity based targeted attack
87.08
35.18
SimSiam
Randomly targeted attack
77.08
47.58
SimSiam
Entropy and Similarity based targeted attack
79.54
49.50
with the cost of requiring large computation power due to a large batch size for contrastive learning. On the other hand, Gowal et al. (2021a) utilized only positive samples to obtain adversarial examples by maximizing the similarity loss between the latent vectors from the online and target networks, enabling this method free for batch size. However, it exhibited relatively poorer robustness than that of self-supervised contrastive learning, even with advanced SSL framework. Despite this advanced framework, i.e., non-contrastive SSL, that employs only positive pairs, robustness is not guaranteed with simple combination of untargeted adversarial learning and advanced SSL. To overcome such vulnerability in non-contrastive SSL, we propose a targeted attack leveraging a novel score function designed to improve robustness.
3 TARGETED ADVERSARIAL SELF-SUPERVISED LEARNING
Adversarial SSL has been proposed to apply existing supervised adversarial learning to models trained with SSL; this method generates adversarial examples an untargeted manner and leverages these examples to improve robustness. Despite previous works being rather straightforward combination of two approaches, we argue that leveraging untargeted adversarial attacks still leaves large room for robustness to improve.
3.1 ATTACK IN ADVERSARIAL SELF-SUPERVISED LEARNING
Adversarial supervised training. To explain adversarial SSL, first recap adversarial supervised training with our notations. We denote the dataset D = (X,Y}, where x E X is a training example, and y Y is its corresponding label. In this supervised learning task, model is So X Y, where 0 is set of the model parameters to train.
Given D and fe. adversarial attack generates an adversarial example by adding a perturbation to given source image that maximizes the loss within a certain radius from it (e.g., foo norm balls). We define this adversarial eo attacks as follows:
g++1 II (8' asign
(1)
where B(0,e) ) is the too norm-ball with radius IT is the projection function to the norm-ball, a the step size of the attacks, and sign(-) is the sign of the vector. Also, the perturbation ö is the accumulated perturbations by as ing()) over multiple iterations t, and Lee is the cross-entropy loss. In the case of PGD (Madry et al., 2018), the attack starts from a random point within the epsilon ball and performs t gradient steps, to obtain perturbed sample adv
Adversarial training. (AT) straightforward way improve the robustness of the model by minimizing the training loss embedding the adversarial described above as an inner loop, as follows:
LAT max CoR (J(0,x 6).
6E ((2,c)
Untargeted adversarial self-supervised learning. Previously proposed adversarial SSL meth- ods (Jiang et al., 2020; Kim et al., 2020; Gowal et al., 2021a) naturally combined the adversarial supervised training and SSL frameworks. Therefore, all previous works design the inner loop of
4

---

Under review as a conference paper at ICLR 2023
Algorithm Targeted Attack Robust Self-Supervised Learning (TAROSS)
Require: Dataset D, transformation function T, model J' parameter of model 0, target score function S, constant w
for iter E number of iteration do
for 24 E miniBatch = (21....,,T do for in 2 do
transform input (2:)
Find target images (x, ((T,)))))) B)
Generate targeted adversarial examples T, (2;) =T, + 8
8 -I 6' asign VoseLarget (1;;), + 8'), S(0, T, (z;
end for Calculate training loss
LTARCSS = Lsel (T (I:), Ti (x;)ade) + w Lgel (T (x; (z;)adu, T2(x;)
end for
Optimize the weight A over LTROSs end for
adversarial attack with untargeted attack follows:
8++ IT B(O,e) 8t as asign Lisss (1 (z) 22 (2)))
where perturbation is generated to maximize the self-supervised loss Lisss that minimizes the similarity between positive pairs, and maximize the similarity between negative pairs if negative pairs exists (Jiang et al., 2020; Kim et al., 2020).
Targeted adversarial self-supervised learning We argue that leveraging untargeted adversarial attacks in an SSL framework using positive-only pairs still leaves large room for better robustness. We can simply improve robustness in con-contrastive SSL by changing the inner loop to randomly targeted attack as follows:
gz+1 (0 88' + asign ( (S(0,z x00 8 S(, S(0,
where Learget C I' a randomly selected target within the batch. To precisely elaborate our observation in the latter section, we introduce score function (S(x, ba)c select the target (x') within the batch. The score function (S) can be random-sampling function or a designed function as Eq. 6. In other words, the score function outputs the target (a') corresponding to the base image (I), then the targeted attack generates perturbation that maximizes the similarity to target a'.
In Table 1, an untargeted attack makes the model more vulnerable when the non-contrastive SSL frameworks utilize only positive pairs, such as in BYOL (Grill et al., 2020), and SimSiam (Chen & He, 2021). However, when modify the inner loop of the untargeted attack the targeted attack with the simple random sampling score function as Eq. 4., non-contrastive SSL achieves better robustness.
3.2 OBSERVATIONS OF TARGET SELECTION BASED ON SCORE FUNCTION
In the previous section, we found that the targeted attack can improve robustness even with randomly selected target images in the batch. However, argue there exist effective target images for each base input æ that can further improve robustness. However, selecting effective target instances for the targeted attack is not trivial. To enable this, we propose leveraging the K-means clustering- based and similarity-baar based score functions. We mainly observe our score function on SimSiam (Chen & He, 2021) and futher describe the details of our method for observations in Appendix C.
K-means clustering-basee target selection. Intuitively, perturbing the most confusing class can be straightforward way of implementing strong adversarial attack for better robustness. To validate our assumption, we first design the score function based on labels from K-means clustering. To find the most confusing instance, we label the pseudo class 3/s on the source images x; with K-means clustering and then find the most closest cluster y, to the pseudo class yi based on the centroid vector of each cluster. Accordingly, we can filter the instances that are labeled as ye from the batch.
5

---

Under review as a conference paper at ICLR 2023
Table 2: Results of our TAROSS with K-means clustering based-, and similarity based- selection for targeted attack CIFARS.
Among those, the score function selects the instance that is closest to the source images 2;.
As shown in Table 2. the K-means clustering target selection score function shows better robustness than the random selection when performing targeted attacks. However, K-means clustering requires a lot of compu- tation resources to derive pseudo class label every iteration, and it is vague to set the K value when there no label information. Moreover, we cannot guarantee that the closest instance in the confused cluster is always the best candidate to improve robust- ness (Zhang et al., 2020) becase the closest cluster to an instance itself may differ from the closest cluster to the pseudo class cluster. For example, when the cat class cluster is close to the dog class cluster, there could be a cat instance close to horse images on the other side. Therefore, we also test the target selection score function based on the distance of each instance.
Selection
Clean
PGD &oo
Untargeted* 66,36
36.53
Random
77.08
47.58
Similarity
76.04
48.73
K K-means clustering 75.86
49.39
Similarity-based target selection. In SSL, the similarity between given instances is an important metric to learn a good visual representation without any class label information (Chen al., 2020; Tian et al., 2020b). Therefore, we leverage the similarity score to find optimal target images in the adversarial SSL. Before designing the score function based on the similarity score, we first observe the influence scores (Koh & Liang, 2017) of training points that are generated by the targeted attacks with randomly selected targets. The influence score is designed to approximate the influence function in DNN to compute the degree to which the training points responsible for given prediction (Koh & Liang, 2017). We followed Koh & Liang (2017) to calculate the influence scores of the adversarial examples that generated by the targeted attack with a variety of target images. However, since this approximation requires a lot of computations, and the possible pair for the targeted attack is squared of the batch size, we sampled 60,000 training points observe the correlation between the similarity and influence scores.
We found that the input pairs having the similarity of around 0.0 have relatively high influence scores (Figure 7), To empirically verify whether the instances with the high influence score actually act as an effective target to show better robustness in adversarial SSL,, we design an ex- periment in which we select target images based on the similarity. We experiment with five cases that have a different range of the similarity: rl: -1.0 -0.5, r2: -0.5 ~ -0.25, r3: -0.25 ~ 0.0, r4: 0.0 ~ 0.25, r5: 0.25 ~ 0.5, and r6: 0.5 ~ 1.0. As shown in Figure 3,
Clean PSD
80
Accurary
Figure 3: Robustness of the model that con- duct targeted attack based similarity score which selecting the target image that are in pre-defined range (r1, .rr,,...," r6)). .6)). selection algorithm.
when we select the target images between -0 00.25 ~ 0.25,
it improves robustness compared to that using the random
3.3 TARGETED ATTACK WITH ENTROPY- AND SIMILARITY-BASED SCORE FUNCTION
In this section, we describe our overall framework to achieve robustness in non-contrastive SSL performing targeted attacks wherein targets selected by leveraging our proposed score function. The target score function is designed based on the observation in the previous section.
Positive-paired self-supervised learning. Our targeted attack designed for an SSL framework that only employs positive pairs of transformed images. Therefore, mainly describe our method on the SimSiam (Chen & He, 2021).
We first describe SSL method, SimSiam (Chen & He, 2021), that learns visual representations with only positive pairs using a stop-gradient. Let us denote the dataset D = (X). and transformation set T that augments the images E X. SimSiam consists of the encoder followed by the projector y, and the predictor h;; each of y and h is multi-layer perceptron (MIPs). To learn visual representations, SimSiam maximizes the cosine similarity between the positive pairs follows:
P1
22
1
P2
21
Loimsiam am (TI T2(2)) = 2 ||ill2
(5)
1|
2
||2212
|

---

Under review as a conference paper at ICLR 2023
where P. (x)))( and 2, (T)() output vectors of the predictor h and the projector 9. respectively, where stands for index of the differently augmented two images. Before calculating the loss, SimSiam stops the gradient the z. Stop-gradient helps the model to form proper visual representations without any momentum network but makes the single model acts like a momentum network.
Entropy and similarity based target selection. From the observation in the previous paragraph, argue that selecting target instances that most confused and are adequately close to the base instance is effective for targeted attacks. For this, we design the score function based on the similarity and entropy values; it does not need any class information, as follows:
C, ej
(TT((
+ (p5/T) log (pş/T).
(6)
|eilll ||eyll2
where Pj L(g( (1))))) and e; [(T, (x:4) output vectors of predictor h and encoder f. respectively. Overall, the score function S consists of a cosine similarity term, and an entropy term. The cosine similarity calculated between features of base images and candidate images in the differently augmented batch (T2). The entropy is calculated with the assumption that the vector is an instance's 's logit as Caron al. (2021). We design the score function to work as combination of selection algorithms based on K-means clustering and similarity values. It naturally selects the target that is mostly confused with base images (Figure 1). We also verify our score function selects targets as our intention in the experiment section (Figure 4b).
Robust self-supervised learning with target attack (TAROSS). In non-contrastive SSL, we make positive pair, i.e., Tz) T2()). with differently transformed augmentation. As shown in Figure to generate adversarial examples, we first select the target images Tz()', T2(2)' for each base image T (z), (z:), respectively, which have the maximum score from score function (S). Here, we employ score function (S) in Eq. 6. Then, we generate adversarial examples, i.e., (z) (2(x)ado, for each transformed input with suggested targeted attack (Eq. 4) where Liarget = -Liimsiam Finally, we maximize the agreement between adversarial images T2 (z jade, and T2(x)ado with clean image T, (x) as follows:
LTAOOSS = (T), (xx (w))dd)) + w (x) adv
(z)))dd))
where L is Eq. 5. Since all three instances have the same identity, we maximize the similarity between the clean image and adversarial examples. Overall, TAROSS is summarized in Algorithm 1.
4 EXPERIMENT
In this section, we validate our TAROSS on non-contrastive adversarial SSL frameworks (Section 4. Moreover, we evaluate the robustness of the representation with different datasets and in transfer- learning tasks (Section 4.2). Finally, we analyze why our targeted attacks help achieve better robustness compared models using untargeted attacks (Section 4.3).
Experimental setup. We validate our TAROSS on top of BYOL (Grill et al., 2020) and Sim- Siam (Chen & He, 2021). To compare the effectiveness of TAROSS, we also implement non- contrastive adversarial SSL using untargeted attacks in each SSL framework. All the models are trained on ResNet18 with foo PGD attacks with an attack step of 10 with epsilon 8/255, We evaluate the robustness against Auto/tttck (Croce & Hein, 2020a) and for PGD attacks with epsilon 8/255 using an attack step of 20 iterations. We further describe the details of our experimental settings in Appendix B. The code will be available in Anonymous.
4.1 EVALUATING ROBUSTNESS
Robustness with targeted/untargeted attack. Table 3, as we observed in the previous section, when replacing untargeted attacks with targeted attacks in positive-only SSL (BYOL, SimSiam), it obtains robustness comparable to contrastive adversarial SSL (RoCL, ACL), which verifies our motivation. Therefore, it is feasible to improve robustness even in positive-only SSL while attaining the pros of positive-only SSL frameworks. Interestingly, the targeted attacks helped improve the clean accuracy in SSL when compared with those using untargeted attacks in positive-only SSL. We conjecture that untargeted attacks are not only inadequate to learn robust features but also hinder to learn good visual representation of natural images.
7

---

Under review as a conference paper at ICLR 2023
Table 3: Experimental results against white box attacks on ResNet18 trained on the CIFARIO. We evaluate adversarial SSL with linear evaluation and robust linear evaluation. Clean is the accuracy of clean images. All models are evaluated with PGD foc with 20 steps of < 0.0314 and AutoAAttack (Croce & Hein, 2020a). Untargeted attack maximizes the training loss between the differently augmented but the same instances to generate adversaries. To see the effectiveness, we TAROSS on positive-only SSL., i.c., BYOL, SimSiam.
Train type
self-supervised framework
Method
Clean
PGD &...
AutoAttack
SimCLR
RoCL (Kim et al., 2020)
78.14
42.89
27.19
Contrastive
SimCLR
ACL (Jiang et al., 2020)
79.96
39.37
35.97
Self-supervised
BYOL
Untargeted attack
72.65
16.20
0.01
linear evaluation
Positive-only
BYOL
TAROSS
84.52
31.19
21.01
SimSiam
Untargeted attack
71.78
37.28
32.41
SimSiam
TAROSS
74.06
44.71
36.39
SimCLR
RoCL (Kim et al., 2020)
76.53
47.51
30.22
Contrastive
SimCLR
ACL (Jiang et al., 2020)
77.17
40.67
39.13
self-supervised
BYOL
Untargeted attack
54.01
27.24
4.49
robust linear evaluation
Positive-only
BYOL
TAROSS
74.33
40.84
29.91
SimSiam
Untargeted attack
68.88
37.84
31.44
SimSiam
TAROSS
76.19
45.57
37.25
Table 4: Results of linear evaluation in STL10 and CIFAR1O. Rob, stands for robust accuracy against PGD bor attack with 20 steps and 0.0314
Table 5: Results of adversarial transfer learning
CIFAR and STL.0 from CIFAR 100. Rob. stands for robust accuracy against 2o PGD attack.
STL10
CIFAR 100
CIFARIO0 Method
CIFARIO
STL10
Method
Attack
Clean
Rob.
Clean
Rob.
Atlack
Clean
Rob.
Clean
Roh.
RoCL
Untarget
52.63
19.19
45.99
17.17
RoCL
Untarget
73.93
18.62
74.06
19.06
ACI.
Untarget
54.14
19.69
41.09
15.31
ACI.
Untarget
61.68
15.66
59.56
13.53
BYOL
Untarget
61.02
12.14
53.43
14.81
BYOL
Untarget
71.06
16.57
63.53
12.93
SimSiam
Untarget
43.88
12.70
27.53
14.20
SimSiam
Untarget
50.05
25.43
34.54
24.82
SimSiam
TAROSS
46,38
21.32
36.02
22.18
SimSiam
TAROSS
50.50
25.44
43.13
22.46
Robustness compared to contrastive-based approaches. We compare our TAROSS to contrastive
adversarial SSL methods to show that our approach could make positive-only SSL to achieve robustness comparable to previous works. To this end, we evaluate adversarial SSL with linear evaluation and robust linear evaluation against AutoAttack (Croce & Hein, 2020a) and PGD (Madry et al., 2018) fxc attacks. Notably, as shown in Table 3, the targeted attacks allow the positive-only SSL model to have better robustness than that of contrastive adversarial SSL (RoCL, ACL) in linear evaluation. Specifically, when we train the fe layer, our model achieves 36.39% of robustness against strong Atto which shows the effectiveness of our proposed method. Interestingly, the SimSiam-based model has already obtained good robustness in the linear evaluation compared to the robust linear evaluation which takes x4 times to train. We conjecture that SimSiam- based TAROSS already has a robust well-cluster after the robust pretraining which does not need to find robust decision boundaries with the adversarial examples. Since the SimSiam directly maximizes the similarity between adversary and clean images only between the positive pairs with the single models, the gap between the representation of adversaries and clean examples may reduce. Moreover, our approach is also applicable to positive pairs in the contrastive-ban
approaches. As shown in Table 6, our TAROSS also could improve both clean and robustness of contrastive- based approaches. This verifies that targeted attack generates effective adversaries for self superviedd learning frameworks which is model agnostic approaches.
4.2 EVALUATING THE QUALITY OF ROBUST REPRESENTATION
Robustness on multiple benchmarks datasets. We validate our method on multiple benchmark datasets, such as CIFAR and STL10. In Table 4, our TAROSS consistently shows good robust- ness across different benchmark datasets when comparing with adversarial SSL frameworks using untargeted attacks. Especially, when the dataset becomes larger, such as CIFARTON our method achieves even better robustness than contrastive learning- based approaches, e.g., RoCI., and ACL, where these approaches are sensitive to the number of same class samples in the single batch size. From this result, we argue that our targeted adversarial SSL contributes to learning better robustness in the larger dataset than contrastive- based SSL.
Transfer to different data. SSL is effective utilize in several downstream tasks with pretrained encoder. Therefore, we also evaluate how our robust pretrained features help in the different datasets in transfer tasks, which demonstrates the quality of our robust pretrained features in different dataset.
8

---

Under review as a conference paper at ICLR 2023
We followed the experimental setting as supervised adversarial transfer learning tasks (Shafahi et al., 2020) which freeze the encoder and train only the fe layer. We pretrained the model on CIFAR and evaluate the robust transferability to STL10, and CIFARIO. Once model is trained, we transfer the robust features to different kinds of datasets with fewer epochs and parameters, which is efficient in that we do not need to conduct adversarial training from scratch. In Table 5, our model also shows impressive transferability both in CIFARIO 10 and STL10 compare to untargeted adversarial SSL. Moreover, while our model shows relatively low clean aceuracy, TAROSS could obtain about 10% gain in robustness compared to contrastive- based adversarial SSL. From these results, we confirm that our methods generate robust representations that can be transferred several downstream tasks, which previous adversarial SSL studies addressed.
4.3 ANALYSIS OF TARGETED ATTACKS
In this section, we further analyze the targeted attacks in adversarial SSL to uncover evidence for why our proposed method is effective in adversarial SSL. We analyze which class is frequently selected when using our score function. Then, we visualize the difference between untargeted attack and targeted attack in the representation space.
Analyze the distribution of the target class. We examine which class is selected as a target by the score function (S). We test the selected tar- get of the single class (airplane) to the adversarial supervised trained models (Madry et al., 2018) obtain the probability and prediction for analyz- ing the class distribution. As shown in Figure 4b,
Moan Puouste (8))
All complics Misclosited somples
44
02-
200
f4 5 Aeg
(a) Mean predict proba- bility of base images
(b) Distribution of class of targeted images
half of the target images are the same class the base image. And the next most frequently
Figure 4: Analysis of target from score function (S) selected class was the class with the second highest probability that the images of the corresponding class were most confused (Figure 4a). The score function we proposed selects images of the same class when the image in the center of the cluster, and images near the decision boundary that have a high probability to predict to a wrong class select images of a different class. Through these results, it can be confirmed that clustering to always select different class from itself and heuristic target selection, which performs an instance-wise attack close to a similarity value, depending on the case, as we intended.
designed a score function that appropriately uses K-means
Visualization of embedding space. To observe the differences between images that are generated with tar- geted versus untargeted attacks, visualize the embed- ding space of targeted attack examples and untargeted attack examples. In Figure 5, adversarial examples denoted with dark blue, and clean examples are denoted with light blue; both are instances of the same class. As shown in Figure 5a, untargeted adversarial examples are located near clean examples. On the other hand, targeted adversarial examples are located near the boundary of the cluster (Figure 5b). This visualization shows that our targeted attack generates relatively more effective adversarial examples than untargeted attacks, which is likely to push the decision boundary to have a better robust representation.
(a) Untargeted attack
(b) Targeted attack
Figure 5: Visualize embedding
CONCLUSION
In this paper, we showed that a simple combination of supervised adversarial training with SSL is highly suboptimal due to the ineffectiveness of adversarial examples generated by the untargeted adversarial attacks perturbed to random places without the consideration of decision boundaries. Based on this observation, we propose an instance-wis targeted attack scheme for an adversarial SSL framework. This scheme selects the target instance based on the similarity and entropy, such that the given instance is perturbed to be confused with the selected target. Our targeted adversarial SSL framework obtains representation that achieves better robustness than the state-of of-the-art adversarial SSL frameworks, including contrastive ones, without using any negative pairs or additional networks. We believe that our work opens a door to future research on the search for more effective targeted attacks, for adversarial SSL.

---

Under review as a conference paper at ICLR 2023
Reproducibility Statement
Datasets. We use CIFARIO, CIFARIOO, STLI0, and CIFAR5 datasets for our experiment. To see more details, please see Supplementary B.2.
Baselines. We use following models as our baseline: RoCL (Kim et al., 2020), ACL (Jiang et al., 2020), and BYORI. (Gowal et al., 2021a). To see the training details, please see Supplementary
Robustness Test. We test our model and baselines against PGD attacks (Madry et al., 2018) and AutoAttack (Croce & Hein, 2020a). To the evaluation details for robustness, please see Section Experimental setup., and Supplementary B.4.
TAROSS, To train our model, please see Supplementary B.3.
Table reproduce the results in Table I, please see Section 3.1.
Table 2. To reproduce the results in Table 2, please see Section 3.2. K-means clustering-
based target selection., and Supplementary C
Figure 3. To reproduce the results in Figure 3, please see Section 3.2. Similarity- target selection, and Supplementary C
Figure 4, and 5. To reproduce results of Figure 4, and 5, please see Supplementary D.
REFERENCES
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: query-efficient black-box adversarial attack via random search. In European Conference on Computer Vision, pp. 484-501. Springer, 2020.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of security: Circumventing defenses to adversarial examples. In International Conference on Machine Learning, 2018
Jacob Buckman, Aurko Roy, Colin Raffel, and Ian Goodfellow. Thermometer encoding: One hot way to resist adversarial examples. In International Conference on Learning Representattioss 2018
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE symposium on security and privacy (sp), pp. 57. IEEE, 2017.
Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, Percy Liang, and John C Duchi. Unlabeled data improves adversarial robustness. Advances in Neural Information Processing Systems, 2019.
Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and Armand Joulin. Emerging properties in self-supervised vision transformers. In IEEE Conference on Computer Vision and Pattern Recognition, pp. 9650-9660, 2021.
David M Chan, Roshan Rao, Forrest Huang, and John F Canny. Gpu accelerated t-distributed stochastic neighbor embedding. Journal of Parallel and Distributed Computing, 131:1-13, 2019.
Ting Chen, Simon Korbllith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In International Conference on Machine Learning, 2020.
Xinlei Chen and Kaiming He. Exploring simple siamese representation learning. In Proceedings of the IEEF/CVF Conference on Computer Vision and Patern Recognition, pp. 15750-15758, 2021.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-fre free attacks. In International Conference Machine Learning, pp. PMLR, 2020a.
Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with fast adaptive boundary attack. In International Conference on Machine Learning, pp. 2195-2205. PMLR, 2020b.
10

---

Under review as a conference paper at ICLR 2023
Guneet S Dhillon, Kamyar Azizzadenesheli, Zachary C Lipton, Jeremy Bernstein, Jean Kossaifi, Aran Khanna, and Anima Anandkumar. Stochastic activation pruning for robust adversarial defense. International Conference Learning Representations, 2018.
Alexey Dosovitskiy, Philipp Fischer, Jost Tobias Springenberg, Martin Riedmiller, and Thomas Brox. Discriminative unsupervised feature learning with exemplar convolutional neural networks. IEEE 2015.
Iransactions on pattern analysis and machine intelligence,
Lijie Fan, Sijia Liu, Pin-Ye Yu Chen, Gaoyuan Zhang, and Chuang Gan. When does contrastive learning preserve adversarial robustness from pretraining finetuning? Advances in Neural Information Processing Systems, 34, 2021.
lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and hamnessing adversarial examples. In International Conference on Learning Representations, 2015.
Sven Gowal, Po-Sen Huang, Aaron van den Oord, Timothy Mann, and Pushmeet Kohli. Self- supervised adversarial robustness for the low-label, high-data regime. In International Conference on Learning Representations, 20.
Sven Gowal, Sylvestre-Alvise Rebuffi, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy A Mann. Improving robustness using generated data. Advances in Neural Information Processing Systems, 34:4218-4233 2021b.
Jean-Bastien Grill, Florian Strub, Florent Altché, Corentin Tallec, Pierre H Richemond, Elena Buchatskaya, Carl Doersch, Bernardo Avila Pires, Zhaohan Daniel Guo, Mohammad Gheshlaghi Azar, et al. Bootstrap your own latent: new approach to self-supervised learning. Advances in Neural Information Processing Systems, 2020.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In IEEE Conference on Computer Vision and Pattern Recognition, pp. 770-778, 2016.
Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. In IEEE Conference on Computer Vision and Pattern Recognition, 2020.
Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness common corruptions and perturbations. In International Conference on Learning Representations, 2019.
Ziyu Jiang, Tianlong Chen, Ting Chen, and Zhangyang Wang. Robust pre-training by adversarial contrastive learning. In Advances in Neural Information Processing Systems, 2020.
Minscon Kim, Jihoon Tack, and Sung Ju Hwang. Adversarial self-supervised contrastive learning. Advances in Neural Information Processing Systems, 2020.
Pang Wei Koh and Percy Liang. Understanding black-box predictions via influence functions. In International conference on machine learning, pp. 1894. PMLR, 2017.
Pang Wei Koh, Shiori Sagawa, Henrik Marklund, Sang Michael Xie, Marvin Zhang, Akshay Balsub- ramani, Weihua Hu, Michihiro Yasunaga, Richard Lanas Phillips, Irena Gao, Tony Lee, Etienne David, Ian Stavness, Wei Guo, Berton Earnshaw, Imran Haque, Sara M Beery, Jure Leskovec, An- shul Kundaje, Emma Pierson, Sergey Levine, Chelsea Finn, and Percy Liang. Wilds: benchmark of in-the-wild distribution shifts. In Marina Meila and Tong Zhang (eds.), Proceedings of the 38th International Conference on Machine Learning, volume 139 of Proceedings of Machine Learning Research, pp. 5637-5664. PMLR, 18-24 Jul 2021.
Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolu- tional neural networks. In Advances in Neural Information Processing Systems, pp. 1097-1105, 1055 2012.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples the physical world. arXiv preprint arXiv: 2016.
Ya Le and X. Yang. Tiny imagenet visual recognition challenge. In TinylmagNeet, 2015.
11

---

Under review as a conference paper at ICLR 2023
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
Mehdi Noroozi and Paolo Favaro. Unsupervised learning of visual representations by solving jigsaw puzzles. In European Conference on Computer Vision, pp. 69-84. Springer, 2016.
Deepak Pathak, Philipp Krahenbuhl, Jeff Donahue, Trevor Darrell, and Alexei A Efros. Context encoders: Feature learning by inpainting. In Proceedings of the IEEE Conference on Computer Vision and Puttern Recognition, pp. 2536-2544, 2016.
Ali Shafahi, Parsa Saadatpanah, Chen Zhu, Amin Ghiasi, Christoph Studer, David Jacobs, and Tom Goldstein. Adversarially robust transfer learning. International Conference on Learning Representations, 2020.
Yang Song. Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman. Pixeldefend: Leveraging generative models to understand and defend against adversarial examples. International Conference on Learning Representations, 2017.
Christian Szegedy, Wojeiech Zaremba, llya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 2013.
Yonglong Tian, Dilip Krishnan, and Phillip Isola. Contrastive multiview coding. In European Conference on Computer Vision, 2020a.
Yonglong Tian, Chen Sun, Ben Poole, Dilip Krishnan, Cordelia Schmid, and Phillip Isola. What makes for good views for contrastive learning. In Advances in Neural Information Processing Systems, 2020b.
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingiun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. International Conference on Learning Representations, 2019.
Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust general- ization. Advances in Neural Information Processing Systems, 33, 2020.
Jure Zbontar, Li Jing, Ishan Misra, Yann LeCun, and Stéphane Deny. Barlow twins: Self-supervised learning via redundancy reduction. International Conference on Machine Learning, pp. 12310- 12320. PMLR, 2021.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P Xing, Laurent El Ghaoui, and Michael I Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference Machine Learning, 2019.
Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankan- halli. Attacks which do not kill training make adversarial learning stronger. In International Conference on Machine Learning, pp. 11278-11287, PMLR, 2020.
Richard Zhang, Phillip Isola, and Alexei A Efros. Colorful image colorization. In European Conference on Computer Vision, pp. 649-666. Springer, 2016.
12

---

Under review as a conference paper at ICLR 2023
Supplementary Material
Targeted Adversarial Self-Supervised Learning
A BASELINES.
RoCL (Kim et al., 2020). RoCL is SimCLR (Chen et al., 2020) based adversarial self- supervised learning methods. We experiment with the official code'. To make a fair comparison, we set the attack step to 10 as other baselines. We train the model with 1,000 epochs under the LARS optimizer with weight decay 2 6 and momentum with 0.9. For the learning rate schedule, we also followed linear warmup with cosine decay scheduling. We set a batch size of 512 for all datasets (CIFARIO. CIFARIO0 100, STL10). For data augmentation, we use random crop with 0.08 to 1.0 size, horizontal flip with a probability of 0.5, color jitter with a probability of 0.8, and grayscale with probability of 0.2 for RoCL. training.
ACL (Jiang et al., 2020) ACL is SimCLR (Chen et al., 2020) based adversarial self- supervised learning methods. We conduct the experiment with the official code?. To make a fair comparison, we set the attack step to 10 as other baselines. We train the model with 1,000 epochs. We set batch size of 512 for STL10 dataset. For CIFAR 10, and CIFARION 100, we use the official pretrained checkpoints. For data augmentation, we use a random crop with 0.08 to 1.0 size, horizontal flip with a probability of 0.5, color jitter with a probability of 0,8, and grayscale with a probability of 0.2 for ACL training. We set PGD dual mode which calculates both clean and adversarial during the training.
BYORL (Gowal et al., 2021a) BYORL BYOL (Grill et al., 2020) based adversarial self- supervised learning methods for low label regime. Since there is no official code for B BYRRL we implement the YORL by ourselves. Though we mentioned as BYOL with untargeted attack in the Table 3, 4 and 5, please note that BYOL with untargeted approach stands for Gowal et al. (2021a). We implement based on B YOL from a self-supervised learning library?. We use the same CIFAR- 10 setting in the library except for normalization. We exclude normalization the data augmentation. To make a fair comparison, we implement the ResNer18 with attack step 10 of PGD. As shown in supplementary materials in Gowal et al. (2021a), when the model is trained with 10 steps in ResNet34 it shows 37.88% of robustness. We conjecture that we have different performance from the original paper because the original paper employs 40 steps of PGD in WideResNet34 to obtain the reported robustness which requires extraordinary computation power.
AdvCL (Fan et al., 2021) AdvCL SimCLR (Chen et al., 2020) based adversarial self- supervised learning which employ pseudo labels from the model that is pretrained on ImageNet (Krizhevsky et al., 2012) data. Even though the outstanding performance of AdvCL, we exclude this model as our baseline because the proposed methods require the model that is trained with the labels of ImageNet which we assume to have no label information for pretraining the model.
B DETAILED DESCRIPTION OF EXPERIMENTAL SETUPS
B. RESOURCE DESCRIPTION.
All experiments are conducted with a two NVIDIA RTX 2080 Ti, except for the experiments with 100 experiments. For CIFARI00 experiments, two NVIDIA RTX 3080 are used. All experiments are processed Intel(R) Xeon(R) Silver 41 CPU @ 2.20GHz.
13

---

Under review as a conference paper at ICLR 2023
B.2 DATASET DESCRIPTION.
For experiments, we use CIFAR 10, CIFAR 100, CIFAR 5, and STL1O. CIFAR 10 and CIFAR 100* consist of 50,000 training images and 10,000 test images with 10 and 100 classes, respectively. All CIFAR images are 32x 32.2 x3 resolution (width, height, and channel). CIFAR 5 is subset of CIFAR 10 which contains all images from 5 classes: airplane, automobile, bird, cat, and deer. We also test with determined classes. The STLI0* consists of 5,000 training images and 8,00 test images with 10 classes, All ST images are 96x96x3 resolution (width, height, and channel.) However, for our experiment in Table 5, resize the images into x2x32x3 resolution (width, height, and channel).
B.3 TRAINING DETAIL.
For all methods, we train on the ResNet18 (He et al., 2016) with l attacks with the attack strength of 8/255 and the step size of 2/255, with the number of inner maximization iteration set to K = 10. For the optimization, we train every model for 800 epochs using the SGD optimizer with the learning rate of 0.05, weight decay of 5e-4, and the momentum of 0.9. For data augmentation, we use a random crop with 0.08 to 1.0 size, horizontal flip with a probability of 0.5, color jitter with a probability of 0.8, and grayscale with a probability of 0.2. We exclude normalization for adversarial training. We set the weight of adversarial similarity loss w as 2.0. We use batch size 512 with two GPUs.
In the score function, we calculate the similarity score term and entropy term as shown in Equation 6. First, to exclude the positive pairs' similarity score we set the similarity score between positive pairs to 1. Then, to calculate the overall score. after obtaining the similarity score and entropy of cach sample, we normalize each component with Euclidean normalization balance each component to score function.
B.4 EVALUATION DETAILS.
PGD too attack. For all PGD foo attacks used in the test time, we the projected gradient descent (PGD) attack with the strength of c 8/ 8/255, with the step size of a = 8/2550, and with the number of inner maximization iteration set to 20 with the random start.
AutoAttack. We further test against strong gradient based attack, i.e., AutoAttack (AA) Croce &
Hein (2020a). AutoAttack an ensemble attack of four different attacks (APGD-CE, APGD-T, FAB- T (Croce& & Hein, 2020b), and Square (Andriushchenko et al., 2020)). AGPD-CE is an untargeted attack, APGD-T and FAB-T are targeted attacks. The Square is black box attack. We use official code to test models
Self-supervised learning. For self-supervised learning, we denote linear evaluation when we use only clean images to train the fully connected (fc) layer after the pretraining phase. When we denote robust linear evaluation, we train the fe layer with adversarial examples. While ACL uses partial fine-tuning to obtain their reported accuracy and robustness, to make a fair comparison freeze the encoder and train only the fo layer. Robust fine-tuning is training all parameters including parameters of the encoder with adversarial examples. For linear evaluation, for each model. We train the baseline models with 150 epochs, 25 epochs, and 50 epochs for RoCL, ACL, and BYORL, respectively. We also followed their learning rate 1, 0.1, and 2 10- 3 for RoCL, ACL, and BYORL, respectively. On the other hand, we train our model with 100 epochs with a learning rate of 0.5 for linear evaluation. We use AT loss for robust linear evaluation except for ACL. For ACL, we use TRADES loss as the official code.
followed baselines hyperparameters
C EXPERIMENT DETAILS OF OUR TARGETED ATTACK
K-means cluster-based TAROSS Intuitively, perturbing to the most confusing class is a straight- forward way of implementing strong adversarial attack for better robustness. To validate our
httttp://ww.cs.torrrt http:/tttooo..eeetee///eeeeeeeee html. Shttps: /htpp:://gittuubccm///aaaa
14

---

Under review as a conference paper at ICLR 2023
assumption, design the score function based on labels from K- X-means clustering. We set K as 5 for CIFAR 5 in Table 2.
As show in Figure 6, we label the pscudo-class y, the source images x; with the feature 2,. Then find the closest cluster Ys pseudo class yi based c of each cluster. We use the cosine similarity function measure the distance between the latent vector and centroid vector c. To calculate the K-means cluster for each batch, K-means cluster-based TAROSS takes high computation.
Y;
the centroid vector
Model
N
Pacudo lbels
Pieudo Target label
dg
|1:/0| [1s
1.3g
wherej
max(ddt)) Gby
Figure 6: K-means clustering target selection
Similarity score based TAROSS
To calculate the influence score during the training, we em-
Halogram of simbertt
5x10
soore
-2000
Numbbe of samplee
ploy underfitted adversarial self-
supervised model which learns vi-
sual representation little with 400
1000
-bx10
epochs. To calculate all pairs of
the training set, it requires O
0
-1x10
Moreover, the computation of in-
-1.0
-0.5
Stiilonty
0
0.5
1.0
sintarty
fluence score (Koh Liang. 2017) for single pair also takes a lot due
(a) Histogram of cosine similarity
(b) Scatter of influence score
hetween sampled pairs.
based on similarity
to approximation. Therefore, we
Figure 7: Analysis with influence score.
randomly sampled subset of the dataset from the training set. We use official code of influence score?. As shown in Figure 3, samples that are in -0.25 0.25 shows relatively high influence score.
D EXPERIMENTAL DETAILS OF ANALYSIS
Analysis the distribution of target class To analyze the target from the score function (S), we employ adversarially supervised trained model. We calculate the score function that is trained with our TAROSS on SimSiam. We use a train set. For each class, we calculate the mean predict probability which is the average of all softmax outputs of target images from the supervised trained model. Further, we also count the number of samples that are predicted for each class. In Figure 4, the results are target images of the airplane we change the base class to other classes as shown in the following Figure 8
base image. There is similar tendency even though
800
MaclaesSii
Moon Probeatyyy
8:0
Nicheofled
Mean Phobeday (S)
200
0.2
200
1000 Rlag
(a) Distribution of class of target of automobile.
(b) Mean predict probabil-(c) Distribution of class of ity of automobile Figure 8: Analysis of target distribution in different class
(d) Mean predict probabil- ity of deer
target of deer.
Visualization of embedding space To visualize the embedding of our targeted attack and untargeted attack, we use t-Distributed Stochastic Neighbor Embedding (t-SNE) (Chan et al., 2019) with the cosine similarity metric. Our TAROSS model is trained on CIFAR1O as feature extractor. We sample few examples and conduct two types of attacks, untargeted attack, and targeted attack. To visualize more effectively we ignore the other seven classes in CIFAR10. We visualize clean examples from three classes and then visualize adversaries that are generated with our targeted attack and untargeted attack, respectively with dark blue.
"tttps: sttrss://iiie www..hhw.b..o..ooooooooooooooooe com wwt.:oopagooe/eeeeeoe/eoaooaa / woffuuneeerr release lease
15

---

Under review as a conference paper at ICLR 2023
E ADDITIONAL. EXPERIMENT
E.I CONTRASTIVE BASED ADVERSARIAL SELE-SUPERVISED LEARNING WITH TAROSS.
Our TAROSS could be also applied to positive pairs in contrastive based adversarial self-supervised learning (e.g., RoCL (Kim et al., 2020), ACL (Jiang et al., 2020)). We applied our TAROSS in instance-wise attack of the contrastive-based approaches follow,
Lattack = -nt-xent (x, {Tpos} h (Tnea)) + Caimilarity (x, {Tyoaess)
(8)
where attack loss is consists of original attack loss nt-xent loss (Chen et al., 2020) and similarity loss. The similarity loss additionally constrains the positive pairs as the TAROSS that maximize the similarity between the x with the jth index images which is searched by our TAROSS score function. Overall, we generate adversarial examples that maximizes the Lattack loss. Surprisingly, when we apply TAROSS on the contrastive learning based approach, previous work could achieve marginally better clean accuracy and robustness (Table 6). This shows that our empirical assumption also holds on contrastive-bast baass SSL but since there is (1/batch size) effects the total loss the gain could be marginal.
Table 6: Results of contrastive learning approach with TAROSS.
Linear evaluation Clean
Robust linear evaluation
PGD
Clean
PGD
RoCL
78. 14
42.89
76.53
47.51
RoCL +TAROSS
78.43
43.91
80.11
46.47
ACI
79.96
39.37
77.17
40.67
ACL +TAROSS
80.02
40.18
79.84
42.29
E.2 ABLATION EXPERIMENT ON THE SCORE FUNCTION
Our score function consists of two terms: entropy term and cosine similarity term. While our score function is designed based
Table Results of ablation study on score function.
observation in Section 3.2, we also empirically validate each term with the ablation experiment. We only use each term as the score function during the adversarial training follow,
Clean
PGD
AutoAttack
Sentropy
78.43
40.35
32.51
Saimilarity
72.90
44.59
36.12
STAROSS
74.06
44.71
36.39
Sentropy (I:) T2(æ))) = (p//T) log (ps/T),
Saimilerity (T (I:). Tz(2))) ||e]|2
ei
Ej
(10)
||eylla"
Through the experimental results in Table 7, the entropy term leverage have good clean accuracy while similarity term focus on to have better robust performance. With combined score function, our model could have good robustness while having good clean accuracy.
E.3 ROBUSTNESS AGAINST BLACK BOX ATTACK
We conduct black box attack to verify our model is robust to gradient free attacks. We generate black box adversaries with AT (Madry et al., 2018) model, RoCL (Kim et al., 2020) model and our models. Then, we test adversaries to each other. As show in the table, our model is able to defend the black box attack from AT model than the RoCL model. Moreover, model generates stronger black box adversaries than RoCL since AT model shows more weak robustness.
Table 8: Results of black box attack. Mod- els on the row are the tested models. Models on the columns are the source models to gen- erate black box adversaries.
AT
RoCL
Ours
AT
59.73
60.92
RoCL
70.40
57.98
Ours
69.97
54.99
16


Reviews:
[{"review_id": "zegYKNKqN88", "reviewer": "Reviewer_ngAb", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper discusses the problem of adversarial training for non-contrastive self-supervised learning (NC-SSL) approaches like BYOL.\nThey propose a modification of the loss function that involves an adversarial attack for a pair of objects that, with high probability, lie in different classes.\nSuch a method allows to beat straightforward adversarial training for NC-SSL, but is not Pareto-optimal given a clean and robust accuracy compared to C-SSL methods like SimCLR.", "summary_of_the_review": "The idea is good. The method is not good enough from theoretical and practical points of view, with little novelty in the current approach. \nI also note that may be other approaches applied to robustness improvement can work in this case, like SAM or Differential Privacy algorithms with a proper algorithm.\nI suggest authors provide a deeper analysis of why they obtained these results and why NC-SSL fails to provide robust solutions. ", "strength_and_weaknesses": "Strengths:\n- The problem the authors propose is interesting and lacks a straightforward solution\n- The authors propose an interesting idea on how to incorporate probably-negative objects in the framework\n\nWeaknesses:\n- The authors only partially solve the adversarial training for NC-CCL. C-SSL methods work better according to my interpretation of the presented results\n- There is no principal explanation of the usage of the approach at hand. There is some experimental analysis, but, e.g. it is missing if we can achieve similar results with different types of losses inspired by similar ideas.\n\nAdditional comments: \nThe idea of selecting a far-away image as a starting point resemble many black-box adversarial attacks.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "iv27hk-BZ7Z", "reviewer": "Reviewer_y32g", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The authors proposed a new unsupervised adversarial training method. Unlike previous work, this method leveraged label information and thus be categorized as the targeted attack. The core idea is the target selection algorithm, which is a combination of similarity and entropy. By running adversarial training on such perturbations, the authors show that this method enhances robustness of models trained with semi-supervised learning.", "summary_of_the_review": "Please address some of my points above.", "strength_and_weaknesses": "Overall the idea has decent novelty and the overall idea of this paper is easy to grasp. What I like about this paper are:\n1. The motivation is clearly stated: the untargeted attack fails to generate useful adversarial training data for improving robustness.\n2. The experimental results are clearly in line of the arguments.\n\nThe limitations are also quite clear though, including:\n1. The design of the score function (combing similarity and cross entropy) lacks justification. Although authors mentioned that we want to maximize the similarity but still unnatural to me why.\n2. Some details are lacking. For instance the authors mentioned K-means multiple times, but based on what distance metric? How does this affect the training efficiency?\n3. The title seems too broad - this paper concerns about SSL using positive pairs (specifically BYOL and Simsiam), but SSL itself is a very broad term containing many other methodologies as well. So the title might confuse others.\n4. The comparison in the experiments are also concerning: the baseline is based on SimCLR (Jiang, Kim) but this paper is based on BYOL and Simsiam. Could this be the reason causing the performance improve? Authors might want to find more support.\n5. The datasets are a bit small and limited, authors might want to find more realistic datasets to verify.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "PocgOeJYCFp", "reviewer": "Reviewer_h3Xt", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper aims to improve the robustness of adversarial self-supervised learning (SSL) by leveraging the proposed targeted adversarial data for adversarial SSL. The targeted adversarial data is generated by updating the natural data towards a targeted sample selected by K-mean or similarity. The paper empirically validates that target attacks can improve the adversarial robustness of several previous adversarial SSL methods including BYORL and SimSiam. ", "summary_of_the_review": "This paper proposes a target attack for improving the robustness of adversarial SSL. However, the paper’s weighting is poor, its motivation is unclear, and it lacks theoretical justification and enough empirical results to validate its effectiveness. ", "strength_and_weaknesses": "Strength:\n[Motivation for target attacks is clear.] Figure 1 clearly illustrates that targeted adversarial data can help find effective adversarial data in the setting of adversarial SSL with only positive pairs.\n\nWeakness:\n[Writing is poor.]\nThe definitions of some terms in the abstract and introduction like “positive-only adversarial SSL” are unclear to readers. In addition, Authors cannot assume the reader fully read “BYORL”. The paper does not introduce BYROL in detail. The paper should be self-contained. Besides, please write a full name before using the abbreviations. \n\n[Motivation is unclear.]\nThis paper tries to propose a method to improve adversarial self-supervised learning. There already exists effective adversarial contrastive learning based on SimCLR. However, this paper tries to improve a suboptimal method BYORL. \n\n[Effectiveness of the proposed method is not well validated.]\n-In the introduction, it seems that Authors tried to improve non-contrastive methods since non-contrastive methods are more efficient. However, Authors do not show the efficiency of the proposed targeted SSL compared to BYORL. Observed that TAROSS spends almost twice of the training time of ACL from the results in Author’s response (https://openreview.net/forum?id=wwRjJScpsOO&noteId=BU4byVrzGsk), it seems that the proposed targeted SSL is more inefficiency.\n-The scalability and efficiency of the targeted SSL on the large-scale datasets (e.g., ImageNet) are unknown. It would be more difficult to select an appropriate target sample in a large-scale dataset, which could degrade the efficiency and scalability of the proposed method.\n-The clean accuracy of the proposed targeted SSL is significantly degraded on some datasets (such as STL10 and CIFAR100 in Table 4). The degradation of clean accuracy is even higher than the improvement in robust accuracy. Therefore, targeted SSL could be problematic.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "Aa2D80dIPnr", "reviewer": "Reviewer_yLsz", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a targeted adversarial training method for non-contrastive self-supervised learning (SSL) to improve the performance. Using the proposed algorithm, non-contrastive SSL gets an improvement in the robustness of the downstream tasks.", "summary_of_the_review": "The main concern is to provide some illustration on why we want to consider the proposed algorithm. From all the numerical experiments in the current presentation of the paper, it seems that contrastive-SSL is a good method. The authors may consider adapting the proposed method into contrastive learning to further improve the performance, or provide some motivation why we some times can only use non-contrastive learning. ", "strength_and_weaknesses": "Strength:\n\nThe paper explains the intuition and numerical experiments clearly.\n\nWeakness:\n\n[1] From the intuition, it seems that the idea behind the proposed method is similar to contrastive learning. Both of them consider separate samples of different properties (e.g, class, or similarity). Could the authors provide some more insights on the difference between the proposed algorithm and the idea behind contrastive learning? Is there any interesting novel thoughts in the new method?\n\n[2] Is there any specific reason on why this paper considers improving non-contrastive SSL? The numerical performance of the proposed algorithm does not outperform compared to contrastive learning. In all Table 3, 4, 5, the new method may either have a similar (or slightly worse) performance compared to contrastive based approach, or has a better robustness while sacrificing the clean testing performance (i.e., clean and adversarial trade-off). \n\nThe authors need to provide some explanation why they want to compare the proposed method only with non-contrastive SSL, but nor contrastive-SSL. For example, the authors may want to explain whether there is any concern to utilize contrastive learning. Or is there any particular area of study which cannot use contrastive learning? Or is there any potential advantage of using non-contrastive SSL? Or can the proposed method be applied in contrastive learning?\n\nIt is acceptable to not consider non-contrastive SSL for a theory paper. But since this paper aims to propose a new method, it is essential to demonstrate that the proposed method is good enough. There may be some scenarios that non-contrastive SSL is used instead of contrastive SSL, but it is not clarified in this paper. In all the experiments in this paper, it seems that we can always use contrastive SSL and get a better result.\n\nPlease also emphasize that the paper works on non-contrastive SSL in the abstract. My first impression was that this paper studies contrastive learning with targeted SSL. It is slightly confusing.\n\n[3] Similarly, the observation in Figure 5 is not apperant.\n\n[4] In the tables, the bold numbers distract readers from catching the groups with the best performance. Please adjust the tables to make them clear.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "0qzA2TsXoi", "reviewer": "Reviewer_MNdh", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "In this paper, the problem of adversarial self-supervised learning is studied, where the goal is to improve the robustness of the self-supervised model. While adversarial example can be created under the supervised scenario, creating adversarial example is not trivial for self-supervised training because no label is available. This paper addresses this problem by proposing a score function that measure the similarities between unlabeled samples. Given an unlabeled sample, the negative sample can then be selected and then used to guide the direction of the adversarial perturbation. Experiment demonstrates the effectiveness of the proposed method.", "summary_of_the_review": "The author is suggested to address the limitation in the weakness section. It seems that some of the settings in this work are different than the prior works and several ablations are missing. The score might be adjusted if these concerns are not well addressed.", "strength_and_weaknesses": "Strength\n(1).\t The motivation of this work is strong.\n(2).\t Figure 1 clearly illustrates the difference between creating adversarial examples under the supervised setting and unsupervised setting. More specifically, the difference between creating adversarial examples in contrastive based self-supervised learning and positive only self-supervised learning is highlighted.\n(3).\t The overall paper is clear and simple to follow.\n\n\nWeaknesses\n(1).\tWhile the proposed method is useful under the scenario where only positive data is used for self-supervised learning, it is unclear why it cannot be applied to contrastive based self-supervised learning (e.g. SimCLR). If applicable to contrastive based self-supervised learning, how does the proposed method compared to prior works (e.g. RoCL)?\n(2).\tThe author is suggested to explain why CIFAR5 is used in Table 1, instead of Cifar10. Moreover, how does table 1 in this paper compares to the Table 1 in RoCL? If the author is using Cifar 10, are Table 1 in this work comparable to Table 1 in RoCL?\n(3).\tTypically, self-supervised learning assumes that the pretraining feature can be applied to various downstream task. However, for the experiment in Figure3, the author assumes that the downstream task is known and use it to ``probe” and select the optimal range of the similarity score. The author is suggested to explain why such operation make sense in general self-supervised learning scenario. Will the selected similarity score range transfer across dataset? How does the similarity score selection affect the final performance?\n(4).\tIt is unclear why the score function looks like Eq 6. Can we use the cosine similarity or the entropy term only? Which term is more important for the training? Any ablation on the weighted version between two terms?\n(5).\tTable 2 of RoCL also conducts experiment on black box attacks on Cifar10. What is the proposed method on black box attacks?\n\n\nTypo:\n(1).\t“becase” : typo near table 2\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject