Understanding Zero-shot Adversarial Robustness for Large-Scale Models
Authors: Chengzhi Mao
Scott Geng
Junfeng Yang
Xin Wang
Carl Vondrick
Venue: ICLR 2023 poster (2023)
Keywords: Adversarial Robustness
Zero-Shot Recognition

Abstract: Pretrained large-scale vision-language models like CLIP have exhibited strong generalization over unseen tasks. Yet imperceptible adversarial perturbations can significantly reduce CLIP's performance on new tasks. In this work, we identify and explore the problem of adapting large-scale models for zero-shot adversarial robustness. We first identify two key factors during model adaption--training losses and adaptation methods--that affect the model's zero-shot adversarial robustness. We then propose a text-guided contrastive adversarial training loss, which aligns the text embeddings and the adversarial visual features with contrastive learning on a small set of training data. We apply this training loss to two adaption methods, model finetuning and visual prompt tuning. We find that visual prompt tuning is more effective in the absence of texts, while finetuning wins in the existence of text guidance. Overall, our approach significantly improves the zero-shot adversarial robustness over CLIP, seeing an average improvement of 31 points over ImageNet and 15 zero-shot datasets. We hope this work can shed light on understanding the zero-shot adversarial robustness of large-scale models. 

Published as a conference paper at ICLR 2023
UNDERSTANDING ZERO-SHOT ADVERSARIAL ROBUSTNESS FOR LARGE-SCALE MODELS
Chengzhi Mao Scott Gengl*
Junfeng Yang'
Xin Wang²
Carl Vondrick'
Columbia University', Microsoft Research²
ABSTRACT
Pretrained large-scale vision- language models like CLIP have exhibited strong generalization over unseen tasks. Yet imperceptible adversarial perturbations can significantly reduce CLIP's performance and explore the problem of adapting large-scale models for zero-shot adversar- ial robustness. We first identify two key factors during model traition-training losses and adaptation methods-that affect the model's zero-shot adversarial ro- bustness. We then propose a text-guided contrastive adversarial training loss, which aligns the text embeddings and the adversarial visual features with con- trastive learning on small set training data. We apply this training loss to two adaption methods, model finetuning and visual prompt tuning. We find that visual prompt tuning more effective in the absence of texts, while finetuning wins the existence of text guidance. Overall, our approach significantly improves the zero-shot adversarial robustness over CLIP, sceing an average improvement of 31 points over ImageNet and 15 zero-shot datasets. Our code and model is available at ailgithub... htwtthub.com/cec col.bbaaaaaaaaaaaa..acaaaa.maaaa htt.aa///essottttuoouaaaaaa
tasks. In this work, we identify
INTRODUCTION
Large-scale models trained on vision and language data-also known as foundation models have emerged as a universal backbone for tackling many recognition problems in computer vision (Jia ett al. 2021 Radford et al.) (021), graphics (Ramesh et al. (022) and robotics (Ahn et al. 2022 One of the key advantages of foundation models is zero-shot generalization, where the models use just single textual description to recognize new visual categories with high accuracy. Since those large-scale models are powerful, they will continue to be used in many critical applications, where it is important make them reliable. However, robustness under adversarial examples remains challenge, where an imperceptible pattern can be combined with the image to cause recognition failures (Croce & Hein 2020 Carlini & Wagner [017 Dong et al. 2018)) Szegedy al. [013] Moosavi-Dezfooli et al., 2016). where attack on foundation models can consequently corrupt the downstream applications.
Due to the importance of this problem, there is a large literature that investigates adversarial ro- bustness for neural networks. The most common approach for adversarial defense is learn the model through adversarial training (Madry et al.] 2018 Mao et al. 2019) Szegedy et al.) 2013) Pang jtt al. 2020 Rice al., 2020; (esato et al., 2019), which involves augmenting the training set with mined adversarial examples that fool the image classifier. Adversarial training has been validated to improve robustness on the task that the mined examples come from, but often comes at a cost of generalization (Stutz et al. 2019 Su et al. 2018 Pedraza et al., 202I). However, our world is vast and naturally open, and only evaluating adversarial robustness on the learned tasks is limited. Can achieve shro-shot transferability for adversarial robustness, trained on the unknown tasks?
if the model has never been
In this paper, we study this important yet under-explored problem, zero-shot adversarial robust- ness of large-scale vision-language models. We start our investigation with the state-of-the-art CLIP model (Radford et al. 2021). which has been shown be effective in zero-shot recogni- tion tasks. We find that simply adding an imperceptible vector to the image (S 1/255) can subvert
Equul contribution

---

Published as a conference paper at ICLR 2023
100
200
Natural Images Mite and Images
Natural Images
Aftacioed images
Accuracy
stub
camutare
creeze
tespettrr
Flawrring
Rinssty row Aince
sTuJ
Eunday
Gatemiz5e
omn
eove strout staeirettrr
(a) CLIP
(b) Adversarially Finetuned CLIP
Figure I: (a, left) Despite CLIP's high performance on zero-shot image recognition tasks, it remains vul- nerable when the input images are constructed adversarially. (b, right) Standard adversarial training improves robustness on the trained task (ImageNet), but comes at the expense of its zero-shot capability. Our paper stud- ies how to adapt CLIP to achieve adversarial robustness on zero-shot tasks.
CLIP's prediction (see Figure| Tap. If we follow the standard adversarial training defense paradigm (Madry et al. 2018 Rice et al. 2020) to finetune CLIP on the ImageNet (Deng et al. (009b) train- ing set, we observe that the adapted CLIP has improved adversarial robustness on the ImageNet validation set, but comes at the cost of significantly reduced accuracy on unseen datasets and classes (Figure[lb) Standard adversarial training backfires on CLIP as it fails to retain the model's s zero-shot generalization ability.
Adaptation methods and training objectives are the two major factors for adapting a large-scale model. First, besides finetuning the whole model, we seek an alternative adaptation prompt moning-whice adapts the inputs instcad of the parameters of the model. Visual prompt tuning (VPT) is emerging light-weight adaptation method (Bar et al. 2022 Bahng et al. 2022 that learns a visual prompt which is added to the input image, where we use visual prompt to instruct the model to be robust against adversaries. Second, we find that the standard adversarial training objective ignores the visual-language alignment in CLIP's pretrained representation space, causing the model to lose zero-shot capability. We then propose text-guided contrastive adversarial training (TeCoA) loss, dubbed as Tekoa (twe, which maximizes the similarity of the adversarial visual features and the correct text embeddings with contrastive learning. Since the adapted visual features continue to align well with the text features, the model adapted with TeCoA can maximally retain the original zero-shot generalization of CLIP while enjoying improved adversarial robustness.
We conduct an extensive evaluation on 15 zero-shot image datasets, offering a holistic study of the zero-shot adversarial robustness problem. This is especially important given that large-scale vision models are emerging as infrastructure and are deploying to critical applications. We find that the lightweight VPT is noticeably more effective than model finetuning when textual information is unavailable. When texts are used during adaptation, both VPT and finetuning using our TeCoA loss have drastically improved zero-shot adversarial robustness compared to baselines. Finetuning has higher gains than VPT as more parameters tuned. Our best performing model with the TeCoA loss can improve adversarial robustness over CLIP by an average of 31% % across the datasets. Our method also works unlabeled images, allowing for better robustness with large amount of unlabeled data. Our work establish a new and important benchmarket, zero-shot adversarial robustness, for future work evaluate on. We release all models and code.
2 RELATED WORK
Zero-Shot Generalization aims to classify novel classes and tasks that are unseen during train-
ing (Palatucei al. 2009 Lampert al. 2009 Radford al. 202T). . Existing zero-shot methods
often project visual features into semantic feature space (Frome et al. 2013 Akata et al., 2015) Komera-Pareder & Torr 2015: Xie et al. 2019 Yu et al., [2188] Liu et al.
(2019), or use generative
methods to generate fake visual features of unseen classes from their semantic descriptions to train classifiers (Xian et al. 2018 Ni et al.) 2019: Huang et al. 2019 Schonfeld et al.] 2019 Verma et al.) 2019 Liu et al. 2020). Recently, large-scale pretrained vision-languaa models (Radford ict al. 2021 Jia et al. 2021) have shown outstanding zero-shot generalization ability on unseen tasks via text prompt engineering. Their adversarial robustness and its transferability, however, has not been studied in the zero-shot setting.
Adversarial Robustness. Adversarial attacks for image recognition find additive vector on the input to maximize the cross-entropy loss, which is calculated from the model prediction and the ground truth one-hot label (Szegedy al. (2013): Athalye et al. (2018); Carlini & Wagner (207));
2

---

Published as a conference paper at ICLR 2023
Kurakin et al. (2017); Papernot et al. (2013): Moosavi-Dezieee et al. (2016)). Adversarial train- ing (Madry et al. al.] [2018) and its variants (Zhang et al. 2019; Rice et al. 2020). which train the model
the task that they have been trained on. However, it is unclear whether this approach can improve robustness in the zero-shot scenario. To the best of our knowledge, Yucel et al. (2020) is far the only work that studies the adversarial robustness of zero-shot learning models. Their setting is limited because it relies on predicting robust attributes, which may be easily available for many tasks.
on generated adversarial examples, are effective in improving adversarial robustmess
Transferability of Robustness, Mao et al. (2020) shows that adversarial robustness is transferable across tasks when multiple tasks are trained together. Salmmn et al. (2020) shows that adversarially robust models transfer better than their cundard-trainee counterparts when they are finetuned on other tasks. Chan et al. (2020) finds that matching robust model's 's gradient can transfer robustness to a new model. Vaishnavi et al.J (2022) proposes a low-cost method to transfer robustness to new model on the same task with different architecture. However, the transferability of adversarial robustness to zero-shot tasks has not been investigated.
Contrastive Learning (Oord et al. 2018) has been used to train large-scale image-langual mod- els (Jia et al. 202TT Radford et al. 2021). Kim et al. (2020); Jiang et al. (2020) propose instance- wise adversarial perturbation and use a contrastive loss to align the features of clean examples and generated adversarial examples. Our method is the first one introduce cross-modal image-text contrastive loss in adversarial contrastive learning.
Adapting Pretrained Models. Linear probing and finetuning the major ways adapt deep pretrained models. Recently, a more lightweight adaptation method, prompt tuning, has been pro- posed (Zhou al. 2022cc a). (Shu et al. (2022) shows that test-time optimization for text prompting helps generalization. Bar et al. (2022) combines target task and image inpainting to achieve zero- shot task inference. Jia et al. (2022); Sandler al. (2022) used visual prompting replace the finetuning procedure for large-scale models. |Bahng et al. (2022) optimizes visual prompt to in- crease the performance on the same task that the model finetunes the visual prompt on. [Ma et al. : et al. (2022); ; Mao et al. (2022) find input prompt with self-supervised objective for robustness. Prompt tuning for continuous learning has also been proposed (Conder et al.) [2022). Liu amortized approach to use fewer iterations to adapt models. |Wang et al. (2019) showed that it useful in improving the performance for healthcare, and et al. showed can be used to adapt generative models for solving under constrained problems. However, adapting large-scale models for transferable zero-shot robustness, using methods such as finetuning or visual prompting, has not been investigated.
et al. (2022) proposes
MODEL ADAPTATION FOR ZERO-SHOT ADVERSARIAL ROBUSTNESS
We first give baougd Section 3.1 on adversarial attacks, adversarial training, and the problem setup. In Section 3.2 we discuss adaptation methods for adapting large-scale models for zero-shot adversarial robustness. Finally, Section 3.3 we discuss the effect of different training losses to motivate and then introduce our proposed text-guided contrastive adversarial training (TeCoA) loss.
3.1 BACKGROUND AND PROBLEM SETUP
Let (-) be a deep model for image recognition parameterized by 0. Given an input image x, the model produces representation Fx)... For image classification, standard model learns to minimize the cross-entropy loss, C(x. y) = one-hot vector.
where the label y is often represented by
Aveeraaral& Attacks. An adversary (i.e., attacker) typically optimizes for an additive transformation 6 to the image, X, + 8, which can fool the model Fy to make incorrect predictions:
X, = argmax ((Xay)) S.t. ||x,
x11g S c.
x.
Here, the magnitude of the added pattern is bounded by q-norm ball of radius e, making the attack perceptually invisible. The role a defender is to find ways to correct the influence the attacks and ensure that the model is robust the adversarial perturbations.
3

---

Published as a conference paper at ICLR 2023
Adapted
[a] Linear probing
[b) Partial finetuning
[c] Full finetuning
[6] Image-level prompting
Tokeen
Input Level
[c10]
(CL0]
C
Token Prompt
Encoder Level
Uneer
PEX)
Output Level
0
Figure 2: Adaptation methods for large- scale pretrained CLIP model for zero-shot adversarial robustness. (a) Linear probes that adapt the readout layer. (b) Partial finetuning that only updates the last few layers of the model. (c) Finetuning the whole model. (d) Adding visual prompting the input image. (c) Appending visual prompt tokens to the input token sequence.
Zero-Shot Adversarial Robustness. Large-scale vision-language models generalize well to new tasks and datasets at test time. However, the zerv-shot transferability of adversarial robustness of these models is less explored. In zero-shot adversarial robustness setup, study the worst case: we assume that the attacker has the significant advantage of unrestricted access to the ground truth of new tasks at test time, while the defender has access. While the attacker can directly optimize for an attacked image that fools the model, the defender needs to be robust on all kinds of unseen data and tasks. Compared to the commonly-used robustness setting, which only evaluates robustness the trained task, our setup is more challenging.
Adversarial Training is the common strategy improve model's adversarial robustness. By retraining the model on mined adversarial examples, the model is incentivized to learn features invariant under adversarial transformations. The defender often optimizes for the objective
= argmin ((Fgx)))))))))))
so that the model Fg still makes correct predictions on the generated adversarial examples. As shown in Figure [ the vanilla adversarial training approach is effective tasks but fails when the model is evaluated on attacked data from unseen tasks.
3.2 ADAPTING THE LARGE-SCALE MODELS
One of the key advantages of large-scale pretrained models is that the features of these models are generalizable to various tasks without full retraining. Thus, would like to make lightweight adjustment to the models with small set of training data of attacked images on known tasks, and maximally retain the zero-shot generalization ability of these large models while improving their adversarial robustness on new tasks. We adopt CLIP, one of the best performing vision-language models for zero-shot recognition, as our base model, and investigate a few adaptation strategies as shown in Figure 2 improve the zero-shot adversarial robustness of CLIP.
Finetuning (FT). A typical way to adapt pretrained model, finetuning, is to update the parameters of the model either entirely or partially. While this approach improves model robustness on the target distribution, Radford et al. (202l) ) and Pham et al. (2021) show that this improvement often comes at cost of generalization; directly modifying model parameters may lead to higher tendency towards overfitting.
Visual Prompting (VP). Recently, visual prompt tuning has emerged as a lightweight approach for adapting pretrained large-scale models. Originating from the natural language processing commu- nity, the key idea of prompt tuning is to identify prompts decorate the inputs that effectively query the pretrained models. The computer vision community recently adopted this idea and starting explore approaches that modify input images in pixel space better adapt large-scale vision

---

Published as a conference paper at ICLR 2023
Image Encoder
Language Encoder
photo (hommingaizd)
T
Attock Vector
Original Imput
d.)
Text-Guided Contrative Adversarial Learning. Instead of using one-hot embedding based supervi- sion, use adverasrial contrastive learning with language supervision, which achieves better zero-shot robust- ness transferability.
Figure 3:
models for downstream tasks. For Taansormer-basee models, visual prompting methods either learn token that is appended the input token sequences (Bar al. 2022) learn direct modification to the input images (Bahng et al. 2022 for adaptation, as shown by (d,e) in Figure
In our study, we conduct an extensive analysis over both adaptation methods better understand adapting large-scale models for zero-shot adversarial robustness.
3.3 TEXT-GUIDED ADVERSARIAL CONTRASTIVE ADVERSARIAL TRAINING
Through our initial experiments, we conjecture that the training objective might play key role in improving the zero-shot adversarial robustness of the models. RRaffrrd et al. (2021) indicates that the zero-shot generalization ability of large-scale vision-language models may come from their language supervision. For example, CLIP learns joint zero-shot generalization at test time. If we simply finetune the visual encoder with one-hot labels, may break the joint feature space and harm this zero-shot generalization ability. These observations motivate us to consider using the text information when generating the adversarial examples and also in the training objective during model adaptation.
feature space, which helps
We now introduce the Text-guided Contrastive Adversarial (TeCoA) training loss, to effectively incorporate text information. In contrast to prior contrastive learning which does image-to-image contrastive learning (Jiang et al., 20200 Kim et al. (020), we consider a cross-modal text-to-image contrastive learning paradigm. We first generate set of adversarial examples conditioned on the text inputs which are targeted to fool the model about the correspondence between image features and text embeddings. TeCoA then tries minimize the feature distance between the attacked image and the correct corresponding text inputs contrastively (Figure 33. We provide additional discussion of this text-image contrastive objective Appendix(A..
Concretely, given set of image and text pairs {(x;, t:)), we use the pretrained CLIP model to encode each pair with an image encoder Fo and a text encoder T. We then have the following image-to-text contrastive loss function,
exp(cos(2) ( ,2, 1/T)
(x, E Yis log
Σn exp(cos(z) (1) . (1)/))
( T(t.) are the features from the input text. We use Yiy to indicate which image-text pairs are positive and which are negative; this indicator satisfies Yij = if and only if the examples = j. and otherwise. т is a sealar hyper-parameter, and cos denotes the cosine similarity function.
where the 2 (xx, are the features of the input image, and z
Constructing Adversarial Examples for Image- Text Pair. Instead maximizing the standard cross-entropy loss, maximize the image-text contrastive loss given batch of natural images and text
X argmax (X,, t, s.t.
||x.
x11y <.c.
Here, for image x; in the batch, the associated text t; can be its natural label text or constructed via the standard prompts for the zero-shot tasks (e.g.. "a photo of [LABEL]"). The indicator Yi, when image x; has category j as its ground-truth class, and otherwise. In practice, we find this objective is effective at generating adversarial examples for zero-shot image recognition tasks.
Text-Guided Contrastive Adversarial Training. Once we have the adversarial examples, we op- timize the parameters 0 of the vision encoder Fg to minimize the aforementioned objective (Equa-
5

---

Published as a conference paper at ICLR 2023
tion 8 the generated adversarial examples,
= argmin L. (Xa, y,
(5)
Our algorithm iteratively alternates between generating adversarial examples and updating the model via Equation [5] Since TeCoA uses additional information from the text embeddings to correct the visual features corrupted by the adversarial attacks, it helps the model to retain zero-shot transfer- ability regarding adversarial robustness.
Contrastive Adversarial Training without Text. To validate whether the gain of zero-shot robust- ness comes from language supervision is due the formulation of the contrastive loss itself, consider two variants of contrastive losses which do not utilize languages in our experiments. One contrastive adversarial training loss with one-hot labels (CoAdv )) where the label information is encoded as a one-hot vector and is used to contrast with the image features. Another is based on Jiang al. (2020), where the model is finetuned on adversarial examples fool the image-to- image contrastive loss, denoted as ImgCoAdv. More details are presented in Section
4 EXPERIMENTS
We start by describing our experiment setups and present the experimental results 16 datasets in Section 4.1 We observe that CLIP adapted with TeCoA achieves average of 31 points im- provement across the datasets over the original CLIP model. In Section 4.2] we provide extensive analysis over the design choices involved in our approach and identify that the of language in TeCoA largely improves the model's 's zero-shot adversarial robustness.
Datasets. We evaluate the zero-shot adversarial robustness conferred by TeCoA trained Ima- geNet (Deng et al. 2009a) and report the performance of the models on the ImageNet test set as well 15 zero-shot test datasets, covering diverse range of recognition tasks. Specifically, we include
CIFARIO 10, CIFAR100 (Krizhevsky et al./ (2009), STL10 (Coates et al. 2001]. Caltech101 (Fei-Fei al., 2004), and Caltech256 (Griffin al. (007)) for generic classification; OxfordPets (Parkhi et al. 2012). StanfordCars (Krause et al. 2013). Food101 (Bossard et al. 2014), Flowers (Nils-
back & Zisserman 20088. and FGVCAircraft (Maji al., 2013) for fine ame-grained classification;
SUN397 (Xiao et (010)) for scene recognition; and DTD (Cimpoi et al., (014)) for texture recog- nition. Finally, we include three datasets with spnain-specialized tasks, PatchCamelyon (PCAM, lymph node tumor detection) (Veeling et al. 2018), HatefulMemes (hatespeech detection) (Kiela ct al. 2020), and EuroSAT (satellite image classification) (Helber et al. 2017).
Baselines. We consider multiple variants to adapt CLIP (Radford al. 2021h. For adaptation
methods, we consider visual prompting (VP) (Bahng et al. 2022) linear probing (LP) and finetuning (FT). Since LP involves training a linear readout layer the target task, it is not shro-shot, but we still evaluate for reference. For training losses, we consider
(1) vanilla cross cross-entropy loss (CE);
(2) standard adversarial training loss (Adv.) ) with the cross-entropy loss;
(3) contrastive adversarial training loss (CoAdv.) ):
(4) contrastive adversarial training over images (ImgCoAdv.).
(5) our weeeee-xxiidee contrastive adversarial training (TeCoA).
In our experiments, we name these variants by adaptation (loss). Detailed formulations and associated training algorithms for each loss can be found in Section A.3
Implementation Details. We use CLIP-B/32 architecture. We optimize the model using an SGD optimizer with momentum 0.9, We train for 10 epochs. For finetuning, we use learning rate of le - 5. For visual prompt tuning, we use a learning rate of 40 and a batch size of 256. For prompt tuning on the entire ImageNet dataset, we use token-level prompt with size 200, while for subsets of ImageNet (IK, 5K, and 50K images), we use token-level prompt with size and a smaller batch size of 64. Unless specified, during adversarial training, we generate Lint 1/255 bounded attacks using a 2-step PGD attack (Madry et al. 20188) with step size a = 1/255. We test the robustness of model using 100 steps of PGD attack, with step size 1/255.

---

Published as a conference paper at ICLR 2023
Zero-shot robust accuracies on images attacked with 100 steps of PGD. We show the test accuracy for 16 tasks (columns) and 12 different methods (rows). We show the average performance of each method in the last column. The best accuracies are bolded. Standard adversarial finetuning achieves the highest robust accuracy on ImageNet, but this gain comes the cost of losing robustness other zero-shot tasks. Adversarial visual prompting improves the average robustness from 10.6 to 31.8. Adding TeCoA with language supervision improves the robustness for both visual prompting and finetuning, where finetuning with TeCoA achieves the best overall robustness, outperforming vanilla CLIP by 31 points.
Table 1:
DATASETS
ImageNet
CIFARIO
STL-10
CIFARION
StanfundCars
Food101
OxfordPet
Flower 02
EUROSAT
PGVC
HateMemes
PCAM
Caltech101
Caltoch256
Average
SUN
DTD
Method
CLIP
1.72
9.57
35,40
4.55
1.02
0.27
3.95
2.72
1.19
2.5
0.04
0.00
2.20
0.10
24.63
15.27
6.57
+VPT (CE)
2.27
13.25
40.74
5.59
1.60
0.21
4.21
3.24
1.77
3.56
0.01
0.00
2.47
0.21
28.46
17.17
7.79
+LP (CF)
5.78
22.07
16.52
16.02
12.11
0.20
5.625
0.00
0.00
0.00
6.06
0.00
44.53
50.11
36.72
20.12
16.00
.FT (CE)
9.13
27.60
61.33
8.50
4.74
1.12
10.13
25.81
5.58
2.61
0.52
0.00
1.07
1.15
44.98
35.44
14.98
+VPT (Adv)
17.50
45,39
72.52
22.10
18.15
9.65
16.02
44.53
25.06
20.27
2.12
3.39
54,30
52.57
61.93
44.06
31.84
+VP (CoAdv.)
17.20
40.72
72.11
20.53
18.01
10.26
15.04
42.71
22.15
21.65
2,80
2.79
26.57
13.69
62.03
43,23
26.97
.VP (ImgCoAdv.)
1.07
8.35
17.44
2.12
2.58
0.03
0.94
3.54
1.94
7.39
0.10
0.03
6.37
14.96
14.38
6.91
5.51
VPT (IcCoA)
23.71
49.18
75.54
25.82
24.87
10.91
20.10
48.57
23.73
21.11
11.26
4.05
31.13
30.50
63.79
47.66
32.00
+FT(dvy)
45.12
11.04
25.90
1.51
0.52
0.25
0.56
20.40
0.11
2.77
3.62
0.48
23.12
24.86
6.68
2.92
10.62
+TT (CoAdv.)
33.41
2.51
5.92
0.40
0.01
0.14
0,09
0.19
0.47
0.21
6.62
0.42
30,2
44.7
0.06
0.08
7.83
+FT (ImgCoAdv.)
0.03
4,00
3,76
0.37
0.12
0.05
0.17
0.57
0.21
0.96
4.13
0.18
32.93
26.41
0,33
0.18
4.65
FT' (IBCAA)
41.88
59.28
83.45
34.13
29.81
13.37
27.99
62.61
30.69
22.88
15.18
5.10
31.97
23.87
69.07
59.54
38.18
1-shot
S-shot
50-shot
1000-hhot
(a) Adversarial Visual Prompting (Robust)
(b) Adversarial Finetuning (Robust)
une Booeat
ros Servet hastattenn
cianmtol Caterisse
Imageter
coeeto
rumyy
Bantertan
roetad
oreatted
oro Baresl Recort
celental
[c) Adversarial Visual Prompting (Cican)
Adversarial Finetuning (Clean)
100
200
193
Figure 4: Effect of training set size. We consider several setups where only a restricted number of samples from each training class are available during adversarial training with TeCoA. Training more data in general improves zero-shot robustness, but not affect clean performance much.
4.1 EXPERIMENTAL RESULTS
We first use PGD attack with 100 steps to evaluate the robustness of CLIP models that are adapted on ImageNet. In Table we show the robust accuracies for the models on the Imagenet test set and 15 zero-shot recognition tasks (i.e., the training classes and test classes are non-overlapping). Each row is the robust accuracy for one method, where we compare the proposed TeCoA with VP and FT against 10 basclines and their variants. We bold the best results for each dataset (column).
From Table [ we can see that most adapted models with adversarial training losses except for IngCoAdv. have better robust accuracies compared to the standard cross-entropy loss. If using adversarial training. the vanilla FT (Adv.), ), which finetunes the entire model with adversarial training, achieves the best adversarial robustness on ImageNet (non zero-shot data, same as the training tasks) while the average robust accuracy is 10.62%, which is only slightly better than the original CLIP (6.57%). In the meantime, VP (Adv.) achieves much better results, improving the
7

---

Published as a conference paper at ICLR 2023
c=
3/255
X33 == 2/255
SS
== 4/255
100
200
Ributt Acturay
5
Claan
are
Eareiar rive Alcvet resetatteee
Figure 5: Zero-shot adversarial robustness under different perturbation bounds (E =
2 255). We vary the
perturbation bound for adversarial finetuning with TeCoA. Each adapted model is evaluated under attacks from the same hound seen during training. We show both the robust accuracy (left) and clean accuracy (right). Our defense is still effective on zero-sho shot tasks when the perturbation gets larger.
Irage Nompl
Teean Nhomat Dopproee
Pewdurnrg
Phanoting
are
(a) Visual Prompt Design
(b) Partially FT vs. VP
Figure 6: (a. left) We conduct an ablation study of whether to add visual prompt to the input image or to append prompt token the input sequence. (b, right) We optimize the same amount of parameters in partial finetuning and VP, we find VP more effective when only a small number of parameters are optimized.
accuracy number from 6.57% to 31.84%. This indicates that visual prompting more powerful than finetuning when coupled with the standard adversarial training.
Within each set of the variants using the same adaptation method, we compare the effectiveness of different training losses. We notice that both CoAdv. and ImgCoAdv, are much worse than the proposed TeCoA and even the standard adversarial training (Adv.) )) This indicates that the formu- lation of contrastive learning may not necessarily help improve the zero-shot adversarial robustness and the use of the language supervision might.
Overall, we find that adapting CLIP with TeCoA using model finetuning presents the best per- formance across the datasets, improving the accuracy number from 6.57% to 18%, roughly 31 points. This might look counter-intuitive as VP significantly outperforms FT under the standard adversarial training without texts. One hypothesis is that with sufficient semantic information at test time, finetuning that directly modifies the model parameters may be more expressive than just modifying the inputs given more model parameters are tuned. In Table 3 in Appendix, we show the clean accuracy of the same models, which gives similar trend as the robust accuracies. We also show results under = 1/255 and = 4/255 using AutoAttack Croce & Hein (2020) in Table and Table where our model is still more robust than baselines, up to an average of 36 points. We describe details in Section A.2
4.2 ANALYSIS
Training Set Size is an important factor when adapting large-scale models. In Figure 4 we show the results of adapting CLIP with TeCoA with 5, 50, and 1000 shot per category on ImageNet. We observe that increasing the amount of training data improves robust accuracy. Moreover, we also find that FT (TeCoA) outperforms the non-adapted CLIP even when the model is adapted with just one shot per class (the blue bars in Figure 4)
Effeet of Attack Strength. To validate whether our method works when the adversarial perturba- tions become larger, we increase the perturbation bound for our TeCoA adversarial training. Figure shows that, while increasing the attack strength decreases the robust accuracy, our model can still transfer robustness to zero-shot tasks.
Visual Prompt Designs. There are two ways to design visual prompts. One is to append additional tokens to image tokens and the other is to add small decoration (i.e., learnable noises) the in-
8

---

Published as a conference paper at ICLR 2023
SUN3997
Flower220
Caltechi 01
25
25
20
Roows Gain: 0.3%
Rebust Galno
Ropeat GaT: 0.03%
RoBval Galts 0.20%
Iendune)
56 10
64 80
93
52
Acourscy
Accuracy (6)
ACCursy
Accurncy
Balancing model robustness and clean accuracy via weight interpolation. By changing the inter- polation ratio for the adapted CLIP and vanilla CLIP weights, we can dynamically improve clean accuracy robust accuracy. There a win-win sweet spot, indicated by the star. where we improves on both zero-shot robust accuracy and zero-shot clean accuracy.
Figure 7:
Table 2: Are labels required to adapt large-scale models for zero-shot adversarial robustness? We find we achieve similar zero-shot adversarial robustness by adapting the model on unlabeled data using our algorithm.
DATASETS
CHARTO
STL-10
CIAARIO
StinfoedCars
FoodTOL
OxfondPet
Flowrr
EUROSAT
POVE
HineMemes
Coleahh 01
Calkee2566
Averuge
SUN
Methol
Labeled?
VPT (IeCoA) Kobust Accuracy
Yes
23.71
49.18
75.54
25.82
24.87
10.11
20.00
48.57
23.73
21.11
11.25
4,05
31.13
30.50
63.
47.66
32.00
VPT (TcCoA) Robust Accuracy
No
23.79
48.73
75.43
34.83
22.
58
12.05
30
38
47.36
24
54
21.22
12.49
3,48
26
40,22
65
05.55
49.41
32.40
VPT (TeCoAl Clean Accuracy
Yes
48.84
91.59
30.97
52.41
45.78
31,86
15.93
12.24
58.53
47.85
98.19
71.66
53.00
(TeCoA) Clean Accurney
55.83
53.46
(TCCo)) Robust Accuracy
Yes
41.88
29,81
27.99
30.09
15.18
31.97
09:07
(TSCoA) Rebust Accuncy
No
38.76
60.90
79.41
31,56
30.33
13.87
23.72
20 48
22.50
11.67
5.10
29.97
19.14
67.49
59.41
36.63
(TCCAA Clean Accuracy FT (TCCAA Clean Accuracy
Yes
63.87
78.12
93.30
19.68
51.28
33.30
55.37
81.58
50.92
34.15
27.57
13.89
53.67
49.01
83.51
76.51
55.97
No
58.87
80.51
91.18
49.08
34.93
39.39
59.14
77.62
50.79
$4.20
26.13
14.52
52.10
52.97
81.39
77.93
56.30
put images. From Figure 6a we can see appending learnable tokens in the input token sequences achieves consistently better performance than just adding the prompt value to the images.
Number of Adapted Parameters. The number of parameters that are adapted during training highly affects model performance. VP is light-weight, as it only modifies the inputs, while FT may either adjust part of the model or the entire model. In Figure (bb] we show the comparison of partially finetuning and visual prompting of CLIP. We can see that with the same amount of parameters adapted, visual prompting is more effective in adapting the large scale model for zero- shot adversarial robustness.
Are Labels Required for Adapting CLIP? Unlabeled data is rich. We investigate it's necessary to use the groundtruth labels from images. We generate the pseudo text labels that CLIP retrieves from clean images, where we show details in Section A.335) We then run our TeCoA on the pseudo labels in the same way as the labelled data. We show experimental results in Table 2 where we obtain a similar zero-shot robust accuracy even without labels.
Trading off between Robust Accuracy and Clean Accuracy. Similar to typical adversarial train- ing, TeCoA also poses a trade-off between the clean accuracy and the robust accuracy Tsipras et al. 2019). Idcally, we want be able to dynamically adjust this trade-off depending level of adversarial robustness. Here we can balance this trade-off by using model weights inter- polation (Wortsman et al. 2022). In Figure we can there is sweet spot in interpolating the model where we improve both the robustness and clean accuracy, marked by the star in the figure.
the desired
CONCLUSION
In this paper, we provided a holistic study of the zero-shot adversarial robustness problem of large- scale vision-language models. We identified the effects of various adaption methods and training losses when adapting models, and conjectured that existing methods failed to generalize to new tasks due to the lack of the language supervision. We proposed text-guided contrastive adversarial training (TeCoA) which can be used with model finetuning and visual prompting to drastically im- prove the zero-shot adversarial robustness of CLIP. Extensive experimental evaluation showed the effectiveness of TeCoA, and the detailed analyses provide useful lessons for adapting large-scale models to improve their shro-shot adversarial robustness, shedding light this important problem.

---

Published as a conference paper at ICLR 2023
6 ACKNOWLEDGEMENT
This research is based on work partially supported by the DARPA SAIL-ON program, the DARPA MCS program, the NSF NRI Award #2132519, a GE/DARPA grant, CAIT grant, and gifts from JP Morgan, DiDi, and Accenture.
REFERENCES
Michael Ahn, Anthony Brohan, Noah Brown, Yevgen Chebotar, Omar Cortes, Byron David, Chelsea Finn, Keerthana Gopalakrishman, Karol Hausman, Alex Herzog, et al. Do as i can, not as say: Grounding language in robotic affordances. arXiv preprint arXiv:2204.0169 2022.
Zeynep Akata, Scott E. Reed, Daniel Walter, Honglak Lee, and Bernt Schiele. Evaluation of output
embeddings for fine- one-grained image classification. In IEEE Conference on Computer Vision and Puttern Recognition, CVPR 2015, Boston, MA, USA, June 7-12, 2015, pp. 2936. IEEE URL https:ttpsse.mmm / /oo.i.d////// org/10.
Computer Society, 2015. doi:
11C9/CVPR. 2015. 7298911
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense se- curity: Circumventing defenses to adversarial examples. In Proceedings of the 35th International Conference on Machine Learning, volume 80, pp. 274-283. PMLR, 2018.
H Bahng, A Jahanian, S Sankaramarayanan, and P Isola. Exploring visual prompts for adapting large-scale models. arXiv preprint arXiv::203. 0112203.77221 17274, pp. 2022, 2022.
Amir Bar, Yossi Gandelsman, Trevor Darrell, Amir Globerson, and Alexei A. Efros. Visual prompt- ing via image inpainting. arXiv preprint arXiv:2209. 00647, 2022.
Lukas Bossard, Matthieu Guillaumin, and Luc Van Gool. Food-101 mood-101-mining discriminative compo- nents with random forests. In European conference on computer vision, pp. 446-461. Springer, 2014.
Nicholas Carlini and David A. Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy, pp. 39-57, 2017.
Alvin Chan, Yi Tay, and Yew-Soon Ong. What it thinks is important is important: Robustness transfers through input gradients. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 332-341, 2020.
M. Cimpoi, S. Maji, I. Kokkinos, S. Mohamed, and A. Vedaldi. Describing textures in the wild. In Proceedings of the IEEE Conf. on Computer Vision and Pattern Recognition (CVPR), 2014.
Adam Coates, Andrew Ng. and Honglak Lee, An analysis of single-layer networks in unsupervised feature learning. In Proceedings of the fourteenth international conference on artificial intelli- gence and statistics, pp. 215 215-223. JMLR Workshop and Conference Proceedings, 2011.
Jonathan Conder, Josephine Jefferson, Khurram Jawed, Alireza Nejati, Mark Sagar, al. Effi- cient transfer learning for visual tasks via continuous optimization of prompts. In International Conference on Image Analysis and Processing, pp. 297-309. Springer, 2022.
Francesco Croce and Matthiss Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-fre free attacks, In ICML, 2020.
Deng, Dong, R. Socher, L. Li, Li, and I.. Fei-Fei. ImageNet: Large-Scale Hierarchical Image Database. In CVPR09, 2009a.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Fei-Fei. Imagenet: A large-scalo hi- crarchical image database. In 2009 IEEE conference computer vision and pattern recognition, pp. 248 255. leee, 2009b.
Yinpeng Dong, Fangzhou Liao, Tianyu Pang. Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boost- ing adversarial attacks with momentum. In CVPR, pp. 9185-9193, 2018.
10

---

Published as a conference paper at ICLR 2023
Li Fei-Fei, Rob Fergus, and Pietro Perona. Learning generative visual models from few training examples: An incremental bayesian approach tested on 101 object categories. Computer Vision and Pattern Recognition Workshop, 2004.
Andrea Frome, Greg S Corrado, Jon Shlens, Samy Bengio, Jeff Dean, Mare Au- relio Ranzato, and Tomas Mikolov. Devise: A deep visual-semantic embedding model. In C.J. Burges, L. Bottou, M. Welling, Z. Ghahramani, and K.Q. Weinberger (eds.), Advances in Neural Information Processing Systems, volume 26. Curran Asso- ciates, Inc., 2013. URL htttps::/pprcceediin. httpp/essecccccpppa////2221333 pttpppppppp//1///11eeee Paper.
Gregory Griffin, Alex Holub, and Pietro Perona. Caltech-256 object category dataset. 2007.
Patrick Helber, Benjamin Bischke, Andreas Dengel, and Damian Borth. Eurosat: A novel dataset and deep learning benchmark for land use and land cover classification, 2017.
He Huang, Changhu Wang, Philip S. Yu, and Chang-Dong Wang. Generative dual adversar- ial network for generalized zero-shot learning. In IEEE Conference on Computer Vision and Paltern Recognition, CVPR 2019, Long Beach, CA. USA, June 16-20, 2019, pp. 801-810. Computer Vision Foundation IEEE, 2019. doi: 10. 10.1109/CVPR.C 2019..000090000 9,00099. thecv. com/ content CVPR 2019/html (aattmm//Huaggg /uungg Generative Laairativee__aallllla Adversarial Network for Generalized Zero- Shot Learning hwwpggg______________ 201 wap.p.pp....... html
URL
Chao Jia, Yinfci Yang, Ye Xia, Yi-Ting Chen, Zarana Parekh, Hicu Pham, Quoc Le, Yun-Hsuan Sung, Zhen Li, and Tom Duerig. Scaling up visual and vision-language representation learning with noisy text supervision. In International Conference on Machine Learning, pp. 4904 4916. PMLR, 2021.
Menglin Jia, Luming Tang, Bor-Chun Chen, Claire Cardie, Serge Belongie, Bharath Hariharan, and Ser-Nam Lim. Visual prompt tuning, arXiv preprint arXiv:2203.12119, 2022.
Ziyu Jiang, Tianlong Chen, Ting Chen, and Zhangyang Wang. Robust pre-training by adversar- ial contrastive learning. Advances in Neural Information Processing Systems, 13:16199-16210, 2020.
Douwe Kiela, Hamed Firooz, Aravind Mohan, Vedanuj Goswami, Amanpreet Singh, Pratik Ring- shia, and Davide Testuggine. The hateful memes challenge: Detecting hate speech multimodal memes. Advances in Neural Information Processing Systems, 13:2611-2622 2020.
Minseon Kim, Jihoon Tack, and Sung Ju Hwang. Adversarial self-supe contrastive learning. Advances in Neural Information Processing Systems, 33:2983-2994,, 2020.
Jonathan Krause, Michael Stark, Jia Deng, and Li Fei-Fei. 3d object representations for fine-grained categorization. In 4th International IEEE Workshop on 3D Representation and Recognition (3dRR-13) Sydney, Australia, 2013.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial examples in the physical world. CoRR, 03//1607002533 2017.
Christoph H. Lampert, Hannes Nickisch, and Stefan Harmeling. Learning to detect unseen ob- ject classes by between-class attribute transfer. In 2009 IEEE Computer Society Conference Computer Vision and Puttern Recognition (CVPR 2009), 20-25 June 2009, Miami, Florida, URL
USA, pp. 951-958. IEEE Computer Society, 2009. doi: 10. (009/CVPR22099.20066
Matthew Lawhon, Chengzhi Mao, and Junfeng Yang. Using multiple self-supervised tasks improves model robustness. arXiv preprint 2rX1v:2204.03714, 2022.

---

Published as a conference paper at ICLR 2023
Bo Liu, Qiulei Dong, and Zhanyi Hu. sero-shot learning from adversarial feature residual to compact visual feature. In The Thirty-Fourd AAAI Conference on Artificial Intelligence, AAAI
2020, The Thirty-Secone Innovative Applications of Artificial Intelligence Conference, IAAI
2020, The Tenth AAAI Symposium on Educational Advances in Artificial Intelligence, FAAI
2020, New York, NY, USA, February 7-12, 2020, pp. 11547-11554. AAAI Press, 2020. URL
org/ index.ndxx..
Ruoshi Liu, Sachit Menon, Chengzhi Mao, Dennis Park, Simon Stent, and Carl Vondrick. Shape analysis by shadow synthesis.
Ruoshi Liu, Chengzhi Mao, Purva Tendulkar, Hao Wang, and Carl Vondrick. Landscape learning for neural network inversion. arXiv e-prints, pp. arXiv-2206, 2022.
Yang Liu, Jishun Guo, Deng Cai, and Xiaofei He. Attribute attention for semantic disambiguation in zero-shot learning, In 2019 IEEE/CVF International Conference Computer Vision, ICCV 2019, Seoul, Korea (South), October 27- November 2. 2019, pp. 6697-6706. IEEE, 2019. doi: 10.1 10.1109/CCCV2211.000088 Utthttps: /twii org /ttg/1..... 10011199//000 ICCV. 2019. 00680
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.
Towards deep learning models resistant adversarial attacks. ICI.R, 2018.
S. Maji, J. Kannala, E. Rahtu, M. Blaschko, and Vedaldi. Fine-grained visual classification of aircraft. Technical report, 2013.
Chengzhi Mao, Ziyuan Zhong, Junfeng Yang, Carl Vondrick, and Baishakhi Ray. Metric learning for adversarial robustness. In Advances in Neural Information Processing Systems, volume 32.
Curran Associates, Inc., 2019.
Chengzhi Mao, Amogh Gupta, Vikram Nitin, Baishakhi Ray, Shuran Song, Junfeng Yang, and Carl Vondrick. Multitask learning strengthens adversarial robustness. In Andrea Vedaldi. Horst Bischof, Thomas Brox, and Jan-Michael Frahm (eds.), Computer Vision - ECCV 2020, pp. 158- 174, Cham, 2020. Springer International Publishing.
Chengzhi Mao, Mia Chiquier, Hao Wang, Junfeng Yang, and Carl Vondrick. Adversarial attacks reversible with natural supervision. In Proceedings of the IEEF/CVF International Conference on Computer Vision, pp. 661-671, 2021.
Chengzhi Mao, Lingyu Zhang, Abhishek Joshi, Junfeng Yang. Hao Wang, and Carl Vondrick. Robust perception through equivariance, 2022. URL httpss//aarxiv..rrg/bbbb//// 06079
Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: simple and accurate method to fool deep neural networks, 2016.
Jian Ni, Shanghang Zhang, and Haiyong Xie. Dual adversarial semantics-consisttrn network for generalized zero-shot learning. In Hanna M. Wallach, Hugo Larochelle, Alina Beygelz- imer, Florence d' Alché-Buc, Emily B. Fox, and Roman Garnett (eds.), Advances in Neu- ral Information Processing Systems 32: Annual Conference on Neural Information Pro- cessing Systems 2019, NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada, pp. 6143-6154, 2019, URL http:ttts/////rooeiiings http://wwwrripp..cpaaeee/////// pctppp/e////11////ss/// c4 20661220udd3311200001111a1222222 AAt.EDDEee....teeeeeeeeeeaaaaaaa html
Abstract
Maria-Flena Nilsback and Andrew Zisserman. Automated flower classification over a large number of classes. In 2008 Sixth Indian Conference Computer Vision, Graphics & Image Processing, pp. 722-729. IEEE, 2008
Aaron van den Oord, Yazhe Li, and Oriol Vinyals. Representation learning with contrastive predic- tive coding. arXiv preprint | 2018
Mark Palatucci, Dean Pomerleau, Geoffrey E Hinton, and Tom M Mitchell. Zero-shot learn- ing with semantic output codes. In Y. Bengio, D. Schuurmans, J. Lafferty, C. Williams, and A. Culotta (eds.), Advances in Neural Information Processing Systems, volume 22. Curran As- sociates, Inc., 2009. URL tts htwpeeediiiiinss.enineeeeeeeeeee httpp//wwpp.cpppppp//////////... 0aweaaae810033eeeee0eeee0000
3053 .d
12

---

Published as a conference paper at ICLR 2023
Tianyu Pang, Xiao Yang, Yinpeng Dong, Hang Su, and Jun Zhu. Bag of tricks for adversarial training, 2020.
Nicolas Papernot, Patrick D. McDaniel, Somesh Jha, Matt Fredrikson, Z. Berkay Celik, and Anan- thram Swami. The limitations of deep learning in adversarial settings.
2015.
Omkar M Parkhi, Andrea Vedaldi, Andrew Zisserman, and CV Jawahar. Cats and dogs. In 2012 IEEE conference on computer vision and pattern recognition, pp. 3498-3505. IEEE, 2012.
Anibal Pedraza, Osear Deniz, and Gloria Bueno. On the relationship between generalization and robustness to adversarial examples. Symmetry, 13(5):817, 2021.
Hieu Pham, Zihang Dai, Golnaz Ghiasi, Hanxiao Liu, Adams Wei Yu, Minh- Thang Luong, Mingx- ing Tan, and Quoe Le. Combined scaling for zero-shot transfer learning. arXiv preprint arXiv:21 10,000 2021.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, al. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning, pp. 8748-8763. PMLR, 2021.
Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text- conditional image generation with clip latents. arXiv preprint arXiv:2204.06125. 2022.
Leslie Rice, Eric Wong, and J. Zico Kolter. Overfitting in adversarially robust deep learning, 2020.
Bernardino Romera-Paredes and Philip H. S. Torr. An embarrassingly simple approach zero- shot learning. In Francis R. Bach and David M. Blei (eds.), Proceedings of the 32nd Inter- national Conference on Machine Learning, ICML 2015, Lille, France, 6-11 July 2015, vol- ume 37 of JMLR Workshop and Conference Proceedings, pp. 2152-2161. JMLR.org. 2015. URL vv3 htt.p://proceedi: ngs ml wwwpss//3/rroorraaaeeee 2aaer/rmraa---reeell55
Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adver- sarially robust imagenet models transfer better? Advances in Neural Information Processing Systems, 33:3533-3555 3545, 2020.
Mark Sandler, Andrey Zhmoginov, Max Vladymyrov, and Andrew Jackson. Fine-tuning image the transformers using learnable memory. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 12155-12164 2022.
Edgar Schonfeld, Sayna Ebrahimi, Samarth Sinha, Trevor Darrell, and Zeynep Akata. Generalized zero-and few-shot learning via aligned variational autoencoders. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, pp. 8247-8255, 2019.
Manli Shu, Weili Nie, De-An Huang, Zhiding Yu, Tom Goldstein, Anima Anandkumar, and Chaowei Xiao. Test-time prompt tuning for zero-shot generalization in vision-language models, 2022. URLhttpss /tctpp::/arxiv..oo wttp://wwwwrrr/bb///.......
David Stutz, Matthias Hein, and Bernt Schiele. Disentangling adversarial robustness and generaliza- tion. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2019.
Dong Su, Huan Zhang, Hongge Chen, Jinfeng Yi, Pin-Yu Chen, and Yupeng Gao. robustness the cost of accuracy?-a comprehensive study the robustness of 18 deep image classification models. Proceedings of the European Conference on Computer Vision (ECCV), pp. 631-648, 2018.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfel- low, and Rob Fergus. Intriguing properties of neural networks. arXiv: 2013.
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be odds with accuracy, 2019.
13

---

Published as a conference paper at ICLR 2023
Jonathan Uesato, Jean-Baptisn Alayrac, Po-Sen Huang, Robert Stanforth, Alhussein Fawzi, and Pushmeet Kohli. Are labels required for improving adversarial robustness? CoRR, 2019.
Pratik Vaishnavi, Kevin Eykholt, and Amir Rahmati. Transferring adversarial robustness through robust representation matching. arXiv preprint arXiv:2202.00 09994, 2022.
Bastiaan S Veeling, Jasper Linmans, Jim Winkens, Taco Cohen, and Max Welling, Rotation equiv- ariant cnns for digital pathology. In International Conference on Medical image computing and computer-assisted intervention, pp. 210-218. Springer, 2018.
Vinay Kumar Verma, Dhanajit Brahma, and Piyush Rai. A meta-leamiing framework for generalized 2019. URL http:://aaax.v.oor//aa//////////
zero-shot learning. CoRR,
04344
Hao Wang, Chengzhi Mao, Hao He, Mingmin Zhao, Tommi $ Jaakkola, and Dina Katabi. Bidirec- tional inference networks: A class of deep bayesian networks for health profiling. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 33, pp. 766-773, 2019.
Mitchell Wortsman, Gabriel Ilharco, Jong Wook Kim, Mike Li, Simon Korblith, Rebecca Roelofs, Raphael Gontijo Lopes, Hannaneh Hajishirzi, Ali Farhadi, Hongseok Namkoong, al. Robust fine-tuning of zero-shot models. In Proceedings the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 7959-7971, 2022.
Yongqin Xian, Tobias Lorenz, Bernt Schiele, and Zeynep Akata. Feature generating net- works for zero-shot learning. In 2018 IEEE Conference on Computer Vision and Pat- tern Recognition, CVPR 2018, Salt Lake City. UT, USA, June 18-22, 2018, pp. 5542- 5551. Computer Vision Foundation / IEFE Computer Society, 2018. doi: 10. 109/CV... 2018.00581.
www.aaaccccssss....e..eeeeee thecvf. com/ content_cvpr 2C18/htm1/ CVPR 2018 1ate018_pppppeeeeee
Xian Feature Generating
Networks Nettwokk..g.Nttwokk..... Bitrresss__PRRRR
Jianxiong Xiao, James Hays, Krista A Ehinger, Aude Oliva, and Antonio Torralba. Sun database: Large-scale scene recognition from abbey to zoo. In 2010 IEEE computer society conference on computer vision and pattern recognition, pp. 3485-3492. IEEE, 2010.
Guo-Sen Xie, Li Liu, Xiaobo Jin, Fan Zhu, Zheng Zhang, Jie Qin, Yazhou Yao, and Ling Shao. Attentive region embedding network for zero-shot learning. In IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2019, Long Beach, CA, USA, June 16-20, 2019, pp. 9384-9393, Computer Vision Foundation / IEEE, 2019. doi: 10. 10.1109/CVPR.22990000 http::/
thecvf com/ http://ottettteeeeeeeeeeeeeeetee Attent i _ee__ve___________ee Region on Sambedding_Netteeen
URL
9/temm//ttiiiee.e.. "oor_Zero-Shct _erect__Lerrnnnnn_n CVPR
2019 paper. html
Yunlong Yu, Zhong Ji, Yanwei Fu, Jichang Guo, Yanwei Pang, and Zhongfei (Mark) Zhang. Stacked semantics-guidee attention model for fine-grained zero-shot learning. In Samy Bengio, Hanna M. Wallach, Hugo Larochelle, Kristen Grauman, Nicolò
and Roman Garnett (eds.), Advances in Neural Information Processing Systems 31: Annual Conference on Neural Infor- mation Processing Systems 2018, NewrIPS 2018, December 3-8, 2018, Montréal, Canada, pp. 5998-6007, 2018. URL https:ttp/ocmmm http::::/ppocceddingggg//// neurei 9087beefc wtt.cclleee111666688
praper2208/hhae Abst html
Mehmet Kerim Yucel, Ramazan Gokberk Cinbis, and Pinar Duygulu. A deep dive into adversar- ial robustness in zero-shot learning. In European Conference on Computer Vision, pp. 3-21. Springer, 2020.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. arXiv abs//900. 08573, 2019.
Chunting Zhou, Junxian Hc, Xuezhe Ma. Taylor Berg-Kirkpatrickk and Graham Neubig. Prompt consistency for zero-shot task generalization. arXiv preprint Ttt::2205.00049 2022a.
Kaiyang Zhou, Jingkang Yang, Chen Change Loy, and Ziwei Liu. Conditional prompt learning for vision- lasion-language models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 168 16826, 2022b.
14

---

Published as a conference paper at ICLR 2023
Table 3: Zero-shot clean accuracy. After adapting the CLIP model on ImageNet, zero-shot performance on clean image in general drops. TeCoA based methods achieves the relatively small drop compared with other training object when the model has been udversarially trained.
DATASRTS
StanfordCans
Hltteiil
ImugeNet
CIFARIO
CIFARIOO
OxfordPet
Flower 102
EUROSAT
Caltehh101
Calteeh256
STL-10
Food101
RGVC
PCAM
SUN
DTD
Method
CLIP
59.12
89.06
97.16
62.32
57.67
52.14
83.15
85.82
65.64
40.52
38.25
20.04
56,20
52.03
91.75
82.04
64.56
+VP (CE)
56.45
86.72
95.90
59.35
59.08
47.61
76.74
85,91
60.48
12.81
33.85
19.05
54,90
50.42
89.93
79.19
60.52
+LP (CE)
61.88
91.80
97.66
58.01
63.44
9.77
60.39
39.84
3.71
3.91
49.41
7.42
44.53
52.29
67.19
66.02
48.58
+FT (CB)
72.72
87.02
97.25
63.93
59.90
47.69
77.96
87.19
63:47
40.80
37.22
16.29
57.00
43.90
87.38
82.75
63.90
+VP (TeCoA)
10.13
33.36
57.42
14.84
10.82
3.78
7.45
23.63
12.36
14.09
0.35
1.77
19:93
49.33
41.85
27.11
20.51
+VP (Adv.
42.34
69.06
90.63
37.52
44.31
50.59
77.60
49.60
60
34.10
10.92
52.47
84.18
68
+V (CoAdv:)
42.05
64.
16
25.57
90.61
43.72
35.94
49.43
77.13
47.65
35.05
12.41
10.98
57.33
45 54
84.37
69
25
49.45
+VP (ImgCoAdv.
13.24
56.07
8.80
20.37
18.79
17.32
23.78
4.26
32,05
VP (TcCoA)
48.84
71.63
91.39
40.96
50.97
33.50
52.41
79.07
45.78
31.86
15.93
12.24
58.53
47.85
95.19
71.66
53.00
(Adv.)
61.55
41.82
5.52
1.51
2.31
27.72
6.22
1.38
41.62
18.49
+FT (CoAdv))
50.18
10.52
17.61
0.63
0.18
0.60
0.90
2.18
1.31
1.22
19.47
1.32
53.20
51.72
0.57
0.44
13.25
(lmgCoAdv.
11.20
0.27
1.13
2.02
1.11
37.97
0.55
8.45
+FT (ToCoA)
63.87
78.12
93.30
49.68
51.
33.30
55.37
81.58
50.92
34.15
27.57
13.89
33:47
49.01
83,51
76.51
55.97
Kaiyang Zhou, Jingkang Yang, Chen Change Loy, and Ziwei Liu. Learning prompt for vision- language models. International Journal of Computer Vision, 130(9):2337-2348, 2022c
A APPENDIX
A.1 EXPERIMENTS
A. 1.1.1 ZERO-SHOT CLEAN ACCURACY OF OUR ADAPTED MODEL
We show the results for accuracy on clean images in Table 3
A.2 AUTOATTACK EXPERIMENT
We also consider stronger attack AutoAttack Croce Hein (2020) in our evaluation. Since our method uses adversarial training and does not rely on the obfuscated gradient, we use two APGD variants, APGD-CE and APGD-DLR, in AutoAttack to evaluate. We show robust accuracy under perturbation bound 1/255 in Table 4 and robust accuracy under perturbation bound 4/255 in Table 5 For both perturbation bounds, our method achieves higher robust accuracy than vanilla CLIP by up 36 points average.
Notably, on e = 1/255, even evaluated under the stronger AutoAttack the robustness accuracy of FT (TeCoA) is 37.02, which is still higher than all other baselines methods from Table 0 in robust accuracy, even though those baselines are evaluated under a weaker PGD100 attack. A larger perturbation bound = 4/255 makes the attack stronger, where our method still improves robustness by an average of 9 points. In addition, while the AutoAttack significantly reduces the robust accuracy of CLIP from 6.57 0.53, it only slightly decreases our TeCoA's robust accuracy: 2.1 points for visual prompt tuning and 1.16 for finetuning model (see Table and Table
One reason for AutoAttack to be so effective in attacking vamilla CLIP than PGD100 because uses fractional attack vector, which is not rounded by 1/255 during the inference. Images are often encoded via integer from 255, which allows only attack at the integer level. In the main paper, we use PGD attacks with step size 1 (if the image ranges from 0 to 1, then step size is proportionally 1/255) for 100 steps. Since there is no fractional attack value, the attack space is constrained and less effective. This is because the standard image inputs have value resolutions that should be larger than 0.5, and any values smaller than this would be rounded when encoding the images. If we ignore the fact that images will be encoded in integers between 0 to 255, then by exploring the fraction values. Since the AutoAttack automatically reduces the attack step size when loss oscillates, it explores the fraction space and is more effective in the attack.
have stronger attacks
15

---

Published as a conference paper at ICLR 2023
Table 4: Zero-sho robust accuracies on images attacked with AutoAttack with c 1/255. We use the CE and DLR variants of APGD in AutoAttack, which is a stronger attacker, where the adaptive step size can be a fraction (for PGDI00, the minimum step size is 1). We show the test accuracy for 16 tasks (columns) and 12 different methods (rows). We show the average performance of each method in the last column. The hest accuracies are bolded. Autoattack is stronger attack than PGD, which significantly reduces the robustness accuracy vanilla CLIP. For example, CLIP robust accuracy on Caltech101 was reduced from 24.63 (PGD100) to 0.41 (AA). However, AA only slightly decreases our TeCoA's robustness, from 69.07 to 68.40. By our language-guides adversarial training (TeCoA), we improve the robustness by an average of 36 points than CLIP, which is larger robustness gain than the PGDI00 experiment. In addition, compared with PGD 100 attack, the average robustness only decreases by around point on FT (TeCoA), suggesting that our TeCoA robust and stronger attack cannot further decrease the accuracy.
DATASETS
ImageNet
CIFARIO
STL-10
CIFAR100
SanfordCars
Foodin
OxfordPet
Flower102
EUROSAT
FGVC
HateMemes
PCAM
Callec1011
Callech256
Average
SUN
DTD
Method
CLIP
0.00
2.73
2.96
1.21
0.04
0.11
0.02
0.03
0.07
0.11
0.11
0.18
0.10
0.16
0.41
0.15
0.53
VPT (TeCoA)
20.82
47.25
74.99
23.39
19.76
8.63
16.81
44.78
20.90
18.83
10.73
3.24
31.13
29.35
62.19
45.64
29.90
FT (TeCoA)
39.81
58.27
83.16
32,57
29.03
12.03
25.79
61.76
28.93
20.70
13.26
4.05
3188
24.09
68.40
58.59
37.02
Table 5: Zero-shot robust accuracies images attacked with AutoAttack with 4/255. We show the test accuracy for 16 tasks (columns) and different methods (rows). We show the average performance of each method in the last column. The best accuracies are bolded. Autoattack is stronger attack than PGD, which reduces the robustness accuracy of CLIP even more. By our eanguage-guided adversarial training (TeCoA), we improve the robustness by an average of points to CLIP.
DATASETS
ImageNer
CIFARIO
CIFAR100
StanfordCars
OxfondPet
Flower102
EUROSAT
HateMemes
Caltech111
Caltech256
STL-10
Food101
RGVC
PCAM
Average
SUN
DID
Method
CLIP
0.05
0.01
0.00
0.04 0.04
0.15 0.02
0.00
0.05
0.00
0.11
0.24
0.06
0.18
0.00
0.04
0.06
VPT (TeCAA)
1.44
8.99
21.83
3.78 0.78 0.25 0.46
2.43
2.80
4.41
10.04
0.21
19.73
27.74
11.79
5.66
7.65
FT (TcCoA)
6.40
15.36
34.30
8.33 2.94
0.35
1.12
7.88
4.16
6.44
4.43
0.18
5.63
3.17
26.85
17.09
9.04
A.3 TRAINING LOSSES AND ALGORIHHM
We give formulations for the different training algorithms considered in our experiments. Through- out this section, let Fe denote an image encoder parameterized by 6, and let T denote a frozen text encoder. Let D denote dataset containing pairs (z, y) of images and their respective one-hot labels.
A.3.1 STANDARD ADVERSARIAL TRAINING WITH CROSS-ENTROPE Loss (ADV.)
The standard adversarial training paradigm. We initialize a learnable linear layer Ca. and append it to Fg. The classification loss is L(Gos (x)(x))) defined in cross-entropy loss.
We first train C. on standard images. Then, given a natural image x with one-hot label y, we generate an attacked image x, by maximizing the loss ((C,(FF(x,) y). We then update 0 to minimize the loss L(C, (Fo(x.)), We describe our algorithm in Algorithm
Algorithm Standard Adversarial Training (Adv.)
Input: Dataset ID, learnable parameter 0, model F, parameter of projector Co for all iter E preset number of training epochs do
for all x, E minibatch do の argmax, , ((C.(F((x))))))
Generating adversarial attacks > Training on generated adversarial examples
0 = 0 - V
(Po
end for
end for
16

---

Published as a conference paper at ICLR 2023
A.3.2 CONTRASTIVE ADVERSARIAL TRAINING Loss (COADV.)
We study how much the contrastive learning objective contributes to the zero-shot robustness gain. Instead of using one-hot label and cross-entrope loss in our objective, we create a dictionary of embeddings & by random initialization, where each embedding e; denotes the code representation for the category y/. We optimize the following contrastive learning loss:
exp(cos(z) (r)(cos(z(),e)) e,;/TT)
E,) -BBs Yig log
(6)
Σx exp(cos(z) ( ,,,)T))
where the z(")) Fx(x;) are the features of the input image, and ej the code representation from the dictionary. We use Yij to indicate which image-code pairs are positive and which are negative; this indicator satisfies Yij 1 if and only if the examples i j. and 0 otherwise. T is and cos denotes the cosine similarity function. We describe our algorithm
scalar
in Algorithm 2
Algorithm Contrastive Adversarial Training Loss (CoAdv.)
Input: Dataset DD, learnable parameter 0, model J' for all iter E preset number of training epochs do
for all X, y E minibatch do
x = argmaxx.. (x, 0 = 0 (x,
Generating adversarial attacks for contrastive loss Contrastive learning on generated adversarial examples
end for end for
A.3.3 CONTRASTIVE ADVERSARIAL TRAINING OVER IMAGES (IMGCOADV.)
Prior work Jiang et al. (2020) uses image-only contrastive adversarial learning to obtain robustness. We adapt this method as baseline to study whether using the knowledge from only images not language- can achieve zero-shot robustness. For each image X,, we create a transformationed Xy, and form the image pair (z).
We use the same visual encoder to embed the images x; and x, to obtain the features z, and Zy. We then construct the following contrastive learning loss:
exp(cos(z,, 22)/T)
Lx Xy, - Yis log
Σn exp(cos(Z, 2,)
where the z, = (x;, are the features of the input image. We use Y.y to indicate which image pairs positive and which negative; this indicator satisfies Yıj 1 if and only if the images x; and Xj are augmented from the same instance, and 0) otherwise. T is scalar hyper-parameter, and cos denotes the cosine similarity function.
Let , (x()), where x denotes the generated adversarial examples. Then we can obtain the adversarial examples via:
exp(cos(z,,22) 2,)/T)
x argmax L. (x,, argmax - Ei, Yis log Σn exp(cos(22) 2
(8)
x
Once we generate the adversarial images, we conduct contrastive learning on adversarial images and the paired clean images using Equation
We introduce our algorithm in Algorithm 3
A.3.4 TEXT-GUIDED CONTRASTIVE ADVERSARIAL TRAINING (TECOA)
We deseribe the TeCoA training algorithm in Algorithm We denote the learnable parameters to be For the visual prompt tuning, is only the prompt vector. For the finetuning method, the parameter of the whole model.
17

---

Published as a conference paper at ICLR 2023
Algorithm 3 Contrastive Adversarial Training over Images (ImgCoAdv.)
Input: Dataset DD, learnable parameter 0, model F
for all iter E preset number of training epochs do for all
minibatch do
x = argmaxy* Lx(x) xx, i = 0 (x Xy.y)
Generating adversarial attacks for contrastive loss
Contrastive learning on generated adversarial examples
end for end for
Algorithm 4 TeCoA Training
Input: Dataset DD, learnable parameter 0, model F, text t for all iter E preset number of training epochs for all x. y minibatch do x = argmaxy (x, t.y) 0 = 0 VoC, y)
> Generating adversarial attacks for contrastive loss Contrastive learning generated adversarial examples
end for
end for
A.3.5 TECOA LEARNING ON UNLABELED DATA
Given unlabeled image, we first provide list of text using the possible category names:
À photo of (Category Name)
Since the unlabeled images are not attacked, CLIP can retrieve the nearest text embedding from the image embedding and the text the pseudo label for the image. We then conduct the TeCoA training on the images and their pseudo text label. We describe the algorithm below in Algorithm 5
Algorithm 5 TeCoA Training on Unlabeled Data
Input: Dataset ID without label, learnable parameter 8, model F, text t. for all iter E preset number of training epochs do
for all minibatch B- (x1,..... Fm do
y argminy Cx t)
Finding pseudo label for the clean images using CLIP Generating adversarial attacks for contrastive loss Contrastive learning generated adversarial examples
x = argmax x (x,xt,,)) t) 0 = 0 - V VoL. t,y)
end for
end for
A.4 DISCUSSION FOR RESULTS
In Table our TeCoA performs better than existing methods except for LP(CE) and VPT(Adv.) on HateMemes and PCAM datasets. This is because the HateMemes dataset is a binary classification task for detecting hateful speech, which is very different domain from the ImageNet classification. Since both LP(CE) and VPT (adv) only adapt small number of parameters on the ImageNet set, the resulting model may overfit less to the Image recognition task, and just perform random guessing. Note that the 54% accuracy is close to random guessing 50%. In addition, PCAM is binary classification for lymph nodes (medical image, very different domain from ImageNet. Similar HateMemes, adapting fewer parameters makes the model learn less and overfit less, where the 52.5% accuracy close to random guessing 50%. Thus, both datasets remain big challenge for all existing zero-shot robust classification tasks.
http://gihuub.oomaaeeeeele//
which is also
18

---

Published as a conference paper at ICLR 2023
A.5 DISCUSSION FOR TECOA LOSS
In the main paper, we interpret our loss through the image-text contrastive objective, which first conducts matrix multiplication between the image embedding and language embedding, and then applies a cross-entropy loss on the output. Since the text embedding is fixed, this embedding can be treated as a layer of linear classifier, whose weights are obtained from the language embedding. This image-text contrastive objective can also be interpreted as using cross-entropy loss on fixed readout layer that initialized with the right language knowledge. This further validates the importance of language information for zero-shot adversarial robustness.
A.6 ADAPTATION METHOD FORMULATION
Token-Level Visual Prompts. Token-level visual prompts adapt transformer- based models by ap- pending tokens to the input token sequence. This is the most effective prompt method in exper- iments, where we use this by default unless specified. Our visual prompts append additional tokens Ps to the input sequence X of the vision transformer:
x Po. .I....,PPP Px]
(9)
The remaining transformer parameters and computations are kept the same as the original.
Image-Level Visual Prompts. Image-level visual prompts adapt transformer models by adding prompt to the input pixels. This is less effective way of adding prompt, as discussed in Figure ba Let the prompt token be P, and input image be x the visual prompt is added the input image:
(10)
The remaining transformer parameters and computations kept the same as the original.
Finetuning, This is the standard way of adapting a model, where all parameters of the model is updated with relatively small learning rate. In experiments, find learning rate of le achieves the best performance.
19


Reviews:
[{"review_id": "tMfUPSgCjF", "reviewer": "Reviewer_Uucq", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "Authors are the first to show that zero-shot image recognition models built on top of CLIP are still susceptible to adversarial attacks, and that standard adversarial training objective, while effective at preventing adversarial attacks, destroys the rich image-language capability of CLIP, making the defended model useless for zero-shot recognition on different tasks/datasets. Authors propose TeCoA - a novel objective that takes the image-language nature of the model into account during adversarial training via visual prompt tuning (VPT) and contrastive learning. Authors show how the proposed objective interacts with various task adaptation techniques, including linear probing, full and partial finetuning, image and token-level prompting. More specifically, authors propose to perform an adversarial attack on the standard contrastive image-text alignment objective used in CLIP - an adversarial image perturbation aims to make the correct image-text pair to have lower cosine similarity then an incorrect one. Authors propose two ablations that verifies that observed gains indeed come from robustifying the vision-language model, and not from robustifying the vision backbone itself - contrastive alignment to one-hot vectors and an image-to-image loss. Authors show that when it comes to zero-shot adversarial robustness, the proposed approach beats the baseline adversarial training and both ablations, and that finetuning outperforms visual prompt tuning. Authors also investigate the effect of the dataset size, attack strength, prompt design, number of adapted parameters during fine-tuning, and the of pareto optimum the clear-vs-robust accuracy.", "summary_of_the_review": "\nI think this is a great paper - it establishes an impactful problem, explores a simple solution in great detail with a lot of ablation experiments to verify their intuition, the paper is very well written.\n", "strength_and_weaknesses": "The paper is very well written and easy to follow: the motivation is clear, the objective and the training procedure are clearly defined. All experiments and ablations are clearly motivated, described, and reported as well. The results are promising. The provided intuition for why the proposed method helps while baselines fail makes intuitive sense.\n\nThe only part of the paper that I found to be not entirely clear and self-contained is the specifics of the image-to-image loss used in ImgCoAdv experiments.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "NETlOgJgHq", "reviewer": "Reviewer_J4qy", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper explores the problem of adapting large-scale pre-trained models for adversarially robust zero-shot classification. It is found that vanilla adversarial training on a single task may reduce the zero-shot capability of the pre-trained model. To improve the zero-shot adversarial robustness, a text-guided contrastive adversarial training (TeCoA) is proposed, which aligns the image embeddings of adversarial examples and the text embeddings of the standard prompts for zero-shot predictions. Experiments validate the effectiveness of TeCoA.", "summary_of_the_review": "While this paper studies an interesting and not well-explored problem, and provides some experimental results that may promote the understanding of zero-shot adversarial robustness, there is a lack of insight and technical novelty. Besides, the missing details and weak robustness evaluation reduce the reliability of the results.", "strength_and_weaknesses": "[Strength]\n1. The problem of zero-shot adversarial robustness is important in practice and has not been well explored.\n2. Some of the results are interesting and may inspire future works on this problem, e.g., Figure 1 and Table 2.\n\n[Weaknesses]\n1. Technical novelty. The proposed TeCoA is nearly identical to: (1) first construct a zero-shot linear classifier head with the pre-defined text prompts for zero-shot classification, as done in (Wortsman et al., 2022), and then (2) perform vanilla adversarial training (using CE loss) with the classification head frozen. Hence the main technical contribution may be that the initialization (and/or freezing) of the classification head is important for adversarial fine-tuning.\n2. Missing important experimental details. The missing implementation details include model architecture, training epochs and which visual prompt design is used. Besides, the generation of pseudo text labels for images (for results in Table 2) needs further explanation.\n3. Robustness evaluation. PGD-100 may not be a reliable attack for robustness evaluation. It would be better to consider stronger attacks like AutoAttack (or at least the two APGD attacks used in AutoAttack) [1]. Besides, the main results in Table 1 are based on eps=1/255, which may be too small. Using larger eps like 4/255 as in [1] may be more convincing.\n\n[1] Croce, Francesco, and Matthias Hein. \"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks.\" International conference on machine learning. PMLR, 2020.\n\n4. Explanation of abnormal results. As shown in Table 1, while FT (TeCoA) is the best on most datasets, LP (CE) and VPT (adv.) outperform other methods by a large margin on HateMemes and PACM. Is there any possible explanation?\n5. Table 1 and Table 3 are inconsistent. Especially, there are two rows starting with \"+VP (TeCoA)\", which is confusing.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "BKk5hA1IOp", "reviewer": "Reviewer_8Zoa", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "CLIP has shown remarkable performance on zero-shot visual recognition. However, adversarial examples still greatly affect CLIP's performance. This work propose a text-guided contrastive adversarial training loss to adopt CLIP to attain adversarial robustness for the datasets that are not seen during adversarial training. They show that a naive adversarial training of CLIP on ImageNet achieves the best performance on ImageNet but fails on other classification datasets. Their approach, on the other hand, performs much better for zero-shot tasks, despite being slightly worse on ImageNet than the naive adversarial training. They evaluate their zero-shot performance on 15 image datasets, and perform comprehensive ablation studies of their method.", "summary_of_the_review": "The problem of zero-shot adversarial robustness is important and this work illustrates how naive adversarial training cannot deal with zero-shot settings. Then they propose a new approach based on image-text embedding alignment to achieve superior zero-shot adversarial robustness. They also conduct a comprehensive set of ablation studies which yield useful insight for future research.", "strength_and_weaknesses": "# Strength\n\n- Zero-shot adversarial robustness is an important problem, given the fact that large-scale models are becoming some sort of infrastructure in practice.\n- Their approach empirically performs well compared to other baselines.\n- They even show that their approach doesn't require ground truth labels, and using psudo-labels (via CLIP image-to-text retrieval) is enough to attain similar performance.\n- They have done comprehensive ablation study including:\n\t- The effect of text supervision in contrastive adversarial training.\n\t- The effect of visual prompt design (e.g. appending an additional token is better than adding a learnable noise to the raw input image.)\n\t- These ablation studies provide useful insights for future research in zero-shot adversarial robustness.\n\n# Weaknesses \n\n- No major weaknesses. See Clarify and Minor for small issues.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "3EmdrRTbaXp", "reviewer": "Reviewer_eUU6", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper studies the problem of zero-shot adversarial robustness: adapting pretrained large-scale vision-language models to unseen target tasks with high robust accuracies. With the conjecture that language encoder plays an important role in achieving good zero-shot generalization ability, a contrastive based adversarial training objective is proposed to contrast between image and text embeddings. Several adaptation methods are analyzed, and some interesting discoveries are made for the visual prompt tunning method.", "summary_of_the_review": "This paper targets the problem of zero-shot adversarial robustness for CLIP, and it seems that it is a “first do A+B” type of work. Techniques used in the proposed methods are not new, while comprehensive experimental results show that the proposed method is effective through comparisons with reasonable baseline methods.", "strength_and_weaknesses": "Strength:\n\nThe proposed problem is new and under-explored.\n\nThe paper conducts rich experiments to compare diverse adaptations methods and several possible training loss functions. Many datasets are employed to evaluate zero-shot generalization.\n\nThe proposed loss function is well motivated by the observation that text encoder is important to zero-shot transferability. Ablation study verifies that the proposed method using text embedding for contrastive learning is important. \n\n\nWeakness:\n\nAlthough the setting is new, the proposed loss function is a direct use of contrastive loss for two modalities. Moreover, the adaptation methods used are all existing techniques.\n\nImplementation details are not sufficient. For example, it is unclear how exactly the adaptation methods are employed during training and what the objective functions of CoAdv or ImgCoAdv are. It would be better to give mathematical formulations of these methods in appendix.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Accept: poster