Adversarial Training on Purification (AToP): Advancing Both Robustness and Generalization
Authors: Guang Lin
Chao Li
Jianhai Zhang
Toshihisa Tanaka
Qibin Zhao
Venue: ICLR 2024 poster (2024)
Keywords: adversarial attacks
adversarial training
adversarial purification
Primary area: general machine learning (i.e., none of the above)

Abstract: The deep neural networks are known to be vulnerable to well-designed adversarial attacks. The most successful defense technique based on adversarial training (AT) can achieve optimal robustness against particular attacks but cannot generalize well to unseen attacks. Another effective defense technique based on adversarial purification (AP) can enhance generalization but cannot achieve optimal robustness. Meanwhile, both methods share one common limitation on the degraded standard accuracy. To mitigate these issues, we propose a novel pipeline to acquire the robust purifier model, named Adversarial Training on Purification (AToP), which comprises two components: perturbation destruction by random transforms (RT) and purifier model fine-tuned (FT) by adversarial loss. RT is essential to avoid overlearning to known attacks, resulting in the robustness generalization to unseen attacks, and FT is essential for the improvement of robustness. 
To evaluate our method in an efficient and scalable way, we conduct extensive experiments on CIFAR-10, CIFAR-100, and ImageNette to demonstrate that our method achieves optimal robustness and exhibits generalization ability against unseen attacks.

Published as a conference paper at ICLR 2024
ADVERSARIAL TRAINING ON PURIFICATION (AToP): ADVANCING BOTH ROBUSTNESS AND GENERALIZA- TION
Guang Lin 12, Chao Li", Jianhai Zhang?: Toshihisa Tanaka 1. and Qibin Zhao?
'Tokyo University of Agriculture and Technology RIKENN Center for Advanced Intelligence Project (RIKEN AIP)
Haagghou Dianzi University
ABSTRACT
The deep neural networks are known to vulnerable to well-designed adversarial attacks. The most successful defense technique based on adversarial training (AT) can achieve optimal robustness against particular attacks but cannot generalize well unseen attacks. Another effective defense technique based on adversarial purification (AP) can enhance generalization but cannot achieve optimal robustness. Meanwhile, both methods share one common limitation on the degraded standard accuracy. To mitigate these issues, we propose a novel pipeline to acquire the robust purifier model, named Adversarial Training on Purification (AToP), which comprises two components: perturbation destruction by random transforms (RT) and purifier model fine-ture tne-tuned (FT) by adversarial loss. RT is essential avoid overlearning to known attacks, resulting in the robustness generalization to unseen attacks, and FT essential for the improvement of robustness. To evaluate our method in an efficient and scalable way. conduct extensive experiments on CIFAR-10, CIFAR- 100, and ImageNette to demonstrate that our method achieves optimal robustness and exhibits generalization ability against unseen attacks.
INTRODUCTION
Deep neural networks (DNNs) have been shown to be susceptible to adversarial examples (Szegedy et al.) 2014 Deng et al. 2020). which are generated by adding small, human- -immanniprrreepbblle perturba- tions to natural images, but completely change the prediction results to DNNs, leading to disastrous implications (Goodfellow et al. 2015). Since then, numerous methods have been proposed to defend against ad adversarial examples. Notably, adversarial training (AT) has gained significant attention as robust learning algorithm against adversarial attacks (Goodfellow et al., 2015 Madry al. 2018a) 8a). AT has proven to be effective in achieving state-of-the- robustness against known attacks, albeit with tendency to overfit the specific adversarial examples seen during training. Consequently, within the framework of AT. the persistent conundrum revolves around striking a balance between standard accuracy and robustness (Zhang et al. 2019). dilemma that has been a subject of enduring concern. Furthermore, the robustness of AT defense against multiple or even unforeseen attacks still remains challenging (Poursaced al. 202 Laidlaw et al. 2021 Tack et al. 2022).
More recently, the concept of adversarial purification (AP) has emerged, aiming eliminate pertur- bations from potentially attacked images before inputting them into the classifier model (Yang et al.) 2019 Shi et al. 2021 Nie et al.) 2022). In contrast to AT methods, AP operates as a pre-processing step that can defend against unseen attacks without retraining the classifier model. However, AP exhibits lower robustness against known attacks compared to AT methods. Meanwhile, both AT and AP have a common limitation on the degraded standard accuracy (Tramer et al.) 2020) Chen al. 2022). which restricts their applicability in real-world applications. As summarized in Table the present landscape of defense methods is confronted with a formidable challenge: How can we
Corresponding Author

---

Published as a conference paper at ICLR 2024
Table I: Robustness comparison of defenses with expectation (negative impacts are marked in red),
Derpe
Putlier modd
Clasilier Chasifeemmmll model
Defense method
Clean images
Known attacks
Unseen attacks
Expectation
Inaned
Frooes
AT
M
AP
1
t
Figure 1: Illustration of adversarial training on
AToP (ours)
M
purification (AToP).
enhance robustness against known attacks while maintaining generalization to unseen attacks and preserving standard accuracy clean examples?
To tackle these challenges with the framework of AT and AP, we propose a novel defense technique that conceptually separates the AP method into two components: perturbation destruction by random transforms and fine-tuning the purifier model via supervised AT called Adversarial Training on Purification (AToP), as shown in Figure [ Specifically, we develop three types of random transforms and conduct a comprehensive investigation into their effectiveness in augmenting robustness and generalization against attacks. The purifier model is designed reconstruct clean examples from corrupted inputs, which can also ensure accurate classification outputs regardless of whether the inputs are corrupted adversarial examples or corrupted clean examples. Furthermore, more importantly, we introduce the adversarial loss calculated from the output of the classifier model to fine-tune the purifier model in a supervised manner while keeping the classifier model fixed. Differing from the traditional AP methods, our method can learn a robust purifier model to generate high-quality purified examples and avoid generating examples to incorrect classes.
We empirically evaluate the performance of our method by comparing with the latest AT and AP methods across various attacks (i.e., FGSM (Goodfellow et al.) 2015), PGD (Madry et al. 2018b), CW (Carlini & Wagner 2017), AutoAttack (Croce & Hein 2020), and StAdv (Xiao et al. 2018)) and conduct extensive experiments on CIFAR-10, CIFAR 100 and ImageNette employing multiple classifier models and purifier models. The experimental results demonstrate that our method achieves state-of-the-arr results and exhibits robust generalization against unseen attacks. Furthermore, method significantly improves the performance of the purifier model in robust classification, surpassing the performance of the same model used in recent studies (Ughini et al. [2022] Wu et al.
2023). To provide a more comprehensive insight into our results, we conduct visual comparisons among multiple examples. In summary, the contributions of this work are as follows.
We propose adversarial training on purification (AToP), a novel defense technique that effectively combines the strengths of AT and AP acquire the robust purifier model.
We separate the adversarial purification process into components, including perturbation destruction and fine-tuning purifier model, and investigate their impacts on robustness.
We conduct extensive experiments to empirically demonstrate that the proposed method significantly improves the performance of the purifier model in robust classification.
RELATED WORK
Adversarial training is initially proposed by Goodfellow al. (2015) to defend against adversarial attacks. While adversarial training has been demonstrated as an effective defense against attacks, remains susceptible to unseen attacks (Stutz al.) 2020 Poursaeed al. 2021 Laidlaw et al.. Tack et al. 2022). Additionally, retraining the classifier model leads to substantial training expenses and could severely impair the standard accuracy of the model (Madry et al. 201 8a Tramer et al. 2018 Zhang et al. 2019). In a study conducted by Raff et al. (2019), the impact of random transforms on the robustness of defense method was investigated. Their research revealed that the inclusion of a broader range of random transforms applied to images before adversarial training can significantly improve robustness. However, the utilization of random transforms also led to the loss of semantie information, which can severely affect the accuracy. Although our framework uses
2021 Tack
2

---

Published as a conference paper at ICLR 2024
random transforms and AT strategy, the essential difference with these works is that we aim train robust purifier model to recover semantics from corrupted examples using AT, rather than training the classifier model to learn the perturbation features using AT. Yang al. (2019) also proposed method that combines adversarial training and purification. Specifically, a purifier model was used prior to the classifier model, and AT was only applied the classifier. Meanwhile, |Ryu & Choil (2022) applied a similar pipeline but fine-tuned both the classifier model and the purifier model using AT. Consequently, the training process became time-intensive. In contrast, our method applies the adversarial loss to train the purifier model, which avoids the need for retraining the classifier model and mitigating the risk of overfitting specific attacks.
Adversarial purification aims to purify adversarial examples before classification, which has emerged as a promising defense method (Shi et al. 202T Srinivasan et al. 2021) Currently, the most prevalent pipeline within AP involves the utilization of a generative model to recover purified examples from adversarial examples. Some prior studies (Bakhti al. 2019 Hwang et al.) 2019) employed consistency losses to train the purifier model, which obtains similar results to AT methods. Nevertheless, these methods primarily capture the distribution of specific perturbations, which also limits their effectiveness in defending against unseen attacks. Other studies (Nie et al. 2022 Ughini et al. 2022] Wu et al.) 2023) employed the pre- pre-trained generative model as a purifier model. These methods have acquired the ability recover information from noisy images through extensive exposure to clean examples, enabling them to provide an effective defense against even unseen attacks. However, there is limitation of the existing pre-trained generator- purifier model, where all parameters are fixed and cannot be further improved for known attacks (Dai et al. (022)). To address these issues, we employ a pre-trained generative model as an initial purifier model, which can be subsequently fine-tuned using examples in supervised manner, i.e., adversarial training on purifier model. Additionally, we introduce an adversarial loss derived from classifier outputs rather than consistency loss derived from purifier outputs. As shown in the experiments, our method achieves improved robustnessness without compromising generalization against unseen attacks.
METHOD
In this section, we introduce a novel defense pipeline to acquire the robust purifier model, named Adversarial Training on Purification (AToP), which comprises two components: random transform (RT) and fine-tuning (FT) the purifier model. Specifically, RT can significantly destruct adversarial perturbations, irrespective of the type of attack, thereby achieving effeective defense against even unseen attacks. On the other hand, FT can generate purified examples from corrupted inputs with true label information, thus further enhancing robustness.
The entire classification system comprises three processes: transform denoted t(-), purifier denoted g(-), and classifier denoted f-).. Given an input x, the pipeline of output y can be formulated as = t (z; 0,), at = 0,) y f 0y)
(I)
where 0r, f,y 8 represent parameters involved in the transform, purifier, and classifier, respectively.
3.1 DESTRUCT PERTURBATION STRUCTURE BY RANDOM TRANSFORMS
We utilize three types of random transforms, ranging from simple to complex cases.
The first type of transform (RT,) utilizes a binary mask m with small patches of size p x that are randomly missing with missing rate r (Yang al. 2019). As shown in Eq. 2 given any input z, take the element-wise multiplication m ④ x,
Z2 m x
g(x)).
The second type of transform (RT2) involves the addition of Gaussian noise 1) before applying the random mask mn to further destruct the perturbations. As shown Figure Ia), we have
3 (x + m), == 9
Randomized smoothing by adding Gaussian noise is a method that provides provable defenses LLi al. 2019 Cohen et al. 2019) Cohre al. 2019) theoretically provides robustness guarantees
3

---

Published as a conference paper at ICLR 2024
Nony Image y
Monked Neiry Imagee O 18xic [L.]]
Compleeed Piacls m2)
Rocenstracid Image
x+0
+
Clan Image
Image
Masked Nolsy Image !))
(
Figure Illustration of random transforms. (a) Firstly, adding Gaussian noise to preliminarily corrupt the image, then randomly masking the image. (b) Next, based on (a), the noisy image is covered randomly by N non-overlapping masks. Finally, the completed pixels are combined to reconstruct the image denoted as L.
for classifiers. In the latest work, Wu et al. (2023) enhance robustness by learning representations through a generative model, as shown in Eq.
The third type of transform (RTg) involves the repetition of N transformations on single image to ensure that all pixel values are regenerated by the purifier model, thereby removing as many perturbations as possible (Ughini et al. (022). As shown Figure the noisy image randomly covered by N non-overlapping masks m, Áfter being processed by purifier model, only the pixels generated by the purifier model are aggregated to yield 2, which is
/ = m, @ (x + m), zy = g(x)), a Σ N
(1 (1) O xzz
(4)
3.2 FINE-TUNING THE PURIFIER MODEL WITH ADVERSARIAL LOSS
Algorithm 1 Adversarial Training on Purification method (AToP)
Require:
Training examples æ, ground truth y. parameters of classifier model 0,, parameters of purifier model og. training epoch Nep
1: Initialize , and Og with pre-trained classifier model and pre-trained purifier model.
2: for epoch 1...Nep do
3: Build adversarial examples x' with perturbations 6: x' + x + 5
4: Freeze 0, and update 0g with gradient descent based on loss in Eq. P
5: Og + 0g- v0,
6: end for
7: return purifier model with 0,
Having described the random transforms, we proceed provide a description of the purifier model and fine-tuning process. Specifically, based on the pre-trained generator-based purifier model trained by the original loss function Toogy we propose AToP loss function T.,, incorporating an adversarial loss to fine-tune the purifier model,
La = Lory (x, 0g) + X Lats (a,, y, 0g. 0y)
where À is held constant as hyperparameter. In the paper, we improve upon two recent studies, and the original loss function Lorg denoted as La in the GAN-based model (Ughini al. 2022) and as Lmae in the AE-baset model (Wu et al.) (023). For instance, we utilize the GAN-based model
called DeepFill as the purifier model g, conjunction with RT; and the classifier model F. Given any input our defense process is defined below:
x t (x; 0.) RT3(x) = m, 2 (x + +n)
(6)
r = g (2t: 0g) DeepFiil i -- (1 m; o 1
(7)
y = (x; F(E),
(8)
4

---

Published as a conference paper at ICLR 2024
where O₂ contains three components: Gaussian standard o, missing rate r, and mask number N. The parameter 8 is derived from the pre-trained classifier model. To perform robust fine-tuning of the purifier model using adversarial training, we aim to optimize the model by freezing classifier parameter O and updating purifier parameter fg. where f and 0g are initialized by the pre-trained classifier model and the pre-trained generative model, respectivelyy, shown in Algorithm [
For pre-training GAN- model (Ughini et al. 2022), we have Lorg = Las (x. 8,) = B[D(z)] ([)()(((x), 0g)]] + B||l= -
To further optimize Oz. we propose AToP loss function
and fine-tune the pre-trained GAN-based model, which comprises an original loss Lag, well as an additional adversarial loss Lats- Given an adversarial example x' with perturbation 6, we have
Le, Lay (z', 00) + X- Lete (z.,8,0g:07 0y)
[E)(= - (]D(((((2"))))))) 0,)). + B[||=' s((((')), 0,llle,
+ À max CE Lu, Fu Flo(t(z)),, 0,)13 where =x
Here, Ly comprises the first three terms, where D represents the discriminator, and g is the generator- based purifier model, which plays similar roles as the generative adversarial network model. During training, the discriminator D is responsible for distinguishing between real examples and the purified examples g((()), 0g). Simultaneously, the purifier model generates high-quality examples to deceive the discriminator D. The third term is consistency loss || g(( ) 0,)lle, which encourages strong image restoration ability to the original examples Consequently, La effectively ensures that the purified examples are not only high-quality but also closely resemble their original example. If RT sufficiently strong the extent that ((x) is essentially Gaussian noise, Lay loss can ensure the purified examples are generated from the same distribution of a and are of high-quality. Conversely, if RT is minimal such as t(z) x, Lay is instrumental in guarantecing that the purifier model can achieve an exact recovery of the original examples. Consequently, if RT is strong enough to destruct the adversarial perturbations, the model can guarantee to generate examples from the original distribution while avoiding the reconstruction of adversarial perturbations. Thus, the effectiveness remains unaffected even for unseen attacks.
During fine-tuning, Lets corresponds to the last term, which serves the purpose of further ensuring that our purified examples do not contain sufficient adversarial perturbations that fool the classifier. On the other hand, if RT is very strong and purified examples & do not contain any adversarial perturbations, Lete can also ensure will not be high-quality examples drawn from different classes. Intuitively, the adversarial perturbations 8 are generated by maximizing classification loss, which can be used as the new examples to train our purifier model such that adversarial perturbations can be reconstructed up the degree that remains correct classification. Unlike standard AT, our adversarial loss is not used to update the classifier model but to optimize the purifier model. As compared to existing AP methods using adversarial examples (Bakhti et al., 2019 Hwang al. 2019), our adversarial loss is essentially more robust than either consistency loss or generator-style loss. Finally, represents a weight hyperparameter to balance the generative error and classification error.
EXPERIMENTS
In this section, we conduct extensive experiments on CIFAR-10, CIFAR- and ImageNette across various transforms, classifier models and purifier models on attack henchmarks. Our findings demonstrate that the proposed method achieves state-of-the-art results and exhibits generalization ability against unseen attacks. Specifically, compared to against AutoAttack lo0 on CIFAR-10, our method improves the robust accuracy by 13.28% on GAN-based purifier model and 14.45% on AE-based purifier model, respectively. Furthermore, we empirically study the random transforms and discuss their impacts on robust accuracy. Finally, we provide visual examples (more details can be found in supplementary materials) to provide a more comprehensive understanding of our method.
4.1 EXPERIMENTAL SETUP
Datasets and model architectures: We conduct extensive experiments on CIFAR-10, CIFAR- 100 (Krizhevsky et al. (209) and ImageNette (a subset of 10 classified classes from ImageNet) (Howard 2021) to empirically validate the effectiveness of the proposed methods against adversarial attacks. For the classifier model, utilize the pre-trained ResNet model (He al. 2016) and NedeResNet.
5

---

Published as a conference paper at ICLR 2024
model Zagoruyko & Komodakis 2016). For the purifier model, we utilize the pre-trained GAN-basel
model (Ughini et al. 2022) and AE-based model (Wu et al.) (023) and utilize adversarial examples generated by FGSM for the fine-tuning.
Adversarial attacks: We evaluate our method against various attacks: We utilize AutoAttack ts and threat models (Croce & Hein 2020) one benchmark, which is powerful attack that combines both white-box and black-box attacks, and utilizes Expectation Over Time (EOT) (Athalye et al.) 2018b) to tackle the stochasticity introduced by random transforms. To consider unseen attacks without 4y-norm, we utilize spatially transformed adversarial examples (StAdv) (Xiao et al. 2018) for validation. Additionally, we generate adversarial examples using some standard methods, including Fast Gradient Sign Method (FGSM) (Goodiellow et al., 2015). Projected Gradient Descent (PGD) (Madry et al. 2018b) and Carlini- Carlini-Wagner (CW) (Carlini & Wagner 2017) attacks.
Evaluation metrics:
We evaluate the performance of defense methods using two metrics: standard accuracy and robust aceuracy, obtained by testing on clean examples and adversarial examples, respectively. Due to the high computational cost of testing models with multiple attacks, following guidance by Nie et al. (0222), we randomly select 512 images from the test set for robust evaluation.
Training details: After experimental testing, we have determined the hyperparameters: Gaussian standard deviation = 0.25, mask size p = P/8 (P is side length of input æ), mask number N = missing rate 0.25 and weight 0.1. All experiments presented in the paper are conducted
Table 2: Standard accuracy and robust accuracy against AutoAttack Loo threat 8/255) on CIFAR-10 with WideResNet classifier model.
Table 3: Standard accuracy and robust accuracy against AutoAttack l2 threat (e 0.5) on CIFAR- 10 with WideResNet classifier model.
Extra data
Standard Robust Acc.
Extra Standard Robust Acc.
Defense method
Defense method
Acc.
data
Acc.
WidcResNett28-UU
WideResNett22-10
Zhang et al.
(2020)
85.36
59.96
Augustin al. (2020)
v
92.23
77.93
Gowal
2020)
89.48
62.70
Ding et al. (2019)
X
88.02
67.77
Rebuffi et al.
(2021)
X
87.33
61.72
Reburn et al (2021)
X
91.79
78.32
Gowal et al.
202T
X
87.50
65.24
Nie et al. (202)
X
91.03
78.58
Nie al. 2022
X
89.02
70.64
Ours
90.62
80.47
Ours
90.62 X
72.85
WideResNet-77-166
WideResNeet70-16
Rebuffi (2021)
95.74
81.44
Gowal al.
(2020)
91.10
65.87
Rebufh et al.
[202T]
92.23
66.56
Gowal et al. (220))
X
90.90
74.03
Nie ct al (2022)
92.68
80.60
Rebuffi et al.
(2021)
X
88.54
64.46
Ours
91.99
81.35
Gowal al.
202T
X
88.74
66.60
Nie al. 2022
X
90.07
71.29
Ours
91.99
76.37
Table Standard accuracy and robust accuracy
against AutoAttack lox threat (e 8/255) on CIFAR-100 with WideResNet classifier model.
Table 5: Robust accuracy against AutoAttack lxc (e 8/255) on CIFAR-10 and CIFAR- Att.AutoAttack l2 (c= 0.5) on CIFAR-10 with WideResNet-28-11 classifier model.
Extra Standard Robust data Acc. Acc.
Defense method
WideRessNet-2-I11
CIFAR 10. Lo
CIFAR
CIFAR 100, 4.0
Hendrycks et al. (2019)
/
59,23
28.42
Defense method
10, l
Pang et al. (2022
63,66
31.08
Wu et al.
(2023)
44.73
45.12
38.48
Cull et al. (023)
x
73.85
39.18
Ours
74.61 x
43.55
Wu al. (0233)
59.18
65,43
40.23
+AToP (Our)
WideRessNet70-116
Ughini et al. (2022)
59.57
63.69
38.89
Bai et al. (2023)
85.21
38.72
Ughini et al. 2022)
72.85
80.47
43.55
Wang et (203)
X
75.22
42.67
+AToP'(Oun)
Ours
X
76.95
44.44

---

Published as a conference paper at ICLR 2024
under these hyperparameters and performed by NVIDIA RTX A5000 Graphies Card with 24GB GDDR6 GPU memory, CUDA v11.7 and cuDNN v8.5.0 in PyTorch v1.13.11 (Paszke et al. 2019).
4.2 COMPARISON WITH STATE-OF-THE-AR METHODS
We evaluate our method against Auto/Atack lcc and l2 threat models and compare its robustness to state-of-the-ar methods listed in RobustBench (Croce al. 2021). All experiments presented in this section utilize RT2 and GAN-based model, which yielded the best results in the experiment.
Result analysis CIFAR-10: Table 2 shows the performance of the defense methods against AutoAtrack 100 (< 8/ 8/255) threat model on CIFAR-10 with WideResNer-28-I1e and WedeResNet- 70-16 classifier models. Our method outperforms all other methods without extra data (the dataset introduced by Carmon et al. (2019)) in terms of both standard accuracy and robust accuracy. Specif- ically, compared the second-best best method, our method improves the robust accuracy by 2.21 % on WideResNet-288 10 and by 5.08% on WideResNet-77-11 16, respectively. Furthermore, in terms of robust accuracy, our method even outperforms the methods with extra data. Table shows the performance of the defense methods against AutoAttack l2 (e 0.5) threat model. Our method outperforms all other methods without extra data in terms of robust accuracy. Specifically, compared to the second-bee best method, our method improves the robust accuracy by 1.89% on 22 and by 0.75% on WideResNee-70- 16, respectively.
Table shows the performance of the two generator- purifier models (Ughini et al. 2022 Wu et al. 2023) against AutoAttack lx (c = 8/255) and l2 (c = 0.5) threat models with WideResNet 28- method improves the robust accuracy by 14.45% and 20.3 % on AE-based purifier model, 13.28% and 16.87% on GAN-based purifier model, respectively. The results demonstrate that our method significantly improve the robustness of the purifier model.
10 classifier model. Specifically,
Result analysis on CIFAR-100: Table shows the performance of the defense methods against AutoAttack (o (E = 8/255) threat model CIFAR- with WideResNeet28-11 and WedeResNet- 70-16 classifier models. Our method outperforms all other methods without extra data in terms of both standard accuracy and robust accuracy. Specifically, compared to the second-best method, our method improves the robust accuracy by 4.37% on WideResNet-28. 10 and by 1.77% on WideResNet- 70--6 respectively. 5 shows the performance of the models against AutoAttack 4 (e = 8/255) and the observations are basically consistent with CIFAR-10 10, demonstrating the effectiveness of our method in enhancing robust classification across different datasets.
4.3 DEFEND AGAINST UNSEEN ATTACKS
As previously mentioned, the mainstream adversarial training (AT) methods have shown limitations in defending against unseen attacks (Laidlaw et al.) 2021; Dolatabadi et al. 2022) defend against known attacks. To demonstrate the generalization ability our method with RT₂ and GAN, we conduct experiments in which defense methods evaluated against attacks with
only
Table Standard accuracy and robust accuracy against AutoAttack lac (c = 8/ 8/255). l2 (e = 1) and StAdv non-lp (c 0.05) threat models CIFAR-10 10 with ResNet-50 classifier model. We utilize GAN-based model with RT,, and all settings follow the same as Laidlaw et al. (2021).
Defense method
Standard Aec.
1,0
l2
StAdv
Standard Training
94.8
0.0
0.0
0.0
Adv. Training with 1. [Laidlaw et al.
2021
86,8
49.0
19.2
4.8
Adv. Training with (2 (Laidlaw al. 202T
85.0
39.5
47.8
7.8
Adv. Training with StAdv (Laidlaw al.12001 22
86.2
0.1
0.2
53.9
Adv. Training with all (Laidlaw et al.
2021
84.0
25.7
30.5
40.0
PAT-self (Laidlaw et al. 2021
82.4
30.2
34,9
46.4
Adv. CRAIG (Dolatabadi et al 2022
83.2
40.0
33.9
49.6
DiffPure (Nie et al 2022
88.2
70.0
70.9
55.0
Ours
89.1
71.2
73.4
56.4

---

Published as a conference paper at ICLR 2024
varying constraints (including AutoAttack 1.0, l2 and StAdv non-lp threat models) CIFAR-10 with ResNet-50 classifier model.
Table that AT method can achieve robustness against particular attacks during training (as indicated by Ace. with underscore) but struggles to generalize robustness to unseen attacks. The intuitive idea is apply AT across all different attacks obtain robust model. However, is challenging to train such a model due to the inherent differences among all sorts of attacks. Furthermore, the emergence of attack techniques continually makes it impractical train the model to defend against all attacks. We combine AT and AP as a new defense method, which outperforms all other methods terms of both standard accuracy and robust accuracy. Specifically, compared to the second-best method, our method improves the robust accuracy by 1 1.2%, 2.5% and 1.4% on AutoAttack so l2 and StAdv non-lp. respectively. The results demonstrate that our method achieves wate-of-the-ar the-art results and exhibits generalization ability against unseen attacks.
4.4 ABLATION STUDIES
We conduct ablation studies to validate the effectiveness factors within our method in defending against more standard attacks. Considering the robustness misestimation caused by obfuscated gradients of purifier model, we use BPDA (Athalye et al. 20188) 8a) following the setting by Yang et al. (2019). which approximates the gradient of purifier model during backward pass. Additionally, we use EOT (Athalye et al.) (018b) following the setting by Lee & Kim (2023) with 20 iterations.
Table 7: Standard accuracy and robust accuracy of attacking the classifier model on CIFAR-10 with ResNet- 18. All attacks are loo threat model with c = 8/255.
Transforms
AToP
Standard Acc.
FGSM
PGD-10
PGD-20
PGD-1000
CW-100
93.36
16.60
0.00
0.00
0.00
21.09
RT
93.36
91.99
43.55
36.72
39.45
87.89
RT2
X
84. 18
55.08
72.27
70.90
67.97
87.70
90.04
89.84
84.77
84.57
84.38
88.87
75.98
67.97
70.51
70.70
70.31
75.20
RTg
80.02
70.90
73.05
72.07
73.44
76.56
Table Standard accuracy and robust accuracy against PGD+FOT l2 threat (c = 1.0) on CIFAR- 10 with ResNet-18 18 classifier model.
AToP
Standard
PGD-10
PGD-20
93.36
20.31
15.04
RT
93.36
27.34
22.46
(a) Original
RT:
(c) RT:
(d) RT,
RT₂
x
84.18
67.19
63.09
90.04
69.92
68.75
Figure 3: The purified images are obtained for clean (Top) and adversarial examples (Bottom) with different random transforms.
75.98
28.52
26.17
RT3
80.02
46.48
41.60
Result analysis on CIFAR-10: Table 7 shows the performance of the defense model utilizing different transforms against FGSM, PGD and CW on CIFAR-I0 with ResNet-18 classifier model. The numbers after the attack represent the number of steps. For each transform, method significantly outperforms the method without AToP in terms of both standard accuracy and robust accuracy.
Figure 4a shows the standard accuracy and robust accuracy of the purifier model trained with clean examples and adversarial examples, respectively. The results demonstrate that while utilizing clean examples mitigate the impact of semantic loss induced by random transforms, thereby improving the standard accuracy. Moreover, utilizing adversarial examples can improve the robust accuracy. Specifically,, AToP with clean examples achieves the best standard accuracy, while AToP with
8

---

Published as a conference paper at ICLR 2024
90
Pooursc 80
Accuracy
Afce or doak
70
Afcl deaane
ATuf derie
Zanders Traring
Gaandrrd
Staddrd
FDOM
PCD-10
PGD-20
Standard
FCOM
PGD-10
PGD-20
Stendard
PCD-10
PG2--20
(a) CIFAR-10
(b) ImageNette
(c) Combine with Adv. train
Figure 4: Standard accuracy and robust accuracy of the GAN-baser purifier model trained with clean examples and adversarial examples, respectively, (a) CIFAR-10 and (b) ImageNette. The dashed line represents the accuracy of standard training w/o attacks. (c) Standard accuracy and robust accuracy of our method with adversarially trained ResNet-18 CIFAR-10.
Table 9: Standard accuracy and robust accuracy of attacking the classifier model ImageNette with ResNet-34. All attacks are %o threat model with c = 8/255.
Transforms
AToP
Standard Acc.
FGSM
PGD-10
PGD-20
PGD-1000
CW-100
91.99
18.95
0.00
0.00
0.00
64.26
RT
89.84
40.62
45.31
45.12
47.07
78.12
84. 18 90.23
67.19
77.34
77.54
77.34
86.52
RT₂
75.20
83.20
82.03
82.03
88.48
RTg
X
71.48
66.60
67.77
64.26
66.21
67.38
80.08
75.78
76.37
75.98
72.85
78.32
adversarial examples achieves the best robustness. Additionally, AP a pre-processing technique that can combine with an adversarial trained classifier to further enhance robust accuracy, as shown in Figure 4c However, the improvement comes at the cost of reduction in standard accuracy.
For the more comprehensive evaluation, we follow the guidance of Lee & Kim (2023) to evaluate our method against PGD+EOT with l2 threat (e 1.0). Table(8showe the performance the defense model with different transforms, and our method still significantly outperforms the method without AToP in terms of both standard accuracy and robust accuracy, demonstrating the effectiveness of our method in enhancing the performance of the purifier model in robust classification.
Result analysis on ImageNette: Table shows the performance of the defense model with different transforms against FGSM, PGD and CW on ImageNette with ResNet-34 classifier model. Figure 4b shows the standard accuracy and robust accuracy of the purifier model trained with clean examples basically
and adversarial examples, respectively. The experimental observations ImageNette consistent with 10, with our method significantly outperforming the method without AToP in terms of robust accuracy. On the other hand, can observe that while employing more powerful random transforms within the same AToP setting, the perturbations will be gradually destructed, resulting in an increase in robustness; however, semantic information will also lost, decreasing standard accuracy. This trade-off presents limitation that prevents the continuous improvement of robust accuracy. Specifically, RT, achieves optimal robustness while maintaining a satisfactory standard accuracy. Figure 3 shows the purified images obtained by inputting clean examples and adversarial examples into purifier model with various RTs. As previously mentioned, while RTs effectively destruct perturbations, they can also introduce the loss of semantic information.
So far, we have conducted extensive experiments across various attacks, classifiers, generator- based purifiers, datasets and RT settings, which have consistently demonstrated the effectiveness of our method in acquiring the robust purifier model for enhancing robust classification.
Given that method involves the fine-tuning of the generative model, the complexity of the generative model has direct impact on the computational cost of AToP. Initially, we explore fine-tuning the diffusion model to improve its robustness. However, as purified images need be fed
Limitations:

---

Published as a conference paper at ICLR 2024
into the classifier, generating 1000 images and fine-tuning the diffusion model requires 144 minutes. In contrast, with the same setting, the GAN-based purifier model only requires 62 seconds.
5 CONCLUSION
In the paper, we propose a novel defense technique called AToP that utilizes adversarial training to acquire the robust purifier model. To demonstrate the robustness of our method, we conduct extensive experiments on CIFAR-10 10, CIFAR-1O1 and ImageNette. In defense of various attacks under multiple transforms, classifier and purifier architectures, state-of-the-are results and exhibits generalization ability against unseen attacks. Ablation studies further highlight that our method can significantly improve the performance of the purifier model on robust classification. Despite the large improvements achieved, our method has a major limitation: AToP requires training on the purifier model, and as the complexity of the purifier model increases, so does the training cost. However, exploring this direction presents an intriguing research opportunity for developing a more efficient defense method by combining AT' and AP.
method consistently achieves
LEKNOWLEDGMENTS
Guang Lin was supported by the RIKEN Junior Research Associate Program. This work was supported in part by the JSPS KAKENHI Grant Numbers JP20H04249, JP23K28 109, 24K03005, and RIKEN Incentive Research Project.
REFERENCES
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning, pp. 274-283, PMLR, 2018a.
Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In International conference machine learning, pp. 284 293. PMLR, 2018b.
Maximilian Augustin, Alexander Meinke, and Matthias Hein. Adversarial robustness in-and out- distribution improves explainability. In European Conference on Computer Vision, pp. 228-245.
Springer, 2020.
Yatong Bai, Brendon G Anderson, Aerin Kim, and Somayeh Sojoudi. Improving the accuracy- robustness trade-off of classifiers via adaptive smoothing. arXiv preprint arXiv:2301.12554, 2023.
Yassine Bakhti, Sid Ahmed Fezza, Wassim Hamidouche, and Olivier Déforges, Ddsa: defense against adversarial attacks using deep denoising sparse autoencoder. IEEE Access, 7:160397- 160407, 2019.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium security and privacy (sp). pp. 39-57. Iece, 2017.
Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C Duchi, and Percy Liang. Unlabeled data improves adversarial robustness. Advances in neural information processing systems, 32, 2019.
Sizhe Chen, Zhehao Huang, Qinghua Tao, Yingwen Wu, Cihang Xie, and Xiaolin Huang. Adversarial attack on attackers: Post-process to mitigate black-box score-based query attacks. Conference on neural information processing systems, 2022.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In international conference machine learning, pp. 1310-1320. PMLR, 2019.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-fit free attacks. In International conference on machine learning, pp. 2206-2216 PMLR, 2020.
10

---

Published as a conference paper at ICLR 2024
Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flam- marion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: standardized adversarial robustness benchmark. In Thirty-fifth Conference Neural Information Processing Systems Datasets and Benchmarks Track (Round 2), 2021.
Jiequan Cui, Zhuotao Tian, Zhisheng Zhong, Xiaojuan Qi, Bei Yu, and Hanwang Zhang. Decoupled kullback-leibler divergence loss. arXiv preprint arXiv:2305. 13948, 2023.
Tao Dai, Yan Feng, Bin Chen, Jían Lu, and Shu-Tao Xia. Deep image prior based defense against adversarial examples. Pattern Recognition, 122: 108249, 2022.
Yao Deng, Xi Zheng, Tianyi Zhang, Chen Chen, Guannan Lou, and Miryung Kim. An analysis of adversarial attacks and defenses on autonomous driving models. In 2020 IEEE international conference on pervasive computing and communications (PerCom), pp. 1-10. IEEE, 2020.
Gavin Weiguang Ding, Yash Sharma, Kry Yik Chau Lui, and Ruitong Huang. Mma training: Direct input space margin maximization through adversarial training. In International Conference on Learning Representations, 2019.
Hadi M Dolatabadi, Sarah Erfani, and Christopher Leckie. I-inf robustness and beyond: Unleashing efficient adversarial training. In European Conference Computer Vision, pp. 467-483. Springer, 2022.
lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. International Conference on Learning Representations, 2015.
Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03593, 2020.
Sven Gowal, Sylvestre-Alviss Rebuffi, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy A Mann. Improving robustness using generated data. Advances in Neural Information Processing Systems, 14:4218-4233. 2021.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016.
Dan Hendryeks, Kimin Lee, and Mantas Mazeika. Using pre-training can improve model robustness and uncertainty. International conference on machine learning. pp. 2712-2721. PMLR, 2019.
Jeremy Howard. Fastai/imagenette. http://gthhbbboommmssss//mgggggt 2021.
Uiwon Hwang, Jaewoo Park, Hyemi Jang. Sungroh Yoon, and Nam Cho. Puvae: variational autoencoder to purify adversarial examples. JEEE Access, 11126582-1265555 2019.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. Technicul Report, 2009.
Laidlaw, Singla, and Feizi. Perceptual adversarial robustness: Defense against unseen threat models. In International Conference on Learning Representations (ICLR), 2021.
Minjong Lee and Dongwoo Kim. Robust evaluation of diffusion- adversarial purification. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pp. 134-144, October 2023.
Bai Li. Changyou Chen, Wenlin Wang, and Lawrence Carin. Certified adversarial robustness with additive noise. Advances in neural information processing systems, 32, 2019.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. International Conference on Learning Representations, 2018a.
11

---

Published as a conference paper at ICLR 2024
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018b.
Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. International Conference on Machine Learning, 2022.
Tianyu Pang, Min Lin, Xiao Yang, Jun Zhu, and Shuicheng Yan. Robustness and accuracy could be reconcilable by (proper) definition. International Conference on Machine Learning, pp. 17258-17277. PMLR, 2022.
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high-performance deep learning library. Advances in neural information processing systems, 32, 2019.
Omid Poursaeed, Tianxing Jiang, Harry Yang, Serge Belongie, and Ser-Nam Lim. Robustness and generalization via generative adversarial training. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 15711-15720, 2021.
Edward Raff, Jared Sylvester, Steven Forsyth, and Mark McLean. Barrage of random transforms for adversarially robust defense. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 6528-6537, 2019.
Sylvestre-Alvise Rebuffi, Sven Gowal, Dan A Calian, Florian Stimberg, Olivia Wiles, and Tim- othy Mann. Fixing data augmentation to improve adversarial robustness. arXiv preprint arXiv:2103.01946, 2021.
Gwonsang Ryu and Daeseon Choi. A hybrid adversarial training for deep learning model and denoising network resistant to adversarial examples. Applied Intelligence, pp. 1-14, 2022.
Changhao Shi, Chester Holtz, and Gal Mishne. Online adversarial purification based self- supervision. International Conference on Learning Representations, 2021.
Vignesh Srinivasan, Csaba Rohrer, Arturo Marban, Klaus-Robert Müller, Wojeiech Samek, and Shinichi Nakajima. Robustifying models against adversarial attacks by langevin dynamics. Neural Networks, 137:1-17, 2021.
David Stutz, Matthias Hein, and Bernt Schiele. Confidence-calibrated adversarial training: Generaliz- ing unseen attacks. In International Conference Machine Learning, pp. 9155-915511 91669 PMLR, 2020.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties neural networks. International Conference on Learning Representations, 2014.
Jihoon Tack, Sihyun Yu, Jongheon Jeong, Minseon Kim, Sung Ju Hwang, and Jinwoo Shin. Con- sistency regularization for adversarial robustness. In Proceedings of the AAAI Conference Artificial Intelligence, pp. 8414-8422, 2022.
Florian Tramèr,
Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and defenses. International Conference on Learning Representations, 2018.
Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. Advances in neural information processing systems, 33:1633-1645 2020.
Giorgio Ughini, Stefano Samele, and Matteo Matteucci. Trust-no-pixll: A remarkably simple defense against adversarial attacks based on massive inpainting. In 2022 International Joint Conference on Neural Networks (IJCNN), pp. 1-10. IEEE, 2022.
12

---

Published as a conference paper at ICLR 2024
Zekai Wang, Tianyu Pang. Chao Du, Min Lin, Weiwei Liu, and YAN Shuicheng. Better diffusion models further improve adversarial training. In International Conference on Machine Learning. PMLR. 2023.
QuanLin Wu, Hang Ye, Yuntian Gu, Huishuai Zhang, Liwei Wang, and Di He. Denoising masked autoencoders help robust classification. In The Eleventh International Conference on Learning Representations, 2023.
Chaowei Xiao, Jun Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song. Spatially transformed adversarial examples. In International Conference on Learning Representations, 2018.
Yuzhe Yang, Guo Zhang, Dina Katabi, and Zhi Xu. Me-net: Towards effective adversarial robustness with matrix estimation. International Conference on Machine Learning, 2019.
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In Procedings of the British Machine Vision Conference 2016. British Machine Vision Association, 2016.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning, pp. 7472-7482. PMLR, 2019.
Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan Kankanhalli. Geometry- aware reseihhe-rewiightee adversarial training. In International Conference Learning Representations, 2020.
13

---

Published as a conference paper at ICLR 2024
SUPPLEMENTARY MATERIAL
PURIFICATION PROCESS AND VISUALIZATION
First, we develop a total of three types of random transforms that employ a mixed strategy of adding Gaussian noise and missing pixels. In this section, we use images from ImageNette as examples, and all operations are based on images of size 256 x 256.
Purify clean examples with RT;
Purify adversarial exumples with RT,
T
Figure 5: For each group, the first column shows the clean example (left) and adversarial exam- ple (right). The following one is the masked image. The last column illustrates the purified image.
For the first type of transform (RT,), we use a binary mask with small patches of size 32 32 that are randomly missing with the missing rate r= 0.25. As shown Figure we illustrate the clean examples and the adversarial examples generated by FGSM attack (e = 8/255), which are processed by RT₁ and purified by the pre-trained GAN- based model without adversarial training. To facilitate image observation, enlarge some patches of size 32 32 and mark them with yellow. In the area without masking, the perturbations are retained, leading to low robust accuracy.
Purify clean examples with RT,
Purify adversurial examples with RT;
Figure 6: For each group, the first column shows the clean example (left) and adversarial exam- ple (right). The following two correspond to the noisy image with Gaussian noise and the masked noisy image. The last column illustrates the purified image.
For the second type of transform (RT'2,, we add Gaussian noise with a = 0.25 before applying the random mask with the missing rate 0.25 destruct the perturbations further. As shown in Figure 6 we also illustrate the clean examples and the adversarial examples generated by FGSM attack (E 8/255). which are processed by RT, and purified by the pre-trained GAN-based model without adversarial training. Since Gaussian noise can destruct some small-epsilon perturbations, therefore, the area without masking, the perturbations are also removed, increasing robust accuracy.
For the third type of transform (RT3), based on the RT2, we repeat N = 4 transformations on the one image to ensure that all pixel values were regenerated by the purifier model to remove as much perturbations as possible. Specifically, the noisy image is covered randomly by four non-overlapping masks with the missing rate r = 0.25, and then we run the pre-trained GAN-based model four times by inputting masked noisy images. As shown in Figure 7 the purified image is obtained by aggregating the completed pixels of four inpainted images, where the inpainting process is carried out by the pre-trained GAN-based model without adversarial training. We compare the purified images
14

---

Published as a conference paper at ICLR 2024
Masked Noisy Images
Inpainted Images
Completed Pixels
Original
Reconstructed Image
Image
Figure 7: Purify the original image with RT3.
Purify clean examples with RT;
Purify adversarial examples with RT:
Figure 8: For each group, the first column shows the clean example (left) and adversarial exam- ple (right). The following two correspond to the masked noisy image and the completed pixels. The last column illustrates the purified image.
obtained by applying a purifier model on both the clean example and the adversarial example on the same image. As shown in Figureß8 we find that the two purified images are almost identical, which confirms that the purified image contains almost perturbations. However, due to the excessive loss of semantic information, the standard accuracy decreased, thereby limiting the improvement of robust accuracy.
In summary, combining with Figure 5 Figure 6. and Figure we can see that when using more powerful random transforms, the perturbations will be gradually destructed; however, semantic information will also be lost. This limitation prevents the continuous increase in robust accuracy.
We fine-tune the purifier model with adversarial training. As shown in Figure 9) we illustrate purified images obtained through the three bhove-mentionee transforms and AToP. Observedly, we find that while suppressing the perturbations. AToP introduces some additional information improve classification accuracy.
Original
RT,
RT,
RT:
Original
RT,
RT:
RT:
Figure 9: For each group, the first column shows the original images containing clean example (top) and an adversarial example (bottom). The following three correspond the images obtained with different random transforms before inputting into the purifier model.
15


Reviews:
[{"review_id": "Zq4nNa1aeT", "reviewer": "Reviewer_jVyX", "summary": "This paper proposes Adversarial Training on Purification (AToP) for adversarial defense, which is expected to improve the robustness while achieving good generalization ability. The proposed method consists of two components: perturbation destruction by random transformations and a purifier model that aims to recover the clean image which is adversarially finetuned. The experiments suggest that AToP can improve the robustness against both seen and unseen attacks without significantly sacrificing the accuracy on clean images, and achieve state-of-the-art results on several benchmarks.", "questions": "- Why FGSM is used for adversarial finetuning instead of PGD or other attacks?\n\n- Can the reconstruction loss in Eq. (8) be applied to the reconstruction of adversarial images? Specifically, is it likely that adding $\\mathbb{E}[\\Vert x-g(t(x+\\delta),\\theta_g) \\Vert]$ to the loss will increase the performance?\n\n- Why does reconstruction loss take $\\ell_1$-distance?\n\n- What is the expected scope of purification models that AToP can generalize to?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 3, "strengths": "- This paper makes an early attempt to finetune an adversarial purification model with adversarial training, and suggests that this can be beneficial.\n- The experiments are complete and the results seem promising.\n- The figures are clear and meaningful.", "weaknesses": "- Clarity of Section 3.2. \n  - Eq. (8) seems to be a mix of the loss functions for the generator (purifier) $g$ and the discriminator $D$, which are supposed to be different in GAN training. Besides, since AToP is not limited to GAN-based purifier models, it is better to present a general form of the loss function.\n  - It is stated that \"the discriminator $D$ is responsible for distinguishing between real examples (*including clean or adversarial examples*) and the purified examples\", but this is not reflected by Eq. (8) since only the clean sample $x$ is involved in $L_{df}$.\n  - Line 5 of Algorithm 1 is confusing. The notation $g_{\\theta_g}$ is not explained.\n- Some experimental details are not clearly stated.\n  - For evaluation, it is claimed that \"we randomly select 512 images from the test set for robust evaluation.\" It is not clear whether this applies to all results or all compared methods. The comparison may be unfair if different models are evaluated on different test sets.\n  - The \"Ours\" in Table 2,3,4 are not specified: Which RT and purifier model are used? What are the hyper-parameters for the training attack?\n- The results for AToP in Table 8 may be unreasonable. Specifically, considering the accuracy of the same model against different attacks, it is shown that FGSM < PGD < AutoAttack, which is exactly the reverse of common expectations since AutoAttack is believed to be a much stronger attack while FGSM should be the weakest attack. These results may significantly challenge the reliability of the robustness evaluation and should be seriously discussed.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "yXMRad9hnv", "reviewer": "Reviewer_n69U", "summary": "1. This paper aims to enhance the adversarial robustness of deep models.\n\n2. Combining adversarial training and purification techniques, a new pipeline is proposed, i.e., adversarial training on purification.\n\n3. Different from purification methods that purify adversarial examples with a pre-trained generative model before classification, \nthe generative model can be finetuned by adversarial training in the proposed pipeline. Moreover, the introduce random transformations play an important role in defensing adversarial attacks.", "questions": "See above weaknesses.", "limitations": "", "rating": 5, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. The paper is written clearly and easy to follow.    \n2. Models trained by the proposed method show promising robustness and generalization.", "weaknesses": "1. What if there are no random transformations in the proposed pipeline?\n    Does the robustness come from the gradient vanishing from random operations?\n\n2. For adversarial training methods, auto-attack is one of the most effective attack methods to evaluate model robustness. This is because models with adversarial training usually show much better results under FGSM, PGD, and other attacks than under the auto-attack. \n\n    However, as indicated by Table 7 and Table 8 in this paper, the trained model even achieves much better robustness under auto-attack than under PGD20, FGSM attacks.\n    From this perspective, the comparisons in Tables 2,3,4,5 can be unfair because models with adversarial training show worst-case robustness under auto-attack while it is not the case for the model trained by the proposed method.\n\n3. Considering the issue in 2, to demonstrate their robustness, the models trained by the proposed methods should be fully tested under different attacks. For example, the CW attack with a large number of steps, and the PGD attack with 1000 steps.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "r1rWKa5gtV", "reviewer": "Reviewer_onZy", "summary": "The paper introduces an adversarial defense technique called Adversarial Training on Purification (AToP). AToP conceptualizes AP into two components: perturbation destruction by random transforms and fine-tu . ning the purifier model using supervised AT. The random transforms aim to enhance the robustness to unseen attacks, while the purifier model reconstructs clean data from corrupted data, ensuring correct classification output regardless of the corruption. The purifier model is fine-tuned through an adversarial loss calculated from the classifier output. The paper presents experiments on CIFAR and ImageNette datasets, comparing AToP with other AT and AP methods. The results demonstrate that AToP achieves good generalization ability against unseen attacks, and maintains standard accuracy on clean examples.", "questions": "Please address the points in my weaknesses section.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The paper addresses a significant problem in the field of deep learning, namely the vulnerability of neural networks to adversarial attacks.\n- The proposed AToP technique offers a promising solution that combines the advantages of AT and AP, achieving good robustness, standard accuracy, and robust generalization to unseen attacks.\n- The proposed AToP framework is well-defined, with a clear explanation of its components and their roles in achieving optimal robustness, standard accuracy, and robust generalization to unseen attacks.  \n- The experiments are conducted on CIFAR and ImageNette dataset \n- I appreciate the evaluation with BDPA   \n- The paper is well-structured, with a clear and concise presentation of ideas.", "weaknesses": "- Overall the technical novelty of this work is limited. In essence, AToP combines the orthogonal techniques of AT and AP. \n- The authors mainly evaluate ResNet and Wide-ResNet architecture. Hence it is not clear if this work generalizes to other model architectures. \n- These days, transformer architectures are gaining popularity. How does the proposed AToP perform on such architectures, such as ViT?\n- While I appreciate the evaluation on BPDA, the authors should include a separate section on “obfuscated gradients”, where they follow the guidelines of BPDA and [A] to test for obfuscated gradients.  \n\n[B] On Evaluating Adversarial Robustness; arXiv 2019", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)