Robustness Exploration of Semantic Information in Adversarial Training
Authors: Huafeng Kuang
Hong Liu
Mingliang Xu
YONGJIAN WU
Rongrong Ji
Venue: Submitted to ICLR 2023 (2023)
Keywords: Adversarial training
Semantic information
Adversarial robustness

Abstract: In this paper, we look into the problem of adversarial robustness from the semantic information perspective. We demonstrate a novel insight that adversarial attacks destroy the correlation between visual representations and semantic word vectors, and adversarial training fixed it. We further find that the correlation between robust features of different categories is consistent with the correlation between corresponding semantic word vectors. Based on that, we introduce the semantic information to assist model training and propose Semantic Constraint Adversarial Robust Learning (SCARL). First, we follow an information-theoretical lens to formulate the mutual information between the visual representation and the corresponding semantic word vector in the embedding space to bridge the information gap. We further provide a differentiable lower bound to optimize such mutual information efficiently. Second, we propose a novel semantic structural constraint, encouraging the trained model to keep the structure of visual representations consistent with that of semantic word vectors. Finally, we combine these two techniques with adversarial training to learn robust visual representation. Experimentally, we conduct extensive experiments on several benchmarks, demonstrating that semantic information is indeed beneficial to model robustness.

Under review as a conference paper at ICLR 2023
ROBUSTNESS EXPLORATION OF SEMANTIC INFORMA- TION IN ADVERSARIAL TRAINING
Anonymous authors Paper under double-blind review
ABSTRACT
In this paper, we look into the problem of adversarial robustness from the seman- tic information perspective. We present novel insight that adversarial attacks destroy the correlation between visual representations and semantic word vec- tors, and adversarial training fixed it. We further find that the correlation between robust features of different categories is consistent with the correlation between corresponding semantic word vectors. Based on that, we introduce the semantic information to assist model training and propose Semantic Constraint Adversar- ial Robust Learning (SCARL). Firstly, we follow an ieformatioonthhoreeee to formulate the mutual information between the visual representation and the corresponding semantic word vector the embedding space to bridge the infor- mation gap. We further provide differentiable lower bound to optimize such mutual information efficiently. Secondly, we propose a novel semantic structural constraint, encouraging the trained model to keep the structure of visual repre- sentations consistent with that of semantic word vectors. Finally, we combine these two techniques with adversarial training to learn robust visual representa- tion. Experimentally, we conduct extensive experiments on several benchmarks, demonstrating that semantic information is indeed beneficial model robustness.
lens
INTRODUCTION
Word embedding is one of the critical technologies in natural language processing (Pennington et al, 2014 Goldberg & Levy] 2014 Tang al. 2014). It statistics the co-occurrence frequency between pairs of words within a given context in large-scale training corpus to learn an encoder that can infer vectors for any words in learned embedded space. A well-trained word embedding model is usually regarded as a knowledge graph (Matthews & Matthews 2001]] Wang et al. 2018). in which the meaning of word is determined by its relationship other words in the learned vector space. That is, analogies and correlations between words can be presented by the learned vectors (Hohman et al. 2018 Chersoni et al. 202T). which help the model associate seen objects with unseen objects.
Recently, several works have explored using semantic word/text embedding as supervision signs for zero-shot learning and -isual-linguisti pre-training and have achieved impressive successes in various AI tasks (Qiao et al.] [017 Wang et al.) [0188] Radford et al.) |021 Wang et al. 2022). the other hand, deep neural networks are usually vulnerable to adversarial examples (Szegedy et al. 20144: Goodffllow et al., 2015 Madry al. 2018 Bhojanapalli et al. 2021), which severely limits their applications in many security scenarios. Fortunately, some studies (Radford et al. 2021 Yu et al. 2022) have shown that the visual model trained with semantic supervised information has much more robust to distribution shift and adversarial examples than standard trained models. As a result, these preliminaries raise a natural question:
What is the impact of semantic informations on adversarial robustness?
To answer this question, we explore the relationship between semantic information and model ro- bustness from two aspects: distribution and structural relevance. Firstly, we apply the canonical correlation analysis (CCA) (Hotelling 1992). which can reflect connections between two random variables. to analyze the distribution relevance between the visual representation and the correspond- ing semantic word vector. We mainly analyze the correlation coefficient of natural and adversarial image representation with semantic word vector under non-robust and robust models (Madry al.,

---

Under review as a conference paper at ICLR 2023
CCA 00.41
CCA-0.53
CCA-0.67
OCA- 0.79
Regresectation
Visil Represemation
Vinual
Weed
Word Vonte
Word Vocte
Semtattc
(4) Nat. image under Nat, model
(b) Adv. image under Nat, model
(c) Adv. image under Adv. Model
(d) Adv. image under Adv. Model
The canonical correlation analysis (CCA) of the natural and adversarial image with the semantic words under the natural and adversarial trained model, respectively. In each plot, sample 500 image-words pairs to calculate the correlation coefficient. * indicates the model trained by FGSM. it's less robust than standard adversarial training (d). The larger the CCA, the stronger the correlation between the visual representation and semantic word vector.
Figure 1:
1.
0.
14
03
180
00
-00
(8) Non-robust feature
Robust feature
(c) Glove vectors
(d) CLIP feature
Figure 2: The similarity matrix between different categories of features learned by different models CIFAR-10. Different numbers represent different categories. The similarity is calculated by operate inner product between different categories of normalized features. The color is brighter with larger similarity.
2018). The results in Figure indicate that, for the non-robust model, the representation of the natural image has a high correlation with corresponding word vector. contrast, the adversarial image has lower correlation. This result means that the adversarial attack will destroy the semantic information from the non-robust model, which responds to the previous observations in (Zhang & Zhu 2019 Ilyas al. 2019) via a perspective. For the robust model trained adversarial examples (Madry et al. 2018), the correlation between the visual representation and word vector has significant enhancement. As result, robust model, the stronger the correlation.
summarize novel intriguing property: the more
Secondly, to verify the semantic word vectors could present the analogies and correlations between words, we visualize the similarity matrix of word vectors generated by a trained Glove (Pennington al. 2014) CIFAR-IO, which is shown in Figure (c), As can be seen from the figure, the correlation between category 3 (Cat) I and category 5 (Dog) is stronger than the correlation between category 3 (Cat) and category (Truck). We further visualize the similarity between different cate- gories of non-robust features and the similarity of robust features. which are shown in Figure 2 (a) and (b) respectively. We can observe that the robustness feature can also reflect the relatedness be- tween categories, and it is similar to the relatedness reflected by the semantic word vector. However, the non-robust features cannot reflect the association between categories. Recently, CLIP (Radford) et al. 2021) uses large-scale image-text pairs to jointly learn semantic representations. Therefore, we also visualize the semantic representation correlation matrix learned by CLIP. which is shown in Figure (d). the semantic representations learned by CLIP present analogies and correlations between categories, but there is certain gap with the real semantics.
Taking analysis into consideration, we introduce the semantic information learned by word em- bedding into model training, which aims at improving the robustness of the current neural networks (He al. 2016a). We follow information-theoreiie perspective bridge the information gap
'The CIFAR-10 contains 10 categories: airplane (0), (1), bird (2), cat (3), deer (4), dog (5), frog (6), horse (7), ship (8), truck (9).
2

---

Under review as a conference paper at ICLR 2023
between visual representations and semantic word vectors, which consists of two key techniques. First, we use mutual information to enhance semantic information in the visual representation, which aims to enhance the correlations via distributional information. Second, we introduce geometric constraints to align the manifold information from the visual representation space to the word vector space, which aims to enhance the correlations via structural information. Finally, we propose the Semantic Constraint Adversarial Robust Learning (SCARL) framework, which combines the above two techniques with adversarial training.
Our contributions are summarized as follows:
We are the first explore the correlation between semantic word information and the deep model via the classical CCA method. We find that, the more robust the model, the stronger the correlation between visual representation and semantic word vector.
We analyze the correlations between different categories of image features, and find that the robust features can reflect the semantic association between categories, which is consistent with the word vector, but the not-robust features can
We introduce Semantic Constraint Adversarial Robust Learning (SCARL) framework that captures the distributional and structural information from semantic word vectors via mutual information optimization and geometry constraints, to promote robustness.
We conduct extensive experiments on three widely-used benchmarks. The results show that the proposed SCARL behaves more robust than several state-of-the-aa techniques, which demonstrates semantic information indeed helps improve robustness.
2 SEMANTIC CONSTRAINT ADVERSARIAL ROBUST LEARNING
2.1 PROBLEM SETTING AND NOTATIONS
The robustness against adversarial example attacks has attracted a lot of attention, and various train- ing algorithms have been proposed to mitigate the problem (Madry et al. 2018] Dhillon et al.) 2018) Yang et al. 2019 Song et al. 2019: Wu et al., 2020). However, none of these methods could sur- vive the latest gradient masking- based attack (Athalye et al. 2018). In this competition between attackers and defenders, adversarial training (Madry a 2018) Zhang et al. 2019) stands out as a promising solution to defend against those strongest adversarial attacks. The approach augments the training data with adversarial inputs produced by an adversarial attack, which can be formulated as min-max optimization problem:
min
E max ( (IT()))))
where Fo is a DNN model with parameters 0, and is the loss function of the DNN, Tady denote adversarial examples.
On the other hand, several works have explored using semantic word embedding as supervision information to improve model performance (Gan al. 2020, Radford et al.) (2021). However, most of them are pre-trained on large-scale image-text datasets and then transferred to downstream tasks. There are several critical limitations of adversarial training: 1) Requesting large-scale image-text datasets, which are collected from the web, often with noisy data; 2) Inconsistency of representation space between visual image and semantic word; 3) There is no reliable robustness evaluation method for multimodal information.
To overcome these limitations, Firstly, we only focus on the essential image classification task, and we use the CIFAR (Krizhevsky et al. (009) and TinyImageNet (Deng et al.) 2009) datasets, which have the one-hot label and the corresponding semantic words. Secondly, for the semantic word vec- tor, we use the Glove (Pennington et al. 2014) or CLIP (Radford et al., 2021) to embed the names or descriptions of the target dataset's s classes. Then, we project visual representation and semantic word vector into the consistency manifold, and introduce two constraint strategies from the infor- mation and structural perspective to ensure the visual representation manifold is consistent with that of the semantic word vector. Lastly, we combine the proposed semantic constraint techniques with adversarial training to learn robust representation, which is called Semantic Constraint Adversarial Robust Leaming (SCARL).. The overall framework is shown in Figure 3
3

---

Under review as a conference paper at ICLR 2023
Adv. Image
Semantic
Maximizing [(S:T) X)
ResNet-18
Glove
Panda
Car
Feature extractor
PC&NPPH
Word embedding
Dog
LL
Plane
Cat
Image fow
FC: Fully connected layer NPH. Nealinear projection head
Maximizing I(S:Y)
Figure 3: The framework of our SCARL, the visual representation and semantic word vector extracted by a DNN and word embedding model respectively. We maximize the mutual informa- tion between visual representation and the corresponding semantic word vector by Lemma 2.1 and maximize the mutual information between visual representation and one-hot label by minimizing cross-entropy loss. By geometric structure constraints, we further align the manifold information from the visual representation space to the word vector space. Best viewed in color.
Notations. We define random variables X,Y.Z PD(I, y, z), where X represents the image input, Y represents the one-hot class label. Z represents the corresponding semantic words. Po is the data distribution, and y, are the observed values. For the image classification task, our goal is to build a classifier q Fa (z)), where (x) is referred to as our objective model. We define random variable S = (X) as the visual representation of X extracted by classifier Fs, and define random variable = Eg(2) (2) as word vector of Z encoded by the word embedding model Eg. Our goal is to train F6 (x) such that X is capable of predicting Y.
2.2 MAXIMIZING LOWER BOUND ON SEMANTIC MUTUAL INFORMATION
In the classification task, the classifier is often trained with cross-entropy loss, which can be viewed as maximizing the mutual information T(S:Y) log p(S.Y)
p(S)p(Y)) where p(S, Y) denotes the joint probability distribution of S.Y, and both p(S) and p(Y) are the marginals. According to variational inference, we can use q(yls) as variational distribution of p(y[s), and derive variational lower bound on T(S; Y) as follows:
I(S:Y) H(Y) Eg Eggyr-p log 4(v s)] + KL s)ll(( s))
(2)
HYY Es,y<po log (3) s)],
where H(Y) is a constant measuring the shannon entropy of Y, and Es.y log gly 8)] is essen- tially the cross-entropy loss using q(y, s) for classification. Therefore, the objective of maximizing Y) can be achieved by minimizing Es, |- log g s)] instead.
However, maximizing I(S; Y) does take into account the semantic information of the seman- tic words. To bridge visual representation and semantic word vector. We follow an information- theoretical lens look into the information gap between visual representation and semantic word vector, and propose maximum semantic mutual information to improve model training. We formu- late our objective as follows:
max (SSYYT))
Our goal is to train the model such that is capable of predicting Y, as well as learning the semantic information from T. However, since the objective of equation Blis difficult to optimize directly, decompose it into two terms as follows:
((S:Y,T) = ((; I( Y),
(4)
where [(S; Y) measures how well the model can predict the one-hot label, and -(S;T) Y) mea- sures how well the visual representation can learn semantic information from the semantic word vector. The I(S;Y) Y) can be optimized using the cross-entropy loss. For optimizing I(S T Y), in- spired by (Hjelm et al. 2018 Tian et al. 2020), -Lin on the conditional mutual information. To achieve a tractable objective, We introduce the following Lemma:
contrastive learning to derive a lower bound
4

---

Under review as a conference paper at ICLR 2023
Lemma 2.1. Given
1 congruent pair 21, =1 and N incongruent pairs 1=11 which is sampled i.id. from the distribution PD(a, y. 2). & (x(x)
(re, Zio Vi Cr = 0)
and t E=(z), [(5TT
Y) is lower bounded by
al))) + () logg e9.l +
(
-Linfo Bo(ssT/cy=-)llog ea.(oV/il0/r +c"
where e is the cardinality of the dataset and T is temperature that adjusts the concentration level. Is and St are nonlinear projection heads to transform the representation into the same manifold space and further normalize by the n.2-norm. The proof is shown in the supplementary material. By leveraging Lemma 2.1 Linfo can be computed using batch of samples and then minimized for maximizing ((;;
We further analyse the characteristies of semantic mutual information and its corresponding differ-
enx(") (11 ential lower bound. From Lemma 2.1. add ( Cy=u) |og (1- cxata) stt))/e to relax the bound. Then, our final bound in Lemma 2.1 contains two parts. The first part is to maximize the mutual information between an image and the corresponding semantic words; the second part is to minimize the mutual information between an image and the mismatched semantic words. Intu- itively, the formulation of Lemma 2. is similar to the fundamental goal for metric learning: learn representation that is close in some metric space for "positive" pairs and push apart the represen- tation between "negative" pairs. Different from traditional metric learning, our approach is based on the perspective of information theory and can be seen special metric learning by optimizing the mutual information.
2.3 SEMANTIC STRUCTURE CONSTRAINT
In the last subsection, we bridged semantic word vector and visual representation through mutual information, but ignored the structure relationship in linguistic words. Based on our findings in Figure the correlation between robust features is similar to that of semantic word vectors. Another reason for using structural constraints is that when a non-robust model is attacked, the manifold of representations is distorted with the disruption of the space structure; thus, maintaining the structure stability is beneficial to the defense. Therefore, we proposed semantic structure constraint loss to keep the structure of images consistent with that of semantic words.
Given a dataset D with classes. Let M E Rd be a lower-dimensional manifold, where {s, E M|s Fo(x)) t Eo(z), x, E D}. was defined using the output of any layer of the network (e.g., hidden output the logic layer). We define the visual representation centers as Simage = {s!.....e s E M]. which is the set of K vertices representative of dataset D. Each vertex s' is the centroid vector representing one class of feature vectors within neighbourhood region. Similarly, we define the word vector centers T word = (t',..., ".....,,te t E M).
To get T word, first randomly initialize its value by picking random position in manifold space. Then, we update iteratively using the momentum rule:
new t + m (Eo = i) ,t,,;= 1,. ,.
(6)
where tye denotes the updated vertex, and the hyperparameter m E [0, 1) is momentum coefficient. The equation O ensures the vertex has stable step towards the center as training goes
For visual representation centers, we construct a new center siew for the observed values of each vertex in each training epoch. s is estimated by the averaging representation of the same class in the mini-batch samples:
new
1 N
Σ
Folxnlyn = i), = K.
Then, let the Tword restrict the Simage to make them consistent. To this end, propose two geometry relation matching metrics: distance-wing wise and angle-wise. Both of them aim to match the geometry structure information between visual representation and semantic word vector.
5

---

Under review as a conference paper at ICLR 2023
Distance-wise Matching. For distance-wise metrics, given pair of representation center s' 2, and a distance-wise function ΦD. we separately calculate the distance (e.g., Euclidean distance) between the two image centers in the representation space:
ØD(s"
-|s 1|s's 12112,
(8)
where is normalization factor for distance. To focus the relative distance among other pairs, we set to the average distance between pairs from Singge is defended as: = 18-1 Exi [|s s' 1222 Similarly, we can calculate the @p(t', (2). Using the distance-wise po- tential measured in both image and word centers, a distance-wise matching loss is defined as:
LD =
E
1s (Øn(s' "n((t
where Is is smooth LI loss (Ren al. 2015), The distance-wise loss matches the relationship of centers by penalizing the distance difference between their output in manifold space.
Angle-wise Matching, For angle-wise metrics, given triplet of training centers < s s/ s an angle-wise relational potential measures the angle formed by the visual representation and word vector centers in the output manifold space:
A 8 * >) cos/ijk =< e
(10)
where ed representation and word vector, angle-wise matching loss is formulated
3 l Using the angle-wise potentials measured in both visual
LA
Σ
1s (ox(s', ( s*,, @a t²,tt))
(11)
The angle-wise loss matches the structure of the visual manifold with semantic structure by penal- izing angular differences.
2.4 ADVERSARIAL TRAINING WITH SEMANTIC CONSTRAINT
Finally, we combine the proposed semantic constraint techniques with the adversarial training frame- work to learn robust representation, which is called Semantic Constraint Adversarial Robust Learn- ing (SCARL). Our goal is to maximize equation and maintain the manifold structure under the adversarial setting.
Maximizing Adversarial ((Svvv Y): As mentioned in 2.2 maximizing I(Saavi Y) can be achieved by minimizing cross-entropy loss instead. To encourage adversarial robustness, this cross-entropy Bellbackk-eebble divergence between natural examples Vast and
loss can be upgraded to maximize adversarial examples Tadv in (Zhang al. 2019) Dong al. 2021). Therefore, the objective function can be formulated as follows:
Lady Lee CF (Fo v) + B K.(P((-( (P((=mm))
(12)
Maximizing Adversarial I(Savv; Y): To maximize the semantic mutual information T(Savvi Y). According to Lemma 2.1 we formulate the objective to minimize Linfo as follows:
(o)
Linfo = Bnss.Tiy=ii(-
(s.(s)a +
(13)
(..10)9
+ (B,((.TTc,==))] log(1 (a)()) +
where Sado Fo(oddd), Ex(z)), and is cardinality of the dataset and 7 is temperature that adjusts the concentration level. Is and are nonlinear projection heads.
Restricting Simage with T Tword: Based the geometric matching, formulate the semantic structure constraint loss as follows:
Lane Lo La
(14)

---

Under review as a conference paper at ICLR 2023
Table 1: Robustness accuracy comparison of the proposed approach and baseline models under different attack methods under the foo norm with e = 8/255 on different datasets. All the models are based on pre-activation ResNet-18 architecture. We choose the best checkpoint according the highest robust accuracy on the test set under P0. The best results are blodfaced.
Dataset
Method
Natural
FGSM
PGD-100
CW-100
Square
AutoAttack
AT
83.14 14
57.98
51.11
49.83
54.42
47.56
TLA
83.75
58.17
51.35
50.54
56.17
48.17
CIFAR-
ACL
84.03
58.48
52.75
50.78
56.43
48.86
10
TRADES
82.76
58.85
53.43
50.91
54.85
49.34
SCARL
80.57
58.44
54.22
51.23
55.93
50.42
AT
57.96
32.64
29.29
27.46
28.26
24.06
TLA
56.51
32.59
29.16
27.44
30.57
25.15
CIFAR-
ACL
57.63
32.58
29.01
27.53
30,93
25.11
100
TRADES
58.95
33.19
30.07
26.53
30,43
25.33
SCARL
58.74
34.13
31.61
27.41
31.13
26.32
AT
48.49
25.37
23.07
20.72
26.42
18.59
TLA
47.36
25.31
23.09
21.06
27.87
18.84
Tiny-
ACL
48.04
25.06
22.79
20.82
26.01
18.62
ImageNet
TRADES
49.89
25.32
23.18
19.59
25.41
18.47
SCARL
49.35
26.10
23.51
21.67
27.07
19.29
Overall Objective Loss: We integrate all the above technologies into end-to-end training frame- work. The overall loss function of our algorithm formulated as follows:
Lobj Ladv + X Linfo + A2 Latuue
(15)
where Å and X2 are hyperparameters to control the relative importance among the three losses. The training process not only maximizes the mutual information between visual representation and semantic word vector in the consistent manifold space, and also captures the semantic structure information, which enables our model to learn more semantic and robust representations that are not sensitive to the input perturbation.
3
EXPERIMENTS
3.1 EXPERIMENTAL SETUP
Datasets. We compare the proposed methods with the baselines on widely-used benchmark datasets, including: CIFAR-10, CIFAR-100 (Krizhevsky et al. 2009) and These datasets can easily obtain one-hot labels and the corresponding semantic words.
(Deng et al. 2009)
Baselines Setup. We compare the robustness of our proposed SCARL with some classical adver- sarial training methods, including standard AT al. 2018), TRADES (Zhang et al. 2019) triplet loss adversarial training (TLA) (Mao et al., 2019) and adversarial training with contrastive learning (ACL) (Tiang al. 2020). We test the defence under different white- and black-box tacks including FGSM (Goodfellow et al. 2015), PGD (Madry et al.. (2018). CW (Carlini & Wagner 2017), Square (Andriushchenko al. 2019) and AutoAttack (Croce Hein 2020).
Model Details. We adopt pre-activation ResNet- 18 He et al. 6b1 as the image feature extractor, then follow nonlinear projection with one additional hidden layer (and ReL.U activation). The output vector (64-D) is normalized by its L2-norm. This is the representation of the image. For the word embedding model, we use the Glove (Pennington et al. 2014). which is trained with Wikipedia (Scheepers) 2017) and Gigaword (Rush et (201)) datasets. The word vector is also projected into a vector (64-D) by nonlinear projection head and normalized. This the representation of semantic words.
Training Details. For training, the initial learning rate is = 0.1, and the learning rate schedule is 10.1, 0.01, 0.001] for all datasets, the decay epoch schedule is [75, 90] for CIFAR and [50, 55] for

---

Under review as a conference paper at ICLR 2023
TinyImageNet. The training scheduling of 100 epochs for CIFAR and 60 epochs for TinylmageNet. Following (Rice et al., 2020). we adopt the common setting that the threat model with radius 8/255, with the PGD attack taking 10 steps of size 2/255 on all datasets. We train with the SGD optimizer with momentum 0.9, weight decay 5 10-1 using a batch size of 128. We performed standard data augmentation including random crops and random horizontal flips during training. For hyper- parameter, we set the hyperparameter A = =1.0 and X = 1.0 along a Gaussian ramp curve in equation [5] the 3 = equation 12] Our implementation is based on PyTorch and the code to reproduce our results will be available.
3.2 MAIN RESULTS
To verify the impact of the semantic information model robustness. we train a natural model and ro- bust model with semantic information (SemInfo), and compare it with another model trained without seman- tic information. Thble the results. We find that the model using semantic information is more robust against simple attacks such as FGSM, but still not ro- bust against stronger attacks. Further, we combine se- mantic information with standard adversarial training (Madry et al.) 2018), The Seminfo improves the robustness by 1.25% under standard AutoAttack, which demonstrated the semantic information is beneficial to the model's 's robustness.
Table 2: The robustness results in CIFAR-
10 under the foo. norm with e = 8/255.
Method
FGSM AutoAttack
Nat. training
33.24
0.0
Nat. training SemInfo
36.32
0.0
Adv. training
57.98
47.56
Adv. training + SemInfo
58.63
48.81
In order to further verify the influence of semantic information the robustness of the model, calculate the CCA of our SCARL where the model trained with the equation [5] the CCA is 0.84 F which means visual representations learned by SCARL are more semantic information than standard adversarial training (Madry et al. 2018). We further report the results under different white- and black-box attacks at the best checkpoint, which is selected based on the performance under the PGD-10 attack. The results are shown in Table [ The proposed method SCARL achieves the best robustness against the strongest attacks AutoAttack both CIFAR and TinylmageNet, where every small margin of improvement is significant.
We further verify the robustness of our method under adaptive attack (Akhtar & Mian 2018) where the attacker has the knowledge and
Table 3: Robustness comparison of different ad- versarially trained models under adaptive attacks.
white-box access to the word embedding model.
use the PGD-based adaptive at- tack to evaluate AT, TRADES and our SCARL model under ResNet- 18 on CIFARIO. The re- sults are shown in Table and demonstrate our SCARL can still defend against the adaptive at- tack. We also tested the performance under WideResNet (Zagoruyko & Komodakis, 2016), the results are shown in supplementary material since space limitations. In addition, We plot the results of testing accuracy over epochs and evaluate adversarial accuracy against PGD attacks under differ- ent attack budgets with a fixed attack step of 10, and we also conduct experiments using PGD attacks with different attack iterations with a fixed attack budget of 8/255. The results shown in Figure 4 (a-c). Our SCARL is better than standard AT and TRADES at a larger budget, besides, our SCARL stable against large iterations attacks, e.g., PGD attack with 500 step iterations. Therefore, the results demonstrate the effectiveness of our proposed SCARI..
Model Natural PGD-CE PGD-KL PGD-Info
83.75
51.35
51.88
52.36
TRADES SCARL
82.76
52.73
52.33
53.97
80.57
54.22
53.81
54.75
3.3 ABLATION STUDIES
For ablation studies, all comparative experiments were performed on the CIFAR-10, and all other hyper-parameters were kept exactly the same other than the contrast variable used.
Ablation Different Techniques. We validate the two proposed techniques in SCARL, of which results are given in Table 4 From Table 4 we can observe significant performance gains by each technique. This confirms the merits of our proposed techniques.
Due space limitations, we show the visualization of CCA in the supplementary material.
8

---

Under review as a conference paper at ICLR 2023
TRADES SCAIL
50
-2
Accunn
8 3
Accuncy
10 1
SCARL
Accunnay
19
SCARL
50-
(8)
Epochs
Attock Budget
(c)
Attack Step
(d)
Batch Size
Figure 4: (a) is the test accuracy curves (under PGD-10). (b) and (c) is the test accuracy under PGD attack with different attack budgets and attack iterations, respectively. (d) is the test accuracy under different batch sizes. All these experiments were conducted on CIFAR-10.
Table 4: Impact of different techniques of our proposed method. Base indicates the model trained with equation [2]
Table The effect of different word embed-
ding.
Base indicates the model trained with
equation 12
Method
Natural
AutoAttack
Method
Natural
AutoAttack
Base
80.44
49.36
Base + Linfo
81.38
50.29
Base
80.44
49.36
Base + Latree
80.96
50,08
Random Embedding
79.69
48.87
Base Linfo + Catrue
80.57
50.42
NN Embedding
81.23
49.38
CLIP Embedding
80.38
50.04
Base + LinfoNCE
81.68
49.95
Glove Embedding
80.57
50.42
Base LisJoNCE Latrue
81.31
50.13
Comparison with InfoNCE. The proposed Linfo fo is similar to InfoNCE (Hjelm al.) 2018). In- foNCE is an alternative contrastive objective that selects a single positive out from a set of distractors via softmax function. We compare InfoNCE with Linfo when using the number of neg- atives. The Table 4 show that our Linfo outperforms InfoNCE. This confirms the merits of the proposed Linfo-
Effect of Semantic Embeddings. We use different word embedding to verify semantic information beneficial robustness. we design four embedding schemes: a) Random: a random vector as the semantic word vector; b) NN: word vector is generated by a learnable neural network embedded layer; c) CLIP: word vector generated by trained CLIP model; d) Glove: word vector gener- ated by trained Glove model. The results are shown in Table 5 semantic information, the higher the robustness.
It is observed that the stronger the
Effect of Batch Size. Theoretically, the proposed Linfo and InfoNCE can benefit from a large batch size. To evaluate the effect of batch sizes, we test six values of batch size and show the results in Figure d). For the standard adversarial training, as the mini-batch sizes get larger, the performance drops dramatically. This proves that adversarial training is not suitable for large batch sizes CIFAR-10. The other reason for the Linfo is not to benefit from large batch size is that, under a given dataset, the semantic words of the data category are fixed, when calculating Lin if using the large batch size, the negative samples in Linfo is still restricted by the number of semantic words.
4 CONLUSION
In this paper, we analyzed the relationship between semantic information and model robustness from a distribution and structural perspective. which shows the robustness of image representation is closely related to semantic information. Based our findings, we proposed Semantic Constraint Adversarial Robustness Learning (SCARL), which learns visual representation by capturing seman- tic word distribution and structure information. Experimentally, we demonstrated the effectiveness of the proposed SCARL in multiple benchmark datasets and revealed that semantic information could indeed improve model robustness.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Naveed Akhtar and Ajmal Mian. Threat of adversarial attacks on deep learning in computer vision: A survey. IEEE Access, 6:14410-14430, 2018.
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: a query-efficient black-box adversarial attack via random search. arXiv preprint arXiv:/9/2.00049 2019.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of security: Circumventing defenses to adversarial examples. In ICML, 2018.
Srinadh Bhojanapalli, Ayan Chakrabarti, Daniel Glasner, Daliang Li, Thomas Unterthiner, and An- dreas Veit. Understanding robustness of transformers for image classification. arXiv preprint 1rXiv:2103.14586, 2021.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In Symposium on Security and Privacy (SP), pp. 39-57, 2017.
Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C Duchi, and Percy S Liang. Unlaheled data improves adversarial robustness. In NeurlPS, pp. 11192-11203, 2019.
Emmanuele Chersoni, Enrico Santus, Chu-Ren Huang, and Alessandro Lenci. Decoding word em- beddings with brain-based semantic features. Computational Linguistics, 47(3):663-698, 2021.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In ICML,, 2020.
Francesco Croce, Maksym Andriushchenko, Vikash Schwag, Edoardo Debenedetti, Nicolas Flam- marion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: standardized adver- sarial robustness benchmark. arXiv preprint arXiv:2010.09670 2020.
Jiequan Cui, Shu Liu, Liwei Wang. and Jiaya Jia. Learnable boundary guided adversarial training. In ICCV, pp. 15721-15730, 2021.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In CVPR, pp. 248-255. Icce, 2009.
Guneet S Dhillon, Kamyar Azizzadenesheli, Zachary C Lipton, Jeremy Bernstein, Jean Kossaifi, Aran Khanna, and Anima Anandkumar. Stochastic activation pruning for robust adversarial de- fense. In ICLR, 2018.
Xinshuai Dong, Anh Tuan Luu, Min Lin, Shuicheng Yan, and Hanwang Zhang. How should pre- trained language models be fine-tuned towards adversarial robustness? NeurlPS, 34, 2021.
Zhe Gan, Yen-Chun Chen, Linjie Li, Chen Zhu, Yu Cheng, and Jingjing Liu. Large-scale adversarial training for iision-and-languaal representation learning. arXiv preprint arXiv:2006.061 2020.
Yoav Goldberg and Omer Levy. word2vec explained: deriving mikolov al.'s nagative-sampling word-embedding method. arXiv preprint arXiv:1402.3722 2014.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015.
Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03593, 2020.
Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens Van Der Maaten. Countering adversarial images using input transformations. In ICLR, 2018.
Minghao Guo, Yuzhe Yang, Rui Xu, Ziwei Liu, and Dahua Lin. When nas meets robustness: In search of robust architectures against adversarial attacks. In CVPR, pp. 631-640, 2020.
10

---

Under review as a conference paper at ICLR 2023
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. CVPR, pp. 770-778, 2016a.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In ECCV, pp. 430-645. Springer, 2016b.
Devon Hjelm, Alex Fedorov, Samuel Lavoie- Lavoic-Marchildor Karan Grewal, Phil Bachman, Adam Trischler, and Yoshua Bengio. Learning deep representations by mutual information estimation and maximization. arXiv preprint 1808: 2018.
Fred Hohman, Minsuk Kahng, Robert Pienta, and Duen Horng Chau. Visual analytics in deep learning: An interrogative survey for the next frontiers. IEEE transactions on visualization and computer graphics, 25(8):2674-266 2693, 2018.
Ramtin Hosseini, Xingyi Yang, and Pengtao Xie. Dsrna: Differentiable search of robust neural architectures. In CVPR, pp. 1196-6205, 2021.
Harold Hotelling. Relations between two sets of variates. In Breakthroughs in statistics, pp. 162- 190. Springer, 1992.
Lang Huang. Chao Zhang, and Hongyang Zhang. Self-adaptive training: beyond empirical risk minimization. In NeurIPS, 2020.
Andrew Hyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. In NeurlPS, pp. 125-136, 2019.
Xiaojun Jia, Yong Zhang, Baoyuan Wu, Ke Ma, Jue Wang, and Xiaochun Cao. Las-at: Adversarial training with learnable attack strategy. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 13398 13408, 2022.
Ziyu Jiang, Tianlong Chen, Ting Chen, and Zhangyang Wang. Robust pre-training by adversarial contrastive learning. In NeurlPS, 2020.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. Technical report, Citeseer, 2009.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks. In ICLR, 2018.
Chengzhi Mao, Ziyuan Zhong, Junfeng Yang, Carl Vondrick, and Baishakhi Ray. Metric learning for adversarial robustness. In NeurlPS, pp. 480-491, 2019.
Peter Hugoe Matthews and Peter Matthews. A short history of structural linguistics. University Press, 2001.
Cambridge
Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: simple and accurate method to fool deep neural networks. CVPR, pp. 2574-2582, 2016.
Tianyu Pang, Xiao Yang, Yinpeng Dong, Taufik Xu, Jun Zhu, and Hang Su. Boosting adversarial training with hypersphere embedding. In NeurlPS, 2020.
Tianyu Pang, Xiao Yang, Yinpeng Dong, Hang Su, and Jun Zhu. Bag of tricks for adversarial training. In ICLR, 2021.
Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami. The limitations of deep learning in adversarial settings. In European Symposium on Security and Privacy, pp. 377-387, 2016a.
Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as defense to adversarial perturbations against deep neural networks. In IEEE Symposium on Security and Privacy (SP), pp. 582-597, 2016b.
Jeffrey Pennington, Richard Socher, and Christopher D Manning. Glove: Global vectors for word representation. In EMNLP, pp. 1532-1543, 2014.

---

Under review as a conference paper at ICLR 2023
Ruizhi Qiao, Lingqiao Liu, Chunhua Shen, and Anton van den Hengel. Visually aligned word embeddings for improving zero-shot learning. arXiv preprint arXiv: 1TX.::1707.05227, 2017.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. arXiv preprint 1oXiv:2103300022 2021.
Aditi Raghunathan, Jacob Steinhardt, and Percy S Liang. Semidefinite relaxations for certifying robustness adversarial examples. NeurlPS, pp. 10877-10887, 2018.
Sylvestre-Alvise Rebuffi, Sven Gowal, Dan Calian, Florian Stimberg, Olivia Wiles, and Tim- othy Mann. Fixing data augmentation to improve adversarial robustness. arXiv preprint arXiv:2103.01946. 2021.
Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster r-cnm: Towards real-time object detection with region proposal networks. In NeurIPS, pp. 91-99, 2015.
Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in adversarially robust deep learning. In JCML, pp. 8093 8104. PMLR, 2020.
Alexander M. Rush, Sumit Chopra, and Jason Weston. neural attention model for abstractive sentence summarization. EMNLP, 2015. doi: 10118653/1//11514444 URL http:////ddx 18653/v 1044
Hadi Salman, Jerry Li, Ilya Razenshteyn, Pengchuan Zhang, Huan Zhang, Sebastien Bubeck, and Greg Yang. Provably robust deep learning via adversarially trained smoothed classifiers. In NeurlPS, pp. 11289-11300, 2019.
Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense- gan:: Protecting classifiers against adversarial attacks using generative models. In ICLR, 2018.
Thijs Scheepers. Improving the compositionality of word embeddings. Master's thesis, Universiteit van Amsterdam, Science Park 904, Amsterdam, Netherlands, 11 2017.
Chuanbiao Song, Kun He, Liwei Wang, and John E Hopcroft. Improving the generalization of adversarial training with domain adaptation. In ICLR, 2019.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In ICLR, 2014.
Duyu Tang, Furu Wei, Nan Yang, Ming Zhou, Ting Liu, and Bing Qin. Learning sentiment-specific word embedding for twitter sentiment classification. In ACL, pp. 1555-1565, 2014.
Yonglong Tian, Dilip Krishnan, and Phillip Isola. Contrastive representation distillation. In ICLR, 2020.
Wenhui Wang, Hangbo Bao, Li Dong, Johan Bjorck, Zhiliang Peng, Qiang Liu, Kriti Aggarwal, Owais Khan Mohammed, Saksham Singhal, Subhojit Som, et al. Image as a foreign language: Beit pretraining for all vision and lasion-language tasks. arXiv preprint arXi 10442, 2022.
Xiaolong Wang, Yufei Ye, and Abhinav Gupta. Zero-shot recognition via semantic embeddings and knowledge graphs. CVPR, pp. 6857-6866, 2018.
Eric Wong, Leslie Rice, and Zico Kolter. Fast better than free: Revisiting adversarial training. In ICLR, 2020.
Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust gener- alization. In NewrIPS, 2020.
Yuzhe Yang, Guo Zhang, Dina Katabi, and Zhi Xu. Me-net: Towards effective adversarial robustness with matrix estimation. In ICML, 2019.
Jiahui Yu, Zirui Wang, Vijay Vasudevan, Legg Yeung, Mojtaba Seyedhosseini, and Yonghui Wu. Coca: Contrastive captioners are image-text foundation models. arXiv preprint arXiv:2205.019177 2022.
12

---

Under review as a conference paper at ICLR 2023
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In BMVC, 2016.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML, 2019.
Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama. and Mohan Kankan- halli. Attacks which do kill training make adversarial learning stronger. ICML, pp. 11278- 11287. PMLR, 2020.
Tianyuan Zhang and Zhanxing Zhu. Interpreting adversarially trained convolutional neural net- works. ICML, pp. 7502-7511, PMLR, 2019.
13

---

Under review as a conference paper at ICLR 2023
A
THE PROOF OF LEMMA 2.1
Lemma 2.1
Given
and incongruent pairs which is sampled i.i.d. from the distribution pD v, s Fo(x)
congruent pair {I, 2, ylC, 1 =)
{2,, 24, Vk Cy.
0)
11==1
and = (z( I( Y) is lower bounded by
(9.())9x 90//
(.)
Linnf (B(( ca.to)'st0// +c
(16)
where c is the cardinality of the dataset and r a temperature that adjusts the concentration level. Os and Sr are nonlinear projection heads to transform the representation into the same manifold space and further normalize by L2-norm.
Proof. For deriving the lower bound, we define the mutual information containing the joint distribu- tion p(S, T') and the product of marginal distributions p(S) Therefore, mutual information between visual representation and word vector via optimizing KL-divergence between these distributions. To this end, we define distribution 9 with the latent variable Cy- When Cy = 1, the pair (S, have the same one-hot label, which is drawn from the joint distribu- tion. On the contrary, when and T have different one-hot labels (Cy = 0), the pair is independent of each other, which is drawn from the product of marginal. As result, the formulations can be written as:
maximize the
C|y = =1)==($,7T)) (S, Cyy = =0 >))((()))((TT)))
(17)
Suppose that, there are congruent pair, which is drawn from the joint distribution, and N incon- gruent pairs, which are drawn from the product of marginal. We can define the priors on the latent C' are:
1 qOy = - N' g(Cr 0) I+N By using Bayes' rule, the posterior for class Cy=1 is:
N
(18)
1)q(Cy =) <(y 1[S,T) a(5, ((S, (0 +) (S TIy = 1) =)
D(S,T(Y)
(19)
(S,TTY) + (Np(S)))((((T)
Then, bridge a connection with mutual information
PS T|Y)
log = -|S,T 7) = -log p(S, + (P(SIY)P(TIY))
log (1 + N+NN PSSYIP(TIT
(20)
P(S,TIY)
D(S,TIY)
S - log N + log
p(S[Y)p(T(T))
Taking expectation on both sides w.r.. p(S,T\Y and rearranging, we have:
((STTYY) 2 log (B((S (Cy 1)S,T),
(21)
where I(S:T\Y) is the conditional mutual information between the distribution of vi- sual representations and word vectors under the same one-hot label. Thus, maximizing B. log (Cy = 1|S, T) w.e.t the parameters of the objective model increase lower bound on mutual information. However, it is intractable to directly optimize such lower bound since we do not know the true distribution qCy = 1|S,T) T). To achieve a tractable objective, We introduce the following Lemma:
In equation 21 maximizing EG(S.TICy=1) log (Cy 1|S,T) w.z.. the parameters of the objec- tive model to increase lower bound mutual information. However, it is intractable to di- rectly optimize such a lower bound since we do not know the true distribution qCy 1|S, Thus, estimate it by fitting model h (8,
[0. 1] to samples from the data distribution
14

---

Under review as a conference paper at ICLR 2023
(Cy = 1|S, T).. We maximize the log- log-likelihood of the data under this model (a binary classifica- tion problem):
(h) = (Q(SST(Cr=1) [log ((5, T)] + (T [log (1 - A(S,T)))
(22)
h- arg max Lest (h)
(23)
h
According to Gibbs' inequality, we have:
(Cy = 1[5 = = arg max Last (h).
(24)
The details of equation 24 be found in Appendix B Thus, we can rewrite equation 21 in terms of ht:
T(S: log N + B
(25)
The optimal h" is an estimator whose expectation lower-bounds mutual information. Our goal is learn model Fe that maximizes the mutual information between visual representations and corresponding semantic word vectors. As result, we have the following optimization problem:
Fe arg max (ot(S./CC==1) [log h (5,
(26)
However, this is still difficult to optimize, since the estimator h* depends on the current model Fo- To hand this problem, we further relax the bound in equation 25 to:
I(S:TYY) 2 log N + (q(STT(Cr=1) [log h" (S, + N ([ [log (1 - (S,))))
= log N + Lese(h") = log N + max (e)((h)
(27)
2 log N + (h).
Since the (Cy log (1 h (s, is strictly negative, the inequality still holds by adding such term into equation 26 follows:
Then, optimizing equation 27 w.E.t. the Fg can be reformulated as
Fe = arg max max (h)
(28)
arg max max (En(s.Ticy=)) h
[log (S, (E.((CC)) Dlog ((S,T))))
At last, equation 28 is our final learning objective, which jointly optimizes Fg together with learning
h. Note that, due to equation 27] Fg = arg max, max, (h), for any h, is always the lower bound the mutual information, which means our objective equation 28 does not depend h being optimized perfectly. Therefore, we define h with any family of functions that satisfy h (S,T) - [0, 1]. In practice, we define the h as follows:
((S
(29)
(3 +
where c is the cardinality of the dataset and is a temperature that adjusts the concentration level. 9. and St are nonlinear projection heads to transform the representation into the same manifold space and further normalize by L2-norm. Therefore, [(; Y) is lower bounded by (t))
(s.(5' (t)/T
-Linfo Eg(s.ricy==)]oo (log e9-(4) +
+ (o (3) +
(30)
B THE PROOF OF EQUATION 24
Proof. In equation 24 the first item q(C = 1|5, T) presents the true distribution of the data that from the same one-hot label, where C. is binary variable judge whether the label is correct. Therefore, it is intuitive that the ((C),, T") can be modeled as a Bernoulli distribution, such as h: () - [0, 1]. For convenience, we define h'(S,T, 1) h(S,T) and h'S,T,CC=)) 1 - b(S, T), then the log-likelihood is:
FEET(CI).T) Moggh((STT,C
(31)
15

---

Under review as a conference paper at ICLR 2023
By using Gibbs' inequality, the max likelihood fit is h' q(C c|S, T), which also implies that T) = q(C = 1)S.T).
Then, rewrite objective in equation 22 follows:
(,, [ lo s, C,
(32)
(....ta((..s.T)) (S s, -, -=, = =c]
(33)
(e,ee((//(C=))((==)) loog h(5 s, t)] + - E=:ee((S/7(-=00((((0))) log h(S s, t)]
(34)
N
E. BeddewSSTTCcnn/blgg( 8, = 1]+ +1
N R. (e 1(5 8, = 1) (35)
Notice that equation 35 proportional to equation 22 from the Appendix A For sufficiently ex- pressive h. then, each term inside the expectation in equation 32 can be maximized, resulting in h" = s, =) qC 1|s s, T,T = t) for all and
C PERFORMANCE UNDER WIDERESNET
Many works have demonstrated larger model capacity can usually lead to better adversarial ro- bustness (Madry al. 2018 Gowal et al. 2020 Pang et al.] (021). Therefore, employ the large-capacity network, e.g., Wide ResNet Zagoruyko & Komodakis 2016). Table 6 reports the best test robustness against AA the CIFAR-10. We compare several state-of-the-an adversarial trained models on robust benchmark (Croce et al. 2020). our SCARL achieves 54.65% % and 56.42%
with AWP respectively, which makes the trained model surpass the previously state-of-the-art mod- els reported by the benchmark. where every small margin of improvement is significant. Notes, our experiments did not use additional datasets.
Table 6: Robustness accuracy comparison of the proposed approach and several state-of-the-ard models under AA at foo norm with 8/255 on CIFAR-10. 10. Most of the results are directly copied from the leaderboards (Croce Hein 2020 indicates the model is re-produced by ourselves.
Method
Architecture
Nat.
AA
TRADES Zhang 2019
WideResNet-34- 10
84.92
53.08
Overfitting (Rice et al.
(1MM22C22))0
WideResNNe-34410
85.18
53.14
SAT (Huang ct al. 2020 2020NNNer))S22200
WideResNett34-10
83,48
53.34
Overlitting (Rice et al.
2020)1CMM12000)
WideResNNet34-20
85.35
53.42
LBGAT (Cui 2020XICCML2200)
FAT Zhang et al.
WideResNee-34-10
84.52
53.51
2021
(ICCV2021)
WideResNNe-34-20
88.70
$3.57
HE
(Pang al.
(NeurrP22)))
WideResNNet34420
85.14
53.74
Bag of Tricks (Pang CVPR2022)
2021
(ICLR2021)
11deResNNet344100
86.28
53.84
LAS-AT Jia et al. (2022
WideRessNeL34-100
85.24
54.13
Bag of Tricks (Pang al.
2021
(ICLR2021)
WideResNNet33-200
86.43
54.39
SCARL (Ours)
WideResNNet344110
84.33
54.65
TRADES AWP Wu (000
WideResNee-34-10
85.26
56.17
LAS-AT + AWP Jia all
2022
(CVPR2022)
WideResNNet34-110
84.98
56.26
SCARL AWP
WideResNeu.34-10
84.70
56.42
16

---

Under review as a conference paper at ICLR 2023
D VISUALIZATION OF CCA
We calculate the CCA of our SCARL, which is shown in Figure 5 It is observed that the visual representations learned by SCARL are more semantic information than standard adversarial training (AT) Madry et al. (2018).
CCA- -..4
CCA-053
CCA 0,79
CCA 0.84
Vistel Reproscraatin
Voand seppeccttaiiee
Semrrticc Word Vesto
Semontic Wood Vezter
Semantic Word Vector (c) image under
Semantic Word Vector
Nat. image under Nat model
(b) image under Nat. model
image under SCARL
The canonical correlation analysis (CCA) of the natural and adversarial image with the semantic words under the non-robust and robust model, respectively. In each plot, we sample 500 image-words pairs to calculate the correlation coefficient. The larger the CCA, the stronger the correlation between the visual representation and semantic word vector.
Figure 5:
RELATED WORK
The problem of adversarial examples was first studied in (Szegedy et al.] 2014). Then, many works proposed series of adversarial attack methods (Moosavi-Dezfoolli et al.] 2016 Papernot et al.) 2016a Carlini & Wagner] 2017 Croce Hein (020), which puts severe limitations on the applica- tion of deep learning in security-critical scenarios. With the rapid development of attack methods, considerable efforts have been devoted defending against adversarial attacks, such as defensive distillation (Papernot et al. 2016b). manifold-projection (Samangouei et al. (2018), pre-processing (Guo et al. 2018 Yang et al. 2019). verification and provable defences (Raghunathan et al. 2018
Salman al.[ 2019), and Ad Training (Madry et al., 2018 Zhang et al.J 2019)) Among them, adversarial training has been demonstrated to be a practical approach for strengthening the
robustness of deep neural networks (Athalye al., 2018). Adversarial training involves the min- max optimization problem as Eq. equation []] The inner maximization can be solved approximately, using FGSM or PGD attack. The outer minimization can be achieved by minimizing cross-entropy loss instead. Based on that, a number of new adversarial training methods have also been devoted from different aspects including designing new adversarial regularization (Zhang al,, 2019 Mao et a0.190 robustness architecture search (Guo al.) 2020 Hosseini et 2202 training strategy (Wong et al.) 2020 Pang et al. 2021) and data augmentation (Carmon et al. 2019 Rebuffi et al.) 2021). To the best of our knowledge, we are the first to explore the impact of semantic information for adversarial training.
17

---

Under review as a conference paper at ICLR 2023
F MORE ABLATION RESUTLS
F.1 COMPARISON WITH TRADES WITH DIFFERENT SETTINGS
combined the semantic information (SemInfo) with TRADES, the balance parameter / and 6. The results are shown above. We can see the robustness can be further improved.
Table 7: Robustness accuracy comparison
Method
FGSM
AutoAttack
Adv. training
83.14
47.56
Adv. training + ScmInfo
82.72
48.81
TRADES (3 = 1)
87.49
44.80
TRADES (3 1) SemInfo
86.88
45.21
TRADES (3 6)
82.76
49.34
TRADES (3 6) SemInfo
82.22
49.72
F.2 IMPACT OF THE WORD EMBEDDING MODELS
We provide the results obtained by training several different word embedding models, as shown in the following table: We that different word embedding models improve the robustness of the model.
Table 8: Different Glove model
Method
Natural
AutoAttack
Random Emhedding
79.69
48.87
CLIP
80.38
50.04
Glove (Twiter)
80.71
50.12
Glove (Common Craw)
81.06
50.25
Glove (Wikipedia 2014 and Gigaword)
80.57
50.42
18


Reviews:
[{"review_id": "rDi19kNH-P", "reviewer": "Reviewer_FuyA", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The authors propose to improve the adversarial robustness of image classification models by adding constraints between visual representations and semantic word vectors. The authors first demonstrate the correlation between visual representations and semantic word vectors and how robust features are aligned with semantic word vectors. Then they propose an adversarial framework (SCARL) to learn robust visual representations through regularizing the structure of visual representations and that of semantic word vectors. As the result, the authors demonstrate the proposed framework improves the model's robustness compared to current approaches.\n", "summary_of_the_review": "See above. ", "strength_and_weaknesses": "Strength: \n1. The intuition and analysis of the correlation between robust visual representations and semantic word vectors are interesting and meaningful. This opens another lens for understanding the adversarial robustness of vision models and robustness of visual representations.\n2. The paper is well-written and the proposed methods are clearly formulated.\n3. The theoretical analysis for the lower bound is helpful. But some comparisons between the results w/ and w/o utilizing this estimated lower bound would be appreciated.\nWeakness: \n1. The similarity analysis in Figure 2 is not well interpreted. How such similarity metrics are normalized is crucial for interpreting the results.\n2. The claim in caption of Figure 1 that FGSM is always less robust than standard AT lacks supporting evidences.\n3. Comparison with existing methods can be improved. Some of the existing methods can trade off accuracy over robustness (.e.g. TRADES). It might be fairer if the authors also include results of TRADES with different settings.\n4. There is a significant performance gap on natural accuracy of models trained with SCARL in CIFAR-10. That is an interesting phenomenon that might be due to limited richness of semantic information in the visual representations. The authors should discuss more on this and other potential limitations.\n\nSome minor things:\nP3: nor-robust -> non-robust\nFig 2,3 visible margins of the images. They are also redundant in the appendix.\nOther suggestions:\n\tThere is a line of research exploring how semantic word vectors improve the generalization/robustness of the vision models [1] might also be related. Some discussion of differences and future directions would be interesting.\n\n[1] Grounded Language-Image Pre-training\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "JJcF2Co1JdN", "reviewer": "Reviewer_Xby6", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes to utilize semantic information for defending against adversarial attacks. The motivation seems interesting. ", "summary_of_the_review": "The motivation for applying semantic information in defending adversarial attacks seems interesting. However, the effectiveness of the proposed method is not well justified.", "strength_and_weaknesses": "Strengths:\n- The motivation for applying semantic information in defending against adversarial attacks seems interesting.\n\nWeaknesses:\n- There lacks the SOTA defending models in comparison, such as [A],[B]. The performance gain looks limited compared to the comparison methods (not the latest ones).\n- It is not clear how these semantic features come.\n\n[A] “Learnable boundary guided adversarial training.” CVPR 2021.\n[B] “Adversarial feature desensitization.” NeurIPS, 2021.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "5A7yS03BpK7", "reviewer": "Reviewer_ARcW", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a new adversarial training scheme that leverages the semantic information from language embeddings to improve the robustness of the model to adversarial attacks. The proposed method is evaluated against various adversarial attacks and compared to multiple methods, showing competitive results.", "summary_of_the_review": "This paper proposed a novel adversarial training method that enforces the alignment between the visual feature and the label semantics from a pretrained word embedding to improve the robustness of adversarial attacks. It shows some potential, but I am not very convinced by the results, considering it requires much more resources than other methods that do not rely on external information. Therefore I am more inclined to rejection.\n", "strength_and_weaknesses": "Strengths:\n1. The paper is well organized. The writing is clear, and it is very easy to follow.\n2. The idea of maintaining the semantic information of the class labels during adversarial training is sound.\n3. The proposed method is evaluated on benchmark datasets with various adversarial attacks. The performance is generally competitive compared to prior arts. It also conducts extensive ablative studies on the components of the method.\n4. The paper provides clear details on reproducing the method.\n\nWeakness:\n1. The improvements over previous methods are not convincing enough. The margins are small, especially considering that the proposed method requires more information, i.e., a pretrained word embedding. This might require more resources in real-world applications than other methods, making it less attractive.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject