AutoLoRa: An Automated Robust Fine-Tuning Framework
Authors: Xilie Xu
Jingfeng Zhang
Mohan Kankanhalli
Venue: ICLR 2024 poster (2024)
Keywords: robust fine-tuning
adversarial robustness
Primary area: societal considerations including fairness, safety, privacy

Abstract: Robust Fine-Tuning (RFT) is a low-cost strategy to obtain adversarial robustness in downstream applications, without requiring a lot of computational resources and collecting significant amounts of data. This paper uncovers an issue with the existing RFT, 
where optimizing both adversarial and natural objectives through the feature extractor (FE) yields significantly divergent gradient directions. This divergence introduces instability in the optimization process, thereby hindering the attainment of adversarial robustness and rendering RFT highly sensitive to hyperparameters. To mitigate this issue, we propose a low-rank (LoRa) branch that disentangles RFT into two distinct components: optimizing natural objectives via the LoRa branch and adversarial objectives via the FE. Besides, we introduce heuristic strategies for automating the scheduling of the learning rate and the scalars of loss terms. Extensive empirical evaluations demonstrate that our proposed automated RFT disentangled via the LoRa branch (AutoLoRa) achieves new state-of-the-art results across a range of downstream tasks. AutoLoRa holds significant practical utility, as it automatically converts a pre-trained FE into an adversarially robust model for downstream tasks without the need for searching hyperparameters. Our source code is available at [the GitHub](https://github.com/GodXuxilie/RobustSSL_Benchmark/tree/main/Finetuning_Methods/AutoLoRa).

Published as a conference paper at ICLR 2024
AUTOLORA: AN AUTOMATED ROBUST FINE-TUNING FRAMEWORK
Xilie Xu' Jingfeng Zhang Mohan Kankanhalli'
School of Computing, National University of Singapore
2 School of Computer Science, The University Auckland
RIKEN Center for Advanced Intelligence Project (AIP)
Xux lie, mohan) comp. nus. edu. sg, jingfeng. zhangdauckland ac..n
ABSTRACT
Robust Fine-Tuning (RFT) is low-cost strategy to obtain adversarial robustness in downstream applications, without requiring a lot of computational resources and collecting significant amounts of data. This paper uncovers an issue with the existing RFT, where optimizing both adversarial and natural objectives through the feature extractor (FE) yields significantly divergent gradient directions. This divergence introduces instability in the optimization process, thereby hindering the attainment of adversarial robustness and rendering RFT highly sensitive hyperparameters. To mitigate this issuc, we propose a low-rank (LoRa) branch that disentangles RFT into two distinct components: optimizing natural objec- tives via the LoRa branch and adversarial objectives via the FE. Besides, we in- troduce heuristic strategies for automating the scheduling of the learning rate and the scalars of loss terms. Extensive empirical evaluations demonstrate that our proposed automated RFT disentangled via the LoRa branch (AutoLoRa) achieves new state-of- tr--the-rt results across a range of downstream tasks. AutoLoRa holds sigmificant practical utility, as it automatically converts a pre-trained FE into an adversarially robust model for downstream tasks without the need for searching hyperparameters. Our source code is available the GitHub.
INTRODUCTION
With the emergence of foundation models (Bommasani al., 2021). fine-tuning the pre-trained feature extractor (FE) has become a low-cost strategy to obtain superior performance in downstream tasks. Notably, GPT-3 (Brown al., 2020) can achieve state-of-the-ar (SOTA) performance on
GLUE benchmarks (Wang et al. 2018) via parameter-efffiient fine-tuning (Hu et al.] (021). Due the ubiquitous existence of adversarial attacks (Goodfellow al. 2014: Madry et al. [0018] Xu
ct al. 2022), adopting pre-trained FEs to safety-critical downstream areas such as medicine (Buch al. 2018) and autonomous cars (Kurakin
2018) necessitates the strategy of robust fine-
tuning (Hendrycks et al.) 2019) that can yield adversarial robustness in downstream applications.
Robust fine-tuning (RFT) (Hendryeks al.) 2019) that contains an adversarial objective learn features of adversarial data (Madry et al.] 2018) can gain adversarial robustness in downstream tasks. To further improve generalization, vanilla RFT (formulated in Eq. [ shown in the left panel of Figure Ich optimizes both adversarial and natural objectives to learn the features of adversarial and natural data simultaneously via the FE (Zhang et al., 2019: Shafahi et al., 2019 Jiang et al. 2020). Recently, TWINS (Liu et al.) (023) (formulated in Eq. further enhances performance in downstream tasks by incorporating vanilla RFT with a dual batch normalization (BN) (Xie et al, 2020 Wang et al.) (2020) module. TWINS takes advantage of extra information from the pre- trained FE (i.e., pre-trained statistics in a frozen BN) via the dual BN module, thus improving performance.
However, empirically find that vanilla RFT and TWINS have common issue, where optimizing both adversarial and natural objectives via the FE leads to significantly divergent gradient directions. As shown in Figure la the cosine similarity between the gradient of natural and adversarial objective
Corresponding author.

---

Published as a conference paper at ICLR 2024
Vanilla RFT
AutoLoRa (ours)
-0.30
1971-577
Voucila SPT TIKINS
Adversarial obj.
Natural obj
Adversarial obj.
Natural obj
B
68
-0
Adversarially
-0.50
Adversarialty pre-trained FE
pre-trained feature extractor (FE)
10
10
(0
Epodhe
(a) Gradient similarity.
DTD-57
Bebous Test Accunny (8)
25-
2o-
15.
Vasilla
20.
TWINS
Astolaats (oan)
Forwarding path:
Farwarding pati of advensatal data
linction
function
of data
Epocis
(c) Left panel: Vanilla RFT. Right panel: Our proposed automated RFT disentangled via a low-rank branch (out) The yellow module is the LoRa branch. Scalars 8, A1, A2 serve reweighting loss terms.
(b) Adversarial robustness.
Figure 1: Figure la shows the cosine similarity between the gradients of natural and adversarial objective w.r.t. the feature extractor (FE) (dubbed as gradient similarity) on DTD-57 (Cimpoi et al. 2014). Figure shows the robust test accuracy evaluated via PGD-10 10 DTD-57. Extra empirical results are shown in Figures [2 and 2b (Appendix [B.I). Figure Ic shows the framework vanilla
RFT that learns both adversarial and natural data via the FE while our proposed AutoLoRa learns adversarial and natural data via the FE and the LoRa branch, respectively.
w.r.t. the FE, dubbed as gradient similarity, achieved by vanilla RFT (blue lines) and TWINS (green lines) is very low. It indicates that optimizing both natural and adversarial objectives through the FE can result in a divergent and even conficcing optimization direction.
The divergent optimization directions make the optimization process of RFT unstable, thus impeding obtaining robustness in downstream tasks and making RFT sensitive to hyperparameters. Compared to TWINS, vanilla RFT has a lower gradient similarity (in Figure Tab while gaining lower robust test accuracy (in Figure [b). It indicates that the issue of divergent optimization direction could prevent gaining adversarial robustness in downstream tasks. TWINS tackles this issue to some extent via the dual BN module while gaining only slightly improved robustness. Thus, we conjecture that mitigating the aforementioned issue can further enhance adversarial robustness.
To this end, we propose to disentangle RFT via a low-rank (LoRa) branch (Hu et al. 202T) (details in Section 1. As shown in the right panel of Figure Ic disentangle the RFT by forwarding adversarial and natural data through the FE (blue module) and the LoRa branch (yellow module), respectively. In this way, the FE parameters features of adversarial data, which exactly solves the aforementioned issue of the divergent optimiza- tion direction. Besides, the FE also learns the knowledge of the natural objective via minimizing the Kullback-Leibler (KL) loss between adversarial logits and natural soft labels provided by the LoRa branch avoid degrading generalization. Therefore, benefiting from the parameter-efficient LoRa branch, RFT disentangled via LoRa branch can be low-cost strategy to further improve adversarial robustness while maintaining generalization.
updated only by the adversarial objective learn the
Moreover, we propose heuristic strategies of automatically scheduling the learning rate (LR) as well as the scalars Å₁ and A2 (details Section 4.2.. Lin et al. (2019) analogized the generation process of adversarial data to the training process of the neural model. It motivates us to employ the automatic step size scheduler in AutoAttack (Croce & Hein 2020), which is proven to enhance the convergence of adversarial attacks, for scheduling the LR, thus helping the convergence of RFT. Inspired by graduated optimization (Hazan et al. 2016 Hulse et al. (2019), we take \ and Ag to be negatively and positively proportional to the standard accuracy of natural training data, respectively. In this way, our proposed scheduler will enforce the model to first focus on solving the natural objective which is simplified optimization problem and then tackling the difficult optimization
2

---

Published as a conference paper at ICLR 2024
problem of the adversarial objective. Therefore, automated scheduler of the scalars utilizes graduated optimization to improve robustness.
Our comprehensive experimental results validate that our proposed automated robust fine-tuning disentangled via a LoRa branch (AutoLoRa) is effective in improving adversarial robustness among various downstream tasks. We conducted experiments using different robust mee-traneed models
(ResNet-18 and ResNet-50 adversarially pre-trained on ImageNet-IK, (Salman et al.) (0200) and both low-resolution (Krizhevsky 2009) and high-resolution (Cimpoi et al.] 2014 Khosla et al., 2011 Wah et al., 2011] Grittin et al.) (007) downstream tasks. Empirical results validate that our proposed AutoLoRa can consistently yield new state-of-the-aa adversarial robustness performance
without tunning hyperparameters compared to TWINS (Liu et al. 2023).
2 RELATED WORK
Here, we introduce the related work of fine-tuning and robust fine-tuning.
Fine-tuning. With recent advances in self-supervised pre-training (Chen al.] 2020a b), fine- tuning foundation models via self-supervision on large-scale unlabelled datasets can efficiently achieve powerful performance downstream tasks. As the number of parameters of pre-traine trained FE grows significantly. it requires the parameter-efficiet fine-tuning (PEFT) strategy that decreases the trainable parameters during fine-tuning. One popular strategy to introduce an adapter layer during fine-tuning (Houlsby et al.) 2019 Lin et al. (020);; however, it brings extra inference latency. Recent studies propose to freeze the pre-trained FE parameters and inject trainable decomposition matrices that are low-rank and thus parameter-efficient (Hu et al., [021]] Chavan et al. (023). No- tably, only fine-tuning low-rank matrices for GPT-3 (Brown et al., 2020 can achieve the SOTA performance GLUE benchmarks (Wang et al. 2018) without incurring inference latency (Hu
et al. 2021 Chavan et al. 2023).
Robust fine-tuning (RFT). RFT Shaffhi et al., 2019 Hendrycks et al. 2019) is low-cost strat- egy to obtain adversarially robust models in downstream tasks by fine-tuning the pre-trained FEs on adversarial training data (Madry et al. 2018 Zhang et al. 2020 2021 Chen et al.
2022). To further
improve generalization in downstream tasks, recent studies propose learn the features of natural and adversarial data together (i.e., vanilla RFT) (Zhang et al. 2019 (Saaahi et al.
(019). Note that
vanilla RFT has been widely applied to fine-tuning adversarially self-supervised pre-trained mod- els (Jiang et al., 2020 Fan et al. 2021] /Zhang et al. 2022 Yu et al. [2022] Xu et al. 2023b and achieved powerful robustness in downstream tasks. Furthermore, various strategies about how to utilize extra information from the pre-trained FEs for improving performance have been proposed. Liu et al. 2022) proposed to jointly fine-tune on extra training data selected from the pre-training datasets and the whole downstream datasets to further improve RFT. TWINS (Liu al. (223) is the existing SOTA RFT method that incorporates vanilla RFT with a dual BN framework (Xie et al.]
2020). TWINS uses the dual BN framework to take advantage of the pre-trained statistics in frozen BN branch, which is the extra useful information of the pre-trained FEs, thus resulting in superior performance.
A CLOSER LOOK AT VANILLA RFT AND TWINS
In this section, we first introduce preliminaries of vanilla RFT (Zhang et al. 2019: Jiang et al. 2020) and TWINS (Liu et al. 2023). Then, we empirically disclose the issues of vanilla RFT and TWINS.
3.1 PRELIMINARIES
Let d2)) be the input space X' with the infinity distance metric d.e (x, x') || x llcc. and B. [n] = {a' E X' (x, x²) S <) be the closed ball of radius > centered at x E X. also denoted as adversarial budget. Let D = {x,, y:) } be a downstream dataset, where 2; E Rd d the dimensionality of the input data, and y; E y {0, I,..., C - 1} is the ground-truth label. Let fe, _dd + RR be a pre-trained feature extractor parameterized by 0₁ E dRdxv where is the dimensionality of the hidden features, 90, IR" + R be a aundoll--nitializen linear classifier parameterized by 02 E Rexz where 2 |}]| is the dimensionality of the predicted logits. For notational simplicity, we denote ho(.) (.)) = ge, o fo, (-) where = 02).
3

---

Published as a conference paper at ICLR 2024
Vanilla RFT (Zhang et al. 2019).
The training loss of vanilla RFT is formulated as follows:
Cvanilla Cvanill(D;,,3))
Σ (x.N)E
(cE((o())).)) +B 6KT. (1) ho(x))
(I)
natural objective adversarial objective
scalar of the adversarial objective, (cB(.,) is the Cross-Entropy (CE) loss func- tion, (xI(-,) is the Kullback-Leibler (KL) loss function, and ă is the adversarial data generated via projected gradient descent (PGD) (aadry et al.) 2018). Natural and adversarial objectives are used to learn the features of natural and adversarial data, respectively. In our paper, follow- ing Liu et al. (202)) the adversarial data i is generated by maximizing the CE loss using PGD, i.e.,
where B
arg 26B. [o] fC (T)( v).
TWINS (Liu et al. 2023). TWINS proposed to combine vanilla RFT with dual BN (Xie al. 2020 framework to take advantage of pre-trained statistics, whose loss function is shown below:
CTWINs 0,0,8,7) Lvaiilla (D; 0,30,) + + Eranilla (D; D; 0, (3)
where > and 7 0 are hyperparameters. During conducting TWINS, all the parameters of 0 are adaptively updated; the BN statistics of 0 are frozen as the pre-trained statistics and other parameters except for BN statistics of 0 are copied from 0. Note that the adversarial data & is generated according to the parameters 9 via PGD.
3.2 ISSUES OF VANILLA RFT AND TWINS
We empirically discover vanilla RFT and TWINS have the issue of the optimization directions of minimizing both adversarial and natural objectives being significantly divergent. This issue can make the optimization unstable, thus impeding obtaining robustness and making RFT sensitive to hyperparameters. To validate the aforementioned issue, we calculate the gradient similarity (GS) as the cosine similarity between the gradient of the natural objective and that of the adversarial objective w.r.t. the FE parameters. To be specific, given a data point (2., E D, the GS of vanilla RFT and TWINS w.r.t. the FE (i.e., 01) are calculated as follows:
GSvanila y5 1,, B) sim Vo, (h)))(())))))))))))))))))))))))) v). Ve, (ho ha (a())));
(3)
GSTWINS y. 0, -sim Ve, (fCrc(hcaaaa) v) + (ce(ho(x)) v)),
Ve, (ha ha (x)) LKT. (ho (i), ha)))))))))))))))))))))))))))))) ha())))
(4)
where sim(:;) is the cosine similarity function. The smaller the GS is, the more divergent the gradient direction of optimizing natural and adversarial adversarial is. We report the average GS over all training data of vanilla RFT (blue lines) and TWINS (green lines) on DTD-57 (Cimpoi
jet al. 2014) in Figure Ta as well as extensive datasets (Cimpoi et al. 2014 Wah et al. 2011 in
Figure 2a (in Appendix B.1 Noticed from Figures la and 2a we can observe the GS achieved by vanilla RFT and TWINS is quite low, which indicates that optimizing both natural and adversarial objectives via the FE can make the optimization direction orthogonal and even conflicting, thus leading to optimization oscillation. As shown in Figures and [i compared to TWINS, vanilla RFT yields worse adversarial robustness in downstream tasks while achieving a lower GS. It indicates that the divergent optimization direction can lead to a lower robust test accuracy, which impedes obtaining adversarial robustness.
Besides, the issue of unstable optimization makes vanilla RFT and TWINS sensitive to hyperpa- rameters. In Appendix [B.2] we empirically validate that vanilla RFT and TWINS are sensitive to hyperparameters such as the learning rate. To achieve superior performance in downstream tasks, the authors of TWINS (Liu et al.) (2023) conducted grid search to find appropriate hyperparameters for each downstream task, which is extremely time-consuming and inconvenient for practical usage.
AUTOLORA: AUTOMATED RFT DISENTANGLED VIA A LOW-RANK BRANCH
To mitigate the aforementioned issue, we propose to disentangle RFT via low-rank branch and then introduce heuristic strategies for automating scheduling hyperparameters.
4

---

Published as a conference paper at ICLR 2024
4.1 DISENTANGLING RFT VIA A LOW-RANK BRANCH
To resolve the issue caused by optimizing both adversarial and natural objectives via the FE, we propose to leverage an auxiliary branch to disentangle the optimization procedure of natural and adversarial objectives. Inspired by PEFT (Hu et al. 2021 Chavan et al. 2023), introduce a low- rank (LoRa) branch as an auxiliary parameter-efficicn branch composed of two rank decomposition matrices B E TRdx and A "aa x where Inat N is the rank, d and are the dimensionality of the input data and hidden features, respectively. Therefore, BA E Rdxv has the same size as the parameters of the FE (i.e., 01 E Rdxx).
To disentangle the RFT, we propose to optimize the natural and adversarial objectives via the LoRa branch and the FE, respectively. Thus, formulate the loss function of the RFT disentangled via the LoRa branch as follows:
LOMBa (D:0, A, B, X1, )2)
1
Σ
A1 lee
n (R.g)ED
natural objective
(1 X1) (cr(ho (T))) A2 (xI (10
(5)
adversarial objective
where A 2 and 22 2 are the scalars, 02) denotes all the trainable parameters com- posed of the FE parameters 01 and the classifier parameters 0z. and 01 denotes that the parameters 0 do not require gradients.
According to Eq. [] RFT disentangled via the LoRa branch can separate the optimization procedure of adversarial and natural objectives. Thus, disentangled RFT will update the FE parameters 01 only by minimizing the adversarial objective that aims to learn the features of adversarial data; whereas, the gradient incurred by the natural objective will affect the LoRa branch instead of the FE. Therefore, the auxiliary LoRA branch solves the issue of divergent optimization directions, thus being able to improve adversarial robustness.
Besides, the FE also indirectly learns the knowledge of the natural objective via distilling knowledge from the LoRa branch, so that it prevents RFT from degrading the generalization. We can regard the LoRa branch as the teacher model that learns features of natural data and provides high-quality natural soft labels for the student model (i.c., the FE). Thus, the KL loss term in Eq. [] which is used penalize the KI. divergence between the adversarial logits and natural soft labels generated by the LoRa branch, can be regarded as the knowledge distillation loss. In this way, the FE can implicitly learn the knowledge of natural objectives from the LoRa branch, thus maintaining the standard generalization.
Note that our proposed disentangled RFT via a LoRa branch is still low-cost thanks to the parameter- efficient LoRa branch. We empirically verify that the LoRa branch only introduces a quite small amount of extra trainable parameters that are less than 5% of the FE parameters (i.c., | + [B| < 0.05 |0,| when rnat < 8 validated in Table 4.. Besides, the auxiliary LoRa branch does not incur extra inference latency since we drop this LoRa branch and only use the parameters 0 for predicting test data during inference. Therefore, disentangled RFT can be an efficient and effective strategy to improve adversarial robustness while maintaining generalization in downstream tasks.
4.2 AUTOMATING SCHEDULING HYPERPARAMETERS
In this subsection, we introduce heuristic strategies of automating scheduling the hyperparameters including the learning rate and the scalars A and A2. We demonstrate the algorithm our proposed automated RFT disentangled via LoRa branch (AutoLoRa) in Algorithm 1
Automated scheduler of the learning rate (LR) 77- Lin al. (2019) analogized the adversarial example generation process to the neural model training process. Therefore, recent studies (Wang & He| 2021: Yuan et al./ (022) have taken similar strategy to control the step size in the adversarial example generation process inspired by the scheduler of LR in the neural model training process in order to improve the convergence used to adjust the change rate of the adversarial example and the model parameters, respectively. Conversely, we conjecture that we can adopt the strategy adjusting the step size for scheduling the L.R well. AutoAttack (Croce& & Hein 2020) proposed automated scheduler of the step size
adversarial attack. Note that the step size and the LR are
5

---

Published as a conference paper at ICLR 2024
Algorithm 1 Automated RFT disentangled via LoRa branch (AutoLoRa)
1: Input: Training set D, pre-trained feature extractor 0,, maximum training epoch E
2: Output: Adversarially robust model
3: Initialize classifier parameters 22 0 {01, 02), and LoRa branch A == = o) and B 0
4: Initialize learning rate = 0.01, epoch e = O, batch size
128, training flag FLAG = True
5: while FLAG' do
6: Update scalars A and 2 according to Eq. 6 and Eq.
respectively
7:
for batch 1, .... [|]]/T] do Sample minibatch S. from D Calculate training loss L LIoRa (mm A, B, A2)
8:
9:
10:
B Update parameters A - - VoL. A + A A- B B-B- B- VBL end for
12:
if Condition I Condition 2 then
!J 8- 1//2
14:
end if
15:
if' 7) < 1E - 5 Sore E then
16:
FLAG t False
17:
else
18:
c+1
19:
end if
20:
end while
guided by the classification loss, which has been validated as effective improving the convergence of adversarial attacks. Therefore,
similar strategy to automatically adjust the LR.
Here, we introduce our proposed dynamic scheduler of the LR v based on the robust validation accuracy during RFT inspired by AutoAttack (Croce & Hein 2020). We start with the LR 17 0.01 at Epoch 0 and identify whether it is necessary to halve the current LR at checkpoint epoch e E N+ where j E {1,..., . M) and M the number of checkpoint epochs. For example, when maximum training epoch E' 60 and M 15, check the LR every 4 epochs, i.c., Cj {0, 4, ..,,,,...,,,,, Given a validation set Dval = {(x,, y:) piein Tival data points and maximum training epoch E' E N,
we set the following two conditions:
1. 9-
e0 [RA ((e+1)) < RA(Dval; o(e))] S 0.75 (cj - cG-1);
2. 1/ (0-1) m0()) and RA ((0--1)) ) max RA(D ((e))) Jmax:
where 1[:] is an indicator function, ((e) refers to the parameters Epoch E 10.1...., E 1}. Dval denotes a validation set, RA (())) refers to the robust accuracy (RA) evaluated on the adversarial validation data using the parameter ((e), (RAlDvali (l()) )ax denotes the highest robust validation accuracy found until Gj epochs.
Condition says that we halve the LR if the robust validation accuracy does not increase in the 75% stage between two adjacent checkpoint epochs (i.c., Cy-1 and c,). Condition 2 says that we halve the LR if both the LR and the best robust validation accuracy remain the same at two adjacent checkpoint epochs. If at a checkpoint epoch Cj. the LR gets halved, then we take the parameters of the checkpoint that achieves the best robust validation accuracy (i.e., RA(Dvat; ((s)) m as the initialization
epoch.
Automated scheduler of the scalars \1 and Az. Given a training set D = ((I::))) of training data points, we set
A = SA (SA(Drrain)
(0(e) + (c) (c) (l0)))
(6)
2 X max
SA (D
(8( Bee) 1())))
where x and x denote the weight terms Epoch Amax 2 0 is dlyer--prameee that controls
the scale X2 E [o, {maa], SA(Dtraini (0( + B()) A (e), {()) }) refers to the standard accuracy (SA)
of natural training data at Epoch evaluated via the LoRa branch, and is used for sharpening

---

Published as a conference paper at ICLR 2024
Table 1: Performance benchmarks using ResNet-18. "SA" refers the standard test accuracy.
"PGD-10" and "AA" refer to the robust test accuracy evaluated by PGD-10 and AutoAttack, respec- tively. We report p-values of t-tests Table to justify the significance of performance gain.
AutoLoRa
Diff. (ours vs.
Diff. (ours
ResNet-18
Vanilla RFT
TWINS
(ours)
Vanilla RFT)
TWINS)
SA
81.51
85.27
84.20
+2.69
-1.07
CIFAR-10
PGD-10
52.97
53.04
54.27
+1.30
+1.23
AA
47.52
47.89
48.95
+1.43
+1.06
SA
58.55
63.03
62.10
+3.55
-0.93
CIFAR-100
PGD-10
30.08
30.37
32.71
+2.63
+2.34
AA
24.07
25.45
27.48
+3.41
+2.03
SA
47.86
49.07
48.72
+0.86
-0.35
DTD-57
PGD-10
23.49
24.87
27.34
+3.85
+2.47
AA
20.37
20.87
21.91
+1.54
+1.04
SA
47.23
48.73
48.57
+1.34
-0.16
DOG-120
PGD-10
14.93
15.12
16.60
+1.67
+1.48
AA
8.14
9.35
10.75
+2.61
+1.40
SA
47.88
51.62
51.00
+3.12
-0.62
CUB-200
PGD-10
21.13
21.35
22.70
+1.57
+1.35
AA
15.66
15.95
16.62
+0.96
+0.67
SA
61.85
65.22
64.16
+2.31
-1.06
Caltech-256
PGD-10
43.22
43.36
44.13
+0.90
+0.76
AA
38.17
38.23
39.00
+0.83
+0.77
the SA inspired by Zhu et al.
2022). As the training progresses with gradually increased standard training accuracy, A and A2 will decrease and increase, respectively.
Next, provide the explanations for design of the scheduler from the perspective of gradu- ated optimization (Hazan et al., 2016 Hulse et al., 2019). The graduated optimization proposes to address a challenging optimization problem by first tackling significantly simplified version, and gradually transforming the problem through optimization steps until it aligns with the complexity of the original optimization challenge. Our proposed scheduler gradually decreases A and increases 22 which lets the model first focus on optimizing the natural objective which is simplified opti- mization problem, and then focus on solving the complex optimization problem of the adversarial objective in Eq. 5 In this way, our proposed scheduler improves the optimization of RFT, thus enhancing the performance.
EXPERIMENTS
In this section, we first conduct robustness benchmarks on various downstream tasks to validate the effectiveness of our proposed AutoLoRaa shown in Algorithm [] Then, we conduct ablation studies on various pre-trained backbones, the rank Tuat, the adversarial budgets Ept during robust pre-training, the sharpening hyperparameter and the automated scheduler of LR.
Baselines. We take vanilla RFT (Zhang et al. 2019 Jiang et al. 2020) and TWINS (Liu et al, 2023) as the baseline methods. As for configurations of the learning exactly follow TWINS and also provide the detailed configurations in Table 5 (Appendix (A).
and the scalars / and 7.
Pre-trained feature extractors. In our work, we utilized ResNet-18 (He et al. (016)) and ResNet- 50 that are adversarially pre-trained on ImageNet-1K (Deng et al. 2009) of 224 x 224 resolution. To be specific, we downloaded the pre-trained weights from the official of
et al. (2020). Following the settings of TWINS (Liu et al. 2023), we used pre-trained models with adversarial budget ppt = 4/255 by default.
Downstream tasks. We considered six datasets the downstream tasks. CIFAR-10 with 10 classes and @ CIFAR-100 (Krizhevsky) 2009) with 100 classes are low-resolution image datasets, Describable textures dataset with 57 classes (DTD-57) (Cimpoi et al. 2014) is a collection of high-resolution textu- ral images the wild, which contains 2,760 training images and test 1,880 images. Stanford Dogs dataset with 120 dog categories (DOG-120) 120) (Khosla et al. 2011) contains 12,000 training im- ages and 8,580 test images. @ Caltech-UCSD Birds-200-2011 with 200 categories of birds (CUB- 200) (Wah et al. 2011) ) is high-resolution bird image dataset for fine-grained image classifica- tion, which contains 5,994 training images and 5,794 validation images. @ Caltech-255 with 257
whose training and sets have 50,000 and 10,000 images, respectively.

---

Published as a conference paper at ICLR 2024
Table 2: Performance benchmarks using ResNet-50. justify the significance of performance gain.
We report p-values of t-tests in Table 7 to
AutoLoRa (ours)
Diff. (ours vs.
Diff. (ours
ResNet-50
Vanilla RFT
TWINS
Vanilla RFT)
vs. TWINS)
SA
86.33
86.50
86.93
+0.60
+0.43
CIFAR-10
PGD-10
56.51
56.77
57.16
+0.65
+0.39
AA
51.67
51.73
52.00
+0.33
+0.27
SA
63.25
65.52
66.20
+2.95
+0.68
CIFAR-100
PGD-10
33.25
33.79
35.25
+2.00
+1.46
AA
28.26
28.37
29.50
+1.24
+1.13
SA
52.99
54.22
53.35
+0.36
-0.87
DTD-57
PGD-10
27.36
28.94
30.21
+2.85
+1.28
AA
23.35
23.88
25.59
+2.24
+1.71
SA
62.68
63.64
62.33
+0.15
-1.31
DOG-120
PGD-10
24.87
24.98
25.32
+0.45
+0.34
AA
12.73
14.41
17.44
+4.71
+3.03
SA
57.27
63.58
62.78
+5,51
-0.81
CUB-200
PGD-10
28.37
29.60
31.07
+2.70
+1.47
AA
23.09
23.71
24.40
+1.31
+0.69
SA
66.78
69.41
69.85
+3.07
+0.44
Caltech-256
PGD-10
47.76
47.79
47.82
+0.06
+0.03
AA
42.17
42.27
42.63
+0.46
+0.36
classes (Griffin al. 2007 is high-resolution dataset composed of 42,099 images in total. We
randomly split it into 38,550 training data and 3,549 test data. Following Liu et al. (2023), we resized the images from both low-resolution image datasets (CIFAR-10 and CIFAR-100) and high- resolution datasets (DTD-57, DOG-120, CUB-200, Caltech-256) to 224 x 224 resolution. In this way, the input sizes are the same for pre-training and fine-tuning.
Training configurations. For the fair comparison, we set maximum training epoch = 60 fol- lowing (Liu et al. 2023). We used SGD the optimizer, froze the weight decay of SGD 1c 4, and set the rank of the LoRa branch Fnat = 8 by default. fault. We randomly selected 5% of the entire training data the validation set. During training, used PGD-10 with an adversarial budget of 8/255 and step size of 2/255 to generate the adversarial training and validation data.
set a 1.0 and Amma 6.0 by de-
Evaluation metrics. We take standard test accuracy (SA) as the measurement of the generalization ability in downstream tasks. To evaluate the adversarial robustness, we use robust test accuracy evaluated by PGD-10 and AutoAttack (AA) (Croce Hein 2020) the adversarial budget being 8/255. For each method, we select the checkpoint that has the best PGD-10 test accuracy as the best checkpoint and report the performance of this best checkpoint experiments 3 times and then conducted t-tests between the results of baselines (i.e., vanilla RFT and TWINS) and the results of our proposed AotoLoRa. We report the p-value of the t-test Table 7 (Appendix B.3 which validates the significance of the improvement achieved by AutoLoRa.
our results. We repeated the
5.1 ROBUSTNESS BENCHMARKS ON VARIOUS DOWNSTREAM TASKS
In Tables I and 2 demonstrate the performance benchmarks on six downstream tasks achieved by ResNet18 and ResNet-50, respectively. We annotate the robust test accuracy achieved by our proposed AutoLoRa in bold with underlining in Table and 2 We consistently obtains higher robust test accuracy under both PGD-10 and AA for each downstream task and each backbone. Besides, the p-values obtained by t-lests in Table 7 (Appendix (B.3) further validate that our improvement in ad versarial robustness is significant. Notably, even compared with the previous SOTA method TWINS Liu et al. (2023). AutoLoRa achieves a 2.03% (from 25 25,45% to 27. )8% robustness gain using ResNet-18 on CIFAR-10W and 3.03% (from 14.41 % to 17.44%) robustness gain using ResNet-50 on the DOG-122 task.
observe that AutoLoRa
5.2 ABLATION STUDY
In this subsection, we conducted ablation studies on the various pre-trained backbones, rank Tnats the adversarial budgets fpt during robust pre-training, the sharpening hyperparameter o, and the automated scheduler of L.R.
8

---

Published as a conference paper at ICLR 2024
Table 3: We report the performance benchmarks using vision transformers including ViT (Dosovit- skiy et al., 2020) and DeiT (Touvron et al.) (021) on the CIFAR-10 dataset. SA and RA refer to standard test aceuracy and PGD-I0 robust test aceuracy, respectively.
ViT (S/16)
ViT (B/16)
DeiT (DeiT-tiny)
DeîT (DeiT-small)
RFT method
SA
RAA
SA
RA
SA
RA
SA
RA
Vanilla RFT
80,31
51.06
83.87
53.39
78.85
49.72
81.73
51.92
AutoLoRa
80.97
51.51
84.79
54.10
79.49
50.52
82.33
52.63
Table 4: We report the effect of various ranks That on the performance downstream tasks as well
as the ratio of the LoRa branch's parameters to the original parameters (denoted "Param. Ratio").
CIFAR-10
CIFAR-100
DTD--57
CUB-200
Rank Tnat
Param. Ratio
SA
RA
SA
RA
SA
RA
SA
RA
1.30%
84.89
52.71
61.86
32.00
45.85
25.43
52.04
22.06
4
2.49%
83.69
52.75
62.91
32.75
45.81
24.95
50.50
22.51
4.87%
84.20
54.27
62.10
32.71
48.72
27.34
51.00
22.70
16
9.62%
84.87
54.17
61.81
32.63
49.15
27.23
50.43
21.92
Various pre-trained backbones. Table 3 Jemmnnttrates Jemeonddossssssssrss the performance of ImageNet (Deng al.,
2009)
pre-trained vision transformers including VIT (Dosovitskiy et al.) 2020) and DeiT (Touvron al. 202I) achieved on the downstream CIFAR- 10 dataset after RFT. The results validate that Aut is compatible with various pre-trained backbones and consistently achieves better gener- alization and adversarial robustness downstream tasks compared vanilla RFT.
The rank Yuat 4able4shows that the test accuracy gradually rises in most cases as the rank Tnat increases from 2 to 8, which indicates that higher rank yields better robustness. The reason could be that a higher rank enables the LoRa branch to have more tunable parameters for fitting natural data and outputting higher-quality natural soft labels, which coincides with the discovery in Zhu eet al. (202T) that high-quality soft labels are beneficial to improving performance. However, when Tnat 8, the performance gain is marginal which means that Tnat 8 is enough capture the features of natural data and provide accurate natural soft labels. Therefore, we keep I'ns 8 for the experiments in Section 5.1 by default.
The adversarial budgets Cpt during robust pre-training. In Table g we report the performance using pre-trained FEs with different adversarial budgets Cpt E {0. 17255, 2/255, 4/255, 8/ 8/255). The results show that larger épc is beneficial to improving performance. Our proposed AutoLoRa achieves consistently better adversarial robustness than baselines.
The automated scheduler of the LR. We apply our proposed automated scheduler of LR into TWINS and report the performance in Table 9 We can observe that TWINS with an automated scheduler of LR can achieve comparable performance compared to TWINS with tuned hyperpa- rameters. It validates the effectiveness of our proposed automatic LR scheduler.
The sharpening hyperparameter We can observe that both standard and robust test accuracy rise as a increases from 0.2 to 1.0 while the robust test accuracy begins to degrade increases from 1.0 to 5.0. It indicates that do not need to sharpen the values the standard test accuracy. Therefore, we keep a 1.0 by default.
We report the performance under different in Table 10
6 CONCLUSIONS
This paper proposed an automated robust fine-tuning disentangled via a low-rank branch (Au- toLoRa) that can automatically convert pre-trained feature extractor an adversarially robust model for the downstream task. We highlighted that vanilla RFT and TWINS have the issue where the gradient directions of optimizing both adversarial and standard objectives via the FE are di- vergent. This issue makes optimization unstable, thus impeding obtaining adversarial robustness and making RFT sensitive hyperparameters. To solve the issue, we proposed a low-rank (LoRa) branch to make RFT optimize adversarial and standard objectives via the FE and the LoRA branch, respectively. Besides, we proposed heuristic strategies for automating the scheduling the hyperpa- rameters. Comprehensive empirical results validate that AutoLoRa can consistently yield state-of- the-art adversarial robustness in downstream tasks without carefully tuning hyperparameters. There- fore, AutoLoRa can be automated and effective RFT framework which is significantly useful in practice. We leave how to conduct RFT to robustify LLMs against adversarial attacks (Xu et al. 2023a) and label-fiipping attacks (Zhang et al. 2024) as the future work.

---

Published as a conference paper at ICLR 2024
ACKNOWLEDGEMENTS
This research is supported by the National Research Foundation, Singapore under its Strategic Ca- pability Research Centres Funding Initiative. Any opinions, findings and conclusions recommen- dations expressed in this material are those of the author(s) and do not reflect the views of National Research Foundation, Singapore.
REFERENCES
Rishi Bommasani, Drew A Hudson, Ehsan Adeli, Russ Altman, Simran Arora, Sydney von Arx, Michael S Bernstein, Jeannette Bohg, Antoine Bosselut, Emma Brunskill, et al. On the opportu- nities and risks of foundation models. arXiv preprint arXiv:2 2021.
Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neural information processing systems, 33:1877-1901, 2020.
Varun H Buch, Irfan Ahmed, and Mahiben Maruthappu. Artificial intelligence medicine: current trends and future possibilities. British Journal of General Practice, (1((668):133-1110 2018.
Arnav Chavan, Zhuang Liu, Deepak Gupta, Eric Xing, and Zhiqiang Shen. One-for-all Generalized lora for parameter-efficient fine-tuning. arXiv preprint arXiv:2306. 079677 2023.
Chen Chen, Jingfeng Zhang, Xilie Xu, Lingjuan Lyu, Chaochao Chen, Tianlei Hu, and Gang Chen. Decision boundary-aware data augmentation for adversarial training. IEEE Transactions on De- pendable and Secure Computing, 2022.
Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. International conference on machine learning. pp. 1597-1607. PMLR, 2020a.
Ting Chen, Simon Kornblith, Kevin Swersky, Mohammad Norouzi, and Geoffrey E Hinton. Big self-supervised models are strong semi-supervised learners. Advances in neural information pro- cessing systems, 33:22243-22255, 2020b.
Mircea Cimpoi, Subhransu Maji, Iasonas Kokkinos, Sammy Mohamed, and Andrea Vedaldi. De- scribing textures in the wild. In Proceedings of the IEEE conference computer vision and pattem recognition, pp. 3606-3613, 2014.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning, pp. 2206- 2216. PMLR. 2020.
Jia Deng, Wei Dong. Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scabl scale hi- crarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp. Ieee, 2009.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11990 11999, 2020.
Lijie Fan, Sijia Liu, Pin- Yu Chen, Gaoyuan Zhang, and Chuang Gan. When does contrastive learning preserve adversarial robustness from pretraining to finetuning? Advances in Neural Information Processing Systems, 34:21480-21499 2021.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint 1xXiv:1412.6572, 2014.
Gregory Griffin, Alex Holub, and Pietro Perona. Caltech-256 object category dataset. 2007.
10

---

Published as a conference paper at ICLR 2024
Elad Hazan, Kfir Yehuda Levy, and Shai Shalev-Shwartz On graduated optimization for stochastic non-convex problems. In International conference on machine learning, pp. 1833-18411 PMLR, 2016.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp- 770-778, 2016.
Dan Hendrycks, Kimin Lee, and Mantas Mazeika. Using pre-training can improve model robustness and uncertainty. In International Conference on Machine Learning, pp. 2712-2721. PMLR, 2019.
Neil Houlsby, Andrei Giurgiu, Stanislaw Jastrzebski, Bruna Morrone, Quentin De Laroussilhe, An- drea Gesmundo, Mona Attariyan, and Sylvain Gelly. Parameter--fficient transfer learning for nlp. In International Conference on Machine Learning, pp. 2790-2799. PMLR, 2019.
Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. arXiv preprint arXiv:2106.0960 2021.
Daniel Hulse, Kagan Tumer, Christopher Hoyle, and Irem Tumer. Modeling multidissciplinary design with multiagent learning. Al EDAM, 33(1):85-99, 2019.
Ziyu Jiang, Tianlong Chen, Ting Chen, and Zhangyang Wang. Robust pre-training by adversar- ial contrastive learning. Advances in Neural Information Processing Systems, 33:16199-16210, 2020.
Aditya Khosla, Nityananda Jayadevaprakash, Bangpeng Yao, and Li Fei-Fei. Novel dataset for fine- grained image categorization. In First Workshop on Fine-Grained Visual Categorization, IEEE Conference on Computer Vision and Pattern Recognition, Colorado Springs, CO, June 2011.
Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, 2009.
Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial intelligence safety and security, pp. 99-112. Chapman and Hall/CRC, 2018.
Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. arXiv preprint arXiv: /908. 1908.06281, 2019.
Zhaojiang Lin, Andrea Madotto, and Pascale Fung. Exploring versatile generative language model via parrameter-effiieen transfer learning. arXiv preprint arXiv:2004.03829 2020.
Ziquan Liu, Yi Xu, Yuanhong Xu, Qi Qian, Hao Li, Xiangyang Ji. Antoni Chan, and Rong Jin. Improved fine-tuning by better leveraging pre-training data. Advances in Neural Information Processing Systems, 35:32568-32581, 2022.
Ziquan Liu, Yi Xu, Xiangyang Ji, and Antoni B Chan. Twins: fine-tuning framework for improved transferability of adversarial robustness and generalization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 16436-16446, 2023.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks. In ICIR, 2018.
Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adver- sarially robust imagenet models transfer better? Advances in Neural Information Processing Systems, 33:3533-3545, 2020.
Ali Shafahi, Parsa Saadatpanah, Chen Zhu, Amin Ghiasi, Christoph Studer, David Jacobs, and Tom Goldstein. Adversarially robust transfer learning. arXiv preprint arXiv:1905.08232. 2019.
Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and
Hervé Jégou. Training data-efficient image transformers & distillation through attention. In International conference on machine learning, pp. 10347-10357. PMLR, 2021.
Catherine Wah, Steve Branson, Peter Welinder, Pietro Perona, and Serge Belongie. The caltech-ucsd birds-200-2011 dataset. 2011.
11

---

Published as a conference paper at ICLR 2024
Alex Wang, Amanpreet Singh, Julian Michael, Felix Hill, Omer Levy, and Samuel R Bowman. Glue: A multi-task benchmark and analysis platform for natural language understanding. arXiv preprint arXiv:1804.07440 2018.
Haotao Wang, Tianlong Chen, Shupeng Gui, TingKuei Hu, Ji Liu, and Zhangyang Wang. Once-for- all adversarial training: In-situ tradeoff between robustness and accuracy for free. Advances in Neural Information Processing Systems, 53:7449-7461, 2020.
Xiaosen Wang and Kun He. Enhancing the transferability of adversarial attacks through variance tuning. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recogni- tion, pp. 1924-1933, 2021.
Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan Yuille, and Quoe V Le. Adversarial examples improve image recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pp. 819-828, 2020.
Xilie Xu, Jingfeng Zhang, Feng Liu, Masashi Sugiyama, and Mohan Kankanhalli. Adversarial attack and defense for non-parametric two-sample tests. In International Conference on Machine Learning. pp. 24743-24769 24769. PMLR, 2022.
Xilie Xu, Keyi Kong, Ning Liu, Lizhen Cui, Di Wang. Jingfeng Zhang, and Mohan Kankanhalli. An Ilm can fool itself: prompt-based adversarial attack. arXiv preprint arXiv:2310.13345, 2023a.
Xilie Xu, Jingfeng Zhang, Feng Liu, Masashi Sugiyama, and Mohan Kankanhalli. Enhanc- ing adversarial contrastive learning via adversarial invariant regularization. arXiv preprint arXiv:2305.00374, 2023b.
Xilie Xu, Jingfeng Zhang, Feng Liu, Masashi Sugiyama, and Mohan Kankanhalli. Effi- cient adversarial contrastive learning via robustness-awars coreset selection. arXiv preprint arXiv:2302.03887, 2023c.
Qiying Yu, Jieming Lou, Xianyuan Zhan, Qizhang Li, Wangmeng Zuo, Yang Liu, and Jingjing Liu. Adversarial contrastive learning via asymmetric infonce. In European Conference on Computer Vision, pp. 53-69. Springer, 2022.
Zheng Yuan, Jie Zhang, and Shiguang Shan. Adaptive image transformations for transfer-based adversarial attack. In European Conference on Computer Vision, pp. 1-17. Springer, 2022.
Chaoning Zhang, Kang Zhang, Chenshuang Zhang, Axi Niu, Jiu Feng, Chang D Yoo, and In So Kweon. Decoupled adversarial contrastive learning for self-supervised adversarial robustness. In European Conference on Computer Vision, pp. 725-742. Springer, 2022.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML, 2019.
Jingfeng Zhang. Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankan- halli. Attacks which do not kill training make adversarial learning stronger. In International conference on machine learning, pp. 11278 1287. PMLR, 2020.
Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan Kankan- halli. Geometry-aware instance-reweighheed adversarial training. In International Confer- ence on Learning Representations, 2021. URL http:s://openreseeee wttpeviwwwwweeeeeeeeemmmm / wttp:rrwwwww...eeoooommt.mc.
1Ax016Cz8ub.
Jingfeng Zhang, Bo Song, Haohan Wang, Bo Han, Tongliang Liu, Lei Liu, and Masashi Sugiyama. Badlabel: A robust perspective on evaluating and enhancing label-noise learning, IEEE Transac- tions on Pattern Analysis and Machine Intelligence, 2024.
Jianing Zhu, Jiangchao Yao, Bo Han, Jingfeng Zhang, Tongliang Liu, Gang Niu, Jingren Zhou, Jianliang Xu, and Hongxia Yang. Reliable adversarial distillation with unreliable teachers. arXiv preprint arXiv:2106.04922 2021.
12

---

Published as a conference paper at ICLR 2024
A CONFIGURATIONS FOR BASELINES
report the hyperparameters for reproducing results of baselines. Note that we exactly followed the hyperparameters provided by Liu et al. (2023) since they are obtained by time- consuming grid search. In our experiments, TWINS refer to the TRADES version of TWINS, known TWINS-TRADES in Liu et al. (2023).
Table 5: The hyperparameter configurations of vanilla RFT and TWINS in our experiment follow- ing Liu al. (002).. The format means (1700, WD, 7) for TWINS and (1/10, WD) for baselines where 17 "0, WD, B2 are the initial learning rate, the weight decay and the scalar. respectively.
Method
CIFAR-10
CIFAR-100
DTD-57
DOG-120
CUB-200
Caltech-256
Vanilla RFT
(le-2,1e-4)
(le-3,le-4)
(le-2,le-4)
(le-3.1e-4)
(Ie-2,1e-4)
(Ie-2,1o-4)
TWINS
(1c-2.1e-4.1.0)
(1c-2.1e-4.100)
(Ic-3.1e-4.1.0)
(3c-3.1o-4.100
(Ic-2.1e-433.0)
(3c-3.1e-4.100)
B EXTENSIVE EMPIRICAL RESULTS
B. EXTENSIVE RESULTS OF GRADIENT SIMILARITY AND ADVERSARIAL ROBUSTNESS
Here, we provide the extra results of gradient similarity and adversarial robustness evaluated
CIFAR-10 (Krizhevsky 2009) and CUB-200 (Wah et al. 2011) The experimental details exactly
follow Section
CIFAR- 10
CUB-200
0.4
Gradient Similarity
-0.20
Vanilla RFT
Gradient Similarity
00.25
TWINS
0.2
ww
0.30
0.0
-0.3
-0.
-0.40
-0.4
0.45
0.50
-066
10
40
50
60
Epochs
Epochs
(a) Gradient similarity.
CIFAR-10 10
CUB-200
Robust Test, Accuracy (%)
Robust Tost Acouracy (%)
54
20
52-
50-
54
15-
48
53
10-
46
44
TWINS
Vanilla RFT
30
5
30
10
80
42-
AutoLoRa (ours)
0
10
20
30 Epochs
40
50
60
10
20
30
40
50
60
Epochs
(b) Adversarial robustness.
Figure 2: Figure 2a shows the cosine similarity between the gradients of natural and adversarial objectives w.r.t. the feature extractor (FE). Figure shows the robust test accuracy evaluated via PGD-10.
13

---

Published as a conference paper at ICLR 2024
B.2 SENSITIVITY TO HYPERPARAMETERS
We empirically show that vanilla RFT and TWINS are very sensitive to the hyperparameter (e.g., initial learning rate) caused by poor training stability in Table 6 We performed vanilla RFT and TWINS using the initial learning sampled from (0.001, 0.1, 0.03). Table 6 shows that the robust accuracy (AA) ranges from 18.29 24.07 obtained by Vanilla RFT and 1.00 to 25.45 obtained by TWINS when the initial learning changes, which validates that vanilla RFT and TWINS are sensitive to hyperparameters.
Furthermore, we conducted AutoLoRa without the automated learning rate scheduler on CIFAR-100 using Resnet-18. The initial learning rate is sampled from f0.001, 0.1, 0.03) and divided by 10 and 100 at Epoch 30 and 50, following Liu al. (2023). Table 6 validates that the LoRa branch is effective mitigating the sensitivity to the initial learning rate. It indicates that our proposed LoRa branch would be beneficial in decreasing the sensitivity to hyperparameters to some extent.
Table 6: Sensitivity to the initial learning rate.
0.001
0.01
0.03
Initial learning rate
SA
RA
SA
RA
SA
RA
Vanilla RFT
58,55
24.07
52.19
20.96
49.10
18,29
TWINS
61.54
23.51
63.03
25.45
1.00
1.00
AutoLoRa without the automated learning rate scheduler
61.97
27.51
62.88
27.21
62.21
27.33
B.3 VALIDATING SIGNIFICANCE VIA T-TESTS
We repeated the experiments using the random seed from {0, 6, 66). Therefore, for each down- stream, each method has three results SA, PGD-10, and AA, respectively. We conducted t-tests between the three results of SA/PGD-10/AA obtained by vanilla RFT and our proposed AutoLoRa as well as t-tests between the three results of SA/PGD-10/ AA obtained by TWINS and our proposed AutoLoRa. We report the v-values obtained by t-tests in Table 7 Note that the p-value is smaller than 0.05, which means that the improvement gained by our proposed method is significant.
We annotate the p-value in bold when the p-value is smaller than 0.05 and the performance of Au- toLoRa is better than the baseline. 7 validates that our proposed AutoLoRa achieves significant improvement most cases.
Table 7: We report the p-values of t-tests between our proposed AutoLoRa (ours) and vanilla RFT as well TWINS.
P-value (vanilla RFT vs. ours)
P-value (TWINS vs. ours)
Model
Method
SA
PGD-I0
AA
SA
PGD-10
AA
CIFAR-10 10
0.0001
0.0014
0.0020
0.0088
0.0002
0.0019
CIFAR-
0.0010
8e-05
0.0008
0.0551
5e-05
0.0091
DTD-57
0.2393
0.0004
0.0037
0.4447
0.0036
0.0043
ResNet-18
DOG-120
0.2568
0.0026
0.0002
0.4993
0.0043
0.0008
CUB-200
0.0215
0.0054
0.0051
0.8731
0.0244
0.0216
Caltech-256
0.0003
0.0023
0.0033
0.0458
0.0021
0.0026
CIFAR-IO
0.0019
0.0029
0.0056
0.0904
0.0341
0.0125
CIFAR-100
1e-05
3e-05
0.0024
0.0044
0.0004
0.0018
DTD-557
0.0320
9e-05
0.0002
0.0053
0.0031
0.0022
ResNet-50
DOG- 120
0.1595
0.0414
5e-06
0.0031
0.0329
6e-06
CUB-200
6c-06
5e-06
2e-06
0.1027
0.0010
0.0048
Caltech-256
le-05
0.0457
0.0002
0.0151
0.0413
0.0050
B.4 EMPIRICAL VALIDATION FOR AUTOLORA MITIGATING OPTIMIZATION DIVERGENCE
Given data point (z, E D, the GS of AutoLoRa w.n.t. the FE (i.e., 01) is calculated as follows:
GS GSAmoLoRaaz,, y, (0, A, B}) = sim Lim(Vo, (co v). Va, (ho(()))) hpo BA,0,) , (x))), (8)
14

---

Published as a conference paper at ICLR 2024
where sim(..- is the cosine similarity function.
Figure demonstrates the average GS over all training data AutoLoRa on CIFAR-IO, 10, DTD-57, and CUB-200 datasets, respectively. We observe that, compared with the GS of Vanilla RFT and TWINS shown in Figures Ta and 2a AutoLoRa significantly improves the GS. Thus, it validates that AutoLoRa alleviates the issue of divergent gradient directions.
CIFAR-10
DTD-57
CUB-200
0.88
Gowbeut Stadlatt
Gradien Siailarity
Goddant Simalarity
0.80
0.0-
0.84
6.82
0.05-
0.70
0.80
0.78-
0.78
0.35
0,72-
0.74
0.00-
0.70-
Epoclas
Epoclas
Epochs
Figure 3: AutoLoRa mitigates the issue of divergent gradient directions.
B.5 EXTENSIVE RESULTS ABLATION STUDIES
Table 8: The effect of adversarial budget Cnt during robust pre-training. We keep adversarial budget as 8/255 during RFT and robustness evaluation.
Datascts
CIFAR-
DTD-57
Ept.
1/255
2/255
4/255
8/255
0
1/255
2/255
4/255
8/255
Vanilla RFT
30.62
55.37
57.03
58.55
59.78
23.94
47.13
48.78
47.86
47.39
SA
TWINS
57.16
60.06
61.88
63.03
62.51
25.70
45.48
49.52
49.07
47.73
AutoLoRa
56.36
59.37
61.13
62.10
62.82
26.54
46.22
48.56
48.72
47.76
Vanilla RFT
13.33
26.33
28.28
30.08
31.44
7.23
23.62
25.32
23.49
25.48
RA
TWINS
26.24
27.67
28.33
30.37
31.83
8.72
20.32
24.15
24.87
25.16
AutoLoRa
27.21
29.97
31.60
32.71
33.31
9.63
24.41
26.38
27.34
27.63
Table 9: The effect of the automated scheduler of LR on TWINS.
Table 10:
The effect of a on AutoLoRa.
CIFAR-10 10
CIFAR-100
Automatic LR scheduler
w/o
w/
diff.
Q
SA
RA
SA
RA
SA
85.27
85,43
+0.16
CIAFR-10
0.2
81.97
53.07
60.89
32.68
RA
53.04
52.98
-0.06
0.5
83.16
54.35
61.51
33.57
SA
63.03
63.66
+0.63
CIFAR-100
0.8
84.12
54.06
61.89
32.92
RA
30.37
30.33
-0.04
1.0
84.20
54.27
62.10
32.71
SA
49.07
51.17
+2.10
DTD-57
2.0
84.17
53.06
62.66
31.39
RA
24.87
23.56
-1.31
3.0
85.08
52.91
64.80
31.08
SA
65.22
64.53
-0.69
Caltech-256
5.0
84.57
51.92
61.91
20.21
RA
43.36
42.98
-0.38
15


Reviews:
[{"review_id": "deEv3TQoyY", "reviewer": "Reviewer_pJnK", "summary": "The paper proposes a decoupled fine-tuning framework for learning adversarially robust features. Specifically, a conventional robust finetuning pipeline consists of two losses: a natural objective and an adversarial objective. The paper shows that the divergence in gradients from the two objectives is correlated with downstream accuracy on robustness benchmarks. Therefore, it proposes to decouple a model into two branches where the second branch is constructed using Low-rank adaptation (LORA). In the decoupled training scheme, the main model (first branch) is only exposed to the adversarial objective and the LORA branch (second branch) is only exposed to the natural objective. The paper claims that the disentanglement avoids gradient divergence and leads to better downstream robustness.", "questions": "* Could the authors provide the cosine similarity between the two terms in the adversarial objective in Equation 5 and comment on the functionality of the second cross-entropy term $L_{KL}(h_{\\theta}(\\tilde{x}),y)$? \n\n* Could the authors clarify the parameter-free characteristic? It could be that I misunderstood the meaning here.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "* **Clear presentation**: the paper uses clear and concise notations for equations. The method section is easy to follow.\n\n* **Good ablation study**: the paper conducts ablation study on important hyper-parameters such as the rank in LORA and the LR scheduler.", "weaknesses": "* **Missing ablation on Equation 5**: Equation 5 is the main loss function of the proposed method, which has three terms. The second cross-entropy term is a new addition $L_{KL}(h_{\\theta}(\\tilde{x}),y)$ in this paper and is not motivated and ablated in the experiments.  \n* **Doubt on mitigating divergence**: a main motivation of the method is that it can avoid divergent gradient updates on the main model parameters. However, this is not validated through experiments explicitly. For example, even though the main model parameters are not directly trained on the natural objective, it is indirectly affected by the natural objective through the KL divergence. Moreover, the unexplained second cross-entropy term $L_{KL}(h_{\\theta}(\\tilde{x}),y)$ can be seen as a natural objective on perturbated input. \n* **Why parameter-free**: the claim on parameter-free can be confusing. The model not only fine-tunes the main model parameters but also additional LORA parameters. So, it is not parameter-free in the sense of fine-tuning. Even though the method reduces the need for extensive hyper-parameter tuning, the design choices of the automated scheduler and the rank selection for LORA are all hyper-parameters. It’s not clear what aspect of the proposed method is parameter-free.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "MOU33ucSMy", "reviewer": "Reviewer_kvxv", "summary": "The paper introduces AutoLoRa, an automated robust transfer learning framework. The authors present empirical evidence showing a significant divergence in the gradients of adversarial and natural objectives with respect to the feature extractor (FE), leading to unstable optimization. This observation motivates the authors to propose an auxiliary low-rank (LoRa) branch to disentangle the robust fine-tuning process, enabling the optimization of natural objectives through the LoRa branch and adversarial objectives through the FE.\n\nAdditionally, the authors introduce automatic schedulers for adjusting the learning rate and loss weights. The empirical results demonstrate that AutoLoRa achieves state-of-the-art robustness in downstream tasks without the need for hyperparameter search.", "questions": "Refer to Weaknesses.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. The paper is well-organized and well-written, making it easy to follow most parts of the paper.\n\n2. The proposed method is well-motivated. The authors empirically discover that optimizing the natural and adversarial objectives leads to divergent optimization directions, which serves as the motivation for the LoRa branch.\n\n3. The comprehensive results across various datasets provide strong support for the effectiveness of AutoLoRa.\n\n4. AutoLoRa is parameter-free, offering practical utility. Additionally, the automated learning scheduler is adaptable to different methods.", "weaknesses": "1. The backbone models are pre-trained through robust supervised learning. It would be beneficial to demonstrate the performance of various backbone models pre-trained using robust self-supervised learning with AutoLoRa.\n\n2. Robustness is currently assessed using AutoAttack. It would be more informative to assess the robustness under various attackers.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "4pSdqfh9Tj", "reviewer": "Reviewer_4DPH", "summary": "Robust fine-tuning (RFT) is an efficient method to obtain a robust model on a downstream task by robustly fine-tuning a robust model that is adversarially trained on a large dataset. \nHowever, this paper shows that the existing methods (vanilla RFT, TWINS [Liu et al. 2023]) suffer from the same issue that optimizing both adversarial and natural objectives yields significantly divergent gradient directions.\nThis paper points out that this divergence can hinder obtaining high robustness and make the training unstable.\n\nTo resolve the issue of the divergent gradient directions, this paper proposes a robust fine-tuning framework called AutoLoRa using the low-rank adaptation (LoRA) technique. \nThe idea is to have separate branches for adversarial and natural objectives: the adversarially pre-trained encoder is trained by the adversarial objective, and the LoRa branch is trained by the natural objective.\n\nAdditionally, AutoLoRa introduces automatic scheduling of hyperparameters, in contrast to vanilla RFT and TWINS, which require expensive hyperparameter searches. The balance between adversarial and natural objectives is determined by natural accuracy on the train set: as the standard accuracy increases, the weight on the natural objective decreases. The learning rate decays automatically with a condition of the validation accuracy.\n\nIn this paper, the pre-trained models are adversarially trained on ImageNet-1k. \nOn the six downstream datasets (CIFAR10, CIFAR100, DTD-57, DOG-120, CUB-200, and Caltech-256), AutoLoRa achieves higher adversarial robustness compared to vanilla RFT and TWINS.", "questions": "Q1. Related to W1-2, it's worth considering the possibility of applying automated hyperparameter scheduling to Vanilla RFT and TWINS.   The scaler $\\beta$ in Vanilla RFT or $\\gamma$ in TWINS can be scheduled, by simply replacing $\\lambda_2$ with $\\beta$ or $\\gamma$ in Equation 7. It would be interesting to see whether \"Vanilla RFT + scaler scheduling\" or \"TWINS + scaler scheduling\" can be better than the original methods. Additionally, comparing \"Vanilla RFT + scaler scheduling\" or \"TWINS + scaler scheduling\" with AutoLoRa could provide insights into the benefits of the LoRa branch.\n\nQ2. How exactly is the gradient similarity calculated? A feature encoder has multiple layers to measure the gradient similarity. \n\nMinor comment:\n- It appears that TWINS in this paper corresponds to the TRADES version of TWINS, known as TWINS-TRADES [Liu et al. 2023]. It might help clarify the paper's context by explicitly mentioning this relationship.\n\n-------\n[Liu et al. 2023] Twins: A fine-tuning framework for improved transferability of adversarial robustness and generalization. CVPR2023", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "S1. This paper points out the common issue of vanilla RFT and TWINS [Liu et al. 2023] that optimizing both adversarial and natural objectives yields significantly divergent gradient directions, which is beneficial knowledge for the adversarial robustness research community.\n\nS2. The application of LoRA for the adversarial robustness problem is novel, and separating the branches for adversarial and natural objectives with the low-rank branch is interesting. The results show that their method can effectively improve adversarial robustness.\n\nS3. The proposed automatic strategy to determine hyperparameters is useful since adversarial training is time-consuming.", "weaknesses": "W1. A more careful ablation study is needed.\n\n- (W1-1.) It remains unclear how much each of the two proposed components contributes to the performance: (1) the automatic hyperparameter scheduling and (2) the LoRa branch. To clarify, does AutoLoRa without automatic scheduling (utilizing grid search) yield a similar result to AutoLoRa with dynamic hyperparameter scheduling? In other words, does the dynamic hyperparameter scheduling contribute to the robustness improvement, or is it only for avoiding grid search? \n\n- (W1-2.) In line with (W1-1), it is also not evident how significantly the learning rate scheduling and the scalar parameter ($\\lambda$) scheduling impact performance. While it appears that dynamic learning rate scheduling might not have the benefit of improving robustness, as seen in Table 5, I assume that dynamic scalar ($\\lambda$) scheduling could contribute positively to performance, in addition to the benefit of avoiding grid search.\n\nW2. The paper's claim regarding divergent gradient directions and training stability needs clarification.\n\n- (W2-1.) The paper lacks evidence to support the claim that Vanilla RFT and TWINS are sensitive to hyperparameters. It would be helpful to specify which hyperparameters these methods are sensitive to and to what extent.\n- (W2-2.) Since AutoLoRa employs automatic hyperparameter scheduling, it remains unverified whether the use of the LoRa branch indeed contributes to training stability regarding hyperparameters. To discuss the hyperparameter sensitivity, I would expect experiments comparing the different magnitudes of a specific hyperparameter and the corresponding performances for compared training methods.\n\nW3: Natural accuracy trade-off in AutoLoRa compared to TWINS.\n- For all cases in ResNet-18 and the three cases in ResNet-50, AutoLoRa exhibits a slightly lower natural accuracy compared to TWINS, despite achieving higher robust accuracy. Further discussion or insights on this trade-off would be valuable.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "iepKR6e3l5", "reviewer": "Reviewer_qytY", "summary": "**Summary Of The Paper:**\n\nThis paper introduces AutoLoRa, a parameter-free automated robust fine-tuning framework to improve adversarial robustness in downstream tasks that disentangles the optimization process into two distinct components: (1) optimizing natural objectives via the LoRa branch, (2) and adversarial objectives via the FE. It addresses the issue of divergent gradient directions, when optimizing both adversarial and natural objectives through the feature extractor (FE), in existing robust fine-tuning methods and achieves state-of-the-art results across various tasks without the need for hyperparameter tuning.", "questions": "Refer to the weakness section.", "limitations": "", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "**Strength:**\n\n-   The motivation that optimizing both adversarial and natural objectives through feature extractor yields divergent gradient directions make sense. The proposed disentangling of the training objective by introducing the LoRA branch is consistent with the motivation.\n-   Extensive empirical evaluation (including the P-test) demonstrates the improvements in Robust Fine-Tuning on various tasks.", "weaknesses": "**Weakness:**\n\n-   The reason for automating scheduling hyper-parameters is not well illustrated, and the ablation study in Table 5 can not show its superiority, especially for the *RA* metric.\n-   In Formula 7, the constant factor $6$ is not well-explained, and it could be considered as a hyper-parameter with further ablation study.\n-   Table 4 is confusing. Specifically, when the adversarial budget is set to $8$ which is the default configuration, the resulting metric is supposed to be that in Table 2. However, this is not true.\n-   Typo in Section 5.2 Ablation Study, the end of adversarial budgets paragraph says \"consistently achieves consistently\".\n-   Diverse network backbone architectures are encouraged to be considered beyond ResNet.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)