When does Contrastive Learning Preserve Adversarial Robustness from Pretraining to Finetuning?
Authors: Lijie Fan
Sijia Liu
Pin-Yu Chen
Gaoyuan Zhang
Chuang Gan
Venue: NeurIPS 2021 Poster (2021)
Keywords: Adversarial robustness
self-supervised learning
pretraining and finetuning

Abstract: Contrastive learning (CL) can learn generalizable feature representations and achieve state-of-the-art performance of downstream tasks by finetuning a linear classifier on top of it.  However, as adversarial robustness becomes vital in image classification,  it remains unclear whether or not CL is able to preserve robustness to downstream tasks. The main challenge is that in the self-supervised pretraining + supervised finetuning paradigm, adversarial robustness is easily forgotten due to a learning task mismatch from pretraining to finetuning. We call such challenge 'cross-task robustness transferability'. To address the above problem, in this paper we revisit and advance CL principles through the lens of robustness enhancement.  We show that (1) the design of contrastive views matters: High-frequency components of images are beneficial to improving model robustness; (2) Augmenting CL with pseudo-supervision stimulus (e.g., resorting to feature clustering) helps preserve robustness without forgetting. Equipped with our new designs, we propose AdvCL, a novel  adversarial contrastive pretraining framework. We show that AdvCL is able to enhance cross-task robustness transferability without loss of model accuracy and finetuning efficiency. With a thorough experimental study,  we demonstrate that AdvCL outperforms the state-of-the-art self-supervised robust learning methods across multiple datasets (CIFAR-10, CIFAR-100, and STL-10) and finetuning schemes  (linear evaluation and full model finetuning).

When Does Contrastive Learning Preserve Adversarial Robustness from Pretraining to Finetuning?
Lijie Fan', Sijia Liu Pin-Yu Chen", Gaoyuan Zhang Chuang Gan Massachusetts Institute of Technology. Michigan State University,
3 MIT-IBM Watson AI Lab, IBM Research lijiefan@mit. edu, $iummss50msu.co edu, (pin-yu.chen, gaoyuan. zhang, chuangg com
Abstract
Contrastive learning (CL) can learn generalizable feature representations and achieve state-of oftt-of-the-art performance of downstream tasks by finetuning linear classifier on top of it. However, as adversarial robustness becomes vital in image classification, it remains unclear whether or not CL is able to preserve robustness downstream tasks. The main challenge that in the 'self-supervised pretraining supervised finetuning' paradigm, adversarial robustness is easily forgotten due a learning task mismatch from pretraining to finetuning. We call such challenge "cross-task robustness transferability'. To address the above problem, in this paper we revisit and advance CL principles through the lens of robustness enhancement. We show that (1) the design of contrastive views matters: High-frequency com- ponents of images are beneficial to improving model robustness; (2) Augmenting CL with npeudo-superviionn stimulus (e.g.. resorting to feature clustering) helps preserve robustness without forgetting. Equipped with our new designs, we pro- pose ADVCL., novel adversarial contrastive pretraining framework. We show that ADVCL. is able to enhance cross-task robustness transferability without loss model accuracy and finetuning efficiency. With thorough experimental study, we demonstrate that ADVCL outperforms the state-of-the-an learning methods across multiple datasets (CIFAR-IO. 10, CIFAR-I00 and STL-10) and finetuning schemes (linear evaluation and full model finetuning). Code is available https: htt///gittt github..b.... com/ Li seeeenannaaa AdvCL.
self-supervised robust
Introduction
Image classification has been revolutionized by convolutional neural networks (CNNs). spite of CNNs' generalization power, the lack of adversarial robustness has shown to be a main weakness that gives rise to security concerns in high-stakes applications when CNNs are applied, e.g., face recognition, medical image classification, surveillance, and autonomous driving [1-5]. The brittleness of CNNs can easily manifested by generating tiny input perturbations to completely alter the models' decision. Such input perturbations and corresponding perturbed inputs are referred as adversarial perturbations and adversarial examples (or attacks), respectively [6-10].
One of the most powerful defensive schemes against adversarial attacks is adversarial training (AT) [11], built upon a two-player game in which an 'attacker' crafts input perturbations to maximize the training objective for worst-case robustness, and 'defender' minimizes the maximum loss for an improved robust model against these attacks. However, AT and its many variants using min-max optimization [12-21] were restricted to supervised learning true labels of training data are required
35th Conference on Neural Information Processing Systems (NcurIPS 2021).

---

for both supervised classifier and attack generator (that ensures misclassification) The recent work [22-24] demonstrated that with a properly-designer attacker's objective, AT-type defenses can be generalized to the semi-supervised setting, and showed that the incorporation of additional unlabeled data could further improve adversarial robustness in image classification. Such an extension from supervised to semi-supervised defenses further inspires us to ask whether there exist unsupervised defenses that can eliminate the prerequisite of labeled data but improve model robustness.
Some very recent literature [25-29] started tackling the problem of adversarial defense through the lens of self- safe--uuerisid learning. Examples include augmenting a supervised task with an unsupervised 'pretext' task for which ground-truth label is available for 'free' [25, 26]. or robustifying unsupervised representation learning based only on a pretext task and then finetuning the learned representations over downstream supervised tasks [27-29]. The latter scenario is of primary interest to us as defense can then be performed at the pretraining stage without needing any label information. Meanwhile, self- supervised contrastive learning (CL.) has been outstandingly successful in the field of representation learning: It can surpass a supervised learning counterpart on downstream image classification tasks in standard accuracy [30-34]. Different from conventional self-
learning methods [35], CL, e.g., SimCLR [30], enforces instance discrimination by exploring multiple views of the same data and treating every instance under a specific view as a class of its own [36].
The most relevant work to ours is [27, 28). which integrated adversarial training with CL. However, the achieved adversarial robustness at downstream tasks largely relies on the use of advanced finetuning techniques, either ad- versarial full finetuning [27] or adversarial lin-
50
AFF Improvement
SLF Improvement
Robust Accuracy
40
car finetuning [28]. Different from [27, 28],
35
SLF
we ask:
30
Supervised
(Q) How to accomplish robustness enhance- ment using CL without losing its finetuning ef- ficiency, e.g., via a standard linear finetuner?
25
DIE
RoCL
20
ACL
ADuCi [Ours)
15
Our work attempts to make a rigorous and comprehensive study addressing the above question. We find that self-suuervised learn- ing (including the state-of-the-art CL) suffers a new robustness challenge that we call 'cross- task robustness transferability', which was largely overlooked in the previous work. That is, there exists a task mismatch from pretrain- ing to finetuning (c.g., from CL to supervised classification) so that adversarial robustness is not able to transfer across tasks even if pretraining datasets and finetuning datasets are drawn from the same distribution. Dif- ferent from supervised/semi--uprrvee supervise learn- ing, this is characteristic behavior of self- supervision when being adapted to robust learning. As shown in Figure 1, our work advances CL in the adversarial context and the pro- posed method outperforms all state-of of-the-art baseline methods, leading to a substantial improvement in both robust accuracy and standard accuracy using either the lightweight standard linear finetuning or end-to-end adversarial full finetuning.
78
81
Standard Accuracy (36)
Figure 1: Summary of performance for various robust pretraining methods CIFAR-10. The covered baseline methods include AP-DPE [26], RoCL [28], ACL [27] and supervised adversarial training (AT) [11]. Upper-right indi- cates better performance with respect to (w.r.t)) standard accuracy and robust accuracy (under PGD attack with 20 steps and 8/ /255 f -norm perturbation strength). Different colors represent different pretraining methods, and differ- ent shapes represent different finetuning settings. Circles indicates Standard Linear Finetuning (SLF), and Di- amonds indicates Adversarial Full Finetuning (AFF). Our method (ADVCL, red circle/diamond) has the best per- formance across finctuning settings. Similar improvement could be observed under Auto-Attacks, and we provide the visualization in the appendix.
Contributions Our main contributions are summarized below.
I We propose ADVCL, a unified adversarial CL framework, and propose to use original adversarial examples and high- seeeufryyency data components to create aobustness-aware and generalization-awel views of unlabeled data.
@ We propose to generate proper neeudo-uppervision stimulus for ADVCL to improve cross-task robustness transferability. Different from existing self-supervised defenses aided with labeled data [27], we generate pseudo-labels of unlabeled data based on their clustering information.

---

We conduct thorough experimental study and show that ADVCL achieves state-of tftt--r robust accuracies under both PGD attacks [11] and Auto-Attacks [37] using only standard linear finetuning. For example, in the case of Auto-Attack (the most powerful threat model) with 8/255 foc noom perturbation strength under ResNet-18, 18, we achieve 3.44% and 3.45% robustness improvement on CIFAR-10 and CIFAR-100 over existing self-supervised methods. We also justify the effectiveness of ADVCL in different attack setups, dataset transferring, model explanation, and loss landscape smoothness.
2 Background & Related Work
Self-Supervised Learning Early approaches for unsupervised representation learning leverages
handcrafted tasks, like prediction rotation [38] and solving the Jigsaw puzzle [39, 40], geometry prediction [41] and Selfie [42]. Recently contrastive learning (CL) [30, 33, 34, 43-45] and its variants [31, 32, 36, 46] have demonstrated superior abilities in learning generalizable features in an unsupervised manner. The main idea behind CL is to self-create positive samples of the same image from aggressive viewpoints, and then acquire data representations by maximizing agreement between positives while contrasts with negatives.
In what follows, we elaborate on the formulation of SimCLR [30], one of the most commonly-used CL frameworks, which this paper will focus on. To be concrete, let X' (21,,2,,-. -.., Fn) denote an unlabeled source dataset, SimCLR offers a learned feature encoder fa to generate expressive deep representations of the data. To train fe, each input x E X will be transformed into two views (TI (I), T2 (r)) and labels them as a positive pair. Here transformation operations TI and 72 are randomly sampled from a pre-defined transformation set T. which includes, e.g., random cropping and resizing, color jittering, rotation, and cutout. The positive pair is then fed in the feature encoder fe with a projection head g to acquire projected features, i.e., 2; g o (x) for j E {1.2). NT-Xent loss (i.e., the normalized cemperature-scaled cross-entropy loss) is then applied to optimizing fo, where the distance of projected positive features 22) is minimized for each input x. SimCLR follows the 'self-supervised pretraining + supervised finetuning' paradigm. That is, once fo is trained, a downstream supervised classification task can be handled by just finetuning a linear classifier ő over the fixed encoder fe, leading to the eventual classification network & o fe-
Adversarial Training (AT) Deep neural networks are vulnerable to adversarial attacks. Various approaches have been proposed to enhance the model robustness. Given a classification model 0, AT [11] is one the most powerful robust training methods against adversarial attacks. Different from standard training over normal data (I, y) E 'D (with feature and label y in dataset D), AT adopts min-max training recipe, where the worst-case training loss is minimized over the adversarially perturbed data (r + 8, y). Here 5 denotes the input perturbation variable to be maximized for the worst-case training objective. The supervised AT is then formally given by
min E (D max l(x + 6, 0), 16 Se
where é denotes the supervised training objective, e.g., cross-entropy (CE) loss. There have been many variants of AT 219 47-50, 25] established for stteriiieddsemm-uupprsiisese learning.
Self-supervision enabled AT Several recent works [26-29] started study how improve model robustness using self-supervised AT. Their idea is to apply AT (1) to a self-supervised pretraining task, e.g., SimCLR in [27, 28), such that the learned feature encoder so renders robust data representations. However, different from our work, the existing ones lack a systematic study on when and how self-supervised robust pretraining can preserve robustness to downstream tasks without sacrificing the efficiency of lightweight finetuning. For example, the prior work [26, 27] suggested adversarial full finetuning, where pretrained model used as weight initialization in finetuning downstream tasks. Yet, it requests the finetuner to update all of the weights of the pretrained model, and thus makes the advantage of self supervieed robust pretraining less significant. more practical scenario is linear finetuning: One freezes the pretrained feature encoder for the downstream task and only partially finetunes a linear prediction head. The work [28] evaluated the performance of linear fintuning but observed relatively large performance gap between the standard linear finetuning and adversarial linear finetuning; see more comparisons in Figure 1. Therefore, the problem-how to enhance robustness transferability from pretraining to linear finetuning fmetuning-remains remains unexplored.
3

---

3 Problem Statement
In this section, we present the problem of our interest, together with its setup.
Robust pretraining + linear finetuning. We aim to develop robustness enhancement solutions by fully exploiting and exploring the power of CL at the pretraining phase, so that the resulting robust feature representations can seamlessly be used to generate robust predictions of downstream tasks using just a lightweight finetuning scheme. With the aid of AT (1), we formulate the 'robust pretraining + linear finetuning' problem below:
Pretraining: min ExEX max Epre( + 6, 2)
(2)
#
Finetuning: min ((..))D (cr(óo, [o(
6.
where fre denotes a properly-designe
robustness- and generalization-awas CL loss (see Sec. 4) given as a function of the adversarial example (x + 5). original example æ and feature encoder parameters 0. In (2), 09. fo denotes the classifier by equipping the linear prediction head Φo. (with parameters 9g to be designed) on top of the fixed feature encoder fo. and fCE denotes the supervised CE loss over the target dataset DD Note that besides the standard linear finetuning (3), one can also modify (3) using the worst-case CE loss for adversarial linear/full finetuning [27, 28]. We do not consider standard full finetuning in the paper since tuning the full network weights with standard cross-entropy loss is not possible for the model to preserve robustness [26].
Cross-task robustness transferability. Different from syperviseedsemiisuperre supervision enables robust pretraining over unlabeled source data. In the meantime, it also imposes new challenge that we call 'cross-task robustness transferabilitt": At the pretraining stage, a feature encoder learned over 'pretext' task for which ground-truth is available for free, while finetuning is typically carried out on a new downstream task. Spurred by the above, we ask the following questions:
learning, self-
Will CL improve adversarial robustness using just standard linear finetuning?
What are the principles that CL should follow to preserve robustness across tasks?
What are the insights can we acquire from self-supervised robust representation learning?
4 Proposed Approach: Adversarial Contrastive Learning (ADvCL)
In this section, we develop a new adversarial CL framework,
Robustness-aware View Selection
High Frequancy
Component
ADVCL, which includes two main components, robustness- aware view selection and pseudo- supervision stimulus generation. In particular, we advance the view selection mechanism by taking into account proper frequency- based data transformations that are beneficial to robust represen- tation learning and pretraining generalization ability. Further- more, we propose to design and integrate proper supervision stim- ulus into ADVCL so as to im- prove the cross-task robustness transferability since robust rep- resentations learned from self- supervision may lack the class-discriiinative ability required for robust predictions on downstream tasks. We provide overview of ADVCL in Figure 2.
Feature
Adversarial Contrastive CaPy
Unlabeled Images
Encoder
fo
2
Same
ADVCL Loss: a + A C
View Selection
Networi
Foature
Encoder
Classifee
Adversarial Loss: Ce
Head
Age
Clustrring
CLUSTERFIT
Encoder
fp
Latent Represenrationss
Pseudo Labels
Pseudo-supervision Stimulus Generation
Figure 2: The overall pipeline of ADVCL. It mainly has two ingredients: robustness- -ware view selection (orange box) and stimulus generation (blue box). The view selection mechanism is ad- vanced by high frequency components, and the supervision stimulus is created by generating pseudo labels for each image through CL.US- TERFIT. The pseudo label (in yellow color) can be created an offline manner and will not increase the computation overhead.
4.1 View selection mechanism
In contrast to standard CL, we propose two additional contrastive views: the adversarial view and the frequency view, respectively.

---

Multi-view CL loss Prior to defining new views, we first review the NT-Xent loss and its multi- view version used in CL. Following notations defined in Sec. the contrastive loss with respect to (w.r.t) positive pair (n (n(()) (2)) of each (unlabeled) data is given by
2
exp (sim 2,)/0)
(z)( = JEP()
log
(4)
exp (sim (2, 2t)/t
(EN(()
where recall that 2; 9 (z)) is the projected feature under the ith view, P(i) is the set of positive views except i (e.g., P(i) = [2] if Nii) denotes the set augmented batch data except the point (2)) the cardinality of (1d) is (2b 12) (for a data batch of size under 2 views), sim 222) denotes the cosine similarity between representations from two views the same data, exp denotes exponential function, sim(..- -) is the cosine similarity between two points, and t 0 is temperature parameter. The two-view CL objective can be further extend to the multi-view contrastive
loss [51]
exp (sim( 25. 2y)/t)
lCL 12)2) mm) =
Σ 1= JEP())
log
exp (sim (2t, /t)
kEV(()
where P(i) [m] denotes the m positive views except i, [m] denotes the integer set and (i),, with cardinality (bm- 1), denotes the set of m-view augmented b batch samples except the point (x).
21, , m).
Contrastive view from adversarial example Existing methods proposed in [27-29] be ex- plained based on (4): An adversarial perturbation 8 w.r.t. each view of a sample x is generated by maximizing the contrastive loss:
6 argmax (rgmmx(cl(T(()) (1, 62).
(6)
|
A solution to problem (6) eventually yields a paired perturbation view (TI (z) + 8j, T2(x) However, the definition of adversarial view (6) used in [27-29] may be proper. First, standard CL commonly uses aggressive data transformation that treats small portions of images as positive samples of the full image [36]. Despite its benefit promoting generalization, crafting perturbations over such aggressive data transformations may not be suitable for defending adversarial attacks applied to full images the adversarial context. Thus, a new adversarial view built upon xr rather than (2:) is desired. Second, the contrastive loss (4) is only restricted to two views of the same data. As will evident later, the multi-view contrastive loss also needed when taking into account multiple robustness wobustness-roomoting views. Spurred by above, modifying the existing data augmentations (T (z), T2(x)). This leads to the following adversarial perturbation generator by maximizing a 3-view contrastive loss
(x)+ + dz).
define the adversarial view over æ, without
8" argmax fCL ( (T) (2)) S
where x + 8t regarded as the third view of x.
Contrastive view from higu-fryy component Next, the high-frequeny" component (HFC) of data as another additional contrastive view. The rationale arises from the facts that 1) learning over HFC of data is main cause of achieving superior generalization ability [52] and 2) an adversary typically concentrates on HFC when manipulating an example to fool model's decision [53]. Let F and F-1 denote Fourier transformation and its inverse. An input image can then be decomposed into its HFC Tn and low-frequency component (LFC) zn;
Ih F (g.),
I =F)
[@h, 9] F(x).
In (8), the distinction between Qh and qi is made by hard thresholding operation. Let qi..)) denote the (i.j)th element of F(r), and c = (C1, 02) denote the centriod of the frequency spectrum. The components qI and qu in (8) are then generated by filtering out values according to the distance from (i.j) = 1I (e)))))))))))))) q(i,j). and (i. = (p((().))((cqee)))s)) q(.,j).. where d(- is the Euclidian dístance between two spatial coordinates, is a pre-defined distance threshold (r in all our experiments), and 1l {0, 1} is an indicator function which equals to 1 if the condition within [:] is met and 0 otherwise.
5

---

Robustness-aware contrastive learning objective By incorporating the adversarial perturbation 8 and disentangling HFC 2n, from the original data z, we obtain a four-view contrastive loss (5) defined over (n (z). T2 (2), + )h).
pady (0; X) == BEE max (x), (2()) r2(x), + 2,; 0);
(9)
where recall that X' denotes the unlabeled dataset, > is perturbation tolerance during training, and for clarity, the four-view contrastive loss (5) is explicitly expressed as a function of model parameters 0. As will be evident latter, the eventual learning objective ADVCL will be built upon (9).
4.2 Supervision stimulus generation: ADVCL empowered by CLUSTERFIT
On top of (9), we further improve the robustness transferability of learned representations by gen- erating proper supervision stimulus. Our rationale that robust representation could lack the clas--dscriminnative power required by robust classification as the former is acquired by optimizing an unsupervised contrastive loss while the latter achieved by a supervised cross-entropy CE loss. However, there is no knowledge about supervised data during pretraining. In order to improve cross- task robustness transferability but without calling for supervision. we take advantage of CLUSTERFIT [54], a pseudo-label generation method used in representation learning.
To be more concrete, let fpre denote pretrained representation network that can generate latent features of unlabeled data. Note that free can be set available beforehand and trained over either supervised or unsupervised dataset D Prres e.g., ImageNet using using CL in experiments. Given (normalized) pretrained data representations (r) CLUSTERFIT uses K-means clustering to find K data clusters of X, and maps a cluster index e to a pseudo-label, resulting in the pseudo- labeled dataset {(x, c) E L}. By integrating CLUSTERFIT with (9), the eventual training objective of ADVCL is then formed by
min 0
radv 2)) + X min E (a,ee max (or( o So(x + 8ce), c), se
(10)
0.0g
Pseudo clussifccaiion enahled regularization
where X' denotes the pseudo-labeled dataset of X. da. denotes a prediction head over fa. and À >>> 0 a regularization parameter that strikes a balance between adversarial contrastive training and pseudo-label stimulated AT. When the number of clusters K is not known priori, we extend (10) to an ensemble version over n choices of cluster numbers {K,..., Kn)- J. Here each cluster number K; paired with a unique linear classifier Φ; to obtain the supervised prediction &; ʃ (using cluster labels). The ensemble CE loss, given by the average of n individual losses, is then used in (10). Our experiments show that the ensemble version usually leads to better generalization ability.
Experiments
In this section, demonstrate the effectiveness of our proposed ADVCL from the following aspects: (1) Quantitative results, including cross-task tooss-task robustness transferability, cross- dats-ett robustmess transferability, and robustness against PGD attacks [11] and Auto-Attacks [37]; (2) Qualitative results, including representation t-SNE [55], feature inversion map visualization, and geometry of loss landscape; (3) Ablation studies of ADVCL, including finetuning schemes, view selection choices, and supervision stimulus variations.
Experiment setup We consider three robustness evaluation metrics: (1) Auto-attack accuracy (AA), namely, classification accuracy over adversarially perturbed images via Auto-Attacks (2) Robust accuracy (RA), namely, classification accuracy over adversarially perturbed images via PGD attacks; and (3) Standard accuracy (SA). namely, standard classification accuracy over benign images without perturbations. We use ResNet- 18 for the encoder architecture of fo in CL. Unless specified otherwise, we use 5-step too projected gradient descent (PGD) with e 8/255 to generate perturbations during pretraining, and use Auto-Attack and 20-step fx PGD with e = 8/255 to generate perturbations in computing AA and RA at test time. We will compare ADVCL with the CL-based adversarial pretraining baselines, ACL [27], RoCL [28], (non-CL) self-supervised adversarial learning baseline AP-DPE [26] and the supervised AT baseline [1]].
5.1 Quantitative Results
Overall performance from pretraining to finetuning (across tasks) In Table 1, we evaluate the robustness of a classifier (ResNet-18) finetuned over robust representations learned by different

---

Table 1: Cross-task performance of ADVCL (in dark gray color), compared with supervised (in white color) and self supervuie (in light gray color) baselines, in terms of AA, RA and SA CIFAR- with ResNet- 18. pretrained models are evaluated under the standard linear finetuning (SLF) setting and adversarial full finetuning (AFF) setting. The top performance highlighted bold.
Pretraining Method
Finetuning Method
CIFAR-I0
CIFAR-I00
AA(%)
RA(%)
SA(%)
AA(%)
RA(%)
SA(%)
Supervised
42.22
44.4
79.77
19.53
23.41
50.53
Standard
AP-DPE[26]
16.07
18.22
78.30
4.17
6.23
47.91
linear
RoCL[28]
28.38
39.54
79.90
8.66
18.79
49.53
finetuning
ACL[27]
39.13
42.87
77.88
16.33
20.97
47.51
(SLF)
ADVCL (ours)
42.57
50.45
80.85
19.78
27.67
48.34
Supervised
46.19
49.89
79.86
21.61
25.86
52.22
Adversarial
AP-DPE[26]
48.13
51.52
81.19
22.53
26.89
55.27
full finetuning (AFF)
RoCL|28]
47.88
51.35
81.01
22.38
27.49
55.10
ACL[27]
49.27
52.82
82.19
23.63
29.38
56.61
ADVCL (ours)
49.77
52.77
83.62
24.72
28.73
56.77
supervised//sel--uuerrve pretraining approaches over CIFAR-I0 and CIFAR-100. We focus on two representative finetuning schemes: the simplest standard linear finetuning (SLF) and the end-to-end adversarial full finetuning (AFF). As we can see, the proposed ADVCL method yields substantial improvement over almost all baseline methods. Moreover, ADVCL. improves robustness and standard accuracy simultaneously.
Robustness transferability across datasets In Table 2, we next evaluate the robust- ness transferability across dif- ferent datasets, where A B denotes the transferability from pretraining on dataset A to finetuning on another dataset B (# A) of represen- tations Iearned by ADVCL. Here the pretraining setup is consistent with Table 1. We observe that ADVCL yields better robustness well standard accuracy than almost all baseline approaches under both SLF and AFF finetuning settings. In the case of CIFAR-100 - STL-10, although ADVCL yields 0.89%
Table 2: Cross-dataset performance of ADVCL (dark gray color), compared with supervised (white color) and self-supervised (light gray) baselines, in AA, RA. SA, on STL-10 10 with R
Method
Fine- tuning
CIFAR-10 + STL-10
CIFAR-100 - STL-10
AA(%)
RA(%)
SA(%)
AA(%)
RA(%)
SA(%)
Supervised
22.26
30.45
54.70
19.54
23.63
51.11
RaCI]288
SLF
18.65
28.18
54.56
12.39
21.93
47.86
ACL[27]
25.29
31,80
55.81
21.75
26.32
45.91
AnyCL. (ours)
25.74
35.80
63.73
20.86
30.35
50.71
Supervised
10
36.7
62.78
29.18
32.43
55.85
RoCL[28]
29.40
34,65
61.75
27.55
31.38
57.83
AFF
ACL[27]
32.50
35.93
62.65
28.68
32.41
57.16
(ours)
30.51
33.70
AA drop compared ACL [27], it yields much better SA with 4.8% improvement.
Supervised RoCL -4-ACL - (Durs)
Robustness evaluation attack strength It was shown in [56]
30.9
70
that adversarial defense that causes obfuscated gradients results
(RA 50
50
60,0
50.5
in false sense model robustness, The issue of obfuscated gradients typically comes with two 'side ef- fects': (a) The success rate of PGD attack ceases be improved the -nom perturbation radius in- creases: (b) larger number of PGD steps fails to generate stronger adversarial examples. Spurred by the above, Figure shows the finetuning performance of ADVCL (using SLF) as function of the perturbation size and the PGD step number. As we can see, ADVCL. is consistently more robust than the baselines at all different PGD settings for significant margin.
40
E
50.5
50.0
43.7
20.4
5.22
35.6
Number PSD Attock Steos
PGD Epsilon (/235)
Figure 3: RA of ADVCL and baseline approaches under various PGD attacks. SLF is applied to the pretrained model.

---

5.2 Qualitative Results
Class discrimination of learned representations To further demonstrate the efficacy of ADVCL, Figure 4 visualizes the representations learned by self-supervision using t-SNE [55] on CIFAR-10. We color each point using its ground-truth truth label. The results show representations learned by ADVCL have a much clearer class boundary than those learned with baselines. This indicates that ADVCL makes an ad adversary difficult to successfully perturb an image, leading to a more robust prediction.
(a) RoCL [28]
(b) ACL [27]
ADVCL (ours)
Figure 4: t-SNE visualization of representations learned with different self-supervised pretraining
approaches. Our ADVCL gives much clearer separation among classes than baseline approaches.
Seed Ieagge
ACE
Alr
Visual interpretability of learned representa- tions Furthermore, demonstrate the advan- tage of our proposals from the perspective of model explanation, characterized by feature in- version map (FIM) [57] of internal neurons' re- sponse. The work [18, 58, 59] showed that model robustness offered by supervised AT and its vari- ants enforces hidden neurons learn perceptually- aligned data features through the lens of FIM. However, it remains unclear whether or not self- supervised robust pretraining is able to render ex- plainable internal response. Following [57, 58), acquire FIM of the ith component of represen- tation vector by solving the optimization problem #FIM mins [zo A)Js. where is ran- domly selected seed image, and [:Is denotes the ith coordinate of vector. Figure shows that compared to other approaches. more similar texture-aligned features can be acquired from a neuron's feature representation of the network trained with method regardless of the choice of seed images.
Figure 5: FIM visualization of neuron 502 under CIFAR-10 using different robust training methods. Column contains different seed images to generate FIM. Columns 2-5 are FIMs using models trained with different approaches.
Flatter loss landscape implies better transferability It has been shown in [60] that the flat- ness of loss landscape is a good indicator for superb transferability in the pretraining + finetuning paradigm. Motivated by that, Figure 6 presents the adversarial loss landscape of ADVCL and other self-supervised pretraining approaches under SLF, where the loss landscape drawn using the method in [61]. Note that instead of standard CE loss, visualize the adversarial loss w.r.t. model weights. As we can see, the loss for ADVCL has much flatter landscape around the local optima, whereas the losses for the other approaches change more rapidly. This justifies that proposal has a better robustness transfcrability than baseline approaches.
130
420
500
300
422
132
-321
4380
0327
2327
435
+313
-32
400
4.2
150
+100
64
100
+000
45
+35
415
4.4
19
(a) RoCL [28]
(b) ACL [27]
(c) ADVCL(ours)
Figure 6: Visualization of adversarial loss landscape w.t.. model weights using different supersupe
pretraining methods, ADVCL gives a much flatter landscape than the other baselines.

---

Table 3:
Performance (RA and SA) of ADVCL (in dark gray color) and bascline approaches on CIFAR- 10, under different lincar finctuning strate- gies: SLF and adversarial lincar finetuning (ALF).
Table 5: Performance (RA and SA) of ADVCL using various pretrained models fpee and cluster numbers K' in CLUSTERFIT, as well as the baseline w/o using CLUSTERFIT. The sctup of fpre is specified by the training method (supervised training SimCLR) and training dataset (ImageNet or CIFAR-10). ADVCL is implemented using unlabeled data from CIFAR-10 under ResNet- 18, together with SLF over the acquired
Method
SLF
ALF
RA(%)
SA(%)
RA(%)
SA(%)
Supervised
44,40
79.77
46.75
79.06
RoCL[28]
39.54
79.90
43.11
77.33
ACI|27]
42.87
77.88
45.40
77.71
feature encoder for supervised CIFAR- 10 classification.
ADVCL(ours)
50.45
80.85
$2.01
79.39
Table 4: Performance (RA and SA) of ADvCL us- ing different contrastive views setups. ResNet-18 is the backbone network, CIFAR- 10 is the datasct,
fae setup: (catasel, training)
Cluster number R
RA (%)
SA (%)
N/A
w/o CLUSTERFrT
48.89
77.73
and SLF is used for classification.
(CIFAR-IO, SimCLR)
10
50.10
80.34
100
49.21
79.52
Contrastive Views
RA(%)
SA(3)
(InaggNeet supervised)
10
50.16
78.27
7(t) 72(3
42.12
77.07
100
49.27
Tlla) 72(2)
42.48
73.12
2
50.09
79.72
T((a)) + (2(2) 62 mz)
43.51
74,22
10
50.12
79.93
x- 6-6,n (2),
50.19
80.17
(ImageNer, SimCLR)
50
49.27
79.55
6, (.). m
49.51
79.83
100
49.16
79.07
x- 6, m.). T2 m.
50.03
80.
500
49.03
78.96
(z), ra
50.45
80.85
Ensemble
50.45
80.85
5.3 Ablation studies
Linear finetuning types We first study the robustness difference when different linear finetuning strategies: Standard linear finetuning (SLF) and Adversarial linear finetuning (ALF) are applied. Table 3 shows the performance of models trained with different pretraining methods. As we can see, our ADVCL achieves the best performance under both linear finetuning settings and outperforms baseline approaches in a large margin. We also note the performance gap between SLF and ALF induced by our proposal ADVCL is much smaller than other approaches, and ADVCL with SLF achieves much better performance than baseline approaches with ALF. This indicates that the representations learned by ADVCL is already sufficient to yield satisfactory robustness.
View selection setup We illustrate how different choices of contrastive views influence the ro- bustness performance of ADVCL in Table 4. The first 4 rows study the effect of different types of adversarial examples in contrastive views, and our proposed 3-view contrastive loss (7) significantly outperforms the other baselines, as shown in row 4. The rows in gray show the performance of further exploring different image frequency components (8) as different contrastive views. is clear that the use of HFC leads to the best overall performance, as shown in the last row.
Supervision stimulus setup We further study the performance of ADVCL using different supervi- sion stimulus. Specifically, we vary the pretrained model for Spre and pseudo cluster number K when training ADVCL and summarize the results in Table 5. The results demonstrate that adding the super- vision stimulus could boost the performance of ADVCL. We also observe that the best result comes from free pretrained on Imagenet using SimCLR. This is because such representations could general- ize better. Moreover, the ensemble scheme over pseudo label categories K E {2, 10, 50, 100, 500} yields better results than using a single number of clusters. The ensemble scheme also makes ADVCL less sensitive to the actual number of labels for the training dataset.
Conclusion
In this paper. we study the good practices in making contrastive lcarning robust to adversarial examples. We show that adding perturbations original images and high-frequency components are two beneficial factors. We further show that proper supervision stimulus could improve model robustness. Our proposed approaches can achieve ofate-of-the-are robust accuracy as well as standard accuracy using just standard linear finetuning. Extensive experiments involving quantitative and qualitative analysis have also been made not only to demonstrate the effectiveness of our proposals but also to rationalize why it yields superior performance. Future works could be done to improve the scalability of our proposed sulf-supe pretraining approach to very large datasets and models to further boost robust transferabilty across datasets.

---

References
[1] Fatemeh Vakhshiteh, Raghavendra Ramachandra, and Ahmad Nickabadi, "Threat of adversarial attacks face recognition: A comprehensive survey," arXiv preprint arXiv:2007.11709, 2020.
[2] Xingjun Ma, Yuhao Niu, Lin Gu, Yisen Wang, Yitian Zhao, James Bailey, and Feng Lu, "Understanding adversarial attacks deep learning based medical image analysis systems," Pattern Recognition, vol. 110, pp. 107332, 2021.
[3] Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Fan, Mengshu Sun, Hongge Chen, Pin- Yu Chen, Yanzhi Wang, and Xue Lin, "Adversarial t-shirt! evading person detectors in physical world," in European Conference on Computer Vision. Springer, 2020, pp. 665-681.
[4] Ji Lin, Chuang Gan, and Song Han, "Defensive quantization: When efficiency meets robustness." ICLR, 2019.
[5) Yulong Cao, Chaowei Xiao, Dawei Yang, Jing Fang, Ruigang Yang, Mingyan Liu, and Bo Li, "Adversarial objects against lidar-based autonomous driving systems," arXiv preprint arXiv:1907.05418, 2019.
[6] Ian Goodfellow, Jonathon Shlens, and Christian Szegedy, "Explaining and harnessing adver- sarial examples." International Conference Learning Representations, vol. arXiv preprint arXiv:1412.65722 2015.
[7] Nicholas Carlini and David Wagner, "Towards evaluating the robustness of neural networks," in Security and Privacy (SP), 2017 IEEE Symposium on. IEEE, 2017, pp. 39-57.
[8] Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, 7. Berkay Celik, and Ananthram Swami, "The limitations of deep learning in adversarial settings," " in Security and Privacy (EuroS&P), 2016 IEEE European Symposium on. IEEE, 2016, pp. 372-387.
[9] Pin-Yu Yu Chen, Yash Sharma, Huan Zhang, Jinfeng Yi, and Cho-Jui Hsich, "EAD: clastic- net attacks to deep neural networks via adversarial examples," in Proceedings of the AAAI Conference on Artificial Intelligence, 2018, pp. 10-17.
[10] Kaidi Xu, Sijia Liu, Pu Zhao, Pin-Yo Yu Chen, Huan Zhang, Quanfu Fan, Deniz Erdogmus, Yanzhi Wang, and Xue Lin, "Structured adversarial attack: Towards general implementation and better interpretability." in International Conference on Learning Representations, 2019.
[11] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu, "Towards deep learning models resistant to adversarial attacks," 2018 ICLR, vol. arXiv preprint trXiv:1706006083, 2018.
[12] Harini Kannan, Alexey Kurakin, and Ian Goodfellow, "Adversarial logit pairing." 2018.
[13] Andrew Slavin Ross and Finale Doshi-Velez, "Improving the adversarial robustness and interpretability of deep neural networks by regularizing their input gradients," in Thirty-second AAAI conference artificial intelligence, 2018.
[14] Jingkang Wang, Tianyun Zhang, Sijia Liu, Pin- Yu Chen, Jiacen Xu, Makan Fardad, and Bo Li, "Towards a unified min-max framework for adversarial exploration and robustness," arXiv preprint arXiv: 1906.09900035662 2019.
[15) Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Jonathan Uesato, and Pascal Frossard, "Robustness via eurvature regularization, and vice versa," " in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2019, pp. 9078-90886
[16] Yisen Wang, Xingjun Ma, James Bailey, Jinfeng Yi, Bowen Zhou, and Quanquan Gu, "On the convergence and robustness of adversarial training." in International Conference on Machine Learning, 2019, pp. 6586-6595.
[17] Jiefeng Chen, Xi Wu, Vaibhav Rastogi, Yingyu Liang, and Somesh Jha, "Robust attribution regularization," in Advances in Neural Information Processing Systems, 2019, pp. 14300-14310.
10

---

[18] Akhilan Boopathy, Sijia Liu, Gaoyuan Zhang, Cynthia Liu, Pin- Yu Chen, Shiyu Chang. and Luca Daniel, "Proper network interpretabllity helps adversarial robustness in classification," in ICMI., 2020.
[19] Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein, "Adversarial training for free!," in Advances in Neural Information Processing Systems, 2019, pp- 3353-3364.
[20] Dinghuai Zhang, Tianyuan Zhang, Yiping Lu, Zhanxing Zhu, and Bin Dong, "You only propagate once: Accelerating adversarial training via maximal principle," arXiv preprint arXiv:1905.00877, 2019.
[21] Eric Wong, Leslie Rice, and J. Zico Kolter, "Fast is better than free: Revisiting adversarial training." in International Conference on Learning Representations, 2020.
[22] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P Xing, Laurent El Ghaoui, and Michael I Jordan, "Theoretically principled trade-off between robustness and accuracy," International Conference on Machine Learning, 2019.
[23] Yair Carmon, Aditi Raghunathan. Ludwig Schmidt, Percy Liang, and John C Duchi, "Unlabeled data improves adversarial robustness," arXiv preprint arXiv:1905.13736 2019.
[24] Runtian Zhai, Tianle Cai, Di He, Chen Dan, Kun He, John Hopcroft, and Liwei Wang, "Adversar- ially robust generalization just requires more unlabeled data," arXiv preprint arXiv:1906.0055: 2019.
[25] Dan Hendrycks, Mantas Mazeika, Saurav Kadavath, and Dawn Song, "Using self-supervised learning can improve model robustness and uncertainty," arXiv preprint urXiv:/9000 /2340, 2019.
[26] Tianlong Chen, Sijia Liu, Shiyu Chang, Yu Cheng, Lisa Amini, and Zhangyang Wang, "Ad- versarial robustness: From self self-supervised pre-training to fine-tuning," in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020, pp. 699-708.
[27] Ziyu Jiang, Tianlong Chen, Ting Chen, and Zhangyang Wang, "Robust pre-training by adver- sarial contrastive learning." arXiv preprint arXiv:2010.13337, 2020.
[28] Minseon Kim, Jihoon Tack, and Sung Ju Hwang, "Adversarial self-supervised contrastive learning," arXiv preprint arXiv:2006. 07589, 2020.
[29] Sven Gowal, Po-Sen Huang, Aaron van den Oord, Timothy Mann, and Pushmeet Kohli, "Self-supervised adversarial robustness for the low-label, high-data regime." in International Conference on Learning Representations, 2021.
[30] Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton, "A simple framework for contrastive learning of visual representations," in International conference on machine learning. PMLR, 2020. pp. 1597-1607.
[31] Jean-Bastien Grill, Florian Strub, Florent Altché, Corentin Tallec, Pierre H Richemond, Elena Buchatskaya, Carl Doersch, Bernardo Avila Pires, Zhaohan Daniel Guo, Mohammad Gheshlaghi Azar, et al., "Bootstrap your own latent: A new approach to self-supervised learning," arXiv preprint arXiv:2006.00733, 2020.
[32] Yonglong Tian, Chen Sun, Ben Poole, Dilip Krishnan, Cordelia Schmid, and Phillip Isola, "What makes for good views for contrastive learning." arXiv preprint arXiv:2005. 10243, 2020.
[33] Tongzhou Wang and Phillip Isola, "Understanding contrastive representation learning through alignment and uniformity on the hypersphere," in International Conference on Machine Learning. PMLR, 2020, pp. 9929-9939.
[34] Xinlei Chen, Haoqi Fan, Ross Girshick, and Kaiming He, "Improved baselines with momentum contrastive learning," arXiv preprint wxXiv:2003.042977 2020.

---

[35] Priya Goyal, Dhruv Mahajan. Abhinav Gupta, and Ishan Misra, "Scaling and benchmarking self- supervuue visual representation learning." in Proceedings of the IEEE/CVF International Conference Computer Vision, 2019, pp. 6391-6400.
[36] Senthil Purushwalkam and Abhinav Gupta, "Demystifing contrastive self-supervised learning: Invariances, augmentations and dataset biases," arXiv preprint vVXiv22007.13116 2020.
[37] Francesco Croce and Matthias Hein, "Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks," in International Conference on Machine Learning. PMLR, 2020, pp. 2206-2216.
[38] Spyros Gidaris, Praveer Singh, and Nikos Komodakis, "Unsupervised representation learning by predicting image rotations," arXiv preprint arXiv:/803.07728, 2018.
[39] Mehdi Noroozi and Paolo Favaro, "Unsupervised learning of visual representations by solving jigsaw puzzles," in European Conference on Computer Vision. Springer, 2016, pp. 69-84.
[40] Fabio M Carlucei, Antonio D D'Innocente, Silvia Bucci, Barbara Caputo, and Tatiana Tommasi, "Domain generalization by solving jigsaw puzzles," " in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2019, pp. 2229-2238.
[41] Chuang Gan, Boqing Gong, Kun Liu, Hao Su, and Leonidas J Guibas, "Geometry guided convolutional neural networks for self-supervised video representation learning," in CVPR, 2018, pp. 5589-5597
[42] Trieu Trinh, Minh Than-T Luong, and Quoc V Le, "Selfie: Self-supervised pretraining for image embedding," arXiv preprint (eee:::000099990 2019.
[43] Aaron van den Oord, Yazhe Li, and Oriol Vinyals, "Representation learning with contrastive predictive coding," arXiv preprint arXiv: 1807.03788, 2018.
[44] Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick, "Momentum contrast for unsupervised visual representation learning." in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020, pp. 9729-9738.
[45] Ting Chen, Simon Kornblith, Kevin Swersky, Mohammad Norouzi, and Geoffrey Hinton, "Big self-supervised models are strong semi-supervised learners," " arXiv preprint arXiv:2006. 10029, 2020.
[46] Xinlei Chen and Kaiming He, "Exploring simple siamese representation learning." arXiv preprint arXiv:2011. 2020.
[47] Eric Wong and J Zico Kolter, "Provable defenses against adversarial examples via the convex outer adversarial polytope," arXiv preprini 1rXiv:1711.0085:1 2017.
[48] Krishnamurthy Dvijotham, Sven Gowal, Robert Stanforth, Relja Arandjelovic, Brendan O'Donoghue, Jonathan Uesato, and Pushmeet Kohli, "Training verified learners with learned verifiers," arXiv preprint 1rXiv:1805.10265 2018.
[49] Chuang Gan, Ting Yao, Kuiyuan Yang. Yi Yang, and Tao Mei, "You lead, we exceed: Labor- free video concept learning by jointly exploiting web videos and images," in CVPR, 2016, pp. 923-932.
[50] Chuang Gan, Chen Sun, Lixin Duan, and Boqing Gong, "Webly-supervised video recognition by mutually voting for relevant web images and web video frames," in ECCV, 2016, pp. 849-866.
[51] Prannay Khosla, Piotr Teterwak, Chen Wang, Aaron Sarna, Yonglong Tian, Phillip Isola, Aaron Maschinot, Ce Liu, and Dilip Krishnan, "Supervised contrastive learning." arXiv preprint arXiv:2004.11362 2020.
[52] Haohan Wang, Xindi Wu, Zeyi Huang, and Eric P Xing. "High-frequency component helps explain the generalization of convolutional neural networks," in Proceedings of the IEFF/CVF Conference Computer Vision and Pattern Recognition, 2020, pp. 8694.
12

---

[53] Zifan Wang, Yilin Yang. Ankit Shrivastava, Varun Rawal, and Zihao Ding, "Towards frequency- based explanation for robust enn," arXiv preprint Stt::2005.031441 2020.
[54] Xueting Yan, Ishan Misra, Abhinav Gupta, Deepti Ghadiyaram, and Dhruv Mahajan, "Clus- terfit: Improving generalization of visual representations." in Proceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognition, 2020, pp. 6509-6518.
[55] Laurens Van der Maaten and Geoffrey Hinton, "Visualizing data using t-sne."" Journal of machine learning research, vol. 9, no. 11, 2008
[56] Anish Athalye, Nicholas Carlini, and David Wagner, "Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples," arXiv preprint 1802. 00420, 2018.
[57] Aravindh Mahendran and Andrea Vedaldi, "Visualizing deep convolutional neural networks using natural pre-images," International Journal of Computer Vision, vol. 120, no. 3, pp. 233-255, 2016.
[58] Logan Engstrom, Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Brandon Tran, and Aleksander Madry, "Adversarial robustness prior for learned representations, arXiv preprint arXiv: 19X6::9906.00945, 2019.
[59] Simran Kaur, Jeremy Cohen, and Zachary C Lipton, "Are perceptuully-atigned gradients a general property of robust classifiers?," arXiv preprint arXiv: 2019.
[60] Hong Liu, Mingsheng Long, Jianmin Wang, and Michael Jordan, "Towards understanding the transferability of deep representations," arXiv preprint arXiv: 120311 2019.
[61] Hao Li, Zheng Xu, Gavin Taylor, Christoph Studer, and Tom Goldstein, "Visualizing the loss landscape of neural nets," arXiv preprint arXiv: arXiv:1712.09913. 2017.
[62] Angus Galloway, Anna Golubeva, Thomas Tanay, Medhat Moussa, and Graham W Taylor, "Batch normalization is cause of adversarial vulnerability," arXiv preprint arXiv:1955.02166 2019.
[63] Tianyu Pang. Xiao Yang, Yinpeng Dong. Hang Su, and Jun Zhu, "Bag of tricks for adversarial training." arXiv preprint arXiv:2010.0000 20460000, 2020.
13


Reviews:
[{"review_id": "zyfS-A0WABd", "reviewer": "Reviewer_gD15", "summary": "The submission investigates the adversarial robustness of self-supervised pretraining using contrastive learning with the NT-Xent loss [29]. The goal is to improve robustness of the pretraining step such that a linear classifier suffices to be fine-tuned for state-of-the-art performance, and to increase robustness across tasks. The proposed design, AdvCL, extends the loss formulation to contain four designed views (Eq. 9), as well as a supervision stimulus based on K-means clustering [50]. Experimental results show that the resulting system significantly increases adversarial robustness in the self-supervised setting. The paper also contributes a visualization of qualitative results as well as an ablation study of some of the key parameters.", "questions": "", "limitations": "", "rating": 7, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The submission builds upon both adversarial training [10, etc.] as well as contrastive learning [29] for its loss and min-max training formulation, and extends these in the ways described above. It is not the first work to tackle the problem of self-supervised adversarial training (the authors cite [26, 27] as relevant related work). Overall originality is medium, since the proposed approach is a novel combination of existing elements -- but this is not a problem, since the resulting system is both well-designed and reasonably well motivated.\nMoving adversarial training toward less supervision (self-supervised, unsupervised) as well as making it easier to use (i.e. without full finetuning) are both of high interest for the machine learning community. The paper does not offer any significant insights on adversarial training processes itself, but overall relevancy quite high.\n\nThe paper is generally very well written and easy to understand. Its sections are also well structured: introduction and related work lead to a clear formulation of the research questions, then the proposed system design, and finally a detailed evaluation. \n \nThe contributions themselves are well motivated and experimental results are overall convincing. However, I would have wished to see an ablation study on parameter \\lambda; what happens when the supervision stimulus is not used at all, for example? Or how does the system perform without the proposed view selection? Separating these two contributions clearly in the experimental evaluation would have made the extent of each contribution somewhat clearer.\n\nOverall this submission makes valuable contributions to advancing adversarial robustness in the laid out scenario and is of high enough quality to qualify for NeurIPS acceptance.\nA few clarifications would make the submission even stronger:\n- I thank the authors for providing footnote 1, which seems prudent. Does this footnote also imply that all presented experimental results were reproduced using either own implementations or code provided by the authors?\n- The experimental results are almost all provided on CIFAR-10 or CIFAR-100, whereas experimental results on (additionally) ImageNet would increase confidence in the proposed method. I do see ImageNet results in Table 5. What was the reason for not including ImageNet experiments (or experiments on yet another large-scale, more realistic data set) in the main results? Is this connected to the scalability limitations described on line 377?\n- What are the limitations described on line 377 in particular?\n\nMinor notes:\n- In lines 147 and 149, both \\theta and f_theta are described as \"feature encoder\". I recommend describing the former as \"feature encoder parameters\".\n- Both Equations 9 and 10 contain a minimization over \\theta. I believe this is superfluous in Equation 9; otherwise it would be a double minimization. And the loss term itself should not contain the type of optimization.\n\nThere are some typos which could have been avoided by a judicious spell check:\n- l. 42: 'fintuning' -> 'finetuning'\n- Caption Figure 1: 'pretrainig' -> 'pretraining'\n- l. 137: A citation seems to be missing.\n- l. 141: 'pretrianing' -> 'pretraining'\n- l. 188: 'mutli-view' -> 'multi-view'\n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "Yes, the authors have discussed the limitations of their work briefly in the conclusions, and the societal impact (which, in the eyes of this reviewer is not even applicable to this kind of work and amounts to guesswork) in the supplementary material.", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "3"}, "extra_text": {}}, {"review_id": "t4V-SD4Zcu", "reviewer": "Reviewer_NaYZ", "summary": "This paper proposes a unified adversarial contrastive learning framework. It proposes to improve the previous methods in the following ways: 1. Besides the previous augmentation methods, it proposes to utilize the high-frequency components as data augmentation to enhance the robustness. 2. It introduces the pseudo label for the pre-training task to mitigate the task difference between pre-training and fine-tuning for improving the transferability of the pre-training network. Many experiment result verifies the effectiveness of the proposed method. The author also offers ablation experiments to demonstrate the improvement brought by each component.", "questions": "", "limitations": "", "rating": 7, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Originality: This paper employs the pseudo-class prediction task for pre-training and shows it can largely improve the transferability of the pre-training model. This is novel to me. I only saw the literature employing the pre-training task as regularization during fine-tuning.\n\nQuality: The quality is overall good. Many experiments verify the effectiveness of the proposed method. Ablation studies also show the gain comes from each component. It would be better to see its performance on different backbones. There is only resnet18 here.\n\nClarity: The paper is overall well written and easy to follow.\n\nSignificance: The methods proposed in this paper significantly improve the transferability of the adversarial pre-trained model. Contributing to building a universal robust pre-training model.\n\nOther: While the method requires a $\\lambda$ to balance two loss terms, the value of $\\lambda$ is not discussed.\n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "I don't see other limitations except for the points I mentioned in the main review.\n\nNo negative societal impact.", "review_text": "", "extra_scores": {"ethical_concerns": "No ethical concerns.", "needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "3"}, "extra_text": {}}, {"review_id": "hentWZvFUNo", "reviewer": "Reviewer_p6Bp", "summary": "The focus of the paper is to make contrastive pre-training (e.g. SimCLR), which has seen great success in recent years, more robust to adversarial attacks. To this end, the authors propose AdvCL, which makes the following modifications to prior contrastive methods:\n1) high-frequency components of images are shown to be important for robustness and are leveraged when building the views.\n2) augmenting contrastive learning with \"pseudo-supervision\" obtained by clustering the features further improves performance.\nThe authors evaluate test accuracy on CIFAR10, CIFAR100, STL-10 under adversarial perturbations (AutoAttack and standard PGD) using both linear head fine-tuning and full fine-tuning and compare against recent SOTA methods. AdvCL seems to outperform the rest mostly across the board. Ablative studies are conducted.", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Overall, this paper checked all the boxes -- it was reasonably well-written, it had a solid experimental evaluation wherein the proposed method outperformed recent baselines, and ablations were conducted to shed more light on how AdvCL's inner workings. However, I have the following concerns:\n1) Only 3 vision datasets were used, and in-domain results were only on 2 (CIFAR10 and CIFAR100). Furthermore, AdvCL loses to Supervised (control) on CIFAR100 standard accuracy (Table 1), yet the AdvCL entry is bolded -- why is this? This is also the case in table 2, CIFAR-100 --> STL-10. If this is indeed true, then improving adversarial robustness using the proposed method can sometimes hurt accuracy in the non-adversarial setting, which is concerning. I would like to see performance on SVHN, MNIST, and maybe a couple others.\n2) Furthermore, the method is complex and begs the question -- are the gains reported really worth the complexity? It's quite feasible that many other alternatives of equal complexity and equal opportunity for hyper-parameter tuning can unlock the same gain. However, this may not be reason enough to reject the paper.\nPoint 1 is why I slightly lean against acceptance. If the authors elaborate on this and add a few more datasets, I would consider leaning in favor of acceptance.\n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "Yes.", "review_text": "", "extra_scores": {"ethical_concerns": "No ethical concerns.", "needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "1.5"}, "extra_text": {}}, {"review_id": "ef-sdgRxS4H", "reviewer": "Reviewer_5h6H", "summary": "This work analyzed the fine-tuning phase of unsupervised contrastive learning for adversarial robustness. Furthermore, they proposed AdvCL which is more robust than other unsupervised adversarial contrastive learning methods. They demonstrated that the model trained with this method shows discriminative and interpretable representations, flat loss landscape, and better transferability to other tasks.", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "In this work, the objective is to address the issue of forgetting adversarial robustness while training the classifier with supervised learning after training feature encoder with unsupervised learning. They pointed out the different results between standard linear fine-tuning and adversarial full fine-tuning. However, the connection between the issue and the proposed method (AdvCL) is ambiguous. Only clusterfit seems to be related to the issue, but it is intuitive. Additionally, the method showed better performance than other methods when combined with standard linear fine-tuning, but showed similar performance when combined with adversarial full fine-tuning. They focused on the efficiency of standard linear fine-tuning and showed the higher performance of proposed method when considering efficiency, but it seems to be not efficient to calculate the cross-entropy loss perturbation and/or the contrastive loss perturbation respectively when using clusterfit.\n\nThe main adversarial contrastive loss (equation (7)) is suitable to make one adversarial perturbation using several augmentations, and HFC is the proper example. However, the connection issue still exists and only clusterfit seems proper. But, if this is included the proposed method (AdvCL + clusterfit), the method should show better performance than other method with clusterfit (RoCL + clutserfit, ACL + clusterfit, …). Additionally, also for the HFC, it should show better performance than other method with HFC (inserting HFC as augmentation or into positive set).\n\nThe discussions about the results are inadequate. Specifically, the discussions about the results of qualitative results and the ablation studies are necessary. It is required to discuss at least roughly what each result means and why.\n\nMinor issues\n\n(1) Because the obfuscated gradients issues can be checked using the performance of AutoAttack, there is no need to put the sanity check result on the main paper.\n\n(2) In the method section, equation (4), it is confused that the input pair of similarity function of the denominator and the numerator. The inputs of the numerator may be $(\\tau_1(x_1), \\tau_2(x_1))$ and $(\\tau_2(x_1), \\tau_1(x_1))$, and the inputs of the denominator may be $(\\tau_1(x_1), \\tau_1(x_2))$, $(\\tau_1(x_1), \\tau_1(x_3))$,…,$(\\tau_1(x_1), \\tau_2(x_1))$, $(\\tau_1(x_1), \\tau_2(x_2))$ ,…, but cannot be sure.\n\n(3) There is no the transferability results for cifar10 ↔ cifar100 as in the RoCL paper.\n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "There is no limitation paragraph and exists a societal impact paragraph in Appendix. No negative societal impact. Several potential broader impact such as lightweight and efficient fine-tuning.", "review_text": "", "extra_scores": {"ethical_concerns": "No ethical concerns.", "needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "6 hours"}, "extra_text": {}}]

Author rebuttal:

Meta-review: With the increasing interest in both adversarial robustness and contrastive self-supervised learning, the paper studies a highly relevant problem at their intersection: how contrastive learning (CL) can be made to learn representations so that robustness is preserved when fine-tuning a linear classification head on top of these representations.

This indeed seems to be a setting that hasn't been explored before in the literature; however, to my knowledge such a setting in which we use standard linear fine-tuning is not commonly used (previous works such as SimCLR only use it to prove a point about the power of the learned representations from CL alone). Thus, I am willing to grant it here as well, as this provides us more insight into the robustness of the CL learned representations, and although one reviewer pointed out concerns about the higher runtime of the proposed procedure, this point may not be so important in this context. Also, as one reviewer pointed out, this may help encourage more light-weight fine-tuning if indeed the robustness can be transferred across tasks making adversarial robustness easier to use.

Moreover, the paper also provides a thorough experimental evaluation not only on the standard linear fine-tuning but also on the adversarially robust fine-tuning, shows that the proposed method (which appears to be an extension of ACL), is superior to previous methods with ablation studies.
Decision: Accept (Poster)