Enhance the Visual Representation via Discrete Adversarial Training
Authors: Xiaofeng Mao
YueFeng Chen
Ranjie Duan
Yao Zhu
Gege Qi
Shaokai Ye
Xiaodan Li
Rong Zhang
Hui Xue'
Venue: NeurIPS 2022 Accept (2022)
Keywords: Adversarial Training
Discrete Visual Representation
Robustness
Generalization

Abstract: Adversarial Training (AT), which is commonly accepted as one of the most effective approaches defending against adversarial examples, can largely harm the standard performance, thus has limited usefulness on industrial-scale production and applications. Surprisingly, this phenomenon is totally opposite in Natural Language Processing (NLP) task, where AT can even benefit for generalization. We notice the merit of AT in NLP tasks could derive from the discrete and symbolic input space. For borrowing the advantage from NLP-style AT, we propose Discrete Adversarial Training (DAT). DAT leverages VQGAN to reform the image data to discrete text-like inputs, i.e. visual words. Then it minimizes the maximal risk on such discrete images with symbolic adversarial perturbations. We further give an explanation from the perspective of distribution to demonstrate the effectiveness of DAT. As a plug-and-play technique for enhancing the visual representation, DAT achieves significant improvement on multiple tasks including image classification, object detection and self-supervised learning. Especially, the model pre-trained with Masked Auto-Encoding (MAE) and fine-tuned by our DAT without extra data can get 31.40 mCE on ImageNet-C and 32.77% top-1 accuracy on Stylized-ImageNet, building the new state-of-the-art. The code will be available at https://github.com/alibaba/easyrobust.

Enhance the Visual Representation via Discrete Adversarial Training
Xiaofeng Mao
Yuefeng Chen'
Ranjie Duan'
Yao Zhu
Gege Qit
Shaokai Ye
Xiaodan Li
Rong Zhang
Hui Xue
Alibaha Group, *Zhejiang University, SEPFI.
Moxf9,6449, chenyf, -aaaiiiba-aaaaabbbb-bbaaaaaa
Abstract
Adversarial Training (AT), which commonly accepted one of the most fective approaches defending against adversarial examples, can largely harm the standard performance, thus has limited usefulness on industrial-scale production and applications. Surprisingly, this phenomenon is totally opposite in Natural Language Processing (NLP) task, where AT can even benefit for generalization. We notice the merit of AT in NLP tasks could derive from the discrete and sym- bolic input space. For borrowing the advantage from NLP-style AT, we propose Discrete Adversarial Training (DAT). DAT leverages VQGAN to reform the image data to discrete text-like inputs, i.c. visual words. Then it minimizes the max- imal risk such discrete images with symbolic adversarial perturbations. We further give an explanation from the perspective of distribution to demonstrate the effectiveness of DAT. As a plug-and-pla technique for enhancing the visual representation, DAT achieves significant improvement on multiple tasks including image classification, object detection and self-supervised learning. Especially, the model pre-trained with Masked Auto-Encoding (MAE) and fine-tuned by our DAT without extra data can get 31.40 mCE ImageNet-C and 32.77% % top-1 accuracy on Stylized-ImageNet,, building the new state-of-the-att The code will be available at httpt::t///ttt https://githuub.c. com/ awwaaaaabbaaaaaaaaa eaabbobbstssobutt
Introduction
Nowadays, Deep Neural Networks (DNNs) has achieved excellent performance surpassing humans in most computer vision tasks. Although remarkable progress has been made, the success of DNNs is actually a false sense when i.i.d hypothesis not satisfied wild. Researchers have shown that deep models fail in most cireumstances including adversarial perturbations [I] common corruptions [2]. colors or textures changing human perception.
etc. There still a long way to make DNNs closer to the robust
possible way towards robust machine perception can Adversarial Training (AT) which automatically finds failure input cases of DNNs and augment online with these cases for fixing "bugs". With online augmentation of adversarial examples, AT greatly enhances the adversarial robustness. and helps for learning perceptually--ligne and transferability y However, AT double-edged, which meanwhile degrades the standard performance caused by problematic regularization [TO]. Such problematic regularization makes the decision boundaries over-smoothed and enlarges indecisive regions.
representations [ with good interpretability 7
Surprisingly, previous works [ 12 observe strange phenomenon that AT behaves conversely in Natural Language Processing (NLP) tasks. By automatically finding adversarial textual inputs,
*Corresponding author: Yao Zhu (E-maill: ee re_zhuy@een (hhueuzj..du..c)
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

AT will not hurt the accuracy and even benefit for both generalization and robustness of language models. This phenomenon motivates us considering whether the merit of NLP-style AT can be transferred to vision tasks. We notice such merit could derive from the unique data organizing form of language models. To be specific, an adversarial image perturbed in continuous pixel space actually differs with the truly "hard" examples appeared in real world. Contrarily, text space is discrete and symbolic, where adversarial text is practically existing when a typo is made by humans. Learning such adversarial text will obviously improve the generalization on other more texts with confusing typos. Therefore, we borrow the symbolic nature of languages, and apply it on CV tasks by discretizing continuous images into more meaningful symbolic space. Afterwards, AT is conducted for minimizing the maximal risk on such text-like inputs with symbolic adversarial perturbations.
In this paper, we propose Discrete Adversarial Training (DAT), a new type of adversarial training which aims to improve both robustness and generalization of vision models. DAT leverages VQ- GAN [13 to learn a vocabulary of visual words, also known as image codebook. For continuous image input, each encoded patch embedding is replaced with its closest visual word in the codebook, and represented as corresponding index. Then the image is transformed to a sequence of symbolic indices similar with language input. For generating adversarial examples based on such symbolic sequence, direct use of optimization methods in NLP like combinatorial optimization [14 IS [6 or synonym substitutions [14] 16 can be challenging. The reason lies in: 1) the large search space of images and 2) the non-existence of synonym in visual codebook. To make it more efficient, DAT adopts a crudient-based method which assumes the backward adversarial gradient goes straight- through the complex discretization process, thus gradients on discretized image can be copied to original input. Then it use one-step search along the direction of estimated gradient such that the discrete representation will altered adversarially during the discretization process, resulting a discrete adversarial examples. Finally the discrete adversarial examples is fed into models for training. Dif- ferent from AT which always adds Ip bound on augmented adversarial examples, DAT affects the discretization process to produce diverse adversarial inputs beyond l, bound for training. We show in ablation experiment that DAT not only enhances the robustness on Ip bounded attacks, but also is partly beneficial in defense of unrestricted semantic attacks [7 [8 The overall pipeline of discrete adversarial training is shown in Figure
We further give an analysis to explain the effectiveness of our DAT from the perspective of distribution. By comparing the distributional difference of training examples in AT and DAT with clean images, we find the discrete adversarial examples in our DAT are much closer to the clean distribution. Such ability of generating "in-distribution" adversarial examples makes DAT can improve the visual representation learning on multiple vision models and tasks, with no sacrificing of clean accuracy,
Our contributions are summarized below:
To the best of our knowledge, appear to be the first transfer the merit of NLP- style adversarial training to vision models, for improving robustness and generalization simultaneously.
We propose Discrete Adversarial Training (DAT), where images are presented as discrete visual words, and the model is training on example which has the adversarially altered discrete visual representation.
DAT achieves significant improvement on multiple tasks including image classification, object detection and self-supervised learning. Especially, it establishes new ottte-of-the-art for robust image classification. By combining MAE 19 pre-training and DAT fine-tuning, our ViT-Huge (20) achieves 31.40 mCE on ImageNet-C 2 and 32.77% top-1 accuracy on
-iizzede- 3
2 Related Work
Adversarial Training Adversarial Training (AT) is first proposed to improve robustness by training models with adversarial examples. As one of the most effective defense, existing works (21 22 have suggested a trade-off between adversarial and clean accuracy in AT. Despite great efforts 2 24! 25] have been made for mitigating this trade-off, the bad generalization of AT still cannot be fully remedied till now. In opposite way, some other works 226 27 use AT to improve the clean accuracy rather than adversarial robustness. The most close work to ours the AdvProp 26 which splits batch norms to prevent the mixed statistics of clean and adversarial

---

examples, thus learns better adversarial feature for generalization. Pyramid AT 28 makes AT specific ViTs by crafting pyramid perturbation with Dropout enabling, yielding imporved performance. However, these methods are only applicable under specific models or tasks. VIILLA 29 is also representation enhancement technique using AT. But contrary to us, it applies vision-style AT only for dssion-add-languag representation learning. AGAT KC is another kind of AT beyond pixel space, which perturbs images along attributes, however it has strict requirement of attributes annotation.
Adversarial Augmentation By borrowing the idea of AT, some previous works G1 propose to search augmentations adversarially for improving the hardness of training examples. Adversarial AutoAugment [31] uses augmentation policy network to produce hard augmentation
policies on pre-defined policy space. AugMax 32] mixes multiple randomly sampled augmentation
3 optimizes operators like AugMix 34 by using adversarially learned mixing factors. AdA
the parameters of image-to-image models to generate adversarially corrupted augmented images. the worst augmented data of each data point in a of random perturbations or transforms for training. However, these methods create adversarial inputs indirectly and rely on pre-defined augmentations translation models. They cannot perturb the images locally. Instead, our DAT directly modifies the image with no need of pre-defined transforms, and can craft local perturbations on images, which is more elaborate.
MaxUp 35
Discrete Visual Representation Learning Early technique (BOVW) model has shown great power of discrete representation in visual understanding. VQ- VAE EN
3 of Bag-Of. Lagg-Of-eee Visual-Words 36
uses DNNs to learn neural discrete representations, also known visual codebook, by generative modeling the image distribution. Recently, the idea of discrete representations learning has been widely emerged in many vision tasks. In most Masked Image Modeling (MIM) methods (39 40)
visual codebook needed for BERT-like self-supervised pretraining. For image classification, dis- crete representations strengthen the robustness by preserving the global structure of object and ignoring local details [... For image synthesis, adversarial and perceptual objective can be added to VQ-VAE for learning perceptually-alignee visual codebook [K] With growing power of generative models, now a well trained VQGAN can produce vivid images with 0,58 FID [4]. In this work, we use VQGAN for the discretization process in our DAT. As a powerful generative model, VQGAN can greatly reduce the information loss in reconstruction process and ensure the high-quality of the generated discrete adversarial examples.
Method
3.1
Traditional Adversarial Training
We take the typical image classification task as an example to show the formulation of Adversarial
Training (AT). Consider the training image and label set DD (x,, Vi ) and a classifier F with learnable parameters 0, the classification objective is always cross-entropy loss L(x, v. 0).
Adversarial Training (AT) finds the optimal 0 by solving a minimax optimization problem:
min E (x max C(x + 5, y. 0)
s. s.t.1|ölpp <,,
(I)
where the inner optimization finds the perturbations on per pixel values for maximizing the loss, and the outer minimization update 0 to improve the worst-case performance of the network w.r.t. the perturbation. || I constraints the p-norm of to a small value c. problem is that AT finds the failure case i.e. + in continuous pixel space. However, human does not create recognize images from complex pixel values, but from discrete semantic concepts. Although adversarial examples can successfully fool the models, they are still different from the real "hard" examples appeared in practice.
3.2 Discrete Adversarial Training
3.2.1 Image Discretization by Visual Codebook
For discrete adversarial training, is desirable first to learn an expressive visual codebook and repre- sent the training image set in discrete space. We utilize VQGAN [ for image discretization. More
3

---

Find the worst 8 by max 8).
Strnighh-Through Gradient Flow
Forward Flow
Backward Gradient Flow
Straight-Through Gradient
Visual Tasks
Cassiication
Codkbwokk&
Q(x)
Enc
Sull Superesed Learting
Update model parameters @ by min & (@ 8).
+
Figure 1: The overall pipeline of Discrete Adversarial Training (DAT).
precisely, consider a continuous image IR=" VQGAN learns an encoder Enc, (.), decoder Dec (.) and quantization 9z (-). Enc, is convolutional model which maps x: to intermediate latent vectors Encą(1) (hxwixxd where h, is the height, width of the intermediate feature map and d is the latent dimension. Subsequently, 9z(-) learn codebook Z {=x |zk Rd Jk=1 such that each latent vector Bij IR can be quantized onto its closest codebook entry 2n as:
1/4 q2())= = arg min ||e #
zell
Raxxxx
where j.j present each location in feature map. Then the decoder Decy (+) outputs the reconstruction image & from the quantized vectors 24 by:
$ Decp (vq).
VQGAN trained by minimizing the reconstructed difference between and x. More details can be referred to Appendix A So far, given continuous image can get its corresponding discrete reconstruction æ. For simplicity, we use to stand for the above image discretization process, and then we have 2 ((z).
3.2.2 Discrete Adversarial Training
Based on the definition in See 3.2.1 we can generate discrete adversarial examples inner maxi- mization step of AT. By slightly modifying the Eq the objective of DAT is formulated as:
min E (ra) max L(Q(= + 8). v.
(4)
where Q transforms the continuous pixel space to discrete input space. We delete the constraint term since there is no need to bound the per-pixel values of ó. Suppose that Q is an ideal discretizer with no information loss discretization process. The problem lies how to find the worst for maximizing the classification loss. Similar with traditional AT, we can use gradient-based methods to approximate by:
8 ~ a C(Q(x), 0)
where a determines the magnitude of the perturbations along the gradient direction. We set a 0.1 by default in DAT. To expand V v,L(O(x), y, 0) by chain rule, we have four partial derivative terms as follows:
ac 0a
Owg
du
V.L(O(z). v.
(6)
Ova
dv
dr
Oue is hard to solve as the non- Through analysing the feasibility of each term, we find only ar differentiable nature of Eq Fortunately, as proposed in previous work, a ttraught gradient
estimator + 4el can be used by copying the gradients from Uq By replacing P., 3v
as dag with
simplify the Eq to v.L( 0)
2c ab de which has derivative everywhere. dz

---

Algorithm 1: Pscudo code of DAT
Input: Classifier F; Pre-trained discretizer 2; A sampled mini-batch of clean images with labels y; attack magnitude a.
Output: Learned network parameter 0 of F
1: Fix the network parameters of Q
2: for each training steps do
3: ② - 2(x)
//Get the discrete reconstruction. i //Estimate the adversarial perturbations //Generate discrete adversarial examples
4: 8 VVVVL((;
5: Bade & +xx++0)
6: Minimize the classification loss w.r.t network parameter
arg ming (Fodvv 0)
7: end for
Although the solution seems workable theoretically, the huge cost makes it impractical large-scale 08 vision tasks. The bottleneck mainly lies on that dy and Oy require the adversarial gradients backward through Enc and Dec. Actually, a generator capable of producing high-quality images always has large amount of parameters. Compared with original adversarial training which only needs F for gradient calculation, requires more than tripled GPU memory and computation cost.
Øz
To solve this problem, we propose an efficient alternative solution. Since 4 = x is empirically observed for an ideal discretizer Q, also which is given by
trraigh-tthrughh estimator between & and æ,
Oc
08
OC
vzL(2(r),
05
dr
OF
Finally, solve the worst 5 by V VaL(â, 0). By this way, the computation cost of DAT has been largely reduced. Compared with original adversarial training, only has extra computation cost on VQGAN forward, which is relatively controllable.
For clarity, let us restate the pipeline our DAT. For each training image x, DAT first use VQGAN to get discrete reconstruction é. By feeding & to classifier F, worst-case perturbation ó can be estimated by computing the gradient be created by adding 8 on original Finally, + 5 is discretized by VQGAN again and acts as the adversarial input, on which F trained by minimizing the classificaiton loss. The details of our DAT is summarized in Algorithm 1
towards maximizing the classification loss. The perturbed
image thus
Explaining the Effectiveness of DAT from the Perspective of Distribution We give empirical analysis to explain why DAT can improve the robustness and generalization without sacrificing clean curacy. Previous work (26) has pointed out that the underlying distributions of ad- versarial examples are different from clean images. Training on both clean and ad- versarial images will force the Batch Nor- malization (BN) 45 estimate inac- curate mixture statistics of feature distribu- tion, and thus impact the standard perfor- mance. We study this effect by sampling 1000 mini-batched in ImageNet validation set, and generate corresponding adversarial images for AT and our DAT. For each batch we calculate the mean and variance statis- ties of last BN ResNet50. Then the Pearson correlation coefficient (PCC) between the statistics on clean and adversarial examples is computed for showing the distributional difference. Figure 2 shows the frequency histogram the distributional difference on 1000 mini-batches. For training samples of DAT, the peak of the histogram is at 0.95, which is greater than AT. It suggests that DAT
AT DAT
40
DAT
Frequency
0.55 ud/S
C.00 UMIS D3b0
B975
0.5
Pearson
Ub
0.00
(4)
Figure 2: The frequency histogram of the Pearson cor- relation coefficient (PCC) between BN statisties clean and adversarial images. Larger PCC value means smaller distributional difference with clean images. (a), (b) present the difference on mean and variance statistics respectively.
5

---

Adversarial Robustness DamageNet
Out of Distribution Robustness
Methods
ImageNet
C4
Sketch
Stylized
ResNet50
76.13
12.19
5,94
0.0
76.70
63.20
36.17
24.09
7.38
DAT
76.52
30.66
14.42
4.38
74.16
65.02
41.90
27.27
10.8
DeepAugment
76.66
21.61
11.94
3.46
60.37
65.24
42.17
29.50
14.68
+ Augmix
14
75.82
27.05
19.60
3.86
53.55
63.63
46.77
32.62
21.23
+ DAT (Ours)
77.10
35.32
22.86
6.86
50.82
65.14
47.88
34,98
21.89
VIT 200 DENIT
72,00
23,30
28.99
6.44
77.61
57.34
25.69
15.56
5.82
79.48
45.76
44.91
17.20
46.22
68.05
44.77
34.59
19.38
AugReg-Ve VT RXS
79.91
44.32
45.24
19.03
54.50
67.90
39.46
29.16
16.62
+ DAT (Ours)
81.46
$1.82
45.70
30.15
44.65
70.83
47.34
34.77
23.13
MAE-H TC
86.90 87.02
60.16
64.36
68. 18
33.92
78.47
64.12
49.08
26.36
+ DAT (Ours)
63.77
70.42
68.92
31.40
78.82
65.61
50.03
32.77
Table 1: The results of DAT on image classification. Bold number indicates the better performance.
Training Strategies
Adversarial Robustness DamageNet
Out Distribution Robustness
ImageNet
FGSM
C²
V2
R
Sketch
Stylized
Normal
[8
79.91
44.32
45.24
19.03
54.50
67.90
39.46
29.16
16.62
Advprop 26
79.54
72.38
45.48
18.53
51.46
68.74
43.51
31.68
19.24
Fast Advprop
79.02
70.52
44.87
17.86
53.31
67.09
41.84
29.42
18.39
Pyramid AT
81.68
50.36
45.53
23.18
44.95
70,32
47.30
36.87
20.02
Debiased
46.85
DAT (Ours)
81.46
51.82
45.70
30.15
44.65
70.83
47.34
34.77
23.13
Table 2: Comparison of DAT with other training strategies. We AugReg- VIT the base model.
generates discrete adversarial examples much closer with the clean distributions. Therefore, training on these examples will reduce the shift of clean distribution in AT, yielding both the robustness and generalization improvement.
Experiments
To demonstrate the versatility of our method, we experiment Discrete Adversarial Training (DAT) on multiple tasks including image classification, object detection and self-supervised learning.
4.1 Image Classification
Implementation
We implement DAT on two representative architectures: ResNet50 46 and ViT's 20 For ResNet50, we first experiment DAT with vanilla training recipes using "robustness"
library Then we combine DAT with other orthogonal robust training techniques: DeepAugment -
Only cross entropy loss is used for generating discrete adversarial examples. The ISD loss AugMix is optimized merely on clean samples. For ViTs, we adopt ViT-B/16 as baseline models, which is trained by the recipes in AugReg [4%] Besides, we use DAT to conduct supervised finetuning on downstream ImageNet classification task based on a self-supervised ViT- Huge pretrained by MAE [1.. By default, we refer VIT to ViT-B/16 in all tables and figures.
and Aix 34
The trained model is evaluated three aspects: 1) in-distribution performance on ImageNet-Validation set; 2) adversarial robustness white-box FGSM (50) and transfer-based black-box attack dataset DamageNet (5T]: 3) out-of-distributtin robustness on MetgeNet(INN-AA.
Benchmarks
IN-C, IN-V2, IN-R, IN-Sketch and Stylized IN. Each of them represents type of out-of-distribution
scenario where the classifier is prone to make mistakes. IN-A [52] places the ImageNet objects in [5X] applies series noise, blur, digital and weather corruptions: IN-R 47 collects online images with artificial creation, c.g., cartoons, graphics, video game renditions, etc: IN-Sketch [54] contains images described by sketches; Stylized IN [ destroys the texture but maintains the shape feature by conducting style transfer on ImageNet images. Except for IN-C which measured by mCE, we report the top-1 accuracy on all above datasets.
hard contexts: IN-C
Results We report all results in Table For fair comparison, add DAT base methods without modifying the original training hyper parameerssssers, such that improvement is entirely attributed to the

---

Linear Evaluation Caltech101
VOC
Object Detection
ADE20K
Method
ImageNet
CIFARIO
mAP
AP50
AP75
Acc.
MoCov3
68.63
91.54
93.40
90.38
49.01
73.03
50.42
80.33
53,93
0.3508
75.64
DAT
69.60
93.15
95.16
91.42
53.09
73.55
51.92
80.97
56.04
0.3585
76.33
SunCLR
64.89
89,28
88.47
83,20
38.84
73.14
48.50
78.75
51.35
0.3396
75.61
DAT
65.47
90.14
89.97
85.09
39,42
72.93
48.83
79.27
51.95
0.3412
75.46
SimSiam DAT
71.70
77.22
52.69
68.57
68.41
86,93
91.70
87.03
35.10
73.03
51.73
79.69
55.74
0.2203
68.92
Table 3: The results of DAT self-supervised learning.
DAT. For ResNet50, DAT achieves significant improvement on both clean accuracy, adversarial and out-of-distribution robustness, The improvement seems greater when combining DAT with DecpAug- ment and AugMix. For ViTs, we find DAT compatible with other complex augmentations such as MixUp [5S], CutMix [56] or RandAugment [57 used in AugReg, yielding greater improvement. Compared with plain ViT, AugReg- ViT and VIT with discrete representation called DiV [.. DAT with AugReg achieves better performance. The best result is from Vige pretrained by MAE [19 and finetumed by DAT, which suggests DAT also effective downstream fine- tinettningg tasks.
Additionally, we also compare DAT with other robust training strategies in Table 2 AugReg-Vits ViT is adopted as the baseline model. Most strategies, e.g., AdvProp 26 and Debiased 40 are proposed
for ResNet with auxiliary BatchNorm. We show these methods cannot work properly on ViTs with only LayerNorm. Compared with Pyramid AT [X stronger robustness. More results of strategies comparison on ResNet50 refer to Appendix B.]
our DAT has lower clean accuracy but yields
4.2 Sell-Supervised Learning
Implementation
We experiment DAT three self-supervised methods: SimCLR 58 Sim-
Siam [59] and recently proposed MoCov3 [60] The discrete adversarial training is only conducted during pre-training stage, and the learned representation evaluated on downstream tasks by standard pipeline [6]] We craft adversarial examples based on RoCL [62], which attacks the pre-training objective by maximizing the contrastive loss. For preventing the cost explosion, we pre-train 200 epochs for SimCLR, and 100 epochs for both SimSiam and MoCov3. The batch size used for SimCLR, SimSiam, MoCov3 is set as 1024, 512, 2048 respectively.
Benchmarks For sule-supe learning, we adopt ImageNet- 1K for both training and in- distribution testing. Beyond that, in order to give more comprehensive assessment, we build three downstream tasks to metric the transferability of the learned visual representation. Specifically, the linear evaluation reports the top-1 accuracy on five classification datasets: Flowers, CIFAR I0, 101tech101, Cars and DTD. For downstream evaluation of object detection, we present mAP, AP50, AP75 on Pascal VOC2007 63 ADE20K [4 used for semantic segmentation task, and both the mean intersection over union (mloU) and accuracy reported.
Results As shown in Table 3 DAT enhance the learned representation on ImageNet and get 0.97%, 0.58% and 0.25% improvement MoCov3, Sim- CLR, SimSiam respectively. For exclud- ing that DAT is not just over-fitting ImageNet, we transfer the representa- tions on downstream recognition, ob- ject detection, semantic segmentation tasks. The results suggest that DAT en- hances the seff-supervised representa- tions with better transferability. In par- ticular, MoCov3 with DAT achieves sig- nificant improvement all downstream tasks. This conclusion echoed with pre- vious works [9, which find adversari- ally robust models often perform better transfer learning.
Training Strategy
COCO mAP
COCO-C mAP
Relative IPC
Models
Normal
26.41
16.11
61.00
EiDee-Lied-320 35
Det-Advprop
26.34
16.38
62.19
DAT (Ours)
27.32
17.89
65.48
Normal
31.50
19.43
61.68
EffDet-Liee-30 xi
Det-Advprop
31.82
20.21
63.51
DAT (Ours)
32.31
21.32
65.99
Normal
35.91
51.21
YOLOx3.120 MM
Det Ddv-oopppop
35.73
19.34
$4.13
(Ours)
36.02
20.55
57.05
Normal
40.30
21.19
52.58
YOL0v3-416
Det-Adyprop
40.69
22.55
55.42
DAT (Ours)
40.41
23.38
$7.86
Table 4: The results of DAT object detection.
7

---

Models
Datasets
K
d'
FID
ImageNet
FGSM
A
Cl
R
Stylized
VQGAN
OpenImages
16384
1.14
76.52
30.66
4.38
74.16
41.90
10.80
VQGAN
1
OpenTmages
T 16
16384
5.15
75.65
30.48
3.17
74.71
40.64
10.76
VQGAN
Opealmages
2:5
1.49
76.52
30.46
3.11
74.06
40.97
10.01
VQGAN
1K
ImugeNet [1
16
16384
256
4.98
75.88
30.28
2.65
75.38
40.66
9.58
DALLEE
Private
32.01
30.17
3.97
74.26
40.13
Table 5: Results of DAT based on different pretrained discretizer Q. f presents the downsampling
factors. We use ResNet50 as base model and the subset of benchmarks in Sec 4.1 for evaluation.
4.3 Object Detection
Implementation
We implement DAT on two popular detectors: EfficientDet 35 and
YOLOv3 [66|- Object detection generally has two sub-taske classification and localization. Det- AdvProp 667 proposes to select more vulnerable sub-task to generate adversarial images, and use auxiliary BN for training. Instead, DAT regards the two sub-tasks as a whole, and attacks the overall detection loss to produce adversarial images. Besides, DAT does not modify BN in detectors. As the memory and computation cost of VQGAN increased quadratic with the input resolution, DAT become unaffordable when input size is large. Therefore, we only experiment DAT on lightweight version of EfficientDet and YOLOv3 with input size smaller than 512.
Benchmarks We train the detectors using the COCO 7017 object detection dataset 68 and evaluate them on COCO's validation set. COCO-C 69 is used for testing the robustness to natural corruptions. We report mAP COCO and COCO-C the clean and robust performance respectively. rPC (69 is used to to measure relative performance degradation under corruption.
Results We compare the detectors with DAT, Det-AdvProp 67 and vanilla training in Table 4 Although Det-AdvProp has been shown effective EfficientDet with size larger than DO we find on smaller detectors, the promotion of Det-AdvProp is subtle. On EfficiemtDDrr-Lie and YOLOv3-320, it even gets worse COCO mAP than vanilla training. While DAT achieves better result on both clean and corrupted input. EfficientDet-Lite0 with DAT get 27.3 and 17.89 mAP on COCO and COCO-C, resulting in 65.53% Relative rPC. By comparison, vanilla YOLOv3 models have lower Relative rPC, showing it is more vulnerable than EfficientDet at same clean mAP. After equipped with DAT, YOLOx3-320 can get 20.55 mAP on COCO-C, leading to 7.75% improvement on rPC.
4.4 Ablations
Impact of the Codebook in DAT A general understanding is that the codebook with larger K should have stronger representation power. As suggested in Table 3 when the K is reduced from 16384 to 256, the FID of generated images increases 0.35. We show DAT on larger codebook size can achieve better generalization. However, the clean accuracy seems no improvement with increasing of K. We think the reason is that the reconstruction quality has already met the demand of DAT. And the improvement on clean accuracy is saturated when K further increases.
Different Types of Discretizer Q Our work is based on the hypothesis of an ideal Q with no loss in discretization process. However, such perfect Q is not existing in practice. So we study if and how the ability of Q affects the performance of our DAT in Table 5 The results show DAT performs better by using discretizer with higher FID. We find clean accuracy declines 1.3% on DALL-E, showing is important for choosing a powerful discretizer. Types of pre-training datasets have little impact. We find the discretizer pre- pre-trained on OpenImages 70 and transferred to discretize ImageNet images, can also achieve comparable results.
The Performance on Different Magnitude We present the DAT results on ResNet50 and VIT with different magnitude Figure B a = 0 means the model is only trained on images augmented by VQGAN with no adversarial training process. We show DAT with a 0 makes the models have high clean accuracy but the lowest robustness. With the increase of a, there still a robustness and accuracy trade-off. DAT with = 0.4 on ResNet50 achieves the best adversarial robustness but generalization getting worse. By contrast, we surprisingly find ViT has the lower sensibility on a. Even if ViT is trained on DAT with 0.4, there is still no great drop of clean and OOD accuracy.
8

---

We suspect that VIT is more suitable for training on discrete examples, and the strong modeling ability makes ViT greater than ResNet50.
48.0
Adversarial Robustness
clean Accuracy,
79.5
0OD Regustness
442.5
ResNe150
27.0
33.0
37.0
VIT
14.5
ResNet50
23.5
ResNet50
31.5
VIT
VIT
12.0
0.4
14.0
0.0
6.1
28.0
0.0
0.3
0.4
Magnitude
Magnitude
Magnitude
(a) Clean Accuracy
(b) Adversarial Robustness
(c) OOD Robustness
Figure 3: The performance of DAT with different magnitude in Eq
Results on Stronger Attacks In the main experiment, only one-step FGSM is used for examining the robustness under white-box adversarial attacks. To give more comprehensive evaluation, we additionally test our DAT under stronger AutoAttack [6] and two unrestricted attacks named Adv- Drop [ and PerC-Adversarial [α]] The result is shown in Figure g DAT brings the improvement of robustness under all three attackers. ViT trained with DAT achieved extremely high robust accuracy on PerC-Adversarial, which suggests DAT also effects well in defense against unrestricted adversarial
attacks. More details can be referred Appendix C
50.0
ResNet50
ResNet50
Robust Accuracy
377.5
VIT
ResNet50+DAT
Robust Accuracy
243.5
ResNet50+ DAT
Robust Accurace
13.5
VIT+DAT
ResNet50
25.00
43.0
ResNet50+DAr
VIT
VIT DAT
12.5
14.5
24.5
0.0
10.0
32.5
15.0
17.5
20.0
Linf
Quantization Table
Attack Iterations
(a) AutoAttack
77
(b) AdvDrop 1i7
(c) Pdrr--Aversariill
Figure 4: The adversarial robustness test under other stronger attackers.
4.5
In-depth Analysis
Discrete Perturbations vs. Pixel-Space Perturbations We compare the proposed Discrete Adver- sarial Examples (DAEs) with traditional Pixel-space Adversarial Examples (PAEs) Figure 5 DAEs have following three superior properties: 1) DAES are more realistic. By calculating the number of colors [77 find PAEs add more invalid colors, resulting in noisy image. While DAEs have minor changes on the color numbers, its modification is harder to be perceived by humans. To give quantitative results, we additionally report the FID score of DAEs. The FID score of our DAEs is 14.65, which is lower than 65. of AEs. The results are also consistent with our visual presentation result in Figure 5 2) DAES have less high frequency component compared with AEs frequency analysis. It may lead the DAES more close to natural image distributions: 3) Discrete perturbations are more structural. From the perturbation visualization in third row of Figure D] we find discrete perturbations have more structured information about objects, shown it attends to more important locations. While pixel-wise perturbations are noisy and disordered.
Visualized Attention. We visualize the attention of ViT trained by DAT in Figure bb.. For the object with unusual renditions in ImageNet-R, ViT cannot attend to semantically relevant image regions. While our DAT can locate the attention to the central object more related for the classification. This phenomenon is also reflected by the statistical average of the attention in Figure ((c). By randomly sampling 1000 images in ImageNet-R and averaging the attention maps, we find the attentions of our DAT are more global. Compared with ViT which puts much attentions on the corners of the image found by prior work 20 our DAT additionally attends the central regions in where the classified object is often located.

---

Original Image
(Oung)
Original Image
(Oun)
Spel-Space
Perturaatton VIHAA tortion Frequeticy Spactrum Number colors
Figure 5: Comparison of discrete perturbations and pixel-space perturbations.
Fractonn of 'hhae decidons
VIT
DAT
DAT (Ours)
0.8
0.8
0.7
8.1 04
05
34
D3
B2
Srappn catngorte
(Ours)
0.1 02
0.3
0.4
655 06 87
Hamana Wailseat TIST Brdke Taalisto
(a) Shape blas Analysis DAT
(b) Attention Visualization on Test Images
(c) Average Attention
Figure (a) The fraction of correct shape-based based decisions models w/ and w/o DAT. (b) Visualized attention test images of ImageNet-R. (c) The heat map of averaged attention with ViT and VIT trained by our DAT.
Shape-bias Analysis. We conduct an analysis based shape-bias, which represents the fraction of correct decisions based on object shape. The result shown in Figure a].. The averaged scores on 16 categories is denoted by the colored vertical line. We compare decisions with Humans, ResNet50 w/ and w/o DAT, ViT w/ and w/o DAT. Human decisions are highly based on shape, which achieve the best average fraction of 0.96 to correctly recognize image by shape. By comparison, VIT and ResNet50 still have large gap with humans on the ability learning shape features. In this work, we find our DAT can help for improving the fraction of shape- based decisions of models. It suggests DAT regularizes the models to learn texture independent shape features, and behave more like human.
Limitations and Conclusions
In this paper, we find transferring NLP-style adversarial training vision models can enhance the learned visual representation effectively. We propose Discrete Adversarial Training (DAT), where images are presented as discrete visual words by VQGAN, and the model is training on examples which have the adversarially altered discrete visual representation. DAT needs not to modify the model architecture and works for both CNNs and ViTs across multiple tasks. DAT reports the state-of- the-art robustness on ImageNet-C and Stylized- Imageeee,, exhibiting strong generalization. However, DAT still costs increased training time, this limitation also holds for any adversarial training. The strict assumption of ideal discretizer is another potential limitation, despite DAT has used powerful VQGAN model to approach this assumption. The effect of DAT is empirically studied without deeper theoretical explanation. All the above limitations remained as the future optimization direction.
10

---

References
[1] Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, D. Erhan, lan J. Goodfellow, and Rob Fergus. Intriguing properties neural networks. In International Conference on Learning Representations. 2019.
[2] Dan Hendrycks and Thomas G. Dietterich. Benchmarking neural network robustness to common corrup- tions and perturbations. In International Conference on Learning Representations, 2019.
[3] Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A Wichmann, and Wieland Brendel. Imagenet-trained cnns biased towards texture; increasing shape bias improves accuracy and robustness. In International Conference on Learning Representations, 2018.
[4] Ali Shahin Shamsabadi, Ricardo Manchez-Matille and Andrea Cavallaro. Colorfool: Semantic adversarial colorization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1151-1160, 2020.
[5] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant to adversarial attacks. International Conference on Learning Representations, 2018.
[6] Logan Engstrom, Andrew llyas, Shibani Santurkar, Dimitris Tsipras, Brandon Tran, and Aleksander Madry. Learning perceptually-aligned representations via adversarial robustness. arXiv preprint arXiv: arXiv:1906.00 1906.00945 2(3):5, 2019.
[7] Andrew Ross and Finale Doshi-Veles Improving the adversarial robustness and interpretability of deep neural networks by regularizing their input gradients. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 32, 2018.
[8] Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. Advances in neural information processing systems, 32, 2019.
[9] Hadi Salman. Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adversarially robust imagenet models transfer better? Advances in Neural Information Processing Systems, 33:3533- 3545, 2020.
[10] Yuxin Wen, Shuai Li, and Kui Jia. Towards understanding the regularization of adversarial robustness on neural networks. In International Conference on Machine Learning, pages 10225-10235. PMLR, 2020.
[11] Chen Zhu, Cheng, Zhe Gan, Siqi Sun, Tom Goldstein, and Jingjing Liu. Freelb: Enhanced adversarial training for natural language understanding. In International Conference on Learning Representations, 2019.
[12] Maor Ivgi and Jonathan Berant. Achieving model robustness through discrete adversarial training. In Proceedings of the 2021 Conference Empirical Methods in Natural Language Processing, pages 1529- 1544, 2021.
[13] Patrick Esser, Robin Rombach, and Bjorn Ommer. Taming transformers for high resolution image synthesis. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages
2021.
[14] Di Jin, Zhijing Jin. Joey Tianyi Zhou, and Peter Szolovits. Is bert really robust? strong baseline for natural language attack text classification and entailment. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pages 8018-8025, 2020.
[15] Yuan Zang, Fanchao Qi, Chenghao Yang, Zhiyuan Liu, Meng Zhang. Qun Liu, and Maosong Sun. Word- level textual adversarial attacking as combinatorial optimization. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages
2020.
[16] Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani Srivastava, and Kei Chang Generating natural language adversarial examples. In Proceedings of the 2018 Conference Empirical Methods in Natural Language Processing, pages 1890-2896, 2018
[17] Ranjie Duan, Yuefeng Chen, Dantong Niu, Yun Yang. A Kai Qin, and Yuan He. Advdrop: Adversarial attack to dnns by dropping information. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 7515, 2021.
11

---

[18] Zhengyu Zhao, Zhuoran Liu, and Martha Larson. Towards large yet imperceptible adversarial image perturbations with perceptual color distance. In Proceedings the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 1039-1048, 2020.
[19] Kaiming He, Xinlei Chen, Saining Xie, Yanghao Li, Piotr Dollár, and Ross Girshick. Masked autoencoders are scalable vision learners. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 2022.
[20] Alexey Dosovitskiy. Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai Thomas Unterthiner, Mostafa Dehghani. Matthias Minderer, Georg Heigold, Sylvain Gelly, al. An image worth 16x16 words: Transformers for image recognition at scale. In International Conference on Learning Representations, 2020.
[21] Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry, Robust- ness may be at odds with accuracy. In International Conference on Learning Representations, 2018.
[22] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theo- retically principled trade-off between robustness and accuracy. In International conference on machine learning, pages 7472-7482, PMLR, 2019.
[23] Aditi Raghunathan, Sang Michael Xie, Fanny Yang, John Duchi, and Percy Liang. Understanding and mitigating the tradeoff' between robustness and accuracy. In International Conference on Machine Learning, pages 19909-7919 PMLR, 2020.
[24] Rahul Rade and Jeyed-Mohser Moosavi-Dezfooll Reducing excessive margin to achieve a better accuracy robustness trade-off. In International Conference on Learning Representations, 2021.
[25] Alex Lamb, Vikas Verma, Juho Kannala, and Yoshua Bengio. Interpolated adversarial training: Achieving rohust neural networks without sacrificing too much accuracy. Proceedings of the 12th ACM Workshop on Artificial Intelligence and Security, pages 15-103,222 2019.
[26] Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan L Yuille, and Quoc V Lc. Adversarial examples improve image recognition. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 819-828, 2020.
[27] Jieru Mei, Yucheng Han, Yutong Bai, Yixiao Zhang, Yingwei Li, Xianhang Li, Alan Yuille, and Cihang Xie. Fast advprop. In International Conference on Learning Representations, 2021.
[28] Charles Hermaann, Kyle Sargent, Lu Jiang, Ramin Zabih, Huiwen Chang, Ce Liu, Dilip Krishnan, and Deqing Sun. Pyramid adversarial training improves vit performance. arXiv preprint 11X1v2211..1512,, 2021.
[29] Zhe Gan, Yen-Chun Chen, Linjie Li, Chen Zhu, Yu Cheng, and Jingjing Liu. Large-scale adversarial training for vision-and-language representation learning. In NewrlPS, 2020.
[30] Tejas Gokhale, Rushil Anirudh, Bhavya Kailkhura, Jayaraman J Thiagarajam, Chitta Baral, and Yezhou Yang. Attribute-guided adversarial training for robustness to natural perturbations. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 7574-7582, 2021.
[31] Xinyu Zhang, Qiang Wang, Jian Zhang, and Zhao Zhong. Adversarial autoaugment. In International Conference on Learning Representations, 2019.
[32] Haotao Wang. Chaowei Xiao, Jean Kossaifi, Zhiding Yu, Anima Anandkumar, and Zhangyang Wang. Augmax: Adversarial composition random augmentations for robust training. Advances in Neural Information Processing Systems, 34, 2021.
[33] Dan Andrei Calian, Florian Stimberg. Olivia Wiles, Sylvestre- Alvise Rebufti, András György, Timothy A Mann, and Sven Gowal. Defending against image corruptions through adversarial augmentations. In International Conference on Learning Representations, 2021.
[34] Dan Hendrycks, Norman Mu, Ekin Dogus Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshmi- narayanan. Augmix: simple data processing method to improve robustness and uncertainty. In International Conference on Learning Representations, 2019.
[35] Chengyue Gong, Tongzheng Ren, Mao Ye, and Qiang Liu. Maxup: Lightweight adversarial training with data augmentation improves neural network training. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2474-2483, 2021.
12

---

[36] Josef Sivic and Andrew Zisserman. Video google: A text retrieval approach to object matching in videos. In Computer Vision, IEEE International Conference on, volume 3, pages 1470-1470. IEEE Computer Society, 2003.
[37] Gabriella Csurka, Christopher Dance, Lixin Fan, Jutta Willamowski, and Cédric Bray. Visual categorization with bags of keypoints. In Workshop on statistical learning in computer vision, ECCV, volume 1, pages 1-2. Prague, 2004.
[38] Aaron Van Den Oord, Oriol Vinyals, et al. Neural discrete representation learning, Advances in neural information processing systems, 30, 2017.
[39] Hangbo Bao. Li Dong, and Furu Wei, Beit: Bert pre-training of image transformers. In International Conference on Learning Representations, 2022.
[40] Jinghao Zhou, Chen Wei, Huiyu Wang, Wei Shen, Cihang Xie, Alan Yuille, and Tao Kong. ibot: Image bert pre-training with online tokenizer. arXiv preprint 2rXiv:2111.0782: 2021.
[41] Chengzhi Mao, Lu Jiang, Mostafa Dehghani, Carl Vondrick, Rahul Sukthankar, and Irian Essa. Dis- crete representations strengthen vision transformer robustness. In International Conference on Learning Representarions, 2022.
[42] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High-resolution image synthesis with latent diffusion models. arXiv preprint arXiv:21 10752, 2021.
[43] Yoshua Bengio, Nicholas Léonard, and Aaron Courville. Estimating or propagating gradients through stochastic neurons for conditional computation. arXiv preprint arXiv:1308.3432. 2013.
[44] Penghang Yin. Jiancheng Lyu. Shuai Zhang, Stanley Osher, Yingyong Qi. and Jack Xin. Understanding through estimator in training activation quantized neural nets. arXiv preprint 19X602290..0566., 2019.
[45] Sergey loffe and Christian Szegedy. Batch normalization: Accelerating deep network training by reducing internal covariate shift. In International conference on machine learning, pages 448-456. PMLR, 2015.
[46] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770-778, 2016.
[47] Dan Hendryeks, Steven Basart, Norman Mu, Saurav Kadavath, Frank Wang. Evan Dorundo, Rahul Desai, Tyler Zhu, Samyak Parajuli, Mike Guo, et al. The many faces of robustness: A critical analysis of out-of-distribution generalization. In Proceedings of the IEEL/CVF International Conference on Computer Vision, pages 8340-8349, 2021.
[48] Andreas Steiner, Alexander Kolesnikov, Xiaohua Zhai, Ross Wightman, Jakob Uszkoreit, and Lucas Beyer. How train your vit? data, augmentation, and regularization in vision transformers. arXiv preprint arXiv: 106. 10270, 2021.
[49] Yingwei Li, Qihang Yu, Mingxing Tan, Jieru Mei, Peng Tang, Wei Shen, Alan Yuille, et al. Shape-texture debiased neural network training. In International Conference on Learning Representations, 2020.
[50] lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv: 1412.657, 2014.
[51] Sizhe Chen, Zhengbao Hc, Chengjin Sun, Jie Yang, and Xiaolin Huang. Universal adversarial attack attention and the resulting dataset damagenet. IEEF Transactions on Pattern Analysis and Machine Intelligence, 2020.
[52] Dan Hendrycks, Kevin Zhao, Steven Basart, Jacob Steinhardt, and Dawn Song. Natural adversarial examples. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognition. pages 15222, 2021.
[53] Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. In International Conference on Learning Representations, 2018.
[54] Haohan Wang, Songwei Ge, Zachary Lipton, and Eric P Xing. Learning robust global representations by penalizing local predictive power. Advances in Neural Information Processing Systems, 32, 2019.
[55] Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Pac Paz. mixup: Beyond empirical risk minimization. In International Conference Learning Representations, 2018
13

---

[56] Sangdoo Yun, Dongyoon Han. Seong Joon Oh. Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. Cutmix: Regularization strategy train strong classifiers with localizable features. In Proceedings of the IEEE/CVF international conference on computer vision, pages 6023-6032, 2019.
[57] Ekin D Cubuk, Barret Zoph, Jonathon Shlens, and Quoc V Le. Randaugment: Practical automated data augmentation with reduced scarch space. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pottern Recognition Workshops, pages 702-703, 2020.
[58] Ting Chen, Simon Komblith, Mohammad Norouzi, and Geoffry Hinton. A simple framework for contrastive learning visual representations. International conference on machine learning, pages 1597-1607. PMLR, 2020.
[59] Xinlci Chen and Kaiming Hc. Exploring simple siamese representation learning. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 15750-15758, 2021.
[60] Xinlei Chen, Saining Xie, and Kaiming Hc. empirical study of training self-supervised vision transformers. Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 9640-9649, 2021.
[61] Linus Ericsson, Henry Gouk, and Timothy M Hospedales, How well do self-supervised models transfer? In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 5414-5423, 2021.
[62] Minscon Kim, Jihoon Tack, and Sung Ju Hwang. Adversarial self-super contrastive learning. Advances in Neural Information Processing Systems, 33:2983-2994, 2020.
[63] Mark Everingham, Luc Van Gool, Christopher KI Williams, John Winn, and Andrew Zisserman. The pascal visual object classes (voc) challenge. International journal of computer vision, 88(2):303-338 2010.
[64] Bolci Zhou, Hang Zhao, Xavier Puig, Sanja Fidler, Adela Barriuso, and Antonio Torralba. Scene parsing through adc20k datasct. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 633-641 2017.
[65] Mingxing Tan, Ruoming Pang, and Quoc V Le. Efficientdet: Scalable and efficient object detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10781-10790, 2020.
[66] Joseph Redmon and Ali Farhadi. Yolov3: An incremental improvement. arXiv preprint arXiv: 1804.0277 2018.
[67] Xiangning Chen, Cihang Xie, Mingxing Tan, Li Zhang. Cho-Jui Hsieh, and Boqing Gong. Robust and accurate object detection via adversarial learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 16622-16631, 2021.
[68] Tsung- Yi Lin, Michael Maire, Serge Belongie, James Hays, Pictro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zimick. Microsoft coco: Common objects in context. In European conference on computer vision, pages 240-755. Springer, 2014.
[69] Claudio Michaelis, Benjamin Mitzkus, Robert Geirhos, Evgenia Rusak, Oliver Bringmann, Alexander Ecker, Matthias Bethge, and Wieland Brendel. Benchmarking robustness in object detection: Autonomous driving when winter is coming. arXiv preprint arXiv: 1907.07444 2019.
[70] Alina Kuznetsova, Hassan Rom, Neil Alldrin, Jasper Uijlings, Ivan Krasin, Jordi Pont-Tuset, Shahab Ka- mali, Stefan Popov, Matteo Malloci, Alexander Kolesnikov, et al. The open images dataset v4. International Journal of Computer Vision, 128(7):1956 1981, 2020.
[71] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248-255. Ieee, 2009.
[72] Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea Voss, Alec Radford, Mark Chen, and Ilya Sutskever. Zero-shot text-to-image generation. In International Conference on Machine Learning, pages 8821 88311 PMLR, 2021.
[73] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning, pages 2206-2216. PMLR, 2020.
[74] Ian Goodfellow, Jean Pouget-Abade Mehdi Mirza, Bing Xu, David Sarde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. Advances in neural information processing systems, 27, 2014.
14


Reviews:
[{"review_id": "j5YCCP4Yckz", "reviewer": "Reviewer_oF1f", "summary": "This paper proposes discrete adversarial training to boost the performance on representation learning. Extensive results on image classification, object detection and self-supervised learning validate the effectiveness.", "questions": "See above.", "limitations": "n/a", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "## Strengths:\n\nThe presentation is clear and extensive experimental results are convincing.\n\n## Weaknesses:\n\n1. My biggest concern is why discrete representation helps?\n\n2. DrVit is very similar except for inner optimization and quantization training. DrVit is training VQVAE from scratch. Will that become unfair comparison? For example, you are using different data for training or pretraining. Could you provide the results if the proposed method is also trained from scratch using the same dataset, loss and architecture? Or DrVit is also using VQGAN\n\n3. In Table 1, why the winner between DrVit and AugReg-Vit keeps changing on different metrics?\n\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "iilWEQjXtgO", "reviewer": "Reviewer_wZbH", "summary": "The paper proposes Discrete Adversarial Training (DAT) strategy for vision tasks that avoids continuous-Lp based perturbations and encourages adversarial examples generated through image discretization using VQGAN. Authors derive the motivation for using image discretization from the observation of improved generalization via discrete adversarial training in NLP tasks. Adversarial examples generated using this discretization process are used for training different architectures for different downstream tasks. Unlike traditional adversarial training (AT), DAT shown to improve network generalization across different tasks, different distribution shifts and also improve adversarial robustness. Major improvements are noticed in image classification task and minimal or comparable performance seen on object detection and semantic segmentation tasks.", "questions": "In line 148, it is mentioned that “We delete the constraint term since there is no need to bound the per-pixel values of \\delta”. Would you elaborate on why this constraint is not needed?\n\nIn line 157, authors mention “as proposed in previous work, a straight-through gradient estimator can be used by copying the gradients from v_q to v”. Which previous work is referred here? Would you provide justification how the gradients can be estimated and copied from v_q to v? \n\nSimilarly a straight-through gradient estimator was used between Q(x) and x. How does this hold in practice (not in ideal setting) ?\n\nIn line 179, it is mentioned that  “x + \\delta is discretized by VQGAN again and acts as the adversarial input”. Do authors cross check that these adversarial inputs generated by VQGAN still mislead the classifier F?\n", "limitations": "Authors have not discussed about their limitations. I find no potential negative impact from this work. The method requires heavily parameterized VQGAN to train different networks. This imposes heavy computation time and budget during the training process.", "rating": 7, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": " Strengths:\n1)\tWell written paper. Easy to understand.\n2)\tMotivation is explained clearly.\n3)\tMajor strength lies in the extensive experimental evaluation.\n4)\tShown improvements of network generalization across different ImageNet distribution shift datasets and higher adversarial robustness on both ResNet50 and ViT.\n5)\tConducted ablation studies to understand the effect of different components.\n\nWeakness:\nDifferent assumptions are made to ease the computation of gradients, backpropagation through VQGAN to generate adversarial examples. No theoretical details are shown to support the assumptions and approximations are made through heuristics.\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "O5Wm2NX7rJa", "reviewer": "Reviewer_haXr", "summary": "The paper proposes a discrete adversarial training strategy to alleviate the robustness-generalization trade-off in vision tasks.  Motivated from the adversarial training used in NLP models, the authors claim that a discrete representation of the image space will aid in more robust models without much drop in generalization. The method utilizes a VQGAN model to generate discrete adversarial samples for adversarial training. The authors show that the adversarial training strategy enhances the performances of various vision tasks such as classification, object detection and self-supervised learning. ", "questions": "- Please report robust accuracy values for epsilon = 4/255 on ImageNet and L_inf for AutoAttack.\n\n- I understand that error bars on ImageNet are not possible - but for CIFAR, that would be easier - and allow for a comparison to more SotA methods on RobustBench. For CIFAR, the epsilon for the comparison should be 8/255 for L_inf on AutoAttack.\n\n\n\n", "limitations": "The authors already mention the limitations of the proposed method – the computational cost and lack of theoretical intuition. Although there are some empirical intuitions provided in the paper (fig 2), the missing error bars in all experiments make the empirical findings less convincing.", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "+ Originality -  The idea to use discrete adversarial samples to enhance the performance of vision tasks seems novel/interesting. \n\n+ Clarity -  The paper is well written and can be easily understood. \n\n- Clarity -  I felt some of the experimental details are missing. For example, the implementation details of the adversarial  robustness experiments  - FGSM and Damagenet. There are some typos which needs to be proofread.\n\n- Quality - The paper lacks theoretical intuition and the experimental section needs more stronger baselines for robustness tasks.  For example the intuition that the straight-through gradient computation and backpropagation canjust be skipped seems very odd to me. At least some empirical evidence (comparison of the adversarial examples that are actually computed by backpropagation) should be reported. \n\n- Significance - It is difficult to analyze the superiority of the method in adversarial robustness since the robustness experiments is missing baselines from RobustBench. However, number for much smaller epsilons than the ones usually evaluated in robustBench indicate that the method strongly underperforms in this respect. \n- Without error bars, it is unclear how significant the results are.\n\n\nAfter the rebuttal and extentive discussion, I see that the proposed approach might have potential w.r.t. model generalization. My orignial argument w.r.t. adversarial robustness holds, but I am willing to increase my score based on the presented results. ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "JsnM536AE3m", "reviewer": "Reviewer_C7HU", "summary": "This paper studies the problem of adversarial training for vision tasks by borrowing ideas from NLP.  A new method called \"DAT\" (Discrete Adversarial Training) is proposed.  DAT uses a VQA-GAN encoder to convert images into discrete tokens, by learning a vocabulary of words (aka image codebook).  Adversarial perturbations are applied on these tokens.  Performance is reported on:\n1. 6 versions of Imagenet for evaluating robustness (Imagenet-A/C/V2/R/ Stylized/Sketch)\n2. against adversarial attacks (FGSM, DamageNet)\n3. COCO-C for object detection", "questions": "## Questions \nAdversarial training has also been used in image classification literature for domain generalization:  see (GUD: Volpi et al NeurIPS 2018 https://arxiv.org/abs/1805.12018, MADA: Qiao et al. CVPR 2019 https://arxiv.org/abs/2003.13216, ME-ADA: Zhao et al. NeurIPS 2020 https://arxiv.org/abs/2010.08001). This leads me to two questions:\n1. How does DAT perform on domain generalization benchmarks such as Digits, PACS, OfficeHome etc.?\n2. On the imagenet benchmarks presented in this paper, how does DAT compare with GUD, MADA? (if some of the baselines that you have used have been shown to be better than GUD, MADA -- please let me know which paper).\n\n3. Line 148: `We delete the constraint term since there is no need to bound the per-pixel values of $\\delta$` -- what are the effects on the performance if the perturbation is bounded? is it better / worse in general? Is is better for some eval datasets but worse for others?\n4. Line 166: `Since xˆ ≃ x established for an ideal discretizer Q` -- this connects to my question-3:  does the magnitude of the perturbation affect this assumption? Will a large perturbation make this assumption false?\n5. Line 184: `Previous work has pointed out that the underlying distributions of adversarial examples are different from clean images.` -- which paper? please cite.\n\n## Suggestions (about References, Structure, Grammar, etc.)\n1. References:  you may also add references to \"vision-like\" AT that have been explored in NLP.  You have mentioned one of them (FreeLB). Another one is:\n    - https://arxiv.org/abs/2006.06195 (NeurIPS 2020) -- here \"VILLA\" perturbs encoded features (of images and/or text) encoded by pretrained V&L model.  In that sense, it is similar to perturbing the VQGAN encoding of images (DAT) is similar to VILLA, but DAT perturbs in the symbolic codebook space.\n2. References:  other forms of adversarial training (beyond pixel-wise perturbations) have been explored for vision tasks:\n    - https://arxiv.org/abs/2012.01806 (AAAI 2021) -- \"AGAT\" is an adversarial training pipeline which starts with a given knowledge of symbolic attributes of images, and then perturbs images along those attributes.  A comparison should be made between DAT and AGAT: in my view DAT indirectly uses the symbolic knowledge from VQGAN encoder, whereas AGAT assumes that such symbols/attributes will be given.\n3. Typo: Fig 4 caption:  last word should be \"attackers\".\n4. Fig 3 caption: please mention in words what $\\alpha$ is (step size/magnitude of adversarial update).\n5. Fig 2: please label the x-axis\n6. Line 201: `Using robustness`:  please rephrase this to `using \"robustness\" library` since robustness is a standard ML term, so people might get confused.", "limitations": "Limitations are not discussed clearly.  Please add a section in/after conclusion to discuss them.  Especially about the assumptions in the method.", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "## Strengths\n1. The motivation of the paper comes from an informed perspective of both vision and NLP literature on AT, and I like the fact that the phenomenon from NLP of AT improving both robustness and clean accuracy is used as a goal for AT in vision.  This exchange of ideas often leads to improvements across various application domains of machine learning.  \n2. Performance is evaluated extensively and reported \n    - 3 benchmarks (classification, detection, self-supervised image classification) \n    - multiple architectures\n3. The paper is well written, especially the methods section.  I have a few questions about the method though (see below)\n\n## Weaknesses\n1. One major weakness is that previous work on adversarial training has been used for improving domain generalization (see my question1).  However, experiments have not been performed in this paper on DG benchmarks.\n2. The methods section has some assumptions (see Q 3 and 4) -- these assumptions are not clearly justified (either theoretically or intuitively).  More study along these assumptions is needed.  \n3. The effect of discrete perturbations is not discussed.  In pixel-wise AT, the perturbation leads to noisy images.  But that need not be true for DAT -- a comparison should be included, perhaps in terms of photorealism comparison between \"real\" images and perturbed images.  ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Accept