Effective Targeted Attacks for Adversarial Self-Supervised Learning
Authors: Minseon Kim
Hyeonjeong Ha
Sooel Son
Sung Ju Hwang
Venue: NeurIPS 2023 poster (2023)
Keywords: Adversarial self supervised learning
targeted attack
self supervised learning
contrastive learning
positive mining

Abstract: Recently, unsupervised adversarial training (AT) has been highlighted as a means of achieving robustness in models without any label information. Previous studies in unsupervised AT have mostly focused on implementing self-supervised learning (SSL) frameworks, which maximize the instance-wise classification loss to generate adversarial examples. However, we observe that simply maximizing the self-supervised training loss with an untargeted adversarial attack often results in generating ineffective adversaries that may not help improve the robustness of the trained model, especially for non-contrastive SSL frameworks without negative examples. To tackle this problem, we propose a novel positive mining for targeted adversarial attack to generate effective adversaries for adversarial SSL frameworks. Specifically, we introduce an algorithm that selects the most confusing yet similar target example for a given instance based on entropy and similarity, and subsequently perturbs the given instance towards the selected target. Our method demonstrates significant enhancements in robustness when applied to non-contrastive SSL frameworks, and less but consistent robustness improvements with contrastive SSL frameworks, on the benchmark datasets.

Effective Targeted Attacks for Adversarial Self-Supervised Learning
Minseon Kim', Hyeonjeong Ha', Sooel Son', Sung Hwang 1.2 Korea Advanced Institute of Science and Technology (KAIST), DDeepAuoo.ai fminseonkim, hyeonjeongha, sl. sonson, 8jhwang82 ac. kr
Abstract
Recently, unsupervised adversarial training (AT) has been highlighted as a means of achieving robustness in models without any label information. Previous studies in unsupervised AT have mostly focused on implementing self-supervised learn- ing (SSL) frameworks, which maximize the instance- wise classification loss to generate adversarial examples. However, we observe that simply maximizing the self-supervised training loss with untargeted adversarial attack often results in generating ineffective adversaries that may not help improve the robustness the trained model, especially for non-contrastive SSL frameworks without neg- ative examples. tackle this problem, we propose a novel positive mining for targeted adversarial attack to generate effective adversaries for adversarial SSL frameworks. Specifically, we introduce an algorithm that seleets the most confusing yet similar target example for a given instance based entropy and similarity, and subsequently perturbs the given instance towards the selected target. Our method demonstrates significant enhancements in robustness when applied to contrastive SSL frameworks, and less but consistent robustness improvements with contrastive SSL frameworks, the benchmark datasets.
Introduction
Enhancing the robustness of deep neural networks (DNN) remains crucial challenge for their real-world safety-critical applications, such as autonomous driving. DNNs have been shown to be vulnerable various forms of attacks, such imperceptible perturbations [14], various types of image corruptions [20], and distribution shifts [25], which can lead DNNs to make incorrect predictions. Many prior studies have proposed using supervised adversarial training (AT) [29, 40, 38, 37] mitigate susceptibility to imperceptible adversarial perturbation, exploiting class label information to generate adversarial examples. However, achieving robustness in the absence of labeled information has been relatively understudied, despite the recent successes of self-supervised learning across various domains and tasks.
Recently, self- sulervupere learning (SSL) frameworks have been proposed to obtain transferable visual representations by learning the similarity and differences between instances of augmented training data. Such prior approaches include those utilizing contrastive learning between positive and negative pairs (e.g., Chen et al. [6] (SimCLR), He et al. [19] (MoCo), Zbontar et al. [39] (Barlow- twins)), as well as those utilizing similarity loss solely between positive pairs (e.g., Grill er al. [17] (BYOL), Chen and He [7] (SimSiam)). To achieve robustness in these frameworks, Kim et al. [23]
and Jiang et al. [22] have proposed adversarial SSL methods using contrastive learning [6]. which generate adversarial examples that maximize the instance-wise classification loss.
Unfortunately, deploying this contrastive framework often becomes computationally expensive as requires large batch size for training in order to attain high level of performance [6]. Specifically, when a given memory and computational budget is limited, such as with edge devices, performing
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

Regathe purs
dean
target image
Effective
maximize
adversriial
adversarial
Effective adversarial
effective adversantal paits
maxémnize
Siarr per turrbation dean
after parturbation
pos pars
maximize
Non-effrctive adversoiiol
minimiize
minimize
(a) Supervised attack
(b) Contrastive based attack
(c) Positive-pai pair only attack
Figure 1: Motivation. In supervised adversarial learning (a), perturbation is generated to maximize the cross-entropy Ioss, which pushes adversarial examples to the decision boundaries of other classes. In adversarial contrastive SSL (b), perturbation is generated to minimize the similarity (red line) between positive pairs while maximizing the similarity (blue lines) between negative pairs. In positive-only adversarial SSL (c), minimizing the similarity (red) between positive pairs. However, adversarial examples adversarial SSL impose weaker constraints in generating effective adversarial examples than does supervised AT due to ineffective positive pairs. To overcome this limitation, we suggest a selectively targeted attack for SSL that maximizes the similarity (blue) the most confusing target instance (yellow oval in (b) and (c)).
contrastive SSL becomes no longer viable or practical as an option, as it may not obtain sufficiently high performance using small batch size.
Alternatively, non-contrastive, positive-only SSL frameworks have been proposed resort to maxi- mizing consistency across differently augmented samples of the same instance, i.e., positive pairs, [17, 7, 39]. without the need of negative instances. These approaches improve the practicality of SSL for those limited computational budget scenarios. However, leveraging prior adversarial attacks that maximize the self-supervised learning loss in these frameworks results in extremely poor performance compared to those of adversarial contrastive SSL methods (Table 1). The suboptimality of the deployed attacks causes to learn limited robustness and leads to the generation of ineffective adversarial examples, which fail improve robustness in the SSL frameworks trained using them. As shown in Figure 1c, the attack in the inner loop of the adversarial training loss, designed to maximize the distance between two differently augmented samples, perturbs a given example to a random position in the latent space. Thus, the generated adversarial samples have little impact on the final robustness. The suboptimality of the attacks also can be occurred contrastive adversarial SSL that also contains positive pairs, when simply maximizing the contrastive loss. As shown in Figure lb, contrastive learning treats all positive and negative pairs equally regardless of their varying importance in generating effective adversarial examples.
To address this issue, we propose Targeted Attack for RObust self-supervised learning (TARO). TARO is designed to guide the generation of effective adversarial examples by conducting targeted attacks that perturb a given instance toward target instance to enhance the robustness of an SSL framework (Figure 1). The direction of attacks is assigned using our target selection algorithm that chooses the most confusing yet similar sample for given instance based on the entropy and similarity. By targeting the attacks toward specific latent spaces that are more likely to improve robustness on positive-pan pairs, TARO improves the robustness of SSL, regardless of the underlying SSL frameworks. Notably, as the positive-pal pair only SSL. has gained attention in recent times, our proposed method becomes crucial for the ongoing safe utilization of these frameworks in real-world applications.
The main contributions can be summarized as follows:
We observe that simply maximizing the training loss of self-supervised learning (SSL) may lead to suboptimality of attacks as the main cause of the limited robustness in SSL frameworks, especially those that rely on maximizing the similarity between the single pair of augmented instances.
To address this issue, we propose a novel approach, Targeted Attack for RObust self- supervised learning (TARO), which aims to improve the robustness of SSL by conducting targeted attacks on the positive-pair that perturb the given instance toward the most confusing yet similar latent space, based on entropy and similarity of the latent vectors.
We experimentally show that TARO is able to obtain consistently improved robustness of SSL,, regardless of underlying SSL frameworks, including contrastive- and positive-pair only SSL frameworks.

---

2 Related Work
Adversarial training Szegedy et al. [34] showed that imperceptible perturbation given input image may lead DNN model to misclassify the input into a false label, demonstrating the vulnera- bility of DNN models to adversarial attacks. Goodfellow al. [14] proposed the fast gradient sign method (FGSM), which perturbs a given input to add imperceptible noise in the gradient direction of decreasing the loss of a target model. They also demonstrated that training a DNN model over perturbed as well as clean samples improves the robustness of the model against FGSM attacks. Follow-up works [27, 2] proposed diverse gradient-based strong attacks, and Madry et al. [29] proposed a projected gradient descent (PGD) attack and robust training algorithm leveraging minimax formulation; they find an adversarial example that achieves a high loss while minimizing the adversarial loss across given data points. TRADES [40] proposed minimizing the Kullback-Leible divergence (KLD) over clean examples and their adversarial counterparts, thus enforcing consistency between their predictions. Recently, leveraging additional unlabeled data [3] and conducting addi- tional attacks [38] have been proposed. Carmon et al. [3] proposed using Tiny ImageNet [28] images as pseudo labels, and Gowal et al. [16] proposed using generated images from generative models to learn richer representations with additional data.
Self-supervised learning Due to the high annotation cost of labeling data, SSL has gained a wide attention [11, 41, 35, 36]. Previously, SSL focused on solving a pre-task problem of collaterally obtaining visual representation, such as solving a jigsaw puzzle [30], predicting the relative position of two regions| [11], or impainting masked area [31]. However, more recently, SSL has shifted to utilizing inductive bias to learn the invariant visual representation of paired transformed images. This accomplished through contrastive learning, which utilizes both positive pairs and negative pairs, that is differently transformed images and other images from the same batch, respectively [6, 19]. Additionally, some studies have proposed using only positive pairs in SSL and have employed techniques such as momentum networks [17] or stop-grade moopggradeent [7]. In this paper, we annotate these approaches as contrastive SSL, and positive-pair only SSL, respectively.
Adversarial self-supervised learning The early stage of adversarial SSL methods [23, 22] em- ployed contrastive learning to achieve high level of robustness without any class labels. Adversarial self-supervised contrastive learning [23, 22] generated an instance-wiss adversarial example that maximizes the contrastive loss against its positive and negative samples by conducting untargeted attacks. Both methods achieved robustness, but at the cost of requiring high computation power due to the large batch size needed for contrastive learning. On the other hand, Gowal et al. [15] utilized only positive samples to obtain adversarial examples by maximizing the similarity loss between the latent vectors from the online and target networks, allowing this method greater freedom regarding the batch size. However, it exhibited relatively worse robustness than the adversarial self-supervised contrastive learning frameworks. Despite the advances in the SSL framework (i.e., positive-pal only SSL), a simple combination of untargeted adversarial learning and advanced SSL does not guarantee robustness. To overcome such vulnerability in positive-pait only SSL, we propose targeted attack leveraging novel score function designed to improve robustness.
Positive-Pais Targeted Attack in Adversarial Self-Supervised Learning
Adversarial SSL. and supervised adversarial learning utilize adversarial examples in a similar manner. Specifically, adversarial SSL generates instance wise adversarial examples in the direction of maxi- mizing the training loss for better robustness. However, this approach exhibits an insufficient level of robustness especially in the positive- partiee-piirraae only self-supervised learning framework due to generating highly suboptimal adversarial examples.
We argue that simply maximizing the training loss, dubbed as an untargeted attack, in positive-pair only SSL limits the diversity of adversarial examples which eventually leads to limited robustness. We theoretically show that range of perturbation smaller when the positive-pair only SSL objective employed in an untargeted attack than the contrastive objective in simple two-class tasks. Furthermore, we empirically demonstrate poorer robustness when we naively merge untargeted attack and positive- pair only SSL approaches [17, 7], compared to contrastive-basee based adversarial SSL [23, 22].
3

---

To remedy such shortcoming, we propose a simple yet effective targeted adversarial attack to increase the diversity of the generated attack. Moreover, we empirically suggest novel positive mining the target for the targeted adversarial attack that contributes to generating more effective and stronger adversarial examples, thus improving the robustness beyond that of previous adversarial SSL. approaches. In this section, we first recap supervised adversarial training, self-supervised learning, and previous adversarial SSL methods. We then demonstrate theoretical intuition on our motivation and describe proposed targeted adversarial SSL framework, TARO, in detail.
3.1 Preliminary
Supervised adversarial training We first recap supervised adversarial training with notations. We denote the dataset D = {(vi, W: where T2 E RD is a input, and yi E R is its corresponding label from the N classes. In this supervised learning task, the model is fo X Y, where 0 is set of model parameters to train.
Given D and fo. an adversarial attack perturbs given source image that maximizes the loss within a certain radius from it (e.g., Lo norm balls). For example, &o attack defined as follows:
5 = TT (5' nsign V fex
(1) where B(0, <) is the for norm-ball of radius II is the projection function to the norm-ball, a is the step size of the attacks, and sign(.) is the sign of the vector. Also, represents the perturbations accumulated by ossign(-) over multiple iterations and Lcs is the cross-entropy loss. In the case of PGD [29], the attack starts from random point within the epsilon ball and performs gradient steps, obtain a perturbed sample. Adversurial training (AT) is straightforward way to improve the robustness of a DNN model; it minimizes the training loss that embeds the adversarial perturbation (8) in the inner loop (Eq. 1).
Self-supervised learning Recent studies on euf-suupe learning (SSL) have proposed methods to allow their models to learn invariant features from transformed images, thus learning semantic visual representations that are beneficial for diverse tasks [6, 19, 17, 7, 391. this paper, we aim at improving the robustness of the two most popular types of SSL frameworks: positive-pair only SSL (e.g., BOL, SimSiam) and contrastive SSL (e.g., SimCLR) frameworks.
We start by briefly describing representative contrastive SSL, SimCLR [6]. SimCLR is designed to maximize the agreement between different augmentations of the same instance in the learned latent space while minimizing the agreement between different instances. Differently augmented examples from the same instance are defined as positive pairs, and all other instances in the same batch are considered negative examples. Then, the training loss of SimCLR is defined as follows:
En (synn) exp(sim(z,
Lat-xent (I,, (2ipoe ) (waeg)) -loog log Σx, (2pca) exp(sim(z, 2p)/T) + Enn, E(tma) exp(simm (z, Z,, TT)
(2)
where 2 is the latent vector of input x, pos, neg stands for positive pair and negative pairs of x, respectively, and sim denotes the cosine similarity function.
representative positive-pair only SSL framework is SimSiam [7]. SimSiam consists of the encoder f. followed by the projector y. and then the predictor h; both y and h are multi-layer perceptrons (MIPs). Given the dataset DD = (X} and the transformation function ~ T that augments the images E X, it is designed to maximize the similarity between the differently transformed images and avoid representational collapse by applying the stop-gradient operation to one of the transformed
images as follows:
Lee Rpoz) =
p
Zpos
Ppoz
2
(3)
llll2
|1 l2
2 Ppoe
||
where = = g ((t(()),, Epos = go ((z(2x)), and p h o 2, h o 2pos are output vectors of the projector y and predictor It, respectively. Before calculating the loss, SimSiam detaches the gradient on the which is called the stop-gradient operation. This stop-gradient operation helps the model prevent representational collapse without any momentum networks, by making an encoder to act as momentum network.

---

Adversarial SSL To achieve robustness in SSL frameworks, prior studies have proposed adversarial SSL methods [22, 23, 15]. They generate adversarial examples by maximizing the training loss, dubbed as an untargeted attack, of their base SSL frameworks. For example, the inner loop of an adversarial attack for Kim et al. [23] is structured as follows:
g I1 ((o,,) (5* osigg V ((t(() + (2(x))))
where the perturbation maximizes the L. For adversarial contrastive SSL approaches [22, 23], fitt-xant the contrastive loss in Eq. 2, so that adversarial examples are generated to minimize the similarity between positive pairs and maximize the similarity between negative pairs. For the positive-pair only SSL, adversarial examples are generated to maximize the similarity loss, L = Lee shown in Table 1, positive-pair only SSL results
(Eq. 3), between positive-pairs only. However, in significantly poor robustness compared to the adversarial contrastive SSL approaches. This is because using the naive training loss function of positive-pate only SSL in the attack hinders the generation of effective attack images for robust representation, as we theoretically show the range of perturbations is smaller (Section 3.2). To address this issue, propose targeted adversarial attack that can select more effective examples to make more diverse perturbations.
3.2 Theoretical Motivation: Adversarial Perturbations in Positive-only SSL
A model is considered to have a better general- ization of adversarial robustness when the model can maintain its performance across a wide range of adversarial perturbations. Hence, the ability of the attack loss to generate diverse range of per- turbations during training crucial factor that influences the model's final robust generalization.
Table 1: Comparison of different attack losses CIFAR-10 using PGD attack.
Attack loss
Method
Clean
PGD
ACL [22]
79.96
39.37
Contrastive
RoCL. [23]
78.14 14
42.89
Positive-only similarity
BYORL [15]
72.65
16.20
However, found the theoretical motivation that positive-pair only SSL loss (Cea) could not provide a wide range of adversarial perturbations as contrastive loss (Lat-xent) does. We simplify the problem into simple binary classification with the linear layer model to demonstrate our theoretical motivation. Let us denote adversarial perturbations that are generated with both losses as follows,
SimSiam*
71.78
32.28
*naive adversarial training applied in SimSiam
f(x + 5)
f(xr
adv 2s
+ arg max
subject to
|00|| S E,
[1 + 8)ll [I f(z)
((+5)) [[(++8]]]
/T)
(5)
exp
2
sdy ntt- = 2 + arg max
log
subject to ||ō|| S
5
Σ exp
((x+6)) [[(
Murrne)
where we approximate the loss of Las in the & distance function between the positive pair and the loss of Lat-rent into combination of two &ı distance functions of one positive- and one negative- pair. In both cases, a maximizes the respective loss, subject to the constraint that the norm of 5 less than or equal The objective in posltive-only SSL is to make the perturbed and original samples dissimilar as follows,
8en arg max (xx - f(x + 6)].
while the objective of nt-xent to make the perturbed sample dissimilar to the positive pair and similar to the negative pair as follows,
8at-zent arg max f(x) f(x + 6)1 (f( f(x + 6)].
Theorem 3.1 (Perturbation range of self supe-supervised learning loss). Given model trained under the positive-only distance loss, the adversarial perturbations des are likely to be smaller than those perturbations dat-zent from a model trained under the posifive-pair and negative-pat distance loss. Formally, [1 < [Sss--enslloo
These theoretical insights are also supported by the empirical experiments in Table that model trained with adversarial examples generated using positive- and negative- paired contrastive loss (Lnt-xant) have better adversarial robustness generalization because it is exposed to wider range of perturbations during training than models that are trained with the positive-only similarity loss (Lza). The detailed proof and the empirical analysis are in the Supplementary.
5

---

3.3 Targeted Adversarial SSL
We propose simple yet effective targeted adversarial attack to generate effective adversarial examples in positive-only SSL scenario. In this section, we first show the theoretical intuition of our approach and describe our overall framework to further improve the robustness of the adversarial SSL method by performing targeted attacks wherein targets are selected according to the proposed score function.
Targeted adversarial attack to different sample We argue that leveraging untargeted adversarial attacks in positive pairs only SSL still leaves a large room for better robustness. To enlarge the diversity of the attacks, we propose simple targeted adversarial attacks for positive- assitive-pair only SSL. The loss for such ad adversarial attacks is as follows:
g²+1 =I B(O,e)) (8' + asign Vo Leargetod-attaaa (x 6²,
(8)
where Crargeted-attect is Lours-es Les, and x' is a selected targer within the batch.
Therefore, in the previous simplified scenario described Section 3.2, conducting the randomly selected targeted attack could increase the range of the perturbation that is generated with positive-pair only similarity loss as follow,
ò bargeted- arg max (f + 5) - fZerrgett)
Through triangle inequality, the targeted attack may increase the range of the perturbation and eventually leverage the overall robustness.
Theorem 3.2 (Perturbation range of targeted attack). Given a model trained under the attrgeted-attack loss, the adversarial perturbations bargeteddattack are larger than the adversarial perturbations dge from a model trained under the L.s- Formally, [] [|Otageted-attack lo ||
However, these are theoretical expectations in a simplistic scenario. To further substantiate this, we empirically observed that even a simple tar- geted attack, with a random target in the batch, significantly improves robustness in positive-pan pair only SSL scenario, as shown in Table 2. There- fore, based on these theoretical and empirical in- sights, we propose to search more effective target for positive-pai targeted attack to boost the robust- ness of the self-supervised learning frameworks through experimental observations. The detailed proof of Theorem 3.2 is in the Supplementary.
Table 2: Effect of random targeted attack in positive-pair only SSL in CIFAR-5.
SSL.
Attack Type
Clean
PGD
untargeted attack
75.4
4.34
BYOL
targeted attack
83.50
31.62
untargeted attack*
66.36
36.53
SimSiam
targeted attack
77.08
47.58
*adversarial training applied in SimSiam
Similarity and entropy-based target selection for targeted attack our theoretical analysis and empirical observations, we established that targeted attacks can significantly enhance overall robustness in SSL, except for the target itself. To this end, we propose a score function, denoted as S(x, )) which aims to identify the most suitable target that is distinct from the input while effectively contributing to improved robustness. Following the studies of Kim et al. [24], Ding et [10], Hitaj et al. [21], we prioritize high-entropy examples or those located near decision boundaries crucial for generating effective adversarial examples in supervised adversarial training. Accordingly, we recommend selecting target distinct from itself, yet induces confusion, creating adversarial examples that are located close to decision boundaries 1Eq.11). The score function yields the most potent target (z') for a given base image (x). Subsequently, the targeted attack generates perturbation, maximizing the similarity to the target x' for the base image x.
To this end, we design the score function based on the similarity and entropy values, without using any class information, as follows:
Seatropy (I, x') = p' / log (p' (T) Ssimilarity (z, x')
(10)
Je/2
le'12"
STARD (1, = Sentrpy + Saimilarity
(11)
where p == hogo fxx) and e = fxx are output vectors of predictor h and encoder f, respectively. Overall, the score function S incorporates both cosine similarity and entropy. The cosine similarity

---

Table Experimental results against white-box attacks on CIFAR-I0. To see the effectiveness, we test TARO on positive-pait only self-supervised learning approaches. i.e., SimSiam, and BYO..
Evaluation type
SSL
Attack Type
Clean
PGD
AutoAttack
BYOL
Loyol
72.65
16.20
0.01
Self-supervised
BYOL
Loura-byel
84.52
31.20
22.01
linear evaluation
SimSiam
Les
71.78
32.28
24.41
SimSiam
Loure-se
74.87
44.71
36.39
BYOL
Lbyol
54.01
27.24
4.49
Self-supervieed robust linear evaluation
BYOL
Lours-byol
74.33
40.84
29.91
SimSiam
Laa
68.88
37.84
31.44
SimSiam
Lours-sa
76.19
45.57
39.25
calculated between features of base images and candidate images in the differently augmented batch. The entropy is calculated with the assumption that the vector represents the logit of an instance as Caron et al. [4], Kim et al. [24]. Our score function is designed to select an instance (x') that is different but confused with the given image (r)) thus facilitating the generation of effective adversarial examples for targeted attack (Figure 1). The experimental results in Figure 2b verify that the score function successfully selects such instances, intended.
Robust self-supervised learning with targeted attacks The TARO framework starts by selecting target image based the score function (S). It then generates adversarial examples using the selected target and performs adversarial training with them.
For a positive pair, represented differently transformed augmentations t, (2),, (2)), the tar- get images (2(') and (ar' are selected respectively, as ones with the maximum score within the batch from the score function (S) in Eq. 11. Then, generate adversarial examples, ie.. ti (zx)dv t2((x)ade for each transformed input with our proposed targeted attack (Eq. 8), where the targeted loss Crargetad-attack = -Les maximizes the similarity to the selected target to (x') and t (2'), respectively. Finally, we maximize the agreement between the representations of adversarial images (t, (x) and (ad) and the clean image ( (x) as follows:
TuRO = L(t, (x), to (z))dr) + L(t, (x:) t=(x)dde) + L(tz(x))dt ,, (x=),
(12)
where is Eq. for the SimSiam framework. Since all three instances have the same identity, we maximize the similarity between the clean and adversarial examples.
TARO could also applied to positive pairs contrastive adversarial SSL methods (e.g., RoCL [23]. ACL [22]). Since contrastive SSL does not have predictor, we use the output of the projector as p in Eq. to select the target for positive-pail Then, when we apply our targeted attack to their instance-wise attacks, as follows:
Laurs-roct Lat-xant (x), (0), (zr) + Casmilarity (t, (x), t2
(13)
where the adversarial loss is alters the untargeted attack of the positive pair with a targeted attack between the base image (t1 (x))
of the modified nt-xent loss [6] and similarity loss. Since TARO
and target image (t, (z')), eliminate the positive pair term in nt-xent loss and add similarity loss instead. The similarity loss maximizes the cosine similarity between the t (z) images and the t, (x') images which searched by the score function. Overall, we generate adversarial examples that maximize the Lours-rocl loss as shown in Algorithm 1.
Experiment
In this section, we extensively evaluate the efficacy of TARO with both contrastive and positive- pair only adversarial SSL frameworks. First, we compare the performance of our model to previous adversarial SSL methods that not utilize any targeted attacks in Section 4.1. Moreover, we evaluate the robustness of the learned representations across different downstream domains in Section 4.2. Finally, we analyze the reason behind the effectiveness of targeted attacks in achieving better robust representations compared models using untargeted attacks in Section 4.3.
7

---

Experimental setup We compare TARO against previous contrastive and positive-pan only ad- versarial SSL approaches. Specifically, we adapt TARO on top of two contrastive adversarial SSL frameworks, RoCI. [23], ACI. [22] and a positive-pair only SSL framework, SimSiam [7]. to demon- strate its efficacy in enhancing their robustness. All models use the ResNet18 backbones that are trained on CIFAR- 10 and CIFAR- 100 with lo PGD attacks with the attack step of 10 and epsilon 8/255. We evaluate the robustness of our method against two types of attack, Attokttack [8] and lo PGD attacks, with the epsilon size of 8/ 8/255, using the attack step of 20 iterations. Clean denotes the classification accuracy of the 8 backbone on the original images. We further describe the experimental details in Appendix B. Code is available in https://github.cco httpjjituu.cooKiiiii www..oc-mm-oooe/eee Laen-Kiii-iiinnnniiin git
4.1 Efficacy of Targeted Attacks in Adversarial SSL
We first validate whether the proposed targeted attacks in TARO contribute to improving the robustness of positive-pair adversarial SSL frameworks. To evaluate the quality of the learned representations with the SSL frameworks, we utilize linear and robust linear evaluation, as shown in Table 3. Then, we validate the generality of TARO to contrastive-based adversarial SSL frameworks (Table 5).
Robustness improvements in positive-pair only SSL We evaluate the efficacy of TARO by comparing those to untargeted attacks on positive-pair only SSL frame- works, i.e., SimSiam and BYOL. As shown in Table 3, when replacing untargeted attacks with TARO in the positive-only SSL, TARO contributes to attaining sig- nificant gains in both robustness accuracy against PGD attacks and clean accuracy. This is due to the inherent limitations of untargeted attacks in positive-pai pair only SSL frameworks. In such frameworks, perturbations in any direction away from the other pair of samples will
Table 4: Ablation results on target selection.
Method
Selection
Clean
PGD
None
78.14
42.89
RoCL
Random
79.26
43.45
Ours
80.06
45.37
None 71.78
32.28
SimSiam
Random
73.25
42.85
Ours
74.87
44.71
*naäve adversarial training applied SimSiam inevitably increase the SSL. loss, making it challenging generate effective adversarial examples. However, with the guidance provided by TARO, the model is able to generate stronger attack images, leading to meaningfully improved performance both on clean and adversarially perturbed images. Furthermore, we show that the untargeted attacks are not only ineffective for learning robust features, but also hinder the learning of good visual representation for clean images.
Switching from an untargeted to a targeted attack approach leads to a substantial increase in per- formance across both contrastive-basse and positive-pair only approaches, shown in Table 4. This advancement is particularly evident when addressing the challenge of selecting appropriate targets within positive pairs. As we have discussed in the Limitations section, our empirical score function may not be the absolute optimal algorithm for target selection. Nevertheless, it is clear that concentrating on targeted attacks in the context of positive pairs is crucial for enhancing robust representation, applicable to both clean and adversarial examples.
Robustness improvements in contrastive adversarial SSL The robustness gains through TARO in contrastive adversarial SSL., specifically RoCL and ACI., are demonstrated in Table 5. Given that our TARO algorithm mines the positive-pair in contrastive loss, its effects contrastive-based SSL might be more limited compared to positive-pair SSL. Despite this, TARO enhances RoCL's robustness against PGD attacks from 42.89% 45.37% without compromising the clean accuracy. In the case of ACL, TARO fortifies the robustness against PGD attacks while maintaining performance comparable AutoAAtack.
4.2 Evaluation on CIFAR-100
Robustness on larger benchmarks datasets We further validate our method on a larger dataset, CIFAR-100. In Table 6, TARO demonstrates consistent robust accuracy when compared with those of the adversarial SSL frameworks using untargeted attacks, with notably significant robustness improvements on the positive-pair only SSL. Although the clean and original robust accuracy of the positive-only SSL method is noticeably lower than that of the contrastive learning method on this particular dataset, it achieves significantly higher robust accuracy than the contrastive counterpart
8

---

Table 5: Experimental results against white-box attacks on ResNet18 trained on the CIFAR- 10 dataset. To see the effectiveness, we test TARO on contrastive adversarial SSL, i.e., RoCL, and ACL.
Table 6: Results of lin-
ear evaluation in larger dataset, CIFAR-
Evaluation type
Method
Attack Type
Clean
PGD
AutoAttack
Method
Clean
PGD
RoCI. [23]
froe1
78.14
42.89
27.19
RoCL
45.99
17.17
Self-supervised
+TARO
Lours-roel
80,06
45.37
27.95
+TARO
46.54
18,91
linear evaluation
ACL [22]
Cacl
79.96
39.37
35,97
SimSiam
24.43
13.34
+TARO
Coure-ac1
78.45
39.71
35.81
+TARO
36.02
22.18
when using our targeted attack. The results further suggest that the proposed targeted attack plays crucial role in creating effective adversarial examples.
Transferable robustness The main objective of SSL is to
Table 7: Results of adversarial transfer
learn transferable representations for diverse downstream tasks. Therefore, we further evaluate the transferable robustness of the pretrained representations trained using our targeted at- tack novel tasks from different dataset. We adopt the
learning CIFAR- 10 from CIFAR- 100.
Method
Clean
PGD
RoCL
73.93
18.62
experimental setting from the previous works on supervised adversarial transfer learning [32] which freeze the encoder and train only the fully connected layer. We pretrained the model on CIFAR- 100 and evaluate the robust transfcrability to CIFAR-10, 10. In Table 7, our model also shows impressive transferable robustness both with contrastive and positive-pair only SSL, compared to those obtained by the representations learned with untargeted adversarial SSL.
+TARO
65.21
19.13
SimSiam +TARO
53.34
11.24
50.50
25.44
4.3 Effectiveness of TARO
In this section, further analyze the effect of the targeted attacks in adversarial SSL to see how and why it works. 1) Analysis of the selected images by S, 2) Visual representation of adversarial examples that are generated with untargeted attack/targeted attack, and 3) ablation experiment on each component of the score function.
Analysis of the selected target To analyze which target images are selected by our score function (S), we use a supervised adversarial training (AT) model. We select the target images of a single class (airplane) with the score function, and for- ward them to the supervised AT model to obtain their class distribution. To further examine which are the most confusing classes for the original im- ages, we forward the base airplane images to the supervised AT model as well. As shown in Fig- ure 2a, airplane images are casily confused with the ship class and the bird class. Surprisingly, 1/3 of the target images are selected using our target selection function for airplane images belonging to either ship or the bird class, which are the most con- fusing classes for the images belonging to the air- plane class (See Figure 2b). These results strongly support that our score function effectively selects targets that are similar yet confused, as intended, without using any label information.
Moan Prosahy (%)
0.4
Number of
600
Misllosiledd samples
eurrutes
0.0
200
(a) Mean predict proba- (b) Distribution of class bility of base images Figure Analysis target from score function (S)
of targeted images
(a) Untargeted attack
(b) Targeted attack
Figure 3: Visualize emhedding
Visualization of embedding space To examine the differences between images that are generated with targeted and untargeted attacks, we visualize their embedding space. In Figure black markers represent adversarial examples, and light blue markers represent clean examples, both belonging to the same class. As shown in Figure 3a, untargeted adversarial examples are located near clean examples,
"aivv adversarial training applied in SimSiam

---

and far from the class boundaries. On the other hand, targeted adversarial examples are located near the class boundaries (Figure 3b), although it is generated in an unsupervised manner without any access to class labels. This visualization shows that our targeted attack generates relatively more effective adversarial examples than untargeted attacks, which likely to push the decision boundary to learn more discriminative representation space for instances belonging to different classes.
Ablation study of the score function To demonstrate the effect of each component in our score function, we conduct an ablation study of the score function S. The score func- tion consists of two terms: the entropy term and the cosine similarity term (Eq. 10), which together contribute to find- ing an effective target that different but confusing. We empirically validate each term by conducting an ablation experiment using only a single term in the score function during adversarial SSL training in Eq. 11. The experimental results in Table 8, suggest that the entropy term leads to good clean accuracy while the similarity term focuses on achieving better robust performance. Thus the combined score function enables our model to achieve good robustness while maintaining its accuracy on clean examples.
Table 8: Results of ablation study on score function on CIFAR-10 10.
Clean
PGD
AutoAttack
Sentropy
78.43
40.35
32.51
Setmilriiy
72.90
44.59
36.12
Stann
74.06
44.71
36.39
Conclusion
In this paper. we demonstrate that a simple combination of supervised adversarial training with self-supervised learning is highly suboptimal due to the ineffectiveness of adversarial examples generated by untargeted attacks in positive-pair only SSL, which perturb to random latent space without considering decision boundaries. To address this limitation, we proposed an instance-wise targeted attack scheme for adversarial self-supervised learning. This scheme selects the target instance based on similarity and entropy, such that the given instance is perturbed to be similar the selected target. Our targeted adversarial self-supervised learning yields representations that achieve better robustness when applied to any type adversarial self-supervised learning, including positive-pair only SSL and contrastive SSL. We believe that our work paves the way for future research in exploring more effective attacks for adversarial self-supervised learning.
Limitations
Our method's main constraint that our score function's design relies on empirical design based on the previous works. Establishing the most optimal score function theoretically for high-dimensional. non-linear deep learning model is complex task. Despite this, we' ve provided a theoretical basis for how a targeted attack can improve robustness in simple scenario for positive pairs. Our experimental results also confirm our score function's 's effectivvness, suggesting we're 've made various efforts to counterbalance our limitations. Additionally, our method demands more computational time than a simple untargeted adversarial training, given the need to select a target instance. Yet, this extra computational time is less than 5% compared to original training time. Considering the significant boost robustness, we believe it's a reasonable trade-off to implement our method. Despite these limitations, we' ve identified significant vulnerability in the untargeted attack method an essential discovery for adversarial self-super learning. Moreover, we suggest a simple yet effective way to address this vulnerability in adversarial self-supervised learning.
Acknowledgement
This work was supported by Institute of Information & communications Technology Planning & Eval- uation (ITTP) grant funded by the Korea government (MSIT) (No.2020-0-001553 and by Institute of Information & communications Technology Planning & Evaluation (IITP) grant funded by the Korea governmen((MSIT) (No.2019-0-00075 Artificial Intelligence Graduate School Program(KAIST) We thank Jin Myung Kwak, Funji Ko, Jihoon Tack, and Yulmu Kim for providing helpful feedbacks and support in journey of this research. We also thank the anonymous reviewers for their insightful comments and suggestions.
10

---

References
[1] Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square at- tack: query-efficiiet black-box adversarial attack via random search. In European Conference on Computer Vision, pages 484-501 Springer, 2020.
[2] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE symposium on security and privacy (sp), pages 39-57. IEEE, 2017.
[3] Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, Percy Liang, and John C Duchi. Unlabeled data improves adversarial robustness. Advances in Neural Information Processing Systems,
2019.
[4] Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and Armand Joulin. Emerging properties in self-supervised vision transformers. In IEEE Conference on Computer Vision and Pattern Recognition, pages 9650-9660, 2021.
[5] David Chan, Roshan Rao, Forrest Huang, and John F Canny. Gpu accelerated t-distributed stochastic neighbor embedding. Journal of Parallel and Distributed Computing. 131:1-13, 2019.
[6] Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In International Conference Machine Learning, 2020.
[7] Xinlei Chen and Kaiming He. Exploring simple siamese representation learning, In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 15750-15758, 2021.
[8] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International Conference on Machine Learning, pages 221662216. PMLR, 2020.
[9] Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with fast adaptive boundary attack. In International Conference on Machine Learning, pages 2196-2205. PMLR, 2020.
[10] Gavin Weiguang Ding, Yash Sharma, Kry Yik Chau Lui, and Ruitong Huang. Mma training: Di- rect input space margin maximization through adversarial training. In International Conference on Learning Representations, 2020.
[11] Alexey Dosovitskiy, Philipp
Fischer, Jost Tobias Springenberg, Martin Riedmiller, and Thomas Brox. Discriminative unsupervised feature learning with exemplar convolutional neural net- works. IEEE transactions on pattern analysis and machine intelligence, 38(9):1734-177 1747, 2015.
[12] Lijie Fan, Sijia Liu, Pin-Yo Yu Chen, Gaoyuan Zhang, and Chuang Gan. When does contrastive learning preserve adversarial robustness from pretraining to finetuning? Advances in Neural Information Processing Systems, 34, 2021.
[13] Lianli Gao, Qilong Zhang, Jingkuan Song, Xianglong Liu, and Heng Tao Shen. Patch-wise attack for fooling deep neural network. In European Conference on Computer Vision, pages 307-322. Springer, 2020.
[14] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples. In International Conference on Learning Representations, 2015.
[15] Sven Gowal, Po-Sen Huang, Aaron van den Oord, Timothy Mann, and Pushmeet Kohli, Self- supervised adversarial robustness for the low-label, high-data regime. In International Confer- ence on Learning Representations, 2021.
[16] Sven Gowal, Sylvestre-Alvies Rebuffi, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy A Mann. Improving robustness using generated data. Advances Neural Information Processing Systems, 34:4218-423 2021.

---

Grill, Florian Strub, Florent Altché, Corentin Tallec, Pierre H Richemond, Elena [17] Buchatskaya, Carl Doersch, Bernardo Avila Pires, Zhaohan Daniel Guo, Mohammad Gheshlaghi Azar, et al. Bootstrap your own latent: A new approach to self-supervised learning. Advances in Neural Information Processing Systems, 2020.
[18] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In IEEE Conference on Computer Vision and Pultern Recognition, pages 770-778, 2016.
[19] Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. In IEEE Conference Computer Vision and Pattern Recognition, 2020.
[20] Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. In International Conference on Learning Representations, 2019.
[21] Dorjan Hitaj, Giulio Pagnotta, Iacopo Masi, and Luigi V Mancini. Evaluating the robustness of geometry-awarg restance-reweighee adversarial training. International Conference on Learning Representations, 2021.
[22] Ziyu Jiang. Tianlong Chen, Ting Chen, and Zhangyang Wang. Robust pre-training by adversarial contrastive learning. In Advances in Neural Information Processing Systems, 2020.
[23] Minseon Kim, Jihoon Tack, and Sung Ju Hwang. Adversarial self-supervised contrastive learning. Advances in Neural Information Processing Systems, 2020.
[24] Minseon Kim, Jihoon Tack, Jinwoo Shin, and Sung Ju Hwang. Rethinking the entropy of instance in adversarial training. In First IEEE Conference Secure and Trustworthy Machine Learning, 2023.
[25] Pang Wei Koh, Shiori Sagawa, Henrik Marklund, Sang Michael Xie, Marvin Zhang, Akshay Balsubramani, Weihua Hu, Michihiro Yasunaga, Richard Lanas Phillips, Irena Gao, Tony Lee, Etienne David, Ian Stavness, Wei Guo, Berton Earnshaw, Imran Haque, Sara M Beery, Jure Leskovec, Anshul Kundaje, Emma Pierson, Sergey Levine, Chelsea Finn, and Percy Liang. Wilds: A benchmark of in-the-wild distribution shifts. In Marina Meila and Tong Zhang, editors, Proceedings of the 38th International Conference on Machine Learning, volume 139 of Proceedings of Machine Learning Research, pages 5637-5664. PMLR, 18-24 Jul 2021.
[26] Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks. In Advances in Neural Information Processing Systems, pages 1097-1105, 2012.
[27] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world, arXiv preprint arXiv:1607.0253: 2016.
[28] Ya Le and X. Yang. Tiny imagenet visual recognition challenge. In TmyJmageNeet, 2015.
[29] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks. In International Conference on Learning Representations, 2018
[30] Mehdi Noroozi and Paolo Favaro. Unsupervised learning of visual representations by solving jigsaw puzzles. In European Conference on Computer Vision, pages 69-84. Springer, 2016.
[31] Deepak Pathak, Philipp Krahenbuhl, Jeff Donahue, Trevor Darrell, and Alexei A Efros. Context encoders: Feature learning by inpainting. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 2536-2544, 2016.
[32] Ali Shafahi, Parsa Saadatpanah, Chen Zhu, Amin Ghiasi, Christoph Studer, David Jacobs, and Tom Goldstein. Adversarially robust transfer learning. International Conference on Learning Representations, 2020.
[33] Jiawei Su, Danilo Vasconcellos Vargas, and Kouichi Sakurai. One pixel attack for fooling deep neural networks. IEEE Transactions on Evolutionary Computation, 23(5):828-844 2019.
12

---

[34] Christian Szegedy, Wojciech Zaremba, llya Sutskever, Joan Bruna, Dumitru Erhan, lan Goodfel- low, and Rob Fergus. Intriguing properties neural networks. arXiv preprint 131..993,..619.
2013.
[35] Yonglong Tian, Dilip Krishnan, and Phillip Isola. Contrastive multiview coding. In European Conference on Computer Vision, 2020.
[36] Yonglong Tian, Chen Sun, Ben Poole, Dilip Krishnan, Cordelia Schmid, and Phillip Isola. What makes for good views for contrastive learning. In Advances in Neural Information Processing Systems, 2020.
[37] Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. International Conference on Learning Representations, 2019.
[38] Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. Advances in Neural Information Processing Systems, 33, 2020.
[39] Jure Zbontar, Li Jing, Ishan Misra, Yann LeCun, and Stéphane Deny. Barlow twins: Self- supervised learning via redundancy reduction. In International Conference on Machine Learn- ing. pages 12310-12320. PMLR, 2021.
[40] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning, 2019.
[41] Richard Zhang, Phillip Isola, and Alexei A Efros. Colorful image colorization. In European Conference on Computer Vision, pages 666. Springer, 2016.
13

---

Effective Targeted Attack for Adversarial Self-Supervised Learning
Supplementary Material
A Baselines.
RoCL [23]. RoCL is SimCLR [6] based adversarial self-supervised learning methods. We experiment with the official code'. To make a fair comparison, we set the attack step to as other baselines. We train the model with 1,000 epochs under the LARS optimizer with weight decay 2e 6 and momentum with 0.9. For the learning rate schedule, we also followed linear warmup with cosine decay scheduling. We set batch size of 512 for all datasets (CIFAR-10, CIFAR-100, STL10). For data augmentation, we use random crop with 0.08 to 1.0 size, horizontal flip with a probability of 0.5, color jitter with a probability of 0.8, and grayscale with a probability of 0.2 for RoCL training.
ACL [22]. ACL is SimCLR [6] based adversarial self-supervised learning methods. We conduct the experiment with the official code.. To make fair comparison, we set the attack step to 10 as other baselines. We train the model with 1,000 epochs. We set batch size 512 for STL10 dataset. For CIFAR- 10, and CIFAR-100, 100, we use the official pretrained checkpoints. For data augmentation, we use random crop with 0.08 to 1.0 size, horizontal flip with a probability probability of 0.2 for ACL training. We set PGD dual mode which calculates both clean and adversarial during the training.
0.5, color jitter with a probability of 0.8, and grayscale with a
BYORL [15] BYOLL is BYOL [17] based adversarial self-super learning methods for low label regime. Since there is no official code for BYORL we implement the BYORL by ourselves. We implement based on BYOL from a self-supervised learning library We the same CIFAR-10 setting in the library except for normalization. We exclude normalization in the data augmentation. To make a fair comparison, we implement on the ResNet18 with attack step 10 of PGI). As shown in supplementary materials in [15], when the model is trained with 10 steps in ResNet34 it shows 37. 7888 of robustness. We conjecture that we have different performance from the original paper because the original paper employs 40 steps of PGD in WideResNet34 to obtain the reported robustness which requires extraordinary computation power.
AdvCL [12]. AdvCL is SimCLR [6] based adversarial self-supervised learning which employ pseudo labels from the model that is pretrained on ImageNet [26] data. Even though the outstanding performance of AdvCL, we exclude this model as our baseline because the proposed methods require the model that is trained with the labels of ImageNet which we assume to have no label information for training.
B Detailed description of experimental setups.
B.1 Resource description.
All experiments are conducted with two NVIDIA RIX 2080 Ti. except for the experiments with CIFAR-100 experiments. For CIFAR-101 experiments, two NVIDIA RTX 3080 are used. All experiments are processed in Intel(R) Xeon(R) Silver 41 14 CPU @ 2.20GHz.
B.2 Training detail.
For all methods, we train on ResNet18 [18] with lo attacks with attack strength of e = 8//255 and step size of a 2/255, with the number of inner maximization iterations set to K 10. For the optimization, we train every model for 800 epochs using the SGD optimizer with the learning rate of
Phttps://gtt http:/:///tthhbbco//oo.eaa http://hhhh..cm//rrrrr/////ooola
14

---

Algorithm Targeted Attack Robust Self-Supervised Learning (TARO) for contrastive-based SSL
Input: Datasct D, transformation function t, model f. parameter of model 8, target score function S for iter E number of iteration do
for æ; miniBatch B (.1...., Fm do
for in do
Transform input (x:) Find target images t., (2x) from S(t., batch)
Generate targeted adversarial examples
Lcoat-sttack Let-xeet (t1(2),, {0), (t, (t1 (mme)) }) (esnstartey(t1(1 t2(xx))
6 =IIp(o.c) 8' + asigg s. [Cemttattsaa))
t, (ar,)du = bn (2s) + 8'
end for
Calculate training loss
LZARD Lae-zout (t, (x:), tia.) (x (ma)
end for 0 +- VoLCa end for
0.05, weight decay of 5.-4, and the momentum of 0.9, For data augmentation, we use random crop with 0.08 to 1.0 size, horizontal flip with probability of 0.5, color jitter with a probability of 0.8, and grayscale with a probability 0.2. We exclude normalization for adversarial training. We set the weight of adversarial similarity loss w as 2.0. We use batch size 512 with two GPUs.
In the score function, calculate the similarity score term and the entropy term shown in Equation 11. First, to exclude the positive pairs' similarity score we set the similarity score between positive pairs 1. Then, calculate the overall score, after obtaining the similarity score and entropy of each sample, we normalize each component with Euclidean normalization to balance each component to the score function. Further, the detailed algorithm of TARO for contrastive SSL is described in Algorithm I and Eq. 14.
B.3 Evaluation details.
PGD Lo attack. For all PGD loo attacks used in the test time, use the projected gradient descent (PGD) attack with the strength of c = 8/255, with the step size of a = 8/2550,, and with the number of inner maximization iteration set to K 20 with the random start.
AutoAttack. We further test against a strong gradient-based attack, i.e., AutoAttack (AA) [8]. AutoAttack is an ensemble attack of four different attacks (APGD-CE, APGD-T, FAB-T [9], and Square [1]). AGPD-CE is an untargeted attack, APGD-T and FAB-T are targeted attacks. The Square is a black-box attack. We use official code to test models!!
Self-supervised learning. For self-supervised learning, we denote linear evaluation when we use only clean images to train the fully connected (fc) layer after the pretraining phase. When we denote robust linear evaluation, we train the fe layer with adversarial examples. While ACL uses partial fine-tuning to obtain their reported accuracy and robustness, to make fair comparison, we freeze the encoder and train only the fe layer. Robust fine-tuning is training all parameters including parameters of the encoder with adversarial examples. For linear evaluation, we followed the baseline hyperparameters for each model. We train the baseline models with 150 epochs, and ACL, respectively. We also followed their learning rate of 0.1, 0. and x 10 for RoCL, and ACL, respectively. On the other hand, we train our model with 100 epochs with a learning rate of 0.5 for linear evaluation. We use AT loss for robust linear evaluation except for ACL. For ACL, use TRADES loss as the official code.
epochs, and 50 epochs for RoCL,
C Experimental Details of Analysis.
Analysis the distribution of target class. To analyze the target from the score function (S), employ an adversarially supervised trained model. We calculate the score function that is trained with our TARO on SimSiam. We use train set. For each class, calculate the mean predict probability, which is the average of all softmax outputs of target images from the supervised trained
Phttps://gitee htt.g//hhh...ccmee/////ttttooooo
15

---

model. Further, we also count the number of samples that are predicted for each class. In Figure 2. the results are target images of the airplane as a base image. There is similar tendency even though we change the base class to other classes as shown in the following Figure 4.
Samoles
603
Mislassfeed samples
Mdean Protenary (h)
04
Number Sammicia
400
pampley
Mucckoolled
Mean Prebntay
200
203
(a) Distribution of class of target of automobile
(b) Mean predict proba-
(c) Distribution of class of target of deer
(d) Mean predict proba- bility of deer
bility of automobile
Figure 4: Analysis of target distribution in different classes
Visualization of embedding space. To visualize the embedding of our targeted attack and un- targeted attack, we use t-Distributed Stochastic Neighbor Embedding (t-SNE) [5] with the cosine similarity metric. Our TARO model is trained on CIFAR-10 as feature extractor. We sample a few examples and conduct two types of attack, the untargeted attack and the targeted attack. To visualize more effectively we ignore the other seven classes in CIFAR-10. We visualize clean examples from three classes and then visualize adversaries that are generated with our targeted attack and untargeted attack, respectively, with dark blue.
D Additional Experiment
Contrastive based adversarial self-supervised learning with TARO. Our TARO could be also
applied to positive pairs contrastive- based adversarial self-supervised learning ge.g.. RoCI. [23],
ACL [22]). We applied our TARO in instance-wisg attack of the contrastive-base approaches as follow,
Lattack Lat-xent (xr, (0), (Fneg]) + Caimstarity(a (I,, {x
(14)
where attack loss is consists of original attack loss nt-xent loss [6] and similarity loss. The similarity loss additionally constrains the positive pairs as the TARO that maximize the similarity between the with the jth index images which is searched by our TARO score function. Overall, generate adversarial examples that maximizes the Lattack loss. Surprisingly, when we apply TARO on the contrastive learning based approach, previous work could achieve marginally better clean accuracy and robustness. This shows that our empirical assumption also holds on contrastive-based SSL but since there is (1/batch size) effects on the total loss the gain could be marginal.
Robustness against black box attack We conduct black box attack to verify our model is robust to gradient free attacks. We generate black box adversaries with AT [29] model, RoCL [23] model and our models. Then, we test adversaries to each other. As show in the table, our model is able to defend the black box attack from AT model than the RoCL model. Moreover, our model generates stronger black box adversaries than RoCL since AT model shows more weak robustness.
Table 9: Results of black box attack. Mod- els on the row are the tested models. Models on the columns are the source models to gen- erate black box adversaries.
AT
RoCL
Ours
AT
59.73
60.92
RoCL Ours
70.40
57.98
69.97
54.99
Robustness against diverse attacks We tested
Table 10: Results against diverse attacks.
our approach against diverse types of adversar- ial attacks, including the Carlini-Wagner (CW) at-
Method
PGD
CW
Pixle
PIFGSM
tack [2], black- box attack, i.e., Pixle [33], and Patch- attack, i.e., PIFGSM [13], as shown in Table 10. Since our approach already showed improved per- formance against Autoattack, which includes black- box Square attacks, our approach able to consistently demonstrates enhanced robustness against both the CW attack and black-box attacks.
RoCL
42.89
76.45
67.32
43.23
+TARO
45.37
72.75
68.40
44.56
SimSiam
32.28
68.14
54.56
28.31
+TARO
44.97
73.87
67.22
46,37
16

---

E Proof of the Theorem
Let consider the problem simple binary task using linear layer model to demonstrate theoretical motivation. The dataset DD = X. consists of training examples, where I E X represents training example without any class label. We assume there is single positive pair and a single negative pair. The linear model denoted as f(.). The adversarial perturbations generated using both losses are as follows:
f(z 55)
f(x)
adv I + arg max
subject
|| S E,
[1f(x + -)]ll [1f(z))
1(x+8)
f(x)
(15)
exp
[[5(++
adv nt-xent = I: + arg max
log
subject to
||||| S
f(a++88) [[(x+
Manee
/T)
exp
where we approximate the cosine similarity distance loss into & distance function. In both cases, maximizes the respective loss, subject the constraint that the norm of ő less than or equal
to c. The objective in positive-only SSL is to make the perturbed and original samples dissimilar as follows.
Sa arg max [(x) - [(x + +61,
(16)
8
8 out-rent = arg max f(x) - f(x + 6)1 - (f(eg) - f(x + 6)1.
(17)
6
The range of adversarial attack of each loss is then calculated follow,
||ó | =II arg max [() - f(x + 6)ll
(18)
= arg max ( (z)(z) - f(x= - 5)1)²
|[6at-eent || = arg max (lf(x) - f(x - 8)1 - (f( - f(x + +1
= arg max (1f(x) - f(x + 6)12 - 21)(z) - ff(x + 5)] (f( f(x + 5)1
+| +If(Xmz)) - f(x + ())²)
R arg max (If(z) - f(x + 2) - (f(nee)) - f(x + 8)1 + ([(nne)) - 1xx + 6)1²)
zo arg max (If(z) - f(= + 6)1² + (f(c))) f(x+
+ 6) 5e
arg max (xx) f(x + 6)P2
(19) If there are more negative pairs, the difference in perturbation range between positive-pair-onl attacks and contrastive attacks could become more pronounced.
Theorem E.1 (Perturbation range of self-supervised learning loss). Given a model trained under the positive-only distance loss, the adversarial perturbations òes are likely to be smaller than those perturbations Oat-zent, from a model trained under the positive-pair and negative-pair distance loss. Formally, | < 118ac-eossloa
When applying a random targeted attack within the positive-pair-one self-supervised learning framework, we can effectively increase the range of perturbations. Let us assume that the target instance Ttarget is different from the original instance ar and the distance between them is greater than the threshold The perturbations generated through the targeted attack are as follows:
Dtargeted-attact arg max [f + 6) f*taargtt))
(20)
5
Let us denote target instance Ttarget as x' for simple equations,
[f(z) f(x + 0)1 < If(x') f(x + 8)1
:: l x| >
= [f + 5) - -xx'))
(21)
:. || arg max If(z) - f(x + 8)ll < ||argmax If(z + 8) f(x')ll
17

---

The random targeted attack, which targets instances that are at a greater distance than å from the original input, can potentially increase the perturbation range and ultimately enhance overall robustness.
Theorem E.2 (Perturbation range of targeted attack), Given model trained under the f targeted-attaac loss, the adversarial perturbations sargeted-attack likely be larger than those from a model trained under the Les. Formally, || (Deareltes-attacclll > l10selloo.
F Broader Impacts
The pursuit of adversarial robustness against malicious attacks within deep neural networks remains an unsolved, yet fundamental area of deep learning research. To date, several self-supervised adversarial training approaches have been proposed, primarily based on the contrastive learning framework. However, the attainment of robustness via a "positive-pair only' self-supervised learning approach is still under-explored. Consequently, self-supervised frameworks have evolved from large batch contrastive learning to focus on single "positive-pair only' learning paradigms. The area of self-super learning that we are targeting aims to delve into the robustness these new learning frameworks through our tailored attacks. Furthermore, in self-super learning is a crucial research path towards achieving authentic robustness in representation. We hope that work will inspire more research aimed at achieving generalizable robustness unseen domains and datasets by leveraging the potential of various self-suuprvised frameworks.
believe that achieving superior robustness
18


Reviews:
[{"review_id": "V9iIlXoHLi", "reviewer": "Reviewer_aDD2", "summary": "This paper investigates the problem of unsupervised adversarial training. It claims that previous non-contrastive, positive-only SSL frameworks suffer from ineffective learning with untargeted adversarial samples. Based on this, this paper proposes a new TARO paradigm, which conducts targeted attacks to select the most confusing but similar samples for guiding the gradients toward a desired direction. Experiments show some great results.", "questions": "See above", "limitations": "n/a", "rating": 4, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. The motivation of this paper is clear, which addresses the limitation so existing positive-only SSL frameworks.\n2. The paper is well-organized and easy to read.\n3. Supplementary file is provided.", "weaknesses": "1. The novelty is incremental. Actually, the technical design of targeted adversarial SSL is too straightforward. Although many theorems are provided in the paper to support it, I don't think they are critical to the final model design.\n\n2. Missing many related works. The references are out-of-data, they are all published before 2022. There are many recent papers of this topic, the authors should carefully revisit them and discuss with them.\n\n3. The experiments are unconvincing. The baselines are old, the authors should conduct experiments with latest baselines. Moreover, the ablation study is also insufficient.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your positive comments on our contributions, which highlight clear motivation and address the limitations of existing positive-pair-only SSL frameworks in robustness. \n\n----\n\nIn the following response, we have done our best to resolve all the concerns that you raised regarding our work. Please find our detailed response below, and if there are further concerns about our work, do not hesitate to share your comments. We would be delighted to address any additional questions or concerns you may have.  \n\nThank you again for your valuable comments and thoughtful review.\n\n----\n\n**Weakness 1.** The novelty is incremental. \n* We appreciate the feedback, but it appears there may be a fundamental misunderstanding of our work that requires clarification.\n* In Table 2 of our manuscript (also summarized in the following table), we observe that robustness in positive-pair only SSL is extremely vulnerable compared to success in adversarial contrastive-based SSL. The vulnerability in positive-pair only SSL can be attributed to the restricted range of perturbation, in contrast to that generated by contrastive-based SSL, as elucidated in Theorem 3.1. Based on this observation, we propose a simple yet effective approach wherein a targeted attack can be employed to augment the perturbation range, as outlined in Theorem 3.2.\n* We would like to underscore that, to the best of our knowledge, **the utilization of targeted attacks between two instances has not been previously explored** in the field of adversarial SSL.\n* **Our approach is founded on theoretical motivation** that suggests a targeted attack amplifies the range of attack strength in positive-pair only SSL (as detailed in Section 3, Lines 185-214). This method involves a methodical design that conducts targeted attacks between positive-pair instances to enhance the robustness of adversarial SSL. \n* Our novel score function proposal involves **selecting more strategic targets, rather than random instances, to increase robustness** in adversarial SSL, building on prior studies [1,2,3].\n* Our empirical findings ensure the effectiveness of our score function design. As shown in the corresponding table, our score function outperforms random selection in terms of robustness, thereby substantiating the merits of our method.\n|Type|Method|Target selection|Clean|Robustness|\n|-|-|-|-|-|\n|Positive-pair only SSL|SimSiam|-|71.78|32.28|\n|Positive-pair only SSL|SimSiam+TARO|Random|73.25|42.85|\n|Positive-pair only SSL|SimSiam+TARO|Score function|74.87 **(+3.09)**|44.71 **(+12.43)**|\n\n* Our targeted adversarial SSL can be adapted to any kind of adversarial SSL framework including contrastive-based SSL and non-contrastive-based SSL, i.e., positive-pair-only SSL, which is especially effective in positive-pair-only SSL (Table 3). The summarized table is as shown follows:\n|Type|Method|Clean|Robustness|\n|-|-|-|-|\n|Contrastive-based SSL|RoCL|78.14|42.89|\n|Contrastive-based SSL|RoCL+TARO|80.06 **(+1.92)** |45.37 **(+2.48)**|\n|Positive-pair only SSL|SimSiam|71.78|32.28|\n|Positive-pair only SSL|SimSiam+TARO|74.87 **(+3.09)**|44.71 **(+12.43)**|\n\n[1] Mma training: Di- rect input space margin maximization through adversarial training. ICLR 2020 \\\n[2] Evaluating the robustness of geometry-aware instance-reweighted adversarial training. ICLR 2021 \\\n[3] Rethinking the entropy of instance in adversarial training., SaTML 2023 \n\n-----\n**Weakness 2**. Many recent related works are missing. \n* Thanks to your comments, we will add recent references [4,5,6] in our paper including the publication in 2023.\n* Since our approach can be applied to various kinds of adversarial SSL, including the contrastive-based SSL approach, we applied TARO to DynACL [6]. As shown in the response to Weakness 3 below, experimental results show that our approach is also effective in [6]. If you have additional publications that need to be revisited in our paper, please let us know so we can include them in our comparison.\n\n-----\n**Weakness 3.** Experiments are not convincing due to old baselines and insufficient ablation study.    \n* As we mentioned in the previous response, we additionally conduct the experiment on top of the most recent work, i.e., DynACL'23 [6].\n* As illustrated in the table below, TARO is also effective with DynACL, a recent variation of ACL that schedules the data augmentation strength during pretraining. Since TARO proposes to adjust the attack to be stronger than the original ACL attack, our approach is applicable and can demonstrate effectiveness with this recent variation of ACL, specifically DynACL.\n| | Clean | PGD| AutoAttack | \n|-|-|-|-|\n|DynACL|78.56|46.10|43.31|\n|DynACL+ TARO|**78.83**|**46.79**|**43.53**|\n\n* Furthermore, we conducted an ablation study on our score function to confirm the effectiveness of our selection algorithm within both the contrastive learning framework and the positive-pair only framework. Compared to random selection, our score function exhibits superior robustness in adversarial SSL, thereby underscoring the advantages of our approach.\n* Please let us know if any further ablation studies are needed to understand our approach.\n||Target Selection|Clean|PGD| AutoAttack | \n|-|:-:|-|-|-|\n|SimSiam|-|71.78|32.28|24.41|\n|SimSiam+TARO|Random|73.25|42.85|34.72|\n|SimSiam+TARO|Score function|**74.87**|**44.71**|**36.39**|\n|RoCL|-|78.14|42.89|27.19|\n|RoCL+TARO|Random|79.26|43.45|27.24|\n|RoCL+TARO|Score function|**80.06**|**45.37**|**27.95**|\n\n[4] Xie et al., Adversarial examples improve image recognition, CVPR'20 \\\n[5] Fan et al., When does Contrastive Learning Preserve Adversarial Robustness from Pretraining to Finetuning?, NeurIPS'21 \\\n[6] Luo and Wang et al., Rethinking the Effect of Data Augmentation in Adversarial Contrastive Learning, ICLR'23"}, {"review_id": "u2fmmMOlfA", "reviewer": "Reviewer_A38P", "summary": "The paper proposed the targeted attack for adversarial self-supervised learning to solve the suboptimal learning issue in positive pair-only self-supervised learning. To improve the robustness of adversarial self-supervised learning (SSL), the author leverages the targeted selection mechanism based on the score function and generate the samples by selected targets for adversarial training. The paper empirically validates that target attacks can improve the adversarial robustness of several previous adversarial SSL methods including BYORL and SimSiam.", "questions": "Can the proposed method be applied to the transformer-based model, such as ViT?", "limitations": "yes, the authors adequately addressed the limitation", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The paper is well-organized and easy to follow. The proposed idea is clear and has good motivation.", "weaknesses": "For the transferable robustness part, the author mentioned that TARO can transfer robustness from one task to another. In my opinion, CIFAR100 and CIFAR10 share a similar domain and is not trivial to transfer the robustness. Although the authors evaluate on AutoAttack, which is a well-known strongest attack so far, one thing that I might be curious about is the transferability from the PGD attack (known attack) to other kinds of unknown attacks such as the Patch attack, CW_l2. ", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your positive comments on our work, which highlight good motivation clear idea with well-organized writing. \n\n---\nIn the following response, we have done our best to resolve all the concerns that you raised regarding our work. Please find our detailed response below, and if there are further concerns about our work, do not hesitate to share your comments. We would be delighted to address any additional questions or concerns you may have during the discussion phase.\n\nThank you again for your valuable comments and thoughtful review.\n\n---\n**Weakness 1.** CIFAR100 and CIFAR10 seem not trivial to transfer the robustness.\n* As you commented we also tested on the different domains transferring from CIFAR10 to STL10, the robustness in the following table. Consistently, our approach shows better-transferring robustness in non-trivial transfer tasks.\n* However, please note that transferring the robustness is one of the challenging tasks to achieve even from a similar domain from CIFAR100 to CIFAR10 [1]. Therefore, many previous works have conducted experiments on CIFAR100 to CIFAR10, and we followed the same setting as [1,2,3]. \n\n| CIFAR10  | target dataset| Clean | PGD $\\ell_{\\infty}$ | \n|--|:-------:|-----------|-----------|\n|RoCL|STL10|63.85|32.75|\n|RoCL + TARO|STL10|**67.30**|**32.90**|\n|SimSiam|STL10|30.22|12.66|\n|SimSiam + TARO |STL10|**54.45**|**33.44**|\n\n\n[1] Shafahi et al., Adversarially Robust Transfer Learning, ICLR 2020 \\\n[2] Kim et al., Adversarial Self-Supervised Contrastive Learning, NeurIPS 2020 \\\n[3] Fan et al., When does Contrastive Learning Preserve Adversarial Robustness from Pretraining to Finetuning?, NeurIPS 2021 \n\n----\n**Weakness 2.** Attack transferability to CW or Patch attack.\n* Following your suggestions, we evaluated our approach against Carlini-Wagner (CW) attack [1], black-box attacks, i.e., OnePixel [2], and Patch-attack, i.e., PIFGSM [3], to demonstrate transferability of the attack types. \n* As shown in the following Table, our works are able to demonstrate the transferable robustness against diverse attacks in both contrastive-based TARO and positive-pair only based TARO.\n|Type|Method|PGD|CW [1]|OnePixel [2]|PIFGSM [3]|Average|\n|-|-|-|-|-|-|-|\n|Contrastive-based SSL|RoCL|42.89|76.45|67.32|43.23|57.47|\n|Contrastive-based SSL|RoCL+TARO|45.37|75.38|68.40|44.56|**58.43**|\n|Positive-pair only SSL|SimSiam|32.28|68.14|54.56|28.31|45.82|\n|Positive-pair only SSL|SimSiam+TARO|44.97|73.87|67.22|46.37|**58.11**|\n\n[1] Towards Evaluating the Robustness of Neural Networks, 2017  \\\n[2] One pixel attack for fooling deep neural networks, 2018 \\\n[3] Patch-wise Attack for Fooling Deep Neural Network, 2022\n\n----------\n\n**Question. Can TARO be applied to ViT?**\n* Our work is a model-agnostic approach so that TARO can be applied to a transformer-based model. \n* We are currently running experiments on ViT with TARO. However, due to the computational costs, it will take a few days to obtain the full set of results, and we will soon update our table as soon as they are out."}, {"review_id": "wLfIS5my8k", "reviewer": "Reviewer_zysz", "summary": "This paper proposes a new adversarial attack on self-supervised learning methods which is called TARO. The method performs an attack \"on the positive-pair that perturb the given instance toward the most confusing yet similar latent space, based on entropy and similarity of the latent vectors.\" Authors show that this attack can be used to improve adversarial robustness of the underlying semi-supervised learning framework.", "questions": "- How improves adversarial training using TARO robustness against other attacks, e.g. Carlini-Wagner or black-box attacks?\n- Are there any other SSL methods besides BYOL and SimSiam which could benefit from TARO?", "limitations": "Limitations are not discussed in the paper.", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The experimental evaluation shows that TARO can be used to improve adversarial robustness of positive-pair-only self-supervised learning approaches (SimSiam and BYOL).\n- The paper is mostly well-written and comprehensible. It also gives a useful overview of the necessary backgrounds. ", "weaknesses": "- Mathematical notation can be improved at some points:\n\t1. In Section 3.1 the authors state that the dataset $\\mathcal{D} = \\\\{X, Y\\\\}$ is a set of the training data and the corresponding labels. This does not make sense: $\\mathcal{D}$ has to be a tuple and X and Y also need to be ordered sets.\n\t2. For me it is not clear what is meant by ${z_{pos,neg}}$ in Equation 2. The used notation suggests that it is a set containing a single element. However, that does not make sense as the sum in the denominator should go over all positive and negative samples. \n\t3. In Equation 3 it is not specified at all over which entries the sum is calculated. \n- The number of evaluated attacks is too small. The authors only compare against PGD and Autoattack. It might be interesting to compare against other attacks, e.g. Carlini-Wagner or black-box attacks.\n- Theorem 3.2 states that \"...adversarial perturbations are *likely* to be larger than...\". However, the next sentence states that this is always the case. I suggest that the authors reformulate that sentence.\n- Figure 1 is difficult to understand. I had to read some more sections first to understand that the positive-pair only attack is proposed in the paper. Maybe, the term should be mentioned earlier (perhaps even in the abstract.)\n\nMinor comment:\n- Using verbatim in formulars is quite uncommon. I suggest the authors use \\text{}, but this is a matter of taste.\n- \"positive-pair only\" vs. \"positive-pair-only\"\n\nOverall, I see merit in this submission and willing to recommend acceptance after the weaknesses mentioned in my review were addressed.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your positive comments on our work, that our work **highlights the improvement of robustness** in the positive-pair-only self-supervised learning approach, **acknowledges the well-written and comprehensive** paper, and **has merits**.\n\n-----\nIn the following response, we have done our best to resolve all the concerns that you raised in the weakness section. Please find our detailed response below, and if there are further concerns about our work, do not hesitate to share your comments. We would be delighted to address any additional questions or concerns you may have.\\\nThank you again for your valuable comments and thoughtful review.\n\n---\n**Weakness 1.** Mathematical notation should be revised.\n* We will revise mathematical notation as follows. Furthermore, we will also go over other parts to improve the clarity of the mathematical notations.\n1) In Section 3.1 the authors state that the dataset D={X,Y} is a set of the training data and the corresponding labels.\n    * We will revise the definition of dataset as follows: dataset $D=${$(x_i,y_i)$} where $x_i \\in R^D$ are input images and $y_i \\in R^N$ are their corresponding labels from the N classes.\n2) For me it is not clear what is meant by zpos,neg in Equation 2. \n    * It is a typo, and we apologize for the confusion. {$z_{\\text{pos}}$} and {$z_{\\text{neg}}$} are the sets of the latent vector \\(z\\) of positive-pair and negative pairs, respectively. We will revise Equation 2 as follows: \n$L_{nt-xent} (x,\\\\{ x_{pos}\\\\}, \\\\{x_{neg}\\\\}) := -log \\frac{\\sum{z_p\\in\\\\{z_{pos}\\\\}} (sim(z, z_p)/\\tau) } {\\sum{z_p \\in\\\\{z_{pos}\\\\}} (sim(z, z_p)/\\tau)+\\sum{z_n \\in \\\\{z_{neg}\\\\}} (sim(z, z_n)/\\tau)}$\n3) In Equation 3 it is not specified at all over which entries the sum is calculated.\n    * Equation 3 represents the objective of SimSiam [1], a positive-pair only SSL framework. The loss function calculates the cosine similarity between the positive pairs, which are originally the same instance but augmented differently. For clarification, we will revise the Equation as follows:\n$L_{ss}(x, x_{pos})$=$L_{t_1(x), t_2(x)}=-\\frac{1}{2}\\frac{p_1}{||p_1||_2}\\frac{z_2}{||z_2||_2}-\\frac{1}{2}\\frac{p_2}{||p_2||_2}\\frac{z_1}{||z_1||_2}$\nwhere $p_i =h \\circ z_i$ and $z_i=g\\circ f(t_i(x))$.\n\n[1] Exploring simple siamese representation learning., CVPR 2021\n\n---\n**Weakness 2./ Q1.** Evaluation against other attacks is needed.\n* Thank you for your comments. Following your suggestions, we tested our approach against the Carlini-Wagner (CW) attack [1], black-box attacks, i.e., Pixle [2], and Patch-attack, i.e., PIFGSM [3], as shown in the following table. Since our approach already showed improved performance against Autoattack, which includes black-box Square attacks, our approach is able to consistently demonstrates enhanced robustness against both the CW attack and AT black-box attacks.\n||PGD|CW [1]|Pixle [2]|PIFGSM [3]|\n|-|-|-|-|-|\n|RoCL|42.89|76.45|67.32|43.23|\n|RoCL+TARO|45.37|72.75|68.40|44.56|\n|SimSiam|32.28|68.14|54.56|28.31|\n|SimSiam+TARO|44.97 |73.87|67.22|46.37|\n\n[1] Towards Evaluating the Robustness of Neural Networks, 2017 \\\n[2] Pixle: a fast and effective black-box attack based on rearranging pixels, ECCV2020 \\\n[3] Patch-wise Attack for Fooling Deep Neural Network, 2022\n\n---\n**Weakness 3.** Theorem 3.2 should be reformulated.\n* Thank you for your comments. We will reformulate Theorem 3.2 as follows to make the theorem more clear.\n> Theorem 3.2 **[Perturbation range of targeted attack]** Given a model trained under the $L_{\\text{targeted-attack}}$ loss, the adversarial perturbations $\\delta_{\\text{targeted-attack}}$ are larger than the adversarial perturbations $\\delta_{\\text{ss}}$ from a model trained under the $L_{ss}$. Formally, $|\\delta_{\\text{targeted-attack}}|$ $>\\|\\delta_{\\text{ss}}\\|_\\infty$.\n\n----\n**Weakness 4.** Figure 1 is difficult to understand and positive-pair only attacks should be explained earlier.\n* We will revise the abstract to include mention of the positive-pair-only attack for better readability. Furthermore, we have also revised Figure 1, providing clearer descriptions for the captions in the PDF.\n\n----\n**Minor comment:**\n    We will revise verbatim in formulas and use \\text{}. Moreover, we will use the consistent term “positive-pair only” in all manuscripts for better consensus of the term. Thanks for the comments!\n\n---\n**Question.** Are there any other SSL methods besides BYOL and SimSiam which could benefit from TARO?\n* Our TARO can leverage any kind of SSL method that employs positive pairs to learn visual representation. Therefore, methods like BYOL and SimSiam, which solely rely on positive-pair-only frameworks, show larger benefits from TARO (Table 3). Furthermore, the contrastive-based approach SimCLR, which also employs positive pairs in representation learning along with negative pairs, also benefits from TARO as shown in Table 4. \n* Based on your question, we further examine the applicability of TARO by applying it to adversarial self-supervised learning in an additional self-supervised learning framework: Barlow Twins. Barlow Twins is a framework that learns visual representation using positive pairs and redundancy regularization.\n* Since there are no adversarial baselines based on Barlow Twins [2], these results may underfit due to a simple combination of [1] and Barlow Twins [2]. However, when we apply TARO to the adversarial Barlow Twins using the same hyper-parameters and the same settings, **it shows much better clean performance and robustness, as demonstrated in the following table**. This further demonstrates the applicability of our TARO on positive-pair of SSL frameworks.\n|Method|Clean|AutoAttack Robustness|\n|-|-|-|\n|[1]+Barlow Twins [2] | 61.94|11.71|\n|[1]+Barlow Twins [2] + TARO|75.37 **(+13.43)**|26.43 **(+14.72)**|\n\n[1] Kim et al., Adversarial Self-Supervised Contrastive Learning, NeurIPS 2020 \\\n[2] Zbontar et al., Barlow Twins: Self-Supervised Learning via Redundancy Reduction, ICML 2021"}, {"review_id": "vPLoeT8MBn", "reviewer": "Reviewer_Uc5D", "summary": "This paper highlights that untargeted attacks for adversarial self-supervised learning result in poor downstream robustness. Instead, they suggest utilizing targeted attacks and propose a scoring method for selecting the target samples. They show that this approach results in significant robustness improvements over the untargeted attacks.\n", "questions": "1. I did not understand the “Analysis of the selected target”. What is the AT model used? How was it trained? And why was an AT model preferred to a standardly trained one? It is also not particularly clear what Fig. 2a shows. Perhaps more clarity in the writing could help.\n2. The notation in the “Similarity and entropy-based target selection for targeted attack” paragraph is confusing. $p’$ and $p$ are used in the equations but $p_i$ is defined below. Is $S_\\text{entropy}$ a vector or a scalar? If $p$ is a vector of logits then isn’t $S_\\text{entropy}$ a vector? \n\nTypo:\n- The sentence starting on line 361, an unnecessary “are” and “belonging” should be “belong”.", "limitations": "As mentioned in Weaknesses.", "rating": 7, "confidence": 5, "soundness": 2, "presentation": 4, "contribution": 3, "strengths": "1. The paper highlights a major issue with adversarial self-supervised learning for non-contrastive models, that the untargeted attacks typically used fail to deliver good downstream robustness.\n2. The proposed method shows significant robustness improvement when compared to positive-only untargeted attack.\n3. The paper is well-written and the definitions and argumentation are easy to follow.", "weaknesses": "1. The proposed method, TARO, has two components but their individual contributions are not studied. TARO improves over the positive-only unsupervised attack by i. changing it to a targeted attack and ii. by selecting the target using a score function. However, there are indications in the prior work and in the results in this paper that the majority of the improvement comes from i. and not ii. For example, (Petrov and Kiwatkowska, 2022) also compare targeted and untargeted adversarial self supervision and show that targeted attacks across the whole batch result in more certifiably robust models than the untargeted ones.  The fact that the improvements in Table 4 in this paper are significantly lower than the improvements in Table 3 is further evidence that it might be i. that drives the improvement rather than ii. Hence, the authors should consider adding an additional baseline to all their results where instead of using their score function, they select a random sample from the batch. This would also be computationally easier, as the paper reports a 5% overhead for the target selection.\n2. The paper does not address the fact that the training loss and the loss used for computing the adversarial samples need not be the same. In fact, a number of prior works have this precise setting, e.g., (Alayrac et al., 2019), (Nguyen et al., 2022). Hence, it is not particularly novel that the loss used for training a positive-only model can be different from the one used for the attacks.\n3. Only RoCL and ACL are compared against the novel method, but a number of other unsupervised adversarial training methods have been proposed as listed above. In order to claim that the target selection via a score function is better than them, the authors should compare with a larger range of methods. In my view, it is especially important to compare against methods that generate adversarial examples using the whole batch, rather than a single target as these methods might be stronger than the proposed TARO. Some examples of such prior work are (Ho and Vasconcelos, 2020), (Fan et al., 2021), (Petrov and Kwiatkowska, 2022) and the Adversarial-to-Adversarial and Dual Stream methods by (Jiang et al., 2020).\n4. In the “Visualization of embedding space” paragraph and Fig. 3, it is actually not that clear whether the targeted attacks generate more samples on the boundary than the untargeted attacks. Visually the two plots seem quite similar. \n\nReferences:\n\nJean-Baptiste Alayrac, Jonathan Uesato, Po-Sen Huang, Alhussein Fawzi, Robert Stanforth, and Pushmeet Kohli. Are labels required for improving adversarial robustness?, 2019\n\nChih-Hui Ho and Nuno Vasconcelos. Contrastive learning with adversarial examples, 2020\n\nZiyu Jiang, Tianlong Chen, Ting Chen, and Zhangyang Wang. Robust pre-training by adversarial contrastive learning, 2020\n\nLijie Fan, Sijia Liu, Pin-Yu Chen, Gaoyuan Zhang, and Chuang Gan. When does contrastive learning preserve adversarial robustness from pretraining to finetuning?, 2021\n\nA. Tuan Nguyen, Ser Nam Lim, and Philip Torr. Task-agnostic robust representation learning, 2022\n\nAleksandar Petrov and Marta Kwiatkowska. Robustness of Unsupervised Representation Learning without Labels, 2022", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Weakness 1:** Individual contributions of two components (i. changing it to a targeted attack and ii. selecting the target using a score function.) are not studied. Lower improvements in Table 4 compared to Table 3 suggest that [i] might be driving the improvement, rather than [ii].\n\n**Response:** **There seems to be a critical misunderstanding of our work.** Our approach consists of **two interrelated components**, not individual ones: [i] changing to a targeted attack and [ii] selecting the target using a score function. It's important to note that component [ii] is not separate but rather boosts the performance of component [i] (Line 245-251).\n* [i] is proposed based on the theoretical motivation of Theorem 3.2, which suggests that targeted attacks enlarge the scale of attacks (Line 230). Empirically, we demonstrate the effect of the first component in Table 2.\n* [ii] is introduced to find a more effective target rather than random instances, enhancing the robustness of the self-supervised models. As shown in Table 3, the model can achieve improved robustness due to selecting a more effective target for the targeted attack in Equation 9 (Line 227). We summarize the tables in the below.\n|Method|Component|Clean|PGD|\n|-|-|-|-|\n||-|71.78|32.28|\n|SimSiam|[i]|73.25|42.85|\n||[i]+[ii]|**74.87**|**44.71**|\n* This improvement also holds true in contrastive-based SSL, such as RoCL and ACL, as indicated in the following table.\n* Specifically, random targeted attacks boost the performance of the original RoCL and ACL. When we employ the score function to select a more effective target for the targeted attack, the model can achieve even better robustness.\n|Method|Attack|Target Selection|Clean|PGD|\n|-|-|-|-|-|\n|RoCL|Untargeted|-|78.14|42.89|\n||Targeted|Random|79.26|43.45|\n|||Score function|80.06|45.37|\n|ACL|Untargeted|-|79.96|39.37|\n||Targeted|Random|73.25|42.85|\n|||Score function|78.45|39.71|\n* The reason that the improvements in Table 4 are lower than those in Table 3 is **due to the different frameworks employed.** \n* Table 3, based on positive-pair only SSL frameworks like BYOL and SimSiam, contrasts with Table 4, which shows results from a contrastive learning framework like SimCLR. BYOL and SimSiam benefit more from TARO due to their reliance on positive pairs (Line 312-316).\n* The contrastive-based approach SimCLR diminishes TARO's effect by using both positive and negative pairs in representation learning, reducing the positive pair effect to 1/batch size in loss objectives (Line 321-323).\n\n---\n**Weakness 2:** The paper does not address the fact that the training loss and the loss used for computing the adversarial samples need not be the same.\n\n**Response:** This is a critical misunderstanding of our contributions. Our primary contribution is not proposing a different attack loss compared to the training loss to gain robustness.\n* Instead, our novel contribution is that we first propose a targeted attack between the positive pair for adversarial self-supervised learning. This proposal is based on theoretical motivation (Theorem 3.2), where a targeted attack can generate stronger adversaries during adversarial representation learning (Table 2). \n* We summarize the tables in the below.\n|SSL|Attack Type|Clean|PGD|\n|-|-|-|-|\n|SimSiam|Untargeted|66.36|36.53|\n||Targeted|77.08 **(+10.02%)**|47.58 **(+11.05%)**|\n* We propose to **switch from an untargeted attack to a targeted attack** between the original image and the selected target image, i.e. positive-pair images, as outlined in the following equation. \n> Untargeted attack\n$\\delta^{t+1}=\\Pi_{B(\\epsilon)}(\\delta^t+\\alpha sign(\\nabla_{\\delta}L(t1(x_i), t2(x_i)))$ \\\n> Targeted attack\n$\\delta^{t+1}=\\Pi_{B(\\epsilon)}(\\delta^t+\\alpha sign(\\nabla_{\\delta}-L(t1(x_i), t2(x_j)))$\n\n---\n**Weakness 3:** Limited comparisons.\n\n**Response:** Thank you for the related work suggestions; they will be included in our revision. Since our method suits any adversarial SSL framework using positive-pair images, we applied the TARO method to recent work (DynACL) and confirmed TARO's effectiveness.\n* Please note that since [1] did not provide any official code or checkpoint, we were unable to evaluate this approach against our evaluations. However, we will discuss it in the related work section.\n|Method|Clean|PGD|\n|-|-|-|\n|DynACL|78.56|46.10|\n|DynACL+TARO|**78.83**|**46.79**|\n---\n**Weakness 4:** It is not that clear whether the targeted attacks generate more samples on the boundary than the untargeted attacks.\n\n**Response:** (Figure also can be found in the PDF file) As depicted in Figure 3 (a), some of the dark blue square dots are positioned near the yellow and orange clusters, but approximately **half of the instances are found within the blue cluster.** These particular instances may not effectively contribute to improving robustness. However, in contrast, Figure 3 (b) shows that **most of the dark blue triangles are aligned along the outline** of the blue cluster.\n\n---\n**Q1. About “Analysis of the selected target”.**  \\\n**R.** We train the AT model, a supervised adversarial training model, with [1]. To identify more attackable classes in robust representation, we use the AT model instead of a standard one. In Figure 2(a), we find that the \"ship\" class is most susceptible to \"plane\" image attacks. Our analysis in Figure 2(b) shows that our target selection algorithm often chooses \"ship\" images as targets for targeted attacks, in line with our aim to create stronger attack images.\nWe will revise the paragraph more clearly.\n[1] Towards Deep Learning Models Resistant to Adversarial Attacks\n\n**Q2. About Equation $S_{entropy}$.** \\\n**R.** Sorry for the confusion; the symbol $pi$ is a typo, and it should be $p$, where $p=h\\circ g\\circ f(x)$. Here, p is a vector of logits, and we calculate the entropy which is scalar by summing up the values along the corresponding dimension as follows:\n$S_{\\text{entropy}}(x,x') = \\sum \\frac{p'}{\\tau} \\log(\\frac{p'}{\\tau})$"}]

Author rebuttal:
Dear Reviewers,

We would like to thank you for the time and effort you've invested in reviewing our paper, and for the constructive feedback you have provided. During the initial response period, we did our best to address all the concerns you raised and to improve our paper according to your insights. We have responded to each of your individual comments. Furthermore, we have additional discussions and experimental results from various perspectives, in line with your suggestions. A brief summary of our responses is provided below for your convenience. We hope that our revisions have resolved your concerns, and kindly request you to consider reflecting these changes in your updated review scores.

---
* Reviewer aDD2: Clarified our contributions and approach
* Reviewer aDD2: Added experiments based on recent work (DynACL’23)
* Reviewer aDD2: Conducted ablation experiments on the score function

---
* Reviewer A38P: Added transfer tasks to the STL10 dataset
* Reviewer A38P: Introduced additional adversarial evaluations against CW, Patch attack, and black-box attack

---
* Reviewer zysz: Revised mathematical notations
* Reviewer zysz: Updated Figure 1 and its descriptions (in PDF file)
* Reviewer zysz: Included additional adversarial evaluations against CW, Patch attack, and black-box attack
* Reviewer zysz: Experimented with different types of SSL frameworks, such as Barlow Twins, using our approach

---
* Reviewer Uc5D: Conducted an ablation study on each component (i.e., targeted attack, target selection algorithm)
* Reviewer Uc5D: Analyzed the ablation study of target selection algorithms in contrastive-based SSL frameworks
* Reviewer Uc5D: Added comparison experiments based on recent work (DynACL’23)
* Reviewer Uc5D: Added detailed description of Figure 2, 3 (in PDF file)

Meta-review: The paper received mixed scores before the rebuttal. The reviewers all think the motivation is clear and the paper is well-written. The main concerns from some reviewers are the technique is not sound (the design of TARO) and the empirical studies are not solid (limited methods in comparison, marginal gain, etc.). After the rebuttal, some of the concerns have been addressed. AC read the paper and all the feedback from the authors/reviewers and thinks this is a borderline paper. After a discussion with SAC and PCs, the novelty and the good empirical result of the paper are still appreciated. Therefore, the final decision is yes.
Decision: Accept (poster)