Beyond Pretrained Features: Noisy Image Modeling Provides Adversarial Defense
Authors: Zunzhi You
Daochang Liu
Bohyung Han
Chang Xu
Venue: NeurIPS 2023 poster (2023)
Keywords: self-supervised learning
adversarial robustness
TL;DR: We show that a simple variant of mask image modeling can be used to provide adversarial robustness in addition to pretrained features..

Abstract: Recent advancements in masked image modeling (MIM) have made it a prevailing framework for self-supervised visual representation learning. The MIM pretrained models, like most deep neural network methods, remain vulnerable to adversarial attacks, limiting their practical application, and this issue has received little research attention. In this paper, we investigate how this powerful self-supervised learning paradigm can provide adversarial robustness to downstream classifiers. During the exploration, we find that noisy image modeling (NIM), a simple variant of MIM that adopts denoising as the pre-text task, reconstructs noisy images surprisingly well despite severe corruption. Motivated by this observation, we propose an adversarial defense method, referred to as De^3, by exploiting the pretrained decoder for denoising. Through De^3, NIM is able to enhance adversarial robustness beyond providing pretrained features. Furthermore, we incorporate a simple modification, sampling the noise scale hyperparameter from random distributions, and enable the defense to achieve a better and tunable trade-off between accuracy and robustness. Experimental results demonstrate that, in terms of adversarial robustness, NIM is superior to MIM thanks to its effective denoising capability. Moreover, the defense provided by NIM achieves performance on par with adversarial training while offering the extra tunability advantage. Source code and models are available at https://github.com/youzunzhi/NIM-AdvDef.

Beyond Pretrained Features: Noisy Image Modeling Provides Adversarial Defense
Zunzhi You', Daochang Liu', Bohyung Han', Chang Xu
School of Computer Science, University of Sydney
2 ECE & IPAI, Seoul National University
zyou58348uni.
http:/uuuuindddyyyyy.....e sydney edu au, daochang 1 liuusydney.... edu au, bhhan@snu. ac.kr, c.xu@sydney edu. au
Abstract
Recent advancements in masked image modeling (MIM) have made it prevailing framework for self supervupee visual representation learning. The MIM pretrained models, like most deep neural network methods, remain vulnerable to adversarial attacks, limiting their practical application, and this issue has received little research attention. In this paper, we investigate how this powerful self-supervised learning paradigm can provide adversarial robustness downstream elassifiers. During the exploration, find that noisy image modeling (NIM), simple variant of MIM that adopts denoising as the pre-text task, reconstructs noisy images surprisingly well despite severe corruption. Motivated by this observation, we propose an adversarial defense method, referred to as De by exploiting the pretrained decoder for denoising. Through 3 NIM is able to enhance adversarial robustness beyond providing pretrained features. Furthermore, we incorporate a simple modification, sampling the noise scale hyperparameter from random distributions, and enable the defense to achieve a better and tunable trade-off between accuracy and robustness. Experimental results demonstrate that, in terms of adversarial robustness, NIM is superior to MIM thanks to its effective denoising capability. Moreover, the defense provided by NIM achieves performance on par with adversarial training while offering the extra tunability advantage, Source code and models are available at https://github... www.ggthubbb... com wttp:/tub..coooouuuuubbaaaaa///a AdvDef
Introduction
The idea of fine-tuning pretrained deep neural networks is essential for the success of machine learning to date. A deep neural network that has been well-pretrained on a large-scale dataset can serve good initialization for various downstream tasks and improve their performance. Within this paradigm, self-supervised learning plays a vital role as this approach allows the networks to take advantage of vast amounts of unlabeled data. With the emergence of powerful, scalable Transformer- based vision models [4 21,, the masked image modeling (MIM) has rapidly developed recently and become the new dominant paradigm for visual feature pretraining (88 17 8 26), following the
success of masked language modeling [12 4 in NLP. Conceptually, the idea behind MIM is simple.
During the pretraining phase, unlabeled training images are randomly masked patch-wise and then fed into an encoder-decoder architecture, where the decoder attempts to recover the original images
from the features embedded by the encoder.
Although pretraining methods like MIM leads to improved standard performance on downstream visual tasks, the adversarial robustness of the fine-tuned model is not enhanced. The vulnerability to imperceptible yet maliciously crafted perturbations will significantly limit the real-world deployment of MIM, especially for safety-critical applications. Although the existing oate-of-tthearr approach,
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

Original Input
Adversarial Image
tineunee ercodor
Jellyfish
Bernese Mountain Dog
reconstruction
reconstruction
initialize
encoder
add
gretralned erooder
Perturbation
Noisy Image
Denoised Image Denoising Decoder for Adversarial Defense (De')
Image Modeling
Noisy image
(a)
(b)
Figure 1: (a) Comparison between the NIM framework and the MIM framework. The two frameworks can be almost exactly the same except for the degradation step. (b) An illustration of the proposed De adversarial defense. De first adds a certain level of noise to the attacked image, then uses the model pretrained by the NIM framework to denoise the image.
adversarial training [22 233, can train adversarially robust models, it is known to be computationally expensive [22] and can result in significant drop in accuracy on clean data [34], which undermines the usefulness of the MIM pretrained features. Moreover, compared to standard training, the sample complexity achieving adversarially robust generalization is significantly higher, increasing the importance of label efficiency in practice. Motivated by these concerns, ask the question: How can the state-of-ther of-the-art generative pretraining paradigm provide adversarial robustness addition standard accuracy?
As we explore this question, we observe two notable characteristics about the paradigm: (1) Other degradations than masking patches, such as zooming-in, blurring, or masking in the frequency
domain, can be effective for the pretext task of self-supervised learning [33 (2) An attempt to understand MIM revealed that implicitly learns occlusion-invariant features [19]. Motivated by the
observations, we explore Noisy Image Modeling (NIM), a variant of MIM that uses denoising as pretext task and learns encode noise-invartin features (Figure (a)).
During the exploration, we find that NIM's denoised images are surprisingly high quality, even from intensely noisy images (Figure 3 (c) and (g)). However, in the common practice of MIM, only the encoder retained for further finetuning, while the decoder that performs image reconstruction is discarded. Therefore, the strong denoising capability of NIM will be wasted, which we believe can be utilized for removing adversarial perturbations. To address this, we propose an adversarial defense method named De"; Denoising by Decoder for Adversarial Defense, which first adds some Gaussian noise to the adversarial samples and then tries to reconstruct the original images, as shown in Figure (b). With De NIM provides not only pretrained features but also adversarial defense to fine-tuned models. We further propose to randomize the hyperparameter that controls the degradation level in pretraining, the defense provided by NIM can achieve tunable trade-off between standard accuracy and adversarial robustness, which further enhances its applicability in practice.
To summarize, this work has the following contributions:
We propose a novel method called De to utilize the strong denoising ability of NIM models they can provide defense against adversarial attacks beyond pretrained features.
Rather than setting the hyperparameter that controls the degradation level globally, as done in existing MIM approaches, we propose to sample from random distributions, so the defense achieves flexible accuracy-robustnes trade-off that can be tuned at test time.

---

Extensive experiments show that our NIM pretraining learns as good visual features as MIM, while being advantageous for effectively enhances the robustness of fine-tuned models against strong adversarial attacks.
2 Related Work
2.1 Self-supervised Pretraining in Vision
Learning visual representations from unlabeled images has been research direction in machine
learning and computer vision that has drawn increasing attention in recent years. While masked
language modeling (MLM) has achieved great success in pretraining large-scale language models [12
4 [0]. the mainstream framework for pretraining vision models was contrastive learning (CL) 66 18
until recently. With the significant emergence of Transformers adapted for vision tasks [14 5 21.
the counterpart of MLM in vision, MIM, becomes the new prevailing self-supervised pretraining
paradigm 26 13 I7 38 Through the process of masking and predicting image patches, the encoder learns to extract meaningful visual features.
Beyond using mask prediction as the pretext task, there have been studies examining the outcomes of employing alternative degradation methods. Tian es al. [3 investigate five methods, including zoom-in, zoom-out, distortion, blurring. and de-colorizing, and discover that all of these methods outperform supervised pretraining. Additionally, Xie et al. 337 explore masking in the frequency domain and demonstrate that similar low-level tasks such as super-resolution and denoising yield competitive performance. These studies inspire us explore the framework of noisy image modeling. More recently. Fang et al. [15] also modify the masking operation in the generative pretraining framework, where the input images degraded by additional generator with small trainable BETT (2]. However, instead of solely using the generative pretraining framework for pretrained features, we further propose to leverage it for enhancing adversarial robustness.
2.2 Adversarial Robustness
Since about a decade ago when researchers found that deep neural networks are fragile to impercepti- ble adversarial perturbations 32 K enhancing their robustness such attacks has been an active
research area, as stronger threat models have also been continuously developed [16] 25 22 [0]. One of the most successful methods, adversarial training (AT), incorporates adversarial examples during training to enhance the model's I adversarial robustness [6] 22 39]. While effective, AT methods present many challenges that limit their applicability. For instance, due the necessity of searching for effective attacks for each image during training, the computational cost can be too expensive. Moreover, AT achieves high robustness at the cost of compromising standard accuracy 34 277. Although Wang et al. [36] mitigate this issue by model-conditional training approach that enables an in-situ calibration of the trade-off between robustness and accuracy, the training cost further increased, and the method is limited to CNNs.
Another line of research aims defend against adversarial attacks in the input space, as opposed to the model space like AT. These methods often use an additional generator to restore clean images from attacked ones, such as GAN [29] or Diffusion Models (24). As their training does not depend on the threat model like AT, these methods can often defend against unseen threats. However, their performance is usually not comparable with AT methods [10]. Our De method is distinct from these methods because our defense is provided by pretraining, eliminating the need for an additional generative model. Therefore, our cost of obtaining the defense also brings pretrained features and boosts fine-tuning. More importantly, the goal of this work is mainly to show the advantage of NIM over MIM in terms of adversarial robustness, not to propose a novel adversarial defense method.
Noisy Image Modeling
3.1 Preliminary: Masked Image Modeling
We first briefly revisit the MIM pretraining framework. For every image E RX where H. W. and C denote the height, width, and channel dimensions respectively, sampled from the training dataset Q MIM first randomly samples binary mask M under the control of the mask ratio
3

---

hyperparameter y so that Σ; m = y, where each element m, E 0, 1 of the binary mask M corresponds to a pixel in the image, and N is the total number pixels. Then, the masked image is given by
XMIM x (1-
(1)
where denotes the element-wise product. After that, MIM uses its encoder Sa and decoder Po parameterized by and o. respectively, to predict the reconstructed image. In practice, the encoder fe of MIM is usually instantiated by Vision Transformers (ViTs) [14] its variants (21), where patch-wise masks are employed. Finally, MIM adopts some distance metric D(-,)) such as & loss to measure the reconstruction quality of the masked patches. Overall, the objective of MIM is formulated as follows:
min E. D(GG(f((RMMM) @ M,x
8,0 XES
3.2 Noisy Image Modeling: Learning Noise-invariant Feature
Figure (a) presents the similarity between the process of MIM and NIM pretraining. As a variant of MIM, NIM shares many components including the network architecture design, the reconstruction target, and the training techniques. The only difference is that NIM degrades the original image by adding Gaussian noise
&NIM = x + de, <0,(0,,),
where a is the parameter that controls the degradation level, i.., the noise scale. The objective function of NIM is given by
min D(oo(fo((N1Ar)) 6 x
As MIM learns to predict masked regions, the encoder-decoder pretrained under NIM is able to denoise corrupted input images. Note that the term "noise" we use has a different meaning from that in the classical Denoising autoencoders (DAE) (35). In our context, we refer to the Gaussian noise that is added to the image, while DAE corrupts the input by replacing randomly selected pixels with O, which is actually equivalent masking..
Following the work trying to understand MIM from an occlusion-invariant feature learning perspec- tive [19], present how NIM learns poise-invariant features. Assume there exists a decoder network dy parameterized by ø' that can almost restore the feature embedded by fo to the its input image:
L' (fo(x)) x.
Then, the objective function of NIM in Eq. 4 can be rewritten as
min E x
(6)
By defining a new similarity measurement
(2, 22) 2 D6)
(7)
Eq. 6 further simplified as
min E P/ (Jo(RNIM)) fo(x)) 0,0 x-
(8)
Hence, the objective function of NIM can be viewed as minimizing the distance of feature embedding between the original image x and the noisy image &NIM implying that the feature embedding learned by fe should be noise-invariant.
4 De Denoising by Decoder for Adversarial Defense
4.1 Formulation of D
Although MIM is effective in representation learning, it is still challenging to learn robust pretrained features. Fine-tuned models are easily compromised by small adversarial perturbations, limiting their use in safety-critical tasks. With the awareness of this problem, we explore the potential of NIM and find that the reconstruction ability of the NIM models is surprisingly good. For example, Figure 3 (c) and (g) illustrate the reconstructed images from the noisy images. We observe that most

---

of the semantics are preserved in the reconstruction even for the images that are too noisy to be recognized by humans. However, the common practice of the MIM pretraining only uses the encoder for the initialization of downstream models while the decoder that has the outstanding reconstruction capability is simply discarded. Meanwhile, we believe that the remarkable denoising capability of the NIM decoder can be employed to enhance the adversarial robustness of downstream models and propose a simple defense technique referred to as De Denoising by Decoder for Adversarial Defense.
As shown in Figure (b), De works during the test time of downstream tasks by first adding Gaussian noise to an input image and then denoising the image using the pretrained decoder as follows:
y (c(os + (aee))))
where Co is the fine-tuned downstream network parameterized by 1b given the pretrained 6, x' the input image that may be under adversarial attacks, and a De is the noise scale used for the defense. The motivation behind this method is straightforward: since the adversarial perturbation is bounded to small it should be easily flooded by the Gaussian noise with a much larger magnitude and then can be removed along with the random Gaussian noise in the decoding process. Also, the noise is randomly generated during testing, which is usually not fully accessible to the threat models even in white-box attack settings, making more difficult to find a way for an effective attack.
While the reconstruction of NIM models yields realistic results with minimal error, there remains a discernible gap between the reconstructed images and the original input images. Therefore, we propose to fine-tune the downstream model with denoised images, where training examples used for fine-tuning co also undergo an adding-noie seagg-noise-hhee deen-deniising procedure, simulating the conditions encountered during test time. The objective function of fine-tuning is formulated follows:
min E + XE
(gc (fo(x + ().c))).).
(10)
where L is the loss function, ÿ is the ground-truth label of x, and at the noise scale using in the fine-tuning. Note that 0 and Φ are fixed during the fine-tuning process.
4.2 Achieving Tunable Trade-off by Sampling Random in Pretraining
Intuitively, the proposed De method should have a tunable trade-off between clean accuracy and adversarial robustness by adjusting Des. Increasing dD will make adversarial perturbations more likely to be flooded and subsequently removed, resulting in stronger adversarial robustness. Meanwhile, as the degradation becomes more severe, the reconstruction quality diminishes, leading to lower clean accuracy However, we observe that this assumption does not necessarily hold in practice. Figure (a) demonstrates that reconstruction quality deteriorates when the noise levels imposed on input images during training and testing are different. We further show how the reconstruction los varies with noise levels in Figure (b) and observe the same phenomenon in the pretrained models with globally set o = 25, 75, and 150. These observations suggest that if the model is exposed only to single noise level during training, it struggles to generalize its denoising capability to images with different noise levels.
To address this issue, we propose to sample the noise level parameter from a random distribution instead of fixing it globally as existing MIM methods do. Figure illustrates that models pretrained with randomly selected a's can effectively reconstruct input images with good quality, even for corrupted images across various noise scales, as long as the scale is not excessively large. Therefore, we can identify good trade-off between accuracy and robustness in the NIM models.
5 Experimental Results
In this section, we empirically show the effectiveness of NIM as a self-supervised pretraining method that can bring adversarial robustness via the De3 method. We describe the settings in Section 5.1 and compare NIM with MIM in Section (5.2 Then, in Section[5.3 the proposed adversarial defense Dea using NIM is compared with the adversarial training approach. Finally, Section 5.44|resent the ablation study that discusses how a in pretraining makes differences to the model performance. More experimental results and details can be found in the supplementary.
Lower loss indicates better reconstruction.
5

---

14
12
d= 150
1oss
0.8
(a) Qualitative comparison of reconstructions by NIM pretrained models with global and random sigma from images of different noise levels. Top: Noisy images of 0 (original image), 50, 75, 100, respectively. Mid-
(b) Relationship between the reconstruction loss and the noise level models pretrained with set to 25, 75, 150 globally and sampled from I(25, 3).
The standard deviation is also shown.
dle: Reconstructed images by the NIM model whose in pretraining is globally
75. Bottom: Reconstructed images by the NIM model whose a pretraining is ran- domly sampled from 1'(25, 3).
Figure 2: Qualitative and quantitative comparisons show that NIM pretraining with globally set a only reconstructs well from the noisy images of noise level close the in pretraining, while NIM pretraining with random reconstructs well for any a in reasonable span.
5.1 Experimental Setups
Datasets and Backbones We conduct all the experiments ImageNet- IK [I1] dataset. We the training set (1.28 million images) in pretraining and finetuning and use the validation set (50,000 images) for evaluation. We adopt ViT-Base (ViT-B/16) 14 as the backbone in our main experiments. Results for additional backbones can be found in the supplementary.
Threat Models To evaluate the adversarial robustness, we adopt untargeted fac -bounded attacks with radius = 4/255, which the most commonly used setting for adversarial robustness studies on ImageNet. We consider three popular white-bor box attacks: single-step attack FGSM [16). multi-step
attack PGD [22]] and the state-of-the-art attack AutoAttack (AA) [10]. For PGD, we the number 2/255. For AA, we use its 'rand' version since our defense is randomized defense. To save the computational cost, we apply the AA attack on a 5000-image subset of the ImageNetIK validation set selected by RobustBench 99.
of steps 10 and step size
Training Implementations We adopt two representative MIM methods, MAE [17] and Sim- MIM [38], as the bascline MIM methods. By modifying only the degradation part, we train our NIM-MAE and NIM-SimMII SIMMIM: the pretext task is changed from mask prediction (with globally set mask ratio) to denoising (with randomly sampled σ), while all the other hyperparameters and training techniques follow the original paper. Our default models pretrained with ~ T(25, 3) and finetuned on denoised images of 30), All models are pretrained for 800 epochs and then finetuned for 100 epochs.
5.2 Comparing NIM with MIM
In Table I we compare our NIM models to the MIM baselines. First, we show that without any adversarial defense, the NIM-pretrained classifiers are slightly less accurate but more robust than the MIM-pretrained classifiers. Therefore, we believe that even in settings where defense model is unavailable, NIM a simple but effective self-supervised visual learning framework and is worth more investigation in the future.

---

Table 1: Comparisons of ImageNet- IK clean and robustness accuracies (%) between MIM and NIM-MIM, with or without the proposed De defense. 'De refers to the defense method that adapts De MIM methods (i.e., de-masking by decoder for adversarial defense). Numbers following De indicate the degradation level used in defense, where is the mask ratio and is the noise scale. model.
NIM-MAE models that use De for defense are finetuned on denoised images from the pretrained
Model De
MAE
17
NIM-MAE
SimMIM
38
NIM-SimMIM
None
>=0.75
None
0=70
a=140
None
7=0.6
None
a=70
o=140
Clean
83.05
44.96
82.58
78.68
70.69
83.62
43.05
82.76
76.23
68.76
FGSM
28.29
36.38
31,66
53.66
53.12
30.38
34.29
31.90
51.84
51.67
PGD-10
0.25
11.58
0.31
34.61
39.82
1.13
7.39
2.02
33.41
37.45
0.00
2.58
23.24
33.70
0.00
1.82
0.00
21.70
32.46
AQUAPAR
DHEAPI
AQUAPAN
AQUAPA
(a)
(b)
(c)
(d)
(e)
(f)
(s)
Figure 3: Qualitative results of reconstruction by MAE and NIM-MAE pretrained models. (a) Original images. (b) 75% masked images. (c) Reconstructed images (b) by the MAE pretrained model. (d) Images added a =70 Gaussian noise. (e) Reconstructed images of (d) by our NIM-MAE pretrained model. (f) Images added a =140 Gaussian noise. (g) Reconstructed images of by our NIM-MAE pretrained model. The images shown are randomly selected from the ImageNet-I K validation set.
With the De defense provided by the NIM pretrained models, the downstream finetuned classifiers obtain strong robustness for all white-box attacks. Numerically, when the Gaussian noise's is 70 (or 140), the magnitude of the added Gaussian noise is about 70/4 17.5 5 (or 35) times the adversarial noise. Therefore, the adversarial noise can be flooded and removed along the Gaussian noise by De As result, the NIM models with De outperform their MIM counterparts without defense with up to 25.37% improvement terms of robustness against FGSM attacks, while only 4.37% clean accuracy is decreased. The De defense is also effective against strong attacks like PGD-10 and AA that almost 100% successfully make the vamilla models fail.
In contrast, MIM does not benefit from the defense. Columns and 7 are the results of using the MIM pretrained models for adversarial defense. Here, the De defense is adapted for MIM models: is performed by first randomly masking some patches and then reconstructing the masked images via the pretrained encoder and decoder, where the mask ratio remains the same as pretraining (75% for MAE and 60% for SimMIM). It is shown that MIM pretrained models are unable to offer effective adversarial defenses as the clean accuracy drops drastically while robustness improves marginally. Figure shows the qualitative results of using MAE and NIM-MAE to reconstruct masked and noisy images, respectively. Noticeably, the reconstruction of MAE is much worse than NIM-MAE, even when the a is 140 and the images are unidentifiable for humans. We further quantitatively evaluate reconstruction quality by computing PSNR (peak signal-to-noise ratio, higher the better) between the original and reconstructed images over the whole ImageNet-1 K validation set. As result, the PSNR of MAE is 20.88 when the mask ratio 75%, while for NIM-MAF, it 27.43 when =70 and 24.9 when = =140.

---

Table 2: Comparisons of ImageNet- 1K clean and robustness accuracies (%) between adversarial trained ViT-base models and NIM-MAE model with the De defense.
Pretrain
Defense
Clean
FGSM
PGD-10
AA
scratch
Adv. Training
56.97
39.89
24.25
19.50
MAE
Adv. Training
69.67
51.80
39.65
34.56
NIM-MAE
Adv. Training
69.28
52.77
39.97
34.84
NIM-MAE
De (a 140) 70.69
53.12
39.82
33.70
5.3 Comparing NIM+De with Adversarial Training
To further help understand the effectiveness of our NIM models with the De defense, we compare it with the adversarial training method in this section. Adversarial training for ViTs is not trivial task and techniques and hyperparameters for CNNs may not be beneficial or applicable for ViTs 330 Here, we adopt the adversarial training recipe for VITs provided by a recent work 223. We do the PGD-5 adversarial training for 20 epochs so the training time is close to ours and adjust the learning rate schedule accordingly. Table 2 shows the results of doing adversarial training from scratch and
the MAE and NIM-MAE pretrained models. It is shown that both MAE and NIM-MAE are helpful for the adversarial training of ViTs. Compared to the adversarial models, our NIM-MAE model with a=140 De defense shows comparable robustness with slightly higher clean accuracy.
Adversarially trained models often compromise the clean accuracy too much. In our experiment, the performance for natural images downgrades by 13.38% for the MAE model. Although this issue can be mitigated by setting a larger weight for the standard loss term in the objective function [39], the adjustment of the trade-off comes at the cost of starting over another training process. In contrast, our De defense enables the testing time tunable trade-off, i.e., we do not need to train another network to trade robustness for accuracy (or vice versa). By increasing the scale of noise added in the defense at test time, more adversarial perturbations can be flooded and removed by the denoising pretrained model, at the expense of poorer reconstruction quality and a greater loss of semantic information (Figure (c) vs. (g)), resulting increased robust accuracies and decreased clean accuracy (Figure 4 For example, our model's robustness against the PGD- 10 attack can be improved from almost 0 to 31.25% and only compromise 2% of clean accuracy (79.37%). Therefore, in practice, our defense can clean and adversarial images according to the requirement of the context.
adjust its performance For example, in autonomous driving, the need for adversarial robustness may increase when the vehicle comes into an adverse environment, while for safer places, the need for high clean accuracy is prioritized.
While we prepare this paper, some more recent studies on adversarial training for ViTs have emerged [28]31] and the adversarial robustness of ViT's on ImageNet- was improved signifi- cantly with more delicate implementation and longer training time. Although our NIM with De approach does not achieve the same level of adversarial robustness as these existing works, we want to highlight that the aim of this work is not to compete with the state-of-the-ar methods. Instead, we aim to demonstrate to the research community that NIM can serve as a promising and advantageous self-learnig paradigm for enhancing adversarial robustness.
5.4 in Pretraining
In this section, we present our ablation studies to evaluate how the random distributions of the Gaussian noise scale parameter a in pretraining influence the fine-tuned models' performance. We adopt MAE as the default implementation of MIM and randomly selected 5,000 images when evaluating robust accuracy for reducing experimental overhead.
First, we present the clean and robust accuracy of models without defense. The left subfigure of Figure [5) shows that NIM pretrained models can achieve competitive accuracy on clean images, especially when the degradation level hyperparameter is set to or concentrated at a fair value (i.e.,
a 75, a T(25,3), 3), a U50, 100)). On the other hand, most of the NIM models lead to higher adversarial robustness than MAE, if the variance of a is not too large (e.g., ~ UO, 250), a [(3, 25). Such phenomenon consistent with the understanding that NIM learns noise-invariant
features in Section 3,2
8

---

80
70
Accuracy (%
60
50
40
30
Clean
20
FGSM
10
PGD-10
M
0
No Defense
10
28
30
49
56
60
79
80
90 160 110 129 130 140 158 166
D
Figure Clean and robust accuracies of our NIM-MAE with De of different o The clean accuracy decreases and robust accuracies increase as the increases, enabling a tunable trade-off in testing time.
MAE
a- [(75.1)
a- L(50,100)
a- (50,
a= 25
a- r(25,3)
[[3, 25)
2/0, 150)
== 75
a= 150
36
Robust Acc (PGD-19 10)
Robust Acc (FGSM)
31
20
29
82.0
82.2
62.4
62.6
82.5
03.0
83.
72
Clean Acc
Clean Acc
Figure 5: Performance of MAE and NIM-MAE with different a in pretraining. Left: Accuracy on clean images and adversarial images attacked by FGSM MAE and NIM-MAE fine-tuned models without De defense. Right: The Pareto frontiers of NIM-MAE models with De defense between clean accuracy and robust accuracy against PGD-10 attacks. The Pareto frontiers are measured by using different a in defense (increased by 10 from 0 to 160).
In the right subfigure of Figure we show the empirical Pareto frontier of De using different NIM-MAE pretrained models, i.e., the points on the figure are the models' best achievable trade-offi offe between clean and robust accuracy by using different o in defense. We first observe that the Pareto frontiers of models using globally set a collapse to very few points because using other than the one in pretraining leads to lowering both clean and robust accuracy. Meanwhile, the results suggest that sampled from the Gamma distribution generally achieves better accuracy-rouustnes trade-off than the ones from the Uniform distribution. Among models, a T(25,3) 3) achieves the best performance by being concentrated to moderate value and having suitable variance.

---

6 Conclusions
In this paper, we investigate noisy image modeling (NIM), a simple variant of masked image modeling where the pretext task is changed from mask prediction to denoising. We discover that NIM exhibits a remarkable ability to reconstruct images even from images with intense noise and are motivated to utilize this denoising capability remove adversarial perturbations. We propose simple method that enables the NIM models to provide not only pretrained features but also an adversarial defense. To further achieve a tunable trade-off during test time, we sample the noise level hyperparameter from random distributions rather than setting it globally as MIM. We demonstrate by extensive experimental results that in terms of adversarial robustness, NIM is advantageous over MIM thanks to its strong denoising ability. We also show that the adversarial defense provided by NIM achieves comparable performance to recent adversarial training method and offers greater flexibilityy and applicability due to its tunable accuracy-robustees trade-off. We hope that our work will motivate the community to explore NIM and other variants of MIM the full potential of generative visual pretraining can be realized.
Acknowledgment
This work was supported in part by the Australian Research Council under Projects DP240101 148 and FT230100549, and also in part by the NRF and IITP grants funded by the Korea government (MSIT) (No. 2022R1A2C3012110, 2021-0-01343).
References
[1] Yutong Bai, Jieru Mei, Alan I. Yuilie, and Cihang Xie. Are transformers more robust than cnns? Advances in Neural Information Processing Systems, 34:26831-248 -26843,, 2021.
[2] Hangbo Bao, Li Dong, and Furu Wei. Beit: Bert pre-training of image transformers. arXiv preprint
arXiv:2106.088 08254. 2021.
[3] Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Šrndić, Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. In Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2013, Prague, Czech Republic, September 23-27, 2013, Proceedings, Part III 13, pages 387-402. Springer, 2013.
[4] Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, al. Language models are few-shot learnrrs. Advances in neural information processing systems, 33:1877-1901, 2020.
[5] Hanting Chen, Yunhe Wang. Tianyu Guo, Chang Xu, Yiping Deng. Zhenhua Liu, Siwei Ma, Chunjing
Xu, Chao Xu, and Wen Gao. Pre-trained image processing transformer. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1229-11230,, 2021.
[6] Ting Chen, Simon Korblithh, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In International conference on machine learning, pages
1597-1607. PMLR. 2020.
[7] Xinlei Chen, Saining Xie, and Kaiming Hc. An empirical study of training self-supervised vision transformers. In Proceedings of the IEEE/CVF International Conference Computer Vision, pages
0640-9649, 2021.
[8] Yabo Chen, Yuchen Liu, Dongsheng Jiang, Xiaopeng Zhang, Wenrui Dai, Hongkai Xiong, and Qi Tian. Sdae: Self-distillated masked autoencoder. European Conference on Computer Vision, pages 124. Springer, 2022.
[9] Francesco Croce Maksym Andriushchenko, Vikash Schwag, Edoardo Dehenedetti, Nicolas Flammarion, Mung Chiang. Prateek Mittal, and Matthias Hein. Robustbench: a standardized adversarial robustness benchmark. arXiv preprint arXiv:2010. 09670, 2020.
[10] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference machine learning, pages 2206 2216. PMLR, 2020.
[11] Jia Deng, Wei Dong. Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248-255 leee, 2009.
[12] Jacob Devlin, Ming-We Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre- Pre-training of deep bidirec- tional transformers for language understanding. arXiv preprint arXiv: 04800, 2018
[13] Xiaoyi Dong. Jianmin Bao, Ting Zhang, Dongdong Chen, Weiming Zhang, Lu Yuan. Dong Chen, Fang Wen, and Nenghai Yu. Peco: Perceptual codebook for bert pre- pre-training of vision transformers. arXiv preprint arXiv 2021.
10

---

[14] Alexey Dosovitskiy. Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai. Thomas Unterthiner. Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition scale. arXiv preprint arXiv:2010. 11929, 2020.
[15] Yuxin Fang. Li Dong. Hangbo Bao, Xinggang Wang, and Furu Wei. Corrupted image modeling for self-supervised visual pre-training. In The Eleventh International Conference on Learning Representations, 2023.
[16] lan Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv; /412.6522 2014.
[17] Kaiming He, Xinlei Chen, Saining Xie, Yanghao Li, Piotr Dollár, and Ross Girshick. Masked autoencoders
are scalable vision learners. In P Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 16000-16009. 2022.
[18] Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Gitshick. Momentum contrast for unsupervised visual representation learning. In Proceedings of the IEEF/CVF conference on computer vision and pattern recognition, pages 9729-9738, 2020.
[19] Xiangwen Kong and Xiangyu Zhang. Understanding masked image modeling via learning occlusion invariant feature. arXiv preprint arXiv:2208.04 2022.
[20] Yinhan Liu, Myle Ott,
Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. Roberta: A robustly optimized bert pretraining approach. arXiv
preprint arXiv: / 1692, 2019.
[21] Ze Liu, Yutong Lin. Yue Cao. Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEF/CVF
International Conference on Computer Vision, pages 10012-10022, 2021.
[22] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant to adversarial attacks. International Conference on Learning Representations, 2018.
[23] Yichuan Mo, Dongxian Wu, Yifei Wang, Yiwen Guo, and Yisen Wang. When adversarial training meets vision transformers: Recipes from training to architecture. In NeurIPS, 2022.
[24] Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Animashree Anandkumar. Diffusion models for adversarial purification. In International Conference on Machine Learning, pages
16805-16827. PMLR, 2022.
[25] Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matl Fredrikson, Z Berkay Celik, and Ananthram Swami. The limitations of deep learning in adversarial settings. In 2016 IEEE European symposium on security
and privacy (EuroS&P), pages 777. IEEE, 2016.
[26] Zhiliang Peng. Li Dong, Hangho Bao, Qixiang Yc, and Furu Wei. Beit v2: Masked image modeling with Sattrraaaizzaaaaaa visual tokenizers. arXiv preprint 2xXv:2208.006666 2022.
vector-quantized
[27] Aditi Raghunathan, Sang Michael Xie, Fanny Yang, John Duchi, and Percy Liang. Understanding and mitigating the tradcoff between robustness and accuracy. In International Conference on Machine Learning, pages 1109-7919, PMLR, 2020.
[28] Sylve Sylvestre-Alvise Rebuffi, Francesco Croce, and Sven Gowal. Revisiting adapters with adversarial training.
In The Eleventh International Conference on Learning Representations, 2023.
[29] Pouya Samangouei. Maya Kabkab, and Rama Chellappa. Defense-gan Protecting classifiers against adversarial attacks using generative models. arXiv preprint arXiv:
2018.
[30] Rulin Shao, Zhouxing Shi, Jinfeng Yi, Pin-Yu Yu Chen, and Cho-Jui Hsieh. On the adversarial robustness of vision transformers. arXiv preprint arXiv:2103. 15670, 2021.
[31] Naman D Singh, Francesco Croce, and Matthias Hein. Revisiting adversarial training for imagenet: Architectures, training and generalization across threat models. arXiv preprint arXiv:2303.011 2023. [32] Christian Szegedy. Wojciech Zaremba, llya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and
Rob Fergus. Intriguing properties of neural networks. arXiv preprint 131.6693,,6,99 2013.
[33] Yunjie Tian, Lingxi Xic,
Fang. Mengnan Shi, Junran Peng, Xiaopeng Zhang, Jianbin Jiao, Qi Tian, and Qixiang Yc. Beyond masking: Demystifying token- pre- pre-training for vision transformers. arXiv preprint arXiv:2203. 14313, 2022.
[34] Dimitris Tsipras. Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry, Robust- ness may be at odds with accuracy. arXiv preprint 1rSiv:1805.12111 2018
[35] Pascal Vincent, Hugo Larochelle, Yoshua Bengio, and Pierre- Antoine Manzagol. Extracting and composing robust features with denoising autoencoders.. In Proceedings of the 25th international conference on
Machine learning, pages 1096-1 103, 2008
[36] Haotao Wang. Tianlong Chen, Shupeng Gui, TingKuei Hu, Ji Liu, and Zhangyang Wang. for--for-all adversarial training: In-situ tradcoff between robustness and accuracy for free. Advances in Neural Information Processing Systems, 33:7449-7746 2020.
[37] Jiahao Xie. Wei Li, Xiaohang Zhan, Ziwei Liu, Yew Soon Ong. and Chen Change Loy. Masked frequency modeling for self-supervised visual pre-training. arXiv preprint arXiv:2206. 07706, 2022.
[38] Zhenda Xie, Zheng Zhang, Yue Cao, Yutong Lin, Jianmin Bao, Zhuliang Yao, Qi Dai, and Han Hu. Simmim: A simple framework for masked image modeling. In Proceedings of the IEEE/CVF Conference Computer Vision and Puttern Recognition, pages 9653-9663, 2022.
[39] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing. Laurent El Ghaoui, and Michael Jordan. Theo- retically principled tra between robustness and accuracy. In International conference on machine learning, pages 7472-7482, PMIR, 2019.
11


Reviews:
[{"review_id": "gAtRaXMDhb", "reviewer": "Reviewer_P9xe", "summary": "This paper proposes a method called Noisy Image Modeling (NIM) as self-supervised learning to improve the adversarial robustness of pretrained features. NIM uses denoising as a pretext task and is effective in reconstructing noisy images for representation learning. In addition, the authors propose a defense technique called De^3 that leverages the denoising capability of NIM to enhance robustness against adversarial attacks. Experimental results show that NIM with De3 defense outperforms Masked Image Modeling (MIM) in terms of adversarial robustness while maintaining competitive performance on clean data. The paper concludes by highlighting the potential of NIM and other variants of MIM for generative visual pretraining.", "questions": "1. Computational cost.\n2. Parameter Sensitivity Analysis.\n3. The generalization of the proposed  method.", "limitations": "Yes", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "1. Different from the popular MIM, NIM improves the pretrained features by resisting adversarial attacks. The experiment verfies the effectiveness of the proposed method.\n2. In addition to the representation learning method, the paper proposes a defense technique called De3 that utilizes the denoising capability of NIM to enhance robustness against adversarial attacks.\n3. The paper compares the performance of NIM with the proposed De3 defense to Masked Image Modeling (MIM) and other adversarial training methods. Experimental results show that NIM with De3 defense outperforms MIM in terms of adversarial robustness while maintaining competitive performance on clean data.\n4. The paper introduces a modification to NIM that allows for a tunable trade-off between accuracy and robustness. ", "weaknesses": "1. The paper does not thoroughly analyze the computational cost of the proposed method. Adversarial training methods, such as the one proposed by Wang et al. [34], are known to be computationally expensive. It would have been valuable to compare the computational cost of NIM with other defense techniques.\n2. The paper does not extensively explore the impact of hyperparameters on the performance of the proposed method. For example, the authors mention that the trade-off between clean accuracy and robustness can be adjusted by varying the noise level hyperparameter, but they do not provide a detailed analysis of the optimal values or the sensitivity of the method to different hyperparameter settings.\n3. The paper does not analyze the transferability of adversarial examples between different models. It would have been valuable to investigate whether the robustness achieved by NIM with De^3 defense can generalize to other models or if it is specific to the pretrained model used in the experiments [1].", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We appreciate your approval and recognition of this paper. Our answers are listed below.\n\n> The paper does not thoroughly analyze the computational cost of the proposed method. Adversarial training methods, such as the one proposed by Wang et al. [34], are known to be computationally expensive. It would have been valuable to compare the computational cost of NIM with other defense techniques.\n\nThank you for this valuable suggestion. Indeed, our paper could have benefitted from a comparison of the computational costs between the proposed NIM approach and existing adversarial training methods. We evaluated the throughput of the adversarial training method [21] (used in the comparisons of Section 5.3) and our proposed NIM approach, using an identical training framework implemented on 8 A100 GPUs. The result is as follows\n\n| Method | Throughput (images/sec) | Clean | PGD-10 |\n| :---: | :---: | :---: | :---: |\n| AT-ViT [21] | 488.0 | 69.28 | 39.97 |\n| Ours | 2009.4 | 70.69 | 39.82 |\n\nNote that the adversarial training method is trained for 20 epochs and ours are trained for 100 epochs. Therefore, adjusted for epochs, our method are (488.0/20)/(2009.4/100)=1.2 times faster than the adversarial training method.\n\n> The paper does not extensively explore the impact of hyperparameters on the performance of the proposed method. For example, the authors mention that the trade-off between clean accuracy and robustness can be adjusted by varying the noise level hyperparameter, but they do not provide a detailed analysis of the optimal values or the sensitivity of the method to different hyperparameter settings.\n> \n\nSorry for the confusion. Regarding the trade-off that can be adjusted by the noise level hyperparameter $\\sigma$, we would like to refer to Figure 4 and the description in lines 247-261, where the variance in clean and robust accuracies with respect to $\\sigma$ is explicitly presented. It is shown that by increasing the $\\sigma$ in defense, the clean accuracy would decrease as the reconstruction gets poorer, but the robust accuracy would be enhanced because adversarial perturbations are flooded by stronger noises.\n\nIn addition, we present how different random distributions of $\\sigma$ in pretraining influence the fine-tuned models’ performance in Section 5.4 and we show that $\\sigma \\sim \\Gamma(25,3)$ achieves the best performance among all models. It is noteworthy that due to the limitation of computational resources, it was challenging to conduct a comprehensive grid search for hyperparameter optimization. However, we would like to highlight that the main point of this work is to show that NIM can achieve a stronger and tunable accuracy-robustness trade-off compared to MIM, instead of achieving the highest possible performance with optimal hyperparameters.\n\n> The paper does not analyze the transferability of adversarial examples between different models. It would have been valuable to investigate whether the robustness achieved by NIM with De^3 defense can generalize to other models or if it is specific to the pretrained model used in the experiments [1].\n> \n\nThanks for this insightful feedback. Indeed, exploring the transferability of the proposed adversarial defense method would be very helpful for a more comprehensive understanding of our method and its applicability. Given that our method does not train the model to be robust to some specific adversarial noise but removes the perturbations along with strong Gaussian noise, we are optimistic about the generalizability of our defense. Due to limited time and computational resources, we haven't provided empirical evidence to confirm this claim, but we will work on it once we are able to.\n\n---\n\n[21] Mo, et al. When adversarial training meets vision transformers: Recipes from training to architecture. NeurIPS 2022."}, {"review_id": "QYzHTKZkIb", "reviewer": "Reviewer_judd", "summary": "This paper proposes a novel adversarial defense method $De^3$ to utilize the strong denoising ability of NIM models. The proposed method first adds some Gaussian noise to the adversarial samples and then tries to reconstruct the original images. Experiments show the advantage of NIM over MIM in terms of adversarial robustness.", "questions": "I wonder the difference of robustness against other types of attacks, like black-box ones.", "limitations": "Limitations are adequately discussed in the supplemental materials. ", "rating": 8, "confidence": 5, "soundness": 4, "presentation": 3, "contribution": 4, "strengths": "1. The idea of NIM is interesting.  The proposed method obtains the adversarial defense as well as provides pretrained features by a simple yet effective modification on masked image modeling. \n2. The idea of De3 is instructive to enhance adversarial defense through reconstructing clean images from intensely noisy images.\n3. The experiments demonstrate that the proposed method can achieve comparable defense performance with adversarial training. \n4. This paper is well-written and easy to follow.\n", "weaknesses": "1. Although De3 can enhance adversarial defense, it increases computational cost during inference time. Note that there exists two encoders  and one decoder in De3, can we distill another encoder  from them and use only it during inference time? \n2. This paper compares NIM against MIM in terms of accuracy and adversarial robustness. It seems that MIM achieves better accuracy on clean images. I wonder can we combine them together and obtain a better trade-off between accuracy and robustness?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you very much for your positive affirmation of our work and your constructive suggestions. Here are our responses.\n\n> Although De3 can enhance adversarial defense, it increases computational cost during inference time. Note that there exists two encoders and one decoder in De3, can we distill another encoder from them and use only it during inference time?\n> \n\nWe appreciate this valuable suggestion. As we acknowledged in our Limitation section, the computational cost introduced by the defense process is a major drawback of our method. We have not considered using distillation for resolving the issue, but we believe it could be a direction with great potential. By training a smaller network to mimic the behavior of the original network, we could obtain a more efficient model that retains much of the adversarial robustness while lowering the computational costs. Moreover, given that one encoder essentially stems from the initialization of the other before fine-tuning, it's plausible that there's room for optimization by either merging or compressing them. We're genuinely grateful for this constructive feedback and will look into this possibility in our subsequent research.\n\n> This paper compares NIM against MIM in terms of accuracy and adversarial robustness. It seems that MIM achieves better accuracy on clean images. I wonder can we combine them together and obtain a better trade-off between accuracy and robustness?\n> \n\nThank you for another insightful idea. Indeed, since MIM exhibits better accuracy on clean images and NIM shows stronger robustness, there could be potential in combining them to achieve a better accuracy-robustness trade-off. Previous work [1] shows that when combining zooming-in and masking, the pretraining performance would be higher than using only masking. Therefore, it is reasonable to expect that combining masking and adding noise would bring further improvements. We will certainly delve into this promising avenue in our future work.\n\n> I wonder the difference of robustness against other types of attacks, like black-box ones.\n> \n\nWe adopt Square [2] as a example of black-box attacks, and set the perturbation budget $\\epsilon$=16/255 and a budget of 1,000 queries. The results are as follows compared with white-box PGD-10 attacks.\n\n| Model | MAE | MAE | NIM-MAE | NIM-MAE | NIM-MAE |\n| --- | --- | --- | --- | --- | --- |\n| $De^3$ | None | $\\gamma$=0.75 | None | $\\sigma$=70 | $\\sigma$=140 |\n| Clean | 83.05 | 44.96 | 82.58 | 78.68 | 70.69 |\n| PGD-10 (WB) | 0.25 | 11.58 | 0.31 | 34.61 | 39.82 |\n| Square (BB) | 1.17 | 33.59 | 2.44 | 73.14 | 67.29 |\n\nIt is shown that our $De^3$ with NIM is very effective for defending against this black-box attack.\n\n---\n\n[1] Tian, et al. Beyond Masking: Demystifying Token-Based Pre-Training for Vision Transformers. 2022.\n\n[2] Andriushchenko et al. Square attack: a query-efficient black-box adversarial attack via random search. ECCV 2020."}, {"review_id": "Ebtn2mroEc", "reviewer": "Reviewer_ovhG", "summary": "The paper presents a straightforward approach for defending against adversarial attacks while incorporating pre-trained feature learning through the utilization of noisy images. Inspired by Masked Image Modeling (MIM), the paper replaces the masking pretext task by introducing a substantial amount of noise into the image. Subsequently, a transformer-based encoder/decoder is trained to reconstruct the original image, and the encoder is fine-tuned to acquire features that are invariant to noise by comparing the encoded features of the original image input with those of the reconstructed images. The defense mechanism involves retaining the decoder for the downstream task, employing an [encoder → decoder → encoder] mechanism to obtain features that can be further fine-tuned for the downstream task.\n\nThe authors perform experiments on ImageNet-1K using the ViT-Base backbone and evaluate the proposed method against several existing adversarial attacks, including $l_{\\infty}$ bound attacks, FGSM, PGD, and AutoAttack (AA). The results demonstrate that the proposed method exhibits greater robustness compared to baseline pre-trained methods like MAE or SIMM.\n", "questions": "I wonder if the authors have considered keeping the original MAE approach and combining it with the noisy modelling technique to explore any potential further improvements?\n\nSee questions above also.\n", "limitations": "N/A", "rating": 5, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "The finding of the paper is interesting, which suggests that the adversarial attacks present as a kind of noise, and it makes sense that denoising works to some extent. This aspect might open up possibilities for combining existing works to further enhance downstream accuracy and adversarial defense. \n\nThe paper writing is easy to follow and the proposed method is simple and comprehensive.\n", "weaknesses": "1. It would be beneficial to have a more extensive comparison by including well-known self-supervised features like SimCLR, MOCO, DINO, and others, to assess the robustness of the features learned by these methods in comparison to the proposed method.\n\n2. To enhance the paper, it would be valuable if the authors conducted experiments on another dataset and included more baseline methods to gain insights into the generalizability of the proposed method.\n\n3. It would be valuable to compare the proposed method with existing adversarial defense approaches, such as GAN-based methods.\n\n4. Despite some improvements, the defense results are not particularly impressive and do not appear to completely eliminate the attacks. This suggests that the attacks might involve more than just noise.\n\n5. It should be noted that using additional decoders could be a drawback depending on the applications, as it significantly increases memory usage during inference.\n\nThe approach seems novel, and I find the current version of the paper is fine unless there are serious concerns / flaws from other reviewer’s feedback. However, I would recommend conducting additional experiments to further showcase the generalizability of the proposed method.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your insightful comments and suggestions! Our answers are as follows:\n\n> It would be beneficial to have a more extensive comparison by including well-known self-supervised features like SimCLR, MOCO, DINO, and others.\n\nWhile we concur that the comparison would be a great direction to explore, we would like to highlight that it is beyond the scope of this paper. The primary goal of this work is to explore how the generative pretraining paradigm can provide adversarial robustness beyond visual features. Therefore, other pretraining frameworks like contrastive learning (CL) are not considered as they are not applicable to our proposed $De^3$ defense.\n\nHowever, we believe this could be a great research direction for future work. Existing works have compared ViTs and CNNs' adversarial robustness [1], and also compared the pretrained visual features of MIM and CL [2], but the comparison between MIM and CL from the perspective of adversarial robustness has not been explored. This research gap could be a good starting point for a valuable research project.\n\n> To enhance the paper, it would be valuable if the authors conducted experiments on another dataset and included more baseline methods.\n\nThanks for this valuable suggestion. We conducted another experiment on CIFAR-10, based on the implementation of [3]. We set the attack radius $\\epsilon = 8/255$, and other settings remain the same as in Table 1. The results are as follows:\n\n| Model | MAE | MAE | NIM-MAE | NIM-MAE | NIM-MAE |\n| --- | --- | --- | --- | --- | --- |\n| $De^3$ | None | $\\gamma$=0.75 | None | $\\sigma$=40 | $\\sigma$=70 |\n| Clean | **89.88** | 78.36 | 88.31 | 81.09 | 76.30 |\n| FGSM | 17.51 | **65.13** | 21.66 | 43.26 | 48.86 |\n| PGD-10 | 0.01 | 22.50 | 2.77 | 32.24 | **40.26** |\n| AA | 0.00 | 6.220 | 0.00 | 31.49 | **41.20** |\n\nInterestingly, we observe that unlike on ImageNet, MAE provides a stronger defense against FGSM on CIFAR-10. The reasons are probably that 1) for low-resolution images, MAE can generate good reconstructions from masked images; 2) when using MAE in $De^3$, 75% of adversarial perturbations will be masked, and if the attack is weak like FGSM, the rest of the perturbation would be too weak to break the model. However, for stronger attacks, NIM still provides better defense.\n\nRegarding the baseline method, we adopted two representative MIM methods, MAE and SimMIM, as two baseline methods. It is observed that NIM provides consistently better adversarial defense than MIM, shown in Table 1 of our main paper.\n\n> It would be valuable to compare the proposed method with existing adversarial defense approaches.\n\nIn Section 5.3, we show the comparison of our method and a recent adversarial training approach where ViTs are also adopted as the backbone. Until recently, most adversarial defense methods are based on CNNs and the comparison with them would be out of this work’s scope. More importantly, we would like to emphasize that the main point of this work is not to compete with other adversarial defense methods, but to show that NIM can achieve a strong and tunable accuracy-robustness trade-off and to demonstrate to the community that NIM can serve as a promising and advantageous self-supervised learning paradigm.\n\n> Despite some improvements, the defense results are not particularly impressive and do not appear to completely eliminate the attacks.\n\nSo far, defending against adversarial attacks is still a very challenging task and there is no method that is completely immune to attacks. We show that our proposed method can achieve an improvement in robustness against PGD attack by 34.36%, with a marginal clean accuracy drop of 4.37%. Given that our model is trained to denoise *Gaussian noise*, instead of *adversarial noise*, we think the improvement is significant and interesting.\n\n> This suggests that the attacks might involve more than just noise.\n\nIndeed, even when $\\sigma$ = 250 (62.5 times the adversarial perturbation budget), the clean accuracy (36.84%) is still higher than the robust accuracy against PGD attack (23.63%). This result shows that even when adding a very large Gaussian noise, the adversarial noise would not be fully flooded and removed, indicating that adversarial perturbation may be meaningful to the neural networks, rather than just noise.\n\n> It should be noted that using additional decoders could be a drawback depending on the applications, as it significantly increases memory usage during inference.\n\nYes, incorporating additional decoders can indeed increase memory requirements, which could be a concern, especially for applications with tight memory constraints. As suggested by Reviewer judd, distillation could be a potential solution. By training a smaller network to mimic the behavior of the larger network, we could obtain a more efficient model that retains much of the adversarial robustness of the original approach. We acknowledge this limitation and appreciate the insightful suggestion, and we're keen to investigate this avenue in future research.\n\n> I wonder if the authors have considered keeping the original MAE approach and combining it with the noisy modelling technique?\n\nThank you for providing this great idea! We have not considered this direction, but we believe it has great potential. It reminds us of the findings presented in [4], where the combination of zooming-in and masking outperformed using only masking. Therefore, it is reasonable to expect that combining masking and adding noise would bring further improvements. We will certainly consider investigating this direction in subsequent studies. Thanks again for the advice.\n\n---\n[1] Bai et al. Are Transformers More Robust Than CNNs? NeurIPS 2021.\n\n[2] Wei et al. Contrastive Learning Rivals Masked Image Modeling in Fine-tuning via Feature Distillation. 2022.\n\n[3] https://github.com/IcarusWizard/MAE.\n\n[4] Tian, et al. Beyond Masking: Demystifying Token-Based Pre-Training for Vision Transformers. 2022."}, {"review_id": "0zAFROARcg", "reviewer": "Reviewer_XF5y", "summary": "The authors introduce noise image modeling (NIM) as a self-supervised pretext task and demonstrate that their encoder-decoder architecture decreases the success of adversarial attacks by adding noise to a perturbed image and then denoising it. Their method is called $De^3$. Furthermore, the author conduct a major comparison effort to masked image modeling (MIM) and the capabilities against adversarial attacks.\n", "questions": "Do you think that there is a way to construct strong adversarial examples if the attacker knows that the NIM architecture is used, despite the noise randomness?\n", "limitations": "Limitations are not discussed in the paper.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "- This paper is well written and easy to understand.\n- \"flooding out\" adversarial attacks is an interesting idea. \n- The method utilizes the usually unused decoder for \"cleaning\" adversarial images.\n- $De^3$, as an adversarial prevention method, can be applied without generating much computation overhead during inference or training.\n- NIM with $De^3$ can use a dynamic trade-off between clean accuracy and the vulnerability to adversarial images. \n- On-par results with MIM while doing adversarial training.", "weaknesses": "1. Table 1/Figure 3: \n- The \"flooding out effect\" for very large sigma (140) seems not reasonable, since it corrupts the whole image. How strong is the flooding in comparison to the adversarial perturbation? I think it is necessary to show the scale difference of (i) the adversarial attacks and (ii) the added noise.\t\t\t  \n- I am a little bit surprised by the denoising performance with high noise-levels (see Figure 3 (f) - sigma 140):  the reconstruction seems \"too good to be true\", where it even recovers the smallest features. This seems odd despite other efforts [1]. I think it needs further extensive investigation:  (i) when does the model break in terms of reconstruction quality? What happens when you use an even larger value for sigma? (ii) when does the adversarial defense fail when a high-noise level (sigma 100, 150, 200) is used? \n2. Figure 2 (a) needs captions for the image rows/columns to understand it better. \n\n3. Table 1: Inconsistent use of bold highlighting?\n\n4. Table 1: I am not sure if this is a fair comparison, since NIM utilizes its built-in adversarial prevention\n           while MAE/SimMIM (MIM) has none (gamma is not implicitly designed for dealing with adversarial images).\n5. line 264-268: From the readers perspective, it seems that the authors tried to achieve state-of-the-art with $De^3$ but failed, so they redirect their writing to fit a different goal. I suggest, the authors omit the sentences about not wanting to achieve SOTA.\n6. Figure 5: I suggest to use more symbols for different sigmas. Differentiate between fixed/random sigma and MAE baseline with triangle and then use square/diamond/circle.\n7. Figure 5: Ordering of the entries in the legend can be improved\n\nReferences:\n\n[1] Mahdaoui, Assia El, Abdeldjalil Ouahabi, and Mohamed Said Moulay.\n\"Image denoising using a compressive sensing approach based on regularization constraints.\"\nSensors 22.6 (2022): 2199.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the constructive comments. Here are our responses:\n\n> The \"flooding out effect\" for very large sigma (140) seems not reasonable, since it corrupts the whole image.\n\n> The reconstruction seems \"too good to be true\". This seems odd despite other efforts [1].\n\nGiven that noisy images with large sigma become completely meaningless to humans, it is understandable that one may think the reconstruction is “too good to be true”. However, the experimental results show that ViTs are indeed capable of removing intense Gaussian noise. Note that we are denoising artificial Gaussian noise, which is much easier than real-world unknown noise in [1]. Table 2 (c) in [2] shows a similar result: Top-1 acc for $\\sigma=100$ is only lower for 0.1% than the best $\\sigma=75$. We think the main reason that highly noisy images are meaningless to humans is that human eyes have limited capabilities, rather than that the information is completely corrupted.\n\n> How strong is the flooding in comparison to the adversarial perturbation? I think it is necessary to show the scale difference.\n\nIn Table 1, when the images are not normalized (the range is [0, 255]), the Gaussian noise’s $\\sigma$ is 70 (or 140), and the budget of adversarial perturbations is 4. In other words, the magnitude of the Gaussian noise we added is about 70/4=17.5 (or 35) times the adversarial noise. Thank you for this valuable advice and we will add this scale difference to our final paper.\n\n> When does the model break in terms of reconstruction quality? What happens when you use an even larger value for sigma? When does the adversarial defense fail when a high-noise level (sigma 100, 150, 200) is used?\n\nWhen using larger values for sigma, the clean accuracy will decrease, and the robust accuracy will also decrease when it gets too large. For example, in Figure 4, accuracy against FGSM gets lower when the $\\sigma$ is larger than 100. When $\\sigma$ gets too high (e.g., 200 or 250), the reconstruction quality will be bad, leading to low clean and robust accuracy. Here are the results when using very large $\\sigma$ in $De^3$:\n\n| $De^3$ | $\\sigma=150$ | $\\sigma=200$ | $\\sigma=250$ |\n| --- | --- | --- | --- |\n| Clean | 69.09 | 61.58 | 36.84 |\n| FGSM | 52.19 | 47.24 | 28.28 |\n| PGD-10 | 39.61 | 37.37 | 23.63 |\n\n> Figure 2 (a) needs captions for the image rows/columns to understand it better.\n\nThank you for the advice. In the top row, the four images are noisy images of $\\sigma$=0 (original image), 50, 75, and 100, respectively. In the middle, the four are reconstructed images from the corresponding noisy images at the top row by the NIM model whose $\\sigma$ in pretraining is globally set to 75, and the bottom row is four reconstructed images from the corresponding noisy images at the top row by the NIM model whose $\\sigma$ in pretraining is randomly sampled from $\\Gamma(25, 3)$. We will make it clearer in the final version.\n\n> Table 1: Inconsistent use of bold highlighting?\n\nWe highlight the highest performance for each setting among variants of the same MIM models. In other words, **83.05** is highlighted because it is the highest clean accuracy achieved by all *MAE* or *NIM-MAE* methods, and **51.84** is highlighted because it is the highest accuracy against FGSM achieved by all *SimMIM* or *NIM-SimMIM* methods.\n\n> Table 1: I am not sure if this is a fair comparison, since NIM utilizes its built-in adversarial prevention while MAE/SimMIM (MIM) has none.\n\nWe’d like to clarify that NIM doesn’t have any “built-in adversarial prevention”, either, because it is trained to denoise *Gaussian noise*, instead of specific *adversarial noise*. The comparison is fair because, from pretraining and fine-tuning to evaluation, we ensure everything is the same and the only variable is the degradation method. \n\n> line 264-268: I suggest, the authors omit the sentences about not wanting to achieve SOTA.\n\nOur intention to write these sentences was to prevent misleading the readers to get the idea from the comparison with adversarial training methods that our purpose was to chase the SOTA. We included the comparison to provide readers with a comprehensive understanding of our method's effectiveness. As stated in the Introduction, our primary goal is to explore how the generative pretraining paradigm can provide adversarial robustness beyond pretrained visual features, and our main takeaway for the community is that NIM can achieve a strong and tunable accuracy-robustness trade-off that MIM models are unable to, indicating the superiority of NIM over MIM in terms of adversarial robustness. However, taking your feedback into account, we'll consider omitting or rephrasing the sentences to prevent any potential misunderstandings.\n\n> Figure 5: I suggest to use more symbols for different sigmas. \n\n> Figure 5: Ordering of the entries in the legend can be improved.\n\nWe genuinely appreciate your constructive feedback on the representation in Figure 5. We will incorporate these modifications in our final paper.\n\n> Do you think that there is a way to construct strong adversarial examples if the attacker knows that the NIM architecture is used, despite the noise randomness?\n\nFirst, we’d like to clarify that our experiments are under this very assumption that the attacker has full access to both the classifier and the defense model, only without knowing the sampling result of the random noise.\n\nTo answer the question, we do believe there may be ways to break the defense provided by NIM and $De^3$. For example, as stated in the Limitation section, we only prove that our method is effective against noise-based attacks, but other forms of attacks, like adversarial patches, might present challenges to our defense mechanism.\n\n> Limitations are not discussed in the paper.\n\nPlease refer to the Section B of our supplementary material.\n\n---\n\n[2] Xie et al. Masked Frequency Modeling for Self-Supervised Visual Pre-Training. 2022."}, {"review_id": "5kuKiv6FsM", "reviewer": "Reviewer_qarJ", "summary": "This paper proposed a denoising pre-training framework NIM similar to MIM to improve adversarial defense ability. In particular, the input image is a noisy version of the original. The pre-training goal is to do denoising.", "questions": "See weakness.", "limitations": "See weakness.", "rating": 3, "confidence": 5, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "This paper is easy to follow.", "weaknesses": " * a) Novelty is limited. The idea proposed in this work is very similar to CIM [1]. Compared to MIM, this work changes the masking operation to add noise.\n\n* b) Performance is incremental with limited applicability. The proposed De3 as a pure self-supervised pre-training approach does not outperform MIM baselines (MAE and SimMIM). For downstream adversarial robustness tests, De3 shows improvement over MAE and SImMIM, which is not surprising since the pre-training goal is to denoise. \n\n* c) Datasets and backbones used in this work to validate performance are scarce. It is suggested that more datasets,downstream tasks, and backbones are evaluated.\n\n**References**\n\n[1]  Fang, Yuxin, et al. \"Corrupted image modeling for self-supervised visual pre-training.\" ICLR 2023.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your valuable feedback. We'd like to address your concerns:\n\n> Novelty is limited. The idea proposed in this work is very similar to CIM [1].\n\nThere are many major differences between our work and [1], including\n1) Purpose: Our goal is to explore how the generative pretraining paradigm can provide adversarial robustness beyond pretrained visual features, while the focus of [1] is to learn better pretrained visual representations.\n2) Method: We propose a novel method that utilizes the strong denoising ability of NIM models to remove the adversarial perturbation, while [1] proposes to adopt an additional generator with a small trainable BEiT to degrade the input image.\n3) Conclusions: We show that NIM is able to achieve a strong and tunable accuracy-robustness trade-off that MIM models are unable to compete, indicating the superiority of NIM over MIM in terms of adversarial robustness. In contrast, [1]’s authors demonstrate that both ViTs and CNNs can learn rich visual representations using a unified framework.\n\nOverall, the core novelty of our work lies in the proposed methods that effectively leverage the pretraining NIM models for providing adversarial defense to downstream models, which is recognized by other reviewers.\n\n> Performance is incremental with limited applicability.\n\nWe respectfully disagree that our method’s performance is incremental. As explicitly stated in our title, this work aims to go beyond pretrained features and see if pretrained models can provide adversarial robustness to downstream models. We show that our proposed method achieves a significant improvement in robustness against PGD attack by 34.36%, with a marginal clean accuracy drop of 4.37%. Even without the $De^3$ defense, the NIM model’s robust accuracy against FGSM attack is higher by 3.37% than MAE, while the clean accuracy of NIM-MAE is slightly lower by 0.47%.\n\n> De3 shows improvement over MAE and SImMIM, which is not surprising since the pre-training goal is to denoise.\n\nFirst, we would like to argue that setting the target improvement as the training goal is a natural and reasonable idea in machine learning research, which would not diminish the work’s value. For example, adversarial training [2] incorporates adversarial examples in training. While it might seem \"unsurprising\" that adversarial trained models are robust to adversarial examples, the importance of this work has been universally acknowledged. In the context of our work, we believe what matters is that NIM’s improvement over MIM is under fair settings: from pretraining and fine-tuning to evaluation, we ensure everything is the same and the only variable is the degradation method. \n\nOn the other hand, we believe our results are interesting for that our training goal is not exactly the target: we train the model to denoise *Gaussian noise*, instead of specific *adversarial noise*. Therefore, at inference time, we propose to add Gaussian noise whose magnitude is much larger than the imperceptible adversarial noise, so the latter can be flooded and removed along. From this perspective, the idea is interesting and instructive, as appreciated by fellow reviewers.\n\n> Datasets and backbones used in this work to validate performance are scarce.\n\nFollowing the suggestion, we conducted another experiment on CIFAR-10, based on the implementation of [3]. We set the attack radius $\\epsilon = 8/255$, and other settings remain the same as in Table 1 of our main paper. The results are as follows:\n\n| Model | MAE | MAE | NIM-MAE | NIM-MAE | NIM-MAE |\n| --- | --- | --- | --- | --- | --- |\n| $De^3$ | None | $\\gamma$=0.75 | None | $\\sigma$=40 | $\\sigma$=70 |\n| Clean | **89.88** | 78.36 | 88.31 | 81.09 | 76.30 |\n| FGSM | 17.51 | **65.13** | 21.66 | 43.26 | 48.86 |\n| PGD-10 | 0.01 | 22.50 | 2.77 | 32.24| **40.26** |\n| AA | 0.00 | 6.220 | 0.00 | 31.49 | **41.20** |\n\nInterestingly, we observe that unlike on ImageNet, MAE provides a stronger defense against FGSM on CIFAR-10. It is likely because, 1) for low-resolution images, MAE can generate good reconstructions from masked images; 2) when using MAE in $De^3$, 75% of adversarial perturbations will be masked, and if the attack is weak like FGSM, the rest of the perturbation would be too weak to break the model. However, for stronger attacks, NIM still provides better defense than MAE. \n\nRegarding more downstream tasks, we would like to remind the reviewers that implementing adversarial attacks for other tasks than classification is not a trivial work [4, 5] and is beyond the scope of this paper. To the best of our knowledge, researchers normally would only conduct experiments on image classification to show the effectiveness of an adversarial defense [6, 7, 8].\n\nRegarding the backbones, we would like to draw attention to Figure 1(a) in the supplementary material, where we have demonstrated that our method is scalable and effective with larger backbones.\n\n---\n[1] Fang, et al. Corrupted image modeling for self-supervised visual pre-training. ICLR 2023.\n\n[2] Madry, et al. Towards Deep Learning Models Resistant to Adversarial Attacks. ICLR 2018.\n\n[3] https://github.com/IcarusWizard/MAE.\n\n[4] Croce, et al. Robust Semantic Segmentation: Strong Adversarial Attacks and Fast Training of Robust Models. 2023.\n\n[5] Agnihotri, et al. CosPGD: a unified white-box adversarial attack for pixel-wise prediction tasks. 2023.\n\n[6] Rebuffi, et al. Revisiting adapters with adversarial training. ICLR 2023.\n\n[7] Mo, et al. When adversarial training meets vision transformers: Recipes from training to architecture. NeurIPS 2022.\n\n[8] Yoon, et al. Adversarial Purification with Score-based Generative Models. ICML 2021.\n\n"}]

Author rebuttal:

Meta-review: After the rebuttal period, most reviewers lean towards acceptance. Although reviewer qarJ raised concerns about the novelty of the method, AC aligns with most reviewers’ comments that the paper proposed an effective defense method against adversarial attack, and it allows for a tunable trade-off between accuracy and robustness. Overall this work can be of large interest to the community working on adversarial defense.
Decision: Accept (poster)