Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Models
Authors: Naman Deep Singh
Francesco Croce
Matthias Hein
Venue: NeurIPS 2023 poster (2023)
Keywords: adversarial robustness
deep learning
vision transformers
convnext
TL;DR: We study the effect of changes in architectures and adversarial training scheme to reach SOTA adversarial robustness on ImageNet.

Abstract: While adversarial training has been extensively studied for ResNet architectures and low resolution datasets like CIFAR-10, much less is known for ImageNet. Given the recent debate about whether transformers are more robust than convnets, we revisit adversarial training on ImageNet comparing ViTs and ConvNeXts. Extensive experiments show that minor changes in architecture, most notably replacing PatchStem with ConvStem, and training scheme have a significant impact on the achieved robustness. These changes not only increase robustness in the seen $\ell_\infty$-threat model, but even more so improve generalization to unseen $\ell_1/\ell_2$-attacks. 
Our modified ConvNeXt, ConvNeXt + ConvStem, yields the most robust $\ell_\infty$-models across different ranges of model parameters and FLOPs, while our ViT + ConvStem yields the best generalization to unseen threat models.

Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Models
Naman D Singh" University of Tübingen Tübingen AI Center
Francesco Croce* University of Tübingen Tübingen AI Center
Matthias Hein University of Tübingen Tübingen Al Center
Abstract
While adversarial training has been extensively studied for ResNet architectures and low resolution datasets like CIFAR-10, much less is known for ImageNet. Given the recent debate about whether transformers are more robust than convnets, we revisit adversarial training on ImageNet comparing ViTs and Cens Extensive experiments show that minor changes architecture, most notably replacing PatchStem with ConyStem, and training scheme have a significant impact the on the achieved robustness. These changes not only increase robustness seen loc -trreat model. but more improve generalization to unseen & /2/22- attacks. Our modified Nex, ConvNeXt + ConvStem, yields the most robust -oodls across different ranges of model parameters and FLOPs, while our ViT ConvStem yields the best generalization to unseen threat models.
Introduction
Adversarial training [36] is the standard technique to obtain classifiers robust against adversarial perturbations. Many works have extensively analyzed several aspects of adversarial training, leading to further improvements. These include changes in the training scheme, i.c. using diffcrent loss functions [66, 43, 40], tuning hyperparameters like learning rate schedule weight decay, increasing the strength of the attack at training time, adding label smoothing and stochastic weight averaging [19, 41], Also, complementing the training set with pscudo-labelled [3] or synthetic [20] data, and via specific augmentations [45] yields more robust classifiers.
However, these works focus on small datasets like CIFAR- 10 with low resolution images, and models using variants of ResNet [22] as architecture. When considering a more challenging dataset like ImageNet, the space of possible design choices regarding model, training and evaluation protocols becomes much richer, and little work exists exploring this domain. For example, has been recently shown that architectures like vision transformers (ViTs) [16, 50], mixers [49, 54] and hybrids borrowing elements of different families networks [17, 64] are competitive or outperform convolutional networks ImageNet, while they hardly work on e.g. CIFAR-10, In turn, ConvNeXt [34] has been proposed as modern version of ResNet which closes the gap to transformer architectures.
In this work we study the influence of architecture and training schemes on the robustness of classifiers seen and unseen attacks. We focus on two extreme ends of architectures used for ImageNet, ViT and ConvNeXt (isotropic vs non-isotropic, attention only vs convolution only, stem with large vs small patches), and study Isotropic ConvNeXt as an intermediate architecture. We focus on training ImageNet models robust with respect to the f. -threat model (i.e. the perturbations have bounded -nrrm), but additionally track the robustness to unseen f and fa-attacks in order to reveal architectural components which lead to better generalization of robustness. This, in fact, is desirable
Equal Contribution. Correspondence to: haman-deep singhhuni- wew.onunnntttiiiinnetcm
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

ConvNeXt-B-CvSt
56
ConvNeXt-S-CvSt
ConvNext-T-CvSt
ViT-B-CvSt
Robust accuracy (%)
52
VIT-S-CvSt
ViT-B
RobArch-L
48
VIT-M-CvSt
Swin-S RobArch-M
Swin-B
XCiT-L
ConvNeXt-
44
RobArch-S
XCIT-S
ViT-S
WRN-50-2
36
GFLOPs (range)
8
-
ConvNeXt (ours)
ResNet-50
ViT (ours)
32
8 12
16+
SOTA models
28
20
30
40
50
60
70
80
90
100
110
Parameters (M)
Figure 1: AutoAttack -Robust accuracy (E = 4/255) on ImageNet across different archi- tectures and training schemes at resolution 224 x 224. With training scheme and replacing PatchStem with ConvStem in ConvNeXt and ViT, we outperform over range of parameters/FLOP existing models in terms of -robust accuracy, e.g. our ConvNeXt-T-CCSS with 28.6M parameters achieves 50.2% robust accuracy, an improvement of 5.8% compared to the Con-NeXt-T of [14].
property since typically adversarially trained models are still vulnerable to attacks not seen at training time [28]. particular, show via extensive experiments that
using a convolutional stem instead of patch stem in most cases leads to consistent gains in Lo -robustness and quite a large boost in the unseen f1- and fg-threat models.
leveraging SOTA pre-trained clean models initialization allows to train using heavy augmen- tation, in contrast to what has been suggested by prior work [2, 14].
increasing image resolution at test time yields improvements in Eoc-rbbutt accuracy. This is
surprising as for the -threat model with fixed radius, higher resolution yields stronger attack.
Combining our various improvements, we obtain statc-of-the-ar foc -robust accuracy for perturbation size 4/255 at resolution 224 224 ImageNet, Fig. 1. We obtain 50.2% robust accuracy for small and 56.3% robust accuracy for large models, improving by 5.8% and 2.8% respectively upon prior works. Furthermore, improve SOTA when fine-tuning these models larger radius, 6x = 8/255 and to other datasets. We make our code and robust models publicly available.'
Background and Related Work
In [36] adversarial training (AT) of a classifier fo : X + y introduced the optimization problem
min Σ
max C(fo(z; + 6), 6:1
(1)
(EL
where 9 are the parameters of the classifier fa. The goal to make robust against bp-bounded perturbations, that is the classifier should have the same prediction on the ball (2 <p) of radius ep centered 24, practice, the iner maximization is approximately solved with projected gradient descent (PGD), 0 is optimized with SGD (or its variants) on the training set D, and cross-entropy loss used as objective function L. AT has been shown to an effective defense against adversarial perturbations, and many follow-up works have modified the original algorithm to further improve the robustness of the resulting models [66, 61, 20, 43, 40].
The most popular threat models are f--- and fz-bounded perturbations. Several other attacks have been explored, including é or bouuddde adversarial patches, those defined by neural perceptual
'https:// /tte::///tttie ccw.//mmddepprrriisstin---a

---

metrics like LPIPS [30]. A well-known problem is that models trained to be robust with respect to one threat model need not be robust with respect to unseen ones [28]. Multiple-norm adversarial training [53] aims to overcome this but degrades the performance compared to adversarial training in each individual threat model.
Training recipe. [19, 41] analyzed in detail the influence of several fine-grained choices of training hyperparameters (batch size, weight decay, learning rate schedule, etc.) on the achieved robustness. [24, 5] suggest to use a standard classifier pre-trained either on a larger dataset or with a self- supervised task as initialization for adversarial training for improved robustness. However, all these works focus on CIFAR-IA 10 or other datasets with low resolution images. In [38], the effect of several elements including clean initialization, data augmentation and length of training on adversarial training with ViTs is analyzed: however, their study is limited to CIFAR- 10 and Imagenette [25], and we show below that some of their conclusions do not generalize to ImageNet and other architectures. For ImageNet, [2] argued that ViT's and ResNets attain similar robustness for several threat models if training scheme and architecture size for both are similar, while [14] proposed recipe for training -robutt transformers, in particular XCIT [17]: basic augmentation, warm-up for the radius ép. and large weight decay. In contrast, [44] use the standard training scheme for a large ViT-B for 300 epochs and obtain the most -robustt model on ImageNet. In concurrent work, [32] study - -taining schemes for ConyNeXt and Swin- Transformer which are outperformed by our models, in particular regarding generalization to unseen attacks.
Architectural design choices. Searching for more robust networks [60, 26] studied the effect of architecture design choices in ResNets, e.g. width and depth, on adversarial robustness for CIFAR- 10. Recently, [42] did a similar exploration on ImageNet. [48] compared the robustness to seen and unseen attacks of several modern architectures on CIFAR-10 and Imagenette, and conclude that ViTs lead to better robust generalization. Finally, [63] found that using smooth activation functions like GELU [23] improves the robustness of adversarially trained models ImageNet, later confirmed for CIFAR- 10 as well [19, 41J.
Modern architectures. Since [16] showed that transformer-basse architectures can be successfully used for vision tasks, a large number of works have introduced modifications of vision transformers [50, 33, 55] achieving SOTA classification accuracy on ImageNet, outperforming ResNets and variants. In turn, several works proposed variations of training scheme and architectures to make convolutional networks competitive with ViTs [47, 591, in particular leading to the ConvNeXt architecture of [34]. Moreover, hybrid models combine typical elements of ViTs and CNNs, trying to merge the strengths of the two families [17, 13, 64]. While these modern architectures perform similarly well on vision tasks, it is open how they differ regarding adversarial robustness. [18, 21] compared the robustness of normally trained ViTs and ResNets to ep-norm bounded and patch attacks concluding that the ranking depends on the threat model.
3 Influence of Architecture on Adversarial Robustness to Seen and Unseen Attacks
In this section we analyze existing architectures and their components regarding adversarial robustness on ImageNet. In particular, we are interested in studying which elements are beneficial for adversarial robustness (i) in the threat model seen at training time and (ii to unseen attacks. Since it is the most popular and well-studied setup, we focus on adversarial training w.r.t. fxo, and use &-- and f bo-doddd attacks to measure the generalization of robustness to unseen threat models. While we focus on the influence of architecture on the achieved robustness in this section, influence of pre-training and augmentation in Sec. 4. All results are summarized in Table which provides the full ablation for this and the next section. We select the version T for ConvNeXt and for Isotropic CenvNeXt and ViT, since these have comparable number of parameters and FLOPPs
analyze the
3.1 Experimental Setup
Training setup. If not stated otherwise, we always use adversarial training [36] w.r.t. too with perturbation bound = 4/255 and steps of APGD [8] for the inner optimization on ImageNet- 1k using resolution 224x224 (we refer to App. C.2 for comparison of APGD-AT vs PGD-AT). Note that we use the f-- or & -threat model just for evaluation, we never do adversarial training for them. basic We use cosine decaying learning rate preceded by linear warm-up. In this section,
3

---

training setting, that is only random crop as basic augmentation and 50 epochs of adversarial training from random initialization. More details are available App. A.
Evaluation setup. For all experiments in the paper, unless specified otherwise, we evaluate the robustness using AutoAttack [8. 9], which combines APGD for cross-entropy and targeted DLR loss, FAB-attack [7] and the black-box Square Attack [1]. on the 5000 images of the ImageNet validation set selected by RobustBench [6] at resolution 224x224. The evaluations are done at the following radii: Eoo 4/255, E2 = 2. and éi = 75. For some marked experiments which involve a large number of evaluations we use APGDT-DLR (40 iterations, 3 restarts) with the targeted DLR loss [8] which is roughly off by 1-2% compared to full AutoAttack.
3.2 Architecture Families and Convolutional Stem
Choice of architectures. While some of the novel components of ConvNeXts are inspired by the Swin Transformer [33]. the ConvNeXt is a modified version of ResNet, using progressive downsampling and convolutional layers. On the other end of the spectrum of network families we find ViTs, as a non-convolutional architecture using attention and with an isotropic design after the PatchStem. see Fig. 2. Additionally, [34] introduce Isotropic ConvNeXt, which creates tokens similarly to ViTs, which are then processed by sequence of identical residual blocks (with no downsampling. hence the name isotropic) as in ViTs, until final linear classifier. The blocks of a VIT rely on multi-head self-attention layers [56], while Isotropic ConvNeXt replaces them with depthwise convolutions. intermediate step between ConvNeXt and VIT. By considering VIT and ConvNeXt, we cover two extreme cases of modern architectures. While it would have been interesting to include other intermediate architectures like XCIT or Swin-Trann Transforrrf our computational budget did not allow this on top of the already extensive experiments of the present paper.
can be thus considered
Convolutional stem. [62] propose to replace the patch embedder in ViTs with a convolu- tional block (ConvStem) consisting of several convolutional layers alternating with normaliza- tion and activation layers. While the PatchStem in ViTs divides the input in disjoint patches and creates tokens from them, the ConvStem progressively downsamples the input image until it has the right resolution to be fed to the transformer blocks. [62] show that this results in more stable standard training which is robust to the choice of optimizer and hyperparameters. As adversarial training is more difficult than standard training, we check if adding a Con- vStem has similar positive impact there well. As both ViTs and Isotropic CenvNeXts divide the input image into 16 x 16 patches, we use for both the convolutional stem of [62]. which has four convolutional layers with stride 2, each followed by layer normalization and GELU acti- vation. Since ConvNeXt uses PatchStem with 4 x 4-patches, the ConvStem of ViTs would not work. Therefore we design specific convo- lutional stem with only two convolutional lay- ers with kernel size and stride see Fig. Adding a ConvStem has only minimal impact on the number of parameters and FLOPs of the models (see Table 2), especially for ConvNeXt. More details on the convolutional stem design, and ablation studies on its effect on unseen threat models can be found in App. B. The effect of ConvStem on model size is discussed in App. C.4.
ConvStem
Patch-Stem
Image
Image
3x3 Cony, stride 2
4x4 Conv, stride 4
LayerNorm
LayerNorm
GeLU
Stage
Stage
Figure 2: Convolutional stem for ConvNeXt. We
use two convolution layers, each followed by Lay- erNorm and GELU to replace the 4x4 patch of the standard Cen model (PatchStem).
3.3 Effect of Architecture and ConvStem vs Patchstem on Adversarial Robustness
In Table we first check for the basic setting described above (random init., basic augment.) the effect of using a convolutional stem (+ CvSt) vs PatchStem for the three architectures: for both isotropic architectures it notably improves the robustness as well as clean accuracy for adversarially trained models, whereas the improvements for the ConvNeXt are marginal. However, all three architectures show huge improvements in the generalization of robustness to unseen é and 2atattacks when using ConyStem instead of PatchStem. Interestingly, the e and fg-robustness of the ConvStem models quite similar despite larger differences in robusstesss. Our results in this basic training setup show

---

Table 1: Influence of ConvStem, strong (clean) pre-training and heavy data augmentation. We show an ablation of using strong (clean) pre-training, heavy data augmentation and longer training for all models with and without ConvStem. Across all architectures using ConvStem, stronger pre-training, heavy augmentation and longer training improve adversarial robustness. We boldface the best performance for every metric within each architecture family.
Adversarial Training w.r.t. too
Architecture
Training Scheme
clean
l2
random init., basic augment.
64.0
37.1
28.9
8.8
strong clean pre-training
69.4 +5,4
41.6
+4,5
42,4+13.5
18.9+10.1
Conv.NeXI-T
heavy augmentations
71.0 +1.6
+4.9 46.5
38.1 -4.3
14.9 -4.0
50 300 epochs
72.4 +1.4
48.6
42.1
38.0 -0.1
14.9 +0.0
random init., basic augment.
64.2
37.6
40.2
18.6
strong clean pre- vee-trannig
69.1
42.2 +4.6
42.4 +2.2
19.7
ConvNeXi-T CvSt
heavy augmentations
69.1 +0.0
47.5 +5.3
47.8 +5.4
24.6 +4,9
50 - 300 epochs
72.7 43.6
+2.0 49.5
40.6 48.4
24.5 -0.1
random init., basic augment.
60.5
31.7
20.8
4.0
strong clean pre- pre-training
68.0 +7.5
38.9 +7.2
38.3+
17.0+13.0
Isotropic Cony-NeXt-S
heavy augmentations
64.5 -3.5
38.5 -0.4
36,5 -1.8
17.7
+ 300 epochs
69.0 +4.5
44.2 +5.77
36.6 40.1
14.9 -2.8
random init., hasic augment.
62.1
33.5
40.0
23.8
strong clean pre-training
69.5 +7.4
41,8 +8.3
46.2 +6.2
26.9 +3.1
Iso-ConyNeXt-S CvSt
heavy augmentations
69.5 +0.0
42.1 +0.3
47.2 +1.0
28.9 +2.0
50 300 epochs
70.2 +0.7
45.9 +3.8
49.2 +2.0
27.9 -1.0
random init.. basic augment.
61.5
31.8
35.5
15.1
strong clean pre-training
66.8 +5.3
39.1 +7.3
34.5 -1.0
12.6
ViT-S
heavy augmentations
65.2 -1.6
39.2 +0.1
37.3 +2.8
16.2 43.6
50 + 300 epochs
69.2 +4.0
44.0 +4.8
37.5 +0.2
15.1 -1.1
random init., basic augment.
62.8
34,4
39.2
20.4
strong clean pre-training
71.2 +8.4
44.3 49.9
47.1 +7.9
23.2 42.8
VIT-S + CvSt
heavy augmentations
69.9 -1.3
44.0 -0.3
47.1 40.0
25.9 42.7
> 300 epochs
72.5 +2.6
44.1
50.4 43.3
26.7
+0.8
that the ConyStem is simple and effective architecture modification which has significant impact robustness with respect to seen and unseen threat models. We also note that this finding generalizes for the modifications of the training scheme proposed in the next section. It particularly remarkable that even for the ConvNeXt architecture, this little change from PatchStem to ConyStem has such huge effect the robustness with respect the unseen -and Eg-threat models.
Effect of Strong Pre-Training and Heavy Data Augmentation on Robustness
As the next step after the architecture modification of the last section, we now identify an ablation study in Table 1 strong pre-training and heavy augmentations as key elements of the training scheme which boost adversarial robustness on ImageNet. The effect of other fine- fine-grained training hyperparameters like weight decay and label smoothing discussed in App. D.3, where we show that varying them around our default values does not have any impact on robustness.
4.1 Strong Pre-Trainie
is well-known that pre-training on large datasets improves the performance downstream tasks, e.g. models pre-trained on ImageNet-21k k or JFT achieve significantly higher accuracy on ImageNet- 1k than those trained on ImageNet- 1k from random initialization [58]. Similarly, has been observed that pre- tre-training on larger datasets like ImageNet-21k or ImageNet- 1k helps to achieve better adversarial robustness on CIFAR-10 [24, 38]. However, our goal not to use a larger training set than ImageNet- 1k but to better utilize the given dataset ImageNet-Ik, As adversarial training on ImageNet is non-trivial optimization problem, where runs can fail completely, see [14], we propose to initialize adversarial training from fully trained (on ImageNet-Ile standard model. Although the clean model
5

---

is clearly not adversarially robust, starting from a point with low clean loss considerably helps in the first stages of adversarial training. Short fine-tuning of clean models to become adversarially robust has been discussed in [27, 10] but without achieving robustness comparable to full adversarial training.
In the following we use as initialization the standard models available in the timm library or from the original papers, refer App. D.7 for further details. For the models with convolutional stem no such models are available. For these we initialize the ConvStem randomly and the remaining layers with the weights of the corresponding non- con-ConvSttem models, then do standard training for 100 epochs to reach good clean accuracy (see App. B.3 for details and performance of these classifiers). Interestingly, changing from random initialization to initialization with strongly pre-trained models significantly improves clean as well as robuust accuracy across architectures, see Table 1. The effects on the isotropic architectures, which are known to be harder train, are even higher than for the ConvNeXt. At this stage the ViT-S ConvStem already has 2.5% better foc-robust (44.3% vs 41.8%) than the XCTT-S model of [14]. Finally, using an even better model, i.e. pre-trained on ImageNet-2IK, as initialization did not provide additional benefit, see App. D.I.
4.2 Heavy Data Augmentation
The second aspect we analyze is how to take advantage of heavy augmentation techniques like RandAugment [12), MixUp [67] and CutMix [65]. which are crucial for the performance of standard models, in adversarial training. In particular, [2] note that for ViTs using heavy data augmentation with adversarial training leads to model collapse, and thus design a schedule to progressively increase the augmentation intensity. Similarly, [14] report better performance for robust ViTs when only weak augmentations (random crop, horizontal flip, color jitter) are used, and that ConvNeXt training even diverges if heavy augmentations are not excluded. Finally, [44] could train with heavy augmentations but using much larger ViT-B model and longer training of 300 epochs (which allows them have a less steep learning rate warm-up phase). Instead we show that initializing adversarial training with well-traing standard classifier makes it possible to heavy augmentation techniques from the beginning, and benefit from them, even for small models and shorter training schedules. In contrast, in our experiments, training a ConvNeXt with heavy augmentations from random initialization failed.
As heavy augmentations we use RandAugment, CutMix, MixUp, Random Erasing [68] (with hyperparameters similar to [34], see App. A). We also use Exponential Moving Average (EMA) with a decay of 0.9999 and label smoothing with parameter 0.1 for consistency with [34]. However, we observe little to no effect of EMA robustness.
In Table one can see that adding heavy data augmentation on top of strong pre-training significantly boosts the performance of the ConvNeXts in clean and foo- robust accuracy. Interestingly, only the ConvNeXt + ConvStem has further strong improvements in the unseen fz- and E -threat models. For the isotropic architectures, heavy augmentations have marginal effect on robbusstssss,, although they improve robustness to unseen attacks. Isotropic architectures require longer training to benefit from heavy augmentations. We highlight that at this point Ton and ConvNeXt-T ConvStem already have higher (+2.1% % and +3.1% 1% respectively) robustness w.r.t. fox than the ConvNeXt-T from [14], and similarly our VIT-S ConvStem and Isotropic ConvNeXt ConvStem outperform XCiT-S [14] (detailed comparison to SOTA in Table 2). A further comparison of heavy augmentation and the 3-Aug scheme of [14] can be found in in App. D.2.
Longer training, Adding heavy data augmentation increases the complexity of the learning problem, which requires longer training. in particular for isotropic architectures. Thus we extend the training time from 50 to 300 epochs. As expected we see the strongest improvements for the isotropic architectures but even for ConvNeXt one observes consistent gains: this is in contrast to the claim of [38] that longer training does not help to improve robustness. The ConvNeXt-T ConvStem, with 49.5% robust accuracy, outperforms all classifiers reported in [14] and [42], including those with up to times more parameters.
5 Comparison with SOTA Models
In Table we compare our classifiers with models from prior works trained for adversarial robustness w.r.t. foo at 6oc 4/255 on ImageNet. For each model we report number of parameters and FLOPs,

---

Table 2: Comparison to SOTA -robust models ImageNet. For each model report the number of parameters, FLOPs, number of epochs of adversarial training (AT), the number of PGD steps in AT, clean and & E2, -oobusst accuracy with Coc 4/255, C2 c1 75 (AutoAttack). Models of similar size are sorted in increasing t0o -robustesss Our ConvNeX + ConvStem improves by 5.8% for small, 7.2% for medium, and 2.8% for large models over SOTA.
Params FLOPs
Adv. Steps
Adversarial foc
wit
Architecture
Source
Ep.
(M)
(G)
clcan
E2
f1
ResNet-50
25.0
4.1
[46]
100
3
65.88
33.18
18.88
3.82
ResNet-50
25.0
4.1
[2]
100
67.44
35.54
18.16
3.90
VIT-S
22.1
4.6
[2]
66.62
36.56
41.40
21.82
ViT-S
22.1
4.6
[14]
110
66.78
37.88
ViT-S
22.1
4.6
[37]
90
3
65.9
39.24
32.18
10.54
XCYT-S12
26.0
4.8
[14]
72.34
41.78
46.20
22.72
Small
ViT-S
22.1
4.6
300
69.22
44.04
37.52
15.12
RobArch-S
26.1
6.3
[42]
110
3
70.58
44.12
39.88
15.46
Isotropic-CN-S
22.3
4.3
ours
69.04
44.22
36.64
14.88
ConwNeXt-T
28.6
4.5
[14]
110
71.60
44.40
45.32
21.76
Isotropic-CN-S ConvStem
23.0
4.7
ours
300
2
70.02
45,90
49.24
27.84
VIT-S + ConvStem
22.8
5.0
ours
300
2
72.56
48.08
50.40
26.68
ConvNeXt-T
28.6
4.5
ours
72.40
48.60
38.02
14.88
ConwNeXt-T ConvStem
28.6
4.6
300
72.72
49.46
48.42
24.52
- + ConyStem
28.6
4.6
ours
300
3
72.70
50.16
49.00
24.16
Wide-ResNet-50-2
68.9
11.4
[46]
100
3
68.82
38.12
22.08
4.48
ResNet-101
44.5
7.9
[37]
90
3
69.52
41.02
25.62
6.56
Medium
XCYT-M12
46.0
8.5
[14]
74.04
45.24
48.18
22.72
ViT-M
38.8
8.0
50
71.72
47.24
49.02
29.20
VIT-M ConvStem
39.5
8.4
ours
50
2
72.40
48.80
50.56
28.12
ConvNeXi-S
50.1
8.7
ours
2
74.10
52.32
43.84
19.52
ConyNeXt-S ConvStem
50.3
8.8
ours
74.10
52.42
50.88
25.64
ViT-B
86.6
17.6
[37]
90
3
70.42
43.02
47. 47.26
27.08
XCTT-L12
104.0
19.0
[14]
73.76
47.60
49.38
23.74
Swin-B
87.7
15.5
[37]
90
3
74.76
48.10
44.42
18.04
RobArch-L.
104.0
25.7
[42]
100
3
73.46
48.92
39.48
14.74
ViT-B
86.6
17.6
ours
73.32
50.02
52.14
33.12
ViT-B ConvStem
87.1
17.9
50
74.38
$2.58
54.38
31.20
Large
VIT-B
86.6
17.6
[44]
300
2
76.62
53.50
ConwNeXItB
88.6
15.4
ours
50
2
75.62
$4.34
48.52
23.70
ConvNeXt-B + ConvStem
88.8
16.0
ours
75.32
$4.38
50.06
24.76
ViT-B + ConvStem
87.1
17.9
250
2
76.30
54.66
56.30
32.06
ConvNeXt-B
88.6
15.4
[32]*
300
3
76.02
55.82
44.68
21.23
ConvNeXt-B + ConvStem
88.8
16.0
ours
75.90
56.14
49.12
23.34
Swin-B
87.7
15.5
[32]*
300
3
76.16
56.16
47.86
23.91
ConvNeXt-B B + ConvStem
88.8
16.0
ours
250
3
75.18
56.28
49.40
23.60
concurrent work
the number of training epochs, the number of steps in the inner maximization. and clean and robust accuracy (AutoAttack on RobustBench validation set) in the three threat models. We group the models according to size for fair comparison, distinguishing small (< 30M parameters), medium (RS 50M params) and large models (2 80M params).
1-Step vs 2-Step Adversarial Training. Current works use one to three steps of PGD to solve the inner problem, see column "Adv. Steps" Table It is an important question if our gains, e.g. compared to works like [14] who use single step, are just result of the stronger attack at training time. We test this by training a ConvNeXt-T ConvStem model with strong pre-training and heavy augmentation with 1-step APGD adversarial training for 50 epochs. We get loc robbstt accuracy

---

of 46.4% (clean acc. is 71.0%) compared to 47.5% with 2-step APGD (see Table 1) which is just difference of 1.1%. Thus our gains are only marginally influenced by stronger adversarial training. Moreover, our ConvNeXt + ConvStem models with 50 epochs of adversarial training outperform all existing SOTA models even though the computational cost of training them lower (50 epochs of 2-step AT corresponds roughly to 75 epochs of 1-step AT and 37.5 epochs of 3-step AT). For our best small and large model we also check the other direction and train 3-step AT models, which improve by 0.7% for ConvNeXI-T ConvStem and 0.14% for ConvNeXI-B + ConvStem in foe -robustness. This suggests that 2-step AT is good compromise between achieved robustness and training time. In App. C.I additionally show how our training scheme yields more robust models than that of [14], even with less than half the effective training cost.
Scaling to larger models. We apply our training scheme introduced in the previous sections to architectures with significantly more parameters and FL.OPs. We focus on ConvNeXt-S/B and ViT-M/B: in particular, for ConvNeXt-B we adapt the convolutional stem used for ConvNeXt-T by adding an extra convolutional layer, while for the ViT's we just adjust the number of output channels to match the feature dimension of the transformer blocks (more details in App. B). We train the medium models for 50 epochs and the large models for 50 and 250 epochs (with ConvStem only).
Comparison with SOTA methods. Among small models, all three architectures equipped with ConvStem outperform in terms of & robuustnes all competitors of similar size with up to 5.8% improvement upon the ConvNeXt-T of [14]. Moreover, our ConvNeXt-T + ConvStem is with 50.2% robust accuracy 1.2% better than the RobArch-L [42] (the previously second most robust model) which has 3.6x more parameters and FL.OPs. The ConvStem positively impacts generalization of robustness to unseen attacks of all three architectures, with improvements between 2.8% and 4. 4.2% for l2 and 1. 1.4% and 5. 5.2% for & (with respect to the XCTT-S12). For medium models the picture is the outperform both in seen and unseen
same: our ViT-M+Conv threat models their non-ConyStem counterparts and the best existing model (XCiT-M12 of (14)).
and the ConvNeXI-S++Cone
For large models we compare the previously most robust model, the VIT-B of [44], with 53.5% -robutt accuracy (the model is not available so we cannot evaluate f1- and fy-robustness). It remarkable that our Www.NeeeeetoSSeeeee
with only 50 epochs of training outperforms this ViT-B trained for 300 epochs already by 0.9% and with 250 epochs training even by 2.5%. An interesting observation that our ViT-B+ConvStem with 250 epochs training with 54.7% just 1.3% worse than our ConvNeXt-B+Con attacks: 56.3% vs. 49.1% for l and 32.1% vs 23.3% for 41. Regarding the concurrent work of [32], we note that our ConvNeXt-B+ConvSe better than their ConvNeXI-B 3-step AT model trained for 300 epochs ( 40% longer training time), while having significantly better generalization to the unseen f and fz-attacks. Our 3-step AT ConvNeet-B+ConsSSee
but has significantly better generalization to unseen
trained for 250 epochs with 2-step AT is already
outperforms their best model, a Swin-B, even though it is trained for 20% less epochs, and has better generalization to lg. Finally, we note that our ViT-++ConyStem significantly outperforms their Swin-B in terms of robustness to unseen attacks.
Additional experiments. InternImage [57], recent non-isotropic model, already uses a ConvStem. Replacing with a PatchStem preserves the robustness in loo (seen threat model) but decreases the robustness to unseen f and fatattacks (App. C.3), further validating the effectiveness of ConvStem.
Table 3: Optimal test time image resolution. For our small and large models trained 224 224 with 300 or 250 epochs AT, we provide the optimal test time resolution and the result- ing improvements (green) in clean and -robustt accuracy (e 4/255) compared to the training resolution.
Table 4: ImageNet: -oobust ac- curacy at 6 8/255. While models from the literature are trained from scratch for 6xo = 8/ 8/255, we fine-tune our 4/255- robust models for only 25 epochs to the larger radius.
Architecture
Res.
clean
fac
ConvNeXt-T
256
72.4
+0.0
49,4
+0.8
ConvNeXI-T + CvSt
288
74.8
+1.9
50.8
+1.3
Architecture
Source clean
foo
Iso-CN-S
288
71.2
+2.2
46.4
+2.2
ResNet-50
[46]
54.9
19.7
Iso-CN-S CvSt
288
72.3
+2.1
48.1
+2.2
XCIT-S
[14]
63.5
25.0
ViT-S
256
69.9
+0.7
44.2
40.2
VIT-S + CvSt
ours
67.5
28.2
VIT-S + CvSt
288
73.7
+1.2
49,3
+1.2
XCIT-L
[14]
69.2
28.7
VIT-B + CvSt
256
76.6
+0.3
55,8
+1.1
CN-T CvSt
ours
68.6
29.6
ConvNeXt-B CvSt
256
76.9
+1.0
$7.3
+1.2
CN-B CvSt
ours
71.7
33.2
8

---

clean accuracy
1. robustness
75
70
45
ConvNeXt-T
60
ConvNeXt-T ConvStem
Isotropic CN-T Isotropic CN-T ConvStem
40
55
VT-S
VTSS
192
224
256
288
320
352
384
192
224
256
288
320
352
384
input resolution
input resolution
Figure 3: (Robust) accuracy improves with increasing test-time image resolution. Evaluation of clean (left) and robust accuracy (right, evaluation using APGDT-DLR at Eoo = 4/225 for the top models from Table for varying test input resolution.
Influence of Resolution and Fine-Tuning
In the following we analyze robustness behaves under variation of test time resolution, and robust fine-tuning to either larger radius on ImageNet or other datasets.
Improving robustness via increasing test-time image resolution. Unlike small datasets like CIFAR- 10, for ImageNet the input images are resized before inference. Using higher resolution at test time can lead to improved clean accuracy for standard ImageNet models [52, 17J. On the other hand increasing dimension for fixed radius makes the -threat model more powerful. To study which effect prevails, we test clean and -robust accuracy for each of our 2-step AT models from 'small' (300 epochs) and 'large' (250 epochs) in Table when varying test time input resolution between 192 and 384. Note that all models have been trained on 224x224 images only, and no fine-tuning to different resolutions is done. Also, for ViTs we have to adapt the models via interpolation of the positional embedding as suggested by [4]. Fig. shows that all classifiers obtain their highest robustness for image resolutions of 256 or 288, higher than the training one. For faster evaluation use for this plot APGDTEDLR with 40 iterations and target classes. Then, we select for each model the best input resolution, and evaluate fox -obuusteesss with AutoAttack in Table 3. Increasing input resolution significantly improves clean and &oo -robust accuracy. Our ConvNeXt-B + ConvStem attains SOTA 76.9% and 57.3% clean and -robust accuracy, respectively, at resolution 256. Additional results on the role the input resolution can be found App. D.5, including a discussion what means for threat models other than lx-
Varied perturbation strength. In Table we test the effect of varying the test time resolution on the robustness in foo for radii other than 4/255 used for training (we use our ConvNeXt-B + ConvStem, with robustness evaluation via AutoAttac on the RobustBench ImageNet set). For all radii 6 the best resolution is either 256 or 288, that is larger than the training resolution of 224, which supports
Table Increased resolution across perturbation strengths. ConvNeXt-B+ConnSiee we see that both best clean and & robust accuracies attained higher resolution than the trained for (224) across all values 6 The difference from base value at the resolution of 224 is shown in color and the best result for each perturbation strength (row) is highlighted.
Input resolution
600
192
224
256
288
320
clean
74.1
-1.8
75.9
76,9
+1.0
77.7
+1.8
77.2
+1.3
2/255
64.6
-2.3
66.9
67.9
+1.0
68.6
+1.7
68.4
+1.5
4/255
53.0
-3.2
56.1
57.3
+1.2
57.2
+1.1
56.6
+0.5
6/255
41.0
-2.8
43.8
44.4
+0.6
44.5
+0.7
43.0
-0.8
8/255
29.5
-0.9
30.4
31.0
+0.6
29.8
-0.6
27.9
-2.5

---

Table 6: -Robutt accuracy at radius 6oo 8/255. We examine fine-tuning our ConvNeXt + ConvStem models robust to 6x. = 8/255 from Table 4 to other datasets. We compare to the XCIT models of [14] when available.
Flowers-100 102
CIFAR- 100
CIFAR-I0
Architecture
clean
foo
clean
foo
clean
foo
XCTT-S
82.86 80.42
47.91
67.34
32.19
90.06
56.14
CN-T + CvSt
50.89
72.32
32.30
92.72
55.97
XCTT-L
70.76
35.08
91.73
57.58
CN-B + CvSt
83.98
54.77
74.83
34.24
93.55
58.17
the results above. Unlike for the smaller radii, Eoc 8/255 the robust accuracy at both resolutions 288 and 320 is worse than at 224. This suggests that there are diminishing returns for higher radii. The attack strength increases more quickly with the perturbation budget higher resolution than the improvements in clean accuracy. While for the -threat model the comparison across different image resolutions can be done directly, the comparison for the fg-threat model more subtle and we discuss potential ways to do this in App. D.5. If one keeps the perturbation budget per pixel constant, that means increasing 62 linearly with the image resolution, then the gains in fz-robustness are marginal.
Fine-tuning to larger radius. While e 4/255 is the standard radius for the lox- -thrett model on ImageNet, even larger perturbations might still be imperceptible. [14] train XCiTs with 8/255 from scratch for 110 epochs. However, given the success of using warm start for adversarial training (see Sec. 4.1), we propose to fine-tune the model fully trained for robustness at e = 4/255 with adversarial training with the larger radius. Such classifiers already have non-trivial robustness at e= 8/255, and we expect they require only relatively small changes to adapt to the larger radius. We use our models from Table 2 to fine-tune for 25 epochs (details in App. A.5), and report the results in Table 4: our Con-NeXt-B + ConvStem improves significantly over the previous best result both in terms of clean and robust accuracy, even though we just use relatively short fine-tuning.
Fine-tuning to other datasets. We fine-tune our models trained to be robust at radius 8/255 from Table 4 to other datasets and compare the results of [14] in Table 6. For Flowers- 102 (resolution 224 x 224) the improvement over XCTT in robust accuracy is similar to the difference of the models in Table and shows that the benefits of more robust models transfer to smaller datasets. For CIFAR (resolution 32 x 32) our models tend to achieve similar robustness as the XCIT models but at a much better clean accuracy. We expect that here even stronger robustmess gains are possible by further optimizing the fine-tuning. For details on the fine-tuning setup see App. D.6.
7 Conclusion
We have examined two extreme representatives of today's modern architectures for image classi- fication, ViT and ConvNeXt, regarding adversarial robustness. We have shown that ConvNeXt + ConvStem yields SOTA & -rbbst accuracy well good generalization to unseen threat models such as & and & across a range of parameters and FLOPs. Given that for smaller model sizes the ConvNeXt + ConvStem is much easier to train than the VIT. has the potential to become similarly popular for studying adversarial robustness on ImageNet like (Wide)-ReeNets for CIFAR-10. On the other hand ViT ConvStem excels in generalization to unseen threat models. Thus there is no clear winner between ViT and Xt. Given that ImageNet backbones are used several other tasks, we think that our robust ImageNet models could boost robustness also in these domains. One such example is our recent work in robust semantic segmentation [11]. Another interesting open question why the ConvStem leads such a boost in generalization to e and ferthreat models.
Limitations. Given the extensive set of experiments already presented in this work and our limited computational resources, we unable to include other modern architectures. Hence, even though we cover quite diverse architectures, we do not cover all modern architectures for ImageNet.
Broader Impact. As this work studies the robustness of deep neural networks to adversaries, we do not see any potential negative impact our work. Instead, our work could help make modern deep models robust and safer to deploy.
10

---

Acknowledgements
The authors acknowledge support from the DFG Cluster of Excellence "Machine Learning New Perspectives for Science", EXC 2064/1, project number 390727645 and Open Philanthropy. The authors thank the International Max Planck Research School for Intelligent Systems (IMPRS-IS) for supporting Naman D Singh.
References
[1] Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: query-efficient black-box adversarial attack via random search. In ECCV, 2020.
[2] Yutong Bai, Jieru Mei, Alan Yuille, and Cihang Xie. Are transformers more robust than CNNs? In NewrlPS, 2021.
[3] Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C Duchi, and Percy S Liang. Unlabeled data improves adversarial robustness. In NeurlPS, 2019.
[4] Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and Armand Joulin. Emerging properties in self-supervised vision transformers. In JCCV, 2021.
[5] Tianlong Chen, Sijia Liu, Shiyu Chang, Yu Cheng, Lisa Amini, and Zhangyang Wang. Adver- sarial robustness: From sele-super pre-training to fine-tuning. CVPR, 2020.
[6] Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: standardized adversarial robustness benchmark. In NeurlPS Datasets and Benchmarks Track, 2021.
[7] Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with a fast adaptive boundary attack. In ICML, 2020.
[8] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse faremeter-free attacks. In ICML, 2020.
[9] Francesco Croce and Matthias Hein. Mind the box: I happd for sparse adversarial attacks image classifiers. In ICML, 2021.
[10] Francesco Croce and Matthias Hein. Adversarial robustness against multiple and single Ip --thrratt models via quick fine-tuning of robust classifiers. ICMI., 2022.
[11] Francesco Croce, Naman D Singh, and Matthias Hein. Robust semantic segmentation: Strong adversarial attacks and fast training of robust models. arXiv preprint, arXiv:2306.129%: 2023.
[12] Ekin D Cubuk, Barret Zoph, Jonathon Shlens, and Quoc V Le. Randaugment: Practical automated data augmentation with reduced search space. In CVPR, 2020.
[13] Zihang Dai, Hanxiao Liu, Quoe V. Le, and Mingxing Tan. Coatnet: Marrying convolution and attention for all data sizes. In NeurIPS, 2021.
[14] Edoardo Debenedetti, Vikash Sehwag, and Prateck Mittal. A light recipe to train robust vision transformers. In First IEEE Conference on Secure and Trustworthy Machine Learning, 2023,
[15] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In CVPR, 2009.
[16] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. In ICLR, 2021.
[17] Alaaeldin El-Nouby, Hugo Touvron, Mathilde Caron, Piotr Bojanowski, Matthijs Douze, Armand Joulin, Ivan Laptev, Natalia Neverova, Gabriel Synnaeve, Jakob Verbeek, et Xcit: Cross-covariance image transformers. In NeurIPS, 2021.

---

[18] Yonggan Fu, Shunyao Zhang, Shang Wu, Cheng Wan, and Yingyan Lin. Patch-fool: Are vision transformers always robust against adversarial perturbations? In ICLR, 2022.
[19] Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.0359322 2020.
[20] Sven Gowal, Sylvestre-Alvise Rebuffi, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy Mann. Improving robustness using generated data. In NeurlPS, 2021.
[21] Jindong Gu, Volker Tresp, and Yao Qin. Are vision transformers robust patch perturbations? In ECCV, 2022.
[22] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. ECCV, 2016.
[23] Dan Hendrycks and Kevin Gimpel. Gaussian error linear units (gelus). arXiv preprint arXiv: 1004441 2016.
[24] Dan Hendrycks, Kimin Lee, and Mantas Mazeika. Using pre-training can improve model robustness and uncertainty. In ICML, 2019.
[25] Jeremy Howard. Imagenette.
[26] Hanxun Huang, Yisen Wang, Sarah Erfani, Quanquan Gu, James Bailey, and Xingjun Ma. Exploring architectural ingredients of adversarially robust deep neural networks. In NeurIPS, 2021.
[27] Ahmadreza Jeddi, Mohammad Javad Shafiee, and Alexander Wong. A simple fine-tuning all you need: Towards robust deep learning via adversarial fine-tuning. arXiv preprint, arXiv: 13228, 2020.
[28] Daniel Kang. Yi Sun, Dan Hendrycks, Tom Brown, and Jacob Steinhardt. Testing robustness against unforeseen adversaries. arXiv preprint Ttf:::990.00011 2019.
[29] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers features from tiny images. 2009.
[30] Cassidy Laidlaw, Sahil Singla, and Soheil Feizi. Perceptual adversarial robustness: Defense against unseen threat models. In ICLR, 2021.
[31] Lin Li and Michael W Spratling. Data augmentation alone can improve adversarial training. In ICLR, 2023.
[32] Chang Liu, Yinpeng Dong, Wenzhao Xiang, Xiao Yang, Hang Su, Jun Zhu, Yuefeng Chen, Yuan He, Hui Xue, and Shibao Zheng. A comprehensive study on robustness of image classification models:
Benchmarking and rethinking. arXiv preprint, arXiv:2302. 14301, 2023.
[33] Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In ICCV, 2021.
[34] Zhuang Liu, Hanzi Mao, Chao- Yuan Wu, Christoph Feichtenhofer, Trevor Darrell, and Saining Xic. A convnet for the 2020s. In CVPR, 2022.
[35] Ilya Loshchilov and Frank Hutter. Decoupled weight decay regularization. In ICLR, 2018.
[36] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018
[37] Xiaofeng Mao, Yuefeng Chen, Xiaodan Li, Gege Qi. Ranjie Duan, Rong Zhang, and Hui Xue. Easyrobust: A comprehensive and easy-to-use toolkit for robust computer vision. https: //github. com/ al http//albbbbaeeeee easyrobust, 2022.
[38] Yichuan Mo, Dongxian Wu, Yifei Wang, Yiwen Guo, and Yisen Wang. When adversarial training meets vision transformers: Recipes from training architecture. In NewrIPS, 2022.
12

---

[39] Maria-Eles Nilsback and Andrew Zisserman. Automated flower classification over large number of classes. Indian Conference on Computer Vision, Graphics and Image Processing. 2008.
[40] Tianyu Pang, Min Lin, Xiao Yang, Junyi Zhu, and Shuicheng Yan. Robustness and accuracy could be reconcilable by (proper) definition. In ICML, 2022.
[41] Tianyu Pang, Xiao Yang, Yinpeng Dong, Hang Su, and Jun Zhu. Bag of tricks for adversarial training. In ICLR, 2021.
[42] Sheng Yun Peng, Weilin Xu, Cory Comelius, Kevin Li, Rahul Duggal, Duen Horng Chau, and Jason Martin. Robarch: Designing robust architectures against adversarial attacks. arXiv preprint arXiv:2301 001 10, 2023.
[43] Rahul Rade and Seyed- Seyed-Mohsen Moosavi-Dezfoolii Reducing excessive margin to achieve a better accuracy robustness trade-off. In ICLR, 2022.
[44] Sylvestre-Alvise Rebuffi, Francesco Croce, and Sven Gowal. Revisiting adapters with adversar- ial training. In ICLR, 2023.
[45] Sylvestre-Alvise Rebuffi, Sven Gowal, Dan A. Calian, Florian Stimberg, Olivia Wiles, and Timothy Mann. Data augmentation can improve robustness. In NeurlPS, 2021.
[46] Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adversarially robust imagenet models transfer better? In NeurlPS, 2020.
[47] Mingxing Tan and Quoc Le. Efficientnetv2: Smaller models and faster training. In ICML, 2021.
[48] Shiyu Tang, Siyuan Liang, Ruihao Gong, Aishan Liu, Xianglong Liu, and Dacheng Tao. Exploring the relationship between architecture and adversarially robust generalization. arXiv preprint arXiv:2209.1444 14105, 2022.
[49] Ilya O Tolstikhin, Neil Houlsby, Alexander Kolesnikov, Lucas Beyer, Xiaohua Zhai, Thomas Unterthiner, Jessica Yung, Andreas Steiner, Daniel Keysers, Jakob Uszkoreit, et al. Mip-mixer: An all-mlp architecture for vision. In NeurlPS, 2021. 2021.
[50] Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data-efficient image transformers & distillation through attention. In ICML, 2021.
[51] Hugo Touvron, Matthieu Cord, and Hervé Jégou. Deit ii:: Revenge of the vit. In ECCV, 2022.
[52] Hugo Touvron, Andrea Vedaldi, Matthijs Douze, and Hervé Jégou. Fixing the train-test resolution discrepancy. In NeurlPS, 2019.
[53] Florian Tramèr and Dan Bonch. Adversarial training and robustness for multiple perturbations. In NeurlPS, 2019.
[54] Asher Trockman and Zico Kolter. Patches are all you need? Transactions on Machine Learning Research, 2023.
[55] Zhengzhong Tu, Hossein Talebi, Han Zhang, Feng Yang, Peyman Milanfar, Alan Bovik, and Yinxiao Li. Maxvit: Multi-axis vision transformer. In ECCV, 2022.
[56] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz. Kaiser, and Illia Polosukhin. Attention is all you need. In NeurlPS, 2017.
[57] Wenhai Wang, Jifeng Dai, Zhe Chen, Zhenhang Huang, Zhiqi Li, Xizhou Zhu, Xiaowei Hu, Tong Lu, Lewei Lu. Hongsheng Li, et al. Internimage: Exploring large-scale vision foundation models with deformable convolutions. In CVPR, 2023.
[58] Ross Wightman. Pytorch image models.
https://githin. wttp://wgtooo//teeeeeeee
pytorch- monage-modele. 2019.
13

---

[59] Ross Wightman, Hugo Touvron, and Hervé Jégou. Resnet strikes back: An improved training procedure timm. arXiv preprint arX1v:2110.00476, 2021.
[60] Boxi Wu, Jinghui Chen, Deng Cai, Xiaofei He, and Quanquan Gu, Do wider neural networks really help adversarial robustness? In NeurIPS, 2021.
[61] Dongxian Wu, Shu-tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. In NeurlPS, 2020.
[62] Tete Xiao, Mannat Singh, Eric Mintun, Trevor Darrell, Piotr Dollár, and Ross Girshick. Early convolutions help transformers see better. In NeurIPS, 2021.
[63] Cihang Xie, Mingxing Tan, Boqing Gong, Alan Yuille, and Quoc Le. Smooth adversarial training. arXiv preprint arXiv:2006. 14536, 2020.
[64] Weihao Yu, Mi Luo, Pan Zhou, Chenyang Si, Yichen Zhou, Xinchao Wang, Jiashi Feng, and Shuicheng Yan. Metaformer is actually what you need for vision. In CVPR, 2022.
[65] Sangdoo Yun, Dongyoon Han, Seong Joon Oh, Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. Cutmix: Regularization strategy train strong classifiers with localizable features. In CVPR, 2019.
[66] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML, 2019.
[67] Hongyi Zhang, Moustapha Cisse. Yann Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. In ICLR, 2018.
[68] Zhun Zhong, Liang Zheng, Guoliang Kang, Shaozi Li, and Yi Yang. Random erasing data augmentation. In AAAI, 2020.
14

---

Contents of the Appendix
1. Appendix A Experimental details (training parameters, etc.).
2. Appendix B E.pperiments specifically related to ConvStem.
3. Appendix C ...,Cost, design-choice comparisons and testing more architectures.
4. Appendix D ... Ablations on training setup and image resolution experiments.
A Experimental Details
In the following we provide the details relative to the setup used for the various experiments. First, describe the general setup (App. A.1), then detail the variations for different settings, if they differ from the main regime.
A.1 General experimental setup
In all the experiments on ImageNet [15]. unless stated otherwise, we use training parameters similar to [44]. All models are trained with AdamW [35] optimizer with cosine decay scheduler for the learning rate (LR), weight decay of 5e-2 and momenta terms 31 and 82 set to 0.9 and 0.95 respectively. We employ a peak LR of 1e-3 (chosen to be in the same range as the values of the original ConvNeXt [34] and DeiT [51] works), slightly higher than [44]. When training for 50 or 100 epochs the peak LR attained epoch 10, when using 250 or 300 epochs at epoch 20. We also use label smoothing coefficient of 0.1 and exponential moving average (EMA) with decay rate 0.999, For the inner maximization adversarial training we use 2-step APGD [8] with an foo radius 4/255 and cross entropy as objective function.
Computational expense. All the training runs conducted NVIDIA A100s with 40GB memory. Around 20,000 hours of single-GPU run-time was expended during this work.
multi-GPU (8) setup using
ConvStem models clean training. All the models with ConvStem (barring the one in 'random init., basic augment." row in Table 1) were normally vorrsiivesariallly trained for 100 epochs with the non-ConvStem part of the model initialized with ImageNet- Ik pre-trained weights from timm. Heavy augmentations (App. A.2) were used for this pre-training. For 'medium' and 'large' category models in Table 2, we only did standard training for 50 epochs to save computational load given the network size, still achieving similar clean performance their non- non-Conv ConvStem counterparts initialized with weights from timm (see Table 10). The checkpoint with highest accuracy was then used as the starting point for adversarial training. The specific timm configuration for pre-trained weights for every model is available in Table 18.
Robustness evaluation. Unless stated otherwise, all robustness evaluations are done using complete standard AutoAttack [8, 9] (includes different attacks) on the complete ImageNet validation set (5k points) from RobustBench [6]. As is the common practice, we do the best (most robust) checkpoint selection in a post-hoe fashion using 1-step APGD on a separate validation set of 4k ImageNet-Ik lk images. Note that we validation set disjoint from the RobustBench ImageNet test set.
Calculation of model size. We compute the number FLOPs and parameters using the fvcore" library. In further sections, we again differentiate models as 'small' (< 30M parameters), 'medium' (As 50M params) and 'large' (> 80M params) depending on their parametric size.
A.2 Pre-training, augmentations and longer training
For the first three rows 'Training Scheme' column in Table we epoch adversarial training. For the specific cases of the "Training Scheme* column, we have the following settings (the list is incremental):
random init., basic augment. It has random initialized weights with RandomCrop as augmenta- tion.
15

---

strong clean pre-training, Adversarial training is initialized with ImageNet- 1k pre-trained weights from timm with RandomCrop as augmentation.
+
+ heavy augmentations. It uses the augmentations similar to [34], including CutMix [65], MixUp [67] with strength 0.8, Augmentt [12] with two layers, magnitude and a random probability 0.5. Label smoothing is set 0.1, Exponential Moving Average (EMA) with factor 0.999 and random erasing with probability 0.25. Unlike [34], we do not use any stochastic depth.
50 + 300 epochs. We adversarially train for 300 epochs instead of 50 and peak I.R is achieved at epoch 20.
The two Isotropic ConvNeXt models in Table 1 use the pre-trained weights from the original repository as these are not available on timm.
A.3 Scaling-up and comparison to SOTA models
For the results in Sec. 5, all our runs were initialized with ImageNet-Ik I pre-trained weights and use the heavy augmentations protocol from the previous section. Adversarial training was done with 2-step APGD for either for 50, 250 or 300 epochs (as listed in the 'Epochs' column in Table 2). For all 'ours' models in Table 2 in 'small' category the effective batch size was 1392, for 'medium' was 1024. In 'large' category, all ViT-B and CcX-NeXI-B models have an effective batch size of 864 and 756 respectively. Unlike for 'small' models, in 'medium' and 'large' category the checkpoint selection is done using 10-step APGDeE attack (first attack in AutoAttack), since 1-step APGD returns several checkpoints in very small numerical range of robustness values.
A.4 Increasing test-time resolution
When using image resolution other than 224x224, we keep the same pre-processing, only resolution changed. For final resolution NS (new size) and scale-ratio (SR) 0.875 (same during training). the images are resized with bicubic interpolation to NS/SR and then center crop to NS is done. Note that we do not fine-tune the models with higher resolution images.
A.5 Fine-tuning larger radius
Fine-tuning to larger radii (Sec. 6) uses our VIT-S + ConvStem, ConvNeXt-T + ConvStem and 50 epochs ConvNeXt-B ConvStem models from Table initialization. We employ the standard setting with heavy augmentations and adversarially train for 25 epochs at the l radius of 8/255 with peak LR of le-4 attained at epoch 5.
B Design Choices for ConvStem
In this section, we give detailed account of how ConvStem can be designed for different architectures and how it affects model size (FLOPs, parameters) and robustness. All the ConyStem configurations discussed below had the non-ConyStem part of the model initialized with pre-trained ImageNet- Ik weights and the ConvStem with random initialization. This setup was chosen to manage the computation load. Afterwards, for the best configurations selected, we clean trained the model with ConvStem before training them adversarially.
B.1 A closer look at the convolutional stem
We here investigate which elements of the convolutional stem most relevant for better robustness of ConvNeXt-Te to unseen threat models. Standard ConvNeXt has a 4x4 convolution in the initial stem (see Fig. 2, right column) that downsamples the input resolution by 4 with non-overlapping patches. This means any possible ConvStem design is limited to a maximum of two downsampling operations. Further, constrain the increase in parameters and FL.OPs limit configurations in Table 7, where we also report the corresponding results. We start off with the standard PatchStem from [34] (Cony44, L), with L indicating LayerNorm and G GELU layer. In 7A., 7.4 L, G), we increase the kernel size from PatchStem which results in mixing of feature maps,
choices the
https: h //gi thub. ccwm///cccbookreeeerr////orvaeee
16

---

Table 7: ConvStem design for ConvNeXt. We progressively modify the stem of ConvNeXt and track its effect on the robustness in seen and unseen threat models. The stem design is represented by the sequence of convolutional layers (ConvAy, i.e. kernel size x and stride y), LayerNorm (I.), and GELU (G).
FLOPs
Adversarial Tr. w.r.t.
Loo
Stem design
(G)
clean
too
E2
&1
Cony L [34]
4.49
71.0
46.5
38.1
14.9
Cony I.,
4.50
69.8
46.6
38.4
17.6
Conv L. G, Conv L, G
4.63
67.5
43.6
37.9
15.7
Conv?.2 L. G, Conv L, G
4.66
69.6
47.6
38.8
18.7
Cony L, G, Co L, G
4.62
70.2
47.4
44.2
21.2
Conv L, G, Conv"2 L, G
4.59
69.5
46.2
47.8
27.7
but this change does not yield any dividends in any of the metrics. Now we add another layer in our convolution stem. From (Conv??, L.G Conv L, G) we keep the kernel size in the first layer 7 and vary the stride in second layer depending on the amount of downsampling required to match the standard ConvNeXt. For all these settings we do not see any improvement in &g and l robustness but there are some gains in Lo robustness. This increase in fo can be attributed to an increase in FLOPs. However, when trained with good clean trained models initialization, all these setting have a very similar f-3 robustness. As next step, we reduce the kernel size in the first layer to 5 in configuration (Convš.2, I.GG Conv32, L.G), which leads to gains across all metries, and reducing the kernel size to 3 yields further improvements in unseen threat models (&2 and & Since these last two configurations look very promising, we trained clean models with such architectures of clean performance and used them as initialization for adversarial training: we observed negligible difference across all metrics. Given (Conv L.G Con L.G) has lower FLOPs of the two we select this configuration as main design for ConvStem. From Table 14, this configuration only leads 2.9% and 0.1% % increase in FLOPs and parameters respectively.
similar level
Additionally, for Con-NeXt-B we use the same stem as ConyNeXt-T and it slightly improved f2 and l robustness without improving for robustness. We also found that adding extra layer to this stem improved the & and & numbers (see Table 8) with a negligible increase in FLOPs and parameters. As this is a large model, an ablation similar to the one for -on was feasible. In the end, we use C2 (from Table 8) as ConyStem for our ConvNeXt-B models. From Table 14, this ConvStem increases the FLOPs by around 4% and the parameters by only 0.2%.
B.2 VIT ConvStem
We here study various designs of ConvStem on ViT-S (to keep the computational load low). We recall that for VIT the standard PatchStem generates 16x16 patches, which means we have higher degree of freedom as to how the ConvStem can be designed compared to ConvNeXt (while keeping the increase in FLOPs from the standard model minimal).
In Table 9, we start off with the ConvStem as proposed by [62]: this configuration (C,) results in a 8. %% increase in FLOPs but the improvement in all metrics tested is quite significant. Now we limit the increase in FLOPs to this value and try several other configurations within this limit. Two
Table 8: ConyStem configurations for ConvNeXi-B, Each layer in configuration column is followed by LayerNorm and GELU activation. * indicates layers with stride 2 (one downsampling operation), and N (= 64) is the number of output channels of the convolution layer. The inerease/decrease in numbers from the PatchStem are shown in green/red respectively.
Adversarial Tr. w.r.t. toc
Stem design
clean
Eoo
l
E1
Pi: PatchStem
75.6
54.3
48.5
23.7
C; 2N*
75.2 -0.4
54.2
-0.1
48.9
+0.4
24.0 +0.3
C2: N*-1.5N--2N
75.3 -0.4 54.4
+0.1
50.1
+1.6 24.7 +1.0
17

---

Table 9: VIT-S ConvStem ablation. N, 2N, 4N 8N are the number of output channels in each convolution layer, where N=48, similar to that of [62]. Each layer is followed by LayerNorm and GELU activation. *; kernel-size and stride (one donwsampling in the layer), *#; kernel-size and stride 4 (double donwsampling in the layer).
FLOPs
Adversarial Training
Stem design
(G)
clean
8z
8
Pr: PatchStem
4.61
65.1
39.2
37.4
16.5
C:: N#-2N9-4N9-81
4.99
68.0
43.3
46.3
27.0
C2: N*-N*-N--8N"
4.71
64.8
41.1
45.3
28.3
C2: -8
4.78
64.5
40.3
46.2
32.3
C:
4.84
64.7
40.4
46.4
32.6
C₁: N*8-2N=$_4N-88
4.81
64.6
39.3
45.8
33.2
ways to change the configuration are most trivially feasible here: 1) reducing the number of output channels in each convolution layer and 2) changing the level of downsampling done in each layer. As the combination of these two changes most readily leads the change FLOPs, we only apply these two kind of changes in our ablation study. Starting from Cj we first reduce the number of output channels in each layer, since the input to the transformer block is 8N (the last layer's output channels cannot be changed). Both C2 and C3 lead to significant reduction in fo numbers, hence we shift towards changing the amount downsampling each layer. Moving more downsampling to earlier layers further reduces & robustness compared to Cj. This small ablation leads us to fix the ConvStem for VIT-S to configuration Cj. From Table 14, the increase in FLOPs only 8. and parameters increase by 3.3%.
We use the same ConvStem as VIT-S with final layers output channels scaled 16N to meet the input channel for transformer block in ViT-B. This only increases the FLOPs by 2% and parameters by a mere 0.6%. Similarly for our ViT-M, we again use the same ConyStem as VIT-S with last layer's output size set to 512.
Improvements in robustness with ConvStem. Our experiments throughout the paper, validate that minimal change in the network architectures, adding the ConvStem provides consistent improvements in robustness of the adversarially trained models. Fig. summarises this and shows how across network types the classifiers with ConyStem achieve better robustness in both seen (Exo) and unseen (fz) threat models.
t. robustness
f robustness
55
+0.1
+2.3
+2.6
Robust accuracy (%)
+1.9
+100
+9.8
+9.7
45
+4.88
40
35
30
VIT-S ConvNeXt-T
VIT-B ConvNeXt-B VIT-S ConvNeXt-T VIT-B ConvNeXt-8
W/o ConvStem
With ConvStem
Figure ConyStem yields consistent improvements across architectures, model sizes in seen and unseen robust accuracy. We show for 50 epochs of AT with pre-training and heavy augmentation, that adding ConvStem yields for VIT and ConvNeXt robustness improvements both seen Exx (left subplot) and the unseen & (right subplot) threat models.
18

---

Table 10: Clean accuracy of standard trained ConvStem models. For all the main models in this work, we show their clean performance on RobustBench 5k validation set. The difference to non-ConvStem models with timm initialization is shown in red.
Architecture
Epochs
Clean
ConvNeXt-T ConvStem
100
80.9
-0.5
Isotropic ConvNeXt + ConvStem
100
79.2
-0.5
VIT-S ConvStem
100
79.3
-1.0
VIT-M ConvStem
50
81.8
-0.6
ConvNeXt-S ConvStem
50
81,6
-1.0
VTT-B + ConvStem
50
81.6
-1.1
ConvNeXt-B ConvStem
50
82.6
-0.8
B.3 Clean performance of ConyStem models
Our ConvStem models from Sec. 4 onward always standard classifier initialization for adversarial training. This clean training was done either for 50 or 100 epochs depending on the size of the model, see Table 10. The non-ConvStem part of the model [ConvNeXt stages and all transformer blocks) were initialized with timm ImageNet-1 Ik pre-trained weights and the ConvStem was randomly initialized. In Table 10, we show that for all models were able reach within I 1% of clean performance of standard models on the RobustBench validation set. Certainly, initialization of non-Conv ConvStem part helps in this fast and efficient learning. The good clean accuracy via short training also corroborates the improved training hypothesis of [62] when using ConvStem instead of PatchStem without much hyperparameter tuning.
Table 11: Comparison to [14] with respect to training time. Both our ConvNeXt and the ConvNeXt ConvStem attain higher robustness in the lx threat model than the ConvNeXt of [14] while using less forward/backward passes per image (see discussion at the beginning of Sec. 5).
Model
Epochs
Attack Steps
Passes/Image
8:0
Con
220
44.4
ConvNeXt-T
50
150
46.5
ConvNeXt-T + ConvStem
50
100
46.4
ConvNeXi-T ConvStem
150
47.5
ConvNeXt-TT T ConvStem
300
900
49.5
ConvNeXt-T ConvStem
300
1200
50.2
C Design choices, cost/size comparisons and new architectures
In this section, we answer (i) How the total training cost of our training regime compares to existing works (ii) What is the effect of using different optimizer for adversarial training (iii) Do the improve- ments as seen by adding ConyStem hold for the most recent architectures (iv) How does the model size change on adding ConvStem.
C.1 Training cost comparison
Table ll shows the robustness in the seen foo threat model of ConvNeXI-T model trained with strong clean pre-trained initialization and heavy augmentations when varying training cost. In particular, the training scheme cost is approximated by the number of passes of the network for each training image (counting the number of forward+backward passes per image combines the number of attack steps with training epochs used). First, we show that our ConvNeXt-T with 150 passes/images attains 2.1 1% higher robustness (46.1 1%% vs 44.4%) than the same model trained with 220 passes/image by [14]. Moreover, adding the ConvStem achieves a similar result with only 100 passes/image (third row), and 57.5% robust accuracy with 150 passes/image (fourth row). Finally, increasing the number of epochs and training steps, which incurs in more expensive training, can further improve robustness.
19

---

Table 12: PGD APGD. Comparing the difference in robustness on using PGD instead of APGD (used in this work) trained for 2 steps each on a Co--NeXt-T. We evaluate clean performance and robustness.
Table 13: Effect of replacing ConvStem with PatchStem InternImage. We train the Intern- Image (original with ConvStem) and Internlmage with PatchStem (PS) for 50 epochs in our heavy aug- mentation setup.
Optimizer
clean
800
82
Architecture
clean
800
8g
81
PGD
72.8
45,4
39.1
16.5
Intemlmage-T
72.9
47.0
48.5
25.9
APGD
71.0
46.5
38.1
14.9
Internlmage-1 PS
72.7
47.0
47.2
24.5
C.2 APGD vs. PGD training
The optimizer for adversarial training is also design choice to be considered while training robust models. Prior works [14, 46] mostly either PGD [36] APGD [8]. We use APGD since it has been shown to generally outperform PGD and does not need parameter tuning when changing radius attack steps [8]. Additionally, in Table 12 train ConvNeXt-T with 2-step PGD (clean pre-training, heavy augmentations, 50 epochs), comparable to the classifier using 2-step APGD from Tables 1 and 2. In this regime APGD yields higher robustness in the seen (foo) threat model which is our main goal, although with a small loss in clean accuracy.
C.3 Testing more architectures
We further test the effect of different stem designs on Internlmage [57], a modern architecture that uses deformable convolutions and has ConvStem its stem. In Table 13, we replace the ConvStem with PatchStem and evaluate robustness for the seen (fxz) and unseen (f2, {1) threat models. The structure of the PatchStem (PS) is the same for ConvNeXt. For the PS model, initialize the PS randomly and do clean pre-training for 50 epochs to reach 82.8% clean accuracy (the original InternImage with ConvStem has 83.5%). Similar to ViT and ConvNeXt, we that robustness for the unseen threat models goes down when replacing the ConvStem with the PatchStem. The models were adversarially (2-step APGD) trained for 50 epochs with ImageNet- 1k clean trained model' as initialization and with the heavy augmentation regime, while other parameter setting were kept same as heavy augmentations in App. A.2.
Table 14: FLOP and parameter count. Here list the FLOPS (Giga), Parameters (Millions) of all the main models and their ConvStem versions. The percentage increase in values on adding ConyStem shown in red.
Architecture
FLOPs (G)
Params (M)
ConvNext-T
4.47
28.59
+ Conv
4.60
+2.9%
28.63
+0.1%
Isotropic ConvNeXi-S
4.29
22.31
+ ConvStem
4.67
+8.8%
23.04
+3.3%
ViT-S-16
4.61
22.05
+ ConvStem
4.99
+8.1 +8.1%
22.78
+3.3%
VIT-M-16
8.01
38.85
+ ConvStem
8.38
+4.7%
39,5
+ +1.7%
ConvNeXi-S
8.70
50.10
ConvStem
8.79
+1.7%
50.33
+0.5%
VIT-B-16
17.58
86.57
+ ConvStem
17.93
+2.0%
87.14
+0.6%
ConvNeXt-B
15.38
88.59
+ ConvStem
15.97
+3.8%
88.75
+0.2%
'https://gi http:///hhttt.oooo////////////at
20

---

Table 15: Effect of using 21k-pre-trained models. Across the two best models discovered we see that there is no improvement in the main seen threat on initializing with ImageNet-211 pretrained weights from timm. The increase/decrease from ImageNet- 1 counterparts of the same models are shown in green/red colors respectively.
Architecture
Epochs
clean
ConvNeXi-T
+0.6
46.7
+0.2
ViT-B-16
50
73.5
40.2
49.6
-0.4
ConvNeXt-T
300
72.2
+0.2
48.3
-0.3
C.4 Increase in paramaters/FL.PP
In Table 14, we list the number of parameters and FLOPs of all models, with the percentage increase on adding the ConvStem shown red: for all models adding ConvStem results marginal amount of extra parameters. For FLOPs, smaller ViTs have bigger increase as compared to ConvNeXt. This can be attributed to the bigger size of ConvStem we use for ViT as we need to downsample before the first transformer block more severely than for ConvNeXt.
D More on Robust ImageNet Models
As the main aim of our work is to study and improve robustness of models trained for ImageNet to seen and unseen threat models, this section we consider ablations (effect of clean pre-traininig. data augmentations, deight-decay and label smoothing) related to this. Moreover, provide more details about using robust ImageNet for fine-tuning to other datasets.
D.1
Using even better pre-training
The most robust models in work ImageNet- 1 pre-trained weights of the respective architec- tures from timm. A natural hypothesis is that better pre-trained model, namely an ImageNet-22 21 pre-trained model fine-tuned on ImageNet-1k, might lead to higher robustness. timm makes available for architectures considered in this work (ViT, ConvNeXt) 21k-pretrained, -k-fine-tuned weights as well. In Table 15, we see the effect of using 2 2-rettrradde weights as initialization for adversarial training. The increase and decrease in clean accuracy and foo robust accuracy as compared to the 1k- Kk-pr-ttrained initialization of the same models is shown green and red respectively.
The ConvNeXt-T trained for 50 epochs shows a small increase in loe, while the one trained for 300 epochs gets slightly lower robustness. For VIT-B with 50 epochs robust accuracy although clean accuracy goes up by 0.2% (which intuitively correct as adversarial training starts from better point with lik-pre-trained weights). Overall did not any sign of gains in robustness when using a model pre-trained on larger dataset. This finding is line with what [38] witnessed when using ImageNet- Ik and 21k initialization while training robust models for CIFAR-10.
drop of 0.4% in
Table 16: Ablation for data augmentations. We show how varying levels of data augmentations influences robustness across all threat models in our training paradigm. The best performing augmen- tation setup for each model per perturbation is in bold. All models are trained for 50 epochs. Results for basic and heavy augmentation are taken from Table. 1.
VIT-S ConvStem
ConvNeXt-T ConvStem
Augmentation
clean
E
E
clean
Ex
basic
71.2
44.3
47.1
23.2
69.1
42.2
42.4
19.7
3-Aug [14]
70.1
43.6
46.1
23.4
71.2
45.3
45.6
19.6
heavy
69.9
44.0
47.1
25.9
69.1
47.5
47.8
24.6
21

---

D.2 Ablating data augmentation components.
A complete ablation study of which augmentations are useful for adversarial training on ImageNet is beyond the scope of this paper. The results of Table suggest that heavy augmentations works better than the basic augmentation (random crop). In this section we test additionally the intermediate augmentation suggested in [14] called 3-aug (basic + radom horizontal flip color-jitter), in particular we are interested in the performance of the ConvStem models and the generalization beyond the e model used for training. Table 16 we show for two models, ViT-S + ConvStem and ConvNeXt-T ConvStem, each trained for 50 epochs the results of basic, 3-Aug [14] and heavy augmentation. Note, that the clean pre-trained model was trained with the heavy augmentations protocol. We can see that using heavy augmentation yields the best robustness across all threat models for the ConwNeXt-T+ConSSeen (+2.2% in robrussssssss)) while having slightly worse clean accuracy (-1.1%). For the ViT-S+ConvStem the results are mixed, basic augmentation performs best, heavy augmentation second and 3-Aug the worst of all three. However, the gap between basic and heavy augmentation is marginal and thus we stick to heavy augmentation throughout the paper. an interesting open question if there exist intermediate or completely different augmentation schemes which would yield improved robustness for ImageNet. A more detailed analysis for the effects of data augmentation on adversarial robustness for small resolution datasets like CIFAR-10 or SVHN can be found in [31].
D.3 Effect of weight decay and label smoothing on adversarial robustness
For our training scheme which already yields strong results (50 epochs of adversarial training with strong pre-training and strong augmentation), we test the effect of varying the weight decay and label smoothing parameters. We check on logarithmic scale other weight decay values than our default value 0.05. In Table 17, we see that for both ViT and ConvNeXt neither smaller nor larger weight decay yields any improvement. Moreover, we observe that the label smoothing parameter has, compared to weight decay, less influence on the final robustness. For the ViT we get small improvement of 0.2% when using label smoothing coefficient 0.2 compared to our default value of 0.1, while for the ConvNeXt the results get 0.2% worse for label smoothing coefficient 0.2. Then, we decided to keep a label smoothing coefficient of 0.1. Finally, we note that a weight decay of 0.05 and label smoothing 0.1 are the values used for clean training of the ConvNeXt in [34].
D.4 Clean and robust accuracy trade-off
Fig. 5 shows the clean vs robust accuracy trade-off for ImageNet models. In the 'small' size category, our models, i.e. ViT-S-ConyStem (black circle) and ConyNeXt-TTConvSSee (red circle), have the best clean accuracy except for XCIT-S of [14], which however has more than 7% worse robust accuracy. In 'medium' size category our models were only trained for 50 epochs (see Table 2) but outperform all SOTA models in terms of robust accuracy. On top of that, our ConvNeXt-S-ConvStee has both the best clean and robust accuracy in this size range. For 'large' sized models only the ViT-B of [44] in comparable range. Their model has around 0.6% higher clean accuracy than our ConvNeXt-B ConvStem but 2.6% lower robust accuracy. In general, our models mostly show a better clean vs robust accuracy trade-off as compared to existing models in literature.
Table 17: Effect of weight decay and label smoothing coefficient. Varying the weight decay and label smoothing coefficient around our default values (marked below with a *), which are the ones suggested for clean training in [34], does not lead to a consistent improvement in foo robustness.
Weight decay
Label smoothing
Architecture
0.5
0.05*
0.005
0.0
0.1*
0.2
VIT-S + ConvStem
37.2
44.0
44.0
44.0
44.0
44.2
ConyNeXt-T ConvStem
27.5
47.5
47.2
47.4
47.5
47.3
22

---

B-NNNe
VIT-B-CVSI
Con
ConwNext-T-CVSt
VIT-B
Robust accuracy (%)
RobArch-L
ViT-M-CvSt
ConvNext-T
XotT-L
RobArch-S
XCiT-S
WRN-50-2
VIT-S
GFLOPs
ConvNeXt (ours)
ResNet-50
ViT (ours)
8 12
16+
SOTA models
65
67
71
73
Clean accuracy (%)
Figure 5: AutoAttack too -Robust accuracy (e 4/255) vs Clean accuracy on ImageNet across
different architectures. All our models are better than their SOTA counterparts in robust accuracy with only negligible difference in clean accuracy, if at all. ConvStem is written as CvSt.
D.5 Increased image resolution
We further discuss the effect of varying the test-time resolution for foo robust models. All evaluations the following are done with APGDY-DLR (40 iteration, 3 target classes) on 1000 test points limit computational cost, as increasing resolution significantly impacts the number of FLOPs.
Larger models. Similar 'small' models, 'large' models trained for 50 epochs also show improve- ments both clean accuracy and fo robustness, see Fig. 6. This phenomenon is seen for both VIT and ConvNeXt with and without ConvStem, with peak robustness at resolution 256x256 for all classifiers.
l2 radius scales with resolution. Since foo bounds applied element- increasing the resolu- tion, i.e. input dimension, does not change how much each input component can be modified. Thus one argue that for fixed radius, the l -threat model is for increasing resolutiinn/dimension at least as strong as the original one. In fact, as each dimension can be manipulated independently can argue that increasing dimension makes the Loc -threat model more powerful. However, with bound (2 w.r.t. & and input dimension d, the average element- wise perturbation is c2/ Vd. If one keeps the 62 constant for increasing dimension, seems clear that the threat model becomes weaker.
clean accuracy
L- robustness
77
56
76
54
75
74
52
73
72
VIT-B
ConvNeXt-B
VIT-B + ConvStem
ConvNeXt-B ConvStem
352
input resolution
input resolution
Figure 6: (Robust) accuracy improves with increasing test-time image resolution. Evaluation of clean (left) and l-x- -obust accuracy (right) for the 50 epoch 'large' models from Table when varying the input resolution at test-time.
23

---

clean accuracy
12 robustness
75
50
70
45
2.00
2.29
2.86
65
35
60
ConvNeXt-T
ConvNeXI-T + ConvStem
55
Isotropic CN-T
25
Isotropic CN-T ConvStem
50
VIT-$
VIT-S ConvStem
15
45
192
320 352
224
256
input resolution
input resolution
Figure 7: (2-(robust) accuracy for varying test-time image resolution. Evaluation of clean (left) and 12-robust accuracy (right) for the top models from Table when varying the input resolution test-time. The radius 62 2 for image resolution 224 and rescaled E2 222 for varying d (this means that the perturbation budget per pixel is constant), and can be read the figure on the right.
In order to keep the perturbation budget per dimension constant we thus increase as function of vd. Note however that when increasing 62 the maximal perturbation per pixel or the number of pixels which can maximally perturbed grows as well. Thus one can argue that the threat model becomes stronger when scaling with v when increasing d. summary, we see that the comparison across image resolutions for & (and similarly for &1) is non-trivial. We decided to consider the scenario where the ft-teatt model is at least not becoming less powerful with increasing dimension and thus increase 62 with vd. The resulting f2-robust accuracies for varying resolution can be found in Fig. 7, where we see that the ConvStem- models very stable in robust accuracy even for much higher resolution.
D.6 Fine-tuning other datasets
We study whether it is possible to transfer adversarial robustness from ImageNet to other datasets via fine-tuning our robust models. We consider datasets with images of resolution either similar to ImageNet, i.e. Flowers- 102 [39], or smaller like CIFAR-10 and CIFAR-100 [29], and fine-tune Erne 8/255 robust models from Table 4. We fine-tune with steps (Flowers- (otwers-10))) or steps (CIFAR-10. 10, CIFAR- 100) adversarial training at 8/255 on all target datasets, with RandAug as augmentation, for 20 epochs, as in [14], with learning rate (LR) warm-up 102 we set peak LR to 4c-3, weight decay of 5e-3 and batch size 30, for CIFAR-100 peak LR 2e-4, weight decay and batch size 1024, for CIFAR- 100 peak LR 2e-4, weight decay 5e-3 and batch size 256. To adapt the networks to the new datasets, we replace the final linear classifier with one suitable for the new number of classes, and for smaller resolution inputs, we change from ConvNeXt ConyStem the strides from first downsampling block Xon. The robust accuracy is computed on the full test sets with AutoAttack in the resolution of the dataset which finetune, e.g. 32 32 for CIFAR-10/100
epochs: for Flowers-
in the convolutional layers of the stem and in the
Table 18: Specitic configurations of pre-trained models we use from timm. As models have a lot of pre-trained weights available on timm, we explicitly list the configuration (also includes pre-trained weight path) of the specific architectures.
Architecture
Configuration
ConvNeXt-T
convnext_tiny.ft
ConvNeXt-S
convnext_small.
ConvNeXt-B
convnext_base.fb
VIT-S
heit_small.patchh6.
VIT-M
deit3
1att3_medium_patcchee 2224
VIT-B
vit_base_pateeeee wtt__asse_ptcchh_220 a2g.aggregg

---

D.7 More pre-training details
In this section we give some additional details related to our models. As we heavily rely on pre- training in our work, the origin of pre-trained models on timm are listed in Table 18. Most ViTs and Xts available timm have different versions (patch sizes, resolutions) and even pre-training (ImageNet-21K,, - 12k, -1k). Among those we use ViT' with patch size 16 trained at resolution of 224 on ImageNet-Il 1k only. Similarly, for ConvNeXt we use the ones trained only with ImageNet- and resolution 224. For ViT-M, we use pre-trained weights of DeïT-3 model from [51], because ViT-M was not available in our desired configuration ImageNet- 1k only pre-training. Note that ViT and DeiTs have the same architecture and differ only in the training scheme. All the clean pre-trained models use heavy augmentations protocol except ViT-M (DeiT-3-M) which uses only augmentations. Finally, for Isotropic ConvNeXt-S we use the weights of convnext iso sooosmalll___m 1k 224_ ema from the original repository.
25


Reviews:
[{"review_id": "8csmDqY21n", "reviewer": "Reviewer_LmXJ", "summary": "This paper investigates the impact of architectures and training strategies on adversarial robustness in adversarial training. The substitution of PatchStem with ConvStem leads to an improvement in adversarial robustness, not only against l_inf attacks but also against previously unseen attacks like l_1 and l_2 attacks. Furthermore, the effects of strong pre-training and extensive data augmentation on adversarial robustness have been examined through ablation studies.", "questions": "It appears that ConvStem performs better on unseen attacks. However, it would be interesting to investigate its performance on black-box attacks as well. One relevant black-box attack is VMI-FGSM (Wang, Xiaosen, and Kun He. \"Enhancing the transferability of adversarial attacks through variance tuning.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2021). To support your opinion, it would be beneficial to compare the performance of the models listed in Table 2 on some black-box attacks. This analysis would provide a more comprehensive understanding of the models' robustness in the face of different attack scenarios.", "limitations": "NA", "rating": 5, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "This paper extends the discussion of adversarial robustness to larger datasets and models, which is significant for the application of deep models. The paper explores one of the most effective methods, adversarial training, from various aspects such as model architecture and training techniques, to improve the adversarial robustness of the models. It proposes replacing PatchStem with ConvStem in the model architecture, resulting in enhanced robustness against l_inf adversarial attacks as well as significant improvements in robustness against unseen attacks, such as l_1 and l_2 attacks. Additionally, the paper validates the positive impact of pre-training and data augmentation in adversarial training. The final results also achieve state-of-the-art performance. The paper is well-structured and easy to understand.", "weaknesses": "This paper has a relatively weak innovation aspect, and a significant portion of the experiments leans towards engineering-oriented approaches. Although the results are relatively good, the paper lacks in-depth analysis of the improvement brought about by ConvStem. The reasons behind the improved performance on unseen attacks are still unknown. To further support this claim, it is necessary to explore different attack settings, including black-box attacks.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the detailed comments. We are glad that they appreciated the relevance of our work as well as its experimental results. In the following we individually address the weaknesses pointed out in the review.\n\n&nbsp;\n\n**This paper has a relatively weak innovation aspect, and a significant portion of the experiments leans towards engineering-oriented approaches. Although the results are relatively good, the paper lacks in-depth analysis of the improvement brought about by ConvStem. The reasons behind the improved performance on unseen attacks are still unknown.**\n\nPlease refer to the [global response](https://openreview.net/forum?id=Pbpk9jUzAi&noteId=3fBEqU4pBW) above.\n\n&nbsp;\n\n**It appears that ConvStem performs better on unseen attacks. However, it would be interesting to investigate its performance on black-box attacks as well. One relevant black-box attack is VMI-FGSM (Wang, Xiaosen, and Kun He. \"Enhancing the transferability of adversarial attacks through variance tuning.\"... it would be beneficial to compare the performance of the models listed in Table 2 on some black-box attacks. This analysis would provide a more comprehensive understanding of the models' robustness in the face of different attack scenarios.**\n\nWe clarify that with unseen attacks we mean **threat models different from the one used during training**, in our case $\\ell_\\infty$-bounded perturbations (seen) vs $\\ell_2$- and $\\ell_1$-bounded ones (unseen). \n\nAmong the attacks of AutoAttack (AA) (APGD on CE/DLR loss, FAB attack, Square attack) which we use for evaluation, APGD on DLR loss, FAB and Square attack are also “unseen”, in the sense that they are different from the APGD on CE with 2 steps used for training, and even APGD in CE in AA uses 100 steps. However, they all use the same threat model, i.e. $\\ell_\\infty$-bounded perturbations.\n\nWe recall that Square Attack in AA is a **SOTA black-box score-based attack**. In our experiments, Square Attack never found a successful adversarial perturbation for a point where the white-box attacks failed (i.e. Square Attack does not reduce the robust accuracy any further). Transfer black box attacks such as the suggested VMI-FGSM are typically significantly weaker than white box attacks: as we are interested in the actual robustness and not the robustness against a specific attack, transfer attacks are highly unlikely to improve the robustness evaluation. However, we are happy to include such evaluation if the reviewer could clarify why this result would make our experiments more complete and which model we should use for the transfer attack."}, {"review_id": "ZMVhgJwoMM", "reviewer": "Reviewer_vpT1", "summary": "This work provides extensive experiments to study the influence of architecture and training schemes on the robustness of classifiers to seen and unseen attacks. The paper investigated SOTA model architectures and it variants, and derives a strategy to build better architecture and training scheme to improve model robustness. With the help of all the explored variations, a SOTA robustness on ImageNet is achieved with the newly proposed scheme.", "questions": "See weakness.", "limitations": "The limitation of this work is adequately discussed. No potential negative impact is observed.", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "This work makes interesting observation on the impacting factors of large-scale adversarial training with extensive experiments. The way the experiments are designed and conducted are solid, and can inspire future work along the direction of systematically understanding the influence of architecture and training scheme on robustness. The observed insights successfully leads to a better architecture and training scheme design that leads to SOTA robustness.", "weaknesses": "The main drawback of the work is the lack of theoretical analysis/insight on why some proposed techniques work. Without further insights this work is mainly an extensive ablation study within a design space of existing methods, but cannot infer on the performance for techniques beyond the scope of the emperical explorations. Given the high resource needed to exhaustively explore all architectural ingredients and training scheme design, some theortical insight derived from existing observation will be helpful to guide future exploration.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the supportive comments and the positive score. We are glad that the reviewer appreciated the relevance of our work and the SOTA results it achieves. In the following we address the weaknesses pointed out in the review.\n\n&nbsp;\n\n**The main drawback of the work is the lack of theoretical analysis/insight on why some proposed techniques work. Without further insights this work is mainly an extensive ablation study within a design space of existing methods, but cannot infer on the performance for techniques beyond the scope of the emperical explorations. Given the high resource needed to exhaustively explore all architectural ingredients and training scheme design, some theortical insight derived from existing observation will be helpful to guide future exploration.**\n\nPlease refer to the [global response](https://openreview.net/forum?id=Pbpk9jUzAi&noteId=3fBEqU4pBW) above.\n\n&nbsp;\n\nWe would be happy to discuss any additional points of interest for the reviewer.\n"}, {"review_id": "lG8oumrzNj", "reviewer": "Reviewer_zQGv", "summary": "This work studies adversarial training on large-scale datasets (i.e., ImageNet), which study the influence of architecture and training schemes on the robustness of classifiers based on different architectures. The paper lacks novelty, but the observations are insightful.\nI think this work is a valuable contribution to the research on adversarial training.", "questions": "1 In Table 2, the authors claim the proposed can improve by 5.8% for small, 7.2% for medium, and 2.8% for large models over SOTA.  How to compare and calculate to get this conclusion？ It is unclear.\n\n2  Since Heavy Data Augmentation contains different data augmentation strategies, How do different strategies affect the robustness of the model?", "limitations": "Adversarial training on large-scale datasets requires a lot of computing resources, It is not easy to reproduce the experimental results in the paper.\n", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1  The paper presents a good review of the architectures training strategy and data augmentation, and presents the impact of varying each of them on adversarial robustness and clean accuracy\n\n2 Based on experiments with different settings, the proposed method achieves the sota robustness.\n\n", "weaknesses": "1. The paper is less novel and more like an experimental analysis report.\n\n2. The other weakness of this paper is that most of the results shown in the paper are quantitative. Lack of some theoretical analysis.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the supportive comments and the positive score. We are glad that the reviewer appreciated insights provided by our work and its contributions to the field. In the following we address the weaknesses and questions pointed out in the review.\n\n&nbsp;\n\n**The paper is less novel and more like an experimental analysis report. The other weakness of this paper is that most of the results shown in the paper are quantitative. Lack of some theoretical analysis.**\n\nPlease refer to the [global response](https://openreview.net/forum?id=Pbpk9jUzAi&noteId=3fBEqU4pBW) above.\n\n&nbsp;\n\n**In Table 2, the authors claim the proposed can improve by 5.8% for small, 7.2% for medium, and 2.8% for large models over SOTA. How to compare and calculate to get this conclusion？It is unclear.**\n\nFor the small models, we compare the ConvNeXt-T of Debenedetti et al. [12] to our best ConvNeXt-T+ConvStem, with robust accuracy wrt $\\ell_\\infty$ 44.40% and 50.16% respectively, and similarly for medium models we compare the XCiT-M12 [12] to our ConvNeXt-S+ConvStem (45.24% vs 54.42%). For the large models, we do not consider the models from [28] since it is concurrent work (which our classifiers would anyway outperform, see Table 2), and compare the ViT-B from Rebuffi et al. [40] to our ConvNeXt-B+ConvStem (53.50% vs 56.28%). We will clarify this in the revision of the paper.\n\n&nbsp;\n\n**Since Heavy Data Augmentation contains different data augmentation strategies, How do different strategies affect the robustness of the model?**\n\nExploring which specific augmentation techniques are most helpful for adversarial training would open another large space of expensive (ImageNet-scale) experiments. So, we decided to consider various components of the heavy augmentations as a whole, and switch its components on and off simultaneously, for simplicity.\n\nFor a related analysis we conducted, we trained ViT-S + ConvStem with strong clean pre-training, 300 epochs of adversarial training and either basic (random crop and horizontal flip) augmentation or the augmentation scheme of Debenedetti et al. [12], named “3-Aug”, which can be seen as an intermediate step between our basic and heavy augmentations. In Table A1 below (and in the attached file), which includes our model from Table 1, we see that increasing the level of augmentations progressively improves both clean and robust accuracy, and the intermediate augmentation strength is suboptimal. In particular, we observed that lighter augmentation schemes, with the same training protocol used throughout all experiments, lead to overfitting. We will include this discussion in the revised version.\n\n&nbsp;\n\n**Table A1:** effect of different levels of augmentation for ViT-S + ConvStem.\n\n| Model     | Augmentation | clean | $\\ell_\\infty$ | $\\ell_2$ |$\\ell_1$ |\n|-----------|:----------:|-------|---------------|----------|---------|\n|ViT-S-CvSt |  basic   | 66.5  |      38.5     |   41.3   |   19.2  |\n|ViT-S-CvSt |  3-Aug   | 70.1  |      43.6     |   46.1   |   23.4  |\n|ViT-S-CvSt |  heavy   | 72.5  |      48.1     |   50.4   |   26.7  |\n\n&nbsp;\n\n**Adversarial training on large-scale datasets requires a lot of computing resources, It is not easy to reproduce the experimental results in the paper.**\n\nPlease note that we provided the training scripts in the supplementary material, and we have made the code and the checkpoints of our models already publicly available to foster research in this area."}, {"review_id": "3R9atA8HAI", "reviewer": "Reviewer_bR1u", "summary": "The paper has done to some extent comprehensive experimental results to show the effect of ConvStem on improving the robustness of Vit and ConvNeSt model architectures.  ", "questions": "Based on my understanding I still could not answer the questions below:\n1- Do ViT architectures are more appropriate for robust or convolutional models? \n2- ConvStem had a negative effect on the clean accuracy of ConvNeXT architecture based on Table 2. How can this be explained? \n3-  ", "limitations": "As mentioned by the authors some of the well-known architectures have been missed because of computational complexity and this limited the final conclusion from experimental results. ", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The experimental results are comprehensive for the proposed purpose. ", "weaknesses": "There are still some parts that need more clarification;\n1- I understand the paper took an experimental point of view to show the effectiveness of the module in improving robustness; however, it would be great to provide more intuition on how and what's the reason for this effect. \n2- I would expect a more comprehensive conclusion from the experiments and observations and the author's recommendations for practical applications. \n3- Authors mentioned there are \"a number of interesting future research directions\" but there is no explanation of what are those directions. \n4- ", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their comments and the positive score. We are glad that the reviewer appreciated our extensive experiments. In the following we address the concerns and questions raised in the review.\n\n&nbsp;\n\n**I understand the paper took an experimental point of view to show the effectiveness of the module in improving robustness; however, it would be great to provide more intuition on how and what's the reason for this effect.**\n\nPlease refer to the [global response](https://openreview.net/forum?id=Pbpk9jUzAi&noteId=3fBEqU4pBW) above.\n\n&nbsp;\n\n**I would expect a more comprehensive conclusion from the experiments and observations and the author's recommendations for practical applications.**\n\nWe tried to present the main observations and takeaways together with the corresponding experiments through the paper. We are happy to expand the comments on these points in the revised version. Regarding practical applications we might recommend using ConvNeXt if only $\\ell_\\infty$-robustness is required and ViT+ConvStem if generalization across threat models is the goal (please find in the replies below more discussion on these differences).\n\n&nbsp;\n\n**Authors mentioned there are \"a number of interesting future research directions\" but there is no explanation of what are those directions**\n\nOur observations about the impact of architecture components on adversarial robustness and its generalization might be the starting point for more fine-grained analysis and designing new architectures. Moreover, ImageNet classifiers are often used for transfer learning to other tasks, even outside image classification, e.g. in semantic segmentation or object detection one uses pre-trained ImageNet models as backbones for initialization. First results show that when using robust ImageNet models for initialization of the backbone one can train adversarially robust semantic segmentation models which are significantly more robust than previous work and this even at a lower computational cost.\n\n&nbsp;\n\n**Do ViT architectures are more appropriate for robust or convolutional models?**\n\nWhile it can be appealing to make strong statements about a single architecture being optimal for adversarial robustness, we think that the matter is more nuanced: from our experiments one observes that ConvNeXts can achieve consistently higher robustness in the $\\ell_\\infty$-threat model used for training, while ViTs show consistently much better generalization to unseen attacks. One main outcome of our work, besides deriving a training recipe which works across architectures, is to show this more nuanced behavior and how architecture components influence it. Note that it is one of our contributions to check the unseen $\\ell_1$ and $\\ell_2$-threat models, otherwise the better behavior of ViTs in this regard would have been overlooked.\n\n&nbsp;\n\n**ConvStem had a negative effect on the clean accuracy of ConvNeXT architecture based on Table 2. How can this be explained?**\n\nWe note that ConvStem leads to slightly (0.3%) lower clean accuracy only for the base model, while it gives an improvement for ConvNeXt-T. Moreover, it improves robustness in seen and unseen threat models, which is our main metric of interest (please note that if one wants to optimize for clean *and* robust accuracy one should anyway not do pure AT). A possible explanation of this is that the clean ConvNeXt-B+ConvStem used as initialization has 0.8% lower clean accuracy than the clean ConvNeXt-B from the timm library (see Table 9 in App. B.4), since we fine-tuned it for only 50 epochs compared to 300 epochs for the timm model. Thus, the model after the additional 50 epochs of adversarial training might still suffer from this worse initialization."}, {"review_id": "KwqfQ9pfG1", "reviewer": "Reviewer_qHdB", "summary": "This work investigates the effect of a set of architectural, training and inference techniques on adversarial training (AT) on ImageNet. AT has been less studied on ImageNet compared to CIFAR10 due to the much computational cost, but the behavior of AT on large-scale realistic dataset is undoubtedly an important topic, so I appreciate a lot the authors’ efforts on this direction. In my understanding, the key takeaway techniques suggested by the paper for improving robustness on ImageNet are ConvStem, pre-training followed by heavy data augmentation, training longer and increasing resolution at inference time. To me, the first and fourth points are novel, while the second and third points are somehow expected. My biggest concern is the lack of explanation behind these empirical observations like why ConvStem works and the generalization abilities of these tricks particularly across various architectures and AT methods. The analysis and explanation are particularly important because none of these techniques is invented in this work, i.e., they are originally proposed by the previous works. Please see the details below. I will be happy to raise my scores if the above concerns are clarified or addressed. ", "questions": "1. L43: The claim of SOTA adversarial robustness on ImageNet may not be right. [1] (arxiv version: 28 Feb 2023) reported a robustness of 56.8% for ConvNeXt-B, while the highest robustness for ConvNeXt-B+ConvStem reported in this work is 56.28%. On RobustBench,  you both submitted a result for ConvNeXt-L: 58.48% from [1] and 57.70% from yours with ConvStem. Therefore, 56.28%, even 57.3% with inference-time resolution technique, seems to be not the state-of-the-art robustness against AA on ImageNet. \n\n2. Table 1: how many runs are repeated for the reported result? If more than one, why not report the standard deviation? \n\n3. L107: why APGD-2, instead of more common attacker PGD-2? \n\n4. L239-240: Have your single-step AT suffered from catastrophic overfitting? If not, did you apply any mitigation technique? \n\n5. Table 2: some implementation details of several related works like “comprehensive” and “light” are missing, so that I can’t judge if the performance difference is caused by, e.g., ConvStem or something else. I will suggest the authors clearly discuss the technical difference between these training receipts and yours, e.g., organized in a table. \n\n6. Section 4.2: how do you decide the specific data augmentation as the component of heavy data augmentation? Besides, it will be interesting to test how a recent data augmentation, IDBH, specific for AT works on ImageNet compared with others. \n\n7. Section 6, test-time image resolution: have you tried to evaluate the robustness using larger epsilon? I guess the robustness improvement will disappear in the setting with larger potential adversarial vulnerability. \n\n8. Table 2: the results of ViT-M and ConvNeXt-S without ConvStem are missing. Are there any reasons for this?\n\n[1] A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinking, Arxiv \n\n[3] A Light Recipe to Train Robust Vision Transformers, SaTML. \n\n[2] Data augmentation alone can improve adversarial training, ICLR 2023. ", "limitations": "The authors discussed the limitation as “not covering more architectures and architectural components”. There are still some limitations about the generalizability of ConvStem across the architectures and the AT methods as listed in Weakness. ", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 3, "strengths": "1. Adversarial training on ImageNet is less studied and indeed an important direction for moving forward for the community \n\n2. Identifying a good receipt of AT on ImageNet can have a great potential impact on the future works, e.g., adopted as a standard training setting for benchmarking various AT methods. \n\n3. Robustness improvement of ConvStem on some architectures is significant \n\n4. The influence of test-time image resolution is interesting. ", "weaknesses": "1. ConvStem seems to only work well with Isotropic architectures but work less well or even not work with ConvNeXt regarding the robustness evaluated against the same threat model as training’s, i.e., L inf. For example, it improves robustness by 0.5% on ConvNeXt-T with basic training setting (Table 1) and by 0.04% on ConvNeXt-B (Table 2). There is almost no improvement on ConvNeXt-B. Even worse, the accuracy seems to be sacrificed for improved robustness on ConvNeXt-B and in some settings of ConvNeXt-T like “+ heavy augmentation”. Therefore, I doubt the generalizability of ConvStem across the different architectures. It will be interesting to test if ConvStem can benefit robustness for other non-isotropic CNN-based architectures such as InternImage [1] which also uses ConvStem. \n\n2. I find almost no analysis about why ConvStem works well on Isotropic architectures and less well on others, why pre-training enables the use of heavy data augmentation, and why training longer works in this context but not in [2]. This is important for us to understand the accounts for the performance boost and to judge the generalization ability of the method, especially when the suggested techniques are originally proposed in the previous works.  \n\n3. A major benefit of ConvStem is the robustness towards the unseen threat models like L1 and L2. However, the discussion of and the comparison with the related works developed for this purpose (trained on L inf to defend L1 and L2) are missing, so it is hard for me to judge how significant the reported improvement is and if the improvement still holds when combined with other techniques. \n\n4. It is also unclear whether ConvStem can improve the SOTA AT methods like how it works with the baseline AT, or if not, whether ConvStem+baseline AT can beat the SOTA AT methods. All tested AT methods are APGD AT with only different steps: 1, 2, 3. \n\n[1] InternImage: Exploring Large-Scale Vision Foundation Models With Deformable Convolutions, CVPR 2023 \n\n[2] When Adversarial Training Meets Vision Transformers: Recipes from Training to Architecture, NeurIPS 2022 ", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the detailed comments, and for their positive comments. Next we concisely, due to limited space, address the weaknesses pointed out in the review.\n\n**ConvStem seems to only work well with Isotropic…**\n\nWe remark that for the best setup (“50->300 ep.”) in Table 1 the ConvStem provides significant improvements in $\\ell_\\infty$ robustness (+0.9%) also for the ConvNeXt, even with slightly better clean performance (+0.3%). For the base (B) models, the marginal improvement of 0.04% given by the ConvStem is for models trained for only 50 epochs. While for limited resources we could not train a ConvNeXt-B for 250 epochs (it takes ~12 days on 8 A100s), we note that our ConvNeXt-B+ConvStem models (with 2 or 3 attack steps) trained for 250 epochs outperform the ConvNeXt-B of [28] trained for 300 epochs with 3 attack steps by 0.3-0.4%: this suggests the positive impact of the ConvStem even on the large non-isotropic architectures.  \nFor a discussion about clean accuracy, please see the [reply to Reviewer bR1u](https://openreview.net/forum?id=Pbpk9jUzAi&noteId=roPu0dNG36).  \nSince InternImage [1] already uses ConvStem, it is not clear to us how to show the effectiveness of ConvStem on it. Do you suggest replacing it with a PatchStem? \n\n**ConvStem more effective on Isotropic architectures**\n\nPlease see the [global response](https://openreview.net/forum?id=Pbpk9jUzAi&noteId=3fBEqU4pBW).\n\n\n**Why pre-training enables heavy data augmentation**\n\nAdversarial training is a more challenging learning problem than clean training. Using heavy augmentations with a random initialization can make the model diverge (see Sec. 4.2 and [12]). When starting with the pre-trained model as initialization the robust loss is initially significantly smaller than for a random initialization and decreases also faster. \n\n**Why training longer works in this context but not in [2]**\n\nMo et al. [2] experiment only with CIFAR-10 and Imagenette, i.e. smaller datasets than full ImageNet, where overfitting is a significant issue. For ImageNet this is a milder issue, although we observe that long training (300 ep.) without sufficiently heavy augmentations also leads to overfitting for ViT-S+ConvStem (see Table A1 above).\n\n**Related works about training on Linf to defend L1 and L2**\n\nWe are not sure which works the reviewer refers to, but would be happy to discuss them if pointed to them. Tracking the robustness to unseen attacks is not standard, and we are not aware of techniques with the goal of training wrt $\\ell_\\infty$ to obtain robustness in $\\ell_2$ and $\\ell_1$. \n\n**Can ConvStem improve the SOTA AT?**\n\nWe are not sure what the reviewer refers to as SOTA AT methods, but we compare our models with all existing SOTA classifiers, and improve upon them.\n\n**Claim of SOTA robustness**\n\nThe 56.8% in Liu et al. [1] (ref. [28] in our paper) is computed on a different set of points as our results. All results in Table 2 use the subset of 5k validation points defined by RobustBench for a fair comparison. In this setup, the ConvNeXt-B of [1] attains 55.82% robust accuracy, which is 0.46% lower than our ConvNeXt-B+ConvStem (Table 2 has both models): as mentioned at L274-275, our model achieves this result even with a 20% shorter training time.  \nFor the ConvNeXt-L, we train ours for only 100 epochs and 2 attack steps, while [1] uses 300 epochs and 3 steps. Given the beneficial effect of longer training, especially for larger models, the two results are not directly comparable. Please note that with our computational resources (8xA100 GPUs), 100 epochs of ConvNeXt-L+ConvStem took 12 days to complete, which made scaling it up at least 3 times infeasible.\n\n**How many runs are repeated?**\n\nA single run due to the high computational cost.\n\n**APGD-2 instead of PGD-2**\n\nWe use APGD since it has been shown to generally outperform PGD and does not need parameter tuning when changing radius or attack steps [8]. Additionally, we train a ConvNeXt-T with PGD-2 (clean pre-training, heavy augm., 50 ep.), comparable to the classifier using APGD-2 from Table 1. In this regime APGD-2 yields higher robustness, which is our main goal, although with a small loss in clean accuracy (Table A2 in the attached file).\n\n**Catastrophic overfitting?**\n\nSimilar to the observations of [Andriushchenko & Flammarion, [2020]](https://arxiv.org/abs/2007.02617) for small (2/255, 4/255) radii on ImageNet, we did not experience catastrophic overfitting in any setup, including single step training, even without any mitigation technique.\n\n**Experimental details of other papers**\n\nTable 2 includes the main parameters (epochs, attack steps), and additional details can be found in the original papers. Please note that we mostly follow the training setup of Liu et al. [30] (which is similar for other works too), without adjusting it to our classifiers. We will add a summary table with the parameters from each paper.\n\n**Choice of heavy augmentations, testing IDBH**\n\nThe heavy data augmentation simply follows the setup used in Liu et al. [30], which is common, with little variations, to other works e.g. [29, 40]. IDBH has not been tested on ImageNet but only smaller datasets, and extending it is out of the scope of our work.\n\n**Test-time resolution at larger radii**\n\nTable A3 (attached file) reports robust accuracy varying perturbation radii and image resolutions: even at the larger 6/255 and 8/255 higher test-time resolution (288 and 256 respectively, 224 is used for training) improves robustness. However, as anticipated by the reviewer, we see a diminishing advantage from increasing resolution for larger radii.\n\n**Medium models without ConvStem**\n\nWe prioritized the model sizes with most competitors. Table A4 (attached file) now illustrates that the ConvStem provides improvements in almost all metrics for medium models too, in particular for the $\\ell_\\infty$-robustness of ViT-M (+1.6%), and the robustness to $\\ell_2$ (+7.1%) and $\\ell_1$ (+6.1%) for ConvNeXt-S."}]

Author rebuttal:
### General comment

We thank all reviewers for their feedback. We appreciate that all reviewers think that our findings are important and highlight our extensive experiments. We address here the main points shared by multiple reviewers, and reply in detail to specific questions individually below. We look forward to hearing whether the reviewers’ concerns are resolved or they have additional questions.

&nbsp;

### Response to common questions

**Lack of theoretical analysis**

Theoretical analyses of both new architectures and ingredients of adversarial training are very rare in the literature, and empirical findings are those driving the advancements in these areas. In fact, the works, e.g. [Dosovitskiy et al. [2019]](https://arxiv.org/abs/2010.11929), [Liu et al. [2021]](https://arxiv.org/abs/2103.14030), [Liu et al., [2022]](https://arxiv.org/abs/2201.03545), introducing modern architectures do not motivate or study their design with theoretical arguments but rather with extensive empirical explorations and (post-hoc) high level intuitions of what makes them successful. Similarly, [Gowal et al. [2020]](https://arxiv.org/abs/2010.03593), [Pang et al. [2020]](https://arxiv.org/abs/2010.00467), [Rebuffi et al. [2021]](https://openreview.net/forum?id=kgVJBBThdSZ) improved the effectiveness of adversarial training for small datasets (mostly CIFAR-10) by searching for the best training configuration and augmentations. Despite the lack of theoretical insights in those works, they have been of great help for the community and subsequent research, since they advanced the state-of-the-art in adversarial defenses and provided clear indications about which factors are most important for training robust models. We think that our work follows this line of research, and makes an important step towards robust classifiers on ImageNet, which presents specific challenges and opportunities. While we could not theoretically explain the different behaviors across architectures (including the role of the ConvStem), our experiments 

1. uncover the existence of such differences in particular regarding generalization to unseen threat models which has not been explored in the literature yet,
2. provide empirical insights about how to successfully train robust classifiers (e.g. clean pre-training, heavy augmentations),
3. show that increasing test-time resolution helps even for robust accuracy.

Some of these indications are even in contrast with those suggested by prior works, and allow us to obtain SOTA $\ell_\infty$-robustness.

&nbsp;

**Analysis of the ConvStem**

We did analyze in detail the design and impact of ConvStem in an ablation study in App. B. In particular, the stem for ViTs (patch size is 16x16) allows for a larger search space since it contains four downsampling layers, compared to the two of a ConvNeXt (patch size 4x4): in Table 8 (App. B.2) one can observe that having only a single downsampling operation per layer yields better robustness than double downsampling or PatchStem (i.e. 16x downsampling with one layer only). This is a possible factor which makes the ConvStem effective, and might also explain the smaller, but positive, impact of ConvStem on the non-isotropic architectures where only two downsampling layers are contained in the stem. In fact, for isotropic architectures all downsampling operations are carried out in the stem (for a total of 16x resolution reduction), while non-isotropic architectures have downsampling layers deeper in the network (only 4x reduction in the stem). Finally, Tables 6, 7 and 8 illustrate the positive effect of the ConvStem on generalization of robustness.

&nbsp;

**Lack of novelty**

We think our work contains several novel aspects: up to our knowledge this is the first work systematically studying the generalization of robustness to unseen threat models on ImageNet. We show that using ConvStem instead of PatchStem yields a large boost in generalization to unseen attacks while still improving in the target threat model. Moreover, we are the first work showing that increasing test-time resolution also boosts robust accuracy which could not be expected as for $\ell_\infty$ increasing resolution yields a more powerful threat model. Note that such differences arise only for high resolution datasets and thus these are new research directions compared to the existing literature on CIFAR. Additionally, while most elements we studied (architectures, pre-training, heavy augmentations) have already been used in some form before, our work empirically analyzes how they interact with each other in the context of adversarial training on ImageNet, which was previously missing. This allows us to distill a new training scheme which effectively improves the robustness of classifiers with various architectures (ViTs, CNNs…), achieving SOTA performance and generalization to unseen threat models.

Meta-review: The paper studies the effect of deep network architecture components on training adversarially robust models on Imagenet. The paper presents a fairly thorough investigation into the effect of different architectural components, as well as transfer robustness. The paper presents some interesting findings. All the reviewers recommend acceptance but raise fair concerns about the practical implications of this study, which the authors are encouraged to address to the best they can in the next version.
Decision: Accept (poster)