Rapid Plug-in Defenders
Authors: Kai Wu
Yujian Betterest Li
Jian Lou
Xiaoyu Zhang
Handing Wang
Jing Liu
Venue: NeurIPS 2024 poster (2024)
Keywords: Rapid Plug-in Defenders
Few-shot Adversarial Training
Adversarial Examples and Defenses
Primary area: safety_in_machine_learning
TL;DR: Pre-trained Transformers as Rapid Plug-in Defenders

Abstract: In the realm of daily services, the deployment of deep neural networks underscores the paramount importance of their reliability. However, the vulnerability of these networks to adversarial attacks, primarily evasion-based, poses a concerning threat to their functionality. Common methods for enhancing robustness involve heavy adversarial training or leveraging learned knowledge from clean data, both necessitating substantial computational resources. This inherent time-intensive nature severely limits the agility of large foundational models to swiftly counter adversarial perturbations. To address this challenge, this paper focuses on the \textbf{Ra}pid \textbf{P}lug-\textbf{i}n \textbf{D}efender (\textbf{RaPiD}) problem, aiming to rapidly counter adversarial perturbations without altering the deployed model. Drawing inspiration from the generalization and the universal computation ability of pre-trained transformer models, we propose a novel method termed \textbf{CeTaD} (\textbf{C}onsidering Pr\textbf{e}-trained \textbf{T}ransformers \textbf{a}s \textbf{D}efenders) for RaPiD, optimized for efficient computation. \textbf{CeTaD} strategically fine-tunes the normalization layer parameters within the defender using a limited set of clean and adversarial examples. Our evaluation centers on assessing \textbf{CeTaD}'s effectiveness, transferability, and the impact of different components in scenarios involving one-shot adversarial examples. The proposed method is capable of rapidly adapting to various attacks and different application scenarios without altering the target model and clean training data. We also explore the influence of varying training data conditions on \textbf{CeTaD}'s performance. Notably, \textbf{CeTaD} exhibits adaptability across differentiable service models and proves the potential of continuous learning.

Rapid Plug-in Defenders
Kai Wu Xidian University
Yujian Betterest Li" Xidian University
kwu@xidian edu
bebetterrestdottlook.ccm
Jian Lou
Xiaoyu Zhang
Handing Wang Xidian University
Zhejiang University jian. lou@hoiying...o net
Xidian University
xiaoyuzhang@xide dian. edu.
hdwang@xidian edu.
Jing Liu Xidian University neouma@mail. xidiann edu. cn
Abstract
In the realm of daily services, the deployment of deep neural networks underscores the paramount importance of their reliability. However, the vulnerability of these networks to adversarial attacks, primarily evasion-based, poses a concerning threat to their functionality. Common methods for enhancing robustness involve heavy adversarial training or leveraging learned knowledge from clean data, both neces- sitating substantial computational resources. This inherent time-intensive nature severely limits the agility of large foundational models to swiftly counter adversar- ial perturbations. To address this challenge, this paper focuses on the Rapid Plug-in Defender (RaPiD) problem, aiming to rapidly counter adversarial perturbations without altering the deployed model. Drawing inspiration from the generaliza- tion and the universal computation ability of pre-trained transformer models, we propose a novel method termed CeTTa (Considering Pre-trained Transformers as Defenders) for RaPiD, optimized for efficient computation. CeTaD strategi- cally fine-tunes the normalization layer parameters within the defender using a limited set of clean and adversarial examples. Our evaluation centers assessing CeTaD's effectiveness, transferability, and the impact of different components in scenarios involving one-shot adversarial examples. The proposed method is capable of rapidly adapting to various attacks and different application scenarios without altering the target model and clean training data. We also explore the influence of varying training data conditions on CeTaD's 's performance. Notably, CeTaD exhibits adaptability across differentiable service models and proves the potential continuous learning.
Introduction
It has been observed that trained neural network models exhibit vulnerability, failing to correctly predict labels when slight perturbations are added to the input examples [15] 2 5. This method,
known an evasion-based adversarial attack, poses significant challenge. Recent research works
47 42 36
41 3D have focused on developing robust models by leveraging clean data knowledge or
employing adversarial training techniques.
"Correponding author
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Presently, deep neural networks serve as fundamental components across various domains [25 12
The most prominent models are pre-trained transformers, such GPT-2 [3], BERT 9 and VIT
[ Following pre-training relevant data, they demonstrate strong generalization capabilities and can swiftly adapt downstream tasks.
Defending deployed service models presents a more challenging scenario. These service models may face difficulties in fine-tuning when under attack, especially if methods like pruning [52] were implemented before deployment to compress or accelerate the service. Retraining a more robust model incurs a considerable computational cost and time. Furthermore, swift defense becomes crucial to prevent further losses instead of waiting for adversarial training redeploying the model.
Hence, Rapid Plug-in in Defender (RaPiD), the goal of which is to swiftly counter adversarial perturba- tions in different application scenarios without altering the deployed model, is of much importance. Most current methods, especially non-invasive defenders (Detection: Magnet 28] ADN 29
DG
etc; Purification: HGGD23] Defense- Laaese-GANEE [3), CAFD(50), D1) DensePure 4 etc.) fail to
accomplish this task due the following reasons: First, they cannot rapidly defend with limited data due to heavy training with much time and training data. Especially, DM-Improves-AT [42] applies adversarial training on large amount of data generated by diffusion models. Second, they cannot quickly adapt to different application scenarios. For example, as shown in Table 3 on CIFAR- 10, although DiffPure [3]] trained on CIFAR-I0 10 (DiffPure performs well against StAdvAttack, it could hardly work with that trained on Imagenet- 1k Difffuuremmgeeertiii Training a diffusion model on specific field needs much time and data.
Table 1: Comparison of conditions between RaPiD and related works in adversarial defense, con- centrating on requirements such as generating additional data, target service model tuning, heavy adversarial training application, utilization of clean data information, and the plug-in nature of the defense.
Heavy Adversarial Training
Data Generation
Tuning Service
Clean Data
Case
Plug-in
DM-Improves-AT
42
DyART 47
X
FD 46
X
X
X
X
DISCO
GDMP 41
X
X
X
X
X
EXXA
X
DifiPure
X
DensePure 45
R&P 45
X
x
CeTaD (Ours)
X
X
In this case, we find that the large volume of training data and the substantial number of parameters requiring adjustment are the primary culprits causing the time-consuming nature of current methods. Motivated by the generalization and the universal computation ability of pre-trained transformer models [26] 19), as well evidence that pre-training can fortify robustness [16], we propose new defense method, CeTaD- Considering Pre-trained Transformers as Defenders. CcTaD is a plug-in defender, which initializes by pre-trained weights and fine-tunes minimal parameters with only few-shot samples. Notably, CeTaD diverges from existing methods as follows: It demonstrates efficacy with minimal sample size required for fine-tuning the rapid defender. Additionally, CeTaD avoids the need for modification within the deployed model, ensuring adaptability across diverse application scenarios, especially with large foundational models.
Our experimental results demonstrate that, in the context of RaPiD, CeTaD exhibits superior performance concerning both clean accuracy and adversarial accuracy with limited training data and computational resources, compared to feasible baselines. The method's effectiveness spans across various datasets and attack methods. The minimal tuned parameters mitigate the risk of overfitting during the training process. Through ablation studies, we evaluate the components within CeTaD, such the residual connection and parameter initialization. Furthermore, explore the impact of

---

data scale and balance, while the transfer test underscores its potential for generalization, with the transfer gap potentially bolstering robustness. Our contributions are summarized as follows.
1. Introduction of the Rapid Plug-in Defender framework aimed at promptly addressing adversarial perturbations quickly without altering the deployed model.
2. Utilization of two strategies in RaPiD to expedite response time: a) leveraging Pretrained models to minimize parameter updates. b) employing few-shot samples for defender training.
3. CeTaD's s achievement of defense response within half hour on a single GPU, surpassing the current RaPiD method in efficacy. Additionally, CeTaD demonstrates proficiency in defending against diverse attacks and enables zero-shot transfer to different datasets.
2 Related Work
Adversarial Examples and Defenses. Introduced by [38. adversarial examples could fool a neural network into working incorrectly. Among various methods 2 attacks in a white-box manner are usually the most dangerous since the leaked information of the victim model is utilized. Many efforts generate adversarial examples through gradients of victims. 11 yielded simple and fast method of generating adversarial examples (FGSM). 4 proposed much more effective attacks tailored to three distance metrics. PGD is multi-step FGSM with the maximum distortion limitation (27]. 8 came up with AutoAttack, a parameter-Fi free ensemble of attacks. Facing adversarial examples. lots of effort pay attention to defense [7]. Some works detect adversarial attack in advance. [28] learned to differentiate between normal and adversarial examples by approximating the manifold of normal examples. [29] proposed to augment deep neural networks with small detector subnetwork which is trained on the binary classification task of distinguishing genuine data from data containing adversarial perturbations. [1] constructed a Latent Neighborhood Graph for detection. Some works strengthen robustness by adversarial training. where the model would be trained on adversarial proposed to exploit diffusion models to generate much extra data for adversarial training. 47 encouraged the decision boundary to engage in movement that prioritizes increasing
examples 15
42
smaller margins. In addition, many works focus on adversarial purification. [23 proposed high-level
representation guided denoiser for purification. [35] trained a generative adversarial network to model
the distribution of unperturbed images. (50) proposed remove adversarial noise by implementing a
self-supervised adversarial training mechanism in class activation feature space. (36) combined canonical supervised learning with self-supervised representation learning to purify adversarial examples at test time. [17] purified adversarial examples by localized manifold projections. Similar to
[1]. 31 followed a forward diffusion process to add noise and recover the clean examples through reverse generative process. Furthermore, multiple reversed samples, which are then passed through the classifier, followed by majority voting of inferred labels to make the final prediction.
43 consisted of multiple runs of reverse process for
Few-shot Adversarial Training. Here are several work on adversarial training with few-shot samples. Many works focus on few-shot learning by adversarial training. [30] applied adversarial discriminator for supervised adaptation problem. 449 introduced an adversarial generator to help few-shot models
learn sharper decision boundary. [2 proposed to hallucinate diverse and discriminative features on
few labeled samples. Furthermore, few-shot adversarial training utilized to enhance the robustness. 13 developed an adversarial training algorithm for producing robust meta-learners and found the the meta-learning models are the most robust with only the last layer tuned. [10] integrated adversarial- aware classifier, aiveessrial-reweighhe training and feature purifier. In this paper, we implement fine-tuning with few-shot adversarial examples for swift defense response.
Pre-trained Transformer. Introduced by [40], transformer is an efficient network architecture based solely on attention mechanisms. It first applied in natural language processing and then rapidly spread in computer vision. 19] proposed BERT to utilize only the encoder of transformer while GPT-2 33 considered only transformer decoder. In computer vision, [ proposed Vision Transformer (VIT), transforming image into sequences of patches and processing them through a pure encoder-only transformer. Moreover, transformer has the ability of universal computation over single modality. (26) demonstrated transformer models pre-trained on natural language could be transferred to tasks of other modalities. Similar to [51 language transformer perceive images by only training a vision encoder the sequence embedding.
(39 proposed to make the frozen
3

---

To strengthen robustness and generalization, we initialize the plug-in in defender by language/vision pre-trained transformer model and only fine-tune minimal parameters.
Pre-trained Transformers as Defenders
Definition 1 RaPiD (Rapid Plug-in Defender): RaPiD is a defense mechanism in machine learning designed to swiftly mitigate adversarial perturbations encountered by deployed models without necessitating alterations the model's architecture or parameters. Its primary objective is to provide rapid and effective protection against adversarial attacks while maintaining the integrity and functionaliity of the existing deployed model.
For RaPiD implementation, the victim service model M is fixed, with limited clean data X. and sparse set of potentially imbalanced adversarial examples X. from single attack method for training, all labeled under Y While this paper specifically addresses image classification within service task, the approach holds theoretical promise for other tasks as well. By default, only one-shot imbalanced adversarial examples are accessible.
CeTaD, initializes with pre-trained weights from models like VIT or BERT, It involves defender embedding and decoder to align the plug-in defender with the input example and the service model respectively. A residual connection retains the primary input features, resulting in the original input combined with the defender's output serving as the input to the service model. Default settings include copying the embedding from VIT or BERT and utilizing PixelShuffle (37 for the decoder. Especially, PixelShuffle rearranges the elements, unfolding channels while increasing spatial resolution, to match the image resolution. Given limited access to adversarial examples, we opt to fine-tune minimal parameters, such as layer normalization, in the plug-in defender, mitigating overfitting and excessive bias on clean data.
The method is formulated as follows: In single- label image classification task, each image from the clean set X is attached with label y" within the corresponding label set Y*. A deployed model M maps xe into the prediction Yee as ye M(x.).
AITEMITIO 62
TRANSRRVERR ENC-066
X
If the model M works correctly, = y². Uti- lizing leaked information about M, the attacker edits the original image to adversarial image Ta by introducing noises, resulting in adversar- ial image za within the adversarial set X. The prediction for Va is then determined as
DERENDER
DEPLOYED MODEL
OEPLOYED
MOPEL
Va M((ra)
If the attack succeeds, Yo * y". The tuning set for defense, denoted as Xa, represents a subset of X. and has a limited size within the RaPiD framework. Our approach incorporates defender module D with parameters 0, while maintaining M fixed. As illustrated Fig. [ M consists of the embedding of pre-trained VIT, pre-trained transformer encoder as a feature poccessor, and a parameter- free PixelShuffle block as a decoder. Only limited parameters are fine-tuned within Xa.
Figure 1: The structure of CeTaD. The input ample would be added with the feature obtained by the stack of embedding, transformer encoder, and a decoder before being processed by the deployed service model. The deployed model is frozen in RaPiD.
The loss function is formulated as
arg min 01
Σ (ass(M((D,, (3.a) + xaa) y²)
(2)
X
where loss is the cross-entropy for classification. Within this framework, 01 and 0g represent the parameters of D. with only 0, being subject to tuning. Specifically, 01 pertains to the layer normalization parameters, while 0₂ encapsulates the remaining parameters. With the trained defender Doz fn, the final prediction y is obtained as
y M(D 00 (x') + x')
(3)

---

Table 2: Accuracy performance with different methods for RaPiD.
Table 3: Accuracy performance with StAdvAt-
tack on CIFAR-10.
Method
CA(%)
AA(% (%)
Method
CA(%)
AA(%)
None
93.75
00.00
None
93.75
00.00
R&P (145)
93.16
02.34
R&P
92.19
01.76
RN(std=0.05) 32
68.95
05.86
RN(std=0.05)
70.90
01.95
RN(std=0.06) 32
57.23
11.13
RN(std=0.07)
46.29
05.27
RN(std=0.07) (32)
48.24
13.67
RN(std=0.09)
32.03
08.20
Linear FFN
23.44
21.68
Linear
18.36
15,43
18.95
19.34
FFN
20.12
16.01
Bottleneck
23.44
20.90
Bottleneck
18.35
13,47
FD (146)
37.50
23.83
FD
29.49
14.64
CeTaD-GPT-2
55.08
39.65
DifFPUrCCIFAR.10
87.50
71.88
CeTaD-Vin VIT
82.81
30.27
Diff
91.41
00.59
CeTaD-VIT-large
71.68
44.14
CeTaD-GPT-2
14.64
09.57
CeTAD-BERT
68.75
44.34
CeTaD-VII
84.57
00.39
CeTaD- BaRTTaggee
66.02
48.83
CeTaD- VIT-l-eeee
67.57
06.64
CeTaD-BERR
56.25
11.52
ReTaD-BERT-lare 56.64
17.38
where 0f is the optimized parameters, and x' (X. U.)).
Module Selection. Module selection is critical aspect of CeTaD given the limited parameter tuning. The embedding and decoder modules play pivotal roles in facilitating the mapping between the input and hidden spaces. Mcanwhile, the encoder holds paramount importance for discerming ad adversarial cues and fortifying robustness, as remains the sole trainable module and undertakes the most computation within CeTaD. Flexibility characterizes Ce contingent upon ensuring harmonious dimensions across the modules.
Outlined below are succinct introductions to the utilized modules: BERT 9 a transformer encoder model, pre-trained for masked language modeling (MLM) and next sentence prediction (NSP) substantial uncased English dataset (available in base and large versions); VIT [Л]. transformer ImageNet-21k
encoder model, pre-trained for image classification
resolution of 224x224
(accessible in base and large versions); GPT-2 [33]. transformer decoder model, pre-trained for causal language modeling (CLM) on an extensive English corpus (available in 124M variant); PixelShuffle (37]. technique reorganizing elements within channels to enhance spatial resolution.
Details of Optimization. In default setup, only layer norm parameters (48 parameter groups, 36864 variables in total) are fine-tuned using Lion [6] with default prpee-parameters. We optimize Eq. over 500 epochs with batch size of 32.
Two perspectives elucidate CeTaD's functionality, Initially, it functions akin to purifier, detecting and filtering adversarial perturbations by introducing adaptive noise. Alternatively, akin to prompt engineering in natural language processing [24], CeTaD can be perceived as a prompt generator, creating adaptive prompts. These prompts serve as cues for the service model, aiding in enhanced classification adversarial examples.
Discussion.
4 Experiments
Experimental Setup Datasets. Three image classification datasets, MNIST 21I. CIFAR- 100 (20), and Imagenet-1k[544
CIFAR-IO 20),
utilized. We utilize the library, Datasets to prepare data. For simplicity. the training set only consists of adversarial examples whose number equals to that of the classes, namely one-shot. The detailed information of datasets and pretrained models can be found in Appendix Section
Attakks. Evasion methods PGD 27,, AutoAttack g and StAdvAtrack 44
simulate service model leakage. Following 42 -ormm 's max distortion 8/255 and 1o-m 128/255. PGD parameters include ten iterations and step size e/4. Metrics include Clean Accuracy (CA) and Adversarial
5

---

Accuracy (AA). Clean accuracy stands for the accuracy on clean data while adversarial accuracy on adversarial data.
Pre-trained Models. Reproducibility relies on public models and checkpoints available on GitHub Huggingface. For MNIST, the victim model is a fine-tuned VIT-basel for CIFAR-10, both of a fine-tuned VIT-base and standardly trained WideResNet-28-UU are considered as victims; for
CIFAR-100, fine-tuned VIT-base is the victim; for Imagenet- Ik. VIT-base is the victim. Pre-trained BERT-base BERTelarge VIT-base VIT-large and GPT-22-12MM are considered as the choices of the
defender initialization.
Other Details. Default settings include BERT-base defending WideResNet-288 10 against 460 -PGD on CIFAR-10, 10, with the defender's embedding sourced from pre-trained VIT.
Baselines R&P and Random Noise 32 are training-free, while the others (Linear, FFN, Bot- tleneck and FD [46 undergo optimization. &&P employs random resizing and padding against adversarial examples, while Random Noise adds zero-mean normal distribution noise similar to BaRT 32]. Linear, FFN, Bottleneck, and FD replace module D in Fig. [ maintaining the rest akin to CeTaD. Linear uses a single layer sans activation, FFN has two doubled hidden feature linear layers with RELU activation, Bottleneck halves the hidden feature dimension, and FD integrates non-local denoising with a 1xl convolution and identity skip connection, performing optimally at a hidden dimension of 256. Our method distinguishes itself from prior adversarial training approaches like excelling in rapid defense without extensive retraining needs.
CeTaD versus Baselines We compare CeTaD with other possible structures and feasible state- of-the-art baselines for RaPiD. Here, BERT-base is the defender for the WideResNeet28-11 against -PGD on CIFAR-10. The results are shown in T
R&P maintains clean accuracy but shows minimal improvement in adversarial accu- racy. Adding random noise slightly boosts adversarial accuracy but drastically re- duces clean accuracy. Generally, training- free methods perform worse in adversarial accuracy compared to optimized ones like Linear, FFN, and Bottleneck, which per- form similarly. With the fixed denoising structure and limited tuned parameters, FD outperforms other prior methods shown.
Table 4: Aceuracy performance in zero-shot transfers from the top to the bottom. "Source" refers to the en- vironment where the defender is tuned, while "Target" r
represents the environment to which the defender trans- fers. None denotes direct training of the defender in the target environment without transfer.
Target Data
Defender
Data (Source Model)
CA(S)
AA(%) )
(Target Model)
None
68.75
44,34
BERT
CIFAR-10 (ResNet)
CIFAR-100 (VIT)
63.87
7.42
None
82.81
30.27
VIT
CIFAR-100 (VIT)
69.73
7.42
However, CeTaD, initialized by GPT-2, VIT, VIT-large, BERT, or BERT-large, ex- cels in adversarial accuracy while main- taining high clean accuracy compared to the aforementioned methods. Notably, GPT-2-based initialization shows relatively poor performance, suggesting the need for better fusion of information between pre- ceding and subsequent patches in visual tasks. Scaling matters too, as larger-scale defenders outperform their base-scale counterparts in adversarial accuracy.
None
41.80
36.35
CIFAR-10 (VTT)
BERT
CIFAR-100 (VIT)
73.63
51.17
VIT
None
80.86
45,90
CIFAR-100 (VIT)
79.88
47.66
None
98.05
92.77
BERT
CIFAR- (VIT)
96.29
90.43
MNIST (VTT)
CIFAR-I00(VII
97.85
89.84
None
98.24
91.41
VIT
CIFAR 10 (VIT)
97.66
87.50
CIFAR- (VIT)
97.66
86.91
When designing a defender, minimal tuned parameters and robustness are crucial. Linear, FFN, and Bottleneck, being more flexible with additional tuned parameters during training, tend to bias towards clean data. Conversely, CeTaD's fixed blocks with fewer tuned parameters, exhibit greater robustness, resulting in superior performance. Further exploration on CeTaD's 's tuned parameters is detailed in Section 4 Evaluating the residual connection's 's role in CaDa Table 5 showcases that without this module, both clean and adversarial accuracy degrade significantly, highlighting the crucial role of the residual connection with minimal tuned parameters and one-shot adversarial examples.
Generalization of CeTaD on Different Attacks In reality, deployed service models face vari- ous attack methods. To gauge defenders' reliability, we subject them to different attack methods, following default experimental settings. Table showcases CeTaD's adaptability performs well

---

Table 5: Accuracy performance on the residual connection. without-res res stands for removing the residual connection.
Table 6: Accuracy performance against differ- ent attack methods. None represents no attack method applied.
Defender
CA(%)
AA ())
Attack Method
CA(%)
AA(%)
None
93.75
00.00
None Lc -PGD
93.75
OeTaD-BERT
68.75
44.34
68.75
44.34
11.13
10.55
1 AutooAttaak
70.70
49.41
CeTaD-VIT
82.81
30.27
12-PGD 76.17
57.03
SUTTaD-VTTwithhut-res
12.89
12.89
122 12-AuttAttack
73.44
61.33
against AutoAttack. We observe that within AutoAttack, only Auto-PGD succeeds; this method is the initial step of the ensemble and singularly overwhelms the victim model. Auto-PGD adjusts its step size automatically, seeking minimal efficient perturbations. However, this pursuit of minimal perturbations may compromise their robustness, allowing for more successful defense strategies. Thus, maintaining balance between maximum distortion and perturbation effectiveness is critical for generating resilient perturbations. In addition, we include another attack method, StAdv in With tougher attack method, method shows good generalization well.
Table 3
Zero-shot Transfer to Different Datasets Given the generalization potential of pre- pre-trained models
16 26]. assess CeTaD across varied datasets without re-tuning, named zero-shot transfer. Table 4 indicates that transferring to ResNet on CIFAR-10 from VIT on CIFAR- 100 yields lower ad- versarial accuracy, even worse than random selection. When the target model is VIT, CeTaD exhibits improved transfer performance. This sensitivity to victim model structures suggests challenges in direct transfer across different models. Instead, similarity between victim models might aid beneficial transfers between tasks. Notably, the transferred BERT defender achieves higher adversarial accuracy, indicating superior performance of CeTaD with diverse prior knowledge.
119
Further evaluations consider MNIST as the target dataset and CIFAR-10 or CIFAR-100 as the source. Performance remains consistent regardless of the souree dataset, suggesting uniform transferable knowledge among these defenders. Shifting focus to more challenging target tasks, Table ( sur- prising results: defenders tuned MNIST demonstrate superior adversarial accuracy on CIFAR-100 compared to CIFAR-10. This highlights that transfer from unrelated data might bolster defender ro- bustness. In summary, leveraging transfer gaps enhances defense robustness, potentially empowering defenders across diverse datasets to strengthen performance on individual datasets.
Effect of Pre-trained Models on CeTaD We ana- lyze how two pre-trained models affect CeTaD's 's per- formance across MNIST, CIFAR-10, and CIFAR-100 datasets, employing default settings from Section 4 Ta- highhiitss the vulnerability of the original service
Table 7: Accuracy performance on zero- shot transfer from bottom to top.
Source Data
Defender
(Source Model)
CA(%)
AA(%)
model in the absence of a defender. Despite limited tun- able parameters and access only one-shot adversarial examples, CeTiaD-equipped models well classify adver- sarial samples. Notably, CeTaD defends both VIT and ResNet on CIFAR- 10, demonstrating its adaptability across diverse victim models. In addition, as shown in Table CeTaD could be applied to a larger dataset such Imagenet- 1k. Furthermore, the effective performance of BERT and VIT defenders
None
44.53
34,77
CIFAR- (VTT)
13.87
MNIST
26.37
23.44
None
52.34
30.47
VII
CIFAR-IO (VIT)
45.31
27.54
MNIST VIT)
49.41
28.91
suggests the potential universality of frozen modules, aligning with prior studies 26 19
Overall, defense performance varies based on dataset and defender initialization. MNIST's clear number pixels and consistent backgrounds enable effective defense with both defenders. Conversely, CIFAR-10 10 and CIFAR-100 diverse scenes pose challenges; tuning introduces bias, impacting clean accuracy. CeTaD-VIT defenders excel in clean accuracy, while CeTaD-BERT defenders perform better in adversarial scenarios. CeTaD-VIT's stability from similar training tasks renders it vulnerable to adversarial perturbations, whereas CeTaD-BERTT diverse training complicates clean classification.
7

---

Table 8: Accuracy performance of CeTaD on different datasets. None represents no defense strategy. TC(mins) refers time cost.
Table 9: Accuracy performance on Imagenet- 1k.
Method
CA(%)
AA(%)
None
81.64
00.00
Dataset
Model
Defender
CA(%)
AA(%)
TC
R&P
78.71
26.56
Nome
98.83
00.78
RN(std=0.11 1)
75.98
10.
MNIST
VIT
BERT
98.05
92.77
RNistd=0.2)
57.42
35.55
VII
98.24
91.41
RN(std=D.3)
34.18
24.41
Linear
47.66
39.45
ResNet
BERT
68.75
44.34
14
FFN
25.20
14.84
VIT
82.81
30.27
Bottlenock
40.63
22.85
CIFAR-10
FD
52.15
27.15
None
98.05
00:00
C
61.52
30.31
VIT
80.86
45.90
25
CεTaD-VIT
51.17
34.38
CoTaD-VTT-tare
45,70
36.33
Nome 91,41
00.00
CeTaD
53.32
36.91
CIFAR-100
VIT
BERT
44.53
34.77
OrTaD-BERTTlagg
65.63
43.55
While humans perceive similarity between clean and adversarial examples, networks struggle, result- ing in clean data performance drops due to catastrophic forgetting [14]. Additionally, treating the defender prompt generator implies prompts added examples, guiding the service model to focus on adversarial features, potentially disregarding clean features.
Discussion on Convergence and Overfitting We address two key concerns: 1) Can CeTaD effectively adapt adversarial examples with most parameters frozen and minimal tuming? 2) Given the default one-shot adversarial examples in the training data, CeTaD susceptible to overfitting?
To assess these, we track clean and adversarial accuracy on both training and test data using default experimental settings. However, the limited quantity of training data may limit the expressiveness of accuracy. To gain deeper insights into the training process, we also monitor the training loss on the training data.
100.00
66.00
310
11.08
05.77
333
Accurscy (96)
20.56
Loss
2.79
44.04
232
20.33
CA training
22.22
training
training
11.11
test
0.56
AA test
0.0
0.00
3T0
460
10
100
190
280
370
460 500
Epoch
Epoch
Figure 2: Accuracy and loss over epochs. Top: Accuracy curves representing training and test data. Training refers to accuracy on training data, while Test denotes accuracy on test data. It's notable that clean training data remains unseen during training. Bottom: The loss curve depicting training data. Given the consistent 100% accuracy after 90 epochs, this loss curve provides insights into the training process.
Figure 2 iillustrates compelling insights. Initially, within 90 epochs, CeTaD swiftly reaches 100% adversarial accuracy on training data, showcasing its rapid adaptation, mainly tuning layer norm parameters. Surprisingly, clean accuracy simultaneously reaches 100%, suggesting that training on adversarial examples can unveil reflective feature of clean examples, even when they are not directly presented to the model.

---

On test data, adversarial accuracy steadily improves, signifying CeTaaD's capacity to generalize from a single-shot adversarial dataset. However, this gain comes the cost of declining clean accuracy. The divergence in distributions and mapping between clean and adversarial data, due to added perturbations, causes a trade-off: aligning with adversarial data benefits but compromises performance on clean data.
In the latter 400 400 epochs, while maintaining 100% training accuracy, test adversarial accuracy continues a slight ascent, clean accuracy gently declines, and the loss sporadically fluctuates. This pattern suggests that rather than overfitting, CeTaD continues explore and assimilate information from adversarial examples. It is a crucial capability in RaPiD, where conventional methods like evaluation or early stopping might not be feasible due limited training data.
Role of Pre-trained Initialization and Frozen Parameters As highlighted in Section 4 the initialization strategies and tuned parameters play pivotal role in defender performance. Here, we delve into these aspects within CeTaD. Given the identical transformer layer structure, the divergence between the BERT and VIT defenders lies primarily in weight ini- tialization. Table TO illustrates that tuning all parameters generally diminishes clean and adversarial accuracy. Here, the fixed modules in the pre-trained VIT, aligned with im- age classification, result in a closer mapping relationship between the defender with limited tuning and the victim ser- vice, rendering it susceptible to adversarial examples. Con- trastingly, comprehensive parameter tuning for VIT fosters a divergence from the original mapping relationship, reinfore- ing robustness and elevating adversarial accuracy. Notably, the BERT defender excels in adversarial accuracy, while the VIT defender showcases superiority in clean accuracy. Even the randomly initialized defender surpasses the VIT defender in adversarial accuracy. Thus, the
Table 10: Performance across vari- ous initialization strategies and param- eter tuning levels are evaluated. "Ran- dom" denotes random initialization of CeTaD. The "Tune-All" suffix signi- fies optimization for all parameters within module D, whereas the ab- sence of suffix indicates the original CeTTDD.
Defender
CA(%)
AA(%)
None
93.75
00.00
Random
52.93
42.39
Random-Tunc-All
43.36
33.79
BERT
68.75
44.34
BERT All
59.77
44.14
VIT
82.81
30,27
VTn--une-Al
69.14
36.14
VIT-initialized defender appears suboptimal and conservative comparison.
Effect of Training Data on CeTaD The default setup offers only one-shot and unbalanced adversarial examples for swift defense. For example, only 10 adversarial examples sampled randomly are available on CIFAR-10. To investigate how training data variations impact CeTaD's performance, Ti highlights that, under default setups, introducing one-shot clean examples auxiliary data, considering four-shot adversarial examples, or balancing the class distribution in training data significantly improves both clean and adversarial accuracy. Notably, establishing class-balanced data and supplementing clean examples play crucial roles in enhancing CA.
Table 11: Accuracy performance on different training data settings. ladv (Iclean) stands for one-shot adversarial (clean) examples re- spectively. Balanced stands for the class balance.
relax these
constraints for assessment. Table
Training Data
CA(%)
AA( 5%)
ladv
68.75
44.34
lndv-Iclear Ielean
76.76
48.24
4adv
70.12
50.20
ladi-Balanced
77.34
49.02
Continuous Attack. Similar to adaptive attacks, continuous attacks have the access to the existing system including the defender, which is very demanding setting in practice. However, method requires limited tuning on few-shot adversarial samples, which may make continuous defense possible and slightly. Treating each Attack-Then- Defense period as a round, we conduct a pilot evaluation of one-shot continuous rapid defense under the ladv-/clean setting mentioned in Section 4 Results in Table [2 demonstrate that both adversarial and clean accuracy is enhanced
Table 12: Performance against continuous attack.
Round
CA(%)
AA(%)
93.75
00.00
i
73.83
55.47
78.71
64.84
through continuous adversarial learning. We foresec the potential expansion of CeTaD into an active defender against adaptive attacks in the future.
Black-Boo Box Attack Black-box attacks are usually more generalized and robust than white-box methods. We evaluate CeTaD on two kinds of black-box attacks, square attack (3] and composite adversarial attack [18), under the default settings. For Square Attack, 5000 queries are applied for randomized perturbation search; for Composite Adversarial Attack (CAA6), semantic perturbations
9

---

are combined with scheduled ordering. As shown in Table 13 and 14 CeTTD is able to adapt to different black-box attacks by one-shot adversarial fine-tuning.
Table 13: Performance against Square Attack.
Table 14: Performance against Composite Ad-
method
CA(%) (%)
AA ())
versarial Attack.
None
93.75
00.00
method
CA(%)
AA (%)
CeTaD-VIT
83.20
74.02
None
93.75
00,00
CeTaD- BEaD-VIT-largee Var-l
81.45
75.39
CeTaD-VIT
85.74
61.52
CeTaD--EER BERT
82,42
79.30
CeTaD- --T-a-eTTe
69.33
52.15
BeTaD-BERT-Base
84.57
83.59
CeTaD-BERT
78.52
65.23
CeTaD-BERTTllage
84.18
68.36
5 Discussion: Limitations and Future Work
In the present scope of RaPiD, there remains notable performance gap for CeTaD without accounting for more potent attacks. End-to-end tuning in CeTTaD tends to impact clean data perfor- mance to certain extent. Investigating the latent clean data features left in adversarial data might potentially preserve clean accuracy. While this paper focuses solely on image classification, CeTaD holds promise for broader application differentiable systems. Future endeavors aim to assess its per- formance and generalization across diverse tasks. Additionally, exploring non-differentiable methods like genetic algorithms or reinforcement learning could circumvent differentiability constraints.
Furthermore, the choice of initialization strategy and parameter tuning significantly affects CeTaD's efficacy (Section 4). This study primarily assesses three initialization strategies from standard pre- trained models and explores only parameter tuning for layer norm and full defender parameters. Enhanced strategies for initialization and refined parameter selection through data-driven approaches could bolster performance.
The characteristics of training data pivotal. While this paper mostly utilizes one-shot imbalanced adversarial examples, Section 4 Whighlights the potential benefits class-balanced adversarial exam- ples and their mixture with clean data. Relaxing RaPiD's limitations by structuring a training set with few-shot clean and adversarial examples might optimize performance.
Considering lifelong learning is imperative. The focus on single attack method in each experiment doesn't account for the reality where service models encounter diverse attack methods. Developing a defender capable of continuous learning to combat new attacks while leveraging past knowledge is essential. By the way, we believe that the defense for deployed models is a complex system. Though we focus on the core (how to defend), there are many other unresolved important problems, such as how to rapidly detect adversarial examples when the attack happens.
In Section 4 surprising outcomes indicate that indirectly related data transfer performs better than related data transfer. This suggests consistency across differing domains, raising questions about aligning modalities based on such consistency. Moreover, exploring transferability across diverse attack methods and various victim models remains open for future exploration. By integrating multiple service models across different tasks and modalities, a relatively universal defender could strengthen its domain robustness.
Conclusion
Defending operational service models poses challenges, especially with potential difficulties in fine-tuning during attacks, particularly post-pruning. Reinforcing more resilient model demands extensive computational resources and time. Rapid defense is vital to prevent further damage rather than waiting for adversarial training or model redeployment. Recent methods might lack efficiency in RaPiD due to the extensive training data and numerous parameters, causing methodical delays. We introduce CeTaD, capitalizing on pre-trate pre-trained transformer models' broad applicability, harnessing pre- pre-trainn rre-training's 's capacity to fortify robustness. CeTaD excels in clean and adversarial accuracy within constrained resources, minimizing overfitting through minimal parameter adjustments. Evaluations highlight its efficacy across datasets and attacks, probing CeTaD's components via ablation studies. Additionally, exploring data scale and balance effects, transfer tests demonstrate potential for broader adaptability, possibly reinforcing robustness through transfer gap analysis.
10

---

Acknowledgments and Disclosure of Funding
This work was supported in part by the National Natural Science Foundation of China under Grant 62206205 and 62471371, in part by the Young Talent Fund of Association for Science and Technology in Shaanxi, China under Grant 20230129, in part by the Guangdong High-level Innovation Research Institution Project under Grant 00210099955000,, and in part by the Guangzhou Key Research and Development Program under Grant 202206030003.
References
[1] Ahmed Abusnaina, Yuhang Wu, Sunprect Arora, Yizhen Wang, Fei Wang, Hao Yang. and David Mohaisen. Adversarial example detection using latent neighborhood graph. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 7687-7696, 2021.
[2] Naveed Akhtar and Ajmal Mian. Threat of adversarial attacks on deep learning in computer vision: A survey. IEEE Access, 6: 6:14410-14430, 2018
[3] Maksym Andriushchenko, Francesco Croce. Nicolas Flammarion, and Matthias Hein. Square attack: query-efficcent black-box adversarial attack via random search. In European conference on computer vision, pages 484-501. Springer, 2020.
[4] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp). pages 39-57. leee, 2017.
[5] Anirban Chakraborty, Manaar Alam, Vishal Dey, Anupam Chattopadhyay, and Debdeep Mukhopadhyay. Adversarial attacks and defences: A survey. arXiv preprint 10XXv:0810000061 2018.
[6] Xiangning Chen, Chen Liang, Da Huang, Esteban Real, Kaiyuan Wang, Yao Liu, Hieu Pham, Xuanyi Dong, Thang Luong. Cho-Jui Hsich, et al. Symbolic discovery of optimization algo- rithms. arXiv preprint arXiv:2302.066755 2023.
[7] Joana C Costa, Tiago Roxo, Hugo Proença, and Pedro RM Inácio. How deep learning sees the world: A survey on adversarial attacks & defenses. arXiv preprint 10862, 2023.
[8] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference machine learning, pages 2206-2216. PMLR, 2020.
[9] Jacob Devlin, Ming- Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv: 1ate:111000000 2018.
Ming-Wei
[10] Junhao Dong, Yuan Wang, Jian-Huang Lai, and Xiaohua Xie. Improving adversarially ro- bust few-shot image classification with generalizable representations. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 9025-9034, June 2022.
[11] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition scale. arXiv preprint a0Xiv:2010. /929, 2020.
[12] Tyna Eloundou, Sam Manning, Pamela Mishkin, and Daniel Rock. Gpts gpts: An early look at the labor market impact potential of large language models. arXiv preprint arXiv:2303.10130 2023.
[13] Micah Goldblum, Liam Fowl, and Tom Goldstein. Adversarially robust few-shot learning: meta-learning approach. In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin, editors, Advances in Neural Information Processing Systems, volume 33, pages 17886-17895. Curran Associates, Inc., 2020.

---

[14] Ian J Goodfellow, Mehdi Mirza, Da Xiao, Aaron Courville, and Yoshua Bengio. An empirical investigation of catastrophic forgetting in gradient-based neural networks. arXiv preprint arXiv: 131.6111 2013.
[15] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples. arXiv preprint arXiv:1412.6S72 2014.
[16] Dan Hendrycks, Kimin Lee, and Mantas Mazeika. Using pre-training can improve model robustness and uncertainty. In International Conference on Machine Learning, pages 2712- 2721. PMLR, 2019.
[17] Chih-Hui Ho and Nuno Vasconcelos. Disco: Adversarial defense with local implicit functions. Advances in Neural Information Processing Systems, 1-23818-23837 2022.
[18) Lei Hsiung, Yun-Yur Tsai, Pin-Yu Chen, and Tsung-Yi Yi Ho. Towards compositional adver- sarial robustness: Generalizing adversarial training to composite semantic perturbations. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24658-24667, 2023.
[19] Donghyun Kim. Kaihong Wang, Stan Sclaroff, and Kate Saenko. A broad study of pre-training for domain generalization and adaptation. In Computer Vision-ECCV 2022: 17th European Conference, Tel Aviv, Israel, October 23-27, 2022, Proceedings, Part XXXIII, pages 621-638. Springer, 2022.
[20] Alex Krizhevsky, Learning multiple layers of features from tiny images. Technical report, NA, 2009.
[21] Yann LeCun, Corinna Cortes, and CJ Burges. Mnist handwritten digit database. ATT Labs [Online]. Available: http://yann. lew.n. wwtn.c/m//xx//nnistt 2, 2010.
[22] Kai Li, Yulun Zhang, Kunpeng Li, and Yun Fu. Adversarial feature hallucination networks for few-shot learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2020.
[23] Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu. Defense against adversarial attacks using high-level representation guided denoiser. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1778-1787, 2018.
[24] Pengfei Liu, Weizhe Yuan, Jinlan Fu, Zhengbao Jiang, Hiroaki Hayashi, and Graham Neubig. Pre-train, prompt, and predict: systematic survey of prompting methods in natural language processing. ACM Computing Surveys, 55(9):1-35, 2023.
[25] Weibo Liu, Zidong Wang, Xiaohui Liu, Nianyin Zeng, Yurong Liu, and Fuad E Alsaadi. A survey of deep neural network architectures and their applications. Neurvcomputing, 234:1 1-26, 2017.
[26] Kevin Lu, Aditya Grover, Pieter Abbeel, and Igor Mordatch. Pretrained transformers as universal computation engines. arXiv preprint arXiv:2103.05247, 1, 2021.
[27] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv: (tt.::770600... 2017.
[28] Dongyu Meng and Hao Chen. Magnet: a two-pronged defense against adversarial examples. In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, pages 135-147, 2017.
[29] Jan Hendrik Metzen, Tim Genewein, Volker Fischer, and Bastian Bischoff. On detecting adversarial perturbations. International Conference on Learning Representations, 2016
[30] Saeid Motiian, Quinn Jones, Seyed Iranmanesh, and Gianfranco Doretto. Few-shot adver- sarial domain adaptation. In I. Guyon, U. Von Luxburg, S. Bengio, H. Wallach, R. Fergus, Vishwanathan, and R. Garnett, editors, Advances Neural Information Processing Systems, volume 30. Curran Associates, Inc., 2017.
12

---

[31] Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. arXiv preprint (.Xiv:2205.074600 2022.
[32] Zeyu Qin, Yanbo Fan, Hongyuan Zha, and Baoyuan Wu. Random noise defense against query- based black-box attacks. Advances in Neural Information Processing Systems, 34:7650-7663, 2021.
[33] Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, al. Language models are unsupervised multitask learners. OpenAl blog, 188)9, 2019.
[34] Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander C. Berg. and Li Fei-Fei. ImageNet Large Scale Visual Recognition Challenge. International Journal of Computer Vision (IJCV), 115()::211 252, 2015.
[35] Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-gan Protecting classifiers against adversarial attacks using generative models. In International Conference on Learning Representations, 2018.
[36] Changhao Shi, Chester Holtz, and Gal Mishne. Online adversarial purification based on self-supervision. arXiv preprint arXiv:2101.09387 2021.
[37] Wenzhe Shi, Jose Caballero, Ferenc Huszár, Johannes Totz, Andrew P Aitken, Rob Bishop, Daniel Rueckert, and Zehan Wang. Real-time single image and video super-resolution using an efficient sub-pixel convolutional neural network. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1874-1883, 2016.
[38] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfel- low, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv: 1312.6199 2013.
[39] Maria Tsimpoukelli, Jacob L Menick, Serkan Cabi, SM Eslami, Oriol Vinyals, and Felix Hill. Multimodal few-shot learning with frozen language models. Advances in Neural Information Processing Systems, 34:200-212, 2021.
[40] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems, 30, 2017.
[41] Jinyi Wang, Zhaoyang Lyu, Dahua Lin, Bo Dai, and Hongfei Fu. Guided diffusion model for adversarial purification. arXiv preprint arXiv:2205. 14969 2022.
[42] Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan. Better diffusion models further improve adversarial training. arXiv preprint arXiv:2302.04638 2023.
[43] Chaowei Xiao, Zhongzhu Chen, Kun Jin, Jiongxiao Wang, Weili Nie, Mingyan Liu, Anima Anandkumar, Bo Li, and Dawn Song. Densepure: Understanding diffusion models towards adversarial robustness. arXiv preprint arXiv:2211.00322. 2022.
[44] Chaowei Xiao, Jun-Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song. Spatially transformed adversarial examples. In International Conference on Learning Representations, 2018.
[45] Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. arXiv preprint 1711::111..0999) 2017.
[46] Cihang Xie, Yuxin Wu, Laurens van der Maaten, Alan L Yuille, and Kaiming He. Feature denoising for improving adversarial robustness. In Proceedings of the IEEF/CVF conference on computer vision and pattern recognition, pages 501-509, 2019.
[47] Yuancheng Xu, Yanchao Sun, Micah Goldblum, Tom Goldstein, and Furong Huang. Explor- ing and exploiting decision boundary dynamics for adversarial robustness. arXiv preprint a302v 03001005..0..... 2023.
13

---

[48] Qinghao Ye, Haiyang Xu, Guohai Xu, Jiabo Ye, Ming Yan. Yiyang Zhou, Junyang Wang, Anwen Hu. Pengcheng Shi, Yaya Shi, al. mplug-owl: Modularization empowers large language models with multimodality. arXiv preprint arXiv:2304. /4178, 2023.
[49]
Ruixiang ZHANG, Tong Che, Zoubin Ghahramani, Yoshua Bengio, and Yangqiu Song. Meta- gan: An adversarial approach to few-shot learning. In S. Bengio, H. Wallach, H. Larochelle, Cesa-Bianchi, Bianchi, and R. Garnett, editors, Advances in Neural Information Pro- cessing Systems, volume 31. Curran Associates, Inc., 2018.
K. Grauman, N. Cesa-
[50] Dawei Zhou, Nannan Wang, Chunlei Peng, Xinbo Gao, Xiaoyu Wang, Jun Yu, and Tongliang Liu. Removing adversarial noise in class activation feature space. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 7878-7887, 2021.
[51] Deyao Zhu, Jun Chen, Xiaoqian Shen, Xiang Li, and Mohamed Elhoseiny. Minigpt-4: En- hancing usion-language understanding with advanced large language models. arXiv preprint arXiv:2304. 10592, 2023.
[52] Mingjian Zhu, Yehui Tang, and Kai Han. Vision transformer pruning. arXiv:2104.08500, 2021.
arXiv preprint
14

---

A Details of Data Preparations
For reproducibility, we illustrate how to prepare data in the experiments.
All datasets are available from Huggingface: MNIST
co/ co/datases/
mnist). CIFAR-10 hattps:/huuggingfacee www.daatsts//iitetttt.a
and CIFAR- 100 (https: The library, Datasets (https: bettps://githb. thub com/ which includes the methods mentioned below, is utilized for down-
//huggingface co/dataastss/caaaa////aaa////aaa
loading and splitting data.
N-shot Training Samples. First, we split data by class using filte.. Then, for each category, two methods, shuffle with given seed and select for getting the first n samples, applied in turn. Finally, we mix the selected samples of all classes by concatenate _dtaasts and shuffle with the seed.
512 Fixed Test Samples. We apply shuffle with the seed and select to get the first 512 samples.
In details, data is class-split via filter. Each category undergoes shuffe and select methods for obtaining n samples, followed by concatenate_din _atueeesss and shuffle for mixing class samples. As per [3], evaluation involves 512 randomly selected images from the test dataset, reducing computational expenses. We apply shuffle with the seed and select to get the first 512 samples.
Few Adversarial Examples
Adversarial Examplos
DEFENDER
DEPLOYED MODEL
DEPLOYED MODEL
OPTIMIZATION
OPTIMIZATION
(a) previous methods
Oblour
Figure 3: Comparison between previous adversarial training methods and ours: (a) Previous methods heavily rely vast adversarial examples to tune the original model, demanding significant time and computational resources. (b) In contrast, our approach focuses on tuning only a subset of parameters within the plug-in defender block using limited adversarial examples, enabling swift impact without exhaustive computational demands.
B Details of Module Selections inside CeTaD
Module selections are essential for CeTaD since only limited parameters are tuned. The embedding and the decoder are vital for feature mapping between the input space and the hidden space. The encoder significant for perceiving adversarial information and enhancing robustness since it the only trainable module and bears the most computation CeTaD.
As shown in Figure [ and illustrated in Section 3 CeTaD flexible as long as the dimensions the modules match with each other. However, pre-trained weights may help.
For example, we take the embedding from the pre-trained VIT, get the transformer blocks from the pre-trained BERT, VIT or GPT-2, and consider PixelShuffle as the decoder. The mod- ules we used are briefly introduced as follows: BERT (9) is transformer encoder model pre-trained for masked language modeling (MLM) and Next sentence prediction (NSP) on large corpus of uncased English data (base: heatps://huggingeee wttp:eiaa.aacc.b.r...taeaaaa large: attps://huggine
co/bert- base uncased, cor Marge-rrr----- uncased); VIT ([LI) transformer encoder
15

---

model pre-trained for image classification on Image\Net-2lk at resolution 224x224 (base: https http://nngaacee.ooooogggo// co/ boo/gogll///tt-laeeeaaaaaaeeeeee
base base- bateee//ttttaaaeeeaaaahhhhhe patchh1-224-in2111 2224-n22KK large: https://huggingfaae
224- in21k): GPT-2 ((3 is a transformer decoder model
pre-trained for causal language modeling (CLM) on large corpus of English data (124M:
https: htap::://uuggigg... (ttpg/nccncccgtt2)). PixelShuffle (377) rearranges elements unfolding channels to increase spatial resolution
C Details of Optimization
Optimization loops are implemented by PyTorch. To optimize limited parameters and freeze the others, following (26), we set requires_gres grad==rrue for tunable parameters while requires_sts Sqquires_rra=FFasee for the others. The optimizer is initialized by registering the parameters with requires_grad-e Under the default experimental setup, only layer norm parameters (48 parameter groups, 36864 variables in total) tuned. We use seed 42 for reported accuracies following (26), each experiment running within 30 minutes on an NVIDIA RTX A5000 GPU.
By the way. the implementation of Lion (66). the optimizer which apply, is available at hhtpp //github. wwt.c/omcccm./a wwtam//uucdaaannnnninaaaa pytorch
D Memory & Memory&Laterr
Latency
We evaluate GPU memory (peak value) and inference time (average value per batch) the test under other default settings with the following device configuration: CPU, 14 vCPU Intel(R) Xeon(R) Gold 6330 CPU @ 2.00GHz; GPU, 1 NVIDIA RTX 3090(24GB). As shown in Table [5] our method would not lead to heavy non-trivial inference overhead. However, with larger pre-trained models, the memory and latency increase accordingly. It is supposed be a trade-off between defense performance and resource consumption.
Table 15; Accuracy performance different training data settings. Iadv (Iclean) stands for one-shot adversarial (clean) examples respectively. Balanced stands for the class balance.
method GPU memory (MB) time (s/batch)
No-defender CeTaD-BERT
2186
0.07818
2638
0.08014
CeTaD-BERR HADD-BERT-aarg
3460
0.08496
E JPEG Compression for Defense
Our evaluation includes naive and training-free defense methods such as Random Noise and R&P. Results show that Random Noise could not balance clean and adversarial accuracy while R&P keeps high clean accuracy but has little effect on adversarial accuracy. We further evaluate that whether an old and simple method, JPEG compression with different quality factors, could work. As shown in Table [6] it is also poor on ad adversarial accuracy. To conclude, these methods do not work well in the RaPiD scenario, which is more practical yet challenging.
F Error Bars
we evaluate the accuracy fixed subset of 512 images randomly sampled from whole test data to save computational cost. Besides, because of the number of experiments and the page limit, following (26), in the content, only report the results with one seed 14e-the answer to the ultimate question of life, the universe and everything). In this section, to show the validity of the results in the content, we additionally repeat two experiments described in Section 4 and Section with another two seeds (41 and 43).
Following 31
IIn the experiments, upscale factor is always set to 16. Thus, the seale of the transformer encoder is large, which means the hidden feature is of 1024 dimensions and four channels are given after PixelShuffle, we just ignore the last channel for simplicity.
16

---

Table 16: Accuracy performance with JPEG compression under default settings.
quality factor
CA(%)
AA(%)
90
90.63
01.37
60
88.48
09.77
40
86.72
10.55
30
86.33
09.96
10
82.62
08.98
71.09
06.45
In Table Table 17 and Table with different seed, though the training data and the fixed subset for evaluation vary, leading to accuracy fluctuation, the relative performances of different methods remain the same. Specifically, while BERT defenders are likely to outperform at adversarial accuracy. Furthermore, the trends of the corresponding curves in Figure Figure 4 and Figure 5 are similar. It demonstrates that our experiments are both efficient and effective.
illustrated in Section VIT defenders better clean accuracy
100.00
5.00
77.78
8.60
Accurscy (9)
89.08
2.78
38.03
1.67
CA training
training
training Loss
CA tost
11.31
0.56
AA test
0.00
Epoch
Epoch
Figure 4: Accuracy and loss vs. epoch with seed 41.
Table 17: Accuracy performance with seed 41.
Table 18: Accuracy performance with seed 43.
Dataset
Model
Defender
CA(S)
AA(%)
Dataset
Model
Defender
CA(%)
AA(%)
None
99.02
00.59
None
99.22
00.59
MNIST
VIT
BERT
97.07
90.82
MNIST
VIT
BERT
98.83
93.36
VIT
99.02
91.60
VIT
99.22
87.70
None
None
95.51
00.00
ResNet
BERT
70.12
43.55
ResNet
BERT
73.05
44.73
VIT
76.95
28.91
VIT
79.30
32.81
CIFAR: 10
CIFAR 10
None 97.85
00.00
None
98.05
00.00
BERT
BERT
69.73
53.52
VIT
76.37
41.60
VIT
80.86
53.13
None
91.80
00.39
None
94. 14
00.20
CIFAR-100
VIT
BERT
50.78
38.28
CIFAR-100
VIT
BERT
44.14
34.18
47.07
28.32
17

---

88.80
533
88,87
4.00
Accuraby (%)
Loss
44.44
2.67
training training
22.20
1.50
training loss
tost
test
0.00
0.00
10
100
370
400
500
100
190
500
Epoch
Epoch
Figure 5: Accuracy and loss vs. epoch with seed 43.
18

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: See Abstract and Introduction
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results be expected to generalize other settings.
is fine include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: See Section 5
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification. asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low images are taken in low lighting. Or speech-to-text system might be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question:
For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
19

---

Justification:
No Assumption and Proof
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification: See Section 4 and Appendix Section A
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm. (b) the contribution is primarily a new model architecture, the paper should describe the architccture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reprodueibility. the case of closed-source models, may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
20

---

Answer: [Yes]
Justification: See Section 4 and Appendix Section Moreover, Code of CeTaD is easy to implement.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.c ec/
for more details.
While encourage the release of code and data, understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https http://ooooSuuiisssodeee
//nips. //nips.cc/ppl wwwppbblccgguiicuceccccccooooope
htt.SSbbbiiiiooooiiiiiooooi. for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: See Section 4 and Appendix Section A
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer:
[Yes]
Justification:
See Appendix Section
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the enror bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
21

---

It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: NVIDIA RTX A5000 GPU
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification:
We have reviewed the NeurlPS Code of Ethics
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: See Section 5 and 6
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no socictal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
22

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of MI..
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
The paper poses no such risks
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Lieenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [NA]
Justification: The paper does not use existing assets.
Guidelines:
The answer NA means that the paper does existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
23

---

If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: The paper does not release new assets
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Ethies, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
24


Reviews:
[{"review_id": "auOHsLhQ8S", "reviewer": "Reviewer_tqbT", "summary": "This paper introduces an approach for defending machine learning models against adversarial attacks using transformer-based vision models. The proposed method, Continuous Transfer and Defense (CeTaD), leverages pre-trained transformers as defenders to provide rapid and effective adversarial protection. The approach is evaluated on various datasets, including MNIST, CIFAR-10, CIFAR-100, and ImageNet-1K, to demonstrate its adaptability and effectiveness across different scenarios. However, the approach leads to some impact on classification accuracy.", "questions": "1. What are the specific computational requirements for deploying CeTaD in a real-time environment (e.g., memory, latency, efficiency), and how do these requirements scale with the size of the dataset?\n2. How does the method handle adversarial examples that are generated using techniques not covered in the evaluation?\n3. How does the model perform on black-box attacks or universal perturbations?", "limitations": "1. The paper notes a notable performance gap for CeTaD, particularly in terms of clean data accuracy, when applying end-to-end tuning.\n2. While the paper discusses the potential for scaling the method to larger datasets, the actual computational efficiency and scalability remain areas for further investigation​.\n3. The current focus is on a single attack method per experiment, which does not fully reflect the diversity of attack methods (e.g., semantic attacks, composite attacks, multiple-threat attacks [1, 2]) encountered in real-world scenarios.\n\n[1] Hosseini and Poovendran. Semantic adversarial examples.\n\n[2] Hsiung et al. Towards compositional adversarial robustness: Generalizing adversarial training to composite semantic perturbations.", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This paper provides extensive empirical evaluations across multiple datasets and models, showcasing the proposed method's robustness and versatility.\n2. The study on transferability of defenders across different datasets and models is insightful, suggesting potential for practical deployment in diverse applications.\n3. The discussion on continuous learning and adaptation against new attacks highlights the method's forward-thinking approach to evolving security challenges.", "weaknesses": "1. There are many works using purification or denoising methods in this field. Thus, the proposed method is not novel enough. \n2. The paper acknowledges that end-to-end tuning in CeTaD can impact clean data performance, which might be a significant drawback in certain applications​.\n3. While the paper evaluates the method on several datasets, the focus remains primarily on image classification tasks. Broader evaluations across other types of tasks and data modalities are needed to fully establish its generalizability.\n4. CeTaD's effectiveness relies heavily on the availability and quality of pre-trained models, which might not always be feasible in every scenario.\n5. The paper lacks a comprehensive discussion of related works in the field, especially those that use denoising layers and plug-and-play mechanisms.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for your careful review and insightful comments. We provide a point-to-point response to your concerns.\n\n**1. related methods & novelty**\n\nAs a very promising line of technique, there are indeed existing works in purification and denoising methods, which we introduce in our paper (e.g., L40-L48). That being said, our paper tackles a more challenging scenario and provides innovative technical developments. Specifically, we overcome the hurdle that existing defenses are not sufficiently capable of rapidly defending with limited data or adapting to different application scenarios. Our proposed method features the following novel designs: 1) the pre-trained model is applied for robustness; 2) limited tuning with only few-shot adversarial samples is utilized for rapid scenario adaptation; 3) most parameters are fixed to maintain clean accuracy. These new technical designs yield better performance in robustness and generalization when compared to existing methods. Additionally, our method has the potential to support many extensions for better future work, as elaborated in the Discussion (L365-L392). Thus, we believe our proposed method is contributive enough.\n\n\n**2. clean data performance**\n\nWe would like to clarify that it is an inevitable tradeoff between generalization performance and robustness enhancement as widely acknowledged in literature, which explains the decreased accuracy on clean samples. Our method actually achieves a better tradeoff under a more challenging problem setting. That is, with only limited adversarial data for tuning, our method outperforms other possible methods in balancing both clean and adversarial accuracy (Table 2).\n\nBesides, our method shows the capability to gradually recover the performance of clean data with more samples for training (L346-L353; Table 11) or continous Attack&Defense (L354-L363; Table 12).\n\n**3. other tasks and data modalities**\n\nThank you very much for your suggestions. \n\nWe comprehensively evaluate and analyze our method on different image classification datasets, ensuring the extensiveness of our empirical validation. Additionally, we choose to focus on attacks against the image classification task because they present one of the most significant threats due to the versatile and advanced capabilities of these attacks nowadays, which have already raised significant challenges for the design of defense mechanisms. Therefore, although we agree that it is a valuable future direction to study defenses against attacks on other tasks and domains, it does not diminish the significance of our current work. We will provide more discussions about the possibilities for large-scale, multi-task, and multi-modality applications in future work.\n\n\n**4. dependence on high-quality pre-trained models in the specific scenario**\n\nIt is true that some methods rely on high-quality pre-trained models on the specific scenario (such as DiffPure; L45-L48). However, our method does not need a customized pre-trained model for the scenario. In fact, we find an interesting phenomenon: applying BERT (model pre-trained for text) is better than VIT (model pre-trained for image) for the image classification task (Table 2). We think uncustomized parameters matter for robustness here.\n\n**5. requirements for real-time environment**\n\nFor our method, the original model is fixed. Only few-shot samples and limited training are needed. Compared with other methods, ours is neither time-consuming nor computationally expensive. In a specific scenario, detailed requirements (e.g., memory, latency, efficiency) rely on the selected pre-trained model, the quantity of tuning samples, available computational resources, inference settings, and so on.\n\n**6. attacks not covered in the evaluation**\n\nOur method is a general framework that does not restrict the type of attacks. For different attacks, it only requires a small number of adversarial samples without any additional operations. Following related methods, such as [1], we evaluate our method against common attacks, including PGD, AutoAttack, and StAdvAttack. These white-box attacks are stronger than black-box attacks or universal perturbations. The results demonstrate the effectiveness and robustness of our method against these white-box attacks. Moreover, due to the time constraints of rebuttal, we would try to extend more additional evaluations on other attacks in the final version.\n\n[1] Diffusion models for adversarial purification, ICML-22.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "CisjKlA6Z9", "reviewer": "Reviewer_Dpo5", "summary": "This submission studies few-shot tuning-based purification for adversarial defense, especially leveraging pre-trained transformers. By only tuning the normalization layers with few training examples, the proposed defense achieves decent accuracy and robustness.", "questions": "Questions are listed in \"Weaknesses\" section. The most important one is how the proposed method works given the misaligned encoder and decoder module.", "limitations": "Yes, limitations are discussed in Section 5.", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. The problem setting is novel and of practical value. Existing adversarial defense requires much computing and data and lacks generalization. The RaPiD problem is of value.\n\n2. The proposed method has strong empirical performance. By leveraging existing pre-trained transformers and ViT as the purifier and a few examples to fine-tune the layer norm parameters, the proposed defense has strong accuracy and robustness supported by comprehensive experimental evaluation.", "weaknesses": "1. My major concern is the unclear description in both the method description and experimental evaluation (sometimes a bit messy). To name a few:\n\n(1) How does the decoder in Figure 1 work? In my understanding, the decoder should be able to restore the potentially perturbed image. However, existing ViT and language models seem not to be capable of doing so. How does PixelShuffle for superresolution work as a decoder? In my understanding, it should take low-resolution image input which is not provided by the encoder.\n\n(2) What do CA and AA mean? I infer that they are clean accuracy and attacked accuracy in all tables but no place to verify.\n\n(3) When measuring AA, what is the specific attack used? PGD, AutoAttack, and StAdvAttack are mentioned but which one is actually used? Moreover, when using the attack, does the gradient flow go backward through the plug-in defender? When compared with other baselines, this is the required adaptive attack and when compared with other baselines, this defense-then-attack number should be used for fair comparison.\n\n(4) What is StAdv attack? Any setup detail?\n\n(5) What is the dataset in Table 5?\n\n2. The proposed method introduces a large model as a pre-purifier which adds a non-trivial inference overhead. More elaboration on this overhead should be discussed. In what case this overhead can be neglected?\n\nGiven these many unclear points, I lean towards rejection.\n\nMinor:\n1. Table 1: better to mention method names rather than just numbered brackets for compared approaches.\n2. Line 112: hallucinates -> hallucinate", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your careful review and valuable comments. We provide point-to-point clarifications on your concerns below and will incoporate them in the revised version. \n\n**1. framework mechanism**\n\nThe decoder does not need to restore the input. Encoder-decoder is a general framework. Usually, an encoder maps the data of source space into a latent feature, and a decoder maps the latent feature into the target space. For some methods to extract feature, source and target space are the same and the target of decoder is to restore the input. For others, they are different. For example, for a text translation model, source space may be the original language while target space is the target language.\n\nIn our method, the decoder maps latent feature into the space where the original image classification model could correctly work. For efficiency and robustness, we do not want to train a decoder from scratch. Thus, we take PixelShuffle as a simple decoder to adjust channel and size. You could consider PixelShuffle as a fixed&untrainable decoder and we just tuning the encoder to adapt the framework.\n\n**2. CA & AA**\n\nCA is the accuracy on clean data and AA is the accuracy on adversarial data, which can be found in Experimental Setup (L210). We will highlight their definitions to make them clearer.\n\n**3. attack settings**\n\nAs described in Experimental Setup (L208), the default attack is PGD. We also evaluate our method on AutoAttack (Table 5) and StAdvAttack (Table 3). In the continuous Attack&Defense evaluation (L354-L363; Table 12), we simulate the situation that the defender is also leaked. The result shows that both CA and AA are continuously improved, which may support that life-long learning is a potential direction.\n\n**4. StAdvAttack**\n\nWe illustrate all attack methods for evaluation in Experimental Setup (L199-L201). StAdvAttack is a strong attack proposed in [1].\n\n[1] Spatially transformed adversarial examples\n\n**5. the dataset in Table 5**\n\nWe illustrate default settings in Experimental Setup (L208-210). the default dataset is CIFAR-10.\n\n**6. non-trivial inference overhead**\n\nTotally, we agree that the trade-off is important in real-time applications. However, no pains no gains. For RaPiD problem, our method needs much less tuning overhead while outperforms other methods on robustness and generalization. In practical, we could flexibly choose the pre-trained model to balance performance and inference overhead. Besides, there are many speed-up techniques for inference, such as quantization, pruning, and distillation.\n\n**7. Minor**\n\nThank you for your careful proofreading, which greatly helps us improve our paper. We will address the mentioned details in the revised version.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "fpqwimxD5D", "reviewer": "Reviewer_ZnXi", "summary": "The paper proposes CeTaD, a rapid plug-in defender (RaPiD) for deep neural networks (DNNs) against adversarial attacks. It leverages pre-trained transformer models and fine-tunes minimal parameters (e.g., layer normalization) using few-shot clean and adversarial examples. CeTaD aims to quickly counter adversarial perturbations without modifying the deployed model, addressing the limitations of existing methods that require heavy training or struggle to adapt to different scenarios. Experiments on various datasets and attack methods demonstrate CeTaD's effectiveness, transferability, and generalization capabilities.", "questions": "How does CeTaD compare to state-of-the-art defense methods in terms of both effectiveness and efficiency?\nCan CeTaD effectively defend against stronger adaptive attacks where the attacker has access to the defender?\nWhat are the underlying mechanisms that contribute to CeTaD's effectiveness? A more in-depth analysis would be valuable.", "limitations": "NA", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "The paper addresses a practical problem in deep learning security: the need for rapid defense against adversarial attacks without modifying deployed models.\n\nThe proposed CeTaD method is computationally efficient, requiring minimal parameter tuning and few-shot examples.", "weaknesses": "The discussion had limitations of the paper seems to have made this quite clear: It seems that the effectiveness is still not good enough when we consider stronger attacks. It is somewhat unclear how should we compare this with existing defenses", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your review and valuable suggestions. Here is our response to your concerns.\n\n**1. effectiveness and efficiency**\n\nThis paper compares methods capable of implementing RaPiD (Rapid Plug-in Defender) (see L130-L134). As a very promising line of technique, there are indeed existing works in purification and denoising methods, which we introduce in our paper (e.g., L40 to L48). That being said, our paper tackles more challenging scenarios with innovative technical developments. Specifically, we overcome the hurdle that existing defenses are not sufficiently capable of rapidly defending with limited data or adapting to different application scenarios. Our proposed method features the following novel designs: 1) the pre-trained model is applied for robustness; 2) limited tuning with only few-shot adversarial samples is utilized for scenario adaptation; 3) most parameters are fixed to maintain clean accuracy. These new technical designs yield better performance in robustness and generalization when compared to exisiting methods. Additionally, our method has the potential to support many extensions for better future work, as elaborated in the Discussion (Sec.5 Page 9).\n\n**2. stronger attacks**\n\nWe evaluate our method on different attacks including PGD, AutoAttack and StAdvAttack. Besides, in the continuous Attack&Defense evaluation (L354-L363; Table 12), we simulate the situation that the defender is also leaked. The result shows that both CA and AA are continuously improved, which may support that life-long learning is a potential direction. Due to the limited time of the rebuttal period, we would try to extend more additional evaluations on black-box attacks and universal perturbations in the final version.\n\n\n**3. underlying mechanism**\n\nWe have made comprehensive evaluation and analysis on the underlying mechanism of our method. \n\n(L245-251) We do ablation studies on the structure. Linear, FFN, and Bottleneck, being more flexible with additional tuned parameters during training, tend to much bias towards clean data. Conversely, CeTaD’s fixed blocks with fewer tuned parameters, exhibit greater robustness, resulting in superior performance. limited tuning would avoid completely damaging the original capability while adapting the whole framework to the scenario.\n\n(L290-296; L326-L345) We do evaluations on different parameter initializations and frozen parameters. Randomly initialized parameters do not work well and tuning all parameters would ruin the clean accuracy. CeTaD-VIT defenders excel in clean accuracy, while CeTaD-BERT defenders perform better in adversarial scenarios. CeTaD-VIT’s capability from similar training tasks renders it vulnerable to adversarial perturbations, whereas CeTaD-BERT’s diverse training complicates clean classification. Totally, introducing fixed&unrelated structure would improve the robustness.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "VZo9vQtMMM", "reviewer": "Reviewer_tz4d", "summary": "The paper proposes a method called CeTaD (Considering Pre-trained Transformers as Defenders) for the Rapid Plug-in Defender (RaPiD) problem, which aims to rapidly counter adversarial perturbations without altering the deployed model. The method leverages pre-trained transformer models and fine-tunes only a limited set of parameters using clean and adversarial examples.  The paper evaluates the effectiveness of CeTaD in various scenarios and datasets, and compares it with other baselines. The results show that CeTaD achieves superior performance in both clean and adversarial accuracy compared to the baselines. This paper is easy to follow and well-written.", "questions": "/NA", "limitations": "/NA", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "* The proposed CeTaD can rapidly counter adversarial perturbations without altering the deployed model, which addresses an important challenge in the field.\n* The CeTaD uses the pre-trained transformer models, which have strong generalization capabilities, and fine-tunes only a limited set of parameters, making it computationally efficient.\n* Comprehensive evaluation of CeTaD's effectiveness, transferability, and the impact of different components in various scenarios and datasets are validated.", "weaknesses": "* The performance of different l_p bound perturbations should be compared.\n* Actually, there are some old defense methods that can also be a plug-in defense, like JPEG compression, which also should be compared.\n* Some typo errors, like \"Baselines\" should be \"Baselines.\"\n* The placement of Table 4 and Table 5 are too far from the corresponding content.\n* The experiment settings of adaptive attack is not right, in this setting, the plug-in defense is all known to the attacker.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your careful review and overall positive evaluation. Here are our point-by-point responses to your concerns.\n\n**1. l_p settings**\n\nFor the experiments in the current paper, we follow the same attack settings as in the related works. We will compare the performance of different ( l_p ) settings in the revised version, just as you suggested. Essentially, with larger ( l_p ), the clean sample becomes more distorted, the attack is stronger, and the defense is more challenging.\n\n(We follow the same attack settings in the related works. We would compare the performance of different l_p settings in the revised version. Basically, with larger l_p, the clean sample would be more distorted, the attack is stronger while the defense is more difficult.)\n\n**2. some old defense methods**\n\nOur evaluation includes naive and training-free defense methods such as Random Noise [30] and R&P [43] (Table 2&3). Random Noise adds zero-mean normal distribution noise; R&P employs random resizing and padding, which is similar to JPEG compression. Results show that Random Noise could not balance clean&adversarial accuracy while R&P keeps high clean accuracy but has little effect on adversarial accuracy. JPEG compression is also poor on adversarial accuracy. Under the setting of Table 2, here's the performance of JPEG compression by changing the quality factor:\n\n\nquality factor| CA(%) | AA(%)\n--- | --- | ---\n90 | 90.63 | 01.37\n60 | 88.48 | 09.77\n40 | 86.72 | 10.55\n30 | 86.33 | 09.96\n10 | 82.62 | 08.98\n1 | 71.09 | 06.45\n\nTo conclude, these older methods do not work well in the RaPiD scenario, which is more practical yet challenging.\n\n\n**3. typo errors & table replacement**\n\nWe will thoroughly proofread our paper to address all typos and adjust the table placement for better legibility in the revised version.\n\n**4. settings of adaptive attack**\n\nUnlike related works, our method requires limited tuning on few-shot adversarial samples, which may make continuous Attack & Defense possible and slightly different from usual adaptive attacks. In continuous Attack & Defense (Table 12), the plug-in defense in the last round is known to the attacker. We will clarify and emphasize this point in the revised version.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: The recommendation is based on the reviewers' comments, the area chair's evaluation, and the author-reviewer discussion. 

While all reviewers find the studied setting useful and the results provide new insights, in the initial round, reviewers raised several valid questions on the scope and empirical validation. The authors' rebuttal was quite successful and addressed the major concerns of all reviewers. In the final discussion phase, all reviewers suggest that the new results (especially those presented during rebuttal) must be included in the final paper to reach the bar of the publication, which requires a major revision (this will be discussed with SAC). If this paper is to be accepted, we strongly suggest the authors include the new results and improve the presentation for the final version.
Decision: Accept (poster)