Few-Shot Adversarial Prompt Learning on Vision-Language Models
Authors: Yiwei Zhou
Xiaobo Xia
Zhiwei Lin
Bo Han
Tongliang Liu
Venue: NeurIPS 2024 poster (2024)
Keywords: Adversarial Robustness
Prompt Learning
Vision-Language Models
Primary area: safety_in_machine_learning

Abstract: The vulnerability of deep neural networks to imperceptible adversarial perturbations has attracted widespread attention. Inspired by the success of vision-language foundation models, previous efforts achieved zero-shot adversarial robustness by aligning adversarial visual features with text supervision. However, in practice, they are still unsatisfactory due to several issues, including heavy adaptation cost, suboptimal text supervision, and uncontrolled natural generalization capacity. In this paper, to address these issues, we propose a few-shot adversarial prompt framework where adapting input sequences with limited data makes significant adversarial robustness improvement. Specifically, we achieve this by providing adversarially correlated text supervision that is end-to-end learned from adversarial examples. We also propose a novel training objective that enhances the consistency of multi-modal features while encourages differentiated uni-modal features between natural and adversarial examples. The proposed framework gives access to learn adversarial text supervision, which provides superior cross-modal adversarial alignment and matches state-of-the-art zero-shot adversarial robustness with only 1\% training data. Code is available at: https://github.com/lionel-w2/FAP.

Few-Shot Adversarial Prompt Learning on Vision-Language Models
Yiwei Zhou
Xiaobo Xia Sydney AI Centre University of Sydney xiaoboxia. uni @gmail com
School of Automation Beijing Institute of Technology zhouyiwei@ba wwitteiiibi...... edu.
Zhiwei Lin" School Automation Beijing Institute of Technology Ainzhwei@bii edu. cn
Bo Han
Department of Computer Science
Hong Kong Baptist University bhanm1 @comp. hkbu. edu. hk
Tongliang Liu" Sydney Al Centre
University of Sydney
tongliang www.sydneyy....m edu.au
Abstract
The vulnerability deep neural networks to imperceptible adversarial perturbations has attracted widespread attention. Inspired by the success of vision-languan foundation models, previous efforts achieved zero-shot adversarial robustness by aligning adversarial visual features with text supervision. However, in practice, they are still unsatisfactory due to several issues, including heavy adaptation cost, suboptimal text supervision, and uncontrolled natural generalization capacity. In this paper, address these issues, we propose a few-shot adversarial prompt framework where adapting input sequences with limited data makes significant adversarial robustness improvement. Specifically, we achieve this by providing adversarially correlated text supervision that is end-to-end learned from adversarial examples. We also propose a novel training objective that enhances the consistency of multi-mont modil features while encourages differentiated uni-modal features between natural and adversarial examples. The proposed framework gives access to learn adversarial text supervision, which provides superior cross-modal adversarial alignment and matches state-of-the-art zero-shot adversarial robustness with only 1% training data. Code available at: https///gittb..com/iioo/////
Introduction
The seminal works [1, 2] reveal that adversarial examples [2], consisting of malicious perturbations imperceptible to humans, can easily mislead state-of-the-art deep neural networks (DNNs) [3-6] into making incorrect predictions. This vulnerability limits the application of DNNs in safety-critical areas, such as medicine [7], healthcare [8], and autonomous driving [9].
Human cognition is immune to the distribution variations induced by adversarial attacks, reflecting fundamental difference between human and machine cognitive understanding. Humans primarily
"Coreesonniig author: Tongliang Liu (tongliang. liu @ sydney.edu.aau) and Zhiwei Lin (linzhiwei @ bit.edu.cn)
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

rely on semantic information [10] from the context, while machines depend more on statistical distributional associations. Consequently, recent work [11] introduces text supervision in adversarial adaptation through foundational vision language models (VI.Ms) [12-19], enhancing adversarial robustness with improved semantic understanding. Specifically, they adapt visual prompts by aligning adversarial visual features with static text supervision from the CLIP model [12]. By narrowing the
gap in the probability distribution between adversarial text-image logits and the ground-truth label, they achieve zero-shot adversarial robustness in downstream tasks.
However, although some progress has been made with the previous method, there are still three limitations to overcome before leveraging context to mitigate adversarial vulnerabilities. First, zero- shot adversarial robustness in downstream tasks stems from aligning image and text embeddings on scage generic datasets like the entire ImageNet [20] through adversarial adaptation, which necessitates huge amount of time and computational resources. Second, static hand-crafted text hints, providing only content-related information while disregarding
prompts lack adversary-relate adversarial components. Finally, the current adaptation method only considers adversarial inputs while disregarding natural inputs. On the one hand, it fails to account for the relationship and distinctions between natural and adversarial examples, potentially leading to catastrophic forgetting of natural generalization during adversarial adaptation. Worse still, if there are distributional discrepancies in the downstream datasets, the constrained natural generalization could hinder the learning of robustness.
To address these issues, we propose F Few-shot Adversarial Prompt learning (FAP) framework where pre-trained VLMs are adversarially adapted in a few-shot manner [21, 22] with prompt learning [23- this
28). This adapts the inputs rather than the parameters of the model. To the best of our the first time to learn adversarial robustness from the perspective of few-shot prompt tuning. Due to the scarcity of data for establishing robust decision boundaries, the robust representations learned by existing adversarial visual prompt methods [11] are far from satisfactory. This leads us to rethink how to provide appropriate prompts for adversarial examples. Instead of using static hand-crafted text prompts, we propose to learn adversarially correlated text supervision end-to-end from adversarial examples. Moreover, we design a novel training objective that harmonizes the connection and distinction of natural and adversarial features from information across different modalities. That is, we force the mudti- features of natural and adversarial inputs to be consistent while encouraging the differentiation between uni uni-modal embeddings.
Compared to existing methods, our method has several advantages. (1) It significantly reduces the dependence on abundant data, as both text supervision and learning objectives are adversarially correlated with visual embeddings, providing better alignment to establish robust generalization from limited examples. By adapting with a 16-shot subset from ImageNet-IK, we achieve comparable zero-shot robustness in downstream tasks using only 1% training data. (2) We provide adversarially correlated text supervision learned end-to-end from adversarial examples, which notably improves the alignment between visual and textual embeddings, making superior zero-shot adversarial robustness. (3) Our novel training objective fully leverages the dual-encoder architectural advantage of CLIP. It enhances cross modal consistency between natural and adversarial examples to avoid potential robustness generalization failures, while encourages uni-modal divergence to introduce an adversarial aware mechanism that aids in learning adversarial text supervision.
Before delving into details, we clearly summarize our contributions as follows. (1) We focus on realistic and important research problem and discuss three major issues in previous adversarial prompt learning paradigms, potentially inspiring further improvements in this area. (2) To tackle these issues, we propose novel adversarial few-shot prompt learning framework with learnable adversarial text supervision and an adversarial-ane aware prompt learning objective. This method is lightweight yet makes significant adversarial generalizations. (3) We justify claims through series of experiments on 11 benchmark datasets covering multiple recognition tasks. The proposed method significantly outperforms state-of-the-art adversarial prompt learning methods in adversarial few-shot learning, adversarial zero-shot transfer, and adversarial tose-to-new generalization settings. Comprehensive ablation studies and discussions are also provided in Section 4.3 and Appendix D.
2 Preliminary
CLIP recap. A pre-trained CLIP model typically includes an image encoder I with learned parame- ters Oz and text encoder T with learned parameters 07. Here we consider a K K-class classification
2

---

problem for an image x and its corresponding label E {1..... [i, x first divided into M patches and converted into the patch embeddings e(x). class token Cets is then appended to the patch sequence e(x) = {Cets é1 (x).... eM (x)]. Afterward, the image encoder I processes this embedded patch sequence with ViT [29] blocks to produce the latent image feature representation z( [[e(x): 0z). For the text branch, we prepare hand-craft prompts t; E t = ftt.................... ,tx by appending the class name to word template, such as 'a photo of a fclass]'. Subsequently, t, is tokenized and embedded as w(t,) = fwr(t)). (ft)..... ......... wy wy(t)), i), where corresponds the i-th class. The text encoder T then encodes these work embeddings into the latent text feature representation z! (t.)) = (ww(ti);;7) For zero-shot classification, the probability of the image x in the i-th class
J. To perform zero-shot evaluation,
p(u xi exp (cos (z(1)2((1))
2((1)) /T) ΣØ= exp (cos (z(1), 2(1)))
(I)
((())) /T)
where cos (.,-) denotes the cosine similarity score and T is the temperature parameter.
CLIP-based prompt learning, Instead of adopting hand-crafted prompt, prompt learning attempts to train lightweight learnable prompts Pt with a few examples from downstream data. To be concrete, P: is inserted into word embeddings as w(t,, Pt) = {Pe, w1 (t,).... WN (f4), a}. Then, the text feature representation is (t.. (Tw Pa); 0r). To preserve the alignment characteristics of the joint image-text feature space for zero-shot capabilities, CLIPP-ased prompt learning optimizes the prompt tokens by narrowing the gap in the distribution between text-image logits and the ground-truth label using cross-entropy:
arg min (xxx LCB (cos(z ,2 ((.P)))) Pt.
P
where cos(2!!) Pt) corresponds the text-image logits. We suggest readers check Zhou et al. [28] for more details about CLIP-based prompt learning.
Adversarial visual prompt. Adversarial prompt learning optimizes prompt tokens through adver- sarial training, enhancing model robustness in a relatively small adaptation cost without altering the pre-trained model. Mao et al. [11] achieves this by adjusting the visual prompt of adversarial images in joint text-image feature space. Notably, owing to the application of text-image contrastive loss dur- ing the generation of adversarial examples, the adapted model reveals zero-shot adversarial robustness on downstream tasks. Formally, let (X' dx=) be the input feature space X' with the infinity distance metric, where do (x,x)
x x' Adversarial data & falls in to close ball (x) of radius centered at x E X. That is, B, (x) = fx' E X' dx (x,x)) S c). The learnable image prompt P, is inserted to the visual patch embedding of x, e(x, P.) {cats: Po, ei (xa)....ee Then, adversarial data x is generated by maximizing the text-image contrastive loss as
x= arg max LCE XEB. (x)
()))))
where P(..P)) = P.); 0z). The learnable prompt token P. is optimized given the adversarial example x, hand-craft prompts and ground-truth -tuth label y. by minimizing the adversarial text-image contrastive loss:
P arg min FCE (cos(z(l.P)) .t).)) (.). P.
Here, Len (L)s( t). y) is defined as text-image contrastive adversarial training (TeCoA) loss by Mao al. [11] that highlights adversarial text-image alignment.
Drawbacks of previous methods. Despite the promising zero-shot adversarial robustness achieved through adversarial visual prompts, certain inherent characteristics impede its widespread application.
(1) The zero-shot adversarial robustness in downstream tasks originates from the alignment of image and text embedding on large-scale generic dataset like the entire ImageNet during prompt tuning. This necessitates an extensive amount of training data and employs prompts of considerable size (token-level prompts with a size of 200), which not only causes significant prompt-related overhead but also precludes the benefits of lightweight adaptation on the top of the pre-trained models that prompt tuning typically offers.
3

---

Image Cncoder Adversurial Example
Adveruey
Shonc Enbeddng
Projection
Enoddr
eN
Tanel
Froam
Bivoed Tobeediic
Tixt Pilioiiii
Label
CxI.
Locc
Text Encoder
LCB
Image Encoder Narural Exomple
Figure 1: The overview of the proposed Few-shot Adversarial Prompt learning (FAP) framework. Note that only prompt tokens well as the deep projections from image of the model is frozen. Our method promotes a consistent cross-modal similarity distribution between natural and adversarial examples, while encouraging differences uni-modal representations. The udversarial-awar text supervision learned in this manner can better align ad adversarial features and establish robust decision boundaries with limited number of examples. The natural and adversarial forward processes of the image encoder share parameters.
tuned while the rest
(2) Due to the distinet visual representation distribution between clean and adversarial examples, static hand-crafted prompts lack adversary-related hints, thereby only providing content-related information without effectively supervising the adversarial components contained in the images. However, manually adjusting hand-crafted prompts inject additional adversarial hints is also challenging, the imperceptibility of adversarial perturbations limits their feature description, and the intensity and distribution these perturbations are variable throughout the training process.
(3) The current learning objective directly trains to provide prompts with adversarial examples, yet overlooks the model capacity for natural generalization in downstream tasks. This presents potential risk of failure, especially in the context of few-shot prompt tuning where the pre-trained model shows inadequate natural generalization on sampled few-shot dataset.
Method
Overview. To address the limitations of previous methods, we propose FAP, few-shot adversarial prompt learning framework. Our framework uses lightweight learnable prompts on the top of the pre-trained CLIP in a few-shot manner, as the case in natural prompt tuning [28]. In more detail, we introduce learnable prompt tokens for adversarial examples, which allows the model to provide more appropriate text supervision that helps balance natural and adversarial generalization. Based on CLIP's dual-encoder architecture, further provide novel training objective that guides the discrimination of natural and adversarial embeddings in uni-modal feature space. This promotes uni uni-modal divergence to incorporate adversarial-ane -wware mechanism, facilitating the learning of adversarial text supervision. The overview of the proposed framework is provided in Figure 1. Below, discuss the FAP framework step by step.
3.1 Learnable Text Supervision for Adversarial Examples
When adapting the CLIP model, a slight change in wording could have huge impact perfor- mance [28]. With the existence of adversarial examples, the situation has become worse. The distribution differences between natural and adversarial examples necessitate the design of special-

---

ized text supervision specifically for adversarial samples, Therefore, we introduce text prompt tokens that are end-to-end learned through adversarial examples.
Formally, our adversarial prompt learning is implemented on a few-shot subset S, created by sampling m examples from each of the K classes in the original dataset. Learnable prompts consist of both visual and text branches, denoted as P = {P.. Pt). The visual prompt token P. is incorporated into the image embedding, as observed in an adversarial visual prompt, while text prompt token Pt is inserted into word embedding, as is the case in natural prompt learning. To preserve mutual synergy between visual and text branchs, Pt is obtained from P. through linear projection h, which can be denoted as Pt h (P.). The proposed framework can be categorized as a cross-mode modal prompt [30] with minimal modification for adversarial robustness tasks. We offer a comprehensive analysis of the prompt design in Section 4.3.
3.2 Balancing Natural and Adversarial Generalization in Few-Shot Adversarial Prompt
For adapting the CLIP model to adversarial robustness tasks, the existing method [11] proposes the TeCoA loss (4). This method minimizes the discrepancy between the distribution of adversarial text-image similarity and one-hot ground-truth labels. While this strategy effectively aligns text representations during adversarial adaptation, potentially compromises the model's generalization ability in specific recognition tasks under few-shot conditions.
The method's effectiveness depends the similarity between the downstream task's distribution and the pre-trained representations. When the downstream task closely aligns with the pre-trained representation, the CLIP model shows preferable natural generalization, and adding learnable prompts for robustness adaptation is advantageous. However, a significant mismatch between the downstream distribution and pre-trained representations challenges the CLIP model's natural generalization capabilities. In such cases, expecting prompt tokens to learn both natural and robust generalization from a few adversarial examples is overly ambitious.
Balancing natural and adversarial generalization. Inspired by the success of TRADES [31] in standard adversarial training, we propose a surrogate adversarial text-image contrastive loss that decouples the adversarial text-image contrastive loss into natural and adversarial terms. By encoding image and text embeddings with their respective transformer encoder and calculating similarity across modality, we have the natural and adversarial text-image logits: (os(z(".P)), 2(t.P)) and cos(2 (1.P),,, z(t.Pt)), where z (t. (tt)). Pt),,....... ..... ((,, P))). The learning objective can be stated as:
C= LCF
CCCC((cos(2 (cos(z
2(t.P))), (2)
+ ALxi. (cos(z (o))
((t,P)),, cos(?! 2(t...)))) (5)
where CKI. denotes the Kullback-Leibler (KL) divergence and is a weight parameter. In Eq, (5), the first term encourages minimizing the natural error between the natural text-image similarity and label. The second term minimizes the boundary error by narrowing the distribution gap between natural and adversarial rext-image similarity to ensure cross-modal adversarial consistency. Note that balanced two-term objective is crucial for downstream generalization, as this design alleviates the potential failure in robustness caused by discrepancies in natural generalization. We provide more analysis on the natural generalization gap in Appendix D.2.
3.3 Uni-Modal Adversarial-Aaare Mechanism
To fully leverage the structural advantages of CLIP, we go beyond enforcing consistency constraints on cross-modal text-image features and tailor adversarial robustness enhancements for uni-modal features. Specifically, we introduce an adversarial -wware mechanism for visual features, guiding the distinction between natural and adversarial examples. To the best of our knowledge, this is the first initiative to foster differentiated representations in adversarial regularization.
Given the distinct distributions of natural and adversarial examples, we argue that driving consistent outputs for natural and adversarial examples in visual models constitutes a compromise, trading off generalization for robustness. In contrast, within CLIP, we achieve robustness by maintaining adversarial consistency the text-image joint space with the adversarial term Eq. (5), while preserving the distributional differences of features in the uni-modal visual space to minimize the
5

---

impact on generalization performance. Here, we append an extra constraint on the adversarial term with cosine similarity:
Lees cos (2(..P),z(..P)) 2(...)) 1,
(6)
where the constant maintains the non-negativit of Less- We introduce the adversarial-aware mechanism by adjusting prompt tokens to minimize similarity, thereby distinctly differentiating between natural and adversarial visual features. During the training process, the text branch learns to provide proper text supervision for different visual features, ensuring that the outputs in the text-image joint space are consistent for natural and adversarial embeddings, which have significant distributional differences in the visual space.
3.4 Overall Learning Objective
Objective for outer minimization. The overall training objective can be obtained by introducing uni-modal adversarial aware mechanism Loos to Eq. (5) as:
Limal = Lce ( (cos(2().o). 2((,Pi)), + XLoos LKL (cos(z(1.Pt) ((t, (2) 2(t.Pi)))
Objective for inner maximization. The goal of inner maximization is to generate the adversarial example x. Here, we leverage the adversarial term in Eq. (5) as this surrogate loss and find the adversarial example x as follows:
X arg max LKT. (cos(z(1.P.) (t.P))),, cos(Z(7.Po) (tt.P3))) (x
(8)
Note that strong attacks can help robustness. Here, the general PGD attack formulation with the CE loss like Eq. (3) is also applicable. With the learning objective outlined in Eq. (7), we adapt learnable prompt P = (Pp, P. tokens on the few-shot dataset S as:
P = arg min (x.)))
(9)
P
3.5 Intuition behind Objective Design
Our learning objective highlights the differentiated processing of features under different modalities, in which we introduce an additional adversarial-awe mechanism with uni-modal image features. We discuss the intuition behind the design concept. We visualize the uni-modal embedding to demonstrate the impact of the adversarial- aware mechanism on the model's 's feature learning.
In Figure 2a, find that certain ad- versarial embeddings closely resem- ble natural examples. This suggests that the consistency of cross-modal features between natural and adversar- ial examples arises from the model's tendency to minimize loss by gen- erating minimal adversarial pertur- bations. These exceedingly small perturbations do not effectively pro- mote robust learning. contrast, the adversarial-awarg mechanism clearly separates the natural and adversarial embeddings in Figure 2b, preventing the minimal perturbation shortcut and guiding the model to recognize the differences between natural and ad- versarial image embeddings.
(a) Uni-modal embed- dings learned without the adversarial-aware term.
(b) Uni-modal embeddings learned with the adversarial- aware term.
Figure 2: Visualization of the natural image embedding, ad- versarial image embedding, and text embedding after tuning with and without the adversarial-aware term. Images sampled from the same class the 101tech101 dataset [32].
For better understanding, we discuss different training objective designs and their results Section 4.3 and describe our adversarial prompt learning and adversarial prompt testing pipeline in Appendix A. Additionally, we demonstrate the significant robustness gains our learning objective brings to other prompt designs through case study. More details can be checked in Appendix D.4.

---

4 Experiments
4.1 Setups
Baselines. To demonstrate the expertise of the proposed method, we employ the adversarial version of multiple commonly used prompt learning designs for comparison. We categorize baselines into two groups: (1) Methods using hand-crafted text supervision, such as zero-shot CLIP [12] and
AdvVP [11]. (2) Methods utilizing learnable text prompts, including AdvVLP and AdvMaPLe [30]. Note that we primarily focus on learnable prompts extending the AdvVP framework. Details on pure text prompt effects in adversarial settings (AdvTP) [28] are discussed in Appendix D.I1.
Additional information about these methods and static prompt templates for each dataset are provided in Appendices C.1 and C.2, respectively.
Datasets. To evaluate the proposed method, we align with previous works [28, 33] and utilize 11 diverse image recognition datasets that span multiple vision tasks. Specifically, the datasets include two generic object datasets: ImageNet- K [20] and Caltech101 [32]; a texture recognition dataset: DTD [34]; five fine-grained object recognition datasets: FGVCAircraft [35], OxfordPets (36),
Flowers 102 [37], Food101 [38], and StanfordCars [39]; a scene recognition dataset: SUN397 [40]; an
action recognition dataset: UCFI01 [41]; and satellite image classification dataset: AuroSAT [42].
Implementation details. We conduct experiments on the ViT-B/32 CLIP architecture and report the average results over three random seeds. All models trained for 5 epochs in cross- dataset evaluation and 10 epochs for other benchmark settings by using an SGD optimizer with a momentum of 0.9. The initial learning rate is set 0.0035. We apply cosine learning rate scheduler and warm-up strategy during the first epoch. For adversarial prompt learning, we use token prompts of size 2 in both the vision and text branches across the first 9 transformer blocks. Attacks generated under fxx threat model through a 2-step PGD attack, with a perturbation boundary = 1/255 and a step size 1 1/255, following the methodologies outlined in [11]. The adversarial robustness is evaluated using a 100-step PGD attack.
Note that due to the limited space of the main paper, we provide comprehensive evaluations, including cross-dataset evaluation (Appendix D.I), the comparison with AdvMaPLe (Appendix D.3), alternative CLIP architectures (Appendix D.5), different attack strengths (Appendix D.6), various choices of adversarial robustness evaluation methods (Appendix D.7), and different training-tine time attack generation (Appendix D.8).
4.2 Main Results
Adversarial few-shot learning. In this scenario, we evaluate the model's ability to develop robust representations with a severely limited amount of downstream data. Specifically, tune the model using (1, 2, 4, 8, 16] shots from each class. As shown in Figure 3, the static text prompt of bascline method struggles
align with adversarial input images under few-shot setting. Even with an increased number of training samples, the model's performance fails to improve, indicating difficulties in adversarial learning. Adv and AdvMaPLe, through end-to-ene learning of adversarial text prompt tokens from adversarial examples, have acquired the capability to adjust prompts from limited samples to gain adversarial robustness. By further training with our proposed objective, our method achieves superior average natural and adversarial accuracy across datasets.
Adversarial base-to-new generalization. We present more challenging adversarial base-to-new generalization setting, where datasets are bifurcated into base and new subclasses. Here, models are trained with 16-shot dataset from the base classes and are subsequently evaluated both base and new classes. In this setting, as the number of categorics in datasets is generally much smaller than the number of examples per class, models need to learn intrinsic features within each dataset and robust representations from limited examples to effectively generalize large amounts of test data.
From Table 1, we observe that our method not only surpasses all its counterparts in robust metrics, but also reveals superior natural generalization due to the joint consideration of natural and robust features in our training objective. Additionally, our method also reveals much better stability (lower standard deviation). That is, even sampled few-shot subset has a natural generalization gap, our learning objective still works well and prevents potential failure.
7

---

(a) Average on 11 Datasets
(b) ImageNet-
(c) Caltech101
(d) Flowers 102
(e) DTD
(I) Food101
EuroSAT
(h) OxfordPets
(i) FGVCAircrat
(i StanfordCars
(k) SUN397
(I) UCF101
Figure 3: Accuracy (%) of adversarial few-shot learning on 11 datasets. The dots represent the result of each experiment and lines reveal the trend of the average results from three trials under each setting with respect to the shot numbers. each subfigure, we report the natural accuracy (dashed line) in the upper half, and the robust accuracy (solid line) in the lower half. Statistical results of standard deviations across multiple trials are included in Appendix D.9.
Table 1: Adversarial base-to-new Generalization performance. We report the average result of the Base Natural Accuracy (%), Base Adversarial Accuracy (%), New Natural Accuracy (%), and New Adversarial Accuracy (%) on 11 datasets. Detailed results for each dataset are provided in Appendix D.10.
Base Class
New Class
Method
Base Nat Acc
Base Adv Ace
New Nat Acc
New Adv Acc
AdvVP
31.68
14.43.12.26
30.39-16.40
13.36-2.80
AdvVLP
38.95+111.67
32.37:6.67
46.92+7.41
21.61=3.86
AdyMaPLe
60,38 8.03 70.52=0.82
30.69:14.71
46.18-16.39
20.25-33.39
FAP
38.05:22.15
49.58
21.86=2.57
Matching Benchmark Zero-Shot Results Adapted with ImageNet-1IK In addition to comparing with the baseline AdvVP under few-shot settings, also benchmark against zero-shot results, where robustness is evaluated through cross-datats evaluations. Initially adapted on ImageNet-1K, our method does not require adaptation across the entire dataset nor extensive prompt designs like the AdvVP [11], which uses embedding token prompts of size 200 and pixel-level pad prompters of size 40. As shown in Table 2, our method aligns with benchmark performance using just 1.25% of IetgeNet-1 K examples, significantly accelerating the training process by over 97%. Moreover, enhancements from 16-shot to 32-shot training and deepening prompt layers from to 12 allow our method to exceed previous adversarial prompt tuning results.

---

Table Comparison with benchmark result [11] which adapts models on the entire ImageNet- I K. We report the average natural and robust accuracy across downstream datasets. Running time is computed on a single NVIDIA RTX A40 GPU.
Average on Downstream Dataset
Method
Dataset
Params (/)
Time (/Day)
Natural Ace (S)
PGD 100 Ace (%)
Vd
16-sbot (1 (1.25%)
0.07
0.65
41.96
12.97
Adv
Entire (100%)
0.24
25.21
FAP
16-shor 25%)
0,42
0.71
48.18
25.06
FAP
32-sbor (2.49%)
0.43
1.43
49,93
25.39
4.3 More Analysis
Trade-off between natural and adversarial robustness. Aligning with the decoupled form of classical adversarial training [31], J. our prompt objective incorporates two terms that ensure the generalization of natural examples and the consistency of robust representations. This motivates to investigate the trade-off between natural and adversarial robustness, and to dynamically adjust this trade-off depending on the desired level of adversarial robustness.
From Table 3, we can conclude that as À in- creases, the proportion of the adversarial com- ponent in the total loss increases, and the natural accuracy declines continuously. Meanwhile, ad- versarial robustness gradually improves, reflect- ing the trade-off between natural and adversarial
Table 3: Adversarial base-to-new generalization performance (%) w.r.t. different À values.
Base Class
New Class
Adv Ase
New Ace
New
1.0
71.95
36,31
52.47
22.34
generalization. However, when À becomes too large (A 2.5), continuing to increase the pro- portion of the adversarial component does not
1.5
70.60
39.15
51.79
23.65
2.0
46.99
23.73
2,5
68.44
41.38
48.49
23,90
3.0
67.15
40:58
46.15
22.84
41.57
20.64
lead to further improvements in robustness.
Prompt depth and prompt length. We provide architectural ablation results for prompt design concerning different prompt depth and length settings. In Table 4, observe that increasing both prompt depth and prompt length introduces more learnable parameters, thereby resulting in improved performance. Furthermore,
also conclude that the performance gain obtained by increasing prompt depth is higher than that achieved by increasing prompt length, and the improvement in robustness metric is larger than in natural accuracy.
Ablation for training objective design. In Sec- tion 3.4, present proposed novel training objective tailored for adversarial prompt learn- ing. Our loss follows two-term design, com- prising a natural term and an adversarial term. The adversarial term further considers both the consistency and diversity of natural and adver- sarial features. In practice, we KL diver- gence to constrain cross-modal consistency and encourage uni-modal diversity with cosine sim- ilarity. In Table 5, we present other possible designs for the loss function and conduct an ab- lation study under the adversarial base-to-new setting. across all these loss function settings.
Table 4: Natural and robust performance (%) w.r.t. different prompt depth and length settings. Results are obtained in under 16 16-shot adversarial prompt learning StanfordCars.
Prompt Depth
Prompt Length
Nums
Natural
PGD-100
Natural
PGD-100
2
71.60
19:00
82.60
56.90
4
75.50
41.50
85.30
59,20
77.50
$
80.10
$2.50
84.00
60.00
10
82,20
58.00
84.90
60.90
$7.30
Our method provides the best robustness
Instability analysis for deep prompt interaction. We report an instability of generalization performance caused by the improper deep prompt interaction, revealing that the standard modal prompt interaction design, from text to image prompt token, is not and--and-play under the setting of adversarial robustness. When natural and adversarial terms ratio the learning objective, the performance of the model may experience a significant decline. From Figure different datasets, and the values of À leading to this instability are also different. For instance, on some generic datasets, the performance degradation it usually brings is not significant (Figure 4c). However, on some fine-grained datasets, the significant performance degradation caused by this instability is unacceptable (Figure 4b).
present in certain moderate
find that the instability intensity caused by the text-to-image design varies across

---

Table 5: Ablation study of base-to-new generalization performance (%) w.r.t different training objective design. Here, TeCoA, JS, KL, MAE, MSE and Cos stand for Text- Contrastive Loss, Jensen-Shannon Divergence, Kullback-Leibler Divergence, Mean Absolute Error, Mean Squared Error and Cosine Similarity, respectively.
Adversarial term
Natural term
Consistency
Diversity
Base Nut Acc
Base Ady Ace
New Nat Acc
New Adv Acc
TeCoA
57.96
30.10
43.73
19.01
TeCoA
X
48.18
26.57
36.52
16.41
74,02
56.91
20.75
KL
X
71.20
37.70
49.52
21.18
KL
MSE
77.73
20.34
64.73
15:90
74.02
57.41
KI.
Cos
70.60
39.15
51.79
23.65
Datad110
(a) DTD
(b) OxfordPets
(c) Caltech101
Figure 4: Instability analysis for DTD, OxfordPets, and Caltech101. We report the model performance (%) w.r.t the ratio (A) between natural and robust terms in training objectives. The results of deep prompt interaction from text image are plotted in red line, while that from image text are plotted in blue line.
To understand this, we plot the loss curve during the training process un- der both stable and unstable settings. As revealed in Figure in unstable cases, we observe that the robust loss drops to zero early in training and re- mains nearly unchanged at this low level during the mid- phase, while the overall loss does not decrease ex- pected. This suggests the text prompt falls into a trivial local solution dur- ing optimization, equating natural and adversarial logits. This nullifies the adversarial term but overlooks natural generalization, causing consistently high natural loss. This issue typically occurs when the natural and robust terms are balanced in a moderate ratio in the training objective.
1.
(a) Stable Case
(b) Unstable Case
Figure 5: Training loss curve under both stable and unstable settings. We report the total, natural, and robust loss during the whole training stage.
We propose a minimal refinement to prevent instability: switching the deep prompt interaction to an -mage-to-text scenario. Here, the text prompt derived from the image prompt projection, limiting its adaptability. This prevents the adversarial loss from reaching zero, thus avoiding the issue.
Conclusion
In this paper, we focus on adversarial prompt tuning on vision-language models, a domain with significant potential for zero-shot downstream adversarial robustness. We precisely reveal the issues of previous methods that perform adversarial visual prompts with static text supervision. Our method distinguishes itself by introducing learnable adversarial text supervision combined with new training objective, facilitating effective learning few-shot setting. The proposed method enjoys excellent algorithmic properties and matches state-of-the-arr performance, notably with reduced computational demand. We helieve that this work can provide some insights to the community and stimulate further research in this area.
10

---

References
[1] Christian Szegedy, Wojciech Zaremba, llya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfel- low, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv: 1312.6199 2013.
[2] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples. arXiv preprint arXiv:1412.6572, 2014.
[3] Alex Krizhevsky, llya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks. In NeurIPS, 2012.
[4] Kaiming He, Xiangyu Zhang, Shaoging Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, pages 770-778, 2016.
[5] Kaleel Mahmood, Rigel Mahmood, and Marten Van Dijk. On the robustness of vision trans- formers adversarial examples. In ICCV, pages 7838-7847, 2021.
[6] Yinpeng Dong, Huamran Chen, Jiawei Chen, Zhengwei Fang. Xiao Yang. Yichi Zhang, Yu Tian, Hang Su, and Jun Zhu. How robust is google's 's bard to adversarial image attacks? arXiv preprint arXiv:2309. 11751, 2023.
[7] Varun H Buch, Irfan Ahmed, and Mahiben Maruthappu. Artificial intelligence in medicine: current trends and future possibilities. British Journal of General Practice, 68(668):14331444 2018.
[8] Samuel G Finlayson, John Bowers, Joichi Ito, Jonathan L Zittrain, Andrew L Beam, and Isaac S Kohane. Adversarial attacks on medical machine learning. Science, 1663333)) 1289, 2019.
[9] Cumbur Erkan Tuncali, Georgios Fainekos, Hisahiro Ito, and James Kapinski. Simulation-baser adversarial test generation for autonomous vehicles with machine learning components. In 2018 IEEE Intelligent Vehicles Symposium (IV), pages 1555-1562, 2018
[10] Yonggang Zhang, Mingming Gong, Tongliang Liu, Gang Niu, Xinmei Tian, Bo Han, Bernhard Schölkopf, and Kun Zhang. Causaladv: Adversarial robustness through the lens of causality. arXiv preprint 2xKi::/0660661 2021.
[11] Chengzhi Mao, Scott Geng, Junfeng Yang. Xin Wang, and Carl Vondrick. Understanding zero-shot adversarial robustness for large-scale models. arXiv preprint arXiv:2212.07016 2022.
[12] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In JCML, pages 8748-8763, 2021.
[13] Chao Jia, Yinfei Yang, Ye Xia, Yi-Ting Chen, Zarana Parekh, Hieu Pham, Quoe Le, Yun- Yun-Hsuan Sung, Zhen Li, and Tom Duerig. Scaling up visual and vision-language representation learning with noisy text supervision. In ICMI., pages 4904-4916, 2021.
[14] Wonjae Kim, Bokyung Son, and Ildoo Kim. Vilt: Dision-and-language transformer without convolution or region supervision. In ICML, pages 5583-5594, 2021.
[15] Lewei Yao, Runhui Huang, Lu Hou, Guansong Lu, Minzhe Niu. Hang Xu, Xiaodan Liang, Zhenguo Li, Xin Jiang, and Chunjing Xu. Filip: Fine-grained interactive language-image pre-training. arXiv preprint 1xXiv:2111.07788 2021.
[16] Lu Yuan, Dongdong Chen, Yi-Ling Chen, Noel Codella, Xiyang Dai, Jianfeng Gao, Houdong Hu, Xuedong Huang, Boxin Li. Chunyuan Li, al. Florence: A new foundation model for computer vision. arXiv preprint arXiv:2111. 2021.
[17] Junnan Li, Dongxu Li, Caiming Xiong, and Steven Hoi. Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation. In ICMI., pages 12888- 12900, 2022.
11

---

[18] Jiahui Yu, Zirui Wang, Vijay Vasudevan, Legg Yeung, Mojtaba Seyedhosseini. and Yonghui Wu. Coca: Contrastive captioners are image-text foundation models. arXiv preprint arXiv:2205.01917, 2022.
[19] Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. Blip-2: Bootstrapping language- image pre-training with frozen image encoders and large language models. arXiv preprint arXiv:2301.12597, 2023.
[20] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In CVPR, pages 248-255 2009.
[21] Ren Wang, Kaidi Xu, Sijia Liu, Pun-Yu Chen, Tsui-Wei Weng, Chuang Gan, and Meng Wang. On fast adversarial robustness adaptation in model-agnostic meta-learning. arXiv preprint arXiv:2102. 10454, 2021.
[22] Junhao Dong, Yuan Wang, Jian-Huang Lai, and Xiaohua Xie. Improving adversarially robust few-shot image classification with generalizable representations. In CVPR, pages 2022.
[23] Brian Lester, Rami Al-Rfou, and Noah Constant. The power of scale for parameter-efficientt prompt tuning. arXiv preprint arXiv:2 2021.
[24] Xiao Liu, Yanan Zheng, Zhengxiao Du, Ming Ding, Yujie Qian, Zhilin Yang, and Jie Tang. Gpt understands, too. Al Open, 2023.
[25] Pengfei Liu, Weizhe Yuan, Jinlan Fu, Zhengbao Jiang, Hiroaki Hayashi, and Graham Neubig, Pre-train, prompt, and predict: systematic survey of prompting methods in natural language processing. ACM Computing Surveys, 55(9):1-35, 2023.
[26] Menglin Jia, Luming Tang, Bor-Chun Chen, Claire Cardie, Serge Belongie, Bharath Hariharan, and Ser-Nam Lim. Visual prompt tuning. In ECCV, pages 709-727, 2022.
[27] Hyojin Bahng, Ali Jahanian, Swami Sankaranarayanan. and Phillip Isola. Exploring visual prompts for adapting large-scale models. arXiv preprint 2rXiv:2203.172722 2022.
[28) Kaiyang Zhou, Jingkang Yang, Chen Change Loy, and Ziwei Liu. Learning to prompt for vision-language models. International Journal of Computer Vision, 13309))3337-2348 2022.
[29] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.1 1929, 2020.
[30] Muhammad Uzair Khattak, Hanoona Rasheed, Muhammad Maaz, Salman Khan, and Fa- had Shahbaz Khan. Maple: Multi-modal prompt learning. In CVPR, pages 19113-19122 2023.
[31] Hongyang Zhang. Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML, pages 7472-7482, 2019.
[32] Li Fei-Fei, Rob Fergus, and Pietro Perona. Learning generative visual models from few training examples: An incremental bayesian approach tested on 101 object categories. In CVPR workshop, pages 178-178, 2004.
[33] Kaiyang Zhou, Jingkang Yang, Chen Change Loy, and Ziwei Liu, Conditional prompt learning for vision-language models. In CVPR, pages 16816-16825, 2022.
[34] Mircea Cimpoi, Subhransu Maji, lasonas Kokkinos, Sammy Mohamed, and Andrea Vedaldi. Describing textures in the wild. In CVPR, pages 3606-3613, 2014.
[35] Subhransu Maji, Esa Rahtu, Juho Kannala, Matthew Blaschko, and Andrea Vedaldi, Fine- grained visual classification of aircraft. arXiv preprint arXiv:100..751,, 2013.
12

---

[36] Omkar M Parkhi, Andrea Vedaldi, Andrew Zisserman, and CV Jawahar. Cats and dogs. In CVPR, pages 3498-3505, 2012.
[37] Maria-Elena Nilsback and Andrew Zisserman. Automated flower classification over large number of classes. In 2008 Sixth Indian conference on computer vision, graphics & image processing, pages 722-729, 2008
[38] Lukas Bossard. Matthieu Guillaumin, and Luc Van Gool. Food- mood-10--minin discriminative components with random forests. In ECCV, pages 446 461, 2014.
[39] Jonathan Krause, Michael Stark, Jia Deng, and Li Fei-Fei. 3d object representations for fine-grained categorization. In ICCV workshops, pages 554-561, 2013.
[40] Jianxiong Xiao, James Hays, Krista A Ehinger, Aude Oliva, and Antonio Torralba. Sun database: Large-scale scene recognition from abbey z0o. In CVPR, pages 3485-3492, 2010.
[41] Khurram Soomro, Amir Roshan Zamir, and Mubarak Shah. Ucf101: A dataset of 101 human actions classes from videos the wild. arXiv preprint prXiv:1212.0444 2012.
[42] Patrick Helber, Benjamin Bischke, Andreas Dengel, and Damian Borth. Eurosat: A novel dataset and deep learning benchmark for land use and land cover classification, IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing, 12(7):2217-2266, 2019.
[43] Xiaobo Xia, Tongliang Liu, Bo Han, Mingming Gong, Jun Yu, Gang Niu, and Masashi Sugiyama. Instance correction for learning with open-set noisy labels. arXiv preprint 10Xv::2106.00455, 2021.
[44] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint 1Xxi:1706.06088 2017.
[45] Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankanhalli. Attacks which do not kill training make adversarial learning stronger. In ICML, pages 11278-11287, 2020.
[46] Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In ICLR, 2020.
[47] Hongjun Wang and Yisen Wang. Self-ensemble adversarial training for improved robustness. arXiv preprint arXiv:2203.c 09678, 2022.
[48] Ziming Hong, Zhenyi Wang, Shen, Yu Yao, Zhuo Huang, Shiming Chen, Chuanwu Yang, Mingming Gong, and Tongliang Liu. Improving non-transferable representation learning by harnessing content and style. In ICLR, 2024.
[49] Zhuo Huang, Xiaobo Xia, Li Shen, Bo Han, Mingming Gong, Chen Gong, and Tongliang Liu. Harnessing
examples via augmenting content and style. In ICLR, 2023.
[50] Aaron van den Oord, Yazhe Li, and Oriol Vinyals. Representation learning with contrastive predictive coding. arXiv preprint arXiv:1807.000 /807.03748, 2018.
[51] Ting Chen, Simon Komblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In ICML,, pages 1597-1607, 2020.
[52] Xinlei Chen, Haoqi Fan, Ross Girshick, and Kaiming He. Improved baselines with momentum contrastive learning. arXiv preprint 2003:20003002997 2020.
[53] Minseon Kim, Jihoon Tack, and Sung Hwang. Adversarial self-supervised contrastive learning. In NeurlPS, pages 2983-2994 2020.
[54] Ziyu Jiang, Tianlong Chen, Ting Chen, and Zhangyang Wang. Robust pre-training by adversarial contrastive learning. In NeurlPS, pages 16199-16210, 2020.
13

---

[55] Lijie Fan, Sijia Liu, Pin- Yu Chen, Gaoyuan Zhang, and Chuang Gan. When does contrastive learning preserve adversarial robustness from pretraining to finetuning? In NeurIPS, pages
2 21480-21492, 2021.
[56] Qiying Yu, Jieming Lou, Xianyuan Zhan, Qizhang Li, Wangmeng Zuo, Yang Liu, and Jingjing Liu. Adversarial contrastive learning via asymmetric infonce. In ECCV, pages 53-69, 2022.
[57] Chaoning Zhang, Kang Zhang, Chenshuang Zhang, Axi Niu, Jiu Feng. Chang D Yoo, and In So Kweon. Decoupled adversarial contrastive learning for self-supervised adversarial robustness. In ECCV, pages 725-742, 2022.
[58] Xilie Xu, Jingfeng Zhang, Feng Liu, Masashi Sugiyama, and Mohan Kankanhalli. Effi- cient adversarial contrastive learning via robustness-award coreset selection. arXiv preprint arXiv:2302.03887, 2023.
[59] Xilie Xu, Jingfeng Zhang, Feng Liu, Masashi Sugiyama, and Mohan Kankanhalli. Enhanc- ing adversarial contrastive learning via adversarial invariant regularization. arXiv preprint arXiv:2305.00374 2023.
[60] Xiao Li, Wei Zhang, Yining Liu, Zhanhao Hu, Bo Zhang, and Xiaolin Hu. Anchor-based adversarially robust zero-shot learning driven by language. arXiv preprint arXiv:230I. 13096, 2023.
[61] Chaojian Yu. Bo Han, Li Shen, Jun Yu, Chen Gong, Mingming Gong, and Tongliang Liu. Understanding robust overfitting of adversarial training and beyond. In ICML, pages 25595- 25610, 2022.
[62] Chengxiang Yin, Jian Tang, Zhiyuan Xu, and Yanzhi Wang. Adversarial meta-learning. arXiv preprint arXiv: 1806 033 16, 2018
[63] Micah Goldblum, Liam Fowl, and Tom Goldstein. Adversarially robust few-shot learning: A meta-learning approach. In NeurlPS, pages 17886- 17895, 2020.
[64] Akshayvarun Subramanya and Hamed Pirsiavash. A simple approach to adversarial robustness in few-shot image classification. arXiv preprint arXiv:2204.05432. 2022.
[65] Mehmet Kerim Yucel, Ramazan Gokberk Cinbis, and Pinar Duygulu. deep dive into adver- sarial robustness in zero-shot learning. In ECCV, pages 3-21, 2020.
[66] Xingxing Zhang. Shupeng Gui, Jian Jin, Zhenfeng Zhu, and Yao Zhao. Atzsl: Defensive sero-shot recognition in the presence of adversaries. IEEE Transactions on Multimedia, 2023.
[67] Run Luo, Haonan Zhang, Longze Chen, Ting-En Lin, Xiong Liu, Yuchuan Wu, Min Yang. Minzheng Wang, Pengpeng Zeng, Lianli Gao, al. Mmevol: Empowering multimodal large language models with evol-instruct. arXiv preprint wxXiv:2409.05840, 2024.
[68] Run Luo, Yunshui Li, Longze Chen, Wanwei He, Ting-En Lin, Ziqiang Liu, Lei Zhang, Zikai Song. Xiaobo Xia, Tongliang Liu, al. Deem: Diffusion models serve as the eyes of large language models for image perception. arXiv preprint 2rXiv:2455.15232 2024.
[69] Xiaohua Zhai, Xiao Wang, Basil Mustafa, Andreas Steiner, Daniel Keysers, Alexander Kolesnikov, and Lucas Beyer. Lit: Zero-shot transfer with locked-image text tuning. In CVPR, pages 18123-18133, 2022.
[70] Xiuye Gu, Tsung- Yi Lin, Weicheng Kuo, and Yin Cui. Open-vocabulary object detection via vision and language knowledge distillation. arXiv preprint 1rXiv:2/04.139) 2021.
[71] Jiarui Xu. Shalini De Mello, Sifci Liu, Wonmin Byeon, Thomas Breuel, Jan Kautz, and Xiaolong Wang. Groupvit: Semantic segmentation emerges from text supervision. In CVPR. pages 18134-18144, 2022.
[72] Liunian Harold Li, Pengchuan Zhang, Haotian Zhang, Jianwei Yang, Chunyuan Li, Yiwu Zhong, Lijuan Wang, Lu Yuan, Lei Zhang, Jenq-Neng Hwang, et al. Grounded language-image pre-training. In CVPR, pages 10965-10975, 2022.
14

---

[73] Huaishao Luo, Lei Ji, Ming Zhong, Yang Chen, Wen Lei, Nan Duan, and Tianrui Li. Clip4clip: An empirical study of clip for end to end video clip retrieval and captioning. Neurocomputing. 508:293-304, 2022.
[74] Yael Vinker, Ehsan Pajouheshgar. Jessica Y Bo, Roman Christian Bachmann, Amit Haim Bermano, Daniel Cohen-Or Or, Amir Zamir, and Ariel Shamir. Clipasso: Semantically-awart object sketching. ACM Transactions Graphics (TOG), 41(4):1-11, 2022.
[75] Runnan Chen, Youquan Liu, Lingdong Kong, Xinge Zhu, Yuexin Ma, Yikang Li, Yuenan Hou, Yu Qiao, and Wenping Wang. Clip2scene: Towards label-efficient 3d scene understanding by clip. In CVPR, pages 7020-7030, 2023.
[76] Zhaoqing Wang, Xiaobo Xia, Ziye Chen, Xiao He, Yandong Guo, Mingming Gong, and Tongliang Liu. Open- vocabulary segmentation with unpaired mask-text supervision. arXiv preprint 2xXi::2402.08960, 2024.
[77] Benjamin Devillers, Bhavin Choksi, Romain Bielawski, and Rufin VanRullen. Does language help generalization in vision models? arXiv preprint arXiv:2104.08) 2021.
[78] Jiaming Zhang, Qi Yi, and Jitao Sang. Towards adversarial attack on lision-language pre- training models. In ACM MM, pages 5005-5013, 2022.
[79] Zhuo Huang, Chang Liu, Yinpeng Dong, Hang Su, Shibao Zheng, and Tongliang Liu. Machine vision therapy: Multimodal large language models enhance visual robustness via denoising in-context learning. In ICMI,, 2024.
[80] Amir Bar, Yossi Gandelsman, Trevor Darrell, Amir Globerson, and Alexei Efros. Visual prompting via image inpainting. In NeurIPS, pages 25005-25017, 2022.
[81] Yuning Lu, Jianzhuang Liu, Yonggang Zhang, Yajing Liu, and Xinmei Tian. Prompt distribution learning. In CVPR, pages 5206-5215, 2022.
[82] Manli Shu, Weili Nie, De-An Huang, Zhiding Yu, Tom Goldstein, Anima Anandkumar, and Chaowei Xiao. Test-time prompt tuning for zero-shot generalization in vision-language models. In NeurlPS, pages 12274-14299 2022.
[83] Muhammad Uzair Khattak, Syed Talal Wasim, Muzammal Naseer, Salman Khan, Ming-Hsuan Hsuan Yang, and Fahad Shahbaz Khan. Self-regulating prompts: Foundational model adaptation without forgetting. In ICCV, pages 15190-15200, 2023.
[84] Beier Zhu, Yulei Niu, Yucheng Han. Yue Wu, and Hanwang Zhang. Prompt-aligned gradient for prompt tuning. In ICCV, pages 15659-15669, 2023.
[85] Boxi Wu, Jindong Gu, Zhifeng Li, Deng Cai, Xiaofei He, and Wei Liu. Towards efficient adversarial training on vision transformers. In ECCV, pages 307-325, 2022.
[86] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-fre freee attacks. In ICML, pages 2206-221 22162, 2020.
15

---

Appendix
Pipelines of Adversarial Prompt Learning and Testing
17
B Related Work
18
Additional Implementation Details
18
C.1 Additional Implementation Details for Baselines
19
C.2 Hand-crafted Prompt Templates
19
Additional Experimental Results
20
D.1 Detailed Results on Adversarial
Evaluation
20
D.2 Natural Generalization Gap Hinders Robust Adapting
20
D.3 Incremental Changes from AdyMaPLe ................................
D.4 Case Study: Improving AdvVLP with Our Learning Objective
D.5 Results Different CLIP Architectures
21
D.6 Zero-shot Adversarial Robustness under Different Perturbation Bounds
22
D.7 Zero-shot Adversarial Evaluation under Auto-Attack
23
D.8 Discussions on Training-time Attack Generation
23
D.9 Detailed Results for Adversarial Few-shot Learning
24
D.10 Detailed Results for Adversarial Base-to-New Generalization
24
D.11 Comparison between Adversarial Text and Vision Prompt
24
Impact Statement
24
Reproducibility
28
G Limitations
28
16

---

A Pipelines of Adversarial Prompt Learning and Testing
For better understanding of the designed algorithm, we describe our adversarial prompt learning and adversarial prompt testing pipeline Algorithm and Algorithm 2 respectively.
Algorithm 1 Few-shot Adversarial Prompt Learning (FAP)
Input: The few-shot dataset S, CLIP pre-trained model
{0z, 0r). prompt vectors P
(Po. P. h (P))). J. text description t, and weight parameter A.
for all training epochs do
for all x, E minibatch do
Calculate image and word embeddings
e(x, P.) + {Cas, Pr, ei w Pt) + wi,,ii( (l,), WN (l))
Generate clean visual and text representations z (1) &- I(e(x, 0z);
z (1. t T(w(t,, 07):
Generate adversarial examples
x arg maN (x) CKL (cos(z(1.Po) (tt.Pt)), cos())), (0) 2(t.Pt))):
# Compute the overall loss
Linal LCE (cos(z!1.Po) (l..P))) v) + &Coss Lxi. (cos(z!l,Pu), (l.P)) co.() ,
# Update prompt vectors P Plinall
end for end for
Algorithm 2 Adversarial Prompt Testing
Input:
The test dataset Stest {(x,, y:)) CLIP pre-trained model (0z, 07), adapted prompt vectors P (P.: Pr), and text description t.
Output: Natural accuracy nat pat_acc, adversarial accuracy adv_acc.
Initialize: nat cttr_corectttooo +- O, adv_correct +- 0;
for all x, y E Stest do
# Calculate image and word embeddings e(x, P.) + (Cass P., (x) w Pt)) (Pi, w7,wi(t,
WN it;
# Generate clean visual and teat representations
(1.Pt) + I(e(x, Pr);
z (t. t T(w(t, PT);
# Generate adversarial examples
X arg maxxeB. Lee (C) ((t.Pi)),
# Find the index of the highest similarity score nat_ids + arg max (cos (Z(1.t)), 2(t.PP ((t.P)
adv _dv_idx=a + arg max (cos (2(1,))) (t.P))))
if hat_id: = y then nat_correct + nat_correct - 1; end if
if adv_idx = y then adv_correct + adv_correct end if end for nat_ acc_acc <- nat_correct/n; adv t- adv adv_correct/n.
17

---

B Related Work
Adversarial robustness. Adversarial attacks fool models by overlaying carefully designed impercep- tible perturbations on input data [1, 2, 43]. In response to the susceptibility of models to such attacks, adversarial training [2, 44, 31, 45-49] has emerged as one of the most effective empirical defense methods to enhance model robustness. It incorporates adversarial data into the training process and ensures the model's s predictive distribution for adversarial images closely aligns with the ground truth label. Moreover, recent advancements have seen the incorporation of contrastive learning into adversarial training [50-52], which enables models to learn robust feature representations through instance discrimination tasks. As result, models can align predictions for natural and adversarial image pairs in a self-supervised manner [53-59]. Additionally, there's 's growing interest in aligning predictions for adversarial image-text pairs in a text-supervised context [11, 60), offering new avenues for zero-shot adversarial evaluation. Nevertheless, current research utilizes CLIP text encoding to produce statie text supervision, which, although effective for clean images, may not adequately cater to the nuances of adversarial examples.
Adversarial few/zero-shot classification. Adversarial training possesses significantly larger sam- ple complexity of robust generalization [61], making it challenging to learn robust representations from sparse data. Existing works in adversarial few-shot classification fall into two categories: meta-learning based [62, 63, 21J, which optimize an adversarial meta-learner using both clean and adversarial examples, and aen-meta-learinn based [22, 64], employing strategies like auxiliary corrective classifiers [22, 64] or reweighted mechanisms [22] for learning robust embeddings. Addi- tionally, Yucel et al. [65] initiated the investigation of adversarial robustness in zero-shot learning setting, where no downstream statistics are available during training. Inspired by the successes of Vision Language Models (VLMs), recent studies [11, 66] have unanimously chosen to incorporate semantic information from text supervision to bridge the generalization gap.
Vision-language models (VLMs). Foundational VLMs [12-19, 67, 68] integrate interactions derived from image and text encodings for multi-modal pre-training. Depending on their specific objectives, VLMs can be trained through image-text contrastive learning [12, 13, 15-17, 69, 19], image-text matching [17, 19], and text generation [17-19]. Utilizing large-scale image-text datasets (e.g., 400M pairs for CLIP [12], 1B for ALIGN [13]) and end-to-end pre-training, these models acquire semantic relations between text and image features, thus exhibiting a profound understanding of open- vocabulayy concepts. Consequently. VLMs have emerged state-of of-th-----he-rrtt the-artrrr solutions for various visual and vision-language tasks [70-76]. Nevertheless, some recent researches [77, 78] reveal that VLMs are also highly susceptible to adversarial perturbations.
Prompt learning for VLMs. Prompt learning, initially introduced in the NLP community [23- 25], involves adapting pre- preitrained models by adding a small number of new learnable parameters in the input data for downstream tasks, without altering the pre-trained weights. This method stands out among other lightweight adaptation approaches due to its exceptional adaptability and flexibility [79]. has garnered increasing attention for adapting vision [26, 27, 80) and vision- language models [28, 33, 81, 82, 30, 83, 84]. Specifically, in VLMs, CoOp [28] pioneers prompt engincering for adapting CLIP models by modeling Icarnable context vectors to replace hand-crafted
text prompts. CoCoOp [33] further enhances the generalization ability of CoOp by introducing conditional prompts specific to each visual input instance. MaPLe [30] integrates vision and language prompts with inner synergy for cross-modality prompt learning. Two recent works, ProGrad [84] and PromptSRC [83], concurrently advance the generalization of prompt learning by employing regulating constraints from zero-shot CLIP predictions to prevent the forgetting of general knowledge.
C Additional Implementation Details
All experiments are conducted in an environment running PyTorch 1.10.1 and CUDA 11.3 on Python 3.8. Experiments of adversarial prompt tuinng on the ImageNet-1K dataset are carried out on a single NVIDIA RTX A40 GPU, while experiments on the other 10 datasets are performed on a single NVIDIA RTX 4090 GPU.
18

---

C.1 Additional Implementation Details for Baselines
Adversarial visual prompt. We implement the adversarial visual prompt following all architectural and parameter settings in [11] for a fair comparison. In detail, we follow their code implementation use token-level prompt with size 5 and an image padding prompt for 30 pixels around the image. An SGD optimizer and a consine learning rate scheduler are used to train 10 epochs with an initial learning rate of 40.
Adversarial text prompt. We adopt a CoOp architecture [28] as our text prompt baseline and adapt learnable context vectors with adversarial examples. We typically follow [28] to use 16 context tokens with an additional class token appended at the end of the context vector. An SGD optimizer and consine learning rate scheduler used train 200 epochs with an initial learning rate of 0.002, which aligns with the training settings in CoOp.
Adversarial multi-modal prompt. Adversarial multi modal prompt in this work follows all the design choices as MaPLe [30], but are adapted with an adversarial text-image contrastive loss. To sum up, contains token-level learnable token with size in both text and visual branches in the first 9 transformer layers, and the deep prompts are coupled through a text-to-image projection. The above prompt tokens well the deep projections optimized for 10 epochs with SGD optimizer and cosine learning rate scheduler from an initial learning rate of 0.0035.
Adversarial vision language prompt. Adversarial vision language prompts possess the same vision and language prompt design as adversarial multi-modal prompts, but vision and language prompts independently adapted without interaction. All learnable prompts are adapted for 10 epochs with SGD optimizer and cosine learning rate scheduler from an initial learning rate of 0.0035.
Overall methodological explanations. We summarize the prompt design and loss function of both baselines and our methods in Table Note that the prompt design for baselines follows the original settings in their corresponding paper, while we replace their loss function with the TeCoA loss for adversarial training and evaluation. This is consistent with the methods used in Mao et al. [11].
Table 6: Overall methodological explanations of baselines and our methods.
Method
Visual Prompe Tokens
Text Prompt Tokens
Prompt Projections
Deep Prompts
Training Loss
Attak-timme Loss
AdvVP
TeCoA TeCoA
TeCoA
AdvTP
x
16
X
TeCoA
AdvVLP
2
2
TcCoA
TeCoA
A
2
2
TeCoA
TeCoA
2
2
Eq.(7)
TeCoA
C.2 Hand-crafted Prompt Templates
We report the hand-crafted prompt templates used in Zero-shot CLIP, AdvVP, and our method for initialization on 11 image recognition datasets in Table 7.
Table Hand-crafted text template for static text supervision of different datasets.
Dataset
Template
ImageNet- 1K
photo 0."
Caltech101
"a photo of a O."
DTD
"O texture."
EuroSAT
"a centered satellite photo of O."
OxfordPets
"a photo of a O, a type of pet." "a photo of O, a type of aircraft
FGVCAircraft
Food101
"a photo of O., type of food.
Flowers 102
"a photo of O, type of flower."
StanfordCars
"a photo of a O)"" "a photo of O."
SUN397
UCF101
"a photo of a person doing 0."
With additional pixel-level pad prompt.
19

---

Table 8: Cross-datasel generalization from ImageNet-Ik 1K various downstream recognition datasets. We report the mean and standard deviation of natural and robust (PGD-100) accuracy. Bolded numbers denote the state-of-ther tfftthe-art results.
Natural Ave 1%)
Ir
Culcch011
DTD
Osfindess
POVCNauuali
Foolol
Rovesa022
StadinoCias
SUN397
UCFI01
Ancrnge
Zam- CTIP
62.10
91.50
6378
$5.20
$7.40
19.30
$8.99
66,90
68-48
62.18
$3.08
61.91
ARMEL AAASPPl
28.9022432
1200111390
35.9111126
403728073
1800020
53.90 10
48
48:2221100
354833
50.7:0.55
1787761 88
11105806
$5676083
52.000025
36,021
50.51:878
5037:1
19700071
PGI-1II
011
Octondhes
Tredt0l
StatondC
SUNWY
Aewragg
1.725100
22-10004
310/30009
010:5001
311299
01002200
S.022000
1.70::0.00
0.20:0000
247250000
4.2662013
11 11675055
12.92=0.54
4,5
19,182241 41
9. 9.802345
16.2n62:91
2.00s0.57
12.7:=0.00
1047
13.5681.11 10
MAVEP
22 10:1135
02.5928024
1846-9.24
1087:9445
408342.00 08
213=346
17.8341.00 90
25:25=122 22
1007:9 26
21,67=0.39
23
23,25461
PAP
22.90.1255
45.55/176
1691..07
VM111.05
4A77.1.32
237
19.0.1.34
37.29.1.05
11,80.0.91
22.40
23-77
24,21.105
TeCo4 Lone -fflre
Teo Tern Loaa
34
Manually Adding
Nutural Generalizatio
20
Without Natural Goneralization
Test
Aomerrllly falucs
Epoch
Adversarial Accurcy
(a)
(b)
Figure 6: Illustration of potential failure cases and their solutions. originate from 8-shot adversarial prompt learning on the DTD dataset.
Experiments of failure cases
D Additional Experimental Results
D.1 Detailed Results on Adversarial Cross-Dataset Evaluation
For the cross-dataset evaluation, models are adapted on the ImageNet- dataset using 16 shots and then assessed for their zero-shot adversarial robustness across 10 distinct datasets, without further downstream tuning. As shown in Table 8, our method outperforms its counterparts 8/1 datasets and baseline in all 11 datasets. Moreover, reveals that robust adaptation takes the cost of natural accuracy, as models obtained using various robust adaptation methods exhibit decline zero-shot natural accuracy performance downstream datasets, compared to the original CLIP model.
D.2 Natural Generalization Gap Hinders Robust Adapting
We identify failure risk in few-shot adversarial prompt learning using TeCoA loss [11], where insufficient natural generalization on the sampled dataset impedes robustness learning. Figure 6a displays the loss variation during training under this setup. Under the same experimental setup using the TeCoA loss, different trials exhibit completely different trends: the curve for the failure shows that the loss quickly ceases to decline and becomes stable shortly after training begins, whereas the loss in the normal case continues to decrease as the training progresses.
We presume that this failure stems from lack of natural generalization ability. To confirm this, we first conduct natural tuning on the problematic few-shot dataset and then apply adversarial prompt learning. This restores the model's 's robust fine-tuning performance, as evident in Figure 6b, where natural and robust accuracies improve significantly after natural example adaptation. Besides, we validate the learning process on the same few-shot dataset with a dual-form loss in the training objective that considers both natural and adversarial terms (red lines in Figure 6a). It is revealed that
20

---

this two-term loss effectively acts surrogate for the aforementioned two-stage method, avoiding potential failures caused by the natural generalization barrier end-to-ent training.
D.3 Incremental Changes from AdyMaPLe
By examining the structural vulnerabilities (Figure 4) and the inadequate natural generalization (Figure 6) inherent in AdyMaPLe's learning objectives, we have proposed straightforward yet effective improvements. We generally have two improvements from AdvMaPLe:
Imp.1: Regarding the prompt design, we optimize the projection direction under the adversarial p learning situation for superior stability.
Regarding the learning objective, we not only consider the natural generalization gap that may cause the adversarial prompt to fail in the few-shot setting, but also make full use of the CLIP structure to design a differentiated robust learning strategy between different modalities.
1mp.2:
For a clear picture of the empirical boost, we demonstrate the incremental changes concerning AdvMaPLe. separately report the performance changes resulting from modifications to prompt direction alone, the learning objective alone, and the combination of both in Table 9.
We find from Table 9 that adopting our provided learning objective alone performance. However, the performance change brought about by modifying the projection direction alone on the basis of AdvMaPLe is subtle, the model's performance on most downstream datasets is not saturated at this point. On the other hand, further modifications to the projection direction based on row 3 can lead to additional improvements in model performance due to the repair of instabilities on certain datasets.
enhance model
Table Incremental changes with respect to AdvMaPLe. Our method combines Imp.1 and Imp.2 based on AdyMaPLe, achieving significant performance improvement (results in the last row).
Method
Prompt Direction
Training Objective
Base Nat
Base Adv Acc
New Ace
New Adv Acc
AdyMaPLe
Pt
P.
TeCoA
58.01
30.66
43.06
18.68
+Imp.1
P. + P.
TeCoA
57.96
30.10
43.73
19.01
+Imp.2
Pt Pa
Eq. (7)
64.81
35.26
45.01
20.25
1mp.1&&1mpp.
Po Pr
Eq. (7)
70.60
39.15
51.79
23.65
D.4 Case Study:
Improving AdvVLP with Our Learning Objective
We further illustrate the adversarial robustness enhancement brought by using our proposed training objective for prompt learning through intuitive study. Here, adapt Adv with both TeCoA loss and our Linal- In Figure 7, our loss improves zero-shot adversarial robustness across ten out of eleven datasets.
Additionally, our training objective results in evident performance gain under few-shot base-to-new generalization, as revealed in Table 10. That is, we not only achieve better base natural accuracy (+11.11%), base RGD-100 accuracy (+6.67%), new natural accuracy (+2.03%) new PGD-100 accuracy (+0.87%), but also maintains superior stability across different trails.
D.5 Results Different CLIP Architectures
We provide the adversarial cross-dataset transfer results on another CLIP VIT backbone, ViT-B/16, that adapted the proposed method. With the same architectural design, ViT-B/16 divides the input image into smaller patches to better capture and learn image details. This makes ViT-B/16 generally have superior performance over ViT-B/32 natural image recognition due to its finer granularity, but it also incurs higher computational costs due to longer input sequences. However, when considering tasks involving adversarial robustness, more complex models not necessarily yield better performance [85]. We report the results on ViT-B/16 in Table 11. We find that ViT-B/16 does not bring about improved robustness performance, which due to adversarial prompt learning focusing more feature alignment and understanding between different modalities rather than
21

---

ImageNet
UCF101
Cattech101
SUN397
DTD
StanfordCars
EuroSAT
Flowers102
OxfordPets
Food101
FGVCAircraft
AdWLP
AdvVLP
Figure 7: Zero-shot adversarial robustness of VdP adapted with TeCoA loss (red) and our loss (blue).
Table 10: Few-shot base-to-new transfer results (%) on AdvVLP with different learning objectives. We also report the performance gains achieved by adapting with our Lriaal
Metric
AdvVLP
Adv + Canal
Base Nat Acc
58.95+=11.67
70.06 1.30
A
11.11
Base Adv Acc
32.37++6.67
39.04
A
+ 6.67
New Nat Acc
46.92+47.41
48.95:+2.17
A
+ 2.03
New Adv Acc
21.6143.86
22.48:E1.96 + 0.87
A
detailed features. Therefore, the loss of detailed information resulting from the division of patches in ViT-B/32 is acceptable.
Table 11: Cross dataset transfer results on ViT-B/16. We report the natural and zero-shot PGD-100 accuracy (%) on the source ImageNet- IK dataset and 10 downstream target datasets.
Sounce
Tagst
VIT8/16
InngsNa-1K
Calechlol
Ostonilex
SonferdCan.
Average
Accency
63.70
13.20
D.6 Zero-shot Adversarial Robustness under Different Perturbation Bounds
In this task, provide adversarial attacks of varying intensities by changing the perturbation bounds to test the effectiveness the model in learning robust representations from different adversarial distributions. Specifically, set (1/255, 2/255, 4/255) during the training phase respectively, and use the same e values during testing as were used in training.
As can be seen in Figure 8, larger perturbation bound brings a stronger attack, thus decreasing lightweight adaptation method, prompt tuning for superior shot adversarial robustness to large attack strength requires more training data.
the zero-shot robust performance.
22

---

-- 1,0
70-
X- 1,51
t- 2025
f 2255
50-
4255
60
42255
50-
100 Accuracy
40
30-
20
10
imagree
Calaecs
Eursayr
Orloerets
Feeuton
Reserss
StnfbonCar
S48937
Imnggeet
Catrnchii
Fuesdar
osteenat
Fewting
Homor
StanfonKar
$18337
(a) Clean Accuracy (%)
(b) PGD-100 Accuracy (%)
Figure 8: Zero-shot adversarial robustness under different perturbation bounds.
D.7 Zero-shot Adversarial Evaluation under Auto-Attack
We consider more powerful Auto-Attack [86] to evaluate our adapted model. Now that adversarial prompt tuning does rely the obfuscated gradient, APGD-DLR, in Auto-Attur to evaluate our models. In Table 12, we can conclude that Auto-Attack provides stronger attack and causes varying degrees of performance degradation in each model. Our model still exhibits better robustness to Auto-Attack compared with AdvVP, Adv.LP, and AdvMaPLe. Moreover, by adapting AdvVLP with our learning objective in Appendix D.4, we achieve further performance gain under all three different perturbation bound settings. Note that AAto-Attack uses fractional attack generator which explores that fraction space by automatically adjusting step size a, it serves more effective and powerful attacker for zero-shot adversarial robustness evaluation.
APGD variants, APGD-CE and
Table 12: Zero-shot adversarial robustness (%) on downstream datasets with Auto-Attack adversarial perturbation. We consider different perturbation bounds = 1/255, 2,55,,/25,, 4 455 to evaluate models with different attack strengths. The best accuracies are bolded.
1/250
ImogeNet-IK
Caltech101
DTD
EuroSAT
OxfeddPets
#GVCAlreratt
Food101
Flowers122
StanfordCars
SUN397
UCF101
Ascrage
AdVVP
10.64
47.29
8.63
1.48
17.93
1.06
6:98
15.62
6.64
12:04
0.79
12.59
AdViaPLe
13.03
60.00
13.34
3.72
26.24
2.73
8.92
21.97
6.64
16.79
17.43
17.40
AdVILP
2.40
(AP
12.70
2/205
ImogeNes.IK
Caltech101
DTD
EurOSAT
OxteddPets
EGVCAtreralt
Food101
Flomers122
StanfrdCarr
SUN397
UCF101
Avtrage
AdvVP
4.25
29.83
5.63
1:15
398
0.24
1.55
5.54
1.90
3.58
2,67
5.46
AdVituPLe
10.41
$5.00
11.89
1.74
19.00
190
6.31
18,29
4.02
12.99
13.71
14.27
A6-ILP
10.30
35.16
12:50
1.56
19.13
2.26
5.6
17.54
3,47
18002
12.15
13.95
11.13
KAR-AGVYLIP
10.21
11:33
1.9
ImageNet-IK
Coltech101
BuroSAT
OxfocdPets
BGVCAlreratt
Foed101
Flowerst02
StanfordUarr SUN397
UCF101
MEVMuPLe
0.32
1003
12.35
AEVVIP
635
46.30
10.02
0.30
0.25
1.31
3.00
11.05
1.4]
7.58
6.22
9.43
RAP
7.01
48.27
10.47
0.11
12.27
1.00
3.21
13:47
1.76
7.45
7.38
10.23
(AVVLP)V
0.30
06.05
11.45
9,07
13.25
100
3.16
11.35
1.64
7.50
6.4%
16.1
D.8 Discussions Training-time Attack Generation
We adopt Eq. (8) to carry out adversarial attacks during the training process. We did not take Coos into account in Eq. (8). Including Loss in the generation of adversarial samples would make the gradient information focus on the differences between natural and adversarial examples, thereby generating stronger adversarial perturbations with greater differences from the natural examples. However, since we have incorporated this term in our adversarial defense, the model will gradually provide stronger attacks during iterative learning to ensure differences in image features between natural and adversarial samples, making it somewhat redundant in function.
23

---

We validate this with the experimental results in Table 13. We can observe that the results of these two methods for generating adversarial attacks are quite similar, indicating that adding Less in the attack is indeed redundant. Therefore, for the sake of simplicity, we did not include Las for training-time attack generation.
Table 13: Comparison in train-time attack generation methods.
Train-time attack generation
Base Nat Acc
Base Adv Acc
New Nat Acc
New Adv Acc
LKL
70.52+0.82
38.05+2.15 15
49.58+3.55
21.8642.57
Loos LKL
70.04+0.94
38.06+2.23
49.56+3.00
22.03+2.19
D.9 Detailed Results for Adversarial Few-shot Learning
For adversarial few-shot prompt learning, we plot curves showing how the average natural and robust accuracy change with varying shot numbers in Figure 3. Here, we present the mean and standard deviation natural (Table 14) and robust (Table 15) accuracy for all experimental settings, datasets, and shot numbers, based on multiple trials. For proposed method, when given smaller number of training samples, both the standard deviation of natural accuracy and robust accuracy are relatively high, indicating that the performance of learning robust representations at this stage depends on the quality of the examples. As the shot number increases, our method exhibits a significant reduction in the standard deviation for both natural and robust accuracy, demonstrating its ability to acquire adversarial robustness stability.
D.10 Detailed Results for Adversarial Base-to-New Generalization
For adversarial base-to-new generalization results in Section 4.2, further provide the detailed results on each dataset. In Table 16, our method demonstrates preferable learning performance on the majority of datasets. Specifically, in recognition datasets for fine-grained tasks that significantly differ from generic knowledge (DTD, Flowers 102, OxfordPets, FGVCAircraft, etc.), our training objective effectively avoids potential failures caused by natural generalization barriers in robustness learning, thus yielding more stable results across multiple trials.
D.11 Comparison between Adversarial Text and Vision Prompt
We design most of the baseline settings on the top of the adversarial vision prompt framework. As a result, most of them belong to a cross-modal prompt family, with learnable prompt tokens not only exist both vision and text input sequences. However, for completeness, we also consider the design of prompts in uni-modal context, namely adversarial vision prompts (AdvVP) and adversarial text prompts (AdvTP). In Figure 9, we find that, as the number of available examples increases, both vision and text prompts fail to acquire more robustness correlated hints for promoting adversarial robustness. However, although seems difficult for AdvTP learn proper adversarial text supervision, AdvTP is capable of maintaining preferable natural performance even when only adversarial examples are visible. We believe this can be attributed to the text prompt's ability to capture semantic information.
E
Impact Statement
This research aims to contribute positively to the machine learning field by enhancing model ro- bustness against adversarial attacks. While we believe our work unlikely to have direct negative societal impacts, we acknowledge the importance of considering potential misuse scenarios, such as the context of security applications. The broader implication of our study is that it enables neural models to maintain adversarial robustness with minimal adaptations, making it particularly suitable for real-time applications in mobile and embodied systems. Such advancements could lead to more secure and reliable applications in various real-world scenarios, including mobile device security.
24

---

Table 14: Natural Accuracy (%) of detailed adversarial few-shot prompt learning results. We report the mean and standard deviation the natural accuracy for baselines and our method under different shot number settings across 11 datasets.
Dataset
Method
1-shot
2-shot
4-shot
8-shot
16-shot
VP
32.81
3.37
32,87 + 5.99
34.13
8.24
34,00
6.02
33.59 + 4.71
AdvTP
52.02
1.55
52.85 + 3.20
56.42 + 1.11
58.68
0.41
60.73 + 0.51
Average
AdvMaPLe
28.22
4.99
34.18 = 1.69
44.05 =
54.65
2.85
64.24 = 1.28
AdvVLP
28.47
1.73
37.22
0.80
46,70
4.23
56.64
1.16
58.62
2.19
FAP
35.42 + 7.44
48.17 + 1.86
53.38 + 3.33
62.17
0.34
65.32
0.08
Ad
46.60 = 3.77
46.93 + 2.21
49,80 = 1.69
46.37
0.62
46.27 = 1.46
49.30
48.83
0.37
ImageNet-IK
AdvMaPLe
49.27 + 0.45
49.97 + 0.54
51.27 = 0.83
$2.13
0.58
52.93 + 0.62
Adv
29.00
1.13
50.53 + 1.08
$1.30 + 0.71
$283
0.12
53.23
0.588
FAP
49.90 0.51
48.53
0.90
51.53
$2.53
0.37
AdvVP
85.73 7.00
91.23 + 0.21
90.17
90.30
90.40
0.42
AdvTP
84.77 + 5.56
89.70 + 0.43
90.77 = 0.70
92.37
0.53
92.93 = 0.29
Caltech101
AdvMaPLe
85.53
1.35
88,00 + 0.71
89.53 =
90.63
0.37
92.17 - 0.21
AdvVLP
85,43
2.21
87.60
0.65
89.37
0.70
90.17
92.37
0.12
FAP
83.53 + 4.06
87.73 + 0.49
87.57 = 0.09
89.63
0.95
91.10
0.42
AdvVP
26.97 26.97+11.1
14.27 + 2.52
18.77 = 0.09
23.63
0.71
29.20
9.73
41.67
1.39
DID
AdvMaPLe
13.63 13.66
16.53 + 16.42
6.43
0.95
33.20 19.91
$7.93 +
0.78
AdvVLP
15.33 15.97
18.33 15.90
22,97 = 13.33
1.16 $1.83
$7.53
0.66
FAP
11.94
18.40
31.27 17.60
52.13
1.14
Ad
9.87 0.87
9.83 0.50
10.57
9.87
5.96
AdvTP
40.47 12.54
40.87 + 10.90
25.67 = 11.51
24.33
4.00
33.40
3.94
EuroSAT
AdyMaPLe
15.10
2.81
21.57 + 6.45
29.27 =
27.07
5.62
$4.97 = 12.19
AdvVLP
14.37 + 2.39
20.37 + 4.32
13.20
3.78
10.87
0.71
15.50
3.96
FAP
31.37 7.97
43.80 + 15.10
64,37 = 9.85
76.57
3.92
81.70
1.10
AdvVP
77.00-388.11
47.13 33.94
57.80 + 38.19
57.43
38.07
56.40 + 38.18
AdvTP
70.23 2.60
72.87
71.83
0,99
OxfordPets
AdyMaPLe
30.67 34.32
34.03 + 31.37
30.70 = 35.81
55.60
36.70
83.27 = 0,57
AdvVLP
29.63 1633::34 31.17
31.27 + 29.44
67.43 +
80.67
0.54
82.93 = 0.29
FAP
25.77
64.23
19.91
42.10
29552
0.45
81.90
0.85
AdvVP
1.50 0.36
5.97 + 6.47
6.10 + 7.00
4.70
5.23
0.24
AdvTP
14.77 1.68
16.37 + 143
15.70 + 1.07
13.60
1.27
14.77 = 0.74
FGVCAireraft
MaPLe
1.37 4: 0.12
0.50
2,50
23.63 + 0.98
AdvVLP
1.90 0.70
6.70 + 4.68
14,07 + 4.12
14.70
9.82
23.27 + 0.88
FAP
2.37 0.39
9,57 + 4.91
19.57 = 0.21
21.03
0.34
23.50
0.36
AdvVP
24.43 32.64
1.03 0.05
22.73 + 30.66
1.00
0.00
1.07 + 0.09
AdvTP
56.57
60.17
1.08
59.80 1.30
62.50
1.85
Food101
AdyMaPLe
5.27 +
3.37
3.10 0.88
60.00 - 0.29
62,70
0.29
65.13
0.52
AdvVLP
0.09 1.07
1,53 + 0.58
41.50 25.81
0.57 61.80
61.73
43.30
29.85
FAP
31.67 22.998
56.90
1.18
59.37
0.74
64.03
AdvVP
63.10 1.22
61.47 + 1.28
55.97 + 0.74
55.50
56.17 1161
AdvTP
61.97
4.65
67.17 + 12.16
82,40 + 0.57
2.09 84.00
86.63 - 0.33
Flowers102
1.40
29.83
0.12
AdvVLP
19.77 1774266.00
62.43 + 7.09
51.00 - 35.57
83,90
1.02
87.70 0.51
FAP
10.40 2.35
53. + 15.70
73.13 + 0.58
81.53
0.45
86.27 = 0.66
AdvVP
0.57 4
31,20 +: 21.57
14.00 + 18.88
14.40
19.59
14.83 + 20.34
AdvTP
40.40 1.42
15.57 19.89
43,37
131
$1.90 0.67
StanfordCars
MaPle
25.80 13.46
39.93 + 0.81
44.60 + 1.08
50.53
0.31
56.17 + 0.49
AdvVLP
35.33 0.54
40.07 + 0.17
45.00 +
50.93 =
56.00 1.00
FAP
34.70 1.24
38.60
0.29
43.20
0.45
48.47
0.62
54.23
0.61
AdvVP
41.20 9.66
50.77 + 7.06
48.47 +: 9.38
$2.53
0.81
$4,70 + 0.64
AdvTP
53.53 + 0.69
59.20 + 0.16
62.37 + 0.19
64.30
0.43
65.67 + 0.45
SUN397
AdyMaPLe
0.29
53.73
Adv
48,83 4 0.46
53.77 + 1.25
57.90 = 0.16
61.33
0.39
63.90
0,08
FAP
49.53 + 0.31
$4.07 + 0.33
56.60
0.79
60.40
0.62
62.37
0.12
AdvVP
3.37 2.79
1.73
0.50
1.07 +
18.27
23.57
0.97 + 0.21
AdvTP
58.50
0.45
65.00
0.28
66.53
1.66
66.53
69.40
0.85
UCF101
MaPLe
32.70 + 21.85
21.17
24.36
59.73 + 0.70
64.33
1.10
68.97 + 1.17
Adv
11.83
5.10
36.83
25.06 54.93
59,97 +
64.07
69.10 0.73
FAP
20.56 28.50
1.43
58.50
1.59
60.70
1.08
65.70
0.28
25

---

Table 15: Robust Accuracy (%) of detailed adversarial few-shot prompt learning results. We report the mean and standard deviation of the PGD-100 accuracy for baselines and our method under different shot number settings across 11 datasets.
Dataset
Method
1-shot
2-shot
4-shot
8-shot
16-shot
VP
14.04
0.85
13.20 +: 1.73
13.08
1.95
13.77
14.28
1.25
AdvTP
3.75 + 0.35
4.33 + 0.21
4.55 + 0.23
5.71
0.07
6.42 + 0.18
Average
AdvMaPLe
8.58
1.17
12.36 + 0.60
18.07 = 1.72
25.78
0.81
32.98 = 0.56
AdvVLP
9.01
0.50
14.18
0.16
18.80 = 1.95
26.62
0.23
30.84
0.88
FAP
7.88 + 1.56
14.05 + 1.05
19.59
1.09
29.51
0.42
34,61
0.28
AdvVP
11.07 + 1.15
10.90 + 0.45
11.13 = 0.76
11.90
0.71
12.77 = 1.46
1.80
0.12
ImageNet-IK
AdvMaPLe
14.60
0.14
17.13 + 0.42
19.00 = 0.29
20.60
0.43
21.90 + 0.50
Adv
15.53
0.58
17.50
0.22
19.37 + 0.26
20.97
0.05
22.10
11.36
FAP
15.40 0.45
17.83
0.47
19.60
22.90
0.85
Ad
50.33 6.74
55.23 + 0.97
52.50
0.42
50,33
$2.60
1.14
Adv
26.90 + 5.35
31.70 + 1.49
26.67 = 1.58
30.83
1.30
30.23 = 1.02
Caltech101
AdvMaPLe
48.37 2.58
56,20 + 0.83
59.40 =
63.80
0.92
68.63 = 0.46
AdvVLP
48,47
3,08
55.33 + 0.17
59.07
0.68
63.13
67.97
1.04
FAP
41.13 -: 7.58
53.90 + 0.99
37.33 + 0.48
0.92 62,50
67.33
1.25
Ad
12.93 7.62
6.93 + 0.74
9.27 = 0.40
11.77
0.37
13.87 + 4.00
0.37
6.33
DID
AdvMaPLe
2.93 3.72
4,20 + 4.68
2,40 = 1.36
16.97
8.60
32.17 = 0.34
AdvVLP
4.77 5.47
7.17 + 6.61
10.33 = 6.43
25.77
0.40
32.73 + 0.82
FAP
2.40 2.65
4.33 5.85
8.07
31.33
1.89
Ad
9.80 0.92
+ 0.97
8.50
9.77
15.83
4.65
AdvTP
0.30 0.24
0.17 + 0.12
0.27 = 0.17
0.17
0.17
0.87 = 0.52
EuroSAT
AdyMaPLe
0.57
0.46
+ 3.79
16.13
7.40
21.60
0.85
32.97 - 5.88
AdvVLP
0.20+ 0.28
6,30 + 4.61
6,83
3.03
12.23
1.75
17.30
4.39
FAP
0.00 0.00
1.00 + 1.1
3.60 + 2.86
29.30 = 2.96
39.73 = 3.29
AdvVP
22.73-415.88
15.10 10.34
16,20 + 11.33
17.33
11.97
16.43
11.55
AdvTP
0.60 0.16
2.10
3.10
0.16
OxfordPets
AdyMaPLe
4.97 6.81
6.87 + 8.80
9.03 = 10.45
21.07 12.46
36.87 = 0.78
AdvVLP
3.83 4.01
+ 8.32
18.47 = 4.29
29.63
0.34
35.57 - 0.96
FAP
3.47 3.94
12.67
8.69
9,30 12.30
34.57
41.00
0.62
AdvVP
0.77 0.33
1.60 0.71
1.27 1.08
1.20
0.39
AdvTP
0.10 0.08
0.13 0.09
0.67 + 0.09
1.0
0.09
1.27 = 0.05
FG FGVCAireraft
AdvM
0.73
5,53
7.33 0.12
AdvVLP
0.90 0.36
2.27 + 0.60
3.73 0.90
4,40
2.41
8.40 + 0.22
FAP
0.07 + 0.09
1.10 + 1.28
3,93 = 0.31
0.29 6.07
7.97 = 0.53
AdvVP
5.23 6.56
0.10 0.00
4.57 + 5.68
0.83
0.17
0.80 + 0.28
AdvTP
0.83 0.25
1 0.17
2.33
0.05
Food101
AdyMaPLe
0 0.42
0.67 + 0.46
0.66 11.20
14.83
20.13
0.53
25.27 - 0,21
Adv
0.77
0.21
1.10 0.36
19.33
0.34
16.50
FAP
1.43 1.82
10,53 5.54
18.37
23.20
0.51
26.67
0.40
AdvVP
29.70
1.64
26.93 + 0.31
23.73
2.04
23.57
0.54
22,33
1145
AdvTP
2.10
0.79
3.10
0.80
4.23 + 0.41
6.00
0.29
8.97 + 0.59
Flowers102
AdvVLP
6.57 # 8.65
25.17 + 2.83
25.80 = 17.75
$0.90
0.50
$8.70 = 0.57
FAP
0.53 0.50
19.57 + 12.73
38.77 = 0.95
$2.63
1.25
61.47 = 0.66
AdvVP
0.33 0.17
+ 3.71
2,80
3.75
3.57 + 4.69
AdvTP
0.23 0.05
0.13 0.19
0.83
1.77
0.16
StanfordCars
MaPMe
2.77 + 0.99
5.20 0.75
8,70 + 0.42
12,80
1.04
17.57 + 0.53
AdvVLP
3.80 0.22
5,33 0.56
9.07 +
13.27
0.29
17.47 = 1.03
FAP
4.83
0.45
7.27 +
0.24
11.17
0.52
15.10
0.49
19.23
1.14
AdvVP
11.10 4.48
13.57 + 3.18
13,03 + 2.92
17.30
0.73
17.63 + 0.69
AdvTP
1.23
0.05
2.03
0.09
2,90 + 0.08
3,40
0.00
3.67 + 0.09
SUN397
AdvMaPLe
12.67
0.24
16.33
0.24
Adv
12.60
0.28
17.33 + 0.59
21.17 = 0.24
26.23
0.19
29.70 + 0,22
FAP
14.93
0.21
19.30 + 0.59
23.20
1.00
27.23
0.12
30.27 - 0.19
AdvVP
0.40 0.08
1.07 + 0.12
0.80 +
4.93
5.85
0.93 - 0.21
AdvTP
3.87
0.50
3.10
0.37
3,03
4.30
0.29
0.14
UCF101
AdyMe
7.07 +
4.62
6.20 + 7.57
21.30
0.51
25.93
0.61
31.67 + 0,97
Adv
1.73
1.11
11.43 + 7.17
21.77 +
26.97
32.80
0.24
FAP
2.43
3.16
7.03 + 5.92
22.13
0.95
26.67
0.48
32,80
1.07
26

---

Table 16: Detailed results for base-to-nee new generalization on 11 datasets. We report the Natural and PGD-100 Accuracy (%) on the base and new classes that adapted with 16-shot adversarial prompt learning.
Dataset
Class
Metric
AdvVP
AdyMaPLe
AdvVLP
FAP
Natural Ace
31.68
6.57
60.38
8.03
58.95 11.67
70.52
0.82
Adv Ace
14.43
2.26
30.69
4.71
32.37 + 6.67
38.05 + 2.15
Average
Natural Acc Adv Acc
30.39
6.40
46.18
6.39
46.92 1 7,41
49.58 1 3.55
New
13.36 =
2.80
20.25 + 3.39
21.61 = 3,86
21.86 = 2.57
Natural Acc Adv Acc
49.87
1,70
58.40
0.57
$8.47 1 0.25
58.10 1 0.14
12.27 + 0.34
25.33 1 0.19
24.93 1 0.21
25.83 = 0.09
ImageNet-IK
Natural Acc Adv Acc
44.80 +: 2.41
48.83
0.90
48.67 :: 0.12
47.83 + 0.31
New
12.27 1. 0.52
21.03 1 0.21
20.50 1 0.08
21.57 1 0.31
Natural Acc Adv Acc
92.83
0.91
94.40
0.65
94.87 + 0.17
94.07 + 0.77
57.17 1. 1.23
73.90 1 0.14
76.23 1 1.08
74,20 1 1.73
Caltech101
Natral Ace Adv Ace
88.83
0.38
83.27
1.27
84.47 + 0.85
76.53 + 2.60
New
49.13 + 1.79
56.70 + 1.16
57.67 +: 1.06
50.00 + 1.00
Naturl Ace Adv Ace
23.27
5.49
43,40 + 25.05
48.63 + 24.86
69.17 = 0.56
Base
10.03 + 2.17
21.50 + 14.25
27.57 + 12.89
41.63 + 2.12
DTD
Natural Acc Adv Acc
13.23 -1 1.40
21.27 1 12.11
22.87 1: 12.71
35.17 1 7.71
New
7.20 = 1.13
9.97 + 6.47
12.37 + 7.07
19.77 = 2.85
Natural Acc Adv Acc
18.07 1. 0.24
54,30 1. 17.51
49.03 1 15.04
87,70 1 1.57
Base
17.77 + 0.19
15,90 +: 12.01
38.03 +: 8.41
51.80 + 5.00
EuroSAT
Natural Ace Adv Acc
25.50 1: 4.98
26.73 1 6.04
35.63 1: 3.13
32.80 1: 12.23
New
19.97 1 4.86
6,83
5.77
19.47 1: 3.60
13.40 1 10.38
Natural Ace Adv Ace
32.57 + 37.86
38.97 + 34.04
60.67 + 39.22
87.37 + 0.94
Base
12.27
12.61
16.80 1 19.18
31.80 1: 18.82
34.13 1 8.01
OxfordPets
Natural Acc Adv Ace
32.30 :. 36.28
39.67 + 34.97
57,90 + 37.00
72.13 = 6.21
New
13.37 13.53
17.50
17.61
90 +: 16.69
26.07 1 7.48
Natural Ace Adv Ace
2.30
0.22
15.00 + 7.03
9.93 + 9.93
24.83 + 0.12
Base
0.30 + 0.16
6.63
2.76
4.53 + 3.07
8.00 + 0.83
FGVCAireraft
Natural Acc
2.00 11 0.00
9.97 6.17 3.13
6.73 1 6.22
15.83 1 0.63
New
Adv Acc
2.00
0.00
2,50 + 1.90
4.23 = 0.74
Natural Acc Adv Ace
2.27 1 0.21
71.37
0.05
71.40 1
1.21
72.37 1 1.44
Base
1.27
0.61
27.90
0.43
28.43 +
0.34
27.57 - 2.88
Food101
Natural Acc Adv Ace
2.20
0.36
68.93
0.82 24.50
90,9011 1: 0.28
68.20 1: 1.42
New
1.00
24.60 1
0.79
24.20 1 2.70
Natural Acc Adv Ace
50.43
4.41
88.90
0.49
56.53 + 35.85
89.30 + 0.41
Base
24.63
62.80
36.70
65.50
0.86
Flowers102
Natural Acc Adv Ace
45.23
2.69
49,90
30.00 + 18.02
45.67 = 3.09
New
15.77
21.07
11.63 8.21
18.10 0.54
Natural Ace Adv Acc
14.87
19.89
56.47
1.72
55.60 + 0.54
53.97 + 0.97
Base
3.49 2.77
16.57
16.97
18.60
0.64
StanfordCars
Natural Acc Adv Acc
15.53
20.69
46.03
46.00 1 0.85
42.67 1 1.08
New
3.70 3.96
12.10
1.04
12.67
0.57
14.10
0.22
Natural Acc
60.20
70.23
70.57
68. 1
0.56
Base
Adv Acc
18.50 =:
0.71
33.87
0.76
34.10 1 0.73
34.63
0.97
SUN397
Natural Acc Adv Acc
62.20
0.73
63.57
63.27
61.47
0.69
New
21.10
0.50
0.76 29.83
29.40 1: 0.67
30.77 1 0.97
Natural Ace Adv Ace
1.77
0.52
72.77
72.80
0.64
70.37 + 1.55
Base
1.73 11
0.54
36.37
0.19
36.77
1.53
36.63
1 0.48
UCF101
Natural Acc
2.47
0.45
49.83
3.07
50.70
1.59
47.10 = 3.11
Adv Ace
1.43 :1
0.82
20.13 1
1.06
18.00
1.77
18.30
1.12
27

---

(a) Average on 11 Datasets
(b) ImageNet- K
(c) Caltech
(d) Flowers
(e) DTD
(I) Food101
EuroSAT
(h) OxfordPets
(i) FGVCAireraft
(i StanfordCars
(k) SUN397
(I) UCF101
Figure Accuracy (%) of adversarial few-shot learning on 11 datasets under uni- uni-modal prompt AdvTP and AdvVP settings. The dots represent the result of each experiment and lines reveal the trend of average results from three trials under each setting with respect to the shot numbers. In each subfigure, we report the natural accuracy (dashed line) in the upper half, and the robust accuracy (solid line) the lower half.
F Reproducibility
During the reviewing process, the source code is supplied anonymously as part of the supplementary materials, Additionally, upon the acceptance of the paper, this code will be publicly released.
G Limitations
This paper introduces framework that leverages the architecture of cross-mode prompts to enhance model robustness. This is achieved by adjusting the prompts to learn anverssrial-correlltte text supervision. However, prompt learning is merely parameter-efficien strategy for model adaptation, and other parameter-basee adaptation methods, such as full-finetning, are not considered this work. Furthermore, while method has empirically shown that comprehensive consideration of connections and distinctions between natural and adversarial examples can better learn adversarial text supervision, systematic theoretical analysis and proof remain elusive. We regard addressing these limitations as our future direction.
28

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: We Summarize the main contribution of our paper in the last paragraph of introduction section.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
We discuss the limitations of paper in Appendix G.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]

---

Justification: Our paper improves adversarial prompt learning from an empirical perspective and does not rely on theoretical proofs and assumptions.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: We summarize the implementation details in Section 1 and Appendix C.1 to reproduce our experimental results. Additionally, we will include the code in our supple- mental material.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way access this model for reproducing the results way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reprodueibility may be tricky in some cases, in which authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing verifying the results.
5. Open access to data and code
30

---

reproducible, they Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
For datasets, we only use open-source datasets that are publicly available. For codes, we list the original paper of baseline methods in Appendix C.1 with access their respective code repositories.
Justification:
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.. cc/
Subliic/uuddes/CodStttmi sslicilicyy for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" an acceptable answer. Papers cannot be rejected simply for including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https:
/ //nips.c. ctce/publicgguuceeo httgg/ddde//ooeSuubiiiiiinee ceassinnooo onPolicy) for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data,
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permirted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We summarize the training and testing details in Section 4.1, Algorithm 1, and Algorithm 2.
Guidelines:
The answer NA means that the paper does include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, the appendix, or as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification; We include means and standard deviations from multiple repeated experiments for experimental results in Section 4.2 and Appendix D.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emoo bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
31

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not show in tables figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We report the compute resources in the first paragraph of Appendix C.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics https: / hww.reuuu...///
Answer: [Yes]
Justification: We have carefully read the NeurIPS Code of Ethics and checked the anonymity our submission.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (c.g.. if there special consid- eration due to laws or regulations in their jurisdiction..
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We discuss the boarder impact of our paper in Appendix E.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
32

---

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: Our paper does not include generative models and typically uses open-source datasets for training and evaluation.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model. for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
The creator of assets[28] used in our paper states the license in their repository (MIT License).
Justification:
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
33

---

For scraped data from a particular source (e.g., website). the copyright and terms of service of that souree should be provided.
assets are released, the license, copyright information, and terms use in the package should be provided. For popular datasets, paperswithcom thcode com/coo/////ooooo comddataeet has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: Although will submit the code in the supplementary materials, will continue to improve the codebase and make publicly available after the paper is officially accepted. Currently, have not released any assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moddl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: There are no crowdsourcing experiments and research with human subjects under adversarial prompt learning settings.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According the NeurIPS Code of Ethics, workers involved data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: There are no crowdsourcing experiments and research with human subjects under adversarial prompt learning settings.
Guidelines:
34

---

The answer NA means that the paper does not involve crowdsoureing nor research with
human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
35


Reviews:
[{"review_id": "QVS8hpYVih", "reviewer": "Reviewer_KV22", "summary": "This paper addresses adversarial robustness for image classification with VLMs (e.g. CLIP model). To this end, the authors proposed the FAP framework to adapt VLM models by learning prompt tokens in a few-shot manner with adversarial examples. The loss function is proposed to promote accuracy on clean images, to align the text-image embedding interaction across clean and adversarial images and to align the image embedding similarity across clean and adversarial images. Experiments are carried out on image classification tasks, with the few-shot setup on multiple datasets, and the proposed method achieves good results on both base and novel datasets.", "questions": "In Eq 3 and 4, $\\bf{t}$ seems to be a list of strings/text prompts (following line 83), how is $cos$ computed on strings? Or are we missing some $z$ here?\nIn Appendix A Algorithm1, are $P_v$ and $P_t$ separate or one is dependent on another? It's not very clear in that codeblock.", "limitations": "Limitations are adequately addressed in the appendix.", "rating": 5, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "* The results are indeed better when there are not many training examples.\n* Extensive discussions are provided in the appendix.", "weaknesses": "* The framework architecture is not easy to understand without reading the MaPLe paper. For example, is $P_v$ in line 150 shared shared or separate across different encoder layers? And the modification of $h$'s direction is not clear without reading the appendix. The presentation should be improved and more self-contained.\n* From Table 1, it seems that most of the gains are coming from the architecture of MaPLe. For the proposed loss in equation 7, the components of them are not carefully ablated.\n\nNitpicking:\nLine 108: $\\theta_T$ -> $\\theta_I$", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "### Official Response to AnonReviewer KV22:\n\nWe deeply appreciate your thorough review of our manuscript and are grateful for the insightful feedback you provided. Your constructive comments have been instrumental in enhancing the quality of our work.\n\n**1. [Re Weakness 1: Concerns about the comprehensibility of the framework.]**\n\nThanks for your positive suggestions! We would like to first answer the questions and then explain the framework design of our paper.\n\n- $P_v$ is separate across different encoder layers, which is a standard configuration of deep prompt tuning structure **[1]**. Besides, the direction of prompt projection $h$ is analyzed in **Appendix D.2** and we place a cross reference in **Section 3.1** to ease reading.\n- As you mentioned, MaPLe serves as the structural foundation for prompt learning in this work but we make both architectural and learning objective modifications for adversarial robustness adaptation. We suppose the preliminary content about prompt learning and adversarial prompts in **Section 2**, along with the overall framework in **Figure 1**, should help readers understand the basic scheme of prompt learning and the method we proposed.\n- We understand your concern. After carefully re-evaluating our paper, we agree that presenting the results appropriately will enhance the paper's quality and make it more self-contained. Including the analytical experiments on our architecture (from **Appendix D.2**) and learning objectives improvements (in **Table 5**) in the main text will better help readers understand our method. We will move the content from **Appendix D.2** to the main text in the final version. Thank you once again for the constructive advice!\n\n**2. [Re Weakness 2: Performance gain over AdvMaPLe and loss ablation.]**\n\nThanks for your feedback! We address your concern from the following three aspects:\n\n- From our initial experiment, we find that AdvMaPLe exhibits powerful performance in few-shot adversarial prompt learning owing to its better-aligned multi-modal structure. However, its instability in both structure (**Appendix D.2**) and learning objectives (**Appendix D.3**) makes it suboptimal.\n- We kindly argue that the improvement brought about by our method is significant in **Table 1**, which obtains [+10.14%, +7.36%, +3.40%, +1.61%] performance gain on [base nat acc, base adv acc, new nat acc, new adv acc]. Additionally, our method is tailored for few-shot adversarial prompts, as it reveals superior stability and fits other prompt frameworks (**Appendix D.5**) with evident performance gain as well.\n- We have actually presented a comprehensive loss function ablation in **Table 5**, which demonstrates the effectiveness of our proposed learning objective. Further, we validate the effectiveness of our learning objective in the few-shot adversarial prompt task on other prompt frameworks in **Appendix D.5** and alternative VLMs in **Table Re.1**.\n\n**3. [Re: weakness 3: Typo error in Line 108.]**\n\nThank you! We will correct it in the final version.\n\n**4. [Re question 1: Questions related to prompt design.]**\n\nWe understand your concern. We clarify the two questions about prompt design as follows:\n\n- Here, $\\textbf{t}$ represents a list of text prompts (**dim:** [num_classes, embed_dim]), as indicated by its bold formatting, while $I$ represents a single image embedding (**dim:** [1, embed_dim]), as it is not bolded. The term `cos` does not refer to a single cosine similarity value but rather to a cosine similarity distribution, as outlined in the original CLIP paper **[2]**. Specifically, we calculate the cosine similarity between one image feature (**dim:** [1, embed_dim]) and all text features (**dim:** [num_classes, embed_dim]) from every class to obtain this distribution (**dim:** [1, num_classes]). This process is illustrated in **lines 174-176**. We will include these explanations in the final version of the paper to ensure clarity.\n- $P_t$ and $P_v$ are relevant in our method. As described in **line 152-154**, $P_t$ is obtained from $P_v$ through linear projection $h$, as $P_t=h\\left(P_v\\right)$. We realize that the brief description in **Algorithm 1** might confuse, so we will explicitly clarify the projection relationship between image and text prompts in **Algorithm 1** in the final version. Thanks once again for your constructive suggestions.\n\n\n\n[1] Jia, Menglin, et al. \"Visual prompt tuning.\" ECCV, 2022.\n\n[2] Radford, Alec, et al. \"Learning transferable visual models from natural language supervision.\" ICML, 2021.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "f2rRXH2nh7", "reviewer": "Reviewer_Lycp", "summary": "Adversarial prompt learning on vision-language models has traditionally focused on aligning text with corresponding images to ensure coherence and contextual accuracy. This paper extends this approach by making the image features of natural and adversarial examples distinct while still aligning them with the relevant text descriptions. This novel contribution enhances the model's robustness against adversarial attacks. The authors introduce a new framework that leverages adversarial text supervision to improve cross-modal adversarial alignment. This framework allows for the learning of adversarial prompts, significantly boosting the model’s ability to handle adversarial examples. Remarkably, the proposed method achieves state-of-the-art zero-shot adversarial robustness while utilizing only 1% of the training data, demonstrating both efficiency and effectiveness in enhancing model performance.", "questions": "When would this few-shot setup particular useful? If we already have LAION and other big dataset?", "limitations": "No.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "Novelty: The paper introduces a training objective that enhances the consistency of multi-modal features while encouraging differentiated uni-modal features between natural and adversarial examples.\n\nClarity: The paper is clearly written, with methodologies and results presented in an accessible and comprehensible manner.\n\nSignificance: The proposed approach is compared with three baseline methods and demonstrates significant improvements in robust accuracy across 11 different datasets.", "weaknesses": "Depth of Analysis: The paper introduces a novel training objective that is both interesting and unexpected. However, there is a need for a deeper analysis and explanation of why this proposed method is effective. Understanding the underlying mechanisms and reasons for its success would provide valuable insights and strengthen the paper's contributions.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "### Official Response to AnonReviewer Lycp:\n\nWe sincerely thank you for your careful reading of our paper and appreciate the valuable feedback in your comments. The insightful and constructive suggestions have enabled us to effectively improve our work.\n\n**1. [Re Weakness 1: Depth of Analysis for training objective.]**\n\nThanks for your feedback. Our training objective generally exhibits adversarial regularization formulation **[1]**, with a natural term ensuring natural generalization and an adversarial term enforcing output consistency on adversarial examples. In this framework, we creatively decompose the adversarial term into a cross-modal consistency term and a uni-modal adversarial aware term for effective few-shot adversarial prompting on VLMs. Here, we first summarize the intuition of such decomposition and differentiated processing between features of different modalities, then present a deep analysis of its success.\n\n- Intuition. Although both natural and adversarial examples contain robust and predictive features consistent with human judgment, adversarial perturbations are predictive yet imperceptible features. Adversarial vulnerability is a direct result of the sensitivity to such well-generalizing yet non-robust features **[2]**. Therefore, an effective prompt training objective must reasonably deduce the relationships and differences between natural and adversarial samples using a limited number of examples.\n\n- The cross-modal consistency term $\\mathcal{L}\\_\\text{KL}$ ensures the decisive categorical features of natural and adversarial examples are consistent, aiding in robust feature learning. In contrast, the uni-modal adversarial-aware term $\\mathcal{L}\\_\\text{cos}$ highlights differences between natural and adversarial images, alerting the model to non-robust features and preventing sensitivity to them.\n\n- Practically, the cross-modal consistency term $\\mathcal{L}\\_\\text{KL}$ seeks to balance two cosine similarities between text-image pairs: $\\operatorname{cos}(\\mathbf{z}^{(I,\\boldsymbol{P}\\_{\\boldsymbol{v}})},\\mathbf{z}^{(t\\_i,\\boldsymbol{P}\\_{\\boldsymbol{t}})})$ and $\\operatorname{cos}(\\tilde{\\mathbf{z}}^{(I,\\boldsymbol{P}\\_{\\boldsymbol{v}})},\\mathbf{z}^{(t\\_i,\\boldsymbol{P}\\_{\\boldsymbol{t}})})$. This can be regarded as aligning the angles between natural and adversarial text-image representations in the feature space. There are two possible scenarios: \n\n  1.  The visual features are similar, being on the same side as the text feature.\n  2.  They are on opposite sides, differing from each other but having the same angle with the text feature. \n\n  Our proposed uni-modal adversarial aware mechanism maximizes another similarity $\\operatorname{cos}\\left(\\mathbf{z}^{(I,\\boldsymbol{P}\\_{\\boldsymbol{v}})},\\tilde{\\mathbf{z}}^{(I,\\boldsymbol{P}\\_{\\boldsymbol{v}})}\\right)$ between natural and adversarial visual features to ensure that the cross-modal consistency primarily falls into the second scenario. As a result, $\\mathcal{L}\\_\\text{cos}$ act as an additional constraint for $\\mathcal{L}\\_\\text{KL}$, excluding conditions where the model relies on the non-robust features to minimize the loss.\n\n**2. [Re Question 1: Usefulness of the few-shot setup.]** \n\nWe address this from the following aspects:\n\n- Large datasets are particularly useful for pre-training powerful foundation models such as CLIP, BERT, and ViT with general knowledge. However, few-shot learning is typically used in downstream adaptation, where we tune the pre-trained model with a small number of task-specific samples to enhance its generalization capability on the downstream task. From this perspective, large datasets can facilitate few-shot learning in that pre-trained models from large datasets tend to carry more diverse prior knowledge, making the adaptation to downstream tasks less data-hungry.\n\n- Furthermore, few-shot learning is especially useful for the following advantages:\n\n  1. **Data efficiency.** Many downstream tasks have only limited data available. A typical example is facial recognition tasks, which have only one-shot data as reference but need to perform recognition across different lighting conditions, facial expressions, and backgrounds.\n\n  2. **Rapid adaptation.** In many cases, there might be a large amount of similar downstream tasks. Few-shot learning enables rapid adaptation for each downstream task, whereas fine-tuning on a large dataset is too cumbersome. A typical example is a customized chatbot.\n\n  3. **Computational efficiency.** The computational efficiency of few-shot learning makes it promising for downstream tasks with high computational complexity. For example, in adversarial robustness tasks, the iterative process of adversarial attack and defense significantly increases the required time compared to natural training. Therefore, attempting few-shot adversarial learning from a pre-trained model with initial robustness is also highly practical.\n\n[1] Zhang, Hongyang, et al. \"Theoretically principled trade-off between robustness and accuracy.\" ICML, 2019.\n\n[2] Ilyas, A., Santurkar, S., Tsipras, D., Engstrom, L., Tran, B., and Madry, A. Adversarial examples are not bugs, they are features. NeurIPS, 2019.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ThVVVrdi7m", "reviewer": "Reviewer_M4S3", "summary": "This paper introduces a novel few-shot adversarial prompt framework for enhancing the adversarial robustness of vision-language models. The authors propose a method that achieves state-of-the-art zero-shot adversarial robustness using only 1% of training data, addressing limitations of existing approaches such as heavy adaptation costs and suboptimal text supervision. The key contribution is a new training objective that improves multi-modal feature consistency while differentiating uni-modal features between natural and adversarial examples.\nThe experiments rely on one multimodal model, but executes experiments on 12 datasets.\nWhile the approach shows promise, potential limitations include questions about generalizability across different model architectures.\nOverall, this paper presents an innovative approach to improving adversarial robustness in vision-language models with promising results.", "questions": "- Have you thought of how your method performs across different types of adversarial attacks?\n- What are the limitations of your approach, and are there specific scenarios where it might not perform as well?", "limitations": "The authors have addressed some limitation in the appendix, directing towards more theoretical analysis of the method. \n\n\nIn my opinion, long-term robustness could be addressed as well: The paper could have addressed (at least in the future work) how the proposed method performs against evolving adversarial attacks such as adaptive attacks [1].\n\n[1] https://proceedings.mlr.press/v162/croce22a.html", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- Novel approach: The paper introduces a few-shot adversarial prompt framework, which appears to be an innovative method for improving adversarial robustness in vision-language models.\n- Efficiency: The approach achieves state-of-the-art zero-shot adversarial robustness using only 1% of training data, which is a significant improvement in data efficiency.\n- Multi-modal consistency: The authors propose a novel training objective that enhances the consistency of multi-modal features while encouraging differentiated uni-modal features between natural and adversarial examples.\n- Practical relevance: The method addresses real-world issues such as heavy adaptation costs and suboptimal text supervision in existing approaches.", "weaknesses": "- Generalizability: It's unclear how well this method generalizes across different vision-language model architectures. The authors should provide more information on the range of models tested.\n- Comparative analysis: While the abstract mentions matching state-of-the-art performance, a more detailed comparison with existing methods would strengthen the paper.\n\nWriting:\n - Line 74: a cross reference would ease reading.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "### Official Response to AnonReviewer M4S3:\n\nWe sincerely thank you for your comprehensive examination of our paper and value the thoughtful feedback you have offered. Your helpful suggestions have played a crucial role in improving the overall quality of our research.\n\n**1. [Re Weakness 1: Generalizability.]**\n\nThanks for your feedback! We answer your question as follows:\n\n- We kindly argue that most of the existing work on adversarial prompts, and even VLM prompts, is based on the CLIP model. This is because the dual encoder structure and contrastive multi-modal feature interactions are particularly suited for downstream classification and retrieval tasks. In this paper, we ensure the generalizability of our proposed method by testing it on various downstream tasks and alternative prompt structures **Appendix D.5**.\n- Furthermore, we step outside the existing framework and attempt to apply adversarial prompts on other VLMs. We have chosen the CLIP-RoBERTa **[1]** model, expending a learnable prompt of length 2 at the input sequences of each block in the image and text encoders. For simplicity, we adopt AdvVLP prompt structure, carrying out comparative experiments between baseline TeCoA loss and our learning objective. The results in **Table Re.1** show the significant improvements brought by our learning objective, especially in terms of generalization to new classes.\n\n**2. [Re Weakness 2: Comparative analysis.]**\n\nWe sincerely appreciate your feedback! We explain this as follows. \n\n- The previous SOTA performance of adversarial prompt is achieved by AdvVP **[2]** which adapt token-level visual prompt (with size 200) with entire ImageNet 1K. In this work, we consider a few-shot setting to avoid heavy adaptation costs and add comparative prompt settings AdvTP, AdvVLP, and AdvMaPLe for completeness. We have summarized their respective design details in **Table 6** for reference.\n- Furthermore, we conduct a thorough review of recent advancements in adversarial prompts and identify a concurrent study AdvPT **[3]** at ECCV 2024 focusing on downstream adversarial robustness. Although this study also utilizes learnable text prompts and TRADE-format loss, our method emphasizes multi-modal prompt design and introduces a novel learning objective for few-shot learning. We validate the performance enhancements brought by our learning objective within this new prompt framework. Here we test it under our few-shot base-to-new generalization setting and report its average results across 8 datasets. We can conclude from **Table Re.2** that our proposed learning objective can also serve as a plug-in method to enhance the effectiveness of **[3]**, especially in terms of robust performance.\n\n**3. [Re Weakness 3: A cross reference in Line 74.]**\n\nThanks for your positive suggestion! We kindly argue that we have added cross references at the end of each subsection of the method section for the potential discussion of corresponding paragraphs.  But we agree that a proper global cross reference to ablation studies and discussions will ease reading. We will add it in the final version. Thanks once again for the constructive suggestion!\n\n**4. [Re Question 1: Results under different adversarial attacks.]**\n\nWe provide additional evaluation results in **Table Re.3** with 4 different attacks including the adaptive methods APGD-CE and APGD-DLR under the adversarial cross-dataset evaluation setting. Our observations indicate that our proposed FAP consistently outperforms the baselines.\n\n**5. [Re Question 2: Potential limitation under specific scenarios.]**\n\nThanks for your feedback! Considering the inherent characteristics of efficient tuning, our proposed few-shot adversarial prompt (FAP) is designed to excel at rapidly adapting robustness from general knowledge to downstream tasks. Despite its advantages, the FAP is not a universal solution for all downstream problems. As far as we are concerned, there is one scenario where it may not be effective:\n\n- When downstream tasks significantly diverge from general knowledge, a natural distribution gap exists. This gap makes learning adversarial robustness using FAP from tasks with distribution shifts particularly challenging. For example, applying FAP on specialized datasets such as FGVCAircraft (fine-grained aircraft images) and DTD (texture dataset) does not yield significant improvements in adversarial robustness.\n\nGiven that prior knowledge cannot effectively generalize to the aforementioned tasks, we conjecture that full-finetuning might be more suitable than prompt learning for adversarial adaptation in such settings.\n\n**6. [Re Limitation 1: Future work on evolving adversarial attacks.]**\n\nWe appreciate your constructive suggestions! We had the following discussions:\n\n- As you mentioned, our proposed method is likely to be effective against evolving adversarial attacks when paired with adaptive test-time defenses. This synergy arises because both strategies share a common goal to rapidly adapt to input changes and enhance adversarial robustness.\n\n- Within the context of prompt architecture, we think the test-time prompt framework **[4]** will be more suitable to be compatible with adaptive test-time adversarial defense, as it tunes adaptive prompts on the fly with a single test sample. In other words, such a combination sheds light on adaptive test-time adversarial defense for VLMs, which seems to be a more concise yet powerful defense method for the long-term robustness of VLMs.\n\n\n\n[1] Cherti, Mehdi, et al. \"Reproducible scaling laws for contrastive language-image learning.\" CVPR, 2023.\n\n[2] Mao, Chengzhi, et al. \"Understanding zero-shot adversarial robustness for large-scale models.\" ICLR, 2023.\n\n[3] Zhang, Jiaming, et al. \"Adversarial prompt tuning for vision-language models.\" ECCV, 2024.\n\n[4] Shu, Manli, et al. \"Test-time prompt tuning for zero-shot generalization in vision-language models.\" NeurIPS, 2022.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "BSNtBjlyax", "reviewer": "Reviewer_Rdwb", "summary": "This paper proposes a few-shot adversarial training methodology for vision-language models to ensure robustness in downstream tasks of pretrained vision-language models. Specifically, instead of using traditional adversarial training methods, it adapts the TRADES loss, a prominent adversarial training approach, for vision-language models. Additionally, it leverages the structural characteristics of vision-language models by adaptively adjusting the weight of the regularization loss, enabling the model to effectively learn robustness in few-shot learning scenarios. As a result, the proposed methodology allows vision-language models to easily acquire robustness through few-shot learning, demonstrating high performance.", "questions": "Please provide answers to the mentioned points. Additionally,\n- Were the adversarial examples in Figure 2 generated using PGD or were they generated by maximizing the KL divergence loss?\n- Are there any comparative experimental results based on full fine-tuning?", "limitations": "Mentioned above", "rating": 6, "confidence": 2, "soundness": 2, "presentation": 2, "contribution": 3, "strengths": "The methodology proposed by the authors effectively adapts the TRADES adversarial training method, originally used in other fields (vision), for training vision-language models. Additionally, they apply a uni-modal adversarial-aware mechanism to the TRADES loss. Through further analysis, the authors demonstrate that this mechanism enables the model to distinguish well between natural and adversarial examples, avoiding meaningless learning and promoting meaningful learning, which is highly suitable for few-shot learning. The authors point out that pretrained models often show insufficient performance on natural examples when learning adversarial examples for downstream tasks in few-shot learning scenarios. TRADES appears to be a highly suitable loss function for addressing this issue. Consequently, experiments show that the proposed method achieves superior performance in both clean and robust accuracy compared to existing methods.", "weaknesses": "- The motivation does not seem sufficient. Among the drawbacks of previous methods raised by the authors, it is not clearly conveyed how (1) and (2) are addressed and resolved later in the paper. Instead, it might have been better to emphasize in section 3.5 that existing methods or simply applying TRADES can lead to small perturbations that do not promote robust learning, which can be particularly disadvantageous in the constrained context of few-shot learning. For (3), if the issue is that the existing clean accuracy is compromised by training only with adversarial examples during the few-shot learning process, a baseline experiment analyzing the performance when both clean and adversarial examples are used together might have been more insightful.\n- There is a lack of analysis regarding the proposed Uni-Modal Adversarial-Aware Mechanism. It is unclear why this method is implemented as a multiplicative factor to the KL divergence loss rather than adding a separate loss. The reasons behind the results shown in Figure 2 using this learning method are not clearly explained. While I understand that it is advantageous for learning if clean and adversarial examples are distinctly separated in the embedding space, I am concerned that if clean and adversarial examples are separated in this manner in the final trained model, it might actually reduce robustness.\n- The analysis of the experiments is insufficient. Although the proposed methodology showed an increase in the overall average performance on the tested datasets, some datasets exhibited similar or even decreased performance compared to existing methods. A deeper consideration and explanation of these observations are necessary.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "### Official Response to AnonReviewer Rdwb:\n\nWe are genuinely grateful for your detailed assessment and valuable insights. Your constructive feedback has significantly contributed to the refinement and advancement of our study.\n\n**1. [Re Weakness 1: How we solve drawbacks of previous methods.]**\n\nThanks for your feedback! We kindly argue that we have provided targeted solutions to each of the three drawbacks (**lines 113-130**) of the previous method. We illustrate them as follows:\n\n- For drawback (1), concerning the need for large datasets and lengthy prompts, we have implemented a few-shot setting and cross-modality prompt structures to reduce adaptation efforts.\n\n- For drawback (2), regarding hand-crafted text prompts lacking adversarial cues, we've integrated learnable text supervision that evolves end-to-end from adversarial visual examples.\n\n- For drawback (3), we agree that a baseline that uses both clean and adversarial examples will be insightful. We treat the TRADES-like loss design as such a baseline. From the comparison results (**lines 1 and 4 in Table 5**), we can find that the natural term brings about significant performance gain, which validates our analysis of drawback (3).\n\n  > ***Note:** We didn't use both clean and adversarial examples directly with two cross-entropy terms, as aligning both output features with one-hot labels through cross-entropy could cause conflicts. While for completeness, we included these results in **line 2 of Table 5** for ablation.\n\n**2. [Re Weakness 2: Analysis of the uni-modal auxiliary loss.]**\n\nThanks for your feedback! We first clarify the contribution of the adversarial-aware mechanism as follows:\n\n- Although both natural and adversarial examples contain robust and predictive features consistent with human judgment, adversarial perturbations are predictive yet imperceptible features. We use an adversarial-aware mechanism to minimize reliance on such non-robust features.\n\n- The cross-modal consistency term $\\mathcal{L}\\_\\text{KL}$ ealigns categorical features of natural and adversarial examples, aiding robust feature learning. The uni-modal adversarial-aware term $\\mathcal{L}\\_\\text{cos}$ highlights differences, alerting the model to non-robust features and reducing sensitivity.\n\n- Practically, the cross-modal consistency term $\\mathcal{L}\\_\\text{KL}$ seeks to balance two cosine similarities between text-image pairs. This can be regarded as aligning the angles between natural and adversarial text-image representations in the feature space. Two scenarios arise:\n\n  1.  The visual features are similar, being on the same side of the text feature.\n  2.  They differ but have the same angle with the text feature.\n\n  Our uni-modal adversarial aware mechanism maximizes the similarity between natural and adversarial visual features to ensure cross-modal consistency falls into the second scenario. Thus, $\\mathcal{L}\\_\\text{cos}$ acts as an additional constraint for $\\mathcal{L}\\_\\text{KL}$, reducing reliance on non-robust features.\n\nWe then explain why the uni-modal loss is implemented as a multiplicative factor:\n\n- As illustrated above, the uni-modal term is an additive constraint for KL term, as it makes the cross-modal consistency fall as much as possible into the second case. Therefore, we should multiply $\\mathcal{L}\\_\\text{cos}$ to $\\mathcal{L}\\_\\text{KL}$.\n- Additionally, we typically follow the two-term formulation from TRADES. This aligns more closely with the trade-off between natural and adversarial samples in adversarial problems.\n- Comparative testing results in **Table Re.4** shows the three-term loss design slightly lowers performance. For better results and simpler hyper-parameter tuning, we prefer the two-term design.\n\n**3. [Re Weakness 3: Insufficient analysis of experimental results.]**\n\nWe understand your concern. We answer it as follows:\n\n- Our method is tested across 11 diverse datasets, many of which pose challenges due to their deviation from general knowledge. Despite challenges, it generally performs well, achieving significant average gains.\n- Detailed analysis shows that our method excels in 9/12 downstream tasks in adversarial few-shot learning (**Figure 3**) except Caltech101, DTD, and FGVCAircraft, and in 9/12 tasks in adversarial cross-dataset transfer (**Table 8**) except DTD, EuroSAT, and Flowers102. These typically involve fine-grained classification with small inter-class differences among samples. \n- In these cases, our method might be less effective due to similar inter-class differences in adversarial examples. Using TeCoA loss to fit the label distribution of adversarial examples and allowing flexible learning through text prompts might better distinguish between classes.\n\n**4. [Re Question 1: Adversarial attack generation.]**\n\nThanks for the feedback! Adversarial examples are generated using PGD in **Figure 2** as the results are visualized on the test set. All test-time attacks follows the same PGD settings for fair comparison. \n\n**5. [Re Question 2: Did not consider full fine-tuning setting.]**\n\nWe understand your concern. We explain this as follows.\n\n- We prioritize the few-shot adversarial prompt setting as it's more relevant to real-world situations where large labeled datasets are costly. This approach suits VLMs particularly, which are resource-intensive in pre-training. We aim to reduce dependency on extensive downstream data by using semantic supervision to ease adaptation.\n- Additionally, we enhance robustness via prompt learning, an efficient method that doesn't need much time or resources. It uses the prior knowledge for quick adaptation to specific tasks. We focus on creating efficient prompt structures and objectives instead of depending on large datasets.\n- Lastly, our FAP shows better performance than SOTA, even with smaller datasets as shown in **Table 2**. This reveals VLMs' capacity in few-shot adversarial prompt, encouraging further exploration in such adaptations.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
### General response

We appreciate the reviewers’ insightful comments and constructive feedback on our manuscript. We are pleased to receive positive feedback from most of the reviewers. Furthermore, we are delighted to learn that the reviewers found the idea of the proposed method to be novel and effective (all reviewers), the experiments to be overall convincing and impressive (Reviewers KV22, Lycp, and M4S3), and the concept illustration/analysis is clear and informative (Reviewers KV22, Lycp, and M4R3). Based on the comments, we provide a general response to the points raised by multiple reviewers and individual responses below to address each reviewer’s concerns.

(1) Regarding the questions about the experiments, we have taken the following actions:

- For Reviewer M4S3, we have provided experimental results about different vision-language models.

- For Reviewer M4S3, we have supplemented comparative experiments on existing methods.

- For Reviewer M4S3, we have added experiments with different attack methodologies.

- For Reviewer Rdwb, we have provided experiments with different design choices for the uni-modal adversarial aware term.

  > ***Note: We have provided the experimental results mentioned above in the PDF, numbered from Table Re.1 to Table Re.4.**

(2) We have addressed the questions about the proposed problem, the idea, and technical details as follows:

- For Reviewer KV22, we have addressed the questions about framework comprehensibility, loss ablation, and prompt design.
- For Reviewer Lycp, we have addressed the concerns about the methodology explanation and usefulness of the few-shot setup.
- For Reviewer M4S3, we have solved the questions about the generalizability, comparative analysis, adversarial attack diversity, additional limitation, and further application on test-time adaptive attacks.
- For Reviewer Rdwb, we have answered the questions about the motivation, adversarial-aware mechanism analysis, and further experimental analysis.

(3) For the valuable suggestions of all reviewers regarding the presentation and organization of this paper, we will take them and finish modifications accordingly in the final version of this paper.

We sincerely thank all the reviewers for their constructive suggestions. Please feel free to let us know if further details/explanations would be helpful.

Yours sincerely,

Authors of #1695

Meta-review: This paper proposes a few-shot adversarial prompt framework aimed at improving the adversarial robustness of vision-language models (VLMs). Overall, all reviewers enjoyed reading this paper and found the proposed method is novel and the provided empirical results are strong. But meanwhile, several concerns are raised, including some technique aspects need to be further clarified, and additional ablations are needed. 

The authors' rebuttal successfully addresses most of these concerns, and all reviewers unanimously agree to accept this paper.
Decision: Accept (poster)