A Study of the Effects of Transfer Learning on Adversarial Robustness
Authors: Pratik Vaishnavi
Kevin Eykholt
Amir Rahmati
Venue: Accepted by TMLR ()

Abstract: The security and robustness of AI systems are paramount in real-world applications. Previous research has focused on developing methods to train robust networks, assuming the availability of sufficient labeled training data. However, in deployment scenarios with limited training data, existing techniques for training robust networks become impractical. In such low-data scenarios, non-robust training methods often resort to transfer learning. This involves pre-training a network on a large, possibly labeled dataset and fine-tuning it for a new task with a limited set of training samples. The efficacy of transfer learning in enhancing adversarial robustness is not comprehensively explored. Specifically, it remains uncertain whether transfer learning can improve adversarial performance in low-data scenarios. Furthermore, the potential benefits of transfer learning for certified robustness are unexplored. In this paper, we conduct an extensive analysis of the impact of transfer learning on both empirical and certified adversarial robustness. Employing supervised and self-supervised pre-training methods and fine-tuning across 12 downstream tasks representing diverse data availability scenarios, we identify the conditions conducive to training adversarially robust models through transfer learning. Our study reveals that the effectiveness of transfer learning in improving adversarial robustness is attributed to an increase in standard accuracy and not the direct ``transfer'' of robustness from the source to the target task, contrary to previous beliefs. Our findings provide valuable insights for practitioners aiming to deploy robust ML models in their applications.

Published in Transactions on Machine Learning Research (05/2024)
A Study of the Effects of Transfer Learning on Adversarial Robustness
Pratik Vaishnavi Stony Brook University
podihnanrfess.stonggoookcc
Kevin Eykholt IBM Research
KhenkkolttSibm.com
Amir Rahmati Stony Brook University
emir@essstongyrooks
Reviewed on OpenReview: https: // www.reveewwwweeeeeee net/ forum?
id- forum?
T6RygOF26B
Abstract
The security and robustness of Al systems paramount in real-world applications. Pre- vious research has focused on developing methods to train robust networks, assuming the availability of sufficient labeled training data. However, in deployment scenarios with lim- ited training data, existing techniques for training robust networks become impractical. In such low-data scenarios, non-robust. training methods often resort transfer learning. This involves pre-training a network on large, possibly labeled dataset and fine-tuning for new task with a limited set of training samples. The efficacy of transfer learning in enhancing adversarial robustness is not comprehensively explored. Specifically, it remains uncertain whether transfer learning can improve adversarial performance in low-data scenarios. Fur- thermore, the potential benefits of transfer learning for certified robustness are unexplored. In this paper, we conduct an extensive analysis of the impact transfer learning on both empirical and certified adversarial robustness. Employing supervised and self-supervised pre-training methods and fine-tuning across 12 downstream tasks representing diverse data availability scenarios, we identify the conditions conducive to training adversarially robust models through transfer learning. Our study reveals that the effectiveness of transfer learn- ing in improving adversarial robustness is attributed to an increase in standard accuracy and not the direct "transfer" of robustness from the source to the target task, contrary to previons beliefs. Our findings provide valuable insights for practitioners aiming to deploy robust MT. models in their applications. The code used to produce the findings in this paper is available at: https: http///gtttttcooot con www.///o////eeeeeeeeeeeeeeeee Sthos-lab/transfee Lar.rmaaag.......rrrrraaaaaa_aaa raw.ariiterrouueeessseeeeee for adversarial
1 Introduction
Transfer learning, as summarized in Figure 1, has been extensively studied for improving standard general- ization machine learning systems across various data availability scenarios (Yosinski et al., 2014; Kornblith et al., 2019; He al., 2019). In the context of adversarial robustness, however, there are only limited works that have studied the benefits of transfer learning (Hendrycks et al., 2019; Chen al., 2020a). These works generally limit themselves to empirical robustness by solely using adversarial training (Madry et al., 2018) (or its variants) in their experiments. Furthermore, they only study the scenario where abundant data is available for the downstream tasks, f.e., well-represented tasks (e.g., CIFAR-10, CIFAR-100). The exact effect of transfer learning on empirical robustness when there a lack of abundant data for the downstream tasks, i.e., andee--rpresenned tasks, is therefore unknown.

---

Published in Transactions on Machine Learning Research (05/2024)
It is also unclear whether the findings in the con- text of empirical robustness would apply to certified robustness training methods, specifically random- ized smoothing-band based methods (Cohen et al., 2019; Salman al., 2019; Zhai et al., 2020; Jeong & Shin, 2020; Jeong al., 2021) which provide state-of-the- art certified robustness in the fg-space. This be- cause both these classes of methods rely on funda- mentally different ways of measuring and encoding adversarial robustness, and so classifiers trained us- ing them inherit different properties. Case in point, Kireev et al. (2022) demonstrated that empirical and certified training methods exhibit dissimilar levels of robustness against common image corruptions. Finally, there is little work that studies the effect of self-superviied pre-training adversarial robust- ness, with existing works limiting themselves to well- represented tasks.
Source Task
Target Task
Knowledge Transfer
M
Pre-training
Fine-tuning
Target Classifier
Transfer
Classifier
Learning
Figure 1: Through transfer learning, one can obtain high-performance networks in settings where it would otherwise be infeasible, é.e., low-data regimes. The network is first trained on a source task with a large training dataset and then fine-tuned on the low-data larget lask.
Table 1 summarizes the findings of prior works in regard to improving performance and robustness in a range of data availability scenarios. The effects of transfer learning on adversarial robustness are largely unexplored (limited to empirical robustness and well-represented tasks). Furthermore, note that self- supervised pre-training has become important component of the transfer learning framework of late it alleviates the need for labeled data for pre-training. The models fine-tuned using pre-trained weights generated via seff-supervised learning have exhibited unprecedented generalization ability, unlocking large- scale commercial applications that were infeasible only a few years back. However, using self-supervision to train highly secure ML models is a topic that has largely been overlooked. Therefore, in this paper, we make adversarial robustness our primary focus and broadly study the effects of self-supervised pre-training on it.
We summarize the contributions of this work follows:
We perform a comprehensive study on the utility of transfer learning towards certified and empir- ical robustness across a range of downstream tasks. First, a classifier is robustly pre-trained on a large-scale dataset (f.e., ImageNet) using supervised or self-supervised methods and then robustly fine-tuned on the downstream task. Our experimental results show that such pre-training is bene- ficial toward improving adversarial performance on downstream tasks compared to training on the downstream task directly.
We further show that during transfer learning, only the fine-tuning part of the pipeline neods rely on robust training methods. This finding eases the overhead of training robust classifiers. Also, regardless of the amount of labeled data available for either pre-training fine-tuning, classifiers with high adversarial robustness can be trained on downstream tasks.
Finally, our work is the first to demonstrate that classifiers be trained to achieve high certified robustness on downstream tasks irrespective of the amount of labeled data available, either during pre-training or fine-tuning.
Our findings serve as a useful guidance for ML practitioners wanting to deploy highly robustness models in a range of data availability scenarios.
2 Background
In this paper, we focus on transfer learning for image classification tasks. More specifically, we explore whether transfer learning can be used to train deep neural network-based image classifiers with high (empir- ical and certified) adversarial robustness in range of data availability scenarios. In this section, we provide
2

---

Published in Transactions on Machine Learning Research (05/2024)
Table 1: Summarizing the findings of prior works regarding the usefulness of transfer learning towards
standard generalization and adversarial robustness.
Is Transfer Learning Useful?
Supervised
Self-Supervised
Low-Data
High-Data
Low-Data
High-
Standard
x
Generalization
(Korublith et al,, 2019)
(He et al., 2019)
(Chon et al,, 2020b) (Chen et al., 2020b)
Empirical
?
?
Adversarial Robustness
(Hendrycks et al., 2019)
(Chen et al., 2020a)
Cortified
?
?
?
?
readers with the necessary background regarding transfer learning (Section 2.1) and adversarial robustness of deep neural networks (Section 2.2).
2.1 Transfer Learning
In transfer learning (Caruana, 1994; Pan & Yang, 2009; Bengio el al., 2011; Bengio, 2012; Yosinski el al., 2014; Huh et al., 2016), a network is pre-trained on a source task and then fine-tuned on a target task. Through pre-training, the network learns features that enable it to generalize better when finc-tuned on the target task (Yosinski et al, 2014). This is true even when the source and target tasks are dissimilar. For example, prior works (Sermanet et al., 2013; Girshick et al., 2014) re-purposed networks trained for ImageNet (Deng et al., 2009) classification task to achieve breakthroughs on object detection tasks. Pre-training has also been shown to be an effective solution for training high-performance networks when available training data is insufficient for standard training (Pan & Yang, 2009). However, He al. (He et al., 2019) showed that, in the presence abundant training data, similar levels of generalization can be achieved whether pre-training is performed or not. In such cases, the only benefit of transfer learning then is faster convergence and, therefore, savings in training time. Other studies found that transfer learning effectively transfers other desirable properties like shape bias (Utrera et al., 2020), robustness to common image corruptions (Yamada & Otani, 2022) and adversarial perturbations (Hendrycks et al., 2019). Specific fine-tuning methods have also been developed to optimally preserve desirable properties like empirical adversarial robustness (Liu et al., 2023; Xu et al., 2023).
2.1.1 Self-supervised Pre-training
Traditionally, pre-training was performed in a supervised fashion on large-scale labeled datasets, which can be challenging acquire in many domains. However, unlabeled data tends to be widely available. To leverage these unlabeled datasets, self-supervised pre-training was proposed to enable models to learn generalizable features by optimizing custom training objective. Contrastive learning (Chen et al., 2020b; He et al., 2020; Caron et al., 2020; 2021) is one such approach. Models are trained to maximize the similarity between positive pairs (semantically similar data samples) while minimizing the similarity between negative pairs (salantically dissimilar data samples) in the feature space. SimCLR (Chen et al., 2020b), one of the most popular contrastive learning methods, generates the positive pairs by applying two different sets of input transformations (like cropping, color distortion, and blurring) to the same image. Negative pairs are generated using transformed versions of different images. Self-supervised methods often achieve state-of-the- art results in a range of applications such as image classification, object detection, and sentiment analysis after fine-tuning on relatively small amounts of labeled data.
2.2 Adversarial Robustness
Neural networks are known to be susceptible to adversarial evasion attacks, which attempt to modify a given input imperceptibly with the goal of triggering misclassification. Since the discovery of this vulnerability,
3

---

Published in Transactions on Machine Learning Research (05/2024)
several methods have been proposed to train neural networks that are robust against such attacks. These methods can be broadly classified as empirical and certified methods based on the nature of the robustness guarantees they provide.
2.2.1 Empirical Adversarial Robustness
Empirical adversarial robustness is traditionally measured using the strongest possible attack within pre- determined threat model. Robustness training methods that rely on this strategy train the neural network to be robust against this strongest attack and, in turn, gain robustness against all possible attacks within the same threat model. However, such robustness is not provable in nature and can be challenged by an adaptive adversary (Carlini & Wagner, 2017; Athalye et al., 2018; Tramer et al., 2020). Adversarial training (Madry et al., 2018), is one of the most promising empirical robustness methods, as is evident from the fact that the current slate-of-the-art methods (Zhang et al., 2019; Wu al., 2020) is derived from the basic framework proposed by Madry et al. (Madry et al., 2018). This framework involves generating adversarial inputs on the fly during training and updating the neural network's weights using them. Furthermore, several works (Tsipras et al., 2019; Ilyas et al., 2019; Augustin et al., 2020) still study the models trained by Madry et al. to learn more about adversarial robustness in general. Due to its prominence and in an attempt to fall in line with prior works, we use adversarial training as a representative of empirical robustness training methods.
2.2.2 Certified Adversarial Robustness
Despite the progress made towards developing empirical robustness methods with strong robustness guar- antees, the lack of provability remains an issue. Provably/certiffably robust training methods remedy this concern by maximizing the lower bound of a neural network's output corresponding to the correct class within a certain range of input perturbations. Tf, for given input, the lower bound of the correct class output is higher than the upper bound of all other class outputs, the neural network is provably robust for that input. Computing and maximizing this lower bound for multi-layer neural network is an NP-hard problem (Katz et al., 2017). In recent literature, several methods have been proposed to approximately com- pute this lower bound and incorporate it in the training process of the neural network in a scalable manner. Of these, randomized smoothing based methods (Cohen et al., 2019; Salman et al., 2019; Zhai et al., 2020; Jeong& & Shin, 2020; Jeong et al., 2021) yield state-of-the-art robustness the fz-space for modern neural networks. Therefore, in this paper, we focus on these methods.
First formalized by Cohen et al. (Cohen et al., 2019), randomized smoothing defines the concept of a smooth classifier. Given a base classifier So, the smooth classifier go, is defined as follows:
() arg max P + n) c)
(1)
eEy
Simply put, the smooth classifier returns the class c, which has the highest probability mass under the Gaussian distribution ground truth label y, it is said to be certifiably robust (with high probability) at x. The certified radius, i.e., the input radius in which a's prediction consistent, given by:
If, for given input x, the smooth classifier's output e is equal to the
CR(ga:x.v) (.0::,,y) = _
- (P, + n) = v) [
(2)
Φ (max (oo( + +1)= -')1
v'Fy
Randomized smoothing- robustness training methods focus maximizing the average certified radius for a given datasct (Cohen et al., 2019; Salman et al., 2019; Zhai et al., 2020; Jeong et al., 2021). Co- hen et al. (Cohen el al., 2019) simply augmented the training data with Gaussian noise when training the base classifier. Salman et al. (Salman et al., 2019) modified the adversarial training objective to work in this new framework. Zhai al. (Zhai et al., 2020) derived a differentiable approximation of the certified radius and directly maximized it during training. Jeong et al. (Jeong & Shin, 2020) find that the certified robustness of smooth classifier can be greatly improved by enforcing the base classifier's outputs over several noisy
4

---

Published in Transactions on Machine Learning Research (05/2024)
copies of a given input to be consistent. They achieve this consistency by using regularization loss that forces the output for noisy copy of the input to be closer to the expected output over several noisy copies. Finally, Jeong et al. (Jeong et al., 2021) identified that the certified radius of the smooth classifier is aligned with its prediction confidence and used a combination of adversarial training and micup (Zhang et al,, 2018) to favorably calibrate the prediction confidence.
3 Empirical is not the same as Certified
Broadly, the process of training adversarially robust classifiers can be dissected into two key stages: (1) quanti- fying the adversarial risk across the training data distribution and (ii) minimizing this adversarial risk during the training process. Empirical methods, such as Adversarial Training, mcasure the adversarial risk by de- termining the maximum loss achievable for an input subjected to adversarial manipulations. This entails employing the most potent attack within a predefined threat model. On the other hand, certified methods utilizing randomized smoothing measure adversarial risk by measuring the largest possible radius around a given input within which the classifier's output remains consistent (Equation 2). The fundamental disparity in how adversarial risk is assessod encourages empirical and certified classifiers to manifest distinct robust- ness properties that the other may not possess. We perform a brief investigation using Gaussian noise image corruption that illustrates the differences between these two robustness classes. Through this demonstra- tion, we underscore the caution required when extending findings from empirical robustness to the realm of certified robustness.
First, we train two ResNet-50 classifiers on Ima- geNet: (i) using an empirical robustness training method, i.e., Adversarial Training (AT) (Madry et al., 2018), and (ii) using certified robustness training method, i.e., Consistency Regularization (CR) (Jeong & Shin, 2020). For CR, we use Gaussian noise distribution with standard deviation a a= 0.5. Subsequently, we assess the performance of these classifiers on the test set, perturbed by Gaus- sian noise using different values of a. The outcomes are detailed in Table 2. We observe that the AT classifier's performance declines as the value of a increases, whereas the CR classifier performs well only when the a value for the test data is exactly the same as the value used during training. This phenomenon aligns with observations made by Kircev et al. (2022), indicating that employing Gaussian data augmentation during training, such as in CR, results in the classifier overfitling to the noise at the value of a used during training. Classifiers trained using AT do not exhibit this overfitting behavior.
Table 2: Performance comparison of a classifier trained using AT (Madry et al., 2018) and a base classifier trained using CR (Jeong & Shin, 2020), under varying levels of Gaussian noise. The AT classifier shows a gradual decline in performance as the noise severity increases, whereas the CR classifier overfits to the level of noise encountered during training (f.e. 0.5).
Noise Stddev (o)
Method
0.001
0.01
0.1
0.5
Adversarial Training
54.5
54.5
28.5
0.1
Consistency Regularization
19.0
19.1
21.8
60.5
Next, evaluate the certified test accuracy of the smooth classifier derived from the afore base classifiers, presenting the results in Table 3. Certified accuracy at a given f2 radius, denoted as r, represents the proportion of test samples with a certified radius (as per Equation 2) greater than r. Recall that a smooth classifier makes predictions through majority voting over outputs from multi- ple noisy copies of a given input (see Equation 1). Consequently, selecting an appropriate value for the noise parameter a for the smoothing process, one that the base classifier can "handle", is crucial. We make this selection informed by the findings presented in Table 2. The CR base classifier is smoothed using 0.5, consistent with the value used during training, aligning with established prac-
Table 3: Certified accuracy at different & radii of smooth classifiers that use base classifiers trained with AT (Madry et al., 2018) and CR (Jeong & Shin, 2020). The smoothing is performed using = 0.01 and 0.5, respectively. AT smooth classifier exhibits no mean- ingful cortified robustness.
f2 radius
Method
0.0
0.5
1.0
1.5
Adversarial Training
49.6
0.0
0.0
0.0
Consistency Rogularization
54.8
50.1
43.8
33.5
5

---

Published in Transactions on Machine Learning Research (05/2024)
tices in randomized smoothing literature (Cohen et al., 2019). In the case of the AT base classifier, opt for 0.01 since the base classifier demonstrates sharp drop in performance at higher values. Once again, we observe noteworthy variations in performance depending on the training method of the base classifier. The CR smooth classifier reports non-zero certified test accuracy at varions radii, whereas the AT smooth classifier exhibits no certified robustness, i.e., the certified accuracy for any l radius r > 0 is negligible.
Empirical methods, such as AT, have been extensively scrutinized in the literature, with previous stud- ies (Tsipras et al., 2019; Moosavi-Dezfooli et al., 2019; Ilyas et al., 2019; Kireev et al., 2022) unveiling various distinctive properties introduced by these methods. Given the close conceptual connection between certified robustness and empirical robustness, there might be a tendency to extrapolate findings in the context of empirical robustness without verification. However, the results presented in this section emphasize that these two classes of methods exhibit more dissimilarity than one might presume, and sranighhforwwrrllyy translating findings between them may lead to erroncous assumptions. Therefore, as part of our contributions through this study, we diligently validate the conclusions drawn in the realm of empirical robustness and transfer learning to certified robustness (Section 4.3).
4 Transfer Learning for Adversarially Robust ML
Commercial systems are becoming increasingly reliant on AT. However, adversarial attacks remain an ever- present issue when considering the trustworthiness of these systems. Unfortunately, training models with high adversarial robustness using current methods requires access to large amounts of labeled data (Schmidt et al., 2018), which is hard to achieve in many deployment scenarios, even in the actively studied image domain. Except for public datasets such as ImageNet, most vision tasks may only have a handful of labeled data samples for training.
In non-robust scenarios, transfer learning one solution to alleviate the need for abundant training data for a given task. It involves pre-training on a data-rich (source) task followed by fine-tuning on the low-data downstream lask achieve state-of-the-art performance. Unfortunately the relationship between transfer learning and adversarial robustness has only been studied in one specific scenario, when the downstream task has abundant labeled training samples and empirical adversarial robustness is the property of interest. To our knowledge, there are no works that explore using transfer learning to enable the deployment of empirically robust models on small-scale datasets. Furthermore, there are no works that study the relationship bet ween transfer learning and certified adversarial robustness.
We present the first comprehensive study on the utility of transfer learning towards adversarial robustness. In Section 4.1, we describe our experiment setup. In Sections 4.2 and 4.3, we examine the benefits of transfer learning in the context of empirical and certified robustness in a range of data availability scenarios. Here, we use different pro-training methods (robust and non-robust), and perform fine-tuning robustly. In Section 5, we will examine the need for robustness training during the different phases of transfer learning, i.e., pre-training and fine-tuning.
4.1 Setup
In this section, we describe our experimental setup. Additional implementation details are available in Appendix A.
Dataset and Model. For pre-training (supervised and self-supervised), we use the standard ImageNet dataset. For fine-tuning, we use suite of 12 downstream datasets (Kornblith et al., 2019) often used in transfer learning literature. Training is done using a ResNet-50 classifier. All images are scaled to 224 x 224 in order to be compatible with ImageNet pre-trained weights.
Threat Model. We measure the adversarial robustness with respect to a white-box l adversarial attack. Our choice of adversary is motivated by the fact that randomized smoothing (Cohen et al., 2019), our choice of certified robustness method, defines robustness in the l space. This enables us to easily compare both adversarial metries (empirical and certified) during evaluation.
6

---

Published in Transactions on Machine Learning Research (05/2024)
Supervised Training. As a baseline for comparison, for every downstream task, we train randomly initialized model using only the downstream lask's labeled data. When studying the effects of transfer learning on empirical robustness, we use Adversarial Training (AT) (Madry et al., 2018) for baseline training, pro-training, and fine-tuning. AT uses a PGD attack with c = 0.5, step size = 2e/3, and 3 steps. We note that higher values of e will only result in reducing the overall performance of the models. When studying the effects of transfer learning on certified robustness, we use Consistency Regularization (CR) (Joong & Shin, 2020) for baseline training, pre-training, and fine-tuning. For CR, we use o = 0.5, number of Gaussian noise samples = 2, À = 5, and 17 0.5.
Self-supervised Training. Due to its popularity in current literature, we study the benefits of self- supervised pre-training on adversarial robustness. Unfortunately, most existing adversarially robust self- supervised methods (Jiang et al., 2020; Fan et al., 2021; Luo et al., 2022; Xu et al., 2024) have not been scaled to ImageNet, but on smaller datasets instead. The one mothod we found that uses ImageNet (Gowal et al., 2020) does not have code publicly available. Thus, we use the SimCLR (Chen et al., 2020b) training method, a contrastive learning approach.
Evaluation. For measuring empirical robustness during evaluation, use autoPGD (Croce & Hein, 2020) (hhite-box) and Square attack (Andriushchenko et al., 2020) (black-box). We generate adversarial test sets using these two attacks and measure the model's accuracy on them, denoted by RA-WB and RA-BB respectively. In both cases, we use the same adversarial budget as what was used during training, í.e. == 0.5. The other attack hyperparameters are set to the default values reported by Croce & Hein (2020), i.e., aut uses 100 steps and 5 random restarts and the Square attack uses 5000 queries and random restart. For measuring certified robustness during evaluation, Cohen et al. (2019) and report the fraction of inputs in the test set with certified radius (Equation 2) greater than or equal to the adversarial budget of e = 0.5, called certified robust accuracy and denoted as RA-CC. Additionally, we report the average radius around an test input within which the model's prediction remains consistent, called Average Certified Radius and denoted as ACR. For all models, we also report the accuracy on the clean test set, called standard accuracy and denoted as SA.
use the certification process proposed by
4.2 Empirical Adversarial Robustness
Prior works (Hendrycks et al., 2019; Chen al., 2020a) have demonstrated that, unlike with standard generalization, empirical robustness benefits from transfer learning for well-represented downstream tasks. We begin our study by validating their findings and then extending them to wider range of data availability scenarios. On suite of 12 target lasks, we train three versions of ResNet-50 classifier: (i) using randomly initialized weights, (ii) using pre-trained weights obtained by performing Adversarial Training (AT) (Madry et al., 2018) on ImagoNet, and (iii) using pre-trained weights obtained by performing SimCLR (Chen et al., 2020b) on ImageNet. The standard accuracy (SA) and robust accuracy against white-box and black-box attacks (RA-WB and RA-BB) of the resultant classifiers are reported in Table 4.
First, we see that, as prior work also demonstrated (Hendrycks et al., 2019; Chen et al., 2020a), transfer learning using model pre-trained using AT improves performance (SA) and robustness (RA-WB and RA-BB) on well-represented downstream tasks (i.e., C- CIFAR-100, and Food). However, our experiments also show that pre-training with AT improves performance and robustness even on under- represented downstream tasks (e.g., Flowers, Pets, and Caltech-101). On average, across all tasks, pre- training with AT improves SA, RA-WB, and RA-BB relative to random initialization by 11.4%, 12.6%, and 13.0% respectively. We also note that SimCLR pre-training yields consistent improvements in SA, RA-WB, and RA-BB, averaging 14.1%, 9.9%, and 15.5% respectively. While improvements in SA were expected, the improvements in RA-WB WB and RA-BB are surprising given that SimCLR, unlike other self-supervised methods we surveyed (Jiang et al., 2020; Fan et al., 2021; Luo et al., 2022), does not specifically design its objective function with adversarial robustness in mind.
We suspect that improvements in RA due to transfer learning are largely due to the overall improvement in SA rather than the robustness being "transferrod" from the source task (ImageNet) to the target tasks. On Birdsnap, for example, both pre-training methods result in lower SA, which is mirrored by lower RA compared to random initialization. In Figure 2, we plot the relative increase in RA-WB vs. the relative
7

---

Published in Transactions on Machine Learning Research (05/2024)
Table 4: Evaluating the benefits of pre-training for empirical adversarial robustness. Given target task, we train three ResNet-50 classifiers: one using random weight initialization and two using weights pre- trained on source task (ImageNet). Pre-training is performed using supervised (adversarial training) and self-supervised (SimCLR) objectives. During fine-tuning, the full network is trained using AT. Pre-training improves empirical adversarial robustness across all target tasks. Relative change due to pre-training is denoted in superscript.
Random Init.
Sup. Pre-Training
Self-Sup. Pre-Training
Target Task
SA
RA-WB
RA-BB
SA
RA-WB
RA-BB
SA
RA-WB
RA-BB
Food
74.5
62.3
69.5
81.6
10..
69.2 11:1
77,711199
82.2 10.3
68.6 6
78.3 12.8
CIFAR-100
71.8
62.5
67.4
80.1
70.6+129
75.1
80.9 +22.6
70.3
75.8 +12.5
CIFAR-10
93.3
88.8
90.2
91.71002
94.0 104.2
95.9 102.8
91.2 1-0.7
93.8 030.9
Birdsnap
65.2
50.8
59.7
61.8-05.2
48.3-05.0
57.1-04.3
60.4-07.4
44.4-12.6
55.5-07.1
SUN397
51.0
41.7
46.5
55.3+08.8
44.4
52.0+11.7
59.0+15.7
44.3+-06.3
55. 55,7+19.7
Caltech-256
61.4
54.4
58.0
70.6+14.9
62.5+15.0
67 +7.4+16.3
76.8+25.0
65.4+30.1
73.4+26.6
Cars
88.3
83.0
86.9
87.9 87.9-00.5 00.5
82.2-00.9
86.4-00.6
85.8-02.8
76.1 76.1-08.4 08.4
83.9 03.5
Aircraft
76.4
68.6
71.6
77.9 02.00
69.6 101.5
74.8 04.5
76.3-00.1
64.6--55.8
74.3 03.7
DTD
54.3
48.1
52.4
65.8 +21.2
59.7+24.1
64.0 +22.1
72.6 72.6+33.7 +33.7
58.9 4-224
70.3
Pets
73.2
63.3
70.0
86,9+18.7
78.4+23.8
83,9+19.8
88.6+210
74.5+17.6
85,8
Caltech-101
66.7
61.5
63.8
88.5+32.7
83.1 +-3.1
86.1 +-34.
91.9++37.6
83.6++35.9
87.8 +-3.7
Flowers
78.0
72.6
75.2
93.7
90.1 +24.1
92.7+220.3
93.7 +20.1
86.1 1--15-18.55
92.4 122.9
40
% Relative Improvement in RA-WB
30
10
0
-10
-20
Relative Improvement
AT
SimCLR
Figure 2: Plotting the improvement (%) introduced by pre-training relative to random initialization across all 12 target tasks. Improvement in RA-WB is linearly correlated with improvement in SA for both pre- training methods, with R² value of 0.98 for AT and 0.94.
increase in SA due to pre-training We observe strong linear correlation between the two quantities for both the pre-training methods, with R² value of 0.98 for AT and 0.94 for SimCLR.
4.3 Certified Adversarial Robustness
To the best of our knowledge, there exist no works that explicitly study the utility of transfer learning in the context of certified adversarial robustness for either supervised or self-supervised pro-training. As before, we train three versions of ResNet-50 classifier on each target task: (i) using randomly initialized weights, (ii) using pre-trained weights obtained by performing Consistency Regularization (CR) (Jeong & Shin, 2020)
8

---

Published in Transactions on Machine Learning Research (05/2024)
Table 5: Evaluating the benefits of pre-training on certified adversarial robustness. Given a target task, we train three ResNet-50 classifiers: one using random weight initialization and two using weights pre-trained on source task (ImageNet). Pre-training is performed using supervised (consistency regularization) and self-supervised (SimCLR) objectives. During fine-tuning, the full network is trained using CR. In all three cases, training target tasks is performed using consistency regularization. Similar to empirical adversarial robustness, pre-training improves certified adversarial robustness across all target tasks. Relative change due to pre-training is denoted in superscript.
Random Init.
Sup. Pre-Training
Self-Sup. Pre- Pre-Training ACR
Target Task
SA
RA-CT
ACR
SA
RA-CT
SA
RA-CT
ACR
(%)
(%)
(6))
(%)
(%)
(6)
(%)
(%)
(62)
Food
63.0
53.9
0.891
63.2
53.5
0.874-01.9
64,4-02.2
57.6+07.0
0.923
CIFAR-100
70.0
62.8
1.075
70.8 +0.1
65.2 403.8
1.101
+02.4
72.8 04.0
65.0
65.0+03.5 +03.5
1.089 F01.3
CIFAR-10
89.6
86.0
1.508
93.4 93.4
89.2 033.
1.601 +06.1
93.2 04.0
90.4
1.619 +07.4
Birdsnap
42.0
34.7
0.538
41.6-00.8
32.4-06.6
0,504-06.3
41.0-02.8
35.3+017
0.541+0005
SUN397
37.0
32.5
0.519
42.3 14.4 14.44
37.4
0.586+13.0 13.0
44.1 19.1
36.2 +6.2+111.
0.585 +22.7
Caltech-256
54.0
47.4
0.835
60.9 12.8
57.3
1.001 19.9
65.4 65.4-212 21.2
58.5 23.3
1.000 19.7
Cars
81.9
77.5
1.358
79.1 79.1-03.4 03.4
73.9-016
1.285 05.1
05.7
70.1-09.5
1.158-14.7
Aircraft
70.1
63.4
1.065
68. 68.1-02.8 02.8
60.9-04.0
1.022-04.0
69.0-01.5
61,4-034
0.991 -06.9
DTD
44.9
39.4
0.699
50.2
45.3+15.1
0.790+13.0
55.5 55.5-23.7
49.8 49.8+26.5
0.849+21.6
Pets
66.7
61.8
1.068
70.8 06.2
64.5 04.4
1.088 101.9
75.2 12.8
67.2 08.7
1.089 102.0
Caltech-100
62.8
58.3
1.019
78.6+25.2
78.6
76.0
1.339
+3144
80.3
28.0
73.7 73.7+26.4
1.300 +27.5
Flowers
75.2
72.7
1.306
16.44
82.0+12.9
1.538+177
84.6-12.5
12.5
78.7+08.3
1.407+07.7
TTe above results are generated by evalnating a smooth classifier. This entails performing the computationally expensive process of certification, which scales poorly with input dimension. Since all our datasets are ImageNet size (f.e. 224 224), we follow the standard practice (Cohen al., 2019) and perform certification using only evenly spaced images test set.
40
% Relative Improvement in RA-CT
Relative Improvement in ACR
30
20
10
10
-10
-10
% Relative Improvement SA
% Relative Improvement in SA
CR simCLR
simCLR
Figure 3: Plotting the improvement (%) introduced by pre-training relative random initialization across all target tasks. Improvements in both RA-CT (left) and ACR (right) are linearly correlated with improvement in SA for both pre-training methods. For the left plot, R²2 values for CR and SimCLR are 0.92 and 0.89. For the right plot, R² values 0.94 and 0.86.
on ImageNet, and (iii) using pre-trained weights obtained by performing SimCLR on ImageNet. In order to achieve certified robustness during inference, we convert the ResNet-50 classifiers into smooth classifiers following Equation 1. The standard accuracy (SA), certified robust accuracy (RA-CT), and Average Certified Radius (ACR) of the smooth classifiers are reported in Table 5. We compute these quantities using the prediction and certification process described by Cohen et al. (2019).
9

---

Published in Transactions on Machine Learning Research (05/2024)
We observe that supervised and self-supervised pre-training improves performance (SA) and certified ro- bustness (RA-CT and ACR) on downstream tasks. Pre-training with CR results in average relative improvement of 7.1%, 7.5% and 7.3% compared to no pre-training on SA, RA-CT, and ACR, respectively, Similarly, Pro-training with SimCLR results in an average relative improvement of 9.9%, 9.1%, and 6.9% compared to no pre-training on SA, RA-CT, and ACR, respectively. As before, we note that the improve- ments RA-CT and ACR are not necessarily due to the "transfer" of robustness of the pre-trained model. Rather, the improvement in SA seemss to result in an overall increase in RA-CT and ACR. In Figure 3, we plot both the relative improvement in SA vs. RA-CT and SA vs. ACR from pre-training and see strong linear correlation between these quantities. For CR pre-training, the R² value for linear correlation between SA and RA-CT is 0.92, and between SA and ACR is 0.94. For SimCLR pre-training, the R² value for linear correlation bet ween SA and RA-CT is 0.89, and between SA and ACR is 0.86.
5 Discussion
In Scction 4, we demonstratod that a robust transfer learning pipeline is an effective method to train robust models, especially on downstream tasks with small amounts of labeled data. In fact, our self-supervised pre-training results highlight that a large labeled pre-training dataset is also unnecessary. However, there remains a question to which parts of the robust transfer learning pipeline need to use robust training methods. As robust training methods impose higher training overhead compared to non-robust, train- ing methods (Shafahi et al., 2019a; Wong et al., 2019; Vaishnavi et al., 2022), we perform two additional experiments to understand which parts of the transfer learning pipeline must use robust training methods.
5.1 Is Robust Pre-training Necessary?
Transfer learning is designed to improve standard performance on downstream tasks. In Section 4, we observed a strong linear correlation between improvements in performance us. improvements in robustness. This obscrvation suggests that the robustness of the pro-trained model may be irrelevant. The SimCLR results provide further evidence as this training method does not optimize for robustness, and the models trained with it possess empirically certifiable robustness. Using the same experimental setup in Section 4, we pre-train ResNet-50 model using standard training (ST), é.e., minimizing the cross entropy loss, which is also a non-robust pre-training method like SimCLR. We still perform robust fine-tuning of the full network. In Table 6, we measure the empirical and certified robustness of models pre-trained with ST on two downstream datasets and compare it to pre-training with SimCLR and the respective robust pre-training method. We only see minor differences when using ST and SimCLR compared to a robust pre-training method, suggesting that robust pre-training is unnecessary for improving robustness on the downstream task.
To further corroborate our claim that robustness source lask is unnecessary when looking to improve robustness on downstream target tasks, we refer to the prior work by Yamada & Otani (2022). In the context of robustness against Gaussian noise corruption, Yamada et al. state that "it seems difficult to transfer corruption robustness from ImageNet to CIFAR-10. In fact, we find that a non-robustified ImageNNet pre- trained ResNet-50 performs the best when fine-tuned for CIFAR-10". Their findings suggest that Gaussian noise robustness on downstream tasks (CIFAR-10) does not benefit from Gaussian noise robustness on the source task (ImageNet), implying that corruption robustness does not transfer between tasks. We observe similar result but in the context of adversarial noise instead of Gaussian noise.
5.2
Is Robust Fine-tuning Necessary?
In our initial experiments with a robust pre-trained model, we found that we could not use standard training and fine-tune the entire model. The resulting model exhibited neither empirical nor certified robustness as it was biased towards maximizing standard performance. However, Shafahi et al. (2019b) showed that it was possible to train an empirically robust network (against white-box and black-box attacks) if standard fine-tuning was only done on the last model layer, thus freezing the rest of the model, which was pre-trained using AT. The intuition is that the frozen layer of the model pre-trained with AT acts robust. feature
10

---

Published in Transactions on Machine Learning Research (05/2024)
Table 6: Effect of the pre-training method on empirical and certified robustness. The full network fine- tuned using AT and CR. respectively. Robustness not requirement during pre-training in order observe improvement in robustness on downstream tasks. Change due to using non-robust pre-training methods (ST, simCLR) relative to using robust pro-training (AT/CR) is denoted in superscript.
Empirical Robustness
Certified Robustness
Task
SA
RA-WB
RA-BB
SA
RA-CT
ACR
Pre- Treiirainn
Pre- Tre-Training
(%)
(%)
(%)
(%)
(%)
(&)
AT
95.8
91.7
94.0
CR
93.4
89.2
1,601
CIFAR-10
ST
95.4-0.5
91,2-0.6
91.4
ST
93.0-94
88.6
1.584-10
SimCLR
95.9+0.1
91.2
93.8
SimCLR
93.2
90.4+1.3
1.619+12
AT
80.1
70.6
75.1
CR
70.8
65.2
1.101
CIFAR-100
ST
78.5-2.1
68.1-3.5
73.5
ST
70.2-0.8
60.6
1.050
SimCLR
80,9+03
70.3-9.5
75.8
SimCLR
72.8+2.8
65.0
1.089-1a
Table 7: Studying whether certified robustness preserved on fine-tuning the final layer of pre-trained model non-robustly using standard training (i.e., a 0). Using different values of a during training and inference causes the smooth classifier to exhibit poor SA, RA, and ACR.
0.5
0.0
Task
SA
RA-CT
ACR
SA
RA-CT
ACR
(%)
(%)
(&2)
(%)
(%)
(L2)
CIFAR-10
8.4
5.4
0.073
91.0
0.0
0.000
CIFAR-100
0.4
0.4
0.008
75.6
0.0
0.000
extractor that can be fine-tuned non-robustly while preserving empirical robustness. Their method results in a less robust model compared to robust fine-tuning but is computationally more efficient. To verify whether their findings extend to certified robustness, we replicate their experiments by first pre-training a ResNet-50 network on ImageNet using Consistency Regularization (CR) with = 0.5 and then fine-tuning the final layer only on CIFAR-10 and CIFAR-100 using Standard Training. During inference, convert the ResNet-50 classifier into smooth classifier (with 0.5) following Equation to measure certified robustness.
In Table 7, we report the performance and robustness of our ResNet-50 classifiers when converted in a smooth classifier with a = 0.5. We observe that on both datasets, non-robust fine-tuning of the last layer results a classifier with trivial standard accuracy (SA), certified robust accuracy (RA-CT), and average certified radius (ACR). Recall from Equation that a smooth classifier go performs prediction by taking majority voting over several copies of given input x sampled from the distribution W(x, o²1.. Thus, the base classifier should be trained using noisy distribution (i.e., 0.5). Standard fine-tuning is equivalent to training with
0. Thus, the smooth classifier's performance suffers. We see that if we instead use 0, the SA of the smooth classifier is restored, though it has zero RA-CT and ACR (follows directly from Equation 2). From these results, we conclude that robust fine-tuning is a necessary step for robust transfer learning to avoid catastrophic forgetting of robustness on the downstream task. Although Shafahi al. (2019b) demonstrate a potential alternative for this finding in the context of empirical robustness, it significantly lowers the performance and robustness of the inc-tuned model, and as we demonstrated, it doesn't 't extend to certified robustness.
11

---

Published in Transactions on Machine Learning Research (05/2024)
6 Limitations
In this paper, we present a comprehensive analysis of the benefits of transfer learning in the context of adversarial robustness. Our experiments utilize a suite of 12 downstream datasets of varying sizes and several training methods that optimize a diverse set of objectives (pertinent to our study), including standard generalization, empirical robustness, and certified robustness. Through these experiments, we address the knowledge gap highlighted in Table and offer a novel insight into why transfer learning enhances adversarial robustness. Despite covering many significant aspects of the experiment space, there few notable areas have not addressed.
Firstly, all our experiments were conducted using the ResNet-50 classifier. We chose ResNet-50 as the prior works we relied on primarily focused on this model, making it easier to identify hyperparameters and access pro-trained modcls. However, the current statc-of-the-art in image classification transformer-basod models (Dosovitskiy et al., 2020; Liu et al., 2021), not CNN-based models. Therefore, it important to verify our findings using transformer-basee learning method in our experiments. As non-contrastive self-supervised learning methods (Grill et al., 2020; Chen & He, 2021; He ct al., 2022) gain traction, future works should analyze these methods within setup. Thirdly, as mentioned in Section 4.1, we limited our experiments to the l2 threat model to ensure comparability of results in the empirical and certified robustness sections. However, prior works on empirical robustness primarily focus on the fo threat model. Lastly, we only provide empirical evidence for our claim that the ellectiveness of transfer learning improving adversarial robustness due to an increase standard accuracy, not the direct "transfer" of robustness from the source to the target task. Theoretical evidence is needed to further solidify this claim.
models. Secondly, we only used a contrastive self-supervised
7 Conclusion
In summary, our research demonstrates that transfer learning, typically employed enhance classifiers' standard generalization tasks with limited labeled training data, can effectively contribute to improving adversarial robustness on downstream tasks, even when the sample complexity of robust generalization is significantly higher than that of standard generalization. This result holds irrespective of the amount of training data available for the downstream task.
Our experiments reveal that utilizing non-robust training methods during pre-training can still yield bene- fits for adversarial robustness on downstream lasks, provided robust training methods are employed during fine-tuning. We show for the first time that, contrary to traditional beliefs, the gains robustness on the downstream task can be attributed to increase in standard accuracy-4 byproduct of transfer learn- ing rather than direct "transfer" of robustness from the source to the target task.
We also find that pre-training can be performed using unlabeled data only by leveraging self-supervised training methods. Across 12 downstream tasks, employing (non-robust) self-supervised pre-training on ImageNet enhances average empirical and certified robustness by 9.9% and 6.9%, respectively. Our work stands as the first demonstration of training certifiably robust classifiers on tasks with extremely limited labeled training data.
Acknowledgement
This work is supported in part by the Air Foree Research Lab under grants FA9550-22-1-0029 and FA9550- 22-1-0450 and Office of Naval Research award N00014-22-1-2001. Any opinions, findings, conclusions expressed in this material are those of the authors and do not necessarily reflect the views of the sponsors.
12

---

Published in Transactions on Machine Learning Research (05/2024)
References
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: query- efficient black-box adversarial attack via random search. In European conference on computer vision, 2020. 7
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International Conference on Machine Learning, 2018.
4
Maximilian Augustin, Alexander Meinke, and Matthias Hein. Adversarial robustness on in-and out- distribution improves explainability. In European Conference on Computer Vission (ECCV), 2020.
Yoshua Bengio. Deep learning of representations for unsupervised and transfer learning. In ICML, workshop on unsupercised and transfer learning. JMLR Workshop and Conference Proceedings, 2012. 3
Yoshua Bengio, Frédéric Bastien, Arnaud Bergeron, Nicolas Bonlanger-Levvandosski Thomas Breuel, Yous- souf Chherawala, Moustapha Cisse, Myriam Côté, Dumitru Erhan, Jeremy Eustache, et al. Deep learners benefit more from out-of-distribution examples. In Fourleenth International Conference on Artificial In- telligence and Statistics. JMLR Workshop and Conference Proceedings, 2011.
Nicholas Carlini and David Wagner. Adversarial examples are not easily detected: Bypassing ten detection methods. In 10th ACM workshop on artificial intelligence and securily, 2017. 4
Mathilde Caron, Ishan Misra, Julien Mairal, Priya Goyal, Piotr Bojanowski, and Armand Joulin. Unsu- pervised learning of visual features by contrasting cluster assignments. Advances in neural information processing systems, 2020.
Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and Armand Joulin. Emerging properties in self-supervised vision transformers. In IEEE/CVF international conference on computer vision, 2021.
Rich Caruana. Learning many related tasks at the same time with backpropagation. Advances in Neural Information Processing Systems, 7, 1994. 3
Tianlong Chen, Sijia Liu, Shiyu Chang, Yu Cheng, Lisa Amini, and Zhangyang Wang, Adversarial robustness: From self- sufe-supervieed pre-training to fine-tuning. In IEEE/CVF Conference on Computer Vision and Pallern Recognition, 2020a. 1,
Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for rastivvv learning of visual representations. In International conference on machine learning, 2020b. 3, 7
Xinlei Chen and Kaiming He. Exploring simple siamese representation learning. In IEEE/CVF conference on computer vision and pottern recognition, 2021. 12
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In International Conference on Mochine Learning (ICML), 2019. 2, 4, 6, 7, 9, 18
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning, 2020.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In Conference on computer vision and pattern recognition (CVPR), 2009.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Un- terthiner, Mostafa. Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, al. An image worth 16x16 words: Transformers for image recognition al scale. In International Conference on Learning Rep- resentations, 2020. 12
Logan Engstrom, Andrew Ilyas, Hadi Salman, Shibani Santurkar, and Dimitris Tsipras. Robustness (python library). https:// httpa/.cc////saryyaarrrrosssssss 2019. 17
13

---

Published in Transactions on Machine Learning Research (05/2024)
Lijie Fan, Sijia Liu, Yun-Yu Chen, Gaoyuan Zhang, and Chuang Gan. When does contrastive learning preserve adversarial robust from pretraining to finetuning? Advances in neural information processing systems, 2021." 7
Ross Girshick, Jeff Donahue, Trevor Darrell, and Jitendra Malik. Rich feature hicrarchics for accurate object detection and semantic segmentation. In Conference on Compuler Vision and Pallern Recogration (CVPR), 2014.
Sven Gowal, Po-Sen Huang, Aaron van den Oord, Timothy Mann, and Pushmect Kohli. Sclf-supervised adversarial robustness for the low-label, high-data regime. In International Conference on Learning Rep- resentations, 2020.
Jean-Bastien Grill, Florian Strub, Florent Altché, Corentin Tallec, Pierre Richemond, Elena Buchatskaya, Carl Doersch, Bernardo Avila Pires, Zhaohan Guo, Mohammad Gheshlaghi Azar, et al. Bootstrap your own latent-a new approach to self-supervised learning. Advances in neural information processing systems. 2020. 12
Kaiming He, Ross Girshick, and Piotr Dollár. Rethinking imagenet pre-training, In International Conference on Computer Vision, 2019. 1, 3, 17
Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. um contrast. for unsupervised visual representation learning. In IEEE/CVF conference on computer vision and pattern recognition, 2020. 3
Kaiming He, Xinlei Chen, Saining Xie, Yanghao Li, Piotr Dollár, and Ross Girshick. Masked autoencoders are scalable vision learners. In IEEE/CVF conference on computer vision and pattern recognition, 2022. 12
Dan Hendrycks, Kimin Lee, and Mantas Mazeika. Using pre-training can improve model robustness and uncertainty. In International Conference on Machine Learning, 2019. 1, 3,
Minyoung Huh, Pulkit Agrawal, and Alexei A Efros. What makes imagenet good for transfer learning? arXiv preprint XrXi::1608.088 08614, 2016.
Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. In Advonces in Neurol Information Processing Systems (NeurIPS), 2019. 4, 6
Jongheon Jeong and Jinwoo Shin. Consistency regularization for certified robustness of smoothed classifiers. Advances in Newral Information Processing Systems, 2020. 2, 4, 5, 7, 8, 17, 18
Jongheon Jeong, Sejun Park, Minkyu Kim, Heung-Chang Lee, Do-Guk Kim, and Jinwoo Shin. Smoothmix: Training ounidence-calibratee smoothed classifiers for certified robustness. Advances in Neural Informa- tion Processing Systems, 2021. 2, 4, 5
Ziyu Jiang, Tianlong Chen, Ting Chen, and Zhangyang Wang. Robust pre-training by adversarial rostrastive learning. Advances in neural information processing systems (NeurIPS), 2020.
Guy Katz, Clark Barrett, David L Dill, Kyle Julian, and Mykel J Kochenderfer. Reluplex: An efficient smt solver for verifying deep neural networks. In International conference on computer aided verification, 2017.
Klim Kireev, Maksym Andriushchenko, and Nicolas Flammarion. On the effectiveness of adversarial training against common corruptions. In Uncertainty in Artificial Intelligence, 2022. 2, 5, 6
Simon Kornblith, Jonathon Shlens, and Quoc Le. Do better imagenet models transfer better? In IRFF/CVF conference on computer vision and pattern recognition, 2019. 3, 6, 17
14

---

Published in Transactions on Machine Learning Research (05/2024)
Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In TEEE/CVE international confer- ence on computer vision, 2021. 12
Ziquan Liu, Yi Xu, Xiangyang Ji, and Antoni B Chan. Twins: A fine-tuning framework for improved transfcrabiliiyy of adversarial robustness and generalization. In IEEE/CVF Conference on Computer Vision and Paltern Recognition, 2023. 3
Rundong Luo, Yifei Wang, and Yisen Wang. Rethinking the effect of data augmentation in adversarial contrastive learning. In International Conference on Learning Represenlations, 2022. 7
Alcksander Madry, Aleksandar Makclov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018. 1, 4, 5,
Seyed-Mohsen Moosavi-Dezfoolii Alhussein Fawzi, Jonathan Uesato, and Pascal Frossard. Robustness via curvature regularization, and vice versa. In Conference Computer Vision and Pattern Recognition (CVPR), 2019. 6
Sinno Jialin Pan and Qiang Yang. A survey transfer learning. JEEE Transactions knowledge and data engineering, 2009. 3
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Kopf, Edward Yang, Zachary DeVito, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala. PyTorch: An imperative style, Newral Information Processing Systems (NeurIPS), 2019. 17
deep learning library. In Advances in
Hadi Salman, Greg Yang, Jerry Li, Pengchuan Zhang, Huan Zhang, llya Razenshteyn, and Sébastien Bubeck. Provably robust deep learning via adversarially trained smoothed classifiers. In Advances in Neural Infor- mation Processing Systems, 2019. 2, 4
Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adversarially robust imagenet models transfer better? In Advances in Newral Information Processing Systems, 2020. 17
Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. Adversarially robust generalization requires more data. In Advances in Neural Information Processing Systems, 2018. 6
Pierre Sermanet, David Eigen, Xiang Zhang, Michaël Mathieu, Rob Fergus, and Yann LeCun. Over- feat: Integrated recognition, localization and detection using convolutional networks. arXiv preprint arXiv:1312. 6229, 2013. 3
Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! Advances in Neural Information Processing Systems, 2019a. 10
Ali Shafahi, Parsa Saadatpanah, Chen Zhu, Amin Ghiasi, Christoph Studer, David Jacobs, and Tom Gold- stein. Adversarially robust transfer learning. In International Conference Learning Represenlations, 2019b. 10, 11
Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adver- sarial example defenses. Advances in Neural Information Processing Systems, 2020. 4
Dimitris Tsipras, Shibani Santurkar, Logan Fagstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. In International Conference on Learning Representation (ICLR), 2019. 4,
6
Francisco Utrera, Evan Kravitz, N Benjamin Erichson, Rajiv Khanna, and Michael W Mahoney. Adversarially-traiee trained deep nets transfer better: Illustration on image classification. In International Con- ference on Learning Representations, 2020. 3
15

---

Published in Transactions on Machine Learning Research (05/2024)
Pratik Vaishnavi, Kevin Eykholt, and Amir Rahmati. Accelerating certified robustness training via knowl- edge transfer. Advances in Newral Information Processing Systems, 2022. 10
Eric Wong, Leslie Rice, and J Zico Kolter. Fast is better than free: Revisiting adversarial training. In International Conference Learning Representations, 2019. 10
Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization.
Advances in Newral Information Processing Systems, 2020. 4
Xilie Xu, Jingfeng Zhang, and Mohan Kankanhalli. Autolora: A marameter-free automated robust fine-tuning framework. In International Conference on Learning Representations, 2023. 3
Xilie Xu, Jingfeng Zhang, Feng Liu, Masashi Sugiyama, and Mohan S Kankanhalli. Enhancing adversarial contrastive learning via adversarial invariant regularization. Advances in Neural Information Processing Systems, 2024. 7
Yutaro Yamada and Mayu Olani. Does robustness on imagenet Transfer downstream tasks? In Conference on Computer Vision and Pattern Recognition (CVPR), 2022. 3, 10
Jason Yosinski, Jeff Clune, Yoshua Bengio, and Hod Lipson. How transferable are features in deep neural networks? Advances in Neural Information Processing Systems, 2014. 1, 3
Runtian Zhai, Chen Dan, Di He, Huan Zhang, Boqing Gong, Pradeep Ravikumar, Cho-Jui Hsieh, and Liwei Wang. Macer: Attack-froc and scalable robust training via maximizing certified radius. In International Conference on Learning Represenlations, 2020. 2, 4
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theo- retically principled trade-off between robustness and accuracy. In Internationol Conference Machine Learning, 2019. 4
Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. In International Conference on Learning Representations, 2018.
16

---

Published in Transactions on Machine Learning Research (05/2024)
A Implementation Details
To promote reproducibility, we provide all necessary implementation details in this Appendix. Statistics regarding all the datasets we used in our experiments are provided in Table 8. To train deep neural net- works, we use the open-source PyTorch library (Paszke et al., 2019). For adversarial training, we use the open-source Robustness library (Engstrom al., 2019) developed by Madry Lab. For autoPGD attack eval- uation, we use the AutoAttack official code.' For training and evaluation using the randomized smoothing framework, use the code provided by Jeong et al. (Jeong & Shin, 2020).2 All the code used to pro- duce the results in this paper is available at https://gtt wtt.tthh..oo/./hheeaeeeeeee weabbbtrrnsferrrree learning. for_ robustness.
roverrrei
Table 8: Statistics for all datasets used in our experiments.
Dataset
# Train Images
# Classes
# Test Images
Skip
# Certified Images
ImageNet
1,281,167
1,000
50,000
100
500
Food
75,750
101
25,250
50
505
CIFAR-10/100
50,000
10/100
10,000
20
500
Birdsnap
32,677
500
8,171
16
511
19,850
397
19,850
39
509
Caltech-256
15,420
257
15,189
30
506
Cars
8,141
196
8,041
16
503
Aircraft
6,667
100
3,333
6
556
DTD
3,760
47
1,880
470
Pets
3,680
37
3,669
7
524
Caltech-101
3,030
101
5,647
513
Flowers
2,040
102
6,149
12
512
Input Pre-processing. For all experiments, we fix the dimension of the input image to 224 224. For cases where the image is smaller resolution (i.e., CIFAR-10 and CIFAR-100), we upscale it first during the input pre-proccssing stage. The complete set of pre-processing steps we perform are as follows:
TRAIN_TRANSFORN
transforms. transforree.oomose
transforms (2))
transforms RandomtHor
transforms (oTensor (), transforms Prensformss.Nrrmallzze Normalize(
})
transforms (
transforms Sransf (256),
Scale transforms.cm catasoormmsCCnttrrropp222222
transforms. ToT (),
cranssorrm..Nrrmaizeee
})
We follow prior works (He et al., 2019; Kornblith et al., 2019; Salman et al., 2020) and only use normalization for the ImageNet, CIFAR-10, and CIFAR-100 datasots.
Training. When training from scratch, we perform hyperparameter tuning by performing grid search over Ir E {0.1, 0.0,, 0.001), batch size E (256, 128, 64, 32}, and weight decay E (le 04, le - 03, le - 02).
17

---

Published in Transactions on Machine Learning Research (05/2024)
Before terminating training, the learning rate is decayed twice by factor of 0.1 when the performance validation set doesn't improve for 30 epochs. For ImageNet pre-training, we use publicly available weights for Adversarial Training" and SimCLR. 4 Since ImageNet pre-trained weights are not publicly available for the Consistency Regularization method, we generate them ourselves using hyperparameter details provided by the authors (Jeong & Shin, 2020). For all training, we use the Stochastic Gradient Descent, (SGD) optimizer.
Certification Using Randomized Smoothing. During cortification, we use = 0.5 and follow Co- hen et al. (Cohen et al., 2019) for all other hyperparameters, i.e., No = 100, N = 100, 000, and failure probability a = 0.001. Also following prior works, we certify about 500 test images for each dataset, by skipping every th image in the complete test set (see Table for skip factor used).
18


Reviews:
[{"review_id": "Gte9WBzCHL", "reviewer": "Reviewer_3Lh2", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- Good overview of what is unexplored in the literature.\n- Considering both empirical and certified robustness.\n\nWeaknesses:\n- I am not sure what section 3 is supposed to tell me. Assuming that AT is trained with L2 adversaries, the experiments just highlight the two different notions of robustness. It is inherently not comparable and I am not convinced that the presented results give any more insights into this. Also I do not see how these experiments motivate the work on transfer learning.\n- Use AutoAttack [1] instead of PGD with only 3 steps; PGD wit only 3 steps is hardly comparable across methods and datasets and will have extremely high variance (which is not reported).\n- Having AT as supervised pre-training but non-robust self-supervised pre-training makes the results not comparable.\n- Tables are overall a bit overwhelming; it would be more useful to highlight improvements and reductions in performance somehow and then discuss these cases in the text appropriately.\n- Interesting cases where performance actually reduces (e.g., Cars, Aircraft) are not discussed.\n- There are not insights provided into why there is no robustness transfer and improvements seem to come purely from standard performance improvements. That is not surprising for standard (non-robust) self-supervise pretraining, but for robust supervised pre-training this is surprising. But it is not further discussed or investigated.\n\nConclusion:\nI am not convinced that this paper is a meaningful contribution for TMLR. I feel the experimental setup is not appropriate and insights are missing.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The authors present an evaluation of robust transfer learning from ImageNet to a series of downstream tasks, considering both empirical and certified robustness.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "In order for this paper to be insightful, I think that significant work would be needed in terms of improving experimental setup and deriving useful insights for the reader. I do not think this is within the scope of a revision.", "broader_impact_concerns": "No concerns.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "WMR3fjcbnU", "reviewer": "Reviewer_rRES", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "### Strengths:\n- The paper is easy to read and follow.\n- The experimental results suggest that using transfer learning can be an effective way of fine-tuning robust neural networks on down-stream tasks even in low-data regimes.\n- The findings not only apply to adversarial robustness, but they also hold for certified robustness.\n\n### Weaknesses:\n- Even though the empirical observations are appreciated, I am not sure to what extent this paper provides novel AND helpful information. In other words, since the community already knew that transfer learning would work for rich-data regimes, this paper only extends those findings to other low-data regime datasets. But at the core, they both say that transfer learning is helpful for adversarial robustness.\n- The experimental studies are a bit too restricted to make a general conclusion. The least the I expect is to use several architectures (such as WideResNet, DenseNet, ViTs, etc.), various $\\ell_p$ norms, and various adversarial perturbation levels. With the current setting (look at table 6) it feels that the selected $\\ell_2$ norm is too restrictive that transfer learning is just done for a regular vanilla task that is not intended to be robust.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper presents an empirical study on the effectiveness of transfer learning for adversarial robustness.\nIn particular, the paper aims to demonstrate whether transfer learning can be adapted to transform adversarial robustness on a source dataset (ImageNet in this case) to other down-stream tasks.\nTo this end, the paper targets adversarial training and certified robustness in terms of $\\ell_2$ norm as its target tasks.\nThen, for each case, it studies the empirical differences between three models: i) models trained directly on the down-stream task, ii) using pre-trained weights of a classifier trained with either adversarial training or certified robustness and fine-tuning on the down-stream task, or iii) using weights of a pre-trained model using self-supervised training.\nThe empirical studies on various datasets with different sizes indicate that transfer learning is an effective way of improving the natural and robust accuracy.\nAlso, the findings suggest that the increase in robust accuracy might be the result of an increase in the natural accuracy.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "- Extending experimental settings as explained.\n- Explaining the importance of the current work and how the community can benefit from this research.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "EIhks12nl2", "reviewer": "Reviewer_4th7", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n1. The problem studied in this article is meaningful because the application scenarios of transfer learning are vast and the robustness of this is worth studying. The authors consider both empirical robustness and verifiable robustness, making the study comprehensive. Meanwhile, the paper is well-written and easy to follow. \n\n2. In this paper, an interesting and plausible argument is made that the improvement of clean accuracy of pre-trained models is the key to improving the downstream model’s robustness, and it is validated with sufficient experiments.\n\nWeaknesses:\n1. The discussion of self-supervised pre-training would be better improved with the addition of a discussion of some kind of Masked Image Modeling methods since this training method differs from models trained by Contrastive Learning in terms of robustness.\n\n2. Section 5.1 discusses robust pretraining and concludes robust pre-training is unnecessary for improving robustness on the downstream task, this sounds like it negates the meaning of robust pre-training. A more detailed discussion is possible here. although robust pre-training with normal fine-tuning does not increase white-box robustness, does it increase robustness against black-box attacks?", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This article focuses on robustness in the field of transfer learning. By experimenting with robust fine-tuning of models with random initialization, adversarial pre-training, and self-supervised pre-training on many downstream tasks, the authors find that improving the standard accuracy of the pre-trained model is a key point to improving downstream robustness. The authors then explore the roles of robust pre-training and robust fine-tuning and suggest that robust fine-tuning is necessary for obtaining robustness.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. The PGD/AutoPGD attacks used for AT and robustness evaluation may not be an ideal choice since the focus of this paper is L2 robustness. Moreover, the robustness should be evaluated against the full AutoAttack, as otherwise can be taken as reliable robustness.\n\n2. Transformer models should also be tested to obtain more general claims, as they are the mainstream pre-trained vision models now.", "broader_impact_concerns": "No particular concerns have been identified.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "yIrixkeegJ", "reviewer": "Reviewer_HEfa", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths: \n\n1. The authors make the first effort to study the certified robustness achieved by robust fine-tuning.\n\nWeaknesses:\n\n1. Section 3 seems to be redundant. The conclusion that ‘Empirical is not the same as Certified’ is not surprising and irrelevant to main topic of this paper.\n\n2. The empirical conclusion could be wrong. The authors falsely take pre-trained ResNet-50 via SimCLR as the robustly pre-trained models. Therefore, the obtained conclusions and analyses are not reliable. For example, the conclusion that robust pre-training is unnecessary could be incorrect according to that pre-trained models via standard training and SimCLR achieves similar robustness.\n\n3. The critical claim that improvements in RA due to transfer learning are largely due to the overall improvement in SA seems to be meaningless. According to TRADES, the robust error can be decomposed into the sum of standard error and boundary error. If standard error decreases, that the robust error should correspondingly decrease. Therefore, I am confused about how such claim can provide some insights for conducting robust fine-tuning.\n\n4. The authors does not cite adequate related works, including [1,2] in the field of robust self-supervised learning and [3,4] in the field of robust fine-tuning. Besides, the authors should utilize the state-of-the-art robust fine-tuning methods [3,4] to conduct the experiments. \n\n[1] Efficient Adversarial Contrastive Learning via Robustness-Aware Coreset Selection, Xu et al., NeurIPS 2023. \\\n[2] Enhancing Adversarial Contrastive Learning via Adversarial Invariant Regularization, Xu et al., NeurIPS 2023. \\\n[3] TWINS: A Fine-Tuning Framework for Improved Transferability of Adversarial Robustness and Generalization, CVPR 2023. \\\n[4] AutoLoRa: A Parameter-Free Automated Robust Fine-Tuning, Xu et al., ICLR 2024.\n\n5. The authors only conducted the experiments on ResNet models. I suggest studying the robustness of pre-trained ViT after robust fine-tuning.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper proposes conducted an empirical studies on the empirical and certified robustness of a robustly pre-trained model after robust fine-tuning. They are for the first time to evaluate the effect of transfer learning on certified accuracy. Their findings indicate that robust pre-training is unnecessary while robust fine-tunning is necessary.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Please see the weaknesses above.", "broader_impact_concerns": "n/a", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: (The decision rationale was written by an EIC, following a discussion with AE and reading the reviews and author reponses).

Seeing that all reviewers answered positively as to whether the two TMLR criteria (claims matched by evidence and TMLR audience) were satisfied, it was determined that this submission should be accepted. 

However, reviewers had some concerns, beyond the TMLR criteria, which we believe should be discussed in the final version of this submission, in what should be a minor revision.

Specifically, we ask the authors to add a new "Limitations" section to the submission, which explicitly highlights the weaknesses of the work described by the reviewers (such as the lack of experiments based on more recent architectures such as the ViT and MAE-based self-supervised learning, the reliance on white-box ℓ2 adversarial attacks only, the lack of a solid explanation for the empirical results reported beyond some intuitive hypotheses).

Additionally, please include any other changes / improvements mentioned in your author responses.
Decision: Accept (poster)