An Empirical Study of the Accuracy-Robustness Trade-off and Training Efficiency in Robust Self-Supervised Learning
Authors: Fatemeh Ghofrani
Mehdi Yaghouti
Pooyan Jamshidi
Venue: Accepted by TMLR ()

Abstract: Self-supervised learning (SSL) has made significant strides in learning image representations, yet its principles remain partially understood, particularly in adversarial scenarios. This work explores the interplay between SSL and adversarial training (AT), focusing on whether this integration can yield robust representations that balance computational efficiency, clean accuracy, and robustness. A major challenge lies in the inherently high cost of AT, which combines an inner maximization problem (generating adversarial examples) with an outer minimization problem (training representations). This challenge is exacerbated by the extensive training epochs required for SSL convergence, which become even more demanding in adversarial settings.

Recent advances in SSL, such as Extreme-Multi-Patch Self-Supervised Learning (EMP-SSL), have demonstrated that increasing the number of patches per image instance can significantly reduce the number of training epochs. Building on this, we introduce Robust-EMP-SSL, an extension of EMP-SSL specifically designed for adversarial training scenarios. Robust-EMP-SSL is a framework that leverages multiple crops per image to enhance data diversity, integrates invariance terms with regularization to prevent collapse, and optimizes adversarial training efficiency by reducing the required training epochs. By aligning these components, Robust-EMP-SSL enables the learning of robust representations while addressing the high computational costs and accuracy trade-offs inherent in adversarial training.

This study poses a central question: "How can multiple crops or diverse patches, combined with adversarial training strategies, achieve trade-offs between computational efficiency, clean accuracy, and robustness?"

Our empirical results show that Robust-EMP-SSL not only accelerates convergence, but also achieves a superior balance between clean accuracy and adversarial robustness, outperforming SimCLR, a widely used self-supervised baseline that, like other methods, relies on only two augmentations. Furthermore, we propose the Cost-Free Adversarial Multi-Crop Self-Supervised Learning (CF-AMC-SSL) method, which incorporates free adversarial training into the multi-crop SSL framework. CF-AMC-SSL demonstrates the potential to enhance both clean accuracy and adversarial robustness under reduced epoch conditions, further improving efficiency.

These findings highlight the potential of Robust-EMP-SSL and CF-AMC-SSL to make SSL more practical in adversarial scenarios, paving the way for future empirical explorations and real-world applications.

Published in Transactions on Machine Learning Research (10/2025)
An Empirical Study of the Accuracy-Robustness Trade-off and Training Efficiency in Robust Self-Supervised Learning
Fatemeh Ghofrani
ghofroni@email.sc.edu
Deportment of Computer Science and Engineering University of South Carolina
Mchdi Yaghouti
Soghooutt@@allbbzzsscc eduu
Department of Computer Science and Engineering University of South Carolina
Pooyan Jamshidi
pjamshid@cse.sc.cd
Department of Computer Science and Engineering University of South Carokina
Reviewed on OpenReview: https: // openreview. net/ forum? id- WTgHDsETg5
Abstract
Self-supervised learning (SSL) has made significant strides in learning image representa- tions, yet its principles remain partially understood, particularly in adversarial scenarios. This work explores the interplay between SSL and adversarial training (AT), focusing on whether this integration can yield robust representations that balance computational effi- ciency, clean accuracy, and robustness, A major challenge lies in the inherently high cost of AT, which combines an inner maximization problem (generating adversarial examples) with an outer minimization problem (training representations). This challenge is exacerbated by the extensive training epochs required for SSL convergence, which become even more demanding in adversarial settings.
Recent advances in SSL, such as Extreme-MuiltiPattch Self-Supervised Tearning (EMP- SSL), have demonstrated that increasing the number of patches per image instance can significantly reduce the number of training epochs. Building on this, we introduce Robust- EMP-SSL, an extension of EMP-SSL specifically designed for adversarial training scenarios. Robust-EMP-SSL is a framework that leverages multiple crops per image to enhance data diversity, integrates invariance terms with regularization to prevent collapse, and optimizes adversarial training efficiency by redueing the required training epochs. By aligning these components, Mobust-EEPPSSL enables the learning of robust representations while address- ing the high computational costs and accuracy trade-offs inherent in adversarial training.
This study poses central question: "How multiple crops diverse patches, combined with adversarial training strategies, achieve trade-offs between computational efficiency, clean accuracy, and robustness?"
Our empirical results show that Robust-EMP-SET not only accelerates convergence, but also achieves superior balance between clean accuracy and adversarial robustness, outperform- ing SimCLR, widely used self-supervised bascline that, like other methods, relics on only two augmentations. Furthermore, we propose the Cost-Free Adversarial Multi-Crop Self- Supervised Learning (CF-AMC-SSL) method, which incorporates free adversarial training into the multi-crop SSL framework. CF-AMC-SSL demonstrates the potential enhance both clean accuracy and adversarial robustness with reduced epoch conditions, further im- proving efficiency.

---

Published in Transactions on Machine Learning Research (10/2025)
These findings highlight the potential of Robust-EMP-SST and CF-AMC-SSL to make SSL more practical in adversarial scenarios, paving the way for future empirical explorations and real-world applications. Our code is released at https:///itthui cow.o//ssoooo/oofss//s.l.alaa CF-AMC-SSL
1
Introduction
In recent years, progress in self-supervised learning (SSL) [Balcstricro al. 2023) has produced represen- tations that match exceed those achieved by supervised learning in classification tasks (Chen et al.) 2020 Grill et al. 2020). For instance, methods such as SimCLR (Chen et al. 2020) and BYOT. (Grill et al. 2020) have demonstrated performance on par with supervised approaches. This advancement has led to state-of-the-art performance various modern Al-enabled applications, including models such as BERT and GPT-3 (Brown et al. 2020: Devlin al. 2018
Despite these remarkable achievements, challenges remain ensure the robustness and reliability of SSL methods, particularly when training is used to produce effective representations from unlabeled data. Among existing SSL approaches, joint-embedding SSL methods aim to produce consistent embeddings for dif- ferent augmentations of the same image. However, a significant challenge in these methods is avoiding collapse, where the model produces identical representations regardless of the input, thus losing the ability to capture meaningful variations in the data.
To address this issuc, several strategics have been proposed, which can be categorized into the following approaches: (i) Contrastive Learning: These methods, such SimCLR (Chen et al.] 2020), rely on distinguishing between similar and dissimilar samples to maintain meaningful and diverse representations, By incorporating negative samples, they ensure that the embeddings of different inputs well separated in the representation space. (ii) Non-Contrastive Methods: Unlike contrastive approaches, methods such as Barlow Twins (Zbontar et al. 2021 and VICReg (Bardes et al. 2021) avoid the need for negative samples by introducing covariance regularization. This approach promotes diversity in embeddings while maintaining consistency for different augmentations, effectively preventing collapse.
Building these strategies, multi-crop techniques, as introduced in SwAV (Caron al. 2020). have emerged a promising approach to further enhance SSL performance. SwAV leverages multiple views of an image at varying resolutions, clustering embeddings to align augmentations while avoiding trivial solutions. This innovative strategy not only prevents collapse but also improves the quality of learned representations by encouraging diversity and consistoncy.
While these advancements have significantly improved the quality and diversity of SSL representations, another pressing concern is the vulnerability of SSL methods to adversarial attacks (Ghofrani al. 2023 Kim et al. 2020 Wahed et al., 2022). Adversarial perturbations can undermine the reliability of SSL models, compromising their utility in real-world applications. One of the most effective strategies to address this challenge is adversarial training, which formulates the problem as min-max optimization Madry et al. 2017). Recent research has extended adversarial training to SSL frameworks (Kim et al. 2020 Moshavash et al. 2021 Wahed et al.] 2022), demonstrating its effectiveness in enhancing robustness across methods such as SimCLR, Momentum Contrast (He et al. 2020), Sw (Caron et al. 2020), and BYOT. (Grill et al. 2020). However, these approaches face two important challenges: (i) high computational costs and (ii) trade-offs between clean accuracy and robustness.
To address these limitations, we introduce Patch Sclf-Supervised Learning (EMP-SSL) [Tong et al. 2023), which reduces training epochs by leveraging fixed-size image patches instead of tradit ional multi-scale cropping. Robust-EMP-SSI exlends EMP-SSL lo adversarial training scenarios by incorporating multiple crops per image to enhance data diversity, integrating invariance terms with regularization to prevent collapse, and optimizing training efficiency. Our contributions focus on the interplay between adversarial training and SSL, investigating key challenges and questions, including:
framework building on PatremmeMMuler
2

---

Published in Transactions on Machine Learning Research (10/2025)
Table 1: CF-AMC-SSL trains efficiently in fewer epochs, thereby reducing overall training time. By effectively employing multi-crop augmentations during base encoder training, it enhances both clean accuracy and robustness against PGD attacks. Note that the highest values are indicated in red, while the second highest values are highlighted in blue
Mudal
CIFAR-10
CIFAR-100
Time
Encader
Clean
PGD(4/255)
PGD(5/255)
PGD(4/255)
PGD(8/256)
(min//poch)
Epochs
(min)
Patch bised EMP SSL (beselinc)
61
37.65
16.05
14.35
4.22
17.07
500
Crop-lseed EMP-SSL
T0.55
53.3
28.49
51.71
33.88
19.35
17.07
copps Gones DCD, opodic
Patchiiuud RMP--oosddbe
61.83
0226
21.53
40.31
23.76
12:13
9.70
10
07
Crop-based EMP-BrooAde (CF-AMC-SSL)
75.88
65.97
50.74
31.73
17.19
9.70
Crop- basod, SinCLR (bazeline)
72.86
47.08
19.84
5.68
1.87
men kompp pCT
Patch--ssa SinCLR
65:48
41.85
17.19
13.71
21.87
8.33
1.87
500
901
Crop--nsoed SimCI R. PePencdd
70.25
45.34
24.5
26.53
11.7
0.94
157
cpecke)
1. Can multiple crops or patches compensate for fewer training epochs in self-supervised adversarial training? We examine whether increasing data diversity through multiple crops or patches can reduce computational overhead while maintaining performance.
2. How does crop diversity affect the trade-off between clean accuracy and robustness? By integrating the mechanisms of EMP-SSL with adversarial training, we analyze whether multiple crops can better balance the trado-off comparod SimCLR, which uses only two crops per image.
3. What is the impact of the augmentation strategy (multi-scale crops vs. fixed-size patches) on robustness? We investigate how the adoption of diverse cropping strategies affects the robustness of the model within the EMP-SSL framework.
4. How do different evaluation strategies perform for adversarially trained models? We compare robust multi-crop embedded aggregate (averaging embeddings from multiple crops) with the standard linear classifier applied to single whole-image embedding.
5. Can free adversarial training improve adversarial SSL? We evaluate whether free adversarial training (Shafahi et al. 2019), known for its efficiency in supervised learning, can achieve competitive robustness in SSL under reduced training epochs.
We systematically compare EMP-SSL and SimCLR, a widely-used SSL method requiring hundreds of epochs to converge, using it as a baseline for its simplicity and ubiquity. Our key findings include:
Increasing the number of multi-scale crops effectively compensates for fewer training epochs, enabling faster training without compromising performance (Table row 2 versus rows 5 and 6).
Robust-EMP-SSI with multi-scale crops achieves better balance between clean accuracy and ro- bustness than Robust-SimCLR used as the baseline (Table row 2 versus row 5).
Multi-scale crops within the Robust-EMP-SST framework outperform fixed-size patches in adver- sarial SSL scttings (Table 1 row 2 versus row 1).
Central cropping outperforms Multi-Crop Embedding Aggregation in terms of training time, clean accuracy, and robustness.
Note that robust central crop evaluation is likely to be less effective terms of accuracy with fixed-scale patch-bused pretraining because the model lacks exposure to the entire image during pretraining, On the other hand, robust malti-patch evaluation is time-intensive, necessitates generating multiple adversarial examples per image for the adversarial training of the linear classifier.
3

---

Published in Transactions on Machine Learning Research (10/2025)
Free adversarial training (Shafahi et al 2019) provides cost-efficient solution for adversarial SSL, even under reduced training epochs (Table rows 3, 4, and 7).
By addressing these questions, work advances adversarial SSL by offering efficient and robust algorithms, paving the way for real-world applications with reduced computational costs and improved performance trade-offs.
2
Related Work
Several recent studies have advanced adversarially robust self-supervised learning, DeACL (Zhang et al, 2022 reformulates the problem into two sub-tasks-standan SSL for representation learning and pscudo- supervised adversarial training for robustness aabustness-achieving strong efficiency and robustness. ProFeAT (Ad- depalli al. 2024) introduces feature-space adversarial objectives with projection head to close the gap with supervised adversarial training. Adversarial Invariant Regularization (AIR) (Xu et al.) 2023) applies causal invariance principles to improve both generalization and robustness, while broader adversarial self- supervised contrastive learning frameworks generate ad adversarial positives and negatives to strengthen con- trastive pretraining. More recently, DAQ-SDP (Zhang et al. 2024] proposes diverse augmented queries and self-supervised double perturbation, showing that increasing augmentation diversity and applying perturba- tions at both input and model levels can significantly enhance robustness and transferability. In parallel, a positive mining approach (Kim et al. 2023) for unsupervised adversarial training has been proposed to ad- dress the ineffectiveness of untargeted adversarial examples in SSL, especially for non-contrastive frameworks. By selecting the most confusing yet semantically similar targets and perturbing instances toward them, this method generates more effective adversaries, yielding substantial robustness gains for non-contrastive SSL and consistent improvements for contrastive SSL. These methods propose complementary strategics that can be integrated into either SimCTR or EMP-SSL. In contrast, our work isolates the role of multi-crop versus pairwise crops under Free Adversarial Training examine their direct impact on adversarial robustness and training efficiency.
3 Methodology
In this study, we focus on evaluating the robustness of Mattemme-Mllt-Paarie Seff-Supervised-Lena Learning (EMP- SSL.) (Tong et al. 2023), a method that employs multiple augmentations per image and achieves convergence in significantly fewer epochs compared to standard SSL methods. We selected SimCLR as the baseline for its simplicity and its standard SSL design, which uses two augmentations per image and requires hundreds of epochs for convergence. This makes SimCLR a suitable reference point to assess the efficiency and robustness of EMP-SSL.
3.1 Overview of SimCLR and EMP-SSL
3.1.1 SimCLR: A Simple Framework for Contrastive Learning
SimCLR a self-supervised learning framework designed to learn image representations by maximizing agrocment between augmented views of the same image.
Key Components:
Data Augmentation: Positive pairs are generated through random augmentations such as crop- ping, color jittering, and Gaussian blur. Each input image produces two augmented views, &1 and &z.
Feature Extraction: backbone network f(-), typically a ResNet, maps each augmented view x; to feature vector h; in high-dimensional space.

---

Published in Transactions on Machine Learning Research (10/2025)
1
Maximize Agreement between
f
Z
Z1
and
f
uudo
audy
Nop epochs
Nep /m epochs
8
Lodo
m iterations
m iterations
(a) The adversarially trained SimCLR vs. free adversarially trained SimCLR framework.
61
Z ado
Maximize Agreement between
T2
Zzaado
Zaddo
t ~
> adi
New! Cm epochs
Nep epochs
Ze
and
t
Codv
Zatn
dC
8c
m71 iterations
m iterations
Adversarial Training
Free Adversarial Training
(b) The adversarially trained crop-based EMP-SSL framework vs. the free adversarially
trained, crop-based EMP-SSL (CF-AMC-SSL).
Figure 1: Illustration of workflow comparison.
Projection Head: A multi-layer perceptron (MLP) g(-) projects the feature vector h; into lower- dimensional embedding space z,, where contrastive loss is applied:
g(f()))).
Contrastive Loss:
The loss function encourages embeddings of positive pairs to be similar while pushing apart embeddings of negative pairs. The contrastive loss defined as:
exp(sim(z; 2;)/T)
(a.) = - log
Σ2N k= [ cxp(sim 2T)

---

Published in Transactions on Machine Learning Research (10/2025)
econtrastive
((2--122k) + 122
2N
where:
sim 244) is the cosine similarity between embeddings,
is temperature parameter (scalar),
N is the number of images in a mini-batch (scalar).
SimCLR's framework efficiently captures meaningful representations by leveraging this contrastive learning approach.
3.1.2 EMP-SSL: Prittme-Mlti-Patchh Self-Supervised Learning
EMP-SSL extends the self-supervised learning paradigm by incorporating multiple fixed-scale patches per image and introducing novel loss terms enhance representation consistency and generalization.
Key Components:
Multi-Patch Reprosentation Learning: During training, given a batch images denoted as
X [ [x),...,XX, xx),, where X, represents the j-th image the batch, we first apply augmentations in- cluding dividing each image into C' fixed-scale patches obtain X Xc, where X, [x] ..]] The augmented image patches then fed into the encoder to extract features Z, F(X,), which are subsequently concatenated into Z [Z...., Zc].
Invariance Term: To encourage consistency among embeddings, an invariance term D(Z 2)
aligns each patch's 's embedding Z, with the average embedding Z:
Σ ZR
D(Z 2) = Tr)
C
==1
Regularization Term: A regularization term R(Z) penalizes redundancy in feature embeddings by reducing correlations among dimensions:
d I+ bea
R(Z) = log det
ZzT)
2
where ZZT the covariance matrix the embeddings, is the batch size (scalar), e distortion
size (scalar, > 0), d is the dimension of projection vectors (scalar), and is the identity matrix.
Overall Objective Function: EMP-SSL maximizes the sum of the invariance and regularization terms across all patches:
LEMP-SSL = Σ D(Z, 2) + R(Z.))
Using these innovative loss terms, EMP-SSL fosters stronger invariance and diversity in learned representa- tions, making it a powerful approach to self-supervised learning.
3.2 Overview of Robust-SimCLR and Cobust-EMP-SSLL Extending SimCLR and EMP-SSL with Adversarial Training
Initially, analysis in Table 2 that both the baseline EMP-SSL and SimCLR without adversarial training are vulnerable to adversarial attacks. This finding further underscores the lack of robustnoss in SimCLR, consistent with previous research findings (Ghofrani et al. 2023 Kim el al., 2020). We extend the SimCLR and EMP-SSL frameworks by incorporating adversarial training to improve robustness against adversarial attacks, as shown in Figure [ Adversarial training integrates adversarial examples into the learning process, enabling models better withstand perturbations. In the following, we describe the generation of adversarial examples and the modifications the training objectives for both frameworks.

---

Published in Transactions on Machine Learning Research (10/2025)
3.2.1 Robust-SimCLR: Adversarial Contrastive Learning
the robust version of SimCLR, adversarial training enhances the model's resilience. For each image in the mini-batch, adversarial examples are generated using PGD attacks. Both the original augmented view and its adversarial counterpart are treated as positive pairs. The contrastive loss function is updated to maintain similarity between these pairs while distinguishing them from negative samples, thereby reinforcing the model's ability to generalize under adversarial perturbations.
3.2.2 Robust-EMP-SSI Adversarial Multi-Patch Learning
In robust EMP-SSL, adversarial training is integrated strengthen the model's defenses. The representation for each image is aggregated from multiple crops patches, and adversarial perturbations are applied independently to each crop (patch).
Adversarial Perturbation Process:
The image divided into multiple crops or patches.
An adversarial perturbation is generated and updated independently for each crop or patch.
3. Each crop is perturbed individually, rather than applying shared perturbation across all crops.
This independent generation of adversarial examples results in more diverse and challenging perturbations, boosting the model's robustness.
Updated Training Objective: The training objective includes:
Regularization Term add): Penalizes high correlations among adversarial representations.
Consistency Term D(Z 2ede): Promotes consistency among adversarial embeddings.
These terms regularize adversarial representations while maintaining their similarity to the original aug- mented views, preventing overfitting to adversarial examples.
4 Experiments and Results
Building on our methodology, we investigate the performance of Robust-EMP-SS: under adversarial training and evaluate its trade-offs between clean accuracy, robustness, and computational efficiency. EMP-SSL significantly reduces the number of training epochs in self-supervised learning by increasing the number of fixed image patches augmented per image. This approach diverges from traditional methods like SimCLR, which rely on extensive training epochs and use only two augmented multi-scale crops per image. Through comprehensive analysis of EMP-SSL within an adversarial training framework, we aim to understand the relationship between training epochs, image crop choices, model robustness, and accuracy.
Empirical Study Objective: These evaluation methods provide insights into the model's capabilities in terms of accuracy and robustness, incorporating both conventional and novel multi-patch and multi-crop embedding strategics.
To assess model robustness, we employ a threat model which the adversary has full knowledge of the base encoder's architecture, network parameters, and those of the linear classifier, Adver- sarial attacks generated end-to-end using the cross-cntropy loss function.
Threat. Model:
4.1 Experiment Setup
Our experimental setup follows that of Tong et al. 2023 We employ ResNet-18 as the base encoder for all experiments unless otherwise specified. We train EMP-SSL. models for 30 epochs and SimCLR models for

---

Published in Transactions on Machine Learning Research (10/2025)
5-step 500 epochs, EMP-SSL converges significantly faster. In all adversarial training scenarios, PGD attack under the lo norm with maximum perturbation limit of e 8/255 unless stated otherwise. The models are evaluated against 20-step PGD attacks, and results are further validated using auto-Attack (Croce & Hein 2020g. We report the top-1 test accuracy across all settings to evaluate robustness. After sampling the patches and crops, their resolution is adjusted them through ResNet-18 for embedding. Since our goal is not evaluate transfer learning (cross-dataset validation), both the base encoder and the linear classifier are trained on the same dataset in all experiments.
match the original image size before passing
4.2 Evaluating Augmentation Strategies for Adversarial Training in Tobust-EMP-S5
To enhance the robustness of EMP-SSL under adversarial training, we analyze two augmentation strategies and their impact on representation diversity, robustness, and computational efficiency:
1. Crop-Based Method: In this approach, random crops are taken from the augmented image, with crop sizes ranging from 9 x 9 to 32 x 32 pixels. This method introduces a greater degree of spatial variability, requiring the model to learn more robust and generalizable representations. The key advantages of this method include:
Enhanced Spatial Generalization: Since crops sampled from different regions of the image, the model learns invariant representations that are less dependent on specific spatial locations.
Diversity in Adversarial Perturbations: Adversarial examples generated smaller cropped regions can vary significantly from those generated on full-image patches, forcing the model to handle adversarial attacks across multiple spatial scales.
Improved Feature Learning: The network is trained to extract meaningful features from both global and local perspectives, benefiting both clean accuracy and robustness.
However, this method comes with added computational costs due to the need to generate multiple adversarial examples for diverse crops per image.
Patch-Based Method: Fixed-scale patches are extracted at predefined scales from the image, maintaining a structured and consistent learning franework. The benefits of this approach include:
Since patches are sampled at fixed locations and sizes, the method is simpler and more predictable during standard training, compared to random cropping.
Simplicity:
Stability in Representation Learning: Fixed patches provide a stable learning process by reducing randomness. This can improve clean accuracy, especially when combined with multi-patch embedding aggregation during evaluation.
However, this method may not achieve the same level of robustness as the erop-based approach because of its limited variability. Since adversarial training benefits from exposure to wider range of perturbations, the lack of randomness in patch selection could result in less effective robustness improvements.
Justification for Evaluating Both Methods: Given the inherent trade-off between diversity and efficiency, the evaluation both augmentation stratogics helps us determine the optimal balance be- tween clean accuracy, robustness, and computational cost in adversarial SSL. The crop-based method offers superior robust due increased spatial diversity, whereas the patch-based method proves training simplicity and stability. By comparing these two approaches, we provide insights into how augmentation strategies impact adversarial training in self-supervisod learning.
Our ovaluation focuses on linear probing accuracy, considering the following two key evaluation strategies:
Standard Central Crop Asscssment: This conventional method trains and evaluates a lincar classifier using a single fixed central patch from each image, where the entire image serves as the central patch.
8

---

Published in Transactions on Machine Learning Research (10/2025)
Table 2: Comparative results clean data performance and robustness against PGD attacks: baseline SimCLR versus EMP-SSL with standard pretraining on CIFAR10 and CIFAR100 datasets.
Models
CIFAR-10
CIFAR-100
Linear Classißeer
Base Encoder
Clean
PGD(4/255)
PGD(5/223)
PCD(16/255)
Clean
PGD(4/253)
PGD(8/256)
PGD(16/255)
Ocutral Crop
SinCLER
86.65
0.18
62.5
0.74
0.53
0.45
EMP-SSL
76.02
44.31
0.02
0.02
0.02
SinCLR
12 Crops (Patches)
EMP-SSL
92.85
0.01
0.01
71.82
0.48
0.15
0.08
SinCLR
89.31
0.01
0
66.3
0.17
0.12
0.12
64 Crope (Patches)
EMP-SSL
83.29
0.02
0.03
0.01
723
0.5
0.2
0.09
2. Multi-Patch (Multi-Crop) Embedding Aggregation Evaluation: In contrast to the standard rent crop assessment, this method constructs an image embedding by inputting a specified number of crops (patches) into the base encoder. These crop (patch) embeddings are then combined by averaging and fed into the linear classifier. Henceforth, we refer this evaluation method as the "n Crops (Patches)" linear classifier. Note that patches (crops) are sampled with the same scale factor as during the pre-training phase.
4.3 Both SimCLR and EMP-SSL Are Vulnerable to Adversarial Attacks Under Standard Training
We first examine the vulnerability standard SimCLR and EMP-SSL training to adversarial attacks. The goal of this experiment twofold: (1) to assess whether employing multiple fixed-sized patches SST. (as in EMP-SSL) inherently enhances robustness compared to methods like SimCLR, which use only one pair of differently scaled crops, and (2) to evaluate whether multi-patch (multiicrop) aggregated evaluation improves robustness over standard central crop evaluation.
Detailed results for clean accuracy and adversarial robustness under PGD attacks are presented in Table 2 for CIFAR-10 and CIFAR-100.
The findings highlight that while multi-patch aggregated evaluation enhances performance on clean data, both SimCLR and EMP-SSL remain highly vulnerable to adversarial attacks, indicating the necessity of adversarial training.
4.4 Robust Crop-Based Based EMP-S5L Improves Both Clean Accuracy and Robustness Compared to Robust SimCLR
We next apply adversarial training to both SimCLR and EMP-SSL, evaluating their performance primarily through central cropping, which balances computational efficiency with accuracy. Figure presents results across different training configurations, highlighting the following key findings:
Training SimCLR with only two augmentations per image results in a significant tradc-off between clean accuracy and robustness.
Crop-based EMP-SSL exhibits higher robustness against adversarial attacks, whercas patch-basod EMP-SSL achieves superior clean accuracy under multi-patch aggregation evaluation (detailed in the Appendix A.1
Central cropping provides an efficient evaluation method while maintaining strong clean accuracy and robustness (detailed in the Appendix A.1
To further understand these trado-offs, we conducted additional ablation studies, examining the effects of different numbers of crops and patches on model performance. Detailed findings are provided in the Appendix which show that.
9

---

Published in Transactions on Machine Learning Research (10/2025)
Comparative Analysis of Robust SimCLR and Robust EMP-SSL with Central Crop Evaluation
Robust SimCLR CIFAR 10
Robust SimCLR CIFAR: 11AAR100
60
40
30
40
10
Patst-baared Baseed Sincta Swej 25 0.25), K-d a. 1.0)
ppesh-baved SincLa Sw00 Aedi
Patca Saredt SincLR
Baselim:: Crop based SinnER 06
Pate Patctsaaee Sinrce Swe 022). Reil 5.0.
Patth- Bareel SincLa SwiD 9.5h Keizz 8.
Patch baved Sincta
Croph Smil 08, Relb. 75.1.3)
75, 1.30
Robust EMP-SSL CIFAR-10
Robust EMP-SSL CIFAR-100
50
40
30
40
20
Beselnn patch brcc-beedd PHRSEL 2.10.23 0.25). Rm
Swi 06, Rvit 75,
croputta EMP-SOL
crope bassed EMP.SEL Se10.3 75,
Baxetner parch basted EMP.SS:
Seer 35, 0.25), Piett.
Swip 08, 1.3)
laseed EMP-50L
crop bacedd EMP Swi0.3 Piito
Clean
PSD(4/255)
PCD/8/255)
PGD116/259)
Figure 2: Evaluation of robustness against PGD attacks through adversarial pretraining CIFAR-10 and CIFAR-100 datasets. We compare the performance of robust SimCLR and robust EMP-SSL, with central crop evaluation under different training configurations. Our analysis includes the evaluation of patch-based SimCLR with varying patch sizes and baseline SimCLR, revealing a noticeable trade-off between clean accuracy and robustness. Larger patch sizes in robust SimCLR improve robustness but reduce clean accuracy. Additionally, we compare crop-based EMP-SSL, (with varying crop sizes) baseline EMP-SST, demonstrating that the crop-based approach significantly enhances robustness. Notably, Robust EMP-SSL achieves superior balance between clean accuracy and robustness compared to robust SimCLR. The variables S and R correspond to the scales and ratios used in the PyTorch framework's ReszemResizedCrop method.
10

---

Published in Transactions on Machine Learning Research (10/2025)
Increasing the number of patches generally enhances clean accuracy under multi-patch aggregation evaluation, while well-calibrated number of crops balances robustness and accuracy effectively. These insights reinforce the effectiveness of crop-based EMP-SSL in adversarial settings while also highlighting the practical considerations of augmentation strategies in robust self-supervised learning.
4.5
Robust Crop-Based EMP-SSL with Robust Linear Evaluation
While robust crop-based EMP-SSL demonstrates improved robustness in standard evaluation, it is crucial to further scrutinize its adversarial resilience in downstream applications. To this end, we employ an additional assessment known as robust linear evaluation (r-L.E) (Kim et al. 2020). This evaluation aligns with the broader objectives of our study, as it provides deeper insights into the transferability of adversarial robustness Iearned during sclf-supe training and its impact on downstream tasks.
Table 3: Evaluation of Robust EMP-SSL and Robust SimCLR across different adversarial training scenarios on CIFAR-10 and CIFAR-100 datasets: The findings imply that boosting the robustness of the linear classifier contributes to enhancing the overall robustness of both the robust SimCLR and EMP-SST.
Modela
CIFAR-10
CIFAR-100
Linear Classifier
Enccoder
(CD(54255)
(GD(5
PGD((6/266)
(CD(4/255)
PGD((/226)
(GD(16/256)
Central Grop
Robaai StnCLR
84:24
26.68
1.77
0.07
66.91
8.68
0.18
Robust EMP SSL
Crop-lnsed(16)
Robaai SiaCLR
72.86
47.98
16.3
5,68
Robast Central Crop (r LE)
Robost EMP-SS1.
Crop-insed((1)
76.55
58.3
28.49
3.96
61.71
33.88
19:35
4.92
The r-LE approach consists of two stages: (1) pretraining the base encoder using the robust crop-based EMP- SSL algorithm and (2) freezing the base encoder while separately adversarially training a linear classifier top of it. This setup allows decouple the robustness contributions of the encoder and the lincar classifier, revealing whether adversarial robustness can be preserved and enhanced in transfer learning setting.
The results, presented in Table 3 highlight the following key observations:
Adversarially training the linear classifier improves overall robustness, demonstrating that robust features learned via EMP-SST. can be further refined to withstand stronger attacks.
Robust crop- EMP-SSL maintains superior balance between clean accuracy and robustness compared to robust SimCLR, reinforcing its iveness in adversarial self-supervised learning.
The effectiveness of r-LE suggests that adversarial robustness in self-supervised reprosentations is not solely determined by the base encoder but also be enhanced at the linear classifier stage, improving overall robustness.
By incorporating r-LE into our evaluation framework, we establish a more comprehensive understanding of the adversarial robustncss of self-supervised reprosentations and validate the effectiveness of robust crop- based EMP-SSL in both feature learning and transferability.
4.6 Cost-Frea Adversarial Multi-Crop Self-Supervised Learning Evaluation
Inspired by our findings on robust EMP-SSL, we introduce a novel adversarial self-supervised learning method that achieves convergence fewer than 10 epochs. We apply free adversarial training (Shafahi al. 2019) the based EMP-SST. framework (see Figure referring to it as Cost-Free Adversarial Multi-Crop
11

---

Published in Transactions on Machine Learning Research (10/2025)
Algorithm 1: CF-AMC-SSL learning algorithm for Nep epochs, given some radius e, m minibatch replays, C number of crops, and a dataset of size D for an encoder fo and projector 9o
Initialize: 8+0 0
/ //tterate Nep/1 m times to account for minibatch replays and run for Nep total epochs for epoch to Nep/ mm do for i == to D do // //Augment data for CF-AMC-SSL learning:
4
5
for h to C do Draw augmendation function lg;
6
7
fi = (zi); end
8
for
j 1 m do //Compute gradients for perturbation and model weights simaltancously:
11
V6, V0 VLEMP- VLEMP-SSC(f go +))
12
8 + 6 -sig( //Update â with the gradients calculated
13
= max(min(()) e))
14
40 // Update model weights with some optimizer
15
end
16
end
end
Table 4: Evaluation of CF-AMC-SSL and SimCLR-FreeAdv algorithms: The results show that CF- AMC-SSL trains efficiently in fewer epochs, reducing the overall training time. Additionally, employing multi- crop augmentations in CF-AMC-SSL, during base encoder training effectively improves both accuracy and robustness. Note that the topmost and the sccond-highest valuos are indicated in red and blue, respectively.
Models
CIFAR-10
CIFAR-100
Time
ImaageNNet-100
Classiferr
Linear
Rase Encoder ResNet-18
Clean
4/255
PGD
8/255
PGD
16/255
PGD
Clean
4/255
PGD
8/255
PGD
PGD 16/255
(min)
Clean
4/255
PGD
8/255
16/255
Crop-based SinCLR
72.86
47.98
16.81
3.3
44.58
19.84
5.88
0.26
934
30.84
Bestag PGB, spudaa)
70.25
48.34
24.5
2
47.64
26.53
11.7
1.26
157
30.26
16.14
6.06
0.25
Sim
69.97
51.96
30.84
5.7
45.69
29.43
16.15
3.1
107
25.26
14.12
5.88
0.7
Robast
Crop EMP-SSL
Central
76.35
53.3
28.49
3.96
51.71
35.88
19.35
4.02
530
50.04
26.54
10.2
0.5
Crop
(36 200. spockar
CP-AMC-SSL.
70.78
55.97
33.34
6.24
5U.74
31.73
17.19
3.49
21.24
mad. masrig
OF-AMC-SSL,
8.55
17.84
5.15
(16 mapa med, expeete)
CF-AMC-SSL
46 26
27.88
13.94
2.18
CP-AMC-SSL.
76.28
58.06
37.5
9.38
52.01
33.3
19.34
5.06
201
CF-A CP--MM-SSE
55.84
43
30.84
12.4
31.33
21.86
14.62
6.14
388
Supervised-Frerkkly
82.63
47.12
16.27
1.3
52.07
20.2
6.34
0.92
105
Supervised
74.63
23.75
2.87
38.58
19.97
360
Self-Supervised Learning (CF-AMC-SSL). This approach significantly reduces the computational bur- den of adversarial SSL training, decrcasing the required epochs by nearly two orders of magnitude (Algorithm
Our method employs an iterative adversarial training strategy that integrates multi-crop augmentations. Specifically, it repeats each training iteration m times within a minibatch, reusing gradient information from previous updates. This enables efficient adversarial example generation before progressing to the next iteration. Experimental results for various values of are presented in Table 4 alongside comparisons to the
12

---

Published in Transactions on Machine Learning Research (10/2025)
Table 5: Evaluation of Different Learning Algorithms Using ResNet-50 as the Base Encoder: This experiment demonstrates the gencralizability of our findings when employing a larger base encoder, such as ResNet-50. Additionally, it highlights that increasing the number of iterations for PGD enhances the model's robustness against larger perturbations.
Models
CIFAR-10
CIFAR-100
Linear
Base Encader
Clean P4D(4/255)
PGD(8/256)
PGD(11)/55)
Clean
PGD(4/256)
PGD(8/255)
PGD(16/265)
Chesifier
ResNet-50
CF-AMC-S8L,
73.43
56.81
38.31
11.03
47.4
32.19
19.9
6.11
Robust
Central
CF-AMC-S8L
75.89
57.61
35.19
6.51
58.34
33.08
18.15
3.72
Crop
SLmCLR- RRFrreddd spodaa)
19.00
39.09
28.88
12.76
25.19
18.36
12.51
5.51
SLmCLR- FreeAde
66.89
47.52
26.9
3.08
38.95
24.14
12.17
1.61
spodaa)
VICRog-FreeAde
56.71
44.04
31.84
11.58
27.81
20.71
14.79
6.44
VICRog-Free.Ae 71.25
53.06
32.64
6.72
43.35
30.35
17.13
4.29
Table 6: Evaluation of different learning algorithms against AutoAttack (AA): The Autoattack evaluation confirms that using multi-crop augmentations in CF-AMC-SSL during base encoder training improves both accuracy and robustness effectively. Note that the topmost and the socond-highest values are indicated in red and blue, respectively.
Models
CIFAR-10
CIFAR-100
Linear
Base Encoder ResNe1-18
Clean
(4/2255)
A8/22555)
AA(16/255)
Clean
AA(4/255)
AA (8/2/555)
A1616225))
Classifer
Crop-based EMP-SSL
76.55
23.93
26.37
7.81
51.71
33.88
19.35
4.M2
crope, Satap spocta)
CF-AMC-SSL (6 coppe wadd specte)
Robust
75.78
51.52
27.74
6.59
50.74
27.05
15.35
5.23
Central
CF-AMC-SSL
Crop
5.83
(10 iugs srucy spenia))
Crop- based SimCLR
72.86
16.06
12.57
10.5
44.58
8.81
6.21
5.29
SinnCRR-FeeeAl
70.25
46.62
22.31
4.76
47.64
23.35
13.6
3.03
(mrm), 307 spochs)
69.97
48.91
27.51
6.32
45.69
25.39
14.28
5.12
(mon), 200 spocks)
conventional 5-step PGD adversarially trained crop-based EMP-SSL model, which requires approximately five times the training time of CF-AMC-SSL, variants.
For a broader comparison, we extend free adversarial training SimCLR and its supervised counterpart (termed SimCLR-FreeAdv and Supervised-Freele experiments were conducted on single RTX A6000 GPU, and runtime evaluations were performed on CIFAR-10 and CIFAR-100 datasets. Although multi-crop augmentations in boint-embedding SSL may ini- tially appear computationally expensive, our findings reveal significant efficiency gains.
respectively), with results summarized in Table 4 All
Robust EMP-SST, converges in 30 srachs--sinificantle fewer than the 500 epochs required for robust Sim- CLR-and achieves faster runtime (530 minutes vs. 934 minutes). CF-AMC-SSL further improves efficiency, leveraging free adversarial training (Shafahi et al. (2019) to reduce runtime to just 97 minutes over five times faster than robust EMP-SSL- SHIP-SSL-hile while maintaining comparable performance. Further details on compu- tational efficiency are provided in Appendix A.3, Additionally, CF-AMC-SSL, achieves superior trade-off between clean accuracy and adversarial robustness, outperforming both robust SimCLR and its supervised variant even when label information is available.
To assess generalizability, we extended our experiments by increasing the number of Free-AT steps m and training epochs. We observed that higher values of improve robustness, particularly under stronger per- turbations (e.g., 6 16/255). We further evaluated CF-AMC-SST, on the ImageNet-100 dataset, where
13

---

Published in Transactions on Machine Learning Research (10/2025)
the results followed similar trend, reinforcing the efficiency and robustness of our approach. Addition- ally, we tested our method using ResNet-50 as the base encoder (Table 5 confirming that employing a larger architecture and increasing the number of PGD iterations enhances robustness, especially against stronger attacks. To offer a point of comparison with frameworks that rely solely on positive pairs, we also evaluated VICReg under the same setup. Finally, the Appendix [A.4 reports robustaness evaluations under additional adversarial attacks, including the Fast Gradient Sign Method (FGSM) (Goodfellow et al.) (0044). the Carlini Wagner (CW) attack (Carlini & Wagner 2017) with 100 optimization steps, and the gradient- free Square Attack (Andriushchenkoo et al. 2020). These evaluations offer more comprehensive assessment of robustness beyond PGD, further demonstrating the broader effectiveness of CF-AMC-SSL, under diverse threat models.
In summary, our framework provides two significant advantages:
1. Efficient training: CF-AMC-SSL dramatically reduces training time, enabling adversarial self- supervised learning with far fewer epochs.
2. Enhanced accuracy and robustness: Multi-crop augmentations during base encoder training significantly improve both clean accuracy and adversarial robustness.
Finally, to further validate our approach, we evaluated CF-AMC-SSL. against Auto-Attack (Table G con- firming the reliability of our findings.
5 Discussion
The empirical evaluation of CF-AMC-SSL provides key insights into its effectiveness in improving adversarial self-supervised learning. Our results demonstrate that CF-AMC-SSL successfully enhances robustness while maintaining competitive clean accuracy, significantly oulperforming robust SimCLR in terms of efficiency and adversarial resilience. By integrating free adversarial training with crop-based EMP-SSL, we enable substantial reductions in training time while preserving the ability to learn robust representations.
Our evaluation results indicate that leveraging moderate number of augmentations per image during training enhances adversarial robustness, the model encounters broader range of perturbed images. This allows it to learn representations that emphasize content over style variations (e-g., color, textures, and background), ultimately leading to improved robustness. The empirical findings further highlight the impact of augmentation diversity, confirming that CF-AMC-SSL effectively balances robustness and efficiency through multi-crop self-supervised learning.
Similar to prior studies (Chen et al. 2022 Li et al. 2022), our method defines the representation of an image x as the average of embeddings hi,..., hn across all its crops (a bag-of-words approach). Our results show that these learned representations are more robust than traditional representations based on full-image embeddings. Furthermore, selecting n greater than two accelerates the learning of co-occurrence patterns across crops, reinforcing the efficiency of CF-AMC-SSL in adversarial settings.
Additionally, we demonstrate that free adversarial training can be successfully integrated into self-supervised learning, independent of the specific loss function used. Even with significantly fewer training epochs, free adversarial training preserves robustness, cstablishing CF-AMC-SSL, as a scalable and efficient adversarial SSL method.
From an adversarial robustness perspective, CF-AMC-SSL employs comprehensive training objective that includes both a regularization term adZ) and an invariance term D(Ziadvv Zade). The regularization term enforces constraints on adversarial representations to enhance robustness, while the invariance term ensures that adversarial perturbations remain consistent with their average representation Zade. This clus- tering effect mitigates extreme adversarial distortions, resulting in more stable and generalizable feature representations. Consequently, CF-AMC-SSL achieves a strong balance between robustness and clean accu- racy, maintaining performance clean data while enhancing resistance to adversarial perturbations.
14

---

Published in Transactions on Machine Learning Research (10/2025)
5.1
Empirical Observations and Insights
Our empirical analysis yields the following key insights:
Trade-Of Between Clean Accuracy and Robustness: Increasing the number of crops enhances robustness, but excessive cropping can lead to diminishing returns and slight reductions in clean accuracy. The ablation studies in the appendices further confirm optimal crop configurations for maintaining this trade-off.
Impact of Augmentation Strategy: Multi-crop augmentation improves generalization under adversarial attacks compared to traditional contrastive methods. However, our findings reveal that crop- crsp- EMP-SSL is particularly effective in preserving adversarial robustness, while patch- EMP-SSL achieves superior clean accuracy under multi-patch aggregation evaluation.
Efficiency of Free Adversarial Training: Our results validate that integrating free adversarial training into crop-based EMP-SSL significantly accelerates training without sacrificing robustness. This makes an ideal solution for large-scale self-supervised learning tasks.
Generalization to Different Architectures and Datasets: ResNet-50 confirm that CF-AMC-SSL extends effectively beyond CIFAR datasets, demonstrating its scalability across different model architectures and data distributions.
The results on ImageNet-100 and
Evaluation Under Stronger Attacks: Our results against Auto-Attack the Carlini- Carlini-Wagner (CW) attack, and the gradient-free Square Attack demonstrate that CF-AMC-SST. maintains ro- bustness under stronger adversarial scenarios, further confirming its reliability in more challenging threat settings.
These observations provide a deeper understanding of the efficiency, robustness, and applicability of CF- AMC-SSL, further validating its potential for real-world adversarial self-supervised learning tasks.
6 Conclusion
In this work, we conducted comprehensive study on the adversarial robustness of Extreme-Multi- Maatuee-Mliiiaaattttt Patch Self- Supervised Learning (EMP-SSL) and proposed Cost-Free Adversarial Multi-Crop Self-Supervieed Learning (CF-AMC-SSL) as efficient solution for adversarial self-supervised learning. Our empirical evaluations demonstrated that increasing the number of multi-scale crops in adversarial training enhances model ro- bustness while maintaining competitive clean accuracy. Unlike robust SimCLR, which relies on only pair of crops per image and requires extensive training epochs, robust EMP-SSL achioves a superior balance between accuracy and robustness with significantly fewer training iterations.
Furthermore, we explored the integration of free adversarial training into self-supervised learning, leading to the development of CF-AMC-SSL. This method dramatically reduces the number of required training without compromising performance. Our findings validate
epochs-by by nearly two orders of that free adversarial training is not only applicable to supervised learning but also highly effective in self- supervised settings, significantly improving training efficiency and model resilience to adversarial perturba- tions.
The empirical analysis highlighted several key insights: multi-crop augmentation enhances robustness, crop- based EMP-SSL performs better in adversarial settings compared patch-based EMP-SSL, and CF-AMC- SSL achieves a strong balance between computational efficiency, clean accuracy, and robustness. Additionally, we demonstrated that CF-AMC-SSL generalizes effectively to different. architectures and datasets, reinforcing its practical applicability.
Overall, our study contributes to the advancement of adversarial self-supervised learning by providing a scalable and efficient training strategy. The insights derived from this work pave the way for future rescarch in optimizing adversarial self-supervised learning methodologies, making them more suitable for real-world deployment in security-critical applications.
15

---

Published in Transactions on Machine Learning Research (10/2025)
Acknowledgments
This work was partially supported by the National Science Foundation (Awards 2007202, 2107463, 2038080, and 2233873).
References
Sravanti Addepalli, Priyam Dey, and R. Venkatesh Babu. Profeat: Projected feature adversarial training for self-supervised learning of robust representations. ar preprint urXiw:2406. 05766, 2024.
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: a query- efficient black-box adversarial attack via random search. In European conference on computer vision, pp. 084-501. Springer, 2020.
Randall Balestriero, Mark Ibrahim, Vlad Sobal, Ari Morcos, Shashank Shekhar, Tom Goldstein, Florian Bordes, Adrien Bardes, Gregoire Mialon, Yuandong Tian, et al. A cookbook of self-supervised learning. arXiv preprint Xix:229944. 12210, 2023.
Adrien Bardes, Jean Ponce, and Yann LeCun. Vicreg: Vatiaaceiimarinne--vvvaaaaa regularization for sclf-supervised learning. arXiv preprint arXiv:2105. 04900, 2021.
Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neurol information processing systems, 33:1877-1901, 2020.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on securily and privacy (sp), pp. 39 57. Teee, 2017.
Mathilde Caron, Ishan Misra, Julien Mairal, Priya Goyal, Piotr Bojanowski, and Armand Joulin. Unsu- pervised learning of visual features by contrasting cluster assignments. Advances in neural information processing systems, 33:9912 9924, 2020.
Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. simple framework for contrastive learning of visual representations. In International conference on machine learning, pp. 1597-1607. PMLR, 2020.
Yubei Chen, Adrien Bardes, Zengyi Li, and Yann LeCun. Intra-instance vicreg: Bag of self-supervised image patch embedding. arXiv preprint orXiw:2206. 089544, 2, 2022.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning, pp. 2206-2216 PMLR, 2020.
Jacob Devlin, Ming- Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deop bidiroctional transformers for language understanding. orXiv preprint arXiv:1810.04800 2018
Fatemch Ghofrani, Mchdi Yaghouti, and Pooyan Jamshidi. Rethinking robust contrastive learning from the adversarial perspective. In The Second Workshop on New Frontiers in Adversarial Machine Learning, 2023.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint Xim: 1ix::111222 1412. 2014.
Jean-Bastien Grill, Florian Strub, Florent Altché, Corentin Tallec, Pierre Richemond, Elena Buchatskaya, Carl Doersch, Bernardo Avila Pires, Zhaohan Guo, Mohammad Gheshlaghi Azar, et al. Bootstrap your own latent-a new approach to self-supervised learning. Advances in neural information processing systems, 33:21271 21284, 2020.
Kaiming Hc, Haoqi Fan, Yuxin Wu, Saining Xic, and Ross Girshick. Momentum contrast for unsupervisod visual representation learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 9729 97339, 2020.
16

---

Published in Transactions on Machine Learning Research (10/2025)
Minseon Kim, Jihoon Tack, and Sung Ju Hwang. Adversarial self-supervised contrastive learning. Advances in Neural Informalion Processing Systems, $3:2983-2999 2020.
Minseon Kim, Hyeonjeong Ha, Sooel Son, and Sung Ju Hwang. Effective targeted attacks for adversarial self-supervised learning. Advances in Newral Information Processing Systems, 36:56885-5666 569002, 2023.
Zengyi Li, Yubei Chen, Yann LeCun, and Friedrich T Sommer. Neural manifold clustering and embedding. arXiv preprint arXim:2201.10000 2022.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv: 201.0000000000 06083, 2017.
Monireh Moshavash, Mahdi Eftekhari, and Kaveh Bahraman. Momentum contrast self-supervised based training for adversarial robustness. Journal of Computing and Security, 8(1):33-433 43, 2021.
Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis; Gavin Taylor, and Tom Goldstein. Adversarial training for free! Advances in Neurul Information Processing Systems, 32, 2019.
Shengbang Tong, Yubei Chen, Yi Ma, and Yann Lecun. Emp-ssl: Towards self-supervised learning in one training epoch. arXic preprint orXiv:2304.030 03977, 2023.
Muntasir Wahed, Afrina Tabassum, and Ismini Lourentzon. Adversarial contrastive learning by permuting cluster assignments. arXiv preprint XXi::2204.1014, 2022.
Xilie Xu, Jingfeng Zhang, Feng Liu, Masashi Sugiyama, and Mohan S Kankanhalli. Enhancing adversarial contrastive learning via adversarial invariant regularization. Advances in Neural Information Processing Systems, 11116783-16800 2023.
Jure Zbontar, Li Jing, Ishan Misra, Yann LeCun, and Stéphane Deny. Barlow twins: Self-supervised learning PMLR, via redundancy reduction. In International Conference on Machine Learning, pp. 2021.
Chaoning Zhang, Kang Zhang, Chenshuang Zhang, Axi Niu, Jiu Feng, Chang Yoo, and In So Kwoon. De- coupled adversarial contrastive learning for self-supervised adversarial robustness. In European Conference on Computer Vision, pp. 725-742. Springer, 2022.
Ruize Zhang, Sheng Tang, and Juan Cao. Self-supervised adversarial training via diverse augmented queries and self-supervised double perturbation. Advances in Neural Information Processing Systems, 37:43788- 43808, 2024.
17

---

Published in Transactions on Machine Learning Research (10/2025)
A Appendix
A.1 Evaluation with 32- and 64-Patch Aggregation
In addition to central cropping, we evaluated the robust base encoders using multi-patch aggregation with and 64 patches. These methods involve aggregating embeddings from multiple fixed-size patches during evaluation. While this approach provides insights into the robustness of the learned representations, it is computationally more intensive than central cropping.
Key observation from the results (Figures and is as follows:
Multi-potch aggregation enhances clean accuracy, especially when a larger number of patches (e.g., 64) used. However, the computational cost increases significantly, making central cropping more practical for resource-construined settings.
PGDV4/255)
PGD/6/255)
Evalusaionn Central Crop CIFAR110
Evaluation: 32 Crops CIFAR-10
Evalustion: 64 Crops CIFAR-10
8D
90
Arnuwyy PS1
1961
60-
Acaresy 156
50
80
40
20
20
Passiine Crope baseel Sincca 2.3)
Patth sated StocEe swiaas Pabi Reid 1.0)
harte Seip S. 8.5 Red 1o. 1.0)
Sep ze E.A Rort 1.0)
archaaaed steeuu
Ramstina: lasse SEneEL Rerld 1.31
Sejo benvel Sincia Rar
Patck SieccL 1.09
Parts hared Stwwe See (0 Rors
Cre--ber Simcuu 5-00. Ried
SiecLa Swi G.30 Redl A.01
Prech taared Sivee 8.51 Rand 1.69
Sep Patckdrrin street Le
Sup.
Evaluation: Central Crop CIFAR-100
Evaluation: 32 Crops CIFAR- 100
Evalu 64 Crops- - OIFAR-106
50-
50-
Actesdy 143
40
Accurey
30
30
20
10
10
Buatiers Crea based Sincla Lah 1.91
Parh Banad Slevin 1-0)
Parch thered Swip 8.5 R.8. 1.0)
P5 8.79 Ruit 1.0)
SinCle
Bammdiie laued Sincle
1.3)
Paich det SinCIR 3.S. 1.0)
Batch thasee Simcca Swn
Backs sand SlnnZa Swi 75 0.29). 2.00
1-91
Drantiins Cepp-ber beend CIRCIA dE 2.d. 1.5.)
Patch Sinttu Swie 3.3 Real 4.0 La
Prechiaae Saandd Sincta Swi 8.50
Swo Prect Beand Stincee 1.0)
1.m)
Swie
Figure 3: Evaluating the robustness against PGD attacks through adversarial pretraining on CIFAR-10 and CIFAR-100 datasets, we compare the performance of patch-based SimCLR. (with various patch sizes) to that of baseline SimCLR. Our findings reveal noticeable trade-off between clean accuracy and robustness. In addition, central cropping (first column) demonstrates higher efficiency in terms of overall complexity, clean accuracy, and robustness. Moreover, increasing patch sizes reduces clean accuracy but improves model robustness. Note that the variables S and R correspond to the scales and ratios employed in the Py framework's MandonResizedCrup method.
18

---

Published in Transactions on Machine Learning Research (10/2025)
A.2 Ablation Study of Robust EMP-SSL
The ablation study analyzed the impact of varying the number of patches (crops) used for adversarial training in the EMP-SSL framework. The results for CIFARIO and CIFAR100 are shown in Figure 5
Findings include:
Increasing the number of patches during evaluation consistently improves clean accuracy in potch- based EMP-SSL.
Moderate numbers of crops (e.g., 16) with crop-based EMP-SSL preserve better trade-off between clean accuracy and robustness when evoluated using central cropping.
Evalustion: Central Crop
CIFR-110
Evaluation: 32 Crops CIFAR-I0
Evaluation: 64 Craps CIFAR-10
70
80
60
150
Accrrocy 290
40
30
10.
Busrinss sutchsl sared Saen-S33 twi
Swiid Au spt.
crepe Cur sat.
Batvire: 2.r0.25 0.39) Rostz
Crepah Uae Swid For 1.31
Tres END Sup Ruio 1.3)
Busitine: patch lassed 5u..
croe taand out SSL.
Swi cmeell Sheeet EMP st1.
Sag Ree
Smi0
Swo DE
Evaluation: Central CIFAR-100
Evaluation:
Evalustion: CIFAR-100
50-
40
30
20
10
10
10-
Baselee mases prrustt d0 0.255
Seid DN Beild 1.30
Barelion DMP.50 Se 1..2 0.35. Rer2..
Sa comple bawed DMP Rell (.3)
Swe cogpe faaend 53t
Emualne Bateh toteeetoeee EMPASS
SHO $.1. Rimid Dui
(40.25
Sart DE
Figure 4: Evaluating the robustness against PGD attacks through adversarial pretraining on CIFAR-10 and CIFAR-100 datascts, we compare the performance of crop-based EMP-SSL (with various crop sizes) to that of baseline EMP-SSL. Our analysis reveals that the approach EMP-SST. demonstrates enhanced robustness. Compared to the results presented in Figure it clear that Robust EMP-SSL achieves a superior balance between clean accuracy and robustness, in contrast to robust SimCLR. Here, the variables and denote the scales and ratios utilized for the RandomResizeddChon method within the PyTorch framework.
A.3 Computational Efficiency Analysis
In this section, we provide detailed analysis of the computational cost of all compared methods. Specifically, we disentangle per-epoch cost from total training cost and quantify the overhead introduced by adversarial training schemes and multiple views per image.
19

---

Published in Transactions on Machine Learning Research (10/2025)
Clean Accuracy Adversarial
Different Crop Settings
Ooey farved (t)
Oupiseed (10)
Dxpriteed (a3)
(4/255)
(0/25))
PGD (162255)
Adverss Accumnt
Adveraa0 Ascuracy
Adveraai Recurasy
66
Adver Accurac
CIFAR-100 Accurary
Advenari Accurntyy
Accuracy
Accuracy
Accuracy
Figure 5: Evaluation of robust EMP-SSL across different patch (crop) sizes on CIFAR-10 and CIFAR-100 datasets: Our results emphasize that, when employing the patch-based based EMP-SSL method with multi-patel aggregation during evaluation, significant augmentation in the number of patches leads to a noticcable enhancement in clean accuracy. Furthermore, when using crop-based EMP-SSL with central- crop assessment, a more equitable balance between clean accuracy and model robustness can be established, especially evident with moderate number of crops, such 16. Note that "Crop-based (4)* means aug- mentation with scales (S) of (0.08, 1.0) and ratios (R) of (0.75, 1.3), with (4) denoting the number of crops. Similarly, "Patch-based (4)* involves scales (S) of (0.25, 0.25) and ratios (R) of (1.0, 1.0), with (4) represent- ing the number of patches.
20

---

Published in Transactions on Machine Learning Research (10/2025)
Table Compute ablation: GFLOPs and adversarial overhead. Backbone is ResNet-18 (4.1 GFLOPs per forward pass). We report the number of views per image, adversarial scheme, the overhead multiplier relative to standard training, and the resulting effective compute per image per epoch and in total.
Method
GFLOPs [per Iwd)
Views (per img)
Adv. scheme
Overhead
Eff.
CFLOPs/epach (per img)
Total GFLOPs
mult.
(per img)
Patch-bused EMP-SSL (beselliee)
4.1
PGD.5
9,840.00
(10 putdees, kalo PGD sposte)
Crop-based SML
4.1
PGD-5
5.0
328.00
9,840.00
Patch-bused MMP--roeAAde
4.1
16
Free-AT (m=3)
1.3
86.28
832.80
(10 patskes, tedd spocka)
Crop-based
(CF-AMC-SSL)
4.1
Free-AT (m==)
85.28
852.80
Go crepe, med, 10 spoct))
Crop-based SinCLR (baseline)
4.1
PGD-5
5.0
41.00
200,500.00
tatep
spoche)
Patch- SimCLR
4.1
PGD-5
41.00
20,500.00
(2 patches S-atep DGD, 300 spocka)
Crop-based SinCCLR-reeeAll
4.1
Free-AT (m==)
1.3
10.66
1,780.22
Assumptions.
1. Backbone is ResNet-18 with 4.1 GFLOPs per forward pass (identical across methods).
2. Views indicates the number of crops patches per image used during pretraining.
Overhead multiplier is relative to standard (non-adversarial) training:
PGD-5 requires approximately 5x compute overhead due to five gradient evaluations per batch. Free-AT with m=3 reuses gradients across mini-batches, resulting in an amortized overhead of approximately 1.3x.
4. Eff. /epoch is computed as:
Eff. GFLOPs/epoch = GFLOPs x Views x Overhead.
5. Total GFLOPs multiplies the per-epoch cost by the total epoch count reported in the main results table.
Table Salle7clen clearly shows that CF-AMC-SSL's efficiency stems primarily from reduced number of epochs rather than a lower per-epoch cost. All methods have the same per-view backbone cost; differences arise from (i) the number of views per image and (ii) the adversarial training strategy. PGD-5 incurs a ~ 5x compute overhead, whereas Free-AT with m=3 reduces this to 1.3x through gradient reuse. Although multi-crop EMP variants have a higher per-epoch compute cost due more views, CF-AMC-SSL achieves substantially lower total compute by converging in only 10 epochs under Free-AT (e.g., $52.8 GFLOPs per image in total) compared to PGD-based basclines or pairwise Free-AT methods that require orders-of- fifdors-o-mmagntudee more total passes. This analysis quantifies both the adversarial overhead and the contribution of multi-crop design to the overall training efficiency.
A.4 Evaluation under Additional Adversarial Attacks
We extend robustness evaluation beyond PGD by considering both gradient-based based and gradient-free ad- versarial attacks. Table g reports performance under FGSM at different perturbation strengths and the Carlini Wagner (CW) attack with 100 optimization steps, where CF-AMC-SSL consistently achieves higher adversarial accuracy than baseline methods. Table 9 presents results under the gradient free Square Attack, confirming that CF-AMC-SSL maintains superior robustness across diverse threat models. These results demonstrate that CF-AMC-S is effective not only against PGD but also across wider range of adversar- ial attacks.
21

---

Published in Transactions on Machine Learning Research (10/2025)
Table 8: Evaluation of different learning algorithms using ResNet-50 as the base encoder under additional adversarial attacks, including FGSM and CW: This experiment provides a more compre- hensive assessment of robustness beyond PGD-based evaluation, offering further evidence the effectiveness of CF-AMC-SSL under diverse threat models.
Models
CIPAR-10
CIFAR-100
Clossiferr
Linear
Raon Encoder
BesNettS0
Clean FC5M(4/223)
FGSM(16/235)
CW-100
Clean
FGSM(44/253
FCSM(5/208)
PGSM(10/255)
CW-100
UF AE--AXC--BL
Robas:
Ocatral
76.80
60.52
20.08
Crup
SmCCBB Prouddyy
50.09
30.51
51.01
18.52
46.12
25.00
16.43
13.52
22.08
StmCIR Prwwrdyy
17.17
31.03
18.11
26.15
VICRig Froudcr
96.21
44.7
31.52
10.06
82.64
27.81
21.05
15.53
6.24
25.00
VIURog Flcehie
71,25
$6.14
42.29
20.64
66
45,55
31.64
21.21
11.14
00.1
Table Evaluation of different learning algorithms using ResNet-50 as the base encoder against gradient free Square Attack: This experiment offers a more comprehensive evaluation of robustness beyond gradient-based attacks, providing additional evidence of the effectiveness of CF-AMC-SSL across diverse threat models.
Models
CIFAR-10
CIFAR-100
Linear
Base Encoder
Cleaan
Squaee 4/255)
Squarr 2265)
Squarn(16
Square( (4/255)
Sigurrs (8/65))
Square(16/
CF AMC SSL
mean wot. apuatec
Central
CF CF-MM-SSLL
75.89
70.15
63.07
51.33
53.34
40.27
35.47
27.49
Crop
BionAL--Boa.ill Inee specta)
SimCLR PieeAdy
66.80
$7.44
51.13
00:47
38.95
30.85
27.00
20.99
ViCReg-FowwAdle
Iwer special
VICRRg--rrw..ee FrowAde
71.25
05.85
59.51
48.0 13
45.35
34.43
30.49
24.13
22


Reviews:
[{"review_id": "28Reydnq4x", "reviewer": "Reviewer_2h9S", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "### Strengths\n1. The paper presents a detailed introduction to the methods (i.e., SimCLR and EMP-SSL), which helps readers follow the idea.\n2. The paper shows various approaches to improve the robustness of self-supervised learning.\n\n### Weaknesses\n1. The experiments mainly study two methods, namely SimCLR and EMP-SSL, and their robust variations. However, experimenting on only two methods is not comprehensive enough to represent the general properties of robust self-supervised learning.\n2. The authors mentioned a few research works that extended adversarial training to the self-supervised learning framework. Then, they proposed Robust-EMP-SSL to reduce the training epochs. However, I cannot find any experiments that compare the robustness/efficiency of the proposed methods to the existing robust self-supervised learning approaches.\n3. This paper claims to be a comprehensive empirical study that provides different insights, but its scope is narrower than what is claimed in the paper. In my opinion, the paper’s experiments gradually converge to the development of the CF-AMC-SSL framework (with a robust linear classifier). To explain, the authors start with the idea of Robust-EMP-SSL, then each section improves the idea with crop-based data augmentations, a robust linear classifier, and free adversarial training. This paper is not about a comprehensive empirical study, but about a new method for robust self-supervised learning.\n4. The performance of CF-AMC-SSL should be compared with more existing methods for robust self-supervised learning. The paper compares its performance only with that of some other encoders with free adversarial training. However, other robust self-supervised learning methods should be compared to the proposed method.\n5. The paper's contents are not well-organized, and readers should read the paper back and forth to locate the tables or figures that the paper refers to. This makes the paper harder to read.\n6. Most experiments use only two datasets: CIFAR-10 and CIFAR-100. Because both datasets consist of the same input data (with different labeling), the input distribution is essentially the same in those experiments. Only Table 4 contains (partial) evaluation on ImageNet-100. However, there are too many missing evaluations, and this makes the experiments less consistent. \n7. Even after the revision, the paper did not evaluate its performance against various attack methods. First, PGD generalizes FGSM, so adding FGSM does not provide any insights beyond the PGD-based evaluations. Including CW (in addition to PGD and AA) could be sufficient for usual papers that propose robust learning methods, but I expect more variations, e.g., gradient-free attacks, for this long paper.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper mainly focuses on the adversarial training of self-supervised learning methods. Specifically, the authors first propose Robust-EMP-SSL, which is an adversarially trained version of the existing EMP-SSL method. With experiments, the authors show that, without adversarial training, the existing self-supervised learning methods are vulnerable to adversarial attacks. Then, the authors empirically find further improvements of Robust-EMP-SSL: data augmentation with cropped images, use of a robust linear classifier, and free adversarial training. Eventually, the authors propose CF-AMC-SSL and demonstrate the effectiveness and efficiency of the proposed method.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. I don’t think that this paper is a comprehensive empirical study. If the authors want to claim so, they should,\n    * Consider more (robust) self-supervised learning methods,\n    * Consider exploring additional variations of data augmentations\n    * Use more attack methods\n    * Use more datasets\n2. In my opinion, the paper’s main achievement is the development of CF-AMC-SSL, and all the other findings are subsidiary. The authors may claim that the other details are essential because they are based on empirical studies that provide valuable insights, but I disagree. To claim an empirical study, more variations mentioned above should be covered in the experiments.\n3. The proposed framework, i.e., CF-AMC-SSL with a robust linear classifier, should be compared with proper competitors.\n4. Reorganize the location of tables and figures so that the readers don’t need to look back at the papers to find the tables and figures.", "broader_impact_concerns": "I don’t see a particular broader impact concern regarding this paper.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "KELhfzVEXa", "reviewer": "Reviewer_H1eh", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**Strengths:**\n\n$\\bullet$  The authors incorporate free adversarial training into self-supervised learning, significantly reducing both the number of training epochs and overall training time.\n\n$\\bullet$ The paper compares crop-based and patch-based data augmentation strategies within the EMP-SSL framework, showing that the former offers better adversarial robustness, while the latter achieves higher clean accuracy.\n\n**Weaknesses:**\n\n$\\bullet$ In Section 2.1.2, the authors should clearly state that the objective is to **maximize** the overall loss [1], not minimize it. This ambiguity can easily confuse readers. Additionally, the dimensions of each variable (e.g., $x_j$, $x_b^i$, $Z_i$, $Z$) should be explicitly specified (e.g., vector, matrix, or tensor) to improve clarity.\n\n$\\bullet$ The presentation of results in Tables 1, 4, 5, and 6 could be reorganized. It is recommended to group baseline and proposed methods together, changing only one variable at a time for clearer comparison. For example, in Table 1, SimCLR-based methods should be grouped to show how the proposed method affects accuracy, robustness, and runtime within this category. Similarly, EMP-based methods should be grouped accordingly.\n\n$\\bullet$ The authors are encouraged to include evaluations under more adversarial attacks, such as FGSM [2] and C&W [3] to provide a more comprehensive assessment of robustness in Table 1.\n\n[1] Tong et al. Emp-ssl: Towards self-supervised learning in one training epoch. arXiv preprint arXiv:2304.03977, 2023.\n\n[2] Goodfellow et al. Explaining and harnessing adversarial examples. ICLR, 2015.\n\n[3] Carlini et al. Towards evaluating the robustness of neural networks. S&P, 2017.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper combined self-supervised learning (SSL) with adversarial training to reduce computational cost while maintaining competitive clean accuracy and robustness. To this end, the authors adopted EMP-SSL during adversarial training, which reduced the number of training epochs by increasing the number of patches per image. In addition, they incorporated free adversarial training into the multi-crop SSL framework to further cut down training time. Experiments showed that the proposed method significantly reduced the time cost of adversarial training under SSL settings.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "See Weaknesses.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "ofU0wktpVW", "reviewer": "Reviewer_XLxS", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**Pros**\n- Practical impact: The proposed CF-AMC-SSL method effectively reduces the high computational cost of adversarial training in SSL.\n- Training time is significantly reduced (e.g., from hundreds of minutes to 97) while maintaining comparable performance.\n- The method is tested across multiple datasets (CIFAR-10/100, ImageNet-100) and architectures (ResNet-18/50), demonstrating some generalizability.\n\n**Cons** \n- The method primarily combines two existing paradigms, with many prior works exploring similar directions. Empirical baselines should be re-run or imported from strong, closely related methods. (1) DeACL: Decoupled Adversarial Contrastive Learning; (2) ProFeAT: Projected Feature Adversarial Training for Self-Supervised Learning of Robust Representations; (3) Enhancing Adversarial Contrastive Learning via Adversarial Invariant Regularization; (4) Adversarial Self-Supervised Contrastive Learning\n- Few and outdated references (mostly pre-2023); limited discussion of foundational and efficiency-oriented SSL methods and SSL+adversarial training. The paper should clearly articulate how the proposed multi-crop + free-AT approach differs conceptually and quantitatively.\n- No evaluation on modern architectures (e.g., WRN, ViT) or comparison with recent SSL frameworks under adversarial training (e.g., BYOL, SwAV, MoCo-v3, VICReg).\n- While CF-AMC-SSL reports significantly reduced training time, it remains unclear how much of this gain comes from the reduced number of epochs versus the efficiency of the free adversarial training. An ablation comparing time per epoch would help clarify this. Additionally, please include computational metrics such as GFLOPs and the overhead of generating multiple adversarial examples per image.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper examines the integration of adversarial training with self-supervised learning, focusing on Extreme-Multi-Patch Self-Supervised Learning. The authors propose Robust-EMP-SSL, which extends EMP-SSL to adversarial training scenarios using multiple crops per image, and Cost-Free Adversarial Multi-Crop Self-Supervised Learning, which incorporates free adversarial training to reduce computational costs. Through experiments on CIFAR and ImageNet, the authors demonstrate that their methods achieve better trade-offs between clean accuracy, adversarial robustness, and training efficiency compared to robust SimCLR baselines.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "The requested changes are referred to the **Cons** section.", "broader_impact_concerns": "No concerns on the ethical implications of the work.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)