Cluster-Driven Adversarial Perturbations for Robust Contrastive Learning

Authors: Seongyun Seo, Sungmin Han, Jeonghyun Lee, Sangkyun Lee
Primary area: unsupervised, self-supervised, semi-supervised, and supervised representation learning
Keywords: adversarial training, contrastive learning, adversarial contrastive learning

Abstract:
Adversarial contrastive learning aims to learn a representation space robust to adversarial inputs using only unlabeled data. Existing methods typically generate adversarial perturbations by maximizing the contrastive loss during adversarial training. However, we find that the effectiveness of this approach is influenced by the composition of positive and negative examples in a minibatch, which is not explicitly controllable. To address this limitation, we propose a novel approach to adversarial contrastive learning, where adversarial perturbations are generated based on the clustering structure of the representation space learned through contrastive learning. Our method is motivated by the observation that contrastive learning produces a well-separated representation space, where similar data points cluster together in space, while dissimilar ones are positioned farther apart. We hypothesize that perturbations directed toward neighboring (the second nearest to be specific) clusters are likely to cross the decision boundary of a downstream classifier built upon contrastive learning, effectively acting as adversarial examples. A key challenge in our approach is to determine a sufficiently large number of clusters, for which the number of classes in the downstream task would serve the purpose but is typically unknown during adversarial contrastive learning. Therefore, we employ the silhouette score to identify the optimal number of clusters, ensuring high-quality clustering in the representation space. Compared to the existing approaches, our method achieved up to $2.25$\% and $5.05$\% improvements in robust accuracy against PGD and Auto-Attack, respectively, showing slight improvement in standard accuracy as well in most cases.

Decision: reject
Reviewer scores: 5, 5, 6, 6

Reviews and discussion:
<thread>
creation date:
1730130417195

thread_type:
official_review

<thread_object>
creator: reviewer_tbcu

<content>
summary:
The paper proposes a novel approach to adversarial contrastive learning, leveraging clustering within the representation space. The method, named Neighboring-Cluster Pursuit Adversarial Contrastive Learning (NCP-ACL), generates adversarial perturbations by directing them toward neighboring clusters in the learned representation space. This technique aims to address limitations in existing adversarial contrastive learning methods by making perturbations more effective in crossing decision boundaries in downstream classifiers. The paper demonstrates significant improvements in robust accuracy against adversarial attacks compared to state-of-the-art methods.

strengths:
- The paper addresses a notable limitation in current adversarial contrastive learning techniques, where perturbations may not be effective in crossing decision boundaries. By utilizing the clustering structure in the representation space, the proposed NCP-ACL method generates more meaningful perturbations.

- The experimental results on CIFAR-10, CIFAR-100, and STL-10 datasets show that NCP-ACL outperforms existing methods in terms of both robust and standard accuracy. The approach yields consistent improvements across different datasets and settings, with up to 5.05% improvement in robust accuracy against Auto-Attack.

- The use of silhouette scores to automatically determine the optimal number of clusters is a practical approach that simplifies hyperparameter tuning.

weaknesses:
- The paper should discuss the computational cost introduced by the additional clustering step. It would be helpful to provide an analysis of how the clustering affects training time compared to baseline methods.
- The method’s reliance on spherical K-means clustering could pose scalability challenges for high-dimensional representation spaces. 
- The paper would benefit from a discussion on the theoretical implications or guarantees provided by the method. For instance, can the clustering structure always ensure that perturbations cross decision boundaries effectively, and under what conditions?

questions:
1. How does the clustering step, including the calculation of silhouette scores, affect the overall computational time? Is there a significant increase in training time compared to other adversarial contrastive learning methods?

2. What assumptions are made regarding the quality of the clustering in the representation space? Could the proposed method perform poorly if the representation space is not well-clustered, and if so, under what specific conditions might this occur?

3. The paper shows results for standard and adversarial linear fine-tuning. Have you tried adversarial full fine-tuning (AFF)?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730641316808

thread_type:
official_review

<thread_object>
creator: reviewer_bfju

<content>
summary:
The paper introduces a new adversarial contrastive learning framework that leverages the clustering structure in the representation space, using the silhouette score to select the optimal number of clusters without extra hyperparameter tuning. Additionally, the authors demonstrate that their method achieves fully robust representations, where adversarial fine-tuning has minimal impact compared to standard fine-tuning, and outperforms state-of-the-art methods in robust accuracy against PGD and Auto-Attack, with a slight improvement in standard accuracy. However, some concerns about writing and methods remain as follows.

strengths:
1.	The authors propose to use cluster-driven adversarial perturbations to improve model’s robustness, such framework makes fully use of the spherical K-means method on contrastive learning.
2.	They empirically show that perturbations generated through the method are harder for models to process compare to random perturbations.
3.	They conduct extensive experiments on CIFAR10, CIFAR100, and STL-10 for classification tasks and robustness evaluation, which verify the effectiveness of the proposed method.

weaknesses:
1.	The motivation for this work is not clear. The authors claim that “the effectiveness of this approach is influenced by the composition of positive and negative examples in a minibatch, which is not explicitly controllable.”. However, what is the effect of positive and negative examples in a minibatch? What is the relation of the adversarial perturbations to positive and negative examples?
2.	I am concerned about the significance of this work. Traditional contrastive learning can obtain a model with high standard accuracy, but if adversarial samples are added to the training, will it lead to a significant decrease in standard accuracy like traditional adversarial training [A][B], even though robustness is improved? If this problem exists, can we achieve more friendly standard accuracy and/or robust accuracy by combining adversarial purification [C][D] and adversarial detection [E][F] after obtaining a standard model through traditional contrastive learning?
3.	The experiments in Table 1 are not convincing to me, comparing only random noise is insufficient. Noise generated under the same paradigm[G][H][I] should be compared, otherwise, the improvement cannot be attributed to breaking the decision boundary.
4.	In Experiment 4.2, the statement “We believe that it was a trade-off” lacks supporting evidence. Additional experiments or academic references are needed to substantiate this claim.
5.	The experiments in Table 3 focus on the small dataset (CIFAR-10) and do not demonstrate the upper limit of the proposed method's generalization ability. Could more complex datasets be considered?

questions:
1.	In Lines 52-53 and 193, why do you want to push the adversarial sample to other classes for sure? Is there some supported theory or experiment?
2.	Why the key challenge in the approach is to determine a sufficiently large number of clusters? What is its effect? It seems that the results in Fig. 3 show that we can obtain a modest performance if we take a cluster number greater than 30.
3.	What is the motivation of employing the silhouette score?
4.	For the adversarial contrastive learning, what kind of encoder is considered to have well-structured clusters (Line 196)? What impact would it have on your method if the clustering ability itself is not very good?
5.	What the advantages of Eqn. (4) compared with Eqn. (2) in theory?
6.	In Section 3.1, the rationale for choosing the second-nearest neighbor lacks clarity— is there a theoretical explanation beyond empirical justification?
7.	In the introduction, the assumption that "there is no guarantee that the created perturbations will be adversarial with respect to the decision boundary" is intuitive. Could this assumption be validated through some experiments?
8.	The experiments in Table 4 show an improvement in robustness, but a decrease in standard accuracy on the CIFAR-10/100 datasets. Can a reasonable explanation be provided for this?
9.	As I understand it, each cluster should have a first-nearest neighbor cluster. If that's the case, why is the n=1 data missing in the ablation experiments in Table 5?

**Minor issues**
1. The concept “adversarial linear fine-tuning” and “standard linear finetuning” are referenced before definition.
2. In Lines 262 and 269, Should the encoder used for generating adversarial samples be $f_{\theta_1}$?
3. In line 20, page 2, "vulnerablility" should be "vulnerability".
4. In line 31, page 2, "roubstness" should be "robustness".
5. In line 27, page 6, "Consitent" should be "Consistent".
6. The section on contrastive learning could be strengthened by incorporating additional related papers, such as [J-M].
7. Would it make better if samples of different classes in Figure 1 were labeled with different colors?

**Reference**

[A]	Towards deep learning models resistant to adversarial attacks. ICLR 2018.

[B]	Improving robustness using generated data. NeurIPS 2021.

[C]	Diffusion models for adversarial purification. ICML 2022.

[D]	Adversarial purification with score-based generative models. ICML 2021.

[E]	Detecting adversarial data by probing multiple perturbations using expected perturbation score. ICML 2023.

[F]	 A practical bayesian approach to adversarial detection. CVPR 2021.

[G]	Decoupled adversarial contrastive learning for self-supervised adversarial robustness. ECCV 2022.

[H]	 Rethinking the effect of data augmentation in adversarial contrastive learning. ICLR 2023.

[I]	Enhancing adversarial contrastive learning via adversarial invariant regularization. NeurIPS 2023.

[J]	Intra- and Inter-Slice Contrastive Learning for Point Supervised OCT Fluid Segmentation. IEEE Trans. Image Process. 2022.

[K]	Unsupervised Domain Adaptation Via Contrastive Adversarial Domain Mixup: A Case Study on COVID-19. IEEE Trans. Emerg. Top. Comput. 2024.

[L]	Cycle contrastive adversarial learning with structural consistency for unsupervised high-quality image deraining transformer. Neural Networks, 2024.

[M]	 Semi-Supervised Dual-Stream Self-Attentive Adversarial Graph Contrastive Learning for Cross-Subject EEG-based Emotion Recognition. IEEE Trans. Affective Comput. 2024.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730657556422

thread_type:
official_review

<thread_object>
creator: reviewer_e4lt

<content>
summary:
This paper introduces an adversarial contrastive learning framework called NCP-ACL (Neighboring-Cluster Pursuit Adversarial Contrastive Learning). The framework leverages the cluster structure of the representation space learned through standard contrastive learning to generate adversarial examples that challenge the decision boundary. Building on a pretrained standard contrastive learning encoder, the method identifies each data point's cluster centroid and its second-nearest neighboring cluster to create adversarial perturbations. Experimental results across three downstream tasks demonstrate the effectiveness of the proposed approach.

strengths:
- This paper introduces related work and the background knowledge in a clear way.
- Experimental setting is clear and apparent.

weaknesses:
- Lack of theoretical / empirical supporting arguments for claims.
   - Why the second nearest neighbor is used instead of the nearest neighbor to generate adversaries? Even in the appendix, there is only comparison using between second, third, and fourth nearest neighbors.
   - The theoretical explanation of why choosing K with the highest Silhouette scores is good for clustering.
   - The main motivation of this work is existing adversarial contrastive learning works don't guarantee that the generated adversarial examples are cross the decision boundary. Then, with the fine-tuned linear classifier, can you compare the success rate that how much generated adversarial examples are cross the decision boundary for both baseline methods and yours?
   - Why do you leverage 5-PGD during training which is relatively weaker than existing standard PGD attack with more attack steps? Since using weaker adversaries lead to a better clean accuracy, evaluating models with much stronger attack seems to be essential.
- Need more experiments with diverse recent attacks (e.g., PGD-100, CW, LGV, SPSA, DeepFool)

questions:
- Is this method robust against diverse pretrained encoder with different learning algorithms such as BYOL or BarlowTwins?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730759076567

thread_type:
official_review

<thread_object>
creator: reviewer_w6gt

<content>
summary:
The paper presents a novel method for adversarial contrastive learning that aims to improve the robustness of learned representations by leveraging the clustering structure inherent in the representation space formed during contrastive learning. NCP-ACL directs perturbations toward neighboring clusters (specifically the second nearest), hypothesizing that such perturbations are more likely to cross the decision boundary of a downstream classifier.

strengths:
- The paper clearly explains the stages of NCP-ACL, from pre-training with SimCLR to the specific perturbation generation technique.
- The paper provides an extensive experimental analysis comparing NCP-ACL with existing state-of-the-art adversarial contrastive learning methods.
- The reported improvements in robust accuracy against strong adversarial attacks (e.g., PGD, Auto-Attack) are promising.
- The paper includes detailed ablation studies that examine the effects of different components, the number of clusters K, the balance parameter λ, and perturbation strategies.

weaknesses:
- The relationship between the clustering in the representation space and the downstream classifier's decision boundary could be more clearly explained. The paper states that perturbations are likely to cross the boundary when directed toward neighboring clusters, but does this generalize across different downstream tasks? The assumption is not well motivated throughout the paper. Fig. 1 (b) for example shows that there exist clusters that are neighboring but not close to the decision boundary. The gray arrow case that is expected to "act as a positive sample in regular contrastive" needs further elaboration. 
- The motivation for why targeting the second nearest cluster is particularly effective could be further elaborated. While the appendix empirically shows that perturbations directed toward this cluster lead to effective adversarial examples, the analysis is for the top-5 clusters and lacks a deeper theoretical or conceptual explanation that would strengthen the argument and provide more insight into the underlying mechanism.
- From a technical contribution, this work integrates clustering into the existing DeACL method. The novelty seems limited, and the method relies heavily on the quality of the clustering in the representation space. If the clusters are not well-formed, the perturbations generated may not be as effective in enhancing adversarial robustness.
- Decoupled adversarial contrastive learning for self-supervised adversarial robustness. In the related works section, the paper could better position itself within the adversarial CL literature.
- The experiments are conducted on CIFAR-10, CIFAR-100, and STL-10, which are relatively small-scale datasets. Including results from larger and more diverse datasets (e.g., ImageNet) would better showcase how the method performance scales.
- The paper discusses that the perturbed anchor sample $x + \delta$ may move closer to the perturbed negative set and further from the perturbed positive set when a sufficiently large number of negative samples is present. However, the statement does not seem to hold for recent works that adjust the direction of perturbations [1-3]. For example, targeted adversarial strategies, like TARO [1], demonstrate that simply perturbing samples without considering specific target directions or entropy measures can lead to suboptimal adversarial effects. 
- Then lines 176-181 are also confusing since most of the literature deals with avoiding false negatives, i.e., examples that are considered negatives but have the same class as the anchor. 
- There exists research that has explored neighbor-based perturbation strategies to enhance contrastive adversarial robustness, e.g., [4,5] and many works in graph learning. Lines 200-208 provide a proof-of-concept experiment that needs more depth to convincingly support the paper's claims, as it compares the effectiveness of the proposed perturbations solely with random noise. It would be best if this was an ablation study comparison with SoTA methods.
- To my understanding, SFL results reported in Table 3 are the same as the ones reported in Table 2 (CIFAR 10). The information could be condensed so that the paper presents both SFL and ALF results across all datasets.


[1] Kim, M., Ha, H., Son, S. and Hwang, S.J., 2024. Effective targeted attacks for adversarial self-supervised learning. Advances in Neural Information Processing Systems, 36.

[2] Wahed, M., Tabassum, A. and Lourentzou, I., 2022. Adversarial contrastive learning by permuting cluster assignments. arXiv preprint arXiv:2204.10314.

[3] Wang, X., Huang, Y., Zeng, D. and Qi, G.J., 2023. CaCo: Both positive and negative samples are directly learnable via cooperative-adversarial contrastive learning. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(9), pp.10718-10730.

[4] Jin, Y., Zhang, X., Lou, J., Ma, X., Wang, Z. and Chen, X., 2023. Explaining Adversarial Robustness of Neural Networks from Clustering Effect Perspective. In Proceedings of the IEEE/CVF International Conference on Computer Vision (pp. 4522-4531).

[5] Ko, C.Y., Mohapatra, J., Liu, S., Chen, P.Y., Daniel, L. and Weng, L., 2022, June. Revisiting contrastive learning through the lens of neighborhood component analysis: an integrated framework. In International Conference on Machine Learning (pp. 11387-11412). PMLR.

questions:
- Does using silhouette scores to find the optimal number of clusters K involve manual interpretation?
- How does the method perform over existing clustering-based ACL methods?
- What does "act as a positive sample in regular contrastive" mean for grayed-out examples in Fig. 2?
</content>
</thread_object>

</thread>
<thread>
creation date:
1732252598255

thread_type:
official_comment

<thread_object>
creator: area_chair_thid

<content>
comment:
Dear Authors and Reviewers,

The discussion phase has passed 10 days. If you want to discuss this with each other, please post your thoughts by adding official comments.

Thanks for your efforts and contributions to ICLR 2025.

Best regards,

Your Area Chair
</content>
</thread_object>

</thread>
<thread>
creation date:
1732533222121

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
General Response 1. Comparison of Perturbation Effectiveness: NCP-ACL and SOTA Methods

comment:
We thank the reviewers for their positive feedback and constructive comments. This response focuses on addressing the primary concern: a lack of comparative experiments evaluating the effectiveness of perturbations generated by our proposed NCP-ACL and SOTA methods in adversarial training. We provide an analysis comparing these perturbations in terms of their adversarial impact, deviation from the data manifold, and their overall effect on standard and robust accuracy.

It is important to note that strong adversarial perturbations are not always beneficial for adversarial training. While such perturbations may exhibit high adversarial impact, they can significantly deviate from the underlying data manifold. This deviation can bring severe distortions in the representation space learned during contrastive learning, ultimately degrading the standard and robust accuracy of models used in downstream tasks. Therefore, the effectiveness of perturbations should be evaluated not only in terms of their adversarial impact but also by considering their deviation from the data manifold.

The Table 1 demonstrates that DeACL generates perturbations with the highest adversarial impact, achieving the largest Prob. Dec. and Attk. Succ. values. However, as shown in the Table 2, DeACL's adversarial examples are farthest from the training data in the representation space. In other words, adversarial examples of DeACL are more likely to deviate significantly from the underlying data manifold. These findings are consistent with experimental results presented in our paper (lines 341-349). Our NCP-ACL generates adversarial examples closest to the data manifold, increasing the likelihood of producing on-manifold adversarial examples. This results in the NCP-ACL's superior performance compared to DeACL and other ACL-based methods.
The proposed NCP-ACL tries to generate perturbations far away from the nearest cluster (to be adversarial) and toward the second nearest cluster (to be close to the training data). 

We will add these remarks with further clarifications in the final version of the manuscript.

**Table 1. Comparison of the adversarial impact of perturbations generated using NCP-ACL and SOTA methods.**

|               | CIFAR-10          |                | CIFAR-100        |                | STL-10           |                |
|---------------|-------------------|----------------|------------------|----------------|------------------|----------------|
|               | Prob. Dec.        | Attk. Succ.    | Prob. Dec.       | Attk. Succ.    | Prob. Dec.       | Attk. Succ.    |
| **NCP-ACL**   | 45.88             | 62.37          | 46.68            | 84.67          | 52.20            | 58.91          |
| **ACL**       | 49.99             | 66.27          | 40.94            | 77.99          | 54.83            | 61.12          |
| **DeACL**     | **69.90**         | **89.06**      | **54.31**        | **94.95**      | **80.44**        | **89.12**      |


**Details on Table 1.** In this table, ACL represents perturbations generated by maximizing the contrastive loss, the strategy used by SOTA methods such as AdvCL, DynACL, DynACL++, DynACL-AIR++, and IntNaCl. 

**Table 2. Comparison of Euclidean distances between adversarial examples generated using adversarial contrastive learning methods and on-manifold data in representation space.**

| Method   | CIFAR-10 | CIFAR-100 | STL-10 |
|----------|----------|-----------|--------|
| **NCP-ACL** | **2.90**  | **3.03**   | **5.88** |
| **ACL**      | 3.16     | 3.58      | 6.03   |
| **DeACL**    | 4.12     | 4.21      | 6.48   |

**Details on Table 2.** To measure how far the generated adversarial examples deviate from the underlying manifold, we calculated the minimum Euclidean distances between the adversarial examples and 1,000 randomly sampled data points from the downstream data distribution in the representation space.
</content>
</thread_object>

</thread>
<thread>
creation date:
1732971474541

thread_type:
official_comment

<thread_object>
creator: area_chair_thid

<content>
title:
Please double check the authors' responses and revision and update the rating if suitable

comment:
Dear Reviewers,

Thanks for the engagement during the discussion. Because the final discussion deadline is fast approaching, please double-check the authors' responses and revisions and update the rating if you feel possible.

Best regards,

Area Chair
</content>
</thread_object>

</thread>


Metareview:
metareview:
The key idea of this paper is quite interesting: first finding that the effectiveness of adversarial contrastive learning is influenced by the composition of positive and negative examples in a minibatch, then proposing a novel approach to adversarial contrastive learning, where adversarial perturbations are generated based on the clustering structure of the representation space learned through contrastive learning. Reviewers also like this idea and agree on its novelty. However, the current evaluation (empirical or theoretical) is still weak and cannot fully support the claim made in the current version. Another round would be beneficial for further improving this paper's quality.