Title: Beyond Pretrained Features: Noisy Image Modeling Provides Adversarial Defense
Venue: NeurIPS 2023
Accepted: yes
Keywords: self-supervised learning

adversarial robustness
Abstract: Recent advancements in masked image modeling (MIM) have made it a prevailing framework for self-supervised visual representation learning. The MIM pretrained models, like most deep neural network methods, remain vulnerable to adversarial attacks, limiting their practical application, and this issue has received little research attention. In this paper, we investigate how this powerful self-supervised learning paradigm can provide adversarial robustness to downstream classifiers. During the exploration, we find that noisy image modeling (NIM), a simple variant of MIM that adopts denoising as the pre-text task, reconstructs noisy images surprisingly well despite severe corruption. Motivated by this observation, we propose an adversarial defense method, referred to as De^3, by exploiting the pretrained decoder for denoising. Through De^3, NIM is able to enhance adversarial robustness beyond providing pretrained features. Furthermore, we incorporate a simple modification, sampling the noise scale hyperparameter from random distributions, and enable the defense to achieve a better and tunable trade-off between accuracy and robustness. Experimental results demonstrate that, in terms of adversarial robustness, NIM is superior to MIM thanks to its effective denoising capability. Moreover, the defense provided by NIM achieves performance on par with adversarial training while offering the extra tunability advantage. Source code and models are available at https://github.com/youzunzhi/NIM-AdvDef.

Beyond Pretrained Features: Noisy Image Modeling Provides Adversarial Defense

Abstract

Recent advancements in masked image modeling (MIM) have made it a prevailing framework for self-supervised visual representation learning. The MIM pretrained models, like most deep neural network methods, remain vulnerable to adversarial attacks, limiting their practical application, and this issue has received little research attention. In this paper, we investigate how this powerful self-supervised learning paradigm can provide adversarial robustness to downstream classifiers. During the exploration, we find that noisy image modeling (NIM), a simple variant of MIM that adopts denoising as the pre-text task, reconstructs noisy images surprisingly well despite severe corruption. Motivated by this observation, we propose an adversarial defense method, referred to as De 3 , by exploiting the pretrained decoder for denoising. Through De 3 , NIM is able to enhance adversarial robustness beyond providing pretrained features. Furthermore, we incorporate a simple modification, sampling the noise scale hyperparameter from random distributions, and enable the defense to achieve a better and tunable trade-off between accuracy and robustness. Experimental results demonstrate that, in terms of adversarial robustness, NIM is superior to MIM thanks to its effective denoising capability. Moreover, the defense provided by NIM achieves performance on par with adversarial training while offering the extra tunability advantage. Source code and models are available at https://github.com/youzunzhi/NIM-AdvDef .

1 Introduction

The idea of fine-tuning pretrained deep neural networks is essential for the success of machine learning to date. A deep neural network that has been well-pretrained on a large-scale dataset can serve as a good initialization for various downstream tasks and improve their performance. Within this paradigm, self-supervised learning plays a vital role as this approach allows the networks to take advantage of vast amounts of unlabeled data. With the emergence of powerful, scalable Transformerbased vision models [14, 21], the masked image modeling (MIM) has rapidly developed recently and become the new dominant paradigm for visual feature pretraining [38, 17, 8, 26], following the success of masked language modeling [12, 4] in NLP. Conceptually, the idea behind MIM is simple. During the pretraining phase, unlabeled training images are randomly masked patch-wise and then fed into an encoder-decoder architecture, where the decoder attempts to recover the original images from the features embedded by the encoder.

Although pretraining methods like MIM leads to improved standard performance on downstream visual tasks, the adversarial robustness of the fine-tuned model is not enhanced. The vulnerability to imperceptible yet maliciously crafted perturbations will significantly limit the real-world deployment of MIM, especially for safety-critical applications. Although the existing state-of-the-art approach,

reconstruction

loss

reconstruction

loss

encoder

decoder

(a)

Denoising by Decoder for Adversarial Defense (De

3

)

Original Input

Perturbation

Adversarial Image

add noise

Jellyfish

Denoised Image

pretrained

encoder

decoder

head

finetuned

encoder

Noisy Image

initialize

(b)

adversarial training [22, 23], can train adversarially robust models, it is known to be computationally expensive [22] and can result in a significant drop in accuracy on clean data [34], which undermines the usefulness of the MIM pretrained features. Moreover, compared to standard training, the sample complexity of achieving adversarially robust generalization is significantly higher, increasing the importance of label efficiency in practice. Motivated by these concerns, we ask the question: How can the state-of-the-art generative pretraining paradigm provide adversarial robustness in addition to standard accuracy ?

As we explore this question, we observe two notable characteristics about the paradigm: (1) Other degradations than masking patches, such as zooming-in, blurring, or masking in the frequency domain, can be effective for the pretext task of self-supervised learning [33, 37]. (2) An attempt to understand MIM revealed that it implicitly learns occlusion-invariant features [19]. Motivated by the observations, we explore Noisy Image Modeling (NIM), a variant of MIM that uses denoising as the pretext task and learns to encode noise-invariant features (Figure 1 (a)).

During the exploration, we find that NIM's denoised images are of surprisingly high quality, even from intensely noisy images (Figure 3 (e) and (g)). However, in the common practice of MIM, only the encoder is retained for further finetuning, while the decoder that performs image reconstruction is discarded. Therefore, the strong denoising capability of NIM will be wasted, which we believe can be utilized for removing adversarial perturbations. To address this, we propose an adversarial defense method named De 3 : De noising by De coder for Adversarial De fense, which first adds some Gaussian noise to the adversarial samples and then tries to reconstruct the original images, as shown in Figure 1 (b). With De 3 , NIM provides not only pretrained features but also an adversarial defense to its fine-tuned models. We further propose to randomize the hyperparameter that controls the degradation level in pretraining, so the defense provided by NIM can achieve a tunable trade-off between standard accuracy and adversarial robustness, which further enhances its applicability in practice.

To summarize, this work has the following contributions:

We propose a novel method called De 3 to utilize the strong denoising ability of NIM models so they can provide defense against adversarial attacks beyond pretrained features.

Rather than setting the hyperparameter that controls the degradation level globally, as done in existing MIM approaches, we propose to sample it from random distributions, so the defense achieves a flexible accuracy-robustness trade-off that can be tuned at test time.

Extensive experiments show that our NIM pretraining learns as good visual features as MIM, while being advantageous for it effectively enhances the robustness of fine-tuned models against strong adversarial attacks.

2 Related Work

2.1 Self-supervised Pretraining in Vision

Learning visual representations from unlabeled images has been a research direction in machine learning and computer vision that has drawn increasing attention in recent years. While masked language modeling (MLM) has achieved great success in pretraining large-scale language models [12, 4, 20], the mainstream framework for pretraining vision models was contrastive learning (CL) [6, 18, 7] until recently. With the significant emergence of Transformers adapted for vision tasks [14, 5, 21], the counterpart of MLM in vision, MIM, becomes the new prevailing self-supervised pretraining paradigm [26, 13, 17, 38]. Through the process of masking and predicting image patches, the encoder learns to extract meaningful visual features.

Beyond using mask prediction as the pretext task, there have been studies examining the outcomes of employing alternative degradation methods. Tian et al. [33] investigate five methods, including zoom-in, zoom-out, distortion, blurring, and de-colorizing, and discover that all of these methods outperform supervised pretraining. Additionally, Xie et al. [37] explore masking in the frequency domain and demonstrate that similar low-level tasks such as super-resolution and denoising yield competitive performance. These studies inspire us to explore the framework of noisy image modeling. More recently, Fang et al. [15] also modify the masking operation in the generative pretraining framework, where the input images are degraded by an additional generator with a small trainable BEiT [2]. However, instead of solely using the generative pretraining framework for pretrained features, we further propose to leverage it for enhancing adversarial robustness.

2.2 Adversarial Robustness

Since about a decade ago when researchers found that deep neural networks are fragile to imperceptible adversarial perturbations [32, 3], enhancing their robustness to such attacks has been an active research area, as stronger threat models have also been continuously developed [16, 25, 22, 10]. One of the most successful methods, adversarial training (AT), incorporates adversarial examples during training to enhance the model's adversarial robustness [16, 22, 39]. While effective, AT methods present many challenges that limit their applicability. For instance, due to the necessity of searching for effective attacks for each image during training, the computational cost can be too expensive. Moreover, AT achieves high robustness at the cost of compromising standard accuracy [34, 27]. Although Wang et al. [36] mitigate this issue by a model-conditional training approach that enables an in-situ calibration of the trade-off between robustness and accuracy, the training cost is further increased, and the method is limited to CNNs.

Another line of research aims to defend against adversarial attacks in the input space, as opposed to the model space like AT. These methods often use an additional generator to restore clean images from attacked ones, such as GAN [29] or Diffusion Models [24]. As their training does not depend on the threat model like AT, these methods can often defend against unseen threats. However, their performance is usually not comparable with AT methods [10]. Our De 3 method is distinct from these methods because our defense is provided by pretraining, eliminating the need for an additional generative model. Therefore, our cost of obtaining the defense also brings pretrained features and boosts fine-tuning. More importantly, the goal of this work is mainly to show the advantage of NIM over MIM in terms of adversarial robustness, not to propose a novel adversarial defense method.

3 Noisy Image Modeling

3.1 Preliminary: Masked Image Modeling

We first briefly revisit the MIM pretraining framework. For every image x ∈ R H × W × C , where H , W , and C denote the height, width, and channel dimensions respectively, sampled from the training dataset Ω , MIM first randomly samples a binary mask M under the control of the mask ratio

hyperparameter γ so that ∑ N i m i /N = γ , where each element m i ∈ 0 , 1 of the binary mask M corresponds to a pixel in the image, and N is the total number of pixels. Then, the masked image is given by

where ⊙ denotes the element-wise product. After that, MIM uses its encoder f θ and decoder g ϕ parameterized by θ and ϕ , respectively, to predict the reconstructed image. In practice, the encoder f θ of MIM is usually instantiated by Vision Transformers (ViTs) [14] or its variants [21], where patch-wise masks are employed. Finally, MIM adopts some distance metric D ( · , · ) such as ℓ 1 loss to measure the reconstruction quality of the masked patches. Overall, the objective of MIM is formulated as follows:

3.2 Noisy Image Modeling: Learning Noise-invariant Feature

Figure 1 (a) presents the similarity between the process of MIM and NIM pretraining. As a variant of MIM, NIM shares many components including the network architecture design, the reconstruction target, and the training techniques. The only difference is that NIM degrades the original image by adding Gaussian noise as

where σ is the parameter that controls the degradation level, i.e., the noise scale. The objective function of NIM is given by

As MIM learns to predict masked regions, the encoder-decoder pretrained under NIM is able to denoise corrupted input images. Note that the term 'noise' we use has a different meaning from that in the classical Denoising autoencoders (DAE) [35]. In our context, we refer to the Gaussian noise that is added to the image, while DAE corrupts the input by replacing randomly selected pixels with 0, which is actually equivalent to masking..

Following the work trying to understand MIM from an occlusion-invariant feature learning perspective [19], we present how NIM learns noise-invariant features. Assume there exists a decoder network g ′ ϕ ′ parameterized by ϕ ′ that can almost restore the feature embedded by f θ to the its input image:

Then, the objective function of NIM in Eq. (4) can be rewritten as

By defining a new similarity measurement

Hence, the objective function of NIM can be viewed as minimizing the distance of feature embedding between the original image x and the noisy image ˆ x NIM , implying that the feature embedding learned by f θ should be noise-invariant.

4 De 3 : Denoising by Decoder for Adversarial Defense

4.1 Formulation of De 3

Although MIM is effective in representation learning, it is still challenging to learn robust pretrained features. Fine-tuned models are easily compromised by small adversarial perturbations, limiting their use in safety-critical tasks. With the awareness of this problem, we explore the potential of NIM and find that the reconstruction ability of the NIM models is surprisingly good. For example, Figure 3 (e) and (g) illustrate the reconstructed images from the noisy images. We observe that most

Eq. (6) is further simplified as

of the semantics are preserved in the reconstruction even for the images that are too noisy to be recognized by humans. However, the common practice of the MIM pretraining only uses the encoder for the initialization of downstream models while the decoder that has the outstanding reconstruction capability is simply discarded. Meanwhile, we believe that the remarkable denoising capability of the NIM decoder can be employed to enhance the adversarial robustness of downstream models and propose a simple defense technique referred to as De 3 : De noising by De coder for Adversarial De fense.

As shown in Figure 1 (b), De 3 works during the test time of downstream tasks by first adding Gaussian noise to an input image and then denoising the image using the pretrained decoder as follows:

where c ψ is the fine-tuned downstream network parameterized by ψ given the pretrained θ , x ′ is the input image that may be under adversarial attacks, and σ De 3 is the noise scale used for the defense. The motivation behind this method is straightforward: since the adversarial perturbation is bounded to a small ϵ , it should be easily flooded by the Gaussian noise with a much larger magnitude and then can be removed along with the random Gaussian noise in the decoding process. Also, the noise is randomly generated during testing, which is usually not fully accessible to the threat models even in white-box attack settings, making it more difficult to find a way for an effective attack.

While the reconstruction of NIM models yields realistic results with minimal error, there remains a discernible gap between the reconstructed images and the original input images. Therefore, we propose to fine-tune the downstream model with denoised images, where training examples used for fine-tuning c ψ also undergo an adding-noise-then-denoising procedure, simulating the conditions encountered during test time. The objective function of fine-tuning is formulated as follows:

where L is the loss function, ¯ y is the ground-truth label of x , and σ ft is the noise scale using in the fine-tuning. Note that θ and ϕ are fixed during the fine-tuning process.

4.2 Achieving Tunable Trade-off by Sampling Random σ in Pretraining

Intuitively, the proposed De 3 method should have a tunable trade-off between clean accuracy and adversarial robustness by adjusting σ De 3 . Increasing σ De 3 will make adversarial perturbations more likely to be flooded and subsequently removed, resulting in stronger adversarial robustness. Meanwhile, as the degradation becomes more severe, the reconstruction quality diminishes, leading to lower clean accuracy However, we observe that this assumption does not necessarily hold in practice. Figure 2 (a) demonstrates that reconstruction quality deteriorates when the noise levels imposed on input images during training and testing are different. We further show how the reconstruction loss 1 varies with noise levels in Figure 2 (b) and observe the same phenomenon in the pretrained models with globally set σ = 25 , 75 , and 150 . These observations suggest that if the model is exposed only to a single noise level during training, it struggles to generalize its denoising capability to images with different noise levels.

To address this issue, we propose to sample the noise level parameter σ from a random distribution instead of fixing it globally as existing MIM methods do. Figure 2 illustrates that models pretrained with randomly selected σ 's can effectively reconstruct input images with good quality, even for corrupted images across various noise scales, as long as the scale is not excessively large. Therefore, we can identify a good trade-off between accuracy and robustness in the NIM models.

5 Experimental Results

In this section, we empirically show the effectiveness of NIM as a self-supervised pretraining method that can bring adversarial robustness via the De 3 method. We describe the settings in Section 5.1 and compare NIM with MIM in Section 5.2. Then, in Section 5.3, the proposed adversarial defense De 3 using NIM is compared with the adversarial training approach. Finally, Section 5.4 presents the ablation study that discusses how σ in pretraining makes differences to the model performance. More experimental results and details can be found in the supplementary.

1.4

0=25

0=75

1.2

=150

1.0

~「(25,3)

0.8

0.6

0.4

0.2

0.0

0

25

50

75

100

125

150

175

200

a

Figure 2: Qualitative and quantitative comparisons show that NIM pretraining with globally set σ only reconstructs well from the noisy images of noise level close to the σ in pretraining, while NIM pretraining with random σ reconstructs well for any σ in a reasonable span.

5.1 Experimental Setups

Datasets and Backbones We conduct all the experiments on ImageNet-1K [11] dataset. We use the training set (1.28 million images) in pretraining and finetuning and use the validation set (50,000 images) for evaluation. We adopt ViT-Base (ViT-B/16) [14] as the backbone in our main experiments. Results for additional backbones can be found in the supplementary.

Threat Models To evaluate the adversarial robustness, we adopt untargeted ℓ ∞ -bounded attacks with radius ϵ = 4 / 255 , which is the most commonly used setting for adversarial robustness studies on ImageNet. We consider three popular white-box attacks: single-step attack FGSM [16], multi-step attack PGD [22], and the state-of-the-art attack AutoAttack (AA) [10]. For PGD, we set the number of steps n = 10 and step size α = 2 / 255 . For AA, we use its 'rand' version since our defense is a randomized defense. To save the computational cost, we apply the AA attack on a 5000-image subset of the ImageNet1K validation set selected by RobustBench [9].

Training Implementations We adopt two representative MIM methods, MAE [17] and SimMIM [38], as the baseline MIM methods. By modifying only the degradation part, we train our NIM-MAE and NIM-SimMIM: the pretext task is changed from mask prediction (with a globally set mask ratio) to denoising (with randomly sampled σ ), while all the other hyperparameters and training techniques follow the original paper. Our default models are pretrained with σ ∼ Γ(25 , 3) and finetuned on denoised images of σ ∼ U (0 , 30) . All models are pretrained for 800 epochs and then finetuned for 100 epochs.

5.2 Comparing NIM with MIM

In Table 1, we compare our NIM models to the MIM baselines. First, we show that without any adversarial defense, the NIM-pretrained classifiers are slightly less accurate but more robust than the MIM-pretrained classifiers. Therefore, we believe that even in settings where a defense model is unavailable, NIM is a simple but effective self-supervised visual learning framework and is worth more investigation in the future.

(a)

(b)

(c)

(d)

(e)

(f)

(g)

AQUAPY

With the De 3 defense provided by the NIM pretrained models, the downstream finetuned classifiers obtain strong robustness for all white-box attacks. Numerically, when the Gaussian noise's σ is 70 (or 140 ), the magnitude of the added Gaussian noise is about 70 / 4 = 17 . 5 (or 35 ) times the adversarial noise. Therefore, the adversarial noise can be flooded and removed along the Gaussian noise by De 3 . As a result, the NIM models with De 3 outperform their MIM counterparts without defense with up to 25.37% improvement in terms of robustness against FGSM attacks, while only 4.37% clean accuracy is decreased. The De 3 defense is also effective against strong attacks like PGD-10 and AA that almost 100% successfully make the vanilla models fail.

In contrast, MIM does not benefit from the defense. Columns 2 and 7 are the results of using the MIM pretrained models for adversarial defense. Here, the De 3 defense is adapted for MIM models: it is performed by first randomly masking some patches and then reconstructing the masked images via the pretrained encoder and decoder, where the mask ratio remains the same as in pretraining (75% for MAE and 60% for SimMIM). It is shown that MIM pretrained models are unable to offer effective adversarial defenses as the clean accuracy drops drastically while robustness improves marginally. Figure 3 shows the qualitative results of using MAE and NIM-MAE to reconstruct masked and noisy images, respectively. Noticeably, the reconstruction of MAE is much worse than NIM-MAE, even when the σ is 140 and the images are unidentifiable for humans. We further quantitatively evaluate the reconstruction quality by computing PSNR (peak signal-to-noise ratio, higher the better) between the original and reconstructed images over the whole ImageNet-1K validation set. As a result, the PSNR of MAE is 20.88 when the mask ratio is 75%, while for NIM-MAE, it is 27.43 when σ =70 and 24.9 when σ =140.

5.3 Comparing NIM+De 3 with Adversarial Training

To further help understand the effectiveness of our NIM models with the De 3 defense, we compare it with the adversarial training method in this section. Adversarial training for ViTs is not a trivial task and techniques and hyperparameters for CNNs may not be beneficial or applicable for ViTs [1, 30]. Here, we adopt the adversarial training recipe for ViTs provided by a recent work [23]. We do the PGD-5 adversarial training for 20 epochs so the training time is close to ours and adjust the learning rate schedule accordingly. Table 2 shows the results of doing adversarial training from scratch and the MAE and NIM-MAE pretrained models. It is shown that both MAE and NIM-MAE are helpful for the adversarial training of ViTs. Compared to the adversarial models, our NIM-MAE model with σ =140 De 3 defense shows comparable robustness with slightly higher clean accuracy.

Adversarially trained models often compromise the clean accuracy too much. In our experiment, the performance for natural images downgrades by 13.38% for the MAE model. Although this issue can be mitigated by setting a larger weight for the standard loss term in the objective function [39], the adjustment of the trade-off comes at the cost of starting over another training process. In contrast, our De 3 defense enables the testing time tunable trade-off, i.e., we do not need to train another network to trade robustness for accuracy (or vice versa). By increasing the scale of noise added in the defense at test time, more adversarial perturbations can be flooded and removed by the denoising pretrained model, at the expense of poorer reconstruction quality and a greater loss of semantic information (Figure 3 (e) vs. (g)), resulting increased robust accuracies and decreased clean accuracy (Figure 4). For example, our model's robustness against the PGD-10 attack can be improved from almost 0 to 31.25% and only compromise 2% of clean accuracy (79.37%). Therefore, in practice, our defense can adjust its performance on clean and adversarial images according to the requirement of the context. For example, in autonomous driving, the need for adversarial robustness may increase when the vehicle comes into an adverse environment, while for safer places, the need for high clean accuracy is prioritized.

While we prepare this paper, some more recent studies on adversarial training for ViTs have emerged [28, 31], and the adversarial robustness of ViTs on ImageNet-1K was improved significantly with more delicate implementation and longer training time. Although our NIM with De 3 approach does not achieve the same level of adversarial robustness as these existing works, we want to highlight that the aim of this work is not to compete with the state-of-the-art methods. Instead, we aim to demonstrate to the research community that NIM can serve as a promising and advantageous self-learning paradigm for enhancing adversarial robustness.

5.4 σ in Pretraining

In this section, we present our ablation studies to evaluate how the random distributions of the Gaussian noise scale parameter σ in pretraining influence the fine-tuned models' performance. We adopt MAE as the default implementation of MIM and randomly selected 5,000 images when evaluating robust accuracy for reducing experimental overhead.

First, we present the clean and robust accuracy of models without defense. The left subfigure of Figure 5 shows that NIM pretrained models can achieve competitive accuracy on clean images, especially when the degradation level hyperparameter is set to or concentrated at a fair value (i.e., σ = 75 , σ ∼ Γ(25 , 3) , σ ∼ U (50 , 100) ). On the other hand, most of the NIM models lead to higher adversarial robustness than MAE, if the variance of σ is not too large (e.g., σ ∼ U (0 , 250) , σ ∼ Γ(3 , 25) . Such phenomenon is consistent with the understanding that NIM learns noise-invariant features in Section 3.2.

80

70

olo

60

50

40

30

Clean

20

FGSM

10

PGD-10

AA

0

Defense

ODe3

MAE

~F(75,1)

~V(50,100)

~V(0,250)

=25

α~T(25,3)

十

~「(3,25)

α~V(0,150)

0=75

0=150

40

32

35

10

(FGSM)

1

30

31

(PGD-

25

Acc

30

20

Robust

15

Robust

29

10

28

5

0

82.0

82.2

82.4

82.6

82.8

83.0

83.2

68

70

72

74

76

78

80

82

Clean Acc

Clean Acc

In the right subfigure of Figure 5, we show the empirical Pareto frontier of De 3 using different NIM-MAE pretrained models, i.e., the points on the figure are the models' best achievable trade-offs between clean and robust accuracy by using different σ in defense. We first observe that the Pareto frontiers of models using globally set σ collapse to very few points because using σ other than the one in pretraining leads to lowering both clean and robust accuracy. Meanwhile, the results suggest that σ sampled from the Gamma distribution generally achieves better accuracy-robustness trade-off than the ones from the Uniform distribution. Among all models, σ ∼ Γ(25 , 3) achieves the best performance by being concentrated to a moderate value and having a suitable variance.

6 Conclusions

In this paper, we investigate noisy image modeling (NIM), a simple variant of masked image modeling where the pretext task is changed from mask prediction to denoising. We discover that NIM exhibits a remarkable ability to reconstruct images even from images with intense noise and are motivated to utilize this denoising capability to remove adversarial perturbations. We propose a simple method that enables the NIM models to provide not only pretrained features but also an adversarial defense. To further achieve a tunable trade-off during test time, we sample the noise level hyperparameter from random distributions rather than setting it globally as MIM. We demonstrate by extensive experimental results that in terms of adversarial robustness, NIM is advantageous over MIM thanks to its strong denoising ability. We also show that the adversarial defense provided by NIM achieves comparable performance to a recent adversarial training method and offers greater flexibility and applicability due to its tunable accuracy-robustness trade-off. We hope that our work will motivate the community to explore NIM and other variants of MIM so the full potential of generative visual pretraining can be realized.

Acknowledgment

This work was supported in part by the Australian Research Council under Projects DP240101848 and FT230100549, and also in part by the NRF and IITP grants funded by the Korea government (MSIT) (No. 2022R1A2C3012210, 2021-0-01343).

References

Yutong Bai, Jieru Mei, Alan L Yuille, and Cihang Xie. Are transformers more robust than cnns? Advances in Neural Information Processing Systems , 34:26831-26843, 2021.

Hangbo Bao, Li Dong, and Furu Wei. Beit: Bert pre-training of image transformers. arXiv preprint arXiv:2106.08254 , 2021.

Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Šrndi´ c, Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. In Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2013, Prague, Czech Republic, September 23-27, 2013, Proceedings, Part III 13 , pages 387-402. Springer, 2013.

Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neural information processing systems , 33:1877-1901, 2020.

Hanting Chen, Yunhe Wang, Tianyu Guo, Chang Xu, Yiping Deng, Zhenhua Liu, Siwei Ma, Chunjing Xu, Chao Xu, and Wen Gao. Pre-trained image processing transformer. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 12299-12310, 2021.

Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In International conference on machine learning , pages 1597-1607. PMLR, 2020.

Xinlei Chen, Saining Xie, and Kaiming He. An empirical study of training self-supervised vision transformers. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 9640-9649, 2021.

Yabo Chen, Yuchen Liu, Dongsheng Jiang, Xiaopeng Zhang, Wenrui Dai, Hongkai Xiong, and Qi Tian. Sdae: Self-distillated masked autoencoder. In European Conference on Computer Vision , pages 108-124. Springer, 2022.

Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: a standardized adversarial robustness benchmark. arXiv preprint arXiv:2010.09670 , 2020.

Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning , pages 2206-2216. PMLR, 2020.

Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition , pages 248-255. Ieee, 2009.

Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805 , 2018.

Xiaoyi Dong, Jianmin Bao, Ting Zhang, Dongdong Chen, Weiming Zhang, Lu Yuan, Dong Chen, Fang Wen, and Nenghai Yu. Peco: Perceptual codebook for bert pre-training of vision transformers. arXiv preprint arXiv:2111.12710 , 2021.

Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929 , 2020.

Yuxin Fang, Li Dong, Hangbo Bao, Xinggang Wang, and Furu Wei. Corrupted image modeling for self-supervised visual pre-training. In The Eleventh International Conference on Learning Representations , 2023.

Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 , 2014.

Kaiming He, Xinlei Chen, Saining Xie, Yanghao Li, Piotr Dollár, and Ross Girshick. Masked autoencoders are scalable vision learners. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 16000-16009, 2022.

Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 9729-9738, 2020.

Xiangwen Kong and Xiangyu Zhang. Understanding masked image modeling via learning occlusion invariant feature. arXiv preprint arXiv:2208.04164 , 2022.

Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv:1907.11692 , 2019.

Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 10012-10022, 2021.

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations , 2018.

Yichuan Mo, Dongxian Wu, Yifei Wang, Yiwen Guo, and Yisen Wang. When adversarial training meets vision transformers: Recipes from training to architecture. In NeurIPS , 2022.

Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Animashree Anandkumar. Diffusion models for adversarial purification. In International Conference on Machine Learning , pages 16805-16827. PMLR, 2022.

Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami. The limitations of deep learning in adversarial settings. In 2016 IEEE European symposium on security and privacy (EuroS&P) , pages 372-387. IEEE, 2016.

Zhiliang Peng, Li Dong, Hangbo Bao, Qixiang Ye, and Furu Wei. Beit v2: Masked image modeling with vector-quantized visual tokenizers. arXiv preprint arXiv:2208.06366 , 2022.

Aditi Raghunathan, Sang Michael Xie, Fanny Yang, John Duchi, and Percy Liang. Understanding and mitigating the tradeoff between robustness and accuracy. In International Conference on Machine Learning , pages 7909-7919. PMLR, 2020.

Sylvestre-Alvise Rebuffi, Francesco Croce, and Sven Gowal. Revisiting adapters with adversarial training. In The Eleventh International Conference on Learning Representations , 2023.

Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-gan: Protecting classifiers against adversarial attacks using generative models. arXiv preprint arXiv:1805.06605 , 2018.

Rulin Shao, Zhouxing Shi, Jinfeng Yi, Pin-Yu Chen, and Cho-Jui Hsieh. On the adversarial robustness of vision transformers. arXiv preprint arXiv:2103.15670 , 2021.

Naman D Singh, Francesco Croce, and Matthias Hein. Revisiting adversarial training for imagenet:

Architectures, training and generalization across threat models. arXiv preprint arXiv:2303.01870 , 2023.

Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 , 2013.

Yunjie Tian, Lingxi Xie, Jiemin Fang, Mengnan Shi, Junran Peng, Xiaopeng Zhang, Jianbin Jiao, Qi Tian, and Qixiang Ye. Beyond masking: Demystifying token-based pre-training for vision transformers. arXiv preprint arXiv:2203.14313 , 2022.

Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. arXiv preprint arXiv:1805.12152 , 2018.

Pascal Vincent, Hugo Larochelle, Yoshua Bengio, and Pierre-Antoine Manzagol. Extracting and composing robust features with denoising autoencoders. In Proceedings of the 25th international conference on Machine learning , pages 1096-1103, 2008.

Haotao Wang, Tianlong Chen, Shupeng Gui, TingKuei Hu, Ji Liu, and Zhangyang Wang. Once-for-all adversarial training: In-situ tradeoff between robustness and accuracy for free. Advances in Neural Information Processing Systems , 33:7449-7461, 2020.

Jiahao Xie, Wei Li, Xiaohang Zhan, Ziwei Liu, Yew Soon Ong, and Chen Change Loy. Masked frequency modeling for self-supervised visual pre-training. arXiv preprint arXiv:2206.07706 , 2022.

Zhenda Xie, Zheng Zhang, Yue Cao, Yutong Lin, Jianmin Bao, Zhuliang Yao, Qi Dai, and Han Hu. Simmim: A simple framework for masked image modeling. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 9653-9663, 2022.

Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning , pages 7472-7482. PMLR, 2019.

Peer reviews:
comments: SUMMARY:
This paper proposed a denoising pre-training framework NIM similar to MIM to improve adversarial defense ability. In particular, the input image is a noisy version of the original. The pre-training goal is to do denoising.

STRENGTHS:
This paper is easy to follow.

WEAKNESSES:
* a) Novelty is limited. The idea proposed in this work is very similar to CIM [1]. Compared to MIM, this work changes the masking operation to add noise.

* b) Performance is incremental with limited applicability. The proposed De3 as a pure self-supervised pre-training approach does not outperform MIM baselines (MAE and SimMIM). For downstream adversarial robustness tests, De3 shows improvement over MAE and SImMIM, which is not surprising since the pre-training goal is to denoise. 

* c) Datasets and backbones used in this work to validate performance are scarce. It is suggested that more datasets,downstream tasks, and backbones are evaluated.

**References**

[1]  Fang, Yuxin, et al. "Corrupted image modeling for self-supervised visual pre-training." ICLR 2023.

QUESTIONS:
See weakness.

LIMITATIONS:
See weakness.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 2
DATE: 2023-06-29

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors introduce noise image modeling (NIM) as a self-supervised pretext task and demonstrate that their encoder-decoder architecture decreases the success of adversarial attacks by adding noise to a perturbed image and then denoising it. Their method is called $De^3$. Furthermore, the author conduct a major comparison effort to masked image modeling (MIM) and the capabilities against adversarial attacks.\n\nSTRENGTHS:\n- This paper is well written and easy to understand.\n- \"flooding out\" adversarial attacks is an interesting idea. \n- The method utilizes the usually unused decoder for \"cleaning\" adversarial images.\n- $De^3$, as an adversarial prevention method, can be applied without generating much computation overhead during inference or training.\n- NIM with $De^3$ can use a dynamic trade-off between clean accuracy and the vulnerability to adversarial images. \n- On-par results with MIM while doing adversarial training.\n\nWEAKNESSES:\n1. Table 1/Figure 3: \n- The \"flooding out effect\" for very large sigma (140) seems not reasonable, since it corrupts the whole image. How strong is the flooding in comparison to the adversarial perturbation? I think it is necessary to show the scale difference of (i) the adversarial attacks and (ii) the added noise.\t\t\t  \n- I am a little bit surprised by the denoising performance with high noise-levels (see Figure 3 (f) - sigma 140):  the reconstruction seems \"too good to be true\", where it even recovers the smallest features. This seems odd despite other efforts [1]. I think it needs further extensive investigation:  (i) when does the model break in terms of reconstruction quality? What happens when you use an even larger value for sigma? (ii) when does the adversarial defense fail when a high-noise level (sigma 100, 150, 200) is used? \n2. Figure 2 (a) needs captions for the image rows/columns to understand it better. \n\n3. Table 1: Inconsistent use of bold highlighting?\n\n4. Table 1: I am not sure if this is a fair comparison, since NIM utilizes its built-in adversarial prevention\n           while MAE/SimMIM (MIM) has none (gamma is not implicitly designed for dealing with adversarial images).\n5. line 264-268: From the readers perspective, it seems that the authors tried to achieve state-of-the-art with $De^3$ but failed, so they redirect their writing to fit a different goal. I suggest, the authors omit the sentences about not wanting to achieve SOTA.\n6. Figure 5: I suggest to use more symbols for different sigmas. Differentiate between fixed/random sigma and MAE baseline with triangle and then use square/diamond/circle.\n7. Figure 5: Ordering of the entries in the legend can be improved\n\nReferences:\n\n[1] Mahdaoui, Assia El, Abdeldjalil Ouahabi, and Mohamed Said Moulay.\n\"Image denoising using a compressive sensing approach based on regularization constraints.\"\nSensors 22.6 (2022): 2199.\n\nQUESTIONS:\nDo you think that there is a way to construct strong adversarial examples if the attacker knows that the NIM architecture is used, despite the noise randomness?\n\nLIMITATIONS:\nLimitations are not discussed in the paper.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper presents a straightforward approach for defending against adversarial attacks while incorporating pre-trained feature learning through the utilization of noisy images. Inspired by Masked Image Modeling (MIM), the paper replaces the masking pretext task by introducing a substantial amount of noise into the image. Subsequently, a transformer-based encoder/decoder is trained to reconstruct the original image, and the encoder is fine-tuned to acquire features that are invariant to noise by comparing the encoded features of the original image input with those of the reconstructed images. The defense mechanism involves retaining the decoder for the downstream task, employing an [encoder → decoder → encoder] mechanism to obtain features that can be further fine-tuned for the downstream task.\n\nThe authors perform experiments on ImageNet-1K using the ViT-Base backbone and evaluate the proposed method against several existing adversarial attacks, including $l_{\\infty}$ bound attacks, FGSM, PGD, and AutoAttack (AA). The results demonstrate that the proposed method exhibits greater robustness compared to baseline pre-trained methods like MAE or SIMM.\n\nSTRENGTHS:\nThe finding of the paper is interesting, which suggests that the adversarial attacks present as a kind of noise, and it makes sense that denoising works to some extent. This aspect might open up possibilities for combining existing works to further enhance downstream accuracy and adversarial defense. \n\nThe paper writing is easy to follow and the proposed method is simple and comprehensive.\n\nWEAKNESSES:\n1. It would be beneficial to have a more extensive comparison by including well-known self-supervised features like SimCLR, MOCO, DINO, and others, to assess the robustness of the features learned by these methods in comparison to the proposed method.\n\n2. To enhance the paper, it would be valuable if the authors conducted experiments on another dataset and included more baseline methods to gain insights into the generalizability of the proposed method.\n\n3. It would be valuable to compare the proposed method with existing adversarial defense approaches, such as GAN-based methods.\n\n4. Despite some improvements, the defense results are not particularly impressive and do not appear to completely eliminate the attacks. This suggests that the attacks might involve more than just noise.\n\n5. It should be noted that using additional decoders could be a drawback depending on the applications, as it significantly increases memory usage during inference.\n\nThe approach seems novel, and I find the current version of the paper is fine unless there are serious concerns / flaws from other reviewer’s feedback. However, I would recommend conducting additional experiments to further showcase the generalizability of the proposed method.\n\nQUESTIONS:\nI wonder if the authors have considered keeping the original MAE approach and combining it with the noisy modelling technique to explore any potential further improvements?\n\nSee questions above also.\n\nLIMITATIONS:\nN/A", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-07-04"}

comments: SUMMARY:
This paper proposes a novel adversarial defense method $De^3$ to utilize the strong denoising ability of NIM models. The proposed method first adds some Gaussian noise to the adversarial samples and then tries to reconstruct the original images. Experiments show the advantage of NIM over MIM in terms of adversarial robustness.

STRENGTHS:
1. The idea of NIM is interesting.  The proposed method obtains the adversarial defense as well as provides pretrained features by a simple yet effective modification on masked image modeling. 
2. The idea of De3 is instructive to enhance adversarial defense through reconstructing clean images from intensely noisy images.
3. The experiments demonstrate that the proposed method can achieve comparable defense performance with adversarial training. 
4. This paper is well-written and easy to follow.

WEAKNESSES:
1. Although De3 can enhance adversarial defense, it increases computational cost during inference time. Note that there exists two encoders  and one decoder in De3, can we distill another encoder  from them and use only it during inference time? 
2. This paper compares NIM against MIM in terms of accuracy and adversarial robustness. It seems that MIM achieves better accuracy on clean images. I wonder can we combine them together and obtain a better trade-off between accuracy and robustness?

QUESTIONS:
I wonder the difference of robustness against other types of attacks, like black-box ones.

LIMITATIONS:
Limitations are adequately discussed in the supplemental materials.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 4
DATE: 2023-07-06

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a method called Noisy Image Modeling (NIM) as self-supervised learning to improve the adversarial robustness of pretrained features. NIM uses denoising as a pretext task and is effective in reconstructing noisy images for representation learning. In addition, the authors propose a defense technique called De^3 that leverages the denoising capability of NIM to enhance robustness against adversarial attacks. Experimental results show that NIM with De3 defense outperforms Masked Image Modeling (MIM) in terms of adversarial robustness while maintaining competitive performance on clean data. The paper concludes by highlighting the potential of NIM and other variants of MIM for generative visual pretraining.\n\nSTRENGTHS:\n1. Different from the popular MIM, NIM improves the pretrained features by resisting adversarial attacks. The experiment verfies the effectiveness of the proposed method.\n2. In addition to the representation learning method, the paper proposes a defense technique called De3 that utilizes the denoising capability of NIM to enhance robustness against adversarial attacks.\n3. The paper compares the performance of NIM with the proposed De3 defense to Masked Image Modeling (MIM) and other adversarial training methods. Experimental results show that NIM with De3 defense outperforms MIM in terms of adversarial robustness while maintaining competitive performance on clean data.\n4. The paper introduces a modification to NIM that allows for a tunable trade-off between accuracy and robustness.\n\nWEAKNESSES:\n1. The paper does not thoroughly analyze the computational cost of the proposed method. Adversarial training methods, such as the one proposed by Wang et al. [34], are known to be computationally expensive. It would have been valuable to compare the computational cost of NIM with other defense techniques.\n2. The paper does not extensively explore the impact of hyperparameters on the performance of the proposed method. For example, the authors mention that the trade-off between clean accuracy and robustness can be adjusted by varying the noise level hyperparameter, but they do not provide a detailed analysis of the optimal values or the sensitivity of the method to different hyperparameter settings.\n3. The paper does not analyze the transferability of adversarial examples between different models. It would have been valuable to investigate whether the robustness achieved by NIM with De^3 defense can generalize to other models or if it is specific to the pretrained model used in the experiments [1].\n\nQUESTIONS:\n1. Computational cost.\n2. Parameter Sensitivity Analysis.\n3. The generalization of the proposed  method.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 8, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-07-10"}