Title: Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Models
Venue: NeurIPS 2023
Accepted: yes
Keywords: adversarial robustness

deep learning

vision transformers

convnext
Abstract: While adversarial training has been extensively studied for ResNet architectures and low resolution datasets like CIFAR-10, much less is known for ImageNet. Given the recent debate about whether transformers are more robust than convnets, we revisit adversarial training on ImageNet comparing ViTs and ConvNeXts. Extensive experiments show that minor changes in architecture, most notably replacing PatchStem with ConvStem, and training scheme have a significant impact on the achieved robustness. These changes not only increase robustness in the seen $\ell_\infty$-threat model, but even more so improve generalization to unseen $\ell_1/\ell_2$-attacks. 
Our modified ConvNeXt, ConvNeXt + ConvStem, yields the most robust $\ell_\infty$-models across different ranges of model parameters and FLOPs, while our ViT + ConvStem yields the best generalization to unseen threat models.

Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Models

Abstract

While adversarial training has been extensively studied for ResNet architectures and low resolution datasets like CIFAR-10, much less is known for ImageNet. Given the recent debate about whether transformers are more robust than convnets, we revisit adversarial training on ImageNet comparing ViTs and ConvNeXts. Extensive experiments show that minor changes in architecture, most notably replacing PatchStem with ConvStem, and training scheme have a significant impact on the achieved robustness. These changes not only increase robustness in the seen ℓ ∞ -threat model, but even more so improve generalization to unseen ℓ 1 /ℓ 2 -attacks. Our modified ConvNeXt, ConvNeXt + ConvStem, yields the most robust ℓ ∞ -models across different ranges of model parameters and FLOPs, while our ViT + ConvStem yields the best generalization to unseen threat models.

1 Introduction

Adversarial training [36] is the standard technique to obtain classifiers robust against adversarial perturbations. Many works have extensively analyzed several aspects of adversarial training, leading to further improvements. These include changes in the training scheme, i.e. using different loss functions [66, 43, 40], tuning hyperparameters like learning rate schedule or weight decay, increasing the strength of the attack at training time, adding label smoothing and stochastic weight averaging [19, 41]. Also, complementing the training set with pseudo-labelled [3] or synthetic [20] data, and via specific augmentations [45] yields more robust classifiers.

However, these works focus on small datasets like CIFAR-10 with low resolution images, and models using variants of ResNet [22] as architecture. When considering a more challenging dataset like ImageNet, the space of possible design choices regarding model, training and evaluation protocols becomes much richer, and little work exists exploring this domain. For example, it has been recently shown that architectures like vision transformers (ViTs) [16, 50], mixers [49, 54] and hybrids borrowing elements of different families of networks [17, 64] are competitive or outperform convolutional networks on ImageNet, while they hardly work on e.g. CIFAR-10. In turn, ConvNeXt [34] has been proposed as modern version of ResNet which closes the gap to transformer architectures.

In this work we study the influence of architecture and training schemes on the robustness of classifiers to seen and unseen attacks. We focus on two extreme ends of architectures used for ImageNet, ViT and ConvNeXt (isotropic vs non-isotropic, attention only vs convolution only, stem with large vs small patches), and study Isotropic ConvNeXt as an intermediate architecture. We focus on training ImageNet models robust with respect to the ℓ ∞ -threat model (i.e. the perturbations have bounded ℓ ∞ -norm), but additionally track the robustness to unseen ℓ 1 - and ℓ 2 -attacks in order to reveal architectural components which lead to better generalization of robustness. This, in fact, is a desirable

20

30

40

50

60

70

80

90

100

110

Parameters (M)

28

32

36

40

44

48

52

56

Robust accuracy (%)

ViT-S-CvSt

ConvNext-T-CvSt

ViT-B-CvSt

ConvNeXt-B-CvSt

ConvNeXt-S-CvSt

ViT-M-CvSt

ResNet-50

ViT-S

Swin-S

XCiT-S

XCiT-L

ConvNeXt-T

ViT-B

WRN-50-2

Swin-B

RobArch-S

RobArch-M

RobArch-L

ConvNeXt (ours)

ViT (ours)

SOTA models

GFLOPs (range)

4 - 7

8 - 12

16+

property since typically adversarially trained models are still vulnerable to attacks not seen at training time [28]. In particular, we show via extensive experiments that

using a convolutional stem instead of a patch stem in most cases leads to consistent gains in ℓ ∞ -robustness and quite a large boost in the unseen ℓ 1 - and ℓ 2 -threat models.

leveraging SOTA pre-trained clean models as initialization allows us to train using heavy augmentation, in contrast to what has been suggested by prior work [2, 14].

increasing image resolution at test time yields improvements in ℓ ∞ -robust accuracy. This is surprising as for the ℓ ∞ -threat model with fixed radius, higher resolution yields a stronger attack.

Combining our various improvements, we obtain state-of-the-art ℓ ∞ -robust accuracy for perturbation size ϵ = 4 / 255 at resolution 224 × 224 on ImageNet, see Fig. 1. We obtain 50 . 2% robust accuracy for small and 56 . 3% robust accuracy for large models, improving by 5 . 8% and 2 . 8% respectively upon prior works. Furthermore, we improve SOTA when fine-tuning these models to a larger radius, ϵ ∞ = 8 / 255 and to other datasets. We make our code and robust models publicly available. 1

2 Background and Related Work

In [36] adversarial training (AT) of a classifier f θ : X → Y is introduced as the optimization problem

where θ are the parameters of the classifier f θ . The goal is to make f θ robust against ℓ p -bounded perturbations, that is the classifier should have the same prediction on the ℓ p -ball B p ( x i , ϵ p ) of radius ϵ p centered at x i . In practice, the inner maximization is approximately solved with projected gradient descent (PGD), θ is optimized with SGD (or its variants) on the training set D , and cross-entropy loss is used as objective function L . AT has been shown to be an effective defense against adversarial perturbations, and many follow-up works have modified the original algorithm to further improve the robustness of the resulting models [66, 61, 20, 43, 40].

The most popular threat models are ℓ ∞ - and ℓ 2 -bounded perturbations. Several other attacks have been explored, including ℓ 1 - or ℓ 0 -bounded, adversarial patches, or those defined by neural perceptual

metrics like LPIPS [30]. A well-known problem is that models trained to be robust with respect to one threat model need not be robust with respect to unseen ones [28]. Multiple-norm adversarial training [53] aims to overcome this but degrades the performance compared to adversarial training in each individual threat model.

Training recipe. [19, 41] analyzed in detail the influence of several fine-grained choices of training hyperparameters (batch size, weight decay, learning rate schedule, etc.) on the achieved robustness. [24, 5] suggest to use a standard classifier pre-trained either on a larger dataset or with a selfsupervised task as initialization for adversarial training for improved robustness. However, all these works focus on CIFAR-10 or other datasets with low resolution images. In [38], the effect of several elements including clean initialization, data augmentation and length of training on adversarial training with ViTs is analyzed: however, their study is limited to CIFAR-10 and Imagenette [25], and we show below that some of their conclusions do not generalize to ImageNet and other architectures. For ImageNet, [2] argued that ViTs and ResNets attain similar robustness for several threat models if training scheme and architecture size for both are similar, while [14] proposed a recipe for training ℓ ∞ -robust transformers, in particular XCiT [17]: basic augmentation, warm-up for the radius ϵ p , and large weight decay. In contrast, [44] use the standard training scheme for a large ViT-B for 300 epochs and obtain the most ℓ ∞ -robust model on ImageNet. In concurrent work, [32] study ℓ ∞ -training schemes for ConvNeXt and Swin-Transformer which are outperformed by our models, in particular regarding generalization to unseen attacks.

Architectural design choices. Searching for more robust networks [60, 26] studied the effect of architecture design choices in ResNets, e.g. width and depth, on adversarial robustness for CIFAR-10. Recently, [42] did a similar exploration on ImageNet. [48] compared the robustness to seen and unseen attacks of several modern architectures on CIFAR-10 and Imagenette, and conclude that ViTs lead to better robust generalization. Finally, [63] found that using smooth activation functions like GELU [23] improves the robustness of adversarially trained models on ImageNet, later confirmed for CIFAR-10 as well [19, 41].

Modern architectures. Since [16] showed that transformer-based architectures can be successfully used for vision tasks, a large number of works have introduced modifications of vision transformers [50, 33, 55] achieving SOTA classification accuracy on ImageNet, outperforming ResNets and variants. In turn, several works proposed variations of training scheme and architectures to make convolutional networks competitive with ViTs [47, 59], in particular leading to the ConvNeXt architecture of [34]. Moreover, hybrid models combine typical elements of ViTs and CNNs, trying to merge the strengths of the two families [17, 13, 64]. While these modern architectures perform similarly well on vision tasks, it is open how they differ regarding adversarial robustness. [18, 21] compared the robustness of normally trained ViTs and ResNets to ℓ p -norm bounded and patch attacks concluding that the ranking depends on the threat model.

3 Influence of Architecture on Adversarial Robustness to Seen and Unseen Attacks

In this section we analyze existing architectures and their components regarding adversarial robustness on ImageNet. In particular, we are interested in studying which elements are beneficial for adversarial robustness (i) in the threat model seen at training time and (ii) to unseen attacks. Since it is the most popular and well-studied setup, we focus on adversarial training w.r.t. ℓ ∞ , and use ℓ 2 - and ℓ 1 -bounded attacks to measure the generalization of robustness to unseen threat models. While we focus on the influence of architecture on the achieved robustness in this section, we analyze the influence of pre-training and augmentation in Sec. 4. All results are summarized in Table 1 which provides the full ablation for this and the next section. We select the version T for ConvNeXt and S for Isotropic ConvNeXt and ViT, since these have comparable number of parameters and FLOPs.

3.1 Experimental Setup

Training setup. If not stated otherwise, we always use adversarial training [36] w.r.t. ℓ ∞ with perturbation bound ϵ = 4 / 255 and 2 steps of APGD [8] for the inner optimization on ImageNet-1k using resolution 224x224 (we refer to App. C.2 for a comparison of APGD-AT vs PGD-AT). Note that we use the ℓ 2 - or ℓ 1 -threat model just for evaluation, we never do adversarial training for them. We use a cosine decaying learning rate preceded by linear warm-up. In this section, we use a basic

training setting, that is only random crop as basic augmentation and 50 epochs of adversarial training from random initialization. More details are available in App. A.

Evaluation setup. For all experiments in the paper, unless specified otherwise, we evaluate the robustness using AutoAttack [8, 9], which combines APGD for cross-entropy and targeted DLR loss, FAB-attack [7] and the black-box Square Attack [1], on the 5000 images of the ImageNet validation set selected by RobustBench [6] at resolution 224x224. The evaluations are done at the following radii: ϵ ∞ = 4 / 255 , ϵ 2 = 2 , and ϵ 1 = 75 . For some marked experiments which involve a large number of evaluations we use APGDT-DLR (40 iterations, 3 restarts) with the targeted DLR loss [8] which is roughly off by 1-2% compared to full AutoAttack.

3.2 Architecture Families and Convolutional Stem

Choice of architectures. While some of the novel components of ConvNeXts are inspired by the Swin Transformer [33], the ConvNeXt is a modified version of a ResNet, using progressive downsampling and convolutional layers. On the other end of the spectrum of network families we find ViTs, as a non-convolutional architecture using attention and with an isotropic design after the PatchStem, see Fig. 2. Additionally, [34] introduce Isotropic ConvNeXt, which creates tokens similarly to ViTs, which are then processed by a sequence of identical residual blocks (with no downsampling, hence the name isotropic) as in ViTs, until a final linear classifier. The blocks of a ViT rely on multi-head self-attention layers [56], while Isotropic ConvNeXt replaces them with depthwise convolutions. It can be thus considered an intermediate step between ConvNeXt and ViT. By considering ViT and ConvNeXt, we cover two extreme cases of modern architectures. While it would have been interesting to include other intermediate architectures like XCiT or Swin-Transformer, our computational budget did not allow this on top of the already extensive experiments of the present paper.

Convolutional stem. [62] propose to replace the patch embedder in ViTs with a convolutional block (ConvStem) consisting of several convolutional layers alternating with normalization and activation layers. While the PatchStem in ViTs divides the input in disjoint patches and creates tokens from them, the ConvStem progressively downsamples the input image until it has the right resolution to be fed to the transformer blocks. [62] show that this results in a more stable standard training which is robust to the choice of optimizer and hyperparameters.

As adversarial training is more difficult than standard training, we check if adding a ConvStem has a similar positive impact there as well. As both ViTs and Isotropic ConvNeXts divide the input image into 16 × 16 patches, we use for both the convolutional stem of [62], which has four convolutional layers with stride 2, each followed by layer normalization and GELU activation. Since ConvNeXt uses a PatchStem with 4 × 4 -patches, the ConvStem of ViTs would not work. Therefore we design a specific convolutional stem with only two convolutional layers with kernel size 3 and stride 2, see Fig. 2. Adding a ConvStem has only minimal impact on the number of parameters and FLOPs of the models (see Table 2), especially for ConvNeXt.

ConvStem

Patch-Stem

Image

Image

X2

3x3Conv,stride 2

4x4 Conv, stride 4

LayerNorm

LayerNorm

GeLU

Stage 1

Stage 1

More details on the convolutional stem design, and ablation studies on its effect on unseen threat models can be found in App. B. The effect of ConvStem on model size is discussed in App. C.4.

3.3 Effect of Architecture and ConvStem vs Patchstem on Adversarial Robustness

In Table 1 we first check for the basic setting described above (random init., basic augment.) the effect of using a convolutional stem (+ CvSt) vs PatchStem for the three architectures: for both isotropic architectures it notably improves the robustness as well as clean accuracy for adversarially trained models, whereas the improvements for the ConvNeXt are marginal. However, all three architectures show huge improvements in the generalization of robustness to unseen ℓ 1 - and ℓ 2 -attacks when using ConvStem instead of PatchStem. Interestingly, the ℓ 1 - and ℓ 2 -robustness of the ConvStem models is quite similar despite larger differences in ℓ ∞ -robustness. Our results in this basic training setup show

that the ConvStem is a simple and effective architecture modification which has significant impact on robustness with respect to seen and unseen threat models. We also note that this finding generalizes for the modifications of the training scheme proposed in the next section. It is particularly remarkable that even for the ConvNeXt architecture, this little change from PatchStem to ConvStem has such a huge effect on the robustness with respect to the unseen ℓ 1 -and ℓ 2 -threat models.

4 Effect of Strong Pre-Training and Heavy Data Augmentation on Robustness

As the next step after the architecture modification of the last section, we now identify in an ablation study in Table 1 strong pre-training and heavy augmentations as key elements of the training scheme which boost adversarial robustness on ImageNet. The effect of other fine-grained training hyperparameters like weight decay and label smoothing is discussed in App. D.3, where we show that varying them around our default values does not have any impact on robustness.

4.1 Strong Pre-Training

It is well-known that pre-training on large datasets improves the performance on downstream tasks, e.g. models pre-trained on ImageNet-21k or JFT achieve significantly higher accuracy on ImageNet-1k than those trained on ImageNet-1k from random initialization [58]. Similarly, it has been observed that pre-training on larger datasets like ImageNet-21k or ImageNet-1k helps to achieve better adversarial robustness on CIFAR-10 [24, 38]. However, our goal is not to use a larger training set than ImageNet1k but to better utilize the given dataset ImageNet-1k. As adversarial training on ImageNet is a non-trivial optimization problem, where runs can fail completely, see [14], we propose to initialize adversarial training from a fully trained (on ImageNet-1k) standard model. Although the clean model

is clearly not adversarially robust, starting from a point with low clean loss considerably helps in the first stages of adversarial training. Short fine-tuning of clean models to become adversarially robust has been discussed in [27, 10] but without achieving robustness comparable to full adversarial training.

In the following we use as initialization the standard models available in the timm library or from the original papers, refer App. D.7 for further details. For the models with convolutional stem no such models are available. For these we initialize the ConvStem randomly and the remaining layers with the weights of the corresponding non-ConvStem models, then do standard training for 100 epochs to reach good clean accuracy (see App. B.3 for details and performance of these classifiers). Interestingly, changing from random initialization to initialization with strongly pre-trained models significantly improves clean as well as ℓ ∞ -robust accuracy across architectures, see Table 1. The effects on the isotropic architectures, which are known to be harder to train, are even higher than for the ConvNeXt. At this stage the ViT-S + ConvStem already has 2 . 5% better ℓ ∞ -robustness (44.3% vs 41.8%) than the XCiT-S model of [14]. Finally, using an even better model, i.e. pre-trained on ImageNet-21k, as initialization did not provide additional benefit, see App. D.1.

4.2 Heavy Data Augmentation

The second aspect we analyze is how to take advantage of heavy augmentation techniques like RandAugment [12], MixUp [67] and CutMix [65], which are crucial for the performance of standard models, in adversarial training. In particular, [2] note that for ViTs using heavy data augmentation with adversarial training leads to model collapse, and thus design a schedule to progressively increase the augmentation intensity. Similarly, [14] report better performance for robust ViTs when only weak augmentations (random crop, horizontal flip, color jitter) are used, and that ConvNeXt training even diverges if heavy augmentations are not excluded. Finally, [44] could train with heavy augmentations but using a much larger ViT-B model and a longer training of 300 epochs (which allows them to have a less steep learning rate warm-up phase). Instead we show that initializing adversarial training with a well-trained standard classifier makes it possible to use heavy augmentation techniques from the beginning, and benefit from them, even for small models and shorter training schedules. In contrast, in our experiments, training a ConvNeXt with heavy augmentations from random initialization failed.

As heavy augmentations we use RandAugment, CutMix, MixUp, Random Erasing [68] (with hyperparameters similar to [34], see App. A). We also use Exponential Moving Average (EMA) with a decay of 0.9999 and label smoothing with parameter 0.1 for consistency with [34]. However, we observe little to no effect of EMA on robustness.

In Table 1 one can see that adding heavy data augmentation on top of strong pre-training significantly boosts the performance of the ConvNeXts in clean and ℓ ∞ - robust accuracy. Interestingly, only the ConvNeXt + ConvStem has further strong improvements in the unseen ℓ 2 - and ℓ 1 -threat models. For the isotropic architectures, heavy augmentations have marginal effect on ℓ ∞ -robustness, although they improve robustness to unseen attacks. Isotropic architectures require longer training to benefit from heavy augmentations. We highlight that at this point our ConvNeXt-T and ConvNeXt-T + ConvStem already have higher (+2.1% and +3.1% respectively) robustness w.r.t. ℓ ∞ than the ConvNeXt-T from [14], and similarly our ViT-S + ConvStem and Isotropic ConvNeXt + ConvStem outperform XCiT-S [14] (detailed comparison to SOTA in Table 2). A further comparison of heavy augmentation and the 3-Aug scheme of [14] can be found in in App. D.2.

Longer training. Adding heavy data augmentation increases the complexity of the learning problem, which requires longer training, in particular for isotropic architectures. Thus we extend the training time from 50 to 300 epochs. As expected we see the strongest improvements for the isotropic architectures but even for ConvNeXt one observes consistent gains: this is in contrast to the claim of [38] that longer training does not help to improve robustness. The ConvNeXt-T + ConvStem, with 49.5% robust accuracy, outperforms all classifiers reported in [14] and [42], including those with up to 4 times more parameters.

5 Comparison with SOTA Models

In Table 2 we compare our classifiers with models from prior works trained for adversarial robustness w.r.t. ℓ ∞ at ϵ ∞ = 4 / 255 on ImageNet. For each model we report number of parameters and FLOPs,

∗ concurrent work the number of training epochs, the number of steps in the inner maximization, and clean and robust accuracy (AutoAttack on RobustBench validation set) in the three threat models. We group the models according to size for fair comparison, distinguishing small ( < 30M parameters), medium ( ≈ 50M params) and large models ( ≥ 80M params).

1-Step vs 2-Step Adversarial Training. Current works use one to three steps of PGD to solve the inner problem, see column 'Adv. Steps' in Table 2. It is an important question if our gains, e.g. compared to works like [14] who use a single step, are just a result of the stronger attack at training time. We test this by training a ConvNeXt-T + ConvStem model with strong pre-training and heavy augmentation with 1-step APGD adversarial training for 50 epochs. We get a ℓ ∞ -robust accuracy

of 46.4% (clean acc. is 71.0%) compared to 47.5% with 2-step APGD (see Table 1) which is just a difference of 1.1%. Thus our gains are only marginally influenced by stronger adversarial training. Moreover, our ConvNeXt + ConvStem models with 50 epochs of adversarial training outperform all existing SOTA models even though the computational cost of training them is lower (50 epochs of 2-step AT corresponds roughly to 75 epochs of 1-step AT and 37.5 epochs of 3-step AT). For our best small and large model we also check the other direction and train 3-step AT models, which improve by 0 . 7% for ConvNeXt-T + ConvStem and 0 . 14% for ConvNeXt-B + ConvStem in ℓ ∞ -robustness. This suggests that 2-step AT is a good compromise between achieved robustness and training time. In App. C.1 we additionally show how our training scheme yields more robust models than that of [14], even with less than half the effective training cost.

Scaling to larger models. We apply our training scheme introduced in the previous sections to architectures with significantly more parameters and FLOPs. We focus on ConvNeXt-S/B and ViT-M/B: in particular, for ConvNeXt-B we adapt the convolutional stem used for ConvNeXt-T by adding an extra convolutional layer, while for the ViTs we just adjust the number of output channels to match the feature dimension of the transformer blocks (more details in App. B). We train the medium models for 50 epochs and the large models for 50 and 250 epochs (with ConvStem only).

Comparison with SOTA methods. Among small models, all three architectures equipped with ConvStem outperform in terms of ℓ ∞ -robustness all competitors of similar size with up to 5.8% improvement upon the ConvNeXt-T of [14]. Moreover, our ConvNeXt-T + ConvStem is with 50 . 2% robust accuracy 1 . 2% better than the RobArch-L [42] (the previously second most robust model) which has 3.6 × more parameters and FLOPs. The ConvStem positively impacts generalization of robustness to unseen attacks of all three architectures, with improvements between 2 . 8% and 4 . 2% for ℓ 2 and 1 . 4% and 5 . 2% for ℓ 1 (with respect to the XCiT-S12). For medium models the picture is the same: our ViT-M+ConvStem and the ConvNeXt-S+ConvStem outperform both in seen and unseen threat models their non-ConvStem counterparts and the best existing model (XCiT-M12 of [14]).

For large models we compare to the previously most robust model, the ViT-B of [44], with 53 . 5% ℓ ∞ -robust accuracy (the model is not available so we cannot evaluate ℓ 1 - and ℓ 2 -robustness). It is remarkable that our ConvNeXt-B+ConvStem with only 50 epochs of training outperforms this ViT-B trained for 300 epochs already by 0 . 9% and with 250 epochs training even by 2 . 5% . An interesting observation is that our ViT-B+ConvStem with 250 epochs training is with 54 . 7% just 1 . 3% worse than our ConvNeXt-B+ConvStem but has significantly better generalization to unseen attacks: 56 . 3% vs. 49 . 1% for ℓ 2 and 32 . 1% vs 23 . 3% for ℓ 1 . Regarding the concurrent work of [32], we note that our ConvNeXt-B+ConvStem trained for 250 epochs with 2-step AT is already better than their ConvNeXt-B 3-step AT model trained for 300 epochs ( ≈ 40% longer training time), while having significantly better generalization to the unseen ℓ 1 - and ℓ 2 -attacks. Our 3-step AT ConvNeXt-B+ConvStem outperforms their best model, a Swin-B, even though it is trained for 20% less epochs, and has better generalization to ℓ 2 . Finally, we note that our ViT-B+ConvStem significantly outperforms their Swin-B in terms of robustness to unseen attacks.

Additional experiments. InternImage [57], a recent non-isotropic model, already uses a ConvStem. Replacing it with a PatchStem preserves the robustness in ℓ ∞ (seen threat model) but decreases the robustness to unseen ℓ 1 - and ℓ 2 -attacks (App. C.3), further validating the effectiveness of ConvStem.

Table 4: ImageNet: ℓ ∞ -robust accuracy at ϵ ∞ = 8 / 255 . While models from the literature are trained from scratch for ϵ ∞ = 8 / 255 , we fine-tune our 4 / 255 -robust models for only 25 epochs to the larger radius.

192

224

256

288

320

352

384

input resolution

50

55

60

65

70

75

clean accuracy

ConvNeXt-T

ConvNeXt-T + ConvStem

Isotropic CN-T

Isotropic CN-T + ConvStem

ViT-S

ViT-S + ConvStem

192

224

256

288

320

352

384

input resolution

35

40

45

50

robustness

6 Influence of Resolution and Fine-Tuning

In the following we analyze how robustness behaves under variation of test time resolution, and robust fine-tuning to either a larger radius on ImageNet or other datasets.

Improving robustness via increasing test-time image resolution. Unlike small datasets like CIFAR10, for ImageNet the input images are resized before inference. Using higher resolution at test time can lead to improved clean accuracy for standard ImageNet models [52, 17]. On the other hand increasing dimension for fixed radius makes the ℓ ∞ -threat model more powerful. To study which effect prevails, we test clean and ℓ ∞ -robust accuracy for each of our 2-step AT models from 'small' (300 epochs) and 'large' (250 epochs) in Table 2 when varying test time input resolution between 192 and 384. Note that all models have been trained on 224x224 images only, and no fine-tuning to different resolutions is done. Also, for ViTs we have to adapt the models via interpolation of the positional embedding as suggested by [4]. Fig. 3 shows that all classifiers obtain their highest robustness for image resolutions of 256 or 288, higher than the training one. For faster evaluation we use for this plot APGDT-DLR with 40 iterations and 3 target classes. Then, we select for each model the best input resolution, and evaluate ℓ ∞ -robustness with AutoAttack in Table 3. Increasing input resolution significantly improves clean and ℓ ∞ -robust accuracy. Our ConvNeXt-B + ConvStem attains SOTA 76.9% and 57.3% clean and ℓ ∞ -robust accuracy, respectively, at resolution 256. Additional results on the role of the input resolution can be found in App. D.5, including a discussion of what it means for threat models other than ℓ ∞ .

Varied perturbation strength. In Table 5, we test the effect of varying the test time resolution on the robustness in ℓ ∞ for radii other than 4 / 255 used for training (we use our ConvNeXt-B + ConvStem, with robustness evaluation via AutoAttack on the RobustBench ImageNet set). For all radii ϵ ∞ , the best resolution is either 256 or 288, that is larger than the training resolution of 224, which supports

the results above. Unlike for the smaller radii, at ϵ ∞ = 8 / 255 the robust accuracy at both resolutions 288 and 320 is worse than at 224. This suggests that there are diminishing returns for higher radii. The attack strength increases more quickly with the perturbation budget at higher resolution than the improvements in clean accuracy. While for the ℓ ∞ -threat model the comparison across different image resolutions can be done directly, the comparison for the ℓ 2 -threat model is more subtle and we discuss potential ways to do this in App. D.5. If one keeps the perturbation budget per pixel constant, that means increasing ϵ 2 linearly with the image resolution, then the gains in ℓ 2 -robustness are marginal.

Fine-tuning to larger radius. While ϵ = 4 / 255 is the standard radius for the ℓ ∞ -threat model on ImageNet, even larger perturbations might still be imperceptible. [14] train XCiTs with ϵ = 8 / 255 from scratch for 110 epochs. However, given the success of using a warm start for adversarial training (see Sec. 4.1), we propose to fine-tune the model fully trained for robustness at ϵ = 4 / 255 with adversarial training with the larger radius. Such classifiers already have non-trivial robustness at ϵ = 8 / 255 , and we expect they require only relatively small changes to adapt to the larger radius. We use our models from Table 2 to fine-tune for 25 epochs (details in App. A.5), and report the results in Table 4: our ConvNeXt-B + ConvStem improves significantly over the previous best result both in terms of clean and robust accuracy, even though we just use relatively short fine-tuning.

Fine-tuning to other datasets. We fine-tune our models trained to be robust at radius 8 / 255 from Table 4 to other datasets and compare to the results of [14] in Table 6. For Flowers-102 (resolution 224 × 224 ) the improvement over XCiT in robust accuracy is similar to the difference of the models in Table 4 and shows that the benefits of more robust models transfer to smaller datasets. For CIFAR (resolution 32 × 32 ) our models tend to achieve similar robustness as the XCiT models but at a much better clean accuracy. We expect that here even stronger robustness gains are possible by further optimizing the fine-tuning. For details on the fine-tuning setup see App. D.6.

7 Conclusion

We have examined two extreme representatives of today's modern architectures for image classification, ViT and ConvNeXt, regarding adversarial robustness. We have shown that ConvNeXt + ConvStem yields SOTA ℓ ∞ -robust accuracy as well as good generalization to unseen threat models such as ℓ 1 and ℓ 2 across a range of parameters and FLOPs. Given that for smaller model sizes the ConvNeXt + ConvStem is much easier to train than the ViT, it has the potential to become similarly popular for studying adversarial robustness on ImageNet like (Wide)-ResNets for CIFAR-10. On the other hand ViT + ConvStem excels in generalization to unseen threat models. Thus there is no clear winner between ViT and ConvNeXt. Given that ImageNet backbones are used in several other tasks, we think that our robust ImageNet models could boost robustness also in these domains. One such example is our recent work in robust semantic segmentation [11]. Another interesting open question is why the ConvStem leads to such a boost in generalization to ℓ 1 - and ℓ 2 -threat models.

Limitations. Given the extensive set of experiments already presented in this work and our limited computational resources, we were unable to include other modern architectures. Hence, even though we cover quite diverse architectures, we do not cover all modern architectures for ImageNet.

Broader Impact. As this work studies the robustness of deep neural networks to adversaries, we do not see any potential negative impact of our work. Instead, our work could help make modern deep models robust and safer to deploy.

References

Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: a query-efficient black-box adversarial attack via random search. In ECCV , 2020.

Yutong Bai, Jieru Mei, Alan Yuille, and Cihang Xie. Are transformers more robust than CNNs? In NeurIPS , 2021.

Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C Duchi, and Percy S Liang. Unlabeled data improves adversarial robustness. In NeurIPS , 2019.

Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and Armand Joulin. Emerging properties in self-supervised vision transformers. In ICCV , 2021.

Tianlong Chen, Sijia Liu, Shiyu Chang, Yu Cheng, Lisa Amini, and Zhangyang Wang. Adversarial robustness: From self-supervised pre-training to fine-tuning. In CVPR , 2020.

Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: a standardized adversarial robustness benchmark. In NeurIPS Datasets and Benchmarks Track , 2021.

Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with a fast adaptive boundary attack. In ICML , 2020.

Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In ICML , 2020.

Francesco Croce and Matthias Hein. Mind the box: l 1 -apgd for sparse adversarial attacks on image classifiers. In ICML , 2021.

Francesco Croce and Matthias Hein. Adversarial robustness against multiple and single l p -threat models via quick fine-tuning of robust classifiers. In ICML , 2022.

Francesco Croce, Naman D Singh, and Matthias Hein. Robust semantic segmentation: Strong adversarial attacks and fast training of robust models. arXiv preprint, arXiv:2306.12941 , 2023.

Ekin D Cubuk, Barret Zoph, Jonathon Shlens, and Quoc V Le. Randaugment: Practical automated data augmentation with a reduced search space. In CVPR , 2020.

Zihang Dai, Hanxiao Liu, Quoc V. Le, and Mingxing Tan. Coatnet: Marrying convolution and attention for all data sizes. In NeurIPS , 2021.

Edoardo Debenedetti, Vikash Sehwag, and Prateek Mittal. A light recipe to train robust vision transformers. In First IEEE Conference on Secure and Trustworthy Machine Learning , 2023.

Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In CVPR , 2009.

Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. In ICLR , 2021.

Alaaeldin El-Nouby, Hugo Touvron, Mathilde Caron, Piotr Bojanowski, Matthijs Douze, Armand Joulin, Ivan Laptev, Natalia Neverova, Gabriel Synnaeve, Jakob Verbeek, et al. Xcit: Cross-covariance image transformers. In NeurIPS , 2021.

Yonggan Fu, Shunyao Zhang, Shang Wu, Cheng Wan, and Yingyan Lin. Patch-fool: Are vision transformers always robust against adversarial perturbations? In ICLR , 2022.

Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03593v2 , 2020.

Sven Gowal, Sylvestre-Alvise Rebuffi, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy Mann. Improving robustness using generated data. In NeurIPS , 2021.

Jindong Gu, Volker Tresp, and Yao Qin. Are vision transformers robust to patch perturbations? In ECCV , 2022.

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In ECCV , 2016.

Dan Hendrycks and Kevin Gimpel. Gaussian error linear units (gelus). arXiv preprint arXiv:1606.08415 , 2016.

Dan Hendrycks, Kimin Lee, and Mantas Mazeika. Using pre-training can improve model robustness and uncertainty. In ICML , 2019.

Jeremy Howard. Imagenette.

Hanxun Huang, Yisen Wang, Sarah Erfani, Quanquan Gu, James Bailey, and Xingjun Ma. Exploring architectural ingredients of adversarially robust deep neural networks. In NeurIPS , 2021.

Ahmadreza Jeddi, Mohammad Javad Shafiee, and Alexander Wong. A simple fine-tuning is all you need: Towards robust deep learning via adversarial fine-tuning. arXiv preprint, arXiv:2012.13628 , 2020.

Daniel Kang, Yi Sun, Dan Hendrycks, Tom Brown, and Jacob Steinhardt. Testing robustness against unforeseen adversaries. arXiv preprint arXiv:1908.08016 , 2019.

Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.

Cassidy Laidlaw, Sahil Singla, and Soheil Feizi. Perceptual adversarial robustness: Defense against unseen threat models. In ICLR , 2021.

Lin Li and Michael W Spratling. Data augmentation alone can improve adversarial training. In ICLR , 2023.

Chang Liu, Yinpeng Dong, Wenzhao Xiang, Xiao Yang, Hang Su, Jun Zhu, Yuefeng Chen, Yuan He, Hui Xue, and Shibao Zheng. A comprehensive study on robustness of image classification models: Benchmarking and rethinking. arXiv preprint, arXiv:2302.14301 , 2023.

Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In ICCV , 2021.

Zhuang Liu, Hanzi Mao, Chao-Yuan Wu, Christoph Feichtenhofer, Trevor Darrell, and Saining Xie. A convnet for the 2020s. In CVPR , 2022.

Ilya Loshchilov and Frank Hutter. Decoupled weight decay regularization. In ICLR , 2018.

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR , 2018.

Xiaofeng Mao, Yuefeng Chen, Xiaodan Li, Gege Qi, Ranjie Duan, Rong Zhang, and Hui Xue. Easyrobust: A comprehensive and easy-to-use toolkit for robust computer vision. https: //github.com/alibaba/easyrobust , 2022.

Yichuan Mo, Dongxian Wu, Yifei Wang, Yiwen Guo, and Yisen Wang. When adversarial training meets vision transformers: Recipes from training to architecture. In NeurIPS , 2022.

Maria-Elena Nilsback and Andrew Zisserman. Automated flower classification over a large number of classes. In Indian Conference on Computer Vision, Graphics and Image Processing , 2008.

Tianyu Pang, Min Lin, Xiao Yang, Junyi Zhu, and Shuicheng Yan. Robustness and accuracy could be reconcilable by (proper) definition. In ICML , 2022.

Tianyu Pang, Xiao Yang, Yinpeng Dong, Hang Su, and Jun Zhu. Bag of tricks for adversarial training. In ICLR , 2021.

ShengYun Peng, Weilin Xu, Cory Cornelius, Kevin Li, Rahul Duggal, Duen Horng Chau, and Jason Martin. Robarch: Designing robust architectures against adversarial attacks. arXiv preprint arXiv:2301.03110 , 2023.

Rahul Rade and Seyed-Mohsen Moosavi-Dezfooli. Reducing excessive margin to achieve a better accuracy vs. robustness trade-off. In ICLR , 2022.

Sylvestre-Alvise Rebuffi, Francesco Croce, and Sven Gowal. Revisiting adapters with adversarial training. In ICLR , 2023.

Sylvestre-Alvise Rebuffi, Sven Gowal, Dan A. Calian, Florian Stimberg, Olivia Wiles, and Timothy Mann. Data augmentation can improve robustness. In NeurIPS , 2021.

Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adversarially robust imagenet models transfer better? In NeurIPS , 2020.

Mingxing Tan and Quoc Le. Efficientnetv2: Smaller models and faster training. In ICML , 2021.

Shiyu Tang, Siyuan Liang, Ruihao Gong, Aishan Liu, Xianglong Liu, and Dacheng Tao. Exploring the relationship between architecture and adversarially robust generalization. arXiv preprint arXiv:2209.14105 , 2022.

Ilya O Tolstikhin, Neil Houlsby, Alexander Kolesnikov, Lucas Beyer, Xiaohua Zhai, Thomas Unterthiner, Jessica Yung, Andreas Steiner, Daniel Keysers, Jakob Uszkoreit, et al. Mlp-mixer: An all-mlp architecture for vision. In NeurIPS , 2021.

Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data-efficient image transformers & distillation through attention. In ICML , 2021.

Hugo Touvron, Matthieu Cord, and Hervé Jégou. Deit iii: Revenge of the vit. In ECCV , 2022.

Hugo Touvron, Andrea Vedaldi, Matthijs Douze, and Hervé Jégou. Fixing the train-test resolution discrepancy. In NeurIPS , 2019.

Florian Tramèr and Dan Boneh. Adversarial training and robustness for multiple perturbations. In NeurIPS , 2019.

Asher Trockman and J Zico Kolter. Patches are all you need? Transactions on Machine Learning Research , 2023.

Zhengzhong Tu, Hossein Talebi, Han Zhang, Feng Yang, Peyman Milanfar, Alan Bovik, and Yinxiao Li. Maxvit: Multi-axis vision transformer. In ECCV , 2022.

Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. In NeurIPS , 2017.

Wenhai Wang, Jifeng Dai, Zhe Chen, Zhenhang Huang, Zhiqi Li, Xizhou Zhu, Xiaowei Hu, Tong Lu, Lewei Lu, Hongsheng Li, et al. Internimage: Exploring large-scale vision foundation models with deformable convolutions. In CVPR , 2023.

Ross Wightman. Pytorch image models. https://github.com/rwightman/ pytorch-image-models , 2019.

Ross Wightman, Hugo Touvron, and Hervé Jégou. Resnet strikes back: An improved training procedure in timm. arXiv preprint arXiv:2110.00476 , 2021.

Boxi Wu, Jinghui Chen, Deng Cai, Xiaofei He, and Quanquan Gu. Do wider neural networks really help adversarial robustness? In NeurIPS , 2021.

Dongxian Wu, Shu-tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. In NeurIPS , 2020.

Tete Xiao, Mannat Singh, Eric Mintun, Trevor Darrell, Piotr Dollár, and Ross Girshick. Early convolutions help transformers see better. In NeurIPS , 2021.

Cihang Xie, Mingxing Tan, Boqing Gong, Alan Yuille, and Quoc V Le. Smooth adversarial training. arXiv preprint arXiv:2006.14536 , 2020.

Weihao Yu, Mi Luo, Pan Zhou, Chenyang Si, Yichen Zhou, Xinchao Wang, Jiashi Feng, and Shuicheng Yan. Metaformer is actually what you need for vision. In CVPR , 2022.

Sangdoo Yun, Dongyoon Han, Seong Joon Oh, Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. Cutmix: Regularization strategy to train strong classifiers with localizable features. In CVPR , 2019.

Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML , 2019.

Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. In ICLR , 2018.

Zhun Zhong, Liang Zheng, Guoliang Kang, Shaozi Li, and Yi Yang. Random erasing data augmentation. In AAAI , 2020.

Contents of the Appendix

Appendix A . . . Experimental details (training parameters, etc.).

Appendix B . . . Experiments specifically related to ConvStem.

Appendix C . . . Cost, design-choice comparisons and testing more architectures.

Appendix D . . . Ablations on training setup and image resolution experiments.

A Experimental Details

In the following we provide the details relative to the setup used for the various experiments. First, we describe the general setup (App. A.1), then detail the variations for different settings, if they differ from the main regime.

A.1 General experimental setup

In all the experiments on ImageNet [15], unless stated otherwise, we use training parameters similar to [44]. All models are trained with AdamW [35] as optimizer with a cosine decay scheduler for the learning rate (LR), weight decay of 5e-2 and momenta terms β 1 and β 2 set to 0.9 and 0.95 respectively. We employ a peak LR of 1e-3 (chosen to be in the same range as the values of the original ConvNeXt [34] and DeiT [51] works), slightly higher than [44]. When training for 50 or 100 epochs the peak LR is attained at epoch 10, when using 250 or 300 epochs at epoch 20. We also use label smoothing coefficient of 0.1 and exponential moving average (EMA) with decay rate 0.999. For the inner maximization in adversarial training we use 2-step APGD [8] with an ℓ ∞ radius of 4 / 255 and cross entropy as objective function.

Computational expense. All the training runs were conducted on a multi-GPU (8) setup using NVIDIA A100s with 40GB memory. Around 20,000 hours of single-GPU run-time was expended during this work.

ConvStem models clean training. All the models with ConvStem (barring the one in 'random init., basic augment.' row in Table 1) were normally (non-adversarially) trained for 100 epochs with the non-ConvStem part of the model initialized with ImageNet-1k pre-trained weights from timm . Heavy augmentations (App. A.2) were used for this pre-training. For 'medium' and 'large' category models in Table 2, we only did standard training for 50 epochs to save computational load given the network size, still achieving similar clean performance as their non-ConvStem counterparts initialized with weights from timm (see Table 10). The checkpoint with highest accuracy was then used as the starting point for adversarial training. The specific timm configuration for pre-trained weights for every model is available in Table 18.

Robustness evaluation. Unless stated otherwise, all robustness evaluations are done using complete standard AutoAttack [8, 9] (includes 4 different attacks) on the complete ImageNet validation set (5k points) from RobustBench [6]. As is the common practice, we do the best (most robust) checkpoint selection in a post-hoc fashion using 1-step APGD on a separate validation set of 4k ImageNet-1k images. Note that we use a validation set disjoint from the RobustBench ImageNet test set.

Calculation of model size. We compute the number of FLOPs and parameters using the fvcore 2 library. In further sections, we again differentiate models as 'small' ( < 30M parameters), 'medium' ( ≈ 50M params) and 'large' ( ≥ 80M params) depending on their parametric size.

A.2 Pre-training, augmentations and longer training

For the first three rows in 'Training Scheme' column in Table 1 we do 50 epoch adversarial training. For the specific cases of the 'Training Scheme' column, we have the following settings (the list is incremental):

random init., basic augment. It has random initialized weights with RandomCrop as augmentation.

+ strong clean pre-training. Adversarial training is initialized with ImageNet-1k pre-trained weights from timm with RandomCrop as augmentation.

+ heavy augmentations. It uses the augmentations similar to [34], including CutMix [65], MixUp [67] with strength 0.8, RandAugment [12] with two layers, magnitude 9 and a random probability of 0.5. Label smoothing is set to 0.1, Exponential Moving Average (EMA) with factor 0.999 and random erasing with probability 0.25. Unlike [34], we do not use any stochastic depth.

50 → 300 epochs. We adversarially train for 300 epochs instead of 50 and peak LR is achieved at epoch 20.

The two Isotropic ConvNeXt models in Table 1 use the pre-trained weights from the original repository 3 as these are not available on timm .

A.3 Scaling-up and comparison to SOTA models

For the results in Sec. 5, all our runs were initialized with ImageNet-1k pre-trained weights and use the heavy augmentations protocol from the previous section. Adversarial training was done with 2-step APGD for either for 50, 250 or 300 epochs (as listed in the 'Epochs' column in Table 2). For all 'ours' models in Table 2 in 'small' category the effective batch size was 1392, for 'medium' it was 1024. In 'large' category, all ViT-B and ConvNeXt-B models have an effective batch size of 864 and 756 respectively. Unlike for 'small' models, in 'medium' and 'large' category the checkpoint selection is done using 10-step APGDCE attack (first attack in AutoAttack), since 1-step APGDCE returns several checkpoints in a very small numerical range of robustness values.

A.4 Increasing test-time resolution

When using image resolution other than 224x224, we keep the same pre-processing, only resolution is changed. For final resolution NS (new size) and scale-ratio (SR) 0.875 (same as during training), the images are resized with bicubic interpolation to NS/SR and then a center crop to NS is done. Note that we do not fine-tune the models with higher resolution images.

A.5 Fine-tuning to larger radius

Fine-tuning to larger radii (Sec. 6) uses our ViT-S + ConvStem, ConvNeXt-T + ConvStem and 50 epochs ConvNeXt-B + ConvStem models from Table 2 as initialization. We employ the standard setting with heavy augmentations and adversarially train for 25 epochs at the ℓ ∞ radius of 8 / 255 with a peak LR of 1e-4 attained at epoch 5.

B Design Choices for ConvStem

In this section, we give a detailed account of how ConvStem can be designed for different architectures and how it affects model size (FLOPs, parameters) and robustness. All the ConvStem configurations discussed below had the non-ConvStem part of the model initialized with pre-trained ImageNet1k weights and the ConvStem with random initialization. This setup was chosen to manage the computation load. Afterwards, for the best configurations selected, we clean trained the model with ConvStem before training them adversarially.

B.1 A closer look at the convolutional stem

We here investigate which elements of the convolutional stem are most relevant for better robustness of ConvNeXt-T to unseen threat models. Standard ConvNeXt has a 4x4 convolution in the initial stem (see Fig. 2, right column) that downsamples the input resolution by 4 with non-overlapping patches. This means any possible ConvStem design is limited to a maximum of two downsampling operations. Further, to constrain the increase in parameters and FLOPs we limit our choices to the configurations in Table 7, where we also report the corresponding results. We start off with the standard PatchStem from [34] (Conv 4,4 , L), with L indicating LayerNorm and G a GELU layer. In (Conv 7,4 , L, G), we increase the kernel size from PatchStem which results in mixing of feature maps,

but this change does not yield any dividends in any of the metrics. Now we add another layer in our convolution stem. From (Conv 7,2 , L,G - Conv 3,2 , L, G) we keep the kernel size in the first layer 7 and vary the stride in second layer depending on the amount of downsampling required to match the standard ConvNeXt. For all these settings we do not see any improvement in ℓ 2 and ℓ 1 robustness but there are some gains in ℓ ∞ robustness. This increase in ℓ ∞ can be attributed to an increase in FLOPs. However, when trained with a good clean trained models as initialization, all these setting have a very similar ℓ ∞ robustness. As next step, we reduce the kernel size in the first layer to 5 in configuration (Conv 5,2 , L,G - Conv 3,2 , L,G), which leads to gains across all metrics, and reducing the kernel size to 3 yields further improvements in unseen threat models ( ℓ 2 and ℓ 1 ). Since these last two configurations look very promising, we trained clean models with such architectures to a similar level of clean performance and used them as initialization for adversarial training: we observed negligible difference across all metrics. Given (Conv 3,2 , L,G - Conv 3,2 , L,G) has lower FLOPs of the two we select this configuration as main design for ConvStem. From Table 14, this configuration only leads to 2.9% and 0.1% increase in FLOPs and parameters respectively.

Additionally, for ConvNeXt-B we use the same stem as ConvNeXt-T and it slightly improved ℓ 2 and ℓ 1 robustness without improving ℓ ∞ robustness. We also found that adding an extra layer to this stem improved the ℓ 2 and ℓ 1 numbers (see Table 8) with a negligible increase in FLOPs and parameters. As this is a large model, an ablation similar to the one for ConvNeXt-T was not feasible. In the end, we use C2 (from Table 8) as ConvStem for our ConvNeXt-B models. From Table 14, this ConvStem increases the FLOPs by around 4% and the parameters by only 0.2%.

B.2 ViT ConvStem

We here study various designs of ConvStem on ViT-S (to keep the computational load low). We recall that for ViT the standard PatchStem generates 16x16 patches, which means we have a higher degree of freedom as to how the ConvStem can be designed compared to ConvNeXt (while keeping the increase in FLOPs from the standard model minimal).

In Table 9, we start off with the ConvStem as proposed by [62]: this configuration (C1) results in a 8.1% increase in FLOPs but the improvement in all metrics tested is quite significant. Now we limit the increase in FLOPs to this value and try several other configurations within this limit. Two

ways to change the configuration are most trivially feasible here: 1) reducing the number of output channels in each convolution layer and 2) changing the level of downsampling done in each layer. As the combination of these two changes most readily leads to the change in FLOPs, we only apply these two kind of changes in our ablation study. Starting from C1, we first reduce the number of output channels in each layer, since the input to the transformer block is 8N (the last layer's output channels cannot be changed). Both C2 and C3 lead to significant reduction in ℓ ∞ numbers, hence we shift towards changing the amount of downsampling in each layer. Moving more downsampling to earlier layers further reduces ℓ ∞ robustness compared to C1. This small ablation leads us to fix the ConvStem for ViT-S to configuration C1. From Table 14, the increase in FLOPs is only 8.1% and parameters increase by 3.3%.

We use the same ConvStem as ViT-S with final layers output channels scaled to 16 N to meet the input channel for transformer block in ViT-B. This only increases the FLOPs by 2% and parameters by a mere 0.6%. Similarly for our ViT-M, we again use the same ConvStem as ViT-S with last layer's output size set to 512.

Improvements in robustness with ConvStem. Our experiments throughout the paper, validate that a minimal change in the network architectures, adding the ConvStem provides consistent improvements in robustness of the adversarially trained models. Fig. 4 summarises this and shows how across network types the classifiers with ConvStem achieve better robustness in both seen ( ℓ ∞ ) and unseen ( ℓ 2 ) threat models.

ViT-S

ConvNeXt-T

ViT-B

ConvNeXt-B

30

35

40

45

50

55

Robust accuracy (%)

+4.8

+1.0

+2.6

+0.1

robustness

ViT-S

ConvNeXt-T

ViT-B

ConvNeXt-B

+9.8

+9.7

+2.3

+1.9

2 robustness

W/o ConvStem

With ConvStem

B.3 Clean performance of ConvStem models

Our ConvStem models from Sec. 4 onward always use a standard classifier as initialization for adversarial training. This clean training was done either for 50 or 100 epochs depending on the size of the model, see Table 10. The non-ConvStem part of the model (ConvNeXt stages and all transformer blocks) were initialized with timm ImageNet-1k pre-trained weights and the ConvStem was randomly initialized. In Table 10, we show that for all models we were able to reach within 1% of clean performance of standard models on the RobustBench validation set. Certainly, initialization of non-ConvStem part helps in this fast and efficient learning. The good clean accuracy via short training also corroborates the improved training hypothesis of [62] when using ConvStem instead of a PatchStem without much hyperparameter tuning.

C Design choices, cost/size comparisons and new architectures

In this section, we answer (i) How the total training cost of our training regime compares to existing works (ii) What is the effect of using different optimizer for adversarial training (iii) Do the improvements as seen by adding ConvStem hold for the most recent architectures (iv) How does the model size change on adding ConvStem.

C.1 Training cost comparison

Table 11 shows the robustness in the seen ℓ ∞ threat model of ConvNeXt-T model trained with strong clean pre-trained initialization and heavy augmentations when varying training cost. In particular, the training scheme cost is approximated by the number of passes of the network for each training image (counting the number of forward+backward passes per image combines the number of attack steps with training epochs used). First, we show that our ConvNeXt-T with 150 passes/images attains 2.1% higher robustness (46.1% vs 44.4%) than the same model trained with 220 passes/image by [14]. Moreover, adding the ConvStem achieves a similar result with only 100 passes/image (third row), and 47.5% robust accuracy with 150 passes/image (fourth row). Finally, increasing the number of epochs and training steps, which incurs in more expensive training, can further improve robustness.

C.2 APGD vs. PGD training

The optimizer for adversarial training is also a design choice to be considered while training robust models. Prior works [14, 46] mostly use either PGD [36] or APGD [8]. We use APGD since it has been shown to generally outperform PGD and does not need parameter tuning when changing radius or attack steps [8]. Additionally, in Table 12 we train a ConvNeXt-T with 2-step PGD (clean pre-training, heavy augmentations, 50 epochs), comparable to the classifier using 2-step APGD from Tables 1 and 2. In this regime APGD yields higher robustness in the seen ( ℓ ∞ ) threat model which is our main goal, although with a small loss in clean accuracy.

C.3 Testing more architectures

We further test the effect of different stem designs on InternImage [57], a modern architecture that uses deformable convolutions and has a ConvStem as its stem. In Table 13, we replace the ConvStem with a PatchStem and evaluate robustness for the seen ( ℓ ∞ ) and unseen ( ℓ 2 , ℓ 1 ) threat models. The structure of the PatchStem (PS) is the same as for ConvNeXt. For the PS model, we initialize the PS randomly and do clean pre-training for 50 epochs to reach 82.8% clean accuracy (the original InternImage with ConvStem has 83.5%). Similar to ViT and ConvNeXt, we see that robustness for the unseen threat models goes down when replacing the ConvStem with the PatchStem. The models were adversarially (2-step APGD) trained for 50 epochs with ImageNet-1k clean trained model 4 as initialization and with the heavy augmentation regime, while other parameter setting were kept same as heavy augmentations in App. A.2.

C.4 Increase in paramaters/FLOPs

In Table 14, we list the number of parameters and FLOPs of all models, with the percentage increase on adding the ConvStem shown in red: for all models adding ConvStem results in a marginal amount of extra parameters. For FLOPs, smaller ViTs have a bigger increase as compared to ConvNeXt. This can be attributed to the bigger size of ConvStem we use for ViT as we need to downsample before the first transformer block more severely than for ConvNeXt.

D More on Robust ImageNet Models

As the main aim of our work is to study and improve robustness of models trained for ImageNet to seen and unseen threat models, in this section we consider ablations (effect of clean pre-traininig, data augmentations, weight-decay and label smoothing) related to this. Moreover, we provide more details about using robust ImageNet for fine-tuning to other datasets.

D.1 Using even better pre-training

The most robust models in our work use ImageNet-1k pre-trained weights of the respective architectures from timm . A natural hypothesis is that a better pre-trained model, namely an ImageNet-21k pre-trained model fine-tuned on ImageNet-1k, might lead to higher robustness. timm makes available for architectures considered in this work (ViT, ConvNeXt) 21k-pretrained, 1k-fine-tuned weights as well. In Table 15, we see the effect of using 21k-pretrained weights as initialization for adversarial training. The increase and decrease in clean accuracy and ℓ ∞ robust accuracy as compared to the 1k-pre-trained initialization of the same models is shown in green and red respectively.

The ConvNeXt-T trained for 50 epochs shows a small increase in ℓ ∞ , while the one trained for 300 epochs gets slightly lower robustness. For ViT-B with 50 epochs we see a drop of 0.4% in robust accuracy although clean accuracy goes up by 0.2% (which is intuitively correct as adversarial training starts from a better point with 21k-pre-trained weights). Overall we did not see any sign of gains in robustness when using a model pre-trained on a larger dataset. This finding is line with what [38] witnessed when using ImageNet-1k and 21k as initialization while training robust models for CIFAR-10.

D.2 Ablating data augmentation components.

A complete ablation study of which augmentations are useful for adversarial training on ImageNet is beyond the scope of this paper. The results of Table 1 suggest that heavy augmentations works better than the basic augmentation (random crop). In this section we test additionally the intermediate augmentation suggested in [14] called 3-aug (basic + radom horizontal flip + color-jitter), in particular we are interested in the performance of the ConvStem models and the generalization beyond the ℓ ∞ -threat model used for training. In Table 16 we show for two models, ViT-S + ConvStem and ConvNeXt-T + ConvStem, each trained for 50 epochs the results of basic, 3-Aug [14] and heavy augmentation. Note, that the clean pre-trained model was trained with the heavy augmentations protocol. We can see that using heavy augmentation yields the best robustness across all threat models for the ConvNeXt-T+ConvStem ( +2 . 2% in ℓ ∞ -robustness) while having slightly worse clean accuracy ( -1 . 1% ). For the ViT-S+ConvStem the results are mixed, basic augmentation performs best, heavy augmentation is second and 3-Aug the worst of all three. However, the gap between basic and heavy augmentation is marginal and thus we stick to heavy augmentation throughout the paper. It is an interesting open question if there exist intermediate or completely different augmentation schemes which would yield improved robustness for ImageNet. A more detailed analysis for the effects of data augmentation on adversarial robustness for small resolution datasets like CIFAR-10 or SVHN can be found in [31].

D.3 Effect of weight decay and label smoothing on adversarial robustness

For our training scheme which already yields strong results (50 epochs of adversarial training with strong pre-training and strong augmentation), we test the effect of varying the weight decay and label smoothing parameters. We check on a logarithmic scale other weight decay values than our default value 0.05. In Table 17, we see that for both ViT and ConvNeXt neither smaller nor larger weight decay yields any improvement. Moreover, we observe that the label smoothing parameter has, compared to weight decay, less influence on the final robustness. For the ViT we get a small improvement of 0 . 2% when using label smoothing coefficient 0.2 compared to our default value of 0.1, while for the ConvNeXt the results get 0 . 2% worse for label smoothing coefficient 0.2. Then, we decided to keep a label smoothing coefficient of 0.1. Finally, we note that a weight decay of 0.05 and label smoothing 0.1 are the values used for clean training of the ConvNeXt in [34].

D.4 Clean and robust accuracy trade-off

Fig. 5 shows the clean vs robust accuracy trade-off for ImageNet models. In the 'small' size category, our models, i.e. ViT-S-ConvStem (black circle) and ConvNeXt-T-ConvStem (red circle), have the best clean accuracy except for XCiT-S of [14], which however has more than 7% worse robust accuracy. In 'medium' size category our models were only trained for 50 epochs (see Table 2) but outperform all SOTA models in terms of robust accuracy. On top of that, our ConvNeXt-S-ConvStem has both the best clean and robust accuracy in this size range. For 'large' sized models only the ViT-B of [44] is in a comparable range. Their model has around 0.6% higher clean accuracy than our ConvNeXt-B-ConvStem but 2.6% lower robust accuracy. In general, our models mostly show a better clean vs robust accuracy trade-off as compared to existing models in literature.

65

67

69

71

73

75

77

Clean accuracy (%)

28

32

36

40

44

48

52

56

/lscript

∞

Robust accuracy (%)

ConvNext-T-CvSt

ViT-B-CvSt

ConvNeXt-B-CvSt

ConvNeXt-S-CvSt

ViT-M-CvSt

ResNet-50

ViT-S

XCiT-S

XciT-L

ConvNext-T

ViT-B

WRN-50-2

RobArch-S

RobArch-L

ConvNeXt (ours)

ViT (ours)

SOTA models

GFLOPs (range)

4 - 7

8 - 12

16+

D.5 Increased image resolution

We further discuss the effect of varying the test-time resolution for ℓ ∞ robust models. All evaluations in the following are done with APGDT-DLR (40 iteration, 3 target classes) on 1000 test points to limit computational cost, as increasing resolution significantly impacts the number of FLOPs.

Larger models. Similar to 'small' models, 'large' models trained for 50 epochs also show improvements in both clean accuracy and ℓ ∞ robustness, see Fig. 6. This phenomenon is seen for both ViT and ConvNeXt with and without ConvStem, with peak robustness at resolution 256x256 for all classifiers.

ℓ 2 radius scales with resolution. Since ℓ ∞ bounds are applied element-wise, increasing the resolution, i.e. the input dimension, does not change how much each input component can be modified. Thus one can argue that for fixed radius, the ℓ ∞ -threat model is for increasing resolution/dimension at least as strong as the original one. In fact, as each dimension can be manipulated independently one can argue that increasing dimension makes the ℓ ∞ -threat model more powerful. However, with a bound ϵ 2 w.r.t. ℓ 2 and input dimension d , the average element-wise perturbation is ϵ 2 / √ d . If one keeps the ϵ 2 constant for increasing dimension, it seems clear that the threat model becomes weaker.

192

224

256

288

320

352

384

input resolution

70

71

72

73

74

75

76

77

clean accuracy

ViT-B

ConvNeXt-B

ViT-B + ConvStem

ConvNeXt-B + ConvStem

192

224

256

288

320

352

384

input resolution

46

48

50

52

54

56

robustness

192

224

256

288

320

352

384

input resolution

45

50

55

60

65

70

75

clean accuracy

ConvNeXt-T

ConvNeXt-T + ConvStem

Isotropic CN-T

Isotropic CN-T + ConvStem

ViT-S

ViT-S + ConvStem

192

224

256

288

320

352

384

input resolution

15

20

25

30

35

40

45

50

1.71

2.00

2.29

2.57

2.86

3.14

3.43

2 robustness

In order to keep the perturbation budget per dimension constant we thus increase ϵ 2 as a function of √ d . Note however that when increasing ϵ 2 the maximal perturbation per pixel or the number of pixels which can be maximally perturbed grows as well. Thus one can argue that the threat model becomes stronger when scaling with √ d when increasing d . In summary, we see that the comparison across image resolutions for ℓ 2 (and similarly for ℓ 1 ) is non-trivial. We decided to consider the scenario where the ℓ 2 -treat model is at least not becoming less powerful with increasing dimension and thus increase ϵ 2 with √ d . The resulting ℓ 2 -robust accuracies for varying resolution can be found in Fig. 7, where we see that the ConvStem- models are very stable in robust accuracy even for much higher resolution.

D.6 Fine-tuning to other datasets

We study whether it is possible to transfer adversarial robustness from ImageNet to other datasets via fine-tuning our robust models. We consider datasets with images of resolution either similar to ImageNet, i.e. Flowers-102 [39], or smaller like CIFAR-10 and CIFAR-100 [29], and fine-tune the ϵ ∞ = 8 / 255 robust models from Table 4. We fine-tune with 2 steps (Flowers-102) or 10 steps (CIFAR-10, CIFAR-100) adversarial training at ϵ = 8 / 255 on all target datasets, with RandAug as augmentation, for 20 epochs, as in [14], with learning rate (LR) warm-up of 2 epochs: for Flowers102 we set peak LR to 4e-3, a weight decay of 5e-3 and batch size 30, for CIFAR-100 peak LR is 2e-4, weight decay 0 and batch size 1024, for CIFAR-100 peak LR is 2e-4, weight decay 5e-3 and batch size 256. To adapt the networks to the new datasets, we replace the final linear classifier with one suitable for the new number of classes, and for smaller resolution inputs, we change from ConvNeXt + ConvStem the strides from 2 to 1 in the convolutional layers of the stem and in the first downsampling block in ConvNeXt. The robust accuracy is computed on the full test sets with AutoAttack in the resolution of the dataset to which we finetune, e.g. 32 × 32 for CIFAR-10/100.

D.7 More pre-training details

In this section we give some additional details related to our models. As we heavily rely on pretraining in our work, the origin of pre-trained models on timm are listed in Table 18. Most ViTs and ConvNeXts available at timm have different versions (patch sizes, resolutions) and even pre-training (ImageNet-21k, -12k, -1k). Among those we use ViTs with patch size 16 trained at resolution of 224 on ImageNet-1k only. Similarly, for ConvNeXt we use the ones trained only with ImageNet-1k and resolution 224. For ViT-M, we use pre-trained weights of a DeiT-3 model from [51], because ViT-M was not available in our desired configuration of ImageNet-1k only pre-training. Note that ViT and DeiTs have the same architecture and differ only in the training scheme. All the clean pre-trained models use heavy augmentations protocol except ViT-M (DeiT-3-M) which uses only 3 augmentations. Finally, for Isotropic ConvNeXt-S we use the weights of convnext_iso_small_1k_224_ema from the original repository.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis work investigates the effect of a set of architectural, training and inference techniques on adversarial training (AT) on ImageNet. AT has been less studied on ImageNet compared to CIFAR10 due to the much computational cost, but the behavior of AT on large-scale realistic dataset is undoubtedly an important topic, so I appreciate a lot the authors’ efforts on this direction. In my understanding, the key takeaway techniques suggested by the paper for improving robustness on ImageNet are ConvStem, pre-training followed by heavy data augmentation, training longer and increasing resolution at inference time. To me, the first and fourth points are novel, while the second and third points are somehow expected. My biggest concern is the lack of explanation behind these empirical observations like why ConvStem works and the generalization abilities of these tricks particularly across various architectures and AT methods. The analysis and explanation are particularly important because none of these techniques is invented in this work, i.e., they are originally proposed by the previous works. Please see the details below. I will be happy to raise my scores if the above concerns are clarified or addressed.\n\nSTRENGTHS:\n1. Adversarial training on ImageNet is less studied and indeed an important direction for moving forward for the community \n\n2. Identifying a good receipt of AT on ImageNet can have a great potential impact on the future works, e.g., adopted as a standard training setting for benchmarking various AT methods. \n\n3. Robustness improvement of ConvStem on some architectures is significant \n\n4. The influence of test-time image resolution is interesting.\n\nWEAKNESSES:\n1. ConvStem seems to only work well with Isotropic architectures but work less well or even not work with ConvNeXt regarding the robustness evaluated against the same threat model as training’s, i.e., L inf. For example, it improves robustness by 0.5% on ConvNeXt-T with basic training setting (Table 1) and by 0.04% on ConvNeXt-B (Table 2). There is almost no improvement on ConvNeXt-B. Even worse, the accuracy seems to be sacrificed for improved robustness on ConvNeXt-B and in some settings of ConvNeXt-T like “+ heavy augmentation”. Therefore, I doubt the generalizability of ConvStem across the different architectures. It will be interesting to test if ConvStem can benefit robustness for other non-isotropic CNN-based architectures such as InternImage [1] which also uses ConvStem. \n\n2. I find almost no analysis about why ConvStem works well on Isotropic architectures and less well on others, why pre-training enables the use of heavy data augmentation, and why training longer works in this context but not in [2]. This is important for us to understand the accounts for the performance boost and to judge the generalization ability of the method, especially when the suggested techniques are originally proposed in the previous works.  \n\n3. A major benefit of ConvStem is the robustness towards the unseen threat models like L1 and L2. However, the discussion of and the comparison with the related works developed for this purpose (trained on L inf to defend L1 and L2) are missing, so it is hard for me to judge how significant the reported improvement is and if the improvement still holds when combined with other techniques. \n\n4. It is also unclear whether ConvStem can improve the SOTA AT methods like how it works with the baseline AT, or if not, whether ConvStem+baseline AT can beat the SOTA AT methods. All tested AT methods are APGD AT with only different steps: 1, 2, 3. \n\n[1] InternImage: Exploring Large-Scale Vision Foundation Models With Deformable Convolutions, CVPR 2023 \n\n[2] When Adversarial Training Meets Vision Transformers: Recipes from Training to Architecture, NeurIPS 2022\n\nQUESTIONS:\n1. L43: The claim of SOTA adversarial robustness on ImageNet may not be right. [1] (arxiv version: 28 Feb 2023) reported a robustness of 56.8% for ConvNeXt-B, while the highest robustness for ConvNeXt-B+ConvStem reported in this work is 56.28%. On RobustBench,  you both submitted a result for ConvNeXt-L: 58.48% from [1] and 57.70% from yours with ConvStem. Therefore, 56.28%, even 57.3% with inference-time resolution technique, seems to be not the state-of-the-art robustness against AA on ImageNet. \n\n2. Table 1: how many runs are repeated for the reported result? If more than one, why not report the standard deviation? \n\n3. L107: why APGD-2, instead of more common attacker PGD-2? \n\n4. L239-240: Have your single-step AT suffered from catastrophic overfitting? If not, did you apply any mitigation technique? \n\n5. Table 2: some implementation details of several related works like “comprehensive” and “light” are missing, so that I can’t judge if the performance difference is caused by, e.g., ConvStem or something else. I will suggest the authors clearly discuss the technical difference between these training receipts and yours, e.g., organized in a table. \n\n6. Section 4.2: how do you decide the specific data augmentation as the component of heavy data augmentation? Besides, it will be interesting to test how a recent data augmentation, IDBH, specific for AT works on ImageNet compared with others. \n\n7. Section 6, test-time image resolution: have you tried to evaluate the robustness using larger epsilon? I guess the robustness improvement will disappear in the setting with larger potential adversarial vulnerability. \n\n8. Table 2: the results of ViT-M and ConvNeXt-S without ConvStem are missing. Are there any reasons for this?\n\n[1] A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinking, Arxiv \n\n[3] A Light Recipe to Train Robust Vision Transformers, SaTML. \n\n[2] Data augmentation alone can improve adversarial training, ICLR 2023.\n\nLIMITATIONS:\nThe authors discussed the limitation as “not covering more architectures and architectural components”. There are still some limitations about the generalizability of ConvStem across the architectures and the AT methods as listed in Weakness.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-06-14"}

comments: SUMMARY:
The paper has done to some extent comprehensive experimental results to show the effect of ConvStem on improving the robustness of Vit and ConvNeSt model architectures.

STRENGTHS:
The experimental results are comprehensive for the proposed purpose.

WEAKNESSES:
There are still some parts that need more clarification;
1- I understand the paper took an experimental point of view to show the effectiveness of the module in improving robustness; however, it would be great to provide more intuition on how and what's the reason for this effect. 
2- I would expect a more comprehensive conclusion from the experiments and observations and the author's recommendations for practical applications. 
3- Authors mentioned there are "a number of interesting future research directions" but there is no explanation of what are those directions. 
4-

QUESTIONS:
Based on my understanding I still could not answer the questions below:
1- Do ViT architectures are more appropriate for robust or convolutional models? 
2- ConvStem had a negative effect on the clean accuracy of ConvNeXT architecture based on Table 2. How can this be explained? 
3-

LIMITATIONS:
As mentioned by the authors some of the well-known architectures have been missed because of computational complexity and this limited the final conclusion from experimental results.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-04

comments: SUMMARY:
This work studies adversarial training on large-scale datasets (i.e., ImageNet), which study the influence of architecture and training schemes on the robustness of classifiers based on different architectures. The paper lacks novelty, but the observations are insightful.
I think this work is a valuable contribution to the research on adversarial training.

STRENGTHS:
1  The paper presents a good review of the architectures training strategy and data augmentation, and presents the impact of varying each of them on adversarial robustness and clean accuracy

2 Based on experiments with different settings, the proposed method achieves the sota robustness.

WEAKNESSES:
1. The paper is less novel and more like an experimental analysis report.

2. The other weakness of this paper is that most of the results shown in the paper are quantitative. Lack of some theoretical analysis.

QUESTIONS:
1 In Table 2, the authors claim the proposed can improve by 5.8% for small, 7.2% for medium, and 2.8% for large models over SOTA.  How to compare and calculate to get this conclusion？ It is unclear.

2  Since Heavy Data Augmentation contains different data augmentation strategies, How do different strategies affect the robustness of the model?

LIMITATIONS:
Adversarial training on large-scale datasets requires a lot of computing resources, It is not easy to reproduce the experimental results in the paper.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-05

comments: SUMMARY:
This work provides extensive experiments to study the influence of architecture and training schemes on the robustness of classifiers to seen and unseen attacks. The paper investigated SOTA model architectures and it variants, and derives a strategy to build better architecture and training scheme to improve model robustness. With the help of all the explored variations, a SOTA robustness on ImageNet is achieved with the newly proposed scheme.

STRENGTHS:
This work makes interesting observation on the impacting factors of large-scale adversarial training with extensive experiments. The way the experiments are designed and conducted are solid, and can inspire future work along the direction of systematically understanding the influence of architecture and training scheme on robustness. The observed insights successfully leads to a better architecture and training scheme design that leads to SOTA robustness.

WEAKNESSES:
The main drawback of the work is the lack of theoretical analysis/insight on why some proposed techniques work. Without further insights this work is mainly an extensive ablation study within a design space of existing methods, but cannot infer on the performance for techniques beyond the scope of the emperical explorations. Given the high resource needed to exhaustively explore all architectural ingredients and training scheme design, some theortical insight derived from existing observation will be helpful to guide future exploration.

QUESTIONS:
See weakness.

LIMITATIONS:
The limitation of this work is adequately discussed. No potential negative impact is observed.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-05

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper investigates the impact of architectures and training strategies on adversarial robustness in adversarial training. The substitution of PatchStem with ConvStem leads to an improvement in adversarial robustness, not only against l_inf attacks but also against previously unseen attacks like l_1 and l_2 attacks. Furthermore, the effects of strong pre-training and extensive data augmentation on adversarial robustness have been examined through ablation studies.\n\nSTRENGTHS:\nThis paper extends the discussion of adversarial robustness to larger datasets and models, which is significant for the application of deep models. The paper explores one of the most effective methods, adversarial training, from various aspects such as model architecture and training techniques, to improve the adversarial robustness of the models. It proposes replacing PatchStem with ConvStem in the model architecture, resulting in enhanced robustness against l_inf adversarial attacks as well as significant improvements in robustness against unseen attacks, such as l_1 and l_2 attacks. Additionally, the paper validates the positive impact of pre-training and data augmentation in adversarial training. The final results also achieve state-of-the-art performance. The paper is well-structured and easy to understand.\n\nWEAKNESSES:\nThis paper has a relatively weak innovation aspect, and a significant portion of the experiments leans towards engineering-oriented approaches. Although the results are relatively good, the paper lacks in-depth analysis of the improvement brought about by ConvStem. The reasons behind the improved performance on unseen attacks are still unknown. To further support this claim, it is necessary to explore different attack settings, including black-box attacks.\n\nQUESTIONS:\nIt appears that ConvStem performs better on unseen attacks. However, it would be interesting to investigate its performance on black-box attacks as well. One relevant black-box attack is VMI-FGSM (Wang, Xiaosen, and Kun He. \"Enhancing the transferability of adversarial attacks through variance tuning.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2021). To support your opinion, it would be beneficial to compare the performance of the models listed in Table 2 on some black-box attacks. This analysis would provide a more comprehensive understanding of the models' robustness in the face of different attack scenarios.\n\nLIMITATIONS:\nNA", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-07"}