Title: Robust Representation Learning via Asymmetric Negative Contrasting and Reverse Attention
Venue: NeurIPS 2023
Accepted: no
Keywords: Robust Representation learning

Asymmetric Negative Contrast

Reverse Attention
Abstract: Deep neural networks are vulnerable to adversarial noise. Adversarial training (AT) has been demonstrated to be the most effective defense strategy to protect neural networks from being fooled. However, we find AT omits to learning robust features, resulting in poor performance of adversarial robustness. To address this issue, we highlight two characteristics of robust representation: 
(1) exclusion: feature of natural examples keeps away from that of other classes;
(2) alignment: feature of natural and corresponding adversarial examples is close to each other. 
These motivate us to propose a generic framework of AT to gain robust representation, by the asymmetric negative contrast and reverse attention. Specifically, we design an asymmetric negative contrast based on predicted probabilities and generate adversarial negative examples by the targeted attack, to push away examples of different classes in the feature space. Moreover, we propose to weight feature by parameters of the linear classifier as the reverse attention, to obtain class-aware feature and pull close the feature of the same class. Empirical evaluations on three benchmark datasets show our method greatly advances the robustness of AT and achieves the state-of-the-art performance.

Abstract

Deep neural networks are vulnerable to adversarial noise. Adversarial training (AT) has been demonstrated to be the most effective defense strategy to protect neural networks from being fooled. However, we find AT omits to learning robust features, resulting in poor performance of adversarial robustness. To address this issue, we highlight two characteristics of robust representation: (1) exclusion: the feature of natural examples keeps away from that of other classes; (2) alignment: the feature of natural and corresponding adversarial examples is close to each other. These motivate us to propose a generic framework of AT to gain robust representation, by the asymmetric negative contrast and reverse attention. Specifically, we design an asymmetric negative contrast based on predicted probabilities and generate adversarial negative examples by the targeted attack, to push away examples of different classes in the feature space. Moreover, we propose to weight feature by parameters of the linear classifier as the reverse attention, to obtain class-aware feature and pull close the feature of the same class. Empirical evaluations on three benchmark datasets show our methods greatly advance the robustness of AT and achieve the state-of-the-art performance.

1 Introduction

Deep neural networks (DNNs) have achieved great success in academia and industry, but they are easily fooled by carefully crafted adversarial examples to output incorrect results [13], which leads to potential threats and insecurity in application. Given a well-trained DNN and a natural example, an adversarial example can be generated by adding small perturbation that is invisible to the human eyes to the natural example. The natural example can be correctly classified before the perturbation and the adversarial example is incorrectly classified after the perturbation. In recent years, there are many researches exploring the generation of adversarial examples to cheat models in various fields, including image classification [13, 26, 5, 9], object detection [33, 8], natural language processing [27, 2], semantic segmentation [28, 25], etc. The vulnerability of DNNs has aroused common concerns on adversarial robustness.

Many empirical defense methods have been proposed to protect DNNs from adversarial perturbation, 28 such as adversarial training (AT) [26, 36, 30, 18, 39, 37, 31], image denoising [24], defensive 29 distillation [38, 6] and so on. The mainstream view is that AT is the most effective defense, which has 30 a training process of a two-sided game. The "attacker" crafts perturbation dynamically to generate 31 adversarial data to cheat the "defender", and the "defender" minimizes the loss function against 32 adversarial samples to improve robustness of models. Existing work [38, 6, 37, 11, 18, 20, 39] has 33 improved the effectiveness of AT in many aspects, but few studies pay attention to learning robust 34 feature. The overlook may lead to potential threats in the feature space of AT models, which does 35 harm to robust classification. Besides, there are no criteria for robust feature. In addition, adversarial 36

(a)

(b)

(c)

(d)

1.75

PGD-AT

PGD-AT

PGD-AT

PGD-AT

TRADES

0.30

TRADES

50

TRADES

1.50

TRADES

Frequency

3

MART

Frequency

0.25

MART

Frequency

40

MART

Frequency

1.25

MART

0.20

1.00

OE

2

0.15

0.75

20

0.10

0.50

1

0.05

10

0.25

0

0.2

Cosine similarity

0.4

0.6

0.8

0.00

5

10

L2 distance

15

20

25

30

0

0.80

0.85

Cosine similarity

0.90

0.95

1.00

0.00

L2 distance

2

3

4

contrastive learning (ACL) and robust feature selection (RFS) are techniques to optimize feature 37 distribution. ACL [21, 12, 35] is a kind of contrast learning (CL) [7, 17, 14] that extends to AT. RFS 38 mostly modifies the architecture of models [32, 1, 34] to select important feature. However, the target 39 problems of them are not to learn robust feature. 40

To demonstrate AT is indeed deficient in the representation which causes limited adversarial robust41 ness, we conduct a simple experiment. We choose the L 2 distance and cosine similarity as metrics. 42 And we measure the distance and similarity of the feature between natural examples, adversarial 43 examples (AEs) and examples of other classes (OEs). The frequency histograms of the distance and 44 similarity is shown in Figure 1. Figure 1 (a) and Figure 1 (b) show that the cosine similarity of the 45 feature between natural examples and OEs shows a Gaussian distribution between 0.4 and 0.8, and 46 the L 2 distance shows a skewed distribution between 2.0 and 12.0, which indicates there are very 47 close pairs of natural examples and OEs that are not distinguished in the feature space. In Figure 1 48 (c) and Figure 1 (d), it is shown that there are a skewed distribution between 0.9 and 0.99 for the 49 cosine similarity of the feature between natural examples and AEs, and a skewed distribution between 50 0.5 and 2.5 for the L 2 distance, which indicates that the feature of natural examples and AEs is not 51 adequately aligned. Thus, there is still large room for optimization of the feature of AT. 52

53

54

55

56

57

58

59

60

Based on the observation, we propose two characteristics of robust feature: exclusion: the feature of natural examples keeps away from that of other classes; alignment: the feature of natural and corresponding adversarial samples is close to each other . First, exclusion confirms the separability between different classes and avoids confusion in the feature space, which makes it hard to fool the model because the feature of different classes keep a large distance. Second, alignment insures the feature of natural examples is aligned with adversarial one, which guarantees the predicted results of the natural and adversarial examples of the same instances are also highly consistent. And it helps to narrow the gap between robust accuracy and clean accuracy.

To address the issue, we propose an AT framework to concentrate on robust representation with the 61 guidance of the two characteristics. Specifically, we suggest two strategies to meet the characteristics, 62 respectively. Treat a natural example and corresponding AE as a positive pair (PP), and treat a natural 63 example and corresponding OE as a negative pair (PP). For exclusion , we propose an asymmetric 64 negative contrast based on predicted probabilities, which freezes natural examples and pushes away 65 OEs by reducing the confidence of predicted class when predicted classes of NPs are consistent. In 66 particular, we find OEs generated by the targeted attack are more beneficial for correct classification 67 than those selected carefully. For alignment , we use the reverse attention to weight the feature of PPs 68 by partial parameters of the linear classifier, which contains the importance of feature to target classes 69 during classification. Because the feature of the same class gets the same weighting and feature of 70 different classes is weighted disparately, PPs are aligned and each example of PPs becomes close 71 to each other in the feature space. Empirical evaluations show that AT methods combined with our 72 framework can greatly enhance robustness, which means the neglect of learning robust feature is 73 one of the main reasons for poor robust performance of AT. In a word, we propose a generic AT 74 framework with the Asymmetric Negative Contrast and Reverse Attention ( ANCRA ), to learn robust 75 representation and advance robustness. Our main contributions are summarized as follows: 76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

We suggest improving adversarial training from the perspective of learning robust feature, and two characteristics are highlighted as criteria of optimizing robust representation.

We propose a generic framework of adversarial training, termed as ANCRA, to obtain robust feature by the asymmetric negative contrast and reverse attention, with the guidance of two characteristics of robust feature. It can be easily combined with other defense methods.

Empirical evaluations show our framework can obtain robust feature and greatly improve adversarial robustness, which achieves the of state-of-the-art performances on CIFAR-10, CIFAR-100 and Tiny-ImageNet.

2 Related work

Adversarial training Madry et al. [26] propose PGD attack and PGD-based adversarial training, forcing the model to correctly classify adversarial samples within the epsilon sphere during training to obtain robustness, which is the pioneer of adversarial learning. Zhang et al. [36] propose to learn both natural and adversarial samples and reduce the divergence of classification distribution of both to reduce the difference between robust accuracy and natural accuracy. Wang et al. [30] find that misclassified samples during training have a negative impact on robustness significantly, and propose to improve the model's attention to misclassification by adaptive weights. Zhang et al. [37] propose to replace fixed attack steps with attack steps that just cross the decision boundary, and improved the natural accuracy by appropriately reducing the number of attack iterations. Huang et al. [18] replace labels with soft labels predicted by the model and adaptively reduce the weight of misclassification loss to alleviate robust overfitting problem. Dong et al. [11] also propose a similar idea of softening label and explain the different effects of hard and soft labels on robustness by investigating the memory behavior of the model for random noisy labels. Chen et al. [6] propose random weight smoothing and self-training based on knowledge distillation, which greatly improve the natural and robust accuracy. Zhou et al. [39] embed a label transition matrix into models to infer natural labels from adversarial noise. However, little work has been done to improve AT from the perspective of robust feature learning. Our work shows AT indeed has defects in the feature distribution, and strategies proposed to learn robust feature can greatly advance robustness, which indicates the neglect of robust representation results in poor robust performance of AT.

Adversarial contrastive learning Kim et al. [21] propose an adversarial training method of maximizing and minimizing the contrastive loss. Fan et al. [12] notice that the robustness of ACL relies on fine-tuning, and pseudo labels and high-frequency information can advance robustness. Kucer et al. [23] find that the direct combination of self-supervised learning and AT penalizes non-robust accuracy. Bui et al. [3] propose some strategies to select positive and negative examples based on predicted classes and labels. Yu et al. [35] find the instance-level identity confusion problem brought by positive contrast and address it by asymmetric methods. The idea of these methods motivates us to further consider how to obtain robust feature by contrast mechanism. We design a new negative contrast to push away NPs and mitigate the confusion caused by negative contrast.

Robust feature selection Xiao et al. [32] take the maximum k feature values in each activation layer to increase adversarial robustness. Zoran et al. [40] use a spatial attention mechanism to identify important regions of the feature map. Bai et al. [1] propose to suppress redundant feature channels and dynamically activate feature channels with the parameters of additional components. Yan et al. [34] propose to amplify the top-k activated feature channels. Existing work has shown enlarging import feature channels is beneficial for robustness, but most approaches rely on extra model components and do not explain the reason. We proposes the reverse attention to weight feature by class information without any extra components, and explain it by alignment of feature.

3 Methodology

This section explains the instantiation of the our AT framework from the perspective of the two characteristics of robust feature. To meet exclusion , we design an asymmetric negative contrast based on predicted probabilities and propose to craft OEs by the targeted attack, to push away the feature of NPs. To confirm alignment , we propose the reverse attention to weight the feature of the same class, by the corresponding weight of target class in parameters of the linear classifier, so that the feature of PPs is aligned and the gap of the feature between natural examples and AEs becomes small.

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

3.1 Notations

In this paper, capital letters indicate random variables or vectors, while lowercase letters represent their realisations. We define the function for classification as f ( · ) . It can be parameterized by DNNs. Linear ( · ) is the linear classifier with a weight of Ω (C, R), in which C denotes the class number and R denotes the channel number of the feature map. g ( · ) is the feature extractor, i.e., the rest model without Linear ( · ) . Let B = { x i , y i } N i be a batch of natural samples where x i is labeled by y i . Given an adversarial transformation T a from an adversary A (e.g., PGD attack in [26]), and a strategy T o for selection or generation of OEs. For data, we consider a positive pair PP= { x i , x a i | x i ∈ B , x a i = T a ( x i ) } N i , and a negative pair NP= { x i , x o i | x i ∈ B , x o i = T o ( x i ) } N i . Let N ( x, ϵ ) represent the neighborhood of x : { ˜ x : ∥ ˜ x -x ∥ ≤ ϵ } , where ϵ is the perturbation budget. For an input x i , we consider its feature z i before Linear ( · ) , the probability vector p i = softmax ( f ( x i )) and predicted class h i = argmax ( p i ) , respectively.

3.2 Adversarial training with asymmetric negative contrast

Firstly, we promote AT to learn robust representation that meets exclusion . We notice that ACL has the contrastive loss [29] to maximize the consistency between PPs and to minimize the consistency between NPs. Motivated by the contrast mechanism, we consider to design a new negative-contrast term and combine it with AT loss, which creates a repulsive action between NPs when minimize the whole loss. Thus, we propose a generic pattern of AT loss with a negative contrast. Let TRADES [36] represent AT in the following paper as a example.

Where x denotes natural examples with labels y , x a are AEs generated by untargeted PGD [26], x o are negative examples of other classes (OEs), Sim is a similarity function, L CE denotes the cross-entropy loss and D KL denotes divergence of Kullback-Leibler. AEs generated by maximizing L CE typically have wrong predicted classes, given by:

where ϵ denotes the L ∞ -norm of perturbation, x a t denotes adversarial positive samples after the t th attack iteration, Π denotes a clamp function, sign denotes a sign function and ∇ x L CE denotes the gradient of L CE with respect to x . When minimizing the loss in Eq 1, L TRADES learns to classify natural examples and AEs correctly, and additional negative contrast prompts the inconsistency of NPs, which keeps the feature of NPs far away from each other. The whole loss guides the model to learn correct classification from TRADES and push away NPs from each other to ensure exclusion . Although we have a generic pattern of AT loss with a negative contrast, there are several problems about details to address. To refine the negative contrast and address problems, we further propose a method to calculate the negative contrast and strategy to generate OEs.

3.2.1 Asymmetric negative contrast based on probabilities

The work in [35] has indicated that when the predicted classes of the adversarial positive examples (i.e., AEs) and negative samples (i.e., OEs) are the same, the positive contrast may lead to a conflict between the positive and negative contrast, resulting in wrong classification. On the basis, we find a similar conflict can also be caused by the negative contrast when the predicted classes of AEs and OEs are different, which we named by class confusion. As shown in Figure 2, when AEs and OEs have different predicted classes, natural examples are subject to the attraction of AEs and the repulsion of OEs at the same time. And it is likely to move near the decision boundary or even into the wrong class space under the actions, which does harm to exclusion .

In order to alleviate the problem of class confusion, We should reasonably control the effect of the repulsion of negative contrast between natural examples and OEs. we propose an asymmetric method of the negative contrast, Sim α ( x, x o ) , to decouple the repulsive force into an one-side push from the natural example to the OE and an one-side push from the OE to the natural example, given by:

(a)

(b)

Predicted as

'cat'

Predicted as

'car'

Predicted as

'dog'

Predicted as

'cat'

Predicted as

'car'

Predicted as

'dog'

Pull

Push

Natural sample

Positive sample

Negative sample

where Sim( x, x o ) denotes the one-sided similarity of x and x o . When minimizing Sim( x, x o ) , we 174 stop the back-propagation gradient of x and only move x o away from x . α denotes the weighting 175 factor to adjust the magnitude of the two repulsive forces. When α = 0, OEs are frozen and only the 176 feature of natural samples is optimized to push far away from the feature of OEs. As α increases, the 177 natural sample becomes more repulsive to the OE and the OE pushes the natural example less. To 178 mitigate the class confusion problem, we should choose α that tends to 1 to reduce the repulsive force 179 from the OE to the natural example, to prevent the natural example from being pushed into the wrong 180 class. Experiments show that α =1 leads to the best performance provided in our supplementary 181 material), which pushes away NPs by only pushing off OEs and follows what we have expected. 182

Then we propose the negative contrast based on predicted probabilities, Sim α cc ( x, x o ) , to measure 183 the repulsive force of NPs pushing away from each other. It pushes away NPs by decreasing the 184 corresponding probabilities of the predicted classes when the predicted classes of NPs are consistent. 185

where ∥B i ∥ denotes the batch size, I ( · ) denotes the Indicator function and ˆ p denotes freezing the 186 back-propagation gradient of p . h i and h n i denote the predicted classes of the NP. And p i and p n i 187 denote the probability vectors of the NP. Under the negative contrast, the model pushes the natural 188 example in the direction away from the predicted class of the OE and push the OE in the direction 189 away from the predicted class of the natural example when and only when two predicted classes of 190 the NP are consistent. This ensures that the action of exclusion not only pushes away the feature of 191 NPs in the feature space, but also reduces the probabilities of NPs in the incorrect class. Since the 192 negative contrast has only directions to reduce the confidence and no explicit directions to increase 193 the confidence, it does not create any actions to push the natural example into the feature space of 194 wrong classes even in the scenario of class confusion, which can effectively alleviate the problem. 195

196

197

198

199

200

201

3.2.2 Generate negative samples by targeted attack

To obtain OEs, previous negative sampling strategies [19] simply screen natural samples and pick up the negatives from them, but rarely consider generating special negative samples to assist learning. We innovatively propose a strategy to craft OEs by the targeted attack: natural negative examples with labels that is different from those of natural examples are attacked to the labeled classes of natural examples by targeted PGD-10 [26], to manufacture hard negatives containing adversarial noise.

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

Where ∇ x o L CE denotes the gradient of L CE with respect to x o . By this strategy, clean OEs randomly chosen from other classes are attacked to the labeled classes of natural examples and become negative adversarial examples. The motivation makes intuitive sense. 1) The negative adversarial sample generated by the targeted attack will be classified as the labeled class of the natural example with high confidence, but its ground truth label is not that, which makes it a very hard negative sample and is beneficial for the negative contrast. 2) The negative adversarial sample contains adversarial noise, which is special feature that natural negative samples do not have. And this feature helps the model learn the paradigm of adversarial noise and improve the robust performance. In particular, we demonstrate that negative samples with adversarial noise do improve robustness better in Table 4.

3.3 Adversarial training with reverse Attention

Secondly, we continue to improve TRADES to learn robust representation that meets alignment . Consider the calculating process of the model f ( · ) . First, the feature vector z is obtained by g ( x ) , and then the output vector Ω z is obtained by a linear mapping Linear ( z ) . Each element z i in z represents the activation level of the feature channel that may be helpful for classification, with larger values representing more feature information extracted from that channel; ω i,j in Ω represents the importance of the i th feature channel to the j th class, with higher values representing the greater contribution of the feature channel to the class. Motivated by [1, 34], we exploit the importance of feature channels to target classes to align the feature of examples of the same classes and pull close the feature of PPs, which is named by reverse attention. To be specific, we take the Hadamard product (Kronecker product) of partial weight of the classifier Ω j and the feature vector z . It can weight feature channel by channel according to its contribution to being classified as the target class j , and gain a class-aware feature vector z ′ containing the information of the target class j .

where ⊙ denotes the Hadamard product operation, which is the method of multiplying two matrices of the same size element by element to obtain a new matrix of the same size. To ensure parameters used for weighting have the correct feature-to-class importance, we use the unweighted feature vector z to go through Linear ( · ) to obtain the auxiliary probability vector p , and z ′ to get the final probability vector p ′ . Finally, we use both p and p ′ to train the model. During the training phase, we use the true label y as an indicator to determine the importance of channels, i.e., Ω j = Ω y . And in the testing phase, since the true label is not available, we simply choose a sub-vector of the linear weight by the predicted class h ( x ) as the importance of channels. We add the reverse attention to the last feature layer in the model, which generally contains two blocks. The model with the reverse attention does not need any extra modules, but module interactions are changed.

Let' s make a detailed analysis and explanation of the principle of this method. The class information from labels guides the input image to be mapped from the feature to the classification vector during training, establishing an feature-to-class mapping relationship. In the model, the feature extractor captures the representation that is helpful for classification until the feature vector contains enough information that allows the classifier to classify the sample as the target class. Among all the modules, the classifier is the closest to labels and learns which feature channel plays an important role in being classified as the target class (i.e., the feature importance). Since the classifier is unique, the importance of the feature channels of one example is exactly the same with that of the other samples in the same class, benefiting the generalization and robustness of the model in the target class. We propose the reverse attention to utilize this information to improve feature rather than classification. The feature vectors are weighted by partial parameters of the linear layer that belong to the target class, which can change the activation of each channel adaptively according to the feature importance, acting as an attention with the guidance of the class information. After the attention, the important channels in the feature vector are boosted and the redundant channels are weakened, i.e., the information contributes to the target class will become larger and more significant, which is helpful for correct classification. Considering from the perspective of the feature distribution, the weighted feature has gained extra class information, which induces changes in the feature distribution. Feature vectors with the same target class get the same weighting, and thus the weighted feature becomes more similar. Moreover, feature vectors with different target classes are weighted according to different weights, and the weighted feature distributions become more inconsistent. Therefore, the reverse attention guides

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

the alignment of the feature of the examples in the same class, pulling the feature of PPs closer and pushing the feature of NPs far away, which benefits alignment and drops by to promote exclusion and classification. Aligned feature has similar activations in every feature channel, which helps the model narrows the gap between feature of natural examples and AEs.

4 Experiments

To demonstrate the effectiveness of the proposed approach, we show feature distribution of trained models firstly. Then we evaluate our framework against white-box attacks and adaptive attacks, and make a compare with other defense methods. We conduct experiments across different datasets and models. Because our methods are compatible with existing AT techniques and can be easily incorporated in a plug-and-play manner, we choose three baselines [26, 36, 30] to combine with our framework for evaluation: PGD-AT-ANCRA, TRADES-ANCRA, and MART-ANCRA.

4.1 Settings

Implementation On CIFAR-10 and CIFAR-100 [22], we train ResNet18 [15] with a weight decay of 2 . 0 × 10 -4 . On Tiny-ImageNet [10], we use PreActResNet18 [16]with a weight decay of 5 . 0 × 10 -4 . We adopt the SGD optimizer with a learning rate of 0.01, a momentum of 0.9, epochs of 120 and a batch size of 128 as [30]. For the trade-off hyperparameters β , we use 6.0 in TRADES and 5.0 in MART, following the original setting in their papers. For other hyperparameters, we tune the values based on TRADES-ANCRA. We generate adversarial example for training by L ∞ -norm PGD [26], with a step size of 0.007, an attack iterations of 10 and perturbation budget of 8/255. We use single NVIDIA A100 and two GTX 2080 Ti in the experiments.

Baseline We compare the proposed PGD-AT-ANCRA, TRADES-ANCRA, and MART-ANCRA with the popular baselines: PGD-AT [26], TRADES [36], MART [30] and SAT [18]. Moreover, we also choose three state-of-the-art methods: AWP [31], S2O [20] and UDR [4]. We keep the same settings among all the baselines with our settings and follow their original hyperparameters.

Evaluation We choose several adversarial attacks to attack the target models, including PGD [26], FGSM [13], C&W [5] and AutoAttack [9] which is a powerful and reliable attack and an ensemble attack with three white-box attacks and one black-box attack. We notice that our methods use the auxiliary probability vector p in the training and testing phase, so we design two scenaios: 1) train with p and test without p ; 2) train with p and test with p . 1) denotes evaluation against white-box attacks and 2) denotes evaluation against adaptive attacks. Following the default setting of AT, the max perturbation strength is set as 8. / 255. for all attack methods under the L ∞ . The attack iterations of PGD and C&W is 40 (i.e., PGD-40), and the step size of FGSM is 8. / 255. unlike 0.007 for other attacks. The clean accuracy and robust accuracy are used as the evaluation metrics.

4.2 Comparison results of feature distribution

(a)

(b)

(c)

(d)

17.5

PGD-AT

0.8

PGD-AT

PGD-AT

PGD-AT

15.0

TRADES

TRADES

50

TRADES

1.75

TRADES

Frequency

12.5

MART

ANCA

Frequency

0.6

MART

ANCA

Frequency

40

ANCA

MART

1.50

MART

ANCA

10.0

0.4

30

1.00

7.5

20

0.75

5.0

0.2

0.50

2.5

10

0.25

0.0

0.0

0.2

0.4

0.6

0.8

1.0

0.0

0

5

10

15

20

25

30

0

0.0

0.2

0.4

0.6

0.8

1.0

0.00

0

2

4

6

8

Cosine similarity

L2 distance

Cosine similarity

L2 distance

Frequency histograms of feature distribution is shown in Figure 3. It is shown that our methods can 288 greatly improve feature distribution, which follows the characteristics of exclusion and alignment . In 289 Figure 3 (a) and Figure 3 (b), it shows that the cosine similarity of the model trained by our method 290 between natural examples and OEs shows a skewed distribution between -0.05 and 0.1, and the L 2 291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

distance with our method shows a Gaussian distribution between 5.5 and 10.0, which indicates natural examples and OEs have been fully distinguished in the feature space and exclusion has been met. In Figure 3 (c) and Figure 3 (d), it shows that in the model trained by our method there are a uniform distribution between 0.95 and 0.99 for the cosine similarity of the feature between natural examples and AEs, and a skewed distribution between 0.05 and 1.5 for the L 2 distance of the feature, which indicates the feature between natural examples and AEs is very close to each other and alignment has been confirmed. Thus, our framework successfully helps AT to obtain robust feature.

4.3 Comparison results against white-box attacks

We train ResNet-18 by different defense on CIFAR-10 and CIFAR-100 to evaluate them under white-box attacks. And more results in PreActResNet18 on Tiny-ImageNet are provided in our supplementary material. The results on CIFAR-10 and CIFAR-100 are shown in Table 1. First, on CIFAR-10, our approaches improve the clean accuracy of based approaches by 5.2%, 3.2% and 5.9%, and also improves the robust performance under all the attacks (e.g., increase by 44.7%, 34.6% and 39.7% against PGD). Compared with state-of-the-art defense, the robust accuracy against different attacks of our methods is almost two times as large than theirs (e.g., 81.23% VS 49.81%). Second, on CIFAR-100, our approaches also greatly improve the robustness and advance the clean accuracy. The clean accuracy of our methods has been increased by 3.5%, 0.3% and 6.8% compared with based methods, and the lowest average robust accuracy of ours is larger than the best one among other methods by 16.8%. In general, our three approaches gain the best performance both in the natural and attacked scenaios. To our surprise, MART-ANCRA and PGD-ANCRA rather than TRADES-ANCRA gain the best performance in a lot of cases without hyper-parameter tuning. Besides, our approaches not only improves robustness but also enhances clean accuracy, though there is always a trade-off between clean and robust accuracy. These results indicate that our approaches can vastly boost the robustness of models against white-box attacks.

4.4 Comparison results against adaptive attacks

We train several ResNet18 models on CIFAR-10 by PGD-AT-ANCRA, TRADES-ANCRA, MARTANCRA and test the same models without p . In addition, we report vanilla based approaches as baseline. Results are in Table 2. It indicates that our approaches can still maintain superb performance after adaptive attacks, e.g., the robust accuracy against PGD of our methods without p are larger than those of baseline by 13.28%, 10.08% and 8.06%.

4.5 Ablation studies

Two defense methods. We train four models by TRADES, TRADES with the asymmetric negative contrast (TRADES-ANC), TRADES with the reverse attention (TRADES-RA) and TRADESANCRA, respectively. The results of evaluation against adaptive attacks are shown in Table 3. First,

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

when incorporating the asymmetric negative contrast only, the performance of robustness against all the attacks and clean accuracy have been improved compared with vanilla TRADES (e.g., 48.36% VS 54.18% against PGD-40). Next, when incorporating the reverse attention only, the performance on clean and adversarial data is also improved greatly compared with TRADES (e.g., 48.36% VS 61.69% against PGD-40). Thus, it shows each method contributes to robustness and generalization. Besides, when Trdeas-ANCRA is compared with TRADES-RA, the clean accuracy and robust accuracy against all the attacks except AA have been enhanced, which indicates that the two strategies are compatible and the combination can alleviate the side effect of independent methods.

Strategy of negative samples We compare our strategy of the targeted attack with other strategies to select negative samples, including Random, Soft-LS and Hard-LS proposed by Bui et al. [3]. The details of them are provided in our supplementary material. The results are shown in Table 4. To make a comprehensive compare, we show results of both the best models and last models with different strategies. It shows that our strategy have the best performance of robustness and clean accuracy in the last models, and achieve the best robust accuracy in the best models.

5 Conclusion

This work addresses an overlook of robust representation learning in the adversarial training by a 341 generic AT framework with the asymmetric negative contrast and reverse attention. We propose 342 two characteristics of robust feature to guide the improvement of AT, i.e., exclusion and alignment . 343 Specifically, the asymmetric negative contrast based on probabilities fixes natural examples, and only 344 pushes away adversarial examples of other classes in the feature space. Besides, the reverse attention 345 weights feature by parameters of the linear classifier, to provide class information and align feature of 346 the same class. Our framework can be used in a plug-and-play manner with other defense methods. 347 Analysis and empirical evaluations demonstrate that our framework can obtain robust feature and 348 greatly improve robustness and generalization. 349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

References

Yang Bai, Yuyuan Zeng, Yong Jiang, Shu-Tao Xia, Xingjun Ma, and Yisen Wang. Improving adversarial robustness via channel-wise activation suppressing. arXiv preprint arXiv:2103.08307 , 2021.

Nicholas Boucher, Ilia Shumailov, Ross Anderson, and Nicolas Papernot. Bad characters: Imperceptible nlp attacks. In 2022 IEEE Symposium on Security and Privacy (SP) , pages 1987-2004, 2022. doi: 10.1109/SP46214.2022.9833641.

Anh Bui, Trung Le, He Zhao, Paul Montague, Seyit Camtepe, and Dinh Phung. Understanding and achieving efficient robustness with adversarial supervised contrastive learning. arXiv preprint arXiv:2101.10027 , 2021.

Tuan Anh Bui, Trung Le, Quan Hung Tran, He Zhao, and Dinh Q. Phung. A unified wasserstein distributional robustness framework for adversarial training. CoRR , abs/2202.13437, 2022. URL https: //arxiv.org/abs/2202.13437 .

Nicholas Carlini and David A. Wagner. Towards evaluating the robustness of neural networks. 2017 IEEE Symposium on Security and Privacy (SP) , pages 39-57, 2016.

Tianlong Chen, Zhenyu Zhang, Sijia Liu, Shiyu Chang, and Zhangyang Wang. Robust overfitting may be mitigated by properly learned smoothening. In International Conference on Learning Representations , 2021.

Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In Hal Daumé III and Aarti Singh, editors, Proceedings of the 37th International Conference on Machine Learning , volume 119 of Proceedings of Machine Learning Research , pages 1597-1607. PMLR, 13-18 Jul 2020. URL https://proceedings.mlr.press/v119/ chen20j.html .

Xiangning Chen, Cihang Xie, Mingxing Tan, Li Zhang, Cho-Jui Hsieh, and Boqing Gong. Robust and accurate object detection via adversarial learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 16622-16631, 2021.

Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International Conference on Machine Learning , 2020.

Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, K. Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. 2009 IEEE Conference on Computer Vision and Pattern Recognition , pages 248-255, 2009.

Yinpeng Dong, Ke Xu, Xiao Yang, Tianyu Pang, Zhijie Deng, Hang Su, and Jun Zhu. Exploring memorization in adversarial training. arXiv preprint arXiv:2106.01606 , 2021.

Lijie Fan, Sijia Liu, Pin-Yu Chen, Gaoyuan Zhang, and Chuang Gan. When does contrastive learning preserve adversarial robustness from pretraining to finetuning? Advances in neural information processing systems , 34:21480-21492, 2021.

Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. CoRR , abs/1412.6572, 2014.

Jean-Bastien Grill, Florian Strub, Florent Altché, Corentin Tallec, Pierre H. Richemond, Elena Buchatskaya, Carl Doersch, Bernardo Avila Pires, Zhaohan Daniel Guo, Mohammad Gheshlaghi Azar, Bilal Piot, Koray Kavukcuoglu, Rémi Munos, and Michal Valko. Bootstrap your own latent a new approach to self-supervised learning. In Proceedings of the 34th International Conference on Neural Information Processing Systems , NIPS'20, Red Hook, NY, USA, 2020. Curran Associates Inc. ISBN 9781713829546.

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , pages 770-778, 2016. doi: 10.1109/CVPR.2016.90.

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In Bastian Leibe, Jiri Matas, Nicu Sebe, and Max Welling, editors, Computer Vision - ECCV 2016 , pages 630-645, Cham, 2016. Springer International Publishing. ISBN 978-3-319-46493-0.

Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages 9726-9735, 2020. doi: 10.1109/CVPR42600.2020.00975.

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

434

435

436

437

438

439

440

441

442

443

444

445

446

447

448

449

450

451

Lang Huang, Chao Zhang, and Hongyang Zhang. Self-adaptive training: beyond empirical risk minimization. Advances in neural information processing systems , 33:19365-19376, 2020.

Tri Huynh, Simon Kornblith, Matthew R Walter, Michael Maire, and Maryam Khademi. Boosting contrastive self-supervised learning with false negative cancellation. In Proceedings of the IEEE/CVF winter conference on applications of computer vision , pages 2785-2795, 2022.

Gaojie Jin, Xinping Yi, Wei Huang, Sven Schewe, and Xiaowei Huang. Enhancing adversarial training with second-order statistics of weights. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 15273-15283, 2022.

Minseon Kim, Jihoon Tack, and Sung Ju Hwang. Adversarial self-supervised contrastive learning. Advances in Neural Information Processing Systems , 33:2983-2994, 2020.

Alex Krizhevsky. Learning multiple layers of features from tiny images. 2009.

Michal Kucer, Diane Oyen, and Garrett Kenyon. When does visual self-supervision aid adversarial training in improving adversarial robustness?

Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu. Defense against adversarial attacks using high-level representation guided denoiser. In 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 1778-1787, 2018. doi: 10.1109/CVPR.2018.00191.

Yawei Luo, Ping Liu, Liang Zheng, Tao Guan, Junqing Yu, and Yi Yang. Category-level adversarial adaptation for semantic segmentation using purified features. IEEE Transactions on Pattern Analysis and Machine Intelligence , 44(8):3940-3956, 2022. doi: 10.1109/TPAMI.2021.3064379.

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 , 2017.

John Morris, Eli Lifland, Jin Yong Yoo, Jake Grigsby, Di Jin, and Yanjun Qi. TextAttack: A framework for adversarial attacks, data augmentation, and adversarial training in NLP. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations , pages 119-126, Online, October 2020. Association for Computational Linguistics. doi: 10.18653/v1/2020. emnlp-demos.16. URL https://aclanthology.org/2020.emnlp-demos.16 .

Federico Nesti, Giulio Rossolini, Saasha Nair, Alessandro Biondi, and Giorgio Buttazzo. Evaluating the robustness of semantic segmentation for autonomous driving against real-world adversarial patch attacks. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision , pages 2280-2289, 2022.

Aäron van den Oord, Yazhe Li, and Oriol Vinyals. Representation learning with contrastive predictive coding. ArXiv , abs/1807.03748, 2018.

Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In International Conference on Learning Representations , 2020.

Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. Advances in Neural Information Processing Systems , 33:2958-2969, 2020.

Chang Xiao, Peilin Zhong, and Changxi Zheng. Enhancing adversarial defense by k-winners-take-all. arXiv preprint arXiv:1905.10510 , 2019.

Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. Adversarial examples for semantic segmentation and object detection. In Proceedings of the IEEE international conference on computer vision , pages 1369-1378, 2017.

Hanshu Yan, Jingfeng Zhang, Gang Niu, Jiashi Feng, Vincent Tan, and Masashi Sugiyama. Cifs: Improving adversarial robustness of cnns via channel-wise importance-based feature selection. In International Conference on Machine Learning , pages 11693-11703. PMLR, 2021.

Qiying Yu, Jieming Lou, Xianyuan Zhan, Qizhang Li, Wangmeng Zuo, Yang Liu, and Jingjing Liu. Adversarial contrastive learning via asymmetric infonce. In Computer Vision-ECCV 2022: 17th European Conference, Tel Aviv, Israel, October 23-27, 2022, Proceedings, Part V , pages 53-69. Springer, 2022.

Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning , pages 7472-7482. PMLR, 2019.

Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankanhalli. 452 Attacks which do not kill training make adversarial learning stronger. In International conference on 453 machine learning , pages 11278-11287. PMLR, 2020. 454

Shiji Zhao, Jie Yu, Zhenlong Sun, Bo Zhang, and Xingxing Wei. Enhanced accuracy and robustness via 455 multi-teacher adversarial distillation. In European Conference on Computer Vision , 2022. 456

Dawei Zhou, Nannan Wang, Bo Han, and Tongliang Liu. Modeling adversarial noise for adversarial 457 training. In International Conference on Machine Learning , pages 27353-27366. PMLR, 2022. 458

Daniel Zoran, Mike Chrzanowski, Po-Sen Huang, Sven Gowal, Alex Mott, and Pushmeet Kohli. Towards 459 robust image classification using sequential attention models. In Proceedings of the IEEE/CVF conference 460 on computer vision and pattern recognition , pages 9483-9492, 2020. 461

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper empirically shows previous supervised adversarial training methods have two shortcomings: (1) The features of the natural examples and those from other classes are not distinguishable and (2) the features of the natural and adversarial examples are not aligned. To mitigate these two issues, the authors propose a regularization to push away the features from other classes and freeze the natural examples and a reverse attention mechanism that increases the weight of the target class. The empirical results seem to validate the effectiveness of the proposed method.\n\nSTRENGTHS:\n1. The paper is well-written and can be easily followed. \n\n1. The proposed method is well-motivated. The empirical study on the feature spaces is interesting and inspirable. \n\n2. The authors conducted the experiments on comprehensive datasets to support their claim.\n\nWEAKNESSES:\n1. Regarding the experiments, the authors only provide the results on ResNet18 and PreActResNet18, which is limited. I suggest the authors provide the results on the WideResNet and make a comparison with the current state-of-the-art performance listed in the RobustBench (https://robustbench.github.io/) to validate the effectiveness of the proposed method.\n\n2. The authors do not provide the error bar to validate the significance of the results.\n\n3. It is weird the accuracies under PGD, FGSM, C&W are higher than the natural accuracy achieved by ANCRA shown in Table 1. It would be better to provide some explanations for these abnormal results. It seems the defence has the issue of the obfuscation gradients. I suggest that the authors report the results under the adaptive attacks that use the auxiliary probability $p$ and even different $p$ during the testing phase and AutoAttacks.\n\nQUESTIONS:\nPlease refer to the comments in Weaknesses and provide the responses.\n\nMinor comments: A typo “negative pair (PP)” => “negative pair (NP)” in Line 64?\n\nLIMITATIONS:\nThough the authors claim they have limitations, I did not find the discussion of the limitations.", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper focuses on robust feature learning by combining two approaches: Adversarial Contrastive Learning and Robust Feature Selection. Specifically, it defines two characteristics for features: exclusion and alignment. The authors aim to enforce exclusion through Asymmetric Negative Contrast (ANC), which ideally should separate different classes. On the other hand, they aim to achieve alignment through Reverse Attention (RA), which should enhance the model's robustness.\n\nSTRENGTHS:\nThe proposed method sounds interesting, especially the Reverse Attention approach. However, I have some concerns and feedback that will be provided in the later section of the review.\n\nWEAKNESSES:\nWriting Style:\n\nOverall, the quality of the writing style could be significantly improved. Reading the paper is not smooth, and understanding it requires reading back and forth several times. For instance:\n\n1. Generally, the flow of the paper is not engaging, which requires the reader to go back and forth in order to understand it. And, there are some sentences that are vague and difficult to understand.\n3. Caption: Overall, the caption writing is not good; it contains long sentences that are difficult to follow. Labels for each plot have not been provided. Specifically, in Figure 1, regarding the distance between natural examples and OEs, it would be preferable to show distances between each pair instead of comparing class 0 with others, as class 0 may share common features with some other classes. It would be more informative to have the following plots: 0-1, 0-2, ..., 0-9.\n4. Typos: \"perturbation -> perturbations\" in line 28 | \"which does harm to robust classification -> which harms robust classification\" in line 35 | \"... negative pair (PP) -> (NP)\" in line 64 | \"import feature -> important feature ...\" in line 118 | \"a example -> an example\" in line 147 | ... \n\nContent:\n1. There are certain terms that are vague. For instance, what does \"well-trained DNN\" mean in line 20?\n2. The definition of an Adversarial Example is not entirely correct. The perturbation itself may be visible, but when it is added to a natural image, both the adversarial example and the original image may not be easily distinguishable by human eyes. Furthermore, it is important to note that it is not the adversarial example itself to which perturbations are added. Rather, the perturbations are added to natural examples so that they cannot be correctly classified.\n3. Description about Figure 1 in line 45-47: It is not a Gaussian distribution; it is a bell-shaped plot but not a Gaussian distribution. The main condition for a Gaussian distribution is that the area under it should be 1. And indeed, those numbers show a significant distance between classes. A cosine similarity below 0.5 should be large enough to indicate a difference between the representations of one class and another. Again, indeed, a cosine similarity between 0.9 and 0.99 indicates that representations of NEs and AEs are very close to each other! And comparing AEs plots with the OEs plots, we see that they have a very close representation to their original examples that OEs. Furthermore, if the representation of NEs and OEs is not significantly distant, models should confuse them, leading to lower clean accuracy. However, that is not the case.\n4. The definition of OEs is not clear from the beginning of the paper. The reader should read the whole paper to figure out what they are, especially since different strategies are considered to select or generate them. \n6. Similarly, the term 'partial parameters' is vague, and the reader doesn't understand what it refers to until the later sections of the paper, which confuses the reader.\n\n\nApproach and Methodology:\n1. IT seems the main weakness is that ANC does not make significant contributions to the clean accuracy and robustness of the model, as indicated by the results in Table 3 of the ablation studies. Specifically, a model with only RA performs just as well as ANCRA. On the other hand, considering this, a large portion of the paper is dedicated to introducing and explaining ANC. However, the most important component, which is RA, is not studied well enough and lacks supporting experiments and theoretical insights.\n2. The training process of a model with ANC is not clear enough. It would have been better to depict it through a diagram. Furthermore, the last paragraph in the introduction section is abstract and confusing, making it difficult for readers to understand the exact contributions.\n\n\nExperiments:\n1. The proposed method in the main table (Table 1) is evaluated without considering \"p\" in attack which creates a false sense of security. However, in Table 2, attacks with \"p\" demonstrate a significant decrease in the model's performance.\n2. Even though \"Error Bars\" is marked in the checklist, I don't see standard deviation values in the reported tables.\n3. Similarly, although \"Reproducibility\" is marked in the checklist, the code necessary to reproduce the results is not available.\n4. I conducted an experiment with TRADES, and the accuracy I obtained differs from what is presented in Table 1. The clean accuracy is 80.92%, and the PGD accuracy is 50.10%.\n4. The results of the Tiny-ImageNet experiments are inconsistent with those of other datasets, and the performance of the model does not seem promising. Additionally, they have not been compared with baselines, which is essential.\n\nQUESTIONS:\nQuestions to ask for clarification based on the claims in the paper:\n1. Why does AT omit learning robust features? Is it possible to theoretically demonstrate why AT is unable to learn robust features? AT does not have poor performance in terms of adversarial robustness. In fact, in the presence of enough data, AT achieves state-of-the-art accuracy.\n\nMajor questions:\n1. The code is not available to reproduce the results. Could you please provide runnable code?\n2. Section 3.2.1 lacks clarity, and the justification for the ANC is not sufficiently sound. Could you please provide further elaboration on this? (Especially since the implementation is not provided for verification, again having a diagram could be helpful)\n3. Is it possible to provide empirical or theoretical evidence for the statement in section 3.3? \"Each element z_i in z represents the activation level of the feature channel that may be helpful for classification, with larger values representing more feature information extracted from that channel\" I am asking because only the value of z_i may not be important, and the combination of weights of the linear layer corresponding to that specific feature is the crucial factor.\n5. Could you please compare the running time of your proposed approach with the baselines? I am curious about how much overhead the additional training steps add.\n6. As described in section 3.3, during the test phase, a sub-vector of the linear weights corresponding to the predicted class h(x) is chosen when the label is not available. However, if the linear layer is already predicting the wrong class, strengthening the prediction by doing so may not improve the model's robustness. Therefore, it raises the question of how this part actually contributes to robustness during testing. Does the robust performance change if we only output the predicted class without doing any reverse attention?\n\n\nMinor questions:\n1. What does it mean to freeze natural examples (in line 65)?\n2. What does \"selected carefully\" mean in line 68?\n3. What are the problems mentioned in line 158 when it states, 'Although we have a generic pattern of AT loss with a negative contrast, there are several specific details to address'?\n\nLIMITATIONS:\n1. It appears that the approach does not work properly with large datasets like ImageNet.", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 1, "DATE": "2023-07-07"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nIn this paper, the authors address a notions of exclusion and alignment in representaion learning for robust adversarial training (AT). They propose a generic framework for AT that includes asymmetric negative contrast and reverse attention in order to obtain robust representation. In addition, they propose to weight feature by parameters of the linear classifier as the reverse attention, to obtain class-aware feature and pull close the feature of the same class. The authors show empirical evaluations on three benchmark datasets, showing the improved robustness under AT and as well as giving increased performance in comparison to state-of-the-art methods.\n\nSTRENGTHS:\nOriginality. The proposed  AT framework that concentrates on robust representation with the guidance of the two characteristics like exclusion and alignment appears to be novel. Generating and using negative samples by targeted attack to assist learning also appears novel. \n\nQuality. The quality is good. The paper is nicely motivated. The idea seems reasonable regarding the use two characteristics for robust representation: (1) exclusion: by pushing away the feature representation of natural examples from the feature representations for examples coming from other classes; and (2) alignment: by pulling close to each other the feature representation of the natural examples and the feature representation for the corresponding adversarial examples. The approach can be used in a plug-and-play manner for a number of defence methods, while the empirical validation shows advantages under the setting of white-box and adaptive attacks. While on table Table 2, we see consistent improvement for the used attacks with p, while we do not have results for comparison when we do not use p. \n\nClarity. The paper organisation, the presentation and the writhing is good. I find the paper easy to follow on most parts. It might be beneficial some parts of the paper to be explained more easily so that the main idea behind the paper to be more obvious. Fig 2. might be improved to more concretely pin point the cases of class confusion issue. In Sections 3.2.1, the section within the lines 162-169, a bit difficult to rad on the first pass regarding the cases covered by the class confusion issue. I would suggest an additional small figure to illustrate intuitively and more obviously the cases. In Sections 3.2.1, the section within the lines 170-172 is not clear (not sure when the some sentences end and begin). Section 3.2.2 could benefit further polishing. Maybe a table or small figure describing what is negative samples or pairs (i.e., OEs), natural negative examples/pairs, adversarial negative examples/pairs, positive examples/pairs, adversarial negative examples/pairs, etc. could be helpful. The text in the lines 234-257 could also benefit sharpening, since some explanations are not that smoot and straightforward at least to my understanding. The results on Table 4 are interesting, but maybe the table could be reorganised and more clearly shown so that we can have a better grasp of what is the actual advantage. \n\nSignificance. Adversarial training is important topic for privacy and security applications. This paper proposes an approach towards more reliable defence of adversarial attacks. The approach also seems to provide improvements on top of other approaches like the TRADES approach. Generating and using negative samples by targeted attack to assist learning seems valuable. Adversarial training with reverse attention on the feature level seems interesting.\n\nWEAKNESSES:\nWeaknesses\n- In the empirical evaluation, some tables could be made more obvious (please see the comment on clarity for Table 4).\n- The black box attacks not considered and comparison for black box attacks not done.\n\nQUESTIONS:\nCould the author comment about the use of the proposed approach under black box attacks?\n\nDoes the reverse attention works only for the TRADES approach?\n\nI wonder of the asymmetric negative contrast based on probabilities is not somewhat artificially enforced, could the authors elaborate on that?\n\nLIMITATIONS:\nLimitations\n\n- By generating negative samples by targeted attack, we use prior on about the possible attack, so possibly, the defence of the approach is biased towards the generated negative samples by the used targeted attack (or similar attacks).\n- In the case of black box attacks when we do not have a prior about the attack, I'm not sure how much the proposed approach could help.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-07"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents two characteristics of robust features, exclusion and alignment, and proposes a novel adversarial training method with asymmetric negative contrast and reverse attention. For exclusion, it introduces asymmetric negative contrast loss and generates adversarial negative examples by targeted attacks to push out examples of other classes in the feature space, and for alignment, it introduces reverse attention that weights features based on the parameters of the linear classifier to obtain class-aware features. Experimental results on three datasets show that the proposed method significantly improves the robustness of the models.\n\nSTRENGTHS:\n1. This paper introduces two characteristics that robust features should have: exclusion and alignment, and proposes a new AT framework that enables models to learn robust features effectively. It can be used in a plug-and-play manner and works well with existing AT methods.\n2. Specifically, asymmetric negative contrast loss for exclusion of robust features, a technique to create hard negative samples through targeted attacks, and reverse attention using class information for alignment are proposed, which induce the characteristics of robust features. To my knowledge, these techniques are novel in AT.\n3. The proposed method records the SoTA performance in experiments on CIFAR-10, -100, and Tiny-ImageNet. The performance improvement shown in Table 1 is impressive.\n4. Overall, the paper is well written to help the readers understand the presented concepts. In detail, figures 1 and 3 show the statistical differences between NEs and OEs and NEs and AEs, making it easier for the reader to understand the difference in the distribution of features and the effectiveness of the proposed AT.  Figure 2 also helps to illustrate the problem of class confusion.\n\nWEAKNESSES:\n1. The practical implementation details for Reverse Attention in Section 3.3 are unclear. Looking at line 228 of the paper, it says that the proposed method uses p and p' together to train the model, but it is ambiguous in what way the proposed method uses them together (e.g., does it use p+p' or alternate between p and p'). Releasing the source code in the future will answer a lot of questions, but it would be nice if it could also be clarified in the paper.\n2. The experimental results for \"adaptive attack\" in Section 4.3 raise the question of whether the experimental results in Section 4.2 are an unfair comparison. Therefore, it is necessary to clarify what the role of p is and whether this is the role of the key in the gray-box setting.\n3. Table 1 in the supplementary material, the results on Tiny-ImageNet, does not have baselines, making it difficult to see performance gains.\n4. Making hard negative examples via targeted attacks requires additional computation, but according to Table 4, the resulting performance gain is small. This paper also needs a clear and specific description of the negative sample generation (such as whether PGD-N was used).  In the supplementary material, it is described as if they used the AEs that are predicted as the classes of NEs in the current batch as OEs, which is difficult to apply in cases with a large number of classes like CIFAR-100 unless the batch size is large enough.\n\nQUESTIONS:\n(Typos)\n\nIn line 331, Trdeas-ANCRA -> Trades-ANCRA\n\nIn Table 2 in Supplementary material, Condation -> Condition\n\nLIMITATIONS:\nIn this paper, possible limitations are not discussed separately.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-26"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis work aims to improve the adversarial training (AT) techniques from the perspective of learning robust representation representations. Specifically, the authors highlight two characteristics of having robust features. Exclusion: the similarity of features of samples of one class should be very less from the features of samples of other classes, so that model can differentiate between features of different classes for better classification.  The second attribute is Alignment: the gap between features of adversaries and clean samples of same class must be very small, which would increase model's robustness against perturbed samples.\n\nTo effectively satisfy these conditions, this work proposes two techniques, (1) to enforce exclusion, a asymmetric negative contrast loss is proposed which minimizes the clean sample similarity with negative samples of other classes, crafted by the adversarial attack. (2) to satisfy alignment: reverse attention strategy is proposed which align together the features of training examples which belong to the same class.\n\nThe proposed method is compatible with existing adversarial training techniques. Extensive experiments are conducted where the proposed method improves the natural accuracy as well as the robust accuracy when combined with existing AT algorithms.\n\nSTRENGTHS:\nStrengths:\n1) The idea of improving adversarial robustness of model by explicitly learning robust representations seems interesting. Although the traditional AT and contrastive learning based AT implicitly learns robust features, this method attempts to achieve the same in more explicit manner.\n\n2) The proposed techniques of utilizing asymmetric negative contrast loss and reverse attention to achieve exclusion and alignment during adversarial training are intuitive and are properly justified in the manuscript. \n\n3) The method provides impressive results as compared to previous state-of-the-art approaches.\n\nWEAKNESSES:\nWeaknesses:\n\n1) There are concerns regarding the proposed reverse attention strategy. During the testing, the true labels are not known and reverse attention uses the predicted label h(x) to calculate z'. In case the model provides wrong predicted class label, the corresponding z' will be also then multiplied with wrong classifier vector. This will further lead to degraded performance. The authors have not tried to address this scenario. \n2) From the works of [1] and [34], how is the proposed reverse attention different? Unfortunately the authors have not provided any comparisons or contrast.\n3) In the ablation studies provided in Table 3, combining ANC and RT marginally improves results as compared to individual ANC and RT results. It looks like there is some sort of competition between the both proposed techniques.\n4) Similarly, the use of negative samples via proposed targeted attack in Table 4 shows marginal improvements overall.\n5) The paper is very difficult to understand, especially for the readers who are new to the technique of adversarial training. The presentation can be significantly improved. \n\nMinor weaknesses:\ntypo at line 281 scenaios -> scenarios\n\nQUESTIONS:\nPlease see weaknesses section.\n\nLIMITATIONS:\nThe authors have not discussed any limitations of their work.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-26"}