# Stylized Pairing for Robust Adversarial Defense
## 1 Introduction  
Deep neural networks (DNNs) have shown great success in many applications; however, DNNs are not always robust, and they are especially vulnerable to adversarial examples [1; 2; 3]. By adding small adversarial perturbations which are less perceptible to human beings on benign examples, attackers can fool DNNs with alarmingly high probabilities [1]. This phenomenon has quickly attracted a wide range of research interests, and there are many works trying to explain the underlying reasons for the existence of adversarial examples. A recent study [4] has shown that DNNs work very differently from human beings and pointed out that CNNs overly rely on object local features such as textures rather than global object shape. That is, since DNNs have different behavior patterns from human beings, DNNs tend to make decisions by local textures which are easily distorted by all kinds of noise. Therefore, although adversarial perturbations are weak and less perceptible to human beings, they still can lead to DNNs with erroneous decisions [5]. There are many defense mechanisms proposed to defend against adversarial examples. Robust optimization is an important research field. On the one hand, there are approaches aiming to generate robust models against adversarial examples by introducing robust architectures or robust parameters. This line of research mainly includes adversarial training [6; 7; 5], certified defense [8; 9; 10], and the regularization approach [11; 12; 13]. In particular, adversarial training is considered as the most effective approach for adversarial defense, but it has also a high computational complexity. Meanwhile, because of the transferability of adversarial examples [1], that is, the adversarial examples which can mislead one model can often mislead other models with the same task, and many seemingly effective methods can also be bypassed. On the other hand, some researchers solve this issue by adding better intuition to the models through explainability. These methods guide models to learn human preferences such as shape bias [14] or action pattern [15]. In general, these methods need to use some domain knowledge, so there is relatively little research in this area at present, but it is also a promising direction. In this paper, we provide a novel method to increase models' explainability and further improve the model's robustness against adversarial examples. To our best knowledge, it is the first time that the DNN models' different classification strategies from human beings as an important factor in the existence of adversarial examples are proposed, and we propose stylized pairing to bridge the gap. Different from other robust optimization methods, the proposed method utilizes stylized pairing training to encourage logit outputs of a pair of the original image and the corresponding stylized image to be similar and enforce the model to learn more generalized representations and therefore generate more robust models. That is, it tries to increase the semantic similarity between original images and stylized images and utilizes such semantic similarity to increase the models' explainability. As shown in Figure 1, a stylized network is pre-trained to generate stylized examples in which the VGG Encoder and Decoder are the main parts to construct the stylized images with content images and style images. The AdaIN operation performs the style change by aligning the mean and variance of content features (the latent features) with those of the style image's feature. We then minimize the outputs' difference between stylized examples and corresponding normal examples as pairing loss and combine it with original task loss to train DNN networks. The code is available at [[https://github.com/lingKok/robust-optimization-with-stylized-pairing](https://github.com/lingKok/robust-optimization-with-stylized-pairing)]([https://github.com/lingKok/robust-optimization-with-stylized-pairing](https://github.com/lingKok/robust-optimization-with-stylized-pairing)), accessed on 15 August 2022.