Rapid Plug-in Defenders

Authors: kai  wu
yujian betterest li
jian  lou
xiaoyu  zhang
handing  wang
jing  liu
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-15 05:32:30

Abstract: In the realm of daily services, the deployment of deep neural networks underscores the paramount importance of their reliability. However, the vulnerability of these networks to adversarial attacks, primarily evasion-based, poses a concerning threat to their functionality. Common methods for enhancing robustness involve heavy adversarial training or leveraging learned knowledge from clean data, both necessitating substantial computational resources. This inherent time-intensive nature severely limits the agility of large foundational models to swiftly counter adversarial perturbations. To address this challenge, this paper focuses on the \textbf{Ra}pid \textbf{P}lug-\textbf{i}n \textbf{D}efender (\textbf{RaPiD}) problem, aiming to rapidly counter adversarial perturbations without altering the deployed model. Drawing inspiration from the generalization and the universal computation ability of pre-trained transformer models, we propose a novel method termed \textbf{CeTaD} (\textbf{C}onsidering Pr\textbf{e}-trained \textbf{T}ransformers \textbf{a}s \textbf{D}efenders) for RaPiD, optimized for efficient computation. \textbf{CeTaD} strategically fine-tunes the normalization layer parameters within the defender using a limited set of clean and adversarial examples. Our evaluation centers on assessing \textbf{CeTaD}'s effectiveness, transferability, and the impact of different components in scenarios involving one-shot adversarial examples. The proposed method is capable of rapidly adapting to various attacks and different application scenarios without altering the target model and clean training data. We also explore the influence of varying training data conditions on \textbf{CeTaD}'s performance. Notably, \textbf{CeTaD} exhibits adaptability across differentiable service models and proves the potential of continuous learning.

Main paper: 
 introduction: 
 It has been observed that trained neural network models exhibit vulnerability, failing to correctly predict labels when slight perturbations are added to the input examples [15, 2, 5] . This method, known as an evasion-based adversarial attack, poses a significant challenge. Recent research works [47, 42, 36, 41, 31] have focused on developing robust models by leveraging clean data knowledge or employing adversarial training techniques.Presently, deep neural networks serve as fundamental components across various domains [25, 12] . The most prominent models are pre-trained transformers, such as GPT-2 [33] , BERT [9] , and VIT [11] . Following pre-training on relevant data, they demonstrate strong generalization capabilities and can swiftly adapt to downstream tasks. Defending deployed service models presents a more challenging scenario. These service models may face difficulties in fine-tuning when under attack, especially if methods like pruning [52] were implemented before deployment to compress or accelerate the service. Retraining a more robust model incurs a considerable computational cost and time. Furthermore, swift defense becomes crucial to prevent further losses instead of waiting for adversarial training or redeploying the model.Hence, Rapid Plug-in Defender (RaPiD), the goal of which is to swiftly counter adversarial perturbations in different application scenarios without altering the deployed model, is of much importance. Most current methods, especially non-invasive defenders (Detection: Magnet [28] , ADN [29] , DG [1] , etc; Purification: HGD [23] , Defense-GAN [35] , CAFD [50] , DISCO [17] , DensePure [43] , etc.) fail to accomplish this task due to the following reasons: First, they cannot rapidly defend with limited data due to heavy training with much time and training data. Especially, DM-Improves-AT [42] applies adversarial training on a large amount of data generated by diffusion models. Second, they cannot quickly adapt to different application scenarios. For example, as shown in Table 3 , on CIFAR-10, although DiffPure [31] trained on CIFAR-10 (DiffPure CIFAR-10 ) performs well against StAdvAttack, it could hardly work with that trained on Imagenet-1k (DiffPure Imagenet-1k ). Training a diffusion model on a specific field needs much time and data.Table 1 : Comparison of conditions between RaPiD and related works in adversarial defense, concentrating on requirements such as generating additional data, target service model tuning, heavy adversarial training application, utilization of clean data information, and the plug-in nature of the defense.Tuning ServiceClean Data Plug-in DM-Improves-AT [42] DyART [47] FD [46] DISCO [17] GDMP [41] DiffPure [31] DensePure [43] R&P [45] CeTaD (Ours) In this case, we find that the large volume of training data and the substantial number of parameters requiring adjustment are the primary culprits causing the time-consuming nature of current methods. Motivated by the generalization and the universal computation ability of pre-trained transformer models [26, 19] , as well as evidence that pre-training can fortify robustness [16] , we propose a new defense method, CeTaD-Considering Pre-trained Transformers as Defenders. CeTaD is a plug-in defender, which initializes by pre-trained weights and fine-tunes minimal parameters with only few-shot samples. Notably, CeTaD diverges from existing methods as follows: It demonstrates efficacy with a minimal sample size required for fine-tuning the rapid defender. Additionally, CeTaD avoids the need for modification within the deployed model, ensuring adaptability across diverse application scenarios, especially with large foundational models.Our experimental results demonstrate that, in the context of RaPiD, CeTaD exhibits superior performance concerning both clean accuracy and adversarial accuracy with limited training data and computational resources, compared to feasible baselines. The method's effectiveness spans across various datasets and attack methods. The minimal tuned parameters mitigate the risk of overfitting during the training process. Through ablation studies, we evaluate the components within CeTaD, such as the residual connection and parameter initialization. Furthermore, we explore the impact of 1. Introduction of the Rapid Plug-in Defender framework aimed at promptly addressing adversarial perturbations quickly without altering the deployed model.2. Utilization of two strategies in RaPiD to expedite response time: a) leveraging Pretrained models to minimize parameter updates, b) employing few-shot samples for defender training.3. CeTaD's achievement of defense response within half an hour on a single GPU, surpassing the current RaPiD method in efficacy. Additionally, CeTaD demonstrates proficiency in defending against diverse attacks and enables zero-shot transfer to different datasets. 
related work: 
 Adversarial Examples and Defenses. Introduced by [38] , adversarial examples could fool a neural network into working incorrectly. Among various methods [2, 5] , attacks in a white-box manner are usually the most dangerous since the leaked information of the victim model is utilized. Many efforts generate adversarial examples through gradients of victims. [15] yielded a simple and fast method of generating adversarial examples (FGSM). [4] proposed much more effective attacks tailored to three distance metrics. PGD is a multi-step FGSM with the maximum distortion limitation [27] .[8] came up with AutoAttack, a parameter-free ensemble of attacks. Facing adversarial examples, lots of effort pay attention to defense [7] . Some works detect adversarial attack in advance. [28] learned to differentiate between normal and adversarial examples by approximating the manifold of normal examples. [29] proposed to augment deep neural networks with a small detector subnetwork which is trained on the binary classification task of distinguishing genuine data from data containing adversarial perturbations. [1] constructed a Latent Neighborhood Graph for detection. Some works strengthen robustness by adversarial training, where the model would be trained on adversarial examples [15] . [42] proposed to exploit diffusion models to generate much extra data for adversarial training. [47] encouraged the decision boundary to engage in movement that prioritizes increasing smaller margins. In addition, many works focus on adversarial purification. [23] proposed high-level representation guided denoiser for purification. [35] trained a generative adversarial network to model the distribution of unperturbed images. [50] proposed to remove adversarial noise by implementing a self-supervised adversarial training mechanism in a class activation feature space. [36] combined canonical supervised learning with self-supervised representation learning to purify adversarial examples at test time. [17] purified adversarial examples by localized manifold projections. Similar to [41] , [31] followed a forward diffusion process to add noise and recover the clean examples through a reverse generative process. Furthermore, [43] consisted of multiple runs of reverse process for multiple reversed samples, which are then passed through the classifier, followed by majority voting of inferred labels to make the final prediction.Few-shot Adversarial Training. Here are several work on adversarial training with few-shot samples. Many works focus on few-shot learning by adversarial training. [30] applied adversarial discriminator for supervised adaptation problem. [49] introduced an adversarial generator to help few-shot models learn sharper decision boundary. [22] proposed to hallucinate diverse and discriminative features on few labeled samples. Furthermore, few-shot adversarial training is utilized to enhance the robustness.[13] developed an adversarial training algorithm for producing robust meta-learners and found the the meta-learning models are the most robust with only the last layer tuned. [10] integrated a adversarialaware classifier, adversarial-reweighted training and a feature purifier. In this paper, we implement fine-tuning with few-shot adversarial examples for swift defense response.Pre-trained Transformer. Introduced by [40] , transformer is an efficient network architecture based solely on attention mechanisms. It is first applied in natural language processing and then rapidly spread in computer vision. [9] proposed BERT to utilize only the encoder of transformer while GPT-2 [33] considered only transformer decoder. In computer vision, [11] proposed Vision Transformer (VIT), transforming a image into sequences of patches and processing them through a pure encoder-only transformer. Moreover, transformer has the ability of universal computation over single modality. [26] demonstrated transformer models pre-trained on natural language could be transferred to tasks of other modalities. Similar to [51, 48] , [39] proposed to make the frozen language transformer perceive images by only training a vision encoder as the sequence embedding.To strengthen robustness and generalization, we initialize the plug-in defender by a language/vision pre-trained transformer model and only fine-tune minimal parameters.3 Pre-trained Transformers as Defenders CeTaD, initializes with pre-trained weights from models like VIT or BERT. It involves a defender embedding and decoder to align the plug-in defender with the input example and the service model respectively. A residual connection retains the primary input features, resulting in the original input combined with the defender's output serving as the input to the service model. Default settings include copying the embedding from VIT or BERT and utilizing PixelShuffle [37] for the decoder. Especially, PixelShuffle rearranges the elements, unfolding channels while increasing spatial resolution, to match the image resolution. Given limited access to adversarial examples, we opt to fine-tune minimal parameters, such as layer normalization, in the plug-in defender, mitigating overfitting and excessive bias on clean data. If the model M works correctly, y c = y * . Utilizing leaked information about M, the attacker edits the original image x c to an adversarial image x a by introducing noises, resulting in an adversarial image x a within the adversarial set X a . The prediction for x a is then determined asEQUATIONIf the attack succeeds, y a ̸ = y * . The tuning set for defense, denoted as X d , represents a subset of X a and has a limited size within the RaPiD framework. Our approach incorporates a defender module D with parameters θ, while maintaining M fixed. As illustrated in Fig. 1 , M consists of the embedding of a pre-trained VIT, a pre-trained transformer encoder as a feature poccessor, and a parameter-free PixelShuffle block as a decoder.Only limited parameters are fine-tuned within X d . The loss function is formulated asEQUATION)where loss is the cross-entropy for classification. Within this framework, θ 1 and θ 2 represent the parameters of D, with only θ 1 being subject to tuning. Specifically, θ 1 pertains to the layer normalization parameters, while θ 2 encapsulates the remaining parameters. With the trained defender D θ * 1 ,θ2 , the final prediction y is obtained as where θ * 1 is the optimized parameters, and x ′ ∈ (X c X a ). Module Selection. Module selection is a critical aspect of CeTaD given the limited parameter tuning. The embedding and decoder modules play pivotal roles in facilitating the mapping between the input and hidden spaces. Meanwhile, the encoder holds paramount importance for discerning adversarial cues and fortifying robustness, as it remains the sole trainable module and undertakes the most computation within CeTaD. Flexibility characterizes CeTaD, contingent upon ensuring harmonious dimensions across the modules.EQUATIONOutlined below are succinct introductions to the utilized modules: BERT [9] , a transformer encoder model, pre-trained for masked language modeling (MLM) and next sentence prediction (NSP) on a substantial uncased English dataset (available in base and large versions); VIT [11] , a transformer encoder model, pre-trained for image classification on ImageNet-21k at a resolution of 224x224 (accessible in base and large versions); GPT-2 [33] , a transformer decoder model, pre-trained for causal language modeling (CLM) on an extensive English corpus (available in 124M variant); PixelShuffle [37] , a technique reorganizing elements within channels to enhance spatial resolution.In our default setup, only layer norm parameters (48 parameter groups, 36864 variables in total) are fine-tuned using Lion [6] with default hyper-parameters. We optimize Eq. ( 2) over 500 epochs with a batch size of 32.Discussion. Two perspectives elucidate CeTaD's functionality. Initially, it functions akin to a purifier, detecting and filtering adversarial perturbations by introducing adaptive noise. Alternatively, akin to prompt engineering in natural language processing [24] , CeTaD can be perceived as a prompt generator, creating adaptive prompts. These prompts serve as cues for the service model, aiding in enhanced classification of adversarial examples.Question: Does the paper discuss the limitations of the work performed by the authors?Answer: [Yes] Justification: See Section 5Guidelines:• The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper. • The authors are encouraged to create a separate "Limitations" section in their paper.• The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be. • The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated. • The authors should reflect on the factors that influence the performance of the approach.For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon. • The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size. • If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness. • While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations. 
theory assumptions and proofs: 
 Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?Answer • Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted. 
experiments: 
 Experimental Setup Datasets. Three image classification datasets, MNIST [21] , CIFAR-10 [20], CIFAR-100 [20] , and Imagenet-1k [34] , are utilized. We utilize the library, Datasets, to prepare data. For simplicity, the training set only consists of adversarial examples whose number equals to that of the classes, namely one-shot. The detailed information of datasets and pretrained models can be found in Appendix Section A.Attacks. Evasion methods PGD [27] , AutoAttack [8] and StAdvAttack [44] simulate service model leakage. Following [42] , l ∞ -norm's max distortion is 8/255 and l 2 -norm is 128/255. PGD parameters include ten iterations and step size ϵ/4. Metrics include Clean Accuracy (CA) and Adversarial Accuracy (AA). Clean accuracy stands for the accuracy on clean data while adversarial accuracy on adversarial data.Pre-trained Models. Reproducibility relies on public models and checkpoints available on GitHub or Huggingface. For MNIST, the victim model is a fine-tuned VIT-base; for CIFAR-10, both of a fine-tuned VIT-base and a standardly trained WideResNet-28-10 are considered as victims; for CIFAR-100, a fine-tuned VIT-base is the victim; for Imagenet-1k, VIT-base is the victim. Pre-trained BERT-base, BERT-large, VIT-base, VIT-large and GPT-2-124M are considered as the choices of the defender initialization.Other Details. Default settings include BERT-base defending WideResNet-28-10 against l ∞ -PGD on CIFAR-10, with the defender's embedding sourced from pre-trained VIT.Baselines R&P [45] and Random Noise [32] are training-free, while the others (Linear, FFN, Bottleneck and FD [46] ) undergo optimization. R&P employs random resizing and padding against adversarial examples, while Random Noise adds zero-mean normal distribution noise similar to BaRT [32] . Linear, FFN, Bottleneck, and FD replace module D in Fig. 1 , maintaining the rest akin to CeTaD. Linear uses a single layer sans activation, FFN has two doubled hidden feature linear layers with a RELU activation, Bottleneck halves the hidden feature dimension, and FD integrates non-local denoising with a 1x1 convolution and identity skip connection, performing optimally at a hidden dimension of 256. Our method distinguishes itself from prior adversarial training approaches like [42] , excelling in rapid defense without extensive retraining needs.We compare CeTaD with other possible structures and feasible stateof-the-art baselines for RaPiD. Here, BERT-base is the defender for the WideResNet-28-10 against l ∞ -PGD on CIFAR-10. The results are shown in Table 2 .Table 4 : Accuracy performance in zero-shot transfers from the top to the bottom. "Source" refers to the environment where the defender is tuned, while "Target" represents the environment to which the defender transfers. None denotes direct training of the defender in the target environment without transfer. against AutoAttack. We observe that within AutoAttack, only Auto-PGD succeeds; this method is the initial step of the ensemble and singularly overwhelms the victim model. Auto-PGD adjusts its step size automatically, seeking minimal efficient perturbations. However, this pursuit of minimal perturbations may compromise their robustness, allowing for more successful defense strategies. Thus, maintaining a balance between maximum distortion and perturbation effectiveness is critical for generating resilient perturbations. In addition, we include another attack method, StAdvAttack, in Table 3 . With a tougher attack method, our method shows good generalization as well.Zero-shot Transfer to Different Datasets Given the generalization potential of pre-trained models [19, 16, 26] , we assess CeTaD across varied datasets without re-tuning, named zero-shot transfer. Table 4 indicates that transferring to ResNet on CIFAR-10 from VIT on CIFAR-100 yields lower adversarial accuracy, even worse than random selection. When the target model is VIT, CeTaD exhibits improved transfer performance. This sensitivity to victim model structures suggests challenges in direct transfer across different models. Instead, similarity between victim models might aid beneficial transfers between tasks. Notably, the transferred BERT defender achieves higher adversarial accuracy, indicating superior performance of CeTaD with diverse prior knowledge.Further evaluations consider MNIST as the target dataset and CIFAR-10 or CIFAR-100 as the source.Performance remains consistent regardless of the source dataset, suggesting uniform transferable knowledge among these defenders. Shifting focus to more challenging target tasks, Table 7 shows surprising results: defenders tuned on MNIST demonstrate superior adversarial accuracy on CIFAR-100 compared to CIFAR-10. This highlights that transfer from unrelated data might bolster defender robustness. In summary, leveraging transfer gaps enhances defense robustness, potentially empowering defenders across diverse datasets to strengthen performance on individual datasets. On test data, adversarial accuracy steadily improves, signifying CeTaD's capacity to generalize from a single-shot adversarial dataset. However, this gain comes at the cost of declining clean accuracy. The divergence in distributions and mapping between clean and adversarial data, due to added perturbations, causes a trade-off: aligning with adversarial data benefits but compromises performance on clean data.In the latter 400 epochs, while maintaining 100% training accuracy, test adversarial accuracy continues a slight ascent, clean accuracy gently declines, and the loss sporadically fluctuates. This pattern suggests that rather than overfitting, CeTaD continues to explore and assimilate information from adversarial examples. It is a crucial capability in RaPiD, where conventional methods like evaluation or early stopping might not be feasible due to limited training data. As highlighted in Section 4, the initialization strategies and tuned parameters play a pivotal role in defender performance.Here, we delve into these aspects within CeTaD. Given the identical transformer layer structure, the divergence between the BERT and VIT defenders lies primarily in weight initialization. Continuous Attack. Similar to adaptive attacks, continuous attacks have the access to the existing system including the defender, which is a very demanding setting in practice. However, our method requires limited tuning on few-shot adversarial samples, which may make continuous defense possible and slightly. Treating each Attack-Then-Defense period as a round, we conduct a pilot evaluation of one-shot continuous rapid defense under the 1adv-1clean setting mentioned in Section 4. Results in Table 12 demonstrate that both adversarial and clean accuracy is enhanced through continuous adversarial learning. We foresee the potential expansion of CeTaD into an active defender against adaptive attacks in the future.Black-Box Attack Black-box attacks are usually more generalized and robust than white-box methods. We evaluate CeTaD on two kinds of black-box attacks, square attack [3] and composite adversarial attack [18] , under the default settings. For Square Attack, 5000 queries are applied for randomized perturbation search; for Composite Adversarial Attack (CAA6), semantic perturbations are combined with scheduled ordering. As shown in Table 13 and 14, CeTaD is able to adapt to different black-box attacks by one-shot adversarial fine-tuning. Furthermore, the choice of initialization strategy and parameter tuning significantly affects CeTaD's efficacy (Section 4). This study primarily assesses three initialization strategies from standard pretrained models and explores only parameter tuning for layer norm and full defender parameters. Enhanced strategies for initialization and refined parameter selection through data-driven approaches could bolster performance. Considering lifelong learning is imperative. The focus on a single attack method in each experiment doesn't account for the reality where service models encounter diverse attack methods. Developing a defender capable of continuous learning to combat new attacks while leveraging past knowledge is essential. By the way, we believe that the defense for deployed models is a complex system. Though we focus on the core (how to defend), there are many other unresolved important problems, such as how to rapidly detect adversarial examples when the attack happens.In For reproducibility, we illustrate how to prepare data in the experiments.All datasets are available from Huggingface: MNIST (https://huggingface.co/datasets/ mnist), CIFAR-10 (https://huggingface.co/datasets/cifar10) and CIFAR-100 (https: //huggingface.co/datasets/cifar100). The library, Datasets (https://github.com/ huggingface/datasets), which includes the methods mentioned below, is utilized for downloading and splitting data.N-shot Training Samples. First, we split data by class using filter. Then, for each category, two methods, shuffle with a given seed and select for getting the first n samples, are applied in turn. Finally, we mix the selected samples of all classes by concatenate_datasets and shuffle with the seed.512 Fixed Test Samples. We apply shuffle with the seed and select to get the first 512 samples.In details, data is class-split via filter. Each category undergoes shuffle and select methods for obtaining n samples, followed by concatenate_datasets and shuffle for mixing all class samples.As per [31] , evaluation involves 512 randomly selected images from the test dataset, reducing computational expenses. We apply shuffle with the seed and select to get the first 512 samples. Module selections are essential for CeTaD since only limited parameters are tuned. The embedding and the decoder are vital for feature mapping between the input space and the hidden space. The encoder is significant for perceiving adversarial information and enhancing robustness since it is the only trainable module and bears the most computation in CeTaD.As shown in Figure 1 and illustrated in Section 3, CeTaD is flexible as long as the dimensions of the modules match with each other. However, pre-trained weights may help.For example, we take the embedding from the pre-trained VIT, get the transformer blocks from the pre-trained BERT, VIT or GPT-2, and consider PixelShuffle as the decoder. The modules we used are briefly introduced as follows: BERT ( [9] ) is a transformer encoder model pre-trained for masked language modeling (MLM) and Next sentence prediction (NSP) on a large corpus of uncased English data (base: https://huggingface.co/bert-base-uncased; large: https://huggingface.co/bert-large-uncased); VIT ( [11] ) is a transformer encoder model pre-trained for image classification on ImageNet-21k at resolution 224x224 (base: https: //huggingface.co/google/vit-base-patch16-224-in21k; large: https://huggingface. co/google/vit-large-patch16-224-in21k); GPT-2 ( [33] ) is a transformer decoder model pre-trained for causal language modeling (CLM) on a large corpus of English data (124M: https://huggingface.co/gpt2); PixelShuffle ( [37] ) rearranges elements unfolding channels to increase spatial resolution2 .Optimization loops are implemented by PyTorch. To optimize limited parameters and freeze the others, following [26] , we set requires_grad=True for tunable parameters while requires_grad=False for the others. The optimizer is initialized by registering the parameters with requires_grad=True.Under the default experimental setup, only layer norm parameters (48 parameter groups, 36864 variables in total) are tuned. We use seed 42 for reported accuracies following [26] , each experiment running within 30 minutes on an NVIDIA RTX A5000 GPU.By the way, the implementation of Lion ( [6] ), the optimizer which we apply, is available at https: //github.com/lucidrains/lion-pytorch.We evaluate GPU memory (peak value) and inference time (average value per batch) on the test set under other default settings with the following device configuration: CPU, 14 vCPU Intel(R) Xeon(R) Gold 6330 CPU @ 2.00GHz; GPU, 1 NVIDIA RTX 3090(24GB). As shown in Table 15 , our method would not lead to a heavy non-trivial inference overhead. However, with larger pre-trained models, the memory and latency increase accordingly. It is supposed to be a trade-off between defense performance and resource consumption. Our evaluation includes naive and training-free defense methods such as Random Noise and R&P. Results show that Random Noise could not balance clean and adversarial accuracy while R&P keeps high clean accuracy but has little effect on adversarial accuracy. We further evaluate that whether an old and simple method, JPEG compression with different quality factors, could work. As shown in Table 16 , it is also poor on adversarial accuracy. To conclude, these methods do not work well in the RaPiD scenario, which is more practical yet challenging.Following [31] , we evaluate the accuracy on a fixed subset of 512 images randomly sampled from whole test data to save computational cost. Besides, because of the number of experiments and the page limit, following [26] , in the content, we only report the results with one seed (42-the answer to the ultimate question of life, the universe and everything). In this section, to show the validity of the results in the content, we additionally repeat two experiments described in Section 4 and Section 4 with another two seeds (41 and 43) . In Table 8 , Table 17 and Table 18 , with a different seed, though the training data and the fixed subset for evaluation vary, leading to accuracy fluctuation, the relative performances of different methods remain the same. Specifically, as illustrated in Section 4, VIT defenders are better at clean accuracy while BERT defenders are likely to outperform at adversarial accuracy. Furthermore, the trends of the corresponding curves in Figure 2 , Figure 4 and Figure 5 are similar. It demonstrates that our experiments are both efficient and effective. • The answer NA means that the abstract and introduction do not include the claims made in the paper. • The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers. • The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings. • It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper. 
experimental setting/details: 
 Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?Answer: [Yes]Justification: See Section 4 and Appendix Section A Guidelines:• The answer NA means that the paper does not include experiments.• The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them. • The full details can be provided either with the code, in appendix, or as supplemental material. 
experiment statistical significance: 
 Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?Answer: [Yes]Justification: See Appendix Section F Guidelines:• The answer NA means that the paper does not include experiments.• The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper. • The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions). • The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.) • The assumptions made should be given (e.g., Normally distributed errors).• It should be clear whether the error bar is the standard deviation or the standard error of the mean. Guidelines:• The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.• If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics. • The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction). 
broader impacts: 
 Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?Answer: [Yes] Justification: See Section 5 and 6Guidelines:• The answer NA means that there is no societal impact of the work performed.• If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact. • Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.• The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 
safeguards: 
 Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?Answer: [NA] Justification: The paper poses no such risks Guidelines:• The answer NA means that the paper poses no such risks.• Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. • We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?Answer: [NA]Justification: The paper does not use existing assets.Guidelines:• The answer NA means that the paper does not use existing assets.• The authors should cite the original paper that produced the code package or dataset.• The authors should state which version of the asset is used and, if possible, include a URL. • The name of the license (e.g., CC-BY 4.0) should be included for each asset.• For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided. • If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. • For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.In the experiments, upscale_factor is always set to 16. Thus, if the scale of the transformer encoder is large, which means the hidden feature is of 1024 dimensions and four channels are given after PixelShuffle, we just ignore the last channel for simplicity. 
 
 Appendix:  


Decision: The recommendation is based on the reviewers' comments, the area chair's evaluation, and the author-reviewer discussion. 

While all reviewers find the studied setting useful and the results provide new insights, in the initial round, reviewers raised several valid questions on the scope and empirical validation. The authors' rebuttal was quite successful and addressed the major concerns of all reviewers. In the final discussion phase, all reviewers suggest that the new results (especially those presented during rebuttal) must be included in the final paper to reach the bar of the publication, which requires a major revision (this will be discussed with SAC). If this paper is to be accepted, we strongly suggest the authors include the new results and improve the presentation for the final version.

Reviews: review: paper_summary: paper_summary: This paper introduces an approach for defending machine learning models against adversarial attacks using transformer-based vision models. The proposed method, Continuous Transfer and Defense (CeTaD), leverages pre-trained transformers as defenders to provide rapid and effective adversarial protection. The approach is evaluated on various datasets, including MNIST, CIFAR-10, CIFAR-100, and ImageNet-1K, to demonstrate its adaptability and effectiveness across different scenarios. However, the approach leads to some impact on classification accuracy.
strength_weakness: strength_weakness: 1. There are many works using purification or denoising methods in this field. Thus, the proposed method is not novel enough. 
2. The paper acknowledges that end-to-end tuning in CeTaD can impact clean data performance, which might be a significant drawback in certain applications​.
3. While the paper evaluates the method on several datasets, the focus remains primarily on image classification tasks. Broader evaluations across other types of tasks and data modalities are needed to fully establish its generalizability.
4. CeTaD's effectiveness relies heavily on the availability and quality of pre-trained models, which might not always be feasible in every scenario.
5. The paper lacks a comprehensive discussion of related works in the field, especially those that use denoising layers and plug-and-play mechanisms.
questions: questions: 1. What are the specific computational requirements for deploying CeTaD in a real-time environment (e.g., memory, latency, efficiency), and how do these requirements scale with the size of the dataset?
2. How does the method handle adversarial examples that are generated using techniques not covered in the evaluation?
3. How does the model perform on black-box attacks or universal perturbations?
limitations: limitations: 1. The paper notes a notable performance gap for CeTaD, particularly in terms of clean data accuracy, when applying end-to-end tuning.
2. While the paper discusses the potential for scaling the method to larger datasets, the actual computational efficiency and scalability remain areas for further investigation​.
3. The current focus is on a single attack method per experiment, which does not fully reflect the diversity of attack methods (e.g., semantic attacks, composite attacks, multiple-threat attacks [1, 2]) encountered in real-world scenarios.

[1] Hosseini and Poovendran. Semantic adversarial examples.

[2] Hsiung et al. Towards compositional adversarial robustness: Generalizing adversarial training to composite semantic perturbations.
paper_summary: paper_summary: This submission studies few-shot tuning-based purification for adversarial defense, especially leveraging pre-trained transformers. By only tuning the normalization layers with few training examples, the proposed defense achieves decent accuracy and robustness.
strength_weakness: strength_weakness: 1. My major concern is the unclear description in both the method description and experimental evaluation (sometimes a bit messy). To name a few:

(1) How does the decoder in Figure 1 work? In my understanding, the decoder should be able to restore the potentially perturbed image. However, existing ViT and language models seem not to be capable of doing so. How does PixelShuffle for superresolution work as a decoder? In my understanding, it should take low-resolution image input which is not provided by the encoder.

(2) What do CA and AA mean? I infer that they are clean accuracy and attacked accuracy in all tables but no place to verify.

(3) When measuring AA, what is the specific attack used? PGD, AutoAttack, and StAdvAttack are mentioned but which one is actually used? Moreover, when using the attack, does the gradient flow go backward through the plug-in defender? When compared with other baselines, this is the required adaptive attack and when compared with other baselines, this defense-then-attack number should be used for fair comparison.

(4) What is StAdv attack? Any setup detail?

(5) What is the dataset in Table 5?

2. The proposed method introduces a large model as a pre-purifier which adds a non-trivial inference overhead. More elaboration on this overhead should be discussed. In what case this overhead can be neglected?

Given these many unclear points, I lean towards rejection.

Minor:
1. Table 1: better to mention method names rather than just numbered brackets for compared approaches.
2. Line 112: hallucinates -> hallucinate
questions: questions: Questions are listed in "Weaknesses" section. The most important one is how the proposed method works given the misaligned encoder and decoder module.
limitations: limitations: Yes, limitations are discussed in Section 5.
paper_summary: paper_summary: The paper proposes CeTaD, a rapid plug-in defender (RaPiD) for deep neural networks (DNNs) against adversarial attacks. It leverages pre-trained transformer models and fine-tunes minimal parameters (e.g., layer normalization) using few-shot clean and adversarial examples. CeTaD aims to quickly counter adversarial perturbations without modifying the deployed model, addressing the limitations of existing methods that require heavy training or struggle to adapt to different scenarios. Experiments on various datasets and attack methods demonstrate CeTaD's effectiveness, transferability, and generalization capabilities.
strength_weakness: strength_weakness: The discussion had limitations of the paper seems to have made this quite clear: It seems that the effectiveness is still not good enough when we consider stronger attacks. It is somewhat unclear how should we compare this with existing defenses
questions: questions: How does CeTaD compare to state-of-the-art defense methods in terms of both effectiveness and efficiency?
Can CeTaD effectively defend against stronger adaptive attacks where the attacker has access to the defender?
What are the underlying mechanisms that contribute to CeTaD's effectiveness? A more in-depth analysis would be valuable.
limitations: limitations: NA
paper_summary: paper_summary: The paper proposes a method called CeTaD (Considering Pre-trained Transformers as Defenders) for the Rapid Plug-in Defender (RaPiD) problem, which aims to rapidly counter adversarial perturbations without altering the deployed model. The method leverages pre-trained transformer models and fine-tunes only a limited set of parameters using clean and adversarial examples.  The paper evaluates the effectiveness of CeTaD in various scenarios and datasets, and compares it with other baselines. The results show that CeTaD achieves superior performance in both clean and adversarial accuracy compared to the baselines. This paper is easy to follow and well-written.
strength_weakness: strength_weakness: * The performance of different l_p bound perturbations should be compared.
* Actually, there are some old defense methods that can also be a plug-in defense, like JPEG compression, which also should be compared.
* Some typo errors, like "Baselines" should be "Baselines."
* The placement of Table 4 and Table 5 are too far from the corresponding content.
* The experiment settings of adaptive attack is not right, in this setting, the plug-in defense is all known to the attacker.
questions: questions: /NA
limitations: limitations: /NA

Comments: title: New results on Stronger attacks
Thanks
New Experimental Results
comment: 1.  framework mechanism
​

​We take the output of the last encoder layer, which is in the shape of (batch_size, patch/sequence_size, hidden_size). Then PixelShuffle rearranges (you could consider it as unfolding channels while increasing spatial resolution) the elements of the last two dimension into the shape of the images (batch_size,  H, W). We will incorporate and clarify this information into the revised version.
Thanks for your effort in conducting additional evaluations to support the research!

1. framework mechanism

Got it. Now I understand what vision embeddings are used. But for the decoder-only transformer model, how to extract the features? Is it the output activation per token before the next-token predictor hand? If so, how are the activations concatenated to form a single feature for PixelShuffle?
I wish to express my sincere appreciation for the invaluable assistance and dedication you have provided during the review process of my paper. Your insightful comments and thoughtful suggestions have significantly contributed to the development and refinement of my work. Your efforts have been of immense help in enhancing the quality and clarity of my research. Thank you for your generous support. It is greatly appreciated. We will incorporate all of your suggestions into the revised version.

**1.framework mechanism**

1) As illustrated in L163-L164 and Figure 1, an image would be processed by the trained embedding from VIT, resulting in the sequence embedding which could be processed by the encoder model. 
Besides, as shown in Figure 1, most parameters are fixed for generalization and robustbess. Only layernorm is tunable. Furthermore, we do additional experiment on tunable parameters in Table 10 for evaluation.

2) The decoder-based transformer model is similar to the encoder-based one, the difference is the attention mask. Thus, we could apply GPT-2 too. However, causal attention could not well extract needed feature, as shown in Table 2.

**2. non-trivial inference overhead**

We evaluate GPU memory (peak value) and inference time (average value per batch) on the test set under other default settings (cifar10) with the following device configuration:

- CPU: 14 vCPU Intel(R) Xeon(R) Gold 6330 CPU @ 2.00GHz

- GPU: 1 NVIDIA RTX 3090(24GB)

Here is the result:

| method | GPU memory (MB) | time (s/batch) |
| --- | --- | --- |
| No-defender | 2186 | 0.07818 |
| CeTaD-BERT | 2638 | 0.08014 |
| CeTaD-BERT-large | 3460 | 0.08496 |

Totally, the defender does not need non-trivial inference overhead. However, with larger pre-trained models, the memory and latency increase accordingly. It is supposed to be a trade-off between defense performance and resource consumption. In practical, the developer could choose the suitable pre-trained model for their device and scenario.

**3. other attacks**

**black-box attack**

Additionally, we also evaluate our method with a pure black-box attack, Square Attack [1] (n_queries=5000), under the default settings. Here is the result on CIFAR-10 indicating that our method is still effective against Square Attack:

Type of attack |method |CA(%)|AA(%)
--- |--- | --- | ---
SquareAttack |None| 93.75 |00.00
||CeTaD-VIT|83.20|74.02
||CeTaD-VIT-large|81.45|75.39
||CeTaD-BERT|82.42|79.30
||CeTaD-BERT-large|84.57 |83.59
L_inf-PGD|CeTaD-VIT| 82.81|30.27
||CeTaD-VIT-large |71.68 |44.14
||CeTaD-BERT |68.75 |44.34
||CeTaD-BERT-large |66.02 |48.83

Our method, CeTaD, demonstrates superior defense effectiveness against black-box attacks compared to L_{\infty}-PGD. Our approach fine-tunes CeTaD using adversarial examples generated from attacks to detect attack patterns and perform defense, without requiring any information about the attack strategies. As a result, it is not limited to any specific type of attack.

**semantic attacks & composite attacks**

We also tested CeTaD’s performance against semantic attacks and composite attacks. The experimental setup was consistent with [2], using WideResNet34 trained on CIFAR-10. CeTaD was trained using a 1-adv-1-clean data setting, with significantly fewer samples than the method in [2], and with a much shorter training time.

Type of attack |method |CA(%)|AA(%)
--- |--- | --- | ---
Semantic attacks |CeTaD-BERT-large|81.23 |64.59
Semantic attacks |R&P|91.2 |3.84

However, our experimental results show that our method achieves good performance against semantic attacks.

Additionally, we also test a composite attack, Composite Adversarial Attack [2] (CAA6: enabled_attack=(0,1,2,3,4,5); order_schedule="scheduled"), under the default settings. The results indicating that our framework is able to adapt to different scenarios by one-shot adversarial fine-tuning.

| method | CA(%) | AA(%) |
| --- | --- | --- |
| None | 93.75 | 00.00 |
| CeTaD-VIT | 85.74 | 61.52 |
| CeTaD-VIT-large | 69.33 | 52.15 |
| CeTaD-BERT | 78.52 | 65.23 |
| CeTaD-BERT-large | 84.18 | 68.36 |

[1] Square Attack: a query-efficient black-box adversarial attack via random search

[2] Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbations
I wish to express my sincere appreciation for the invaluable assistance and dedication you have provided during the review process of my paper. Your insightful comments and thoughtful suggestions have significantly contributed to the development and refinement of my work. Your efforts have been of immense help in enhancing the quality and clarity of my research. Thank you for your generous support. It is greatly appreciated. We will incorporate all of your suggestions into the revised version.
We will incorporate all of your suggestions into the revised version.

**1. memory&latency**

We evaluate GPU memory (peak value) and inference time (average value per batch) on the test set under other default settings with the following device configuration:

- CPU: 14 vCPU Intel(R) Xeon(R) Gold 6330 CPU @ 2.00GHz
- GPU: 1 NVIDIA RTX 3090(24GB)

Here is the result:

| method | GPU memory (MB) | time (s/batch) |
| --- | --- | --- |
| No-defender | 2186 | 0.07818 |
| CeTaD-BERT | 2638 | 0.08014 |
| CeTaD-BERT-large | 3460 | 0.08496 |

With larger pre-trained models, the memory and latency increase accordingly. It is supposed to be a trade-off between defense performance and resource consumption.

**2. other attacks**

**black-box attack**

Additionally, we follow your suggestion to evaluate our method with a pure black-box attack, Square Attack [1] (n_queries=5000), under the default settings. Here is the result on CIFAR-10 indicating that our method is still effective against Square Attack:

Type of attack |method |CA(%)|AA(%)
--- |--- | --- | ---
SquareAttack |None| 93.75 |00.00
||CeTaD-VIT|83.20|74.02
||CeTaD-VIT-large|81.45|75.39
||CeTaD-BERT|82.42|79.30
||CeTaD-BERT-large|84.57 |83.59
L_inf-PGD|CeTaD-VIT| 82.81|30.27
||CeTaD-VIT-large |71.68 |44.14
||CeTaD-BERT |68.75 |44.34
||CeTaD-BERT-large |66.02 |48.83

Our method, CeTaD, demonstrates superior defense effectiveness against black-box attacks compared to L_{\infty}-PGD. Our approach fine-tunes CeTaD using adversarial examples generated from attacks to detect attack patterns and perform defense, without requiring any information about the attack strategies. As a result, it is not limited to any specific type of attack.

**semantic attacks & composite attacks**

We also tested CeTaD’s performance against semantic attacks and composite attacks. The experimental setup was consistent with [2], using WideResNet34 trained on CIFAR-10. CeTaD was trained using a 1-adv-1-clean data setting, with significantly fewer samples than the method in [2], and with a much shorter training time.

Type of attack |method |CA(%)|AA(%)
--- |--- | --- | ---
Semantic attacks |CeTaD-BERT-large|81.23 |64.59
Semantic attacks |R&P|91.2 |3.84

However, our experimental results show that our method achieves good performance against semantic attacks.

Additionally, we also test a composite attack, Composite Adversarial Attack [2] (CAA6: enabled_attack=(0,1,2,3,4,5); order_schedule="scheduled"), under the default settings. The results indicating that our framework is able to adapt to different scenarios by one-shot adversarial fine-tuning.

| method | CA(%) | AA(%) |
| --- | --- | --- |
| None | 93.75 | 00.00 |
| CeTaD-VIT | 85.74 | 61.52 |
| CeTaD-VIT-large | 69.33 | 52.15 |
| CeTaD-BERT | 78.52 | 65.23 |
| CeTaD-BERT-large | 84.18 | 68.36 |

[1] Square Attack: a query-efficient black-box adversarial attack via random search

[2] Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbations
Thanks to the author for the experimental results. My main concerns have been addressed, and I believe these results can further demonstrate the applicability of the proposed approach, especially in defending against unseen attacks. I recommend that the authors incorporate these results into the revision. I have updated my scores accordingly.
Thanks for the response! Most of my concerns are resolved. I adjusted the score accordingly. However, here are follow-up questions:

> 1. framework mechanism

Now I understand how the decoder works here. Then, my questions are: 

(1) For pure language model encoders, such as BERT and GPT-2, how do they perceive images? If you use an image encoder, what is it and are its weights fixed?

(2) For decoder-only transformers like GPT-2, how to attach a decoder like PixelShuffle next to it? GPT-2 does not generate embeddings directly.

> 6. non-trivial inference overhead

It would be great to quantitatively study the overhead across different datasets. For example, I would expect the overhead is too high for MNIST and may be tolerable for ImageNet.
Thank you for your time and effort in reviewing our work, and we really appreciate your support.

There is only 1 day left to the rebuttal deadline, and we would like to know whether our responses can successfully address your concerns. Please also let us know if you have other concerns, and we are more than happy to address them.

Best Wishes

Authors
Thank you for your time and effort in reviewing our work, and we really appreciate your support.

There is only 1 day left to the rebuttal deadline, and we would like to know whether our responses can successfully address your concerns. Please also let us know if you have other concerns, and we are more than happy to address them.

Best Wishes

Authors
Thank you for your time and effort in reviewing our work, and we really appreciate your support.

There is only 1 day left to the rebuttal deadline, and we would like to know whether our responses can successfully address your concerns. Please also let us know if you have other concerns, and we are more than happy to address them.

Best Wishes,

Authors
Thank you very much for your support. We will incorporate all of your suggestions into the revised version.
Thanks for your further comments. We provide a point-to-point response to your concerns. We will incorporate all of your suggestions into the revised version.

**1. memory&latency**

We evaluate GPU memory (peak value) and inference time (average value per batch) on the test set under other default settings with the following device configuration:

- CPU: 14 vCPU Intel(R) Xeon(R) Gold 6330 CPU @ 2.00GHz
- GPU: 1 NVIDIA RTX 3090(24GB)

Here is the result:

| method | GPU memory (MB) | time (s/batch) |
| --- | --- | --- |
| No-defender | 2186 | 0.07818 |
| CeTaD-BERT | 2638 | 0.08014 |
| CeTaD-BERT-large | 3460 | 0.08496 |

With larger pre-trained models, the memory and latency increase accordingly. It is supposed to be a trade-off between defense performance and resource consumption.

**2. other attacks**

**black-box attack**

Additionally, we follow your suggestion to evaluate our method with a pure black-box attack, Square Attack [1] (n_queries=5000), under the default settings. Here is the result on CIFAR-10 indicating that our method is still effective against Square Attack:

Type of attack |method |CA(%)|AA(%)
--- |--- | --- | ---
SquareAttack |None| 93.75 |00.00
||CeTaD-VIT|83.20|74.02
||CeTaD-VIT-large|81.45|75.39
||CeTaD-BERT|82.42|79.30
||CeTaD-BERT-large|84.57 |83.59
L_inf-PGD|CeTaD-VIT| 82.81|30.27
||CeTaD-VIT-large |71.68 |44.14
||CeTaD-BERT |68.75 |44.34
||CeTaD-BERT-large |66.02 |48.83

Our method, CeTaD, demonstrates superior defense effectiveness against black-box attacks compared to L_{\infty}-PGD. Our approach fine-tunes CeTaD using adversarial examples generated from attacks to detect attack patterns and perform defense, without requiring any information about the attack strategies. As a result, it is not limited to any specific type of attack.

**semantic attacks & composite attacks**

We also tested CeTaD’s performance against semantic attacks and composite attacks. The experimental setup was consistent with [2], using WideResNet34 trained on CIFAR-10. CeTaD was trained using a 1-adv-1-clean data setting, with significantly fewer samples than the method in [2], and with a much shorter training time.

Type of attack |method |CA(%)|AA(%)
--- |--- | --- | ---
Semantic attacks |CeTaD-BERT-large|81.23 |64.59
Semantic attacks |R&P|91.2 |3.84

However, our experimental results show that our method achieves good performance against semantic attacks.

Additionally, we also test a composite attack, Composite Adversarial Attack [2] (CAA6: enabled_attack=(0,1,2,3,4,5); order_schedule="scheduled"), under the default settings. The results indicating that our framework is able to adapt to different scenarios by one-shot adversarial fine-tuning.

| method | CA(%) | AA(%) |
| --- | --- | --- |
| None | 93.75 | 00.00 |
| CeTaD-VIT | 85.74 | 61.52 |
| CeTaD-VIT-large | 69.33 | 52.15 |
| CeTaD-BERT | 78.52 | 65.23 |
| CeTaD-BERT-large | 84.18 | 68.36 |

[1] Square Attack: a query-efficient black-box adversarial attack via random search

[2] Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbations
I am satisfied with the rebuttal and thus keep my rate unchanged.
Thanks to the author for the rebuttal. I carefully read the author's rebuttal as well as other review comments. Nonetheless, it appears that some aspects of the weaknesses and questions identified in the initial review have not been addressed in the rebuttal, leaving some pieces of my concerns unresolved. 

First, how the memory and latency scale with the size of the dataset/model remains unclear. Can the authors provide concrete examples to demonstrate this? Second, how does CeTaD handle black-boxed adversarial examples or other unforeseen attacks (e.g., semantic attacks & composite attacks)? This question also remains unanswered. Although white-box attacks are stronger than black-box attacks or universal perturbations, in terms of defense, white-box attacks are easier to defend than black-box attacks. The author's rebuttal does not really convenience me. 

The paper should conduct more thorough evaluations and discussions on the points mentioned above. Therefore, I decided to keep my score.