Enhance the Visual Representation via Discrete Adversarial Training
s
Abstract
Adversarial Training (AT), which is commonly accepted as one of the most effective approaches defending against adversarial examples, can largely harm thestandard performance, thus has limited usefulness on industrial-scale productionand applications.
Surprisingly, this phenomenon is totally opposite in Natural
Language Processing (NLP) task, where AT can even benefit for generalization.
We notice the merit of AT in NLP tasks could derive from the discrete and symbolic input space.
For borrowing the advantage from NLP-style AT, we propose
Discrete Adversarial Training (DAT).
DAT leverages VQGAN to reform the imagedata to discrete text-like inputs, i.e. visual words.
Then it minimizes the maximal risk on such discrete images with symbolic adversarial perturbations.
Wefurther give an explanation from the perspective of distribution to demonstratethe effectiveness of DAT.
As a plug-and-play technique for enhancing the visualrepresentation, DAT achieves significant improvement on multiple tasks includingimage classification, object detection and self-supervised learning.
Especially, themodel pre-trained with Masked Auto-Encoding (MAE) and fine-tuned by our DATwithout extra data can get 31.40 mCE on ImageNet-C and 32.77% top-1 accuracyon Stylized-ImageNet, building the new state-of-the-art.
Introduction
Nowadays, Deep Neural Networks (DNNs) has achieved excellent performance surpassing humansin most computer vision tasks.
Although remarkable progress has been made, the success of DNNs isactually a false sense when i.i.d hypothesis is not satisfied in wild.
Researchers have shown that deepmodels fail in most circumstances including adversarial perturbations [1], common corruptions [2],colors or textures changing [3, 4] etc.
There is still a long way to make DNNs closer to the robusthuman perception.
A possible way towards robust machine perception can be Adversarial Training (AT) [5], whichautomatically finds failure input cases of DNNs and augment online with these cases for fixing "bugs".
With online augmentation of adversarial examples, AT greatly enhances the adversarial robustness,and helps for learning perceptually-aligned representations [6] with good interpretability [7, 8]and transferability [9].
However, AT is double-edged, which meanwhile degrades the standardperformance caused by problematic regularization [10].
Such problematic regularization makes thedecision boundaries over-smoothed and enlarges indecisive regions.
Surprisingly, previous works [11, 12] observe a strange phenomenon that AT behaves converselyin Natural Language Processing (NLP) tasks.
By automatically finding adversarial textual inputs,
AT will not hurt the accuracy and even benefit for both generalization and robustness of languagemodels.
This phenomenon motivates us considering whether the merit of NLP-style AT can betransferred to vision tasks.
We notice such merit could derive from the unique data organizingform of language models.
To be specific, an adversarial image perturbed in continuous pixel spaceactually differs with the truly "hard" examples appeared in real world.
Contrarily, text space isdiscrete and symbolic, where adversarial text is practically existing when a typo is made by humans.
Learning on such adversarial text will obviously improve the generalization on other more texts withconfusing typos.
Therefore, we borrow the symbolic nature of languages, and apply it on CV tasks bydiscretizing continuous images into a more meaningful symbolic space.
Afterwards, AT is conductedfor minimizing the maximal risk on such text-like inputs with symbolic adversarial perturbations.
In this paper, we propose Discrete Adversarial Training (DAT), a new type of adversarial trainingwhich aims to improve both robustness and generalization of vision models.
DAT leverages VQGAN [13] to learn a vocabulary of visual words, also known as image codebook.
For a continuousimage input, each encoded patch embedding is replaced with its closest visual word in the codebook,and represented as a corresponding index.
Then the image is transformed to a sequence of symbolicindices similar with language input.
For generating adversarial examples based on such symbolicsequence, direct use of optimization methods in NLP like combinatorial optimization [14, 15, 16] orsynonym substitutions [14, 16] can be challenging.
The reason lies in: 1) the large search space ofimages and 2) the non-existence of synonym in visual codebook.
To make it more efficient, DATadopts a gradient-based method which assumes the backward adversarial gradient goes straightthrough the complex discretization process, thus gradients on discretized image can be copied tooriginal input.
Then it use one-step search along the direction of estimated gradient such that thediscrete representation will altered adversarially during the discretization process, resulting a discreteadversarial examples.
Finally the discrete adversarial examples is fed into models for training.
Different from AT which always adds l p bound on augmented adversarial examples, DAT affects thediscretization process to produce diverse adversarial inputs beyond l p bound for training.
We show inablation experiment that DAT not only enhances the robustness on l p bounded attacks, but also ispartly beneficial in defense of unrestricted semantic attacks [17, 18].
The overall pipeline of discreteadversarial training is shown in Figure 1.
We further give an analysis to explain the effectiveness of our DAT from the perspective of distribution.
By comparing the distributional difference of training examples in AT and DAT with clean images,we find the discrete adversarial examples in our DAT are much closer to the clean distribution.
Such ability of generating "in-distribution" adversarial examples makes DAT can improve the visualrepresentation learning on multiple vision models and tasks, with no sacrificing of clean accuracy.
Our contributions are summarized below:
• To the best of our knowledge, we appear to be the first to transfer the merit of NLPstyle adversarial training to vision models, for improving robustness and generalizationsimultaneously.•
We propose Discrete Adversarial Training (DAT), where images are presented as discretevisual words, and the model is training on example which has the adversarially altereddiscrete visual representation.• DAT achieves significant improvement on multiple tasks including image classification,object detection and self-supervised learning.
Especially, it establishes a new state-of-the-artfor robust image classification.
By combining MAE [19] pre-training and DAT fine-tuning,
our ViT-Huge [20] achieves 31.40 mCE on ImageNet-C [2] and 32.77% top-1 accuracy on
Stylized-ImageNet [3].
Related Work
Adversarial Training Adversarial Training (AT) [5] is first proposed to improve robustnessby training models with adversarial examples.
As one of the most effective defense, existing works [21, 22] have suggested a trade-off between adversarial and clean accuracy in AT.
Despitegreat efforts [23, 24, 25] have been made for mitigating this trade-off, the bad generalization of
AT still cannot be fully remedied till now.
In opposite way, some other works [26, 27] use ATto improve the clean accuracy rather than adversarial robustness.
The most close work to ours isthe AdvProp [26], which splits batch norms to prevent the mixed statistics of clean and adversarialexamples, thus learns better adversarial feature for generalization.
Pyramid AT [28] makes AT specificto ViTs by crafting pyramid perturbation with Dropout enabling, yielding imporved performance.
However, these methods are only applicable under specific models or tasks.
VILLA [29] is also arepresentation enhancement technique using AT.
But contrary to us, it applies vision-style AT only forvision-and-language representation learning.
AGAT [30] is another kind of AT beyond pixel space,which perturbs images along attributes, however it has strict requirement of attributes annotation.
Adversarial Augmentation
By borrowing the idea of AT, some previous works [31, 32, 33] proposeto search augmentations adversarially for improving the hardness of training examples.
Adversarial
AutoAugment [31] uses augmentation policy network to produce hard augmentation policies on apre-defined policy space.
AugMax [32] mixes multiple randomly sampled augmentation operatorslike AugMix [34], by using adversarially learned mixing factors.
AdA [33] optimizes the parametersof image-to-image models to generate adversarially corrupted augmented images.
MaxUp [35] usesthe worst augmented data of each data point in a set of random perturbations or transforms for training.
However, these methods create adversarial inputs indirectly and rely on pre-defined augmentations ortranslation models.
They cannot perturb the images locally.
Instead, our DAT directly modifies theimage with no need of pre-defined transforms, and can craft local perturbations on images, which ismore elaborate.
Discrete Visual Representation Learning Early technique [36, 37] of Bag-Of-Visual-Words(BOVW) model has shown great power of discrete representation in visual understanding.
VQVAE [38] uses DNNs to learn neural discrete representations, also known as visual codebook, bygenerative modeling the image distribution.
Recently, the idea of discrete representations learning hasbeen widely emerged in many vision tasks.
In most Masked Image Modeling (MIM) methods [39, 40],visual codebook is needed for BERT-like self-supervised pretraining.
For image classification, discreterepresentations strengthen the robustness by preserving the global structure of an object and ignoringlocal details [41].
For image synthesis, adversarial and perceptual objective can be added to VQ-VAEfor learning perceptually-aligned visual codebook [13].
With growing power of generative models,now a well trained VQGAN can produce vivid images with 0.58 FID [42].
In this work, we use
VQGAN for the discretization process in our DAT.
As a powerful generative model, VQGAN cangreatly reduce the information loss in reconstruction process and ensure the high-quality of thegenerated discrete adversarial examples.
Method
3.1 Traditional Adversarial Training
We take the typical image classification task as an example to show the formulation of Adversarial
Training (AT).
Consider the training image and label set D
= { x i , y i } ni =1 , and a classifier Fwith learnable parameters θ , the classification objective is always a cross-entropy loss L ( x, y, θ ) .
Adversarial Training (AT) finds the optimal θ by solving a minimax optimization problem:
[Equation]
where the inner optimization finds the perturbations δ on per-pixel values for maximizing the loss,and the outer minimization update θ to improve the worst-case performance of the network w.r.t.
theperturbation.
∥ · ∥ p constraints the p -norm of δ to a small value ϵ .
A problem is that AT finds thefailure case i.e. x + δ in continuous pixel space.
However, human does not create or recognize imagesfrom complex pixel values, but from discrete semantic concepts.
Although adversarial examplescan successfully fool the models, they are still different from the real "hard" examples appeared inpractice.
Find the worst 𝜹 by
𝐦𝐚𝐱 𝜹 𝓛
( 𝓠 𝒙 + 𝜹 , 𝒚 , 𝜽 )
Update model parameters 𝜽 by 𝐦𝐢𝐧 𝜽
𝓛 ( 𝓠 𝒙 + 𝜹 , 𝒚 , 𝜽 )
Enc 2 0 10 1 3
Dec
Codebook 𝓩
N … … 0 1 22 3 10 1 3
Visual Tasks
Self-Supervised Learning 00.20.40.60.81 cat tiger lion dog
Classification
Object Detection ∇ !"
ℒ 𝛿
ForwardDataFlow
Backward Gradient Flow Straight-Through Gradient ⨁
Straight-Through Gradient Flow 𝑥 + 𝛿 𝑥 𝑥
#$% =
𝒬 ( 𝑥 + 𝛿 ) * 𝑥 = 𝒬 ( 𝑥 )
3.2 Discrete Adversarial Training
3.2.1 Image Discretization by Visual Codebook
For discrete adversarial training, it is desirable first to learn an expressive visual codebook and represent the training image set in discrete space.
We utilize VQGAN [13] for image discretization.
Moreprecisely, consider a continuous image x ∈ R H
× W × 3 , VQGAN learns an encoder Enc ϕ ( · ) , decoder
Dec ψ ( · ) and quantization q Z ( · ) .
Enc ϕ is a convolutional model which maps x to intermediate latentvectors v =
Enc ϕ ( x ) ∈ R
( h × w ) × d , where h, w is the height, width of the intermediate feature mapand d is the latent dimension.
Subsequently, q Z ( · ) learn a codebook Z
= { z k | z k ∈ R d } Kk =1 , suchthat each latent vector v ij ∈ R d can be quantized onto its closest codebook entry z k as:
[Equation]
where i, j present each location in feature map.
Then the decoder Dec ψ ( · ) outputs the reconstructionimage ˆ x from the quantized vectors v q by:
[Equation]
VQGAN is trained by minimizing the reconstructed difference between ˆ x and x .
More details can bereferred to Appendix A. So far, given a continuous image x , we can get its corresponding discretereconstruction
ˆ x .
For simplicity, we use Q to stand for the above image discretization process, andthen we have ˆ x = Q ( x ) .
3.2.2 Discrete Adversarial Training
Based on the definition in Sec 3.2.1, we can generate discrete adversarial examples in inner maximization step of AT.
By slightly modifying the Eq 1, the objective of DAT is formulated as:
[Equation]
where Q transforms the continuous pixel space to discrete input space.
We delete the constraint termsince there is no need to bound the per-pixel values of δ .
Suppose that Q is an ideal discretizer withno information loss in discretization process.
The problem lies how to find the worst δ for maximizingthe classification loss.
Similar with traditional AT, we can use gradient-based methods to approximateδ by:
[Equation]
where α determines the magnitude of the perturbations along the gradient direction.
We set α = 0 .
1by default in DAT.
To expand ∇ x L ( Q ( x ) , y, θ ) by chain rule, we have four partial derivative termsas follows:
[Equation]
← discrete adversarial
Through analysing the feasibility of each term, we find only ∂v q ∂v is hard to solve as the nondifferentiable nature of Eq 2.
Fortunately, as proposed in previous work, a straight-through gradientestimator [43, 44] can be used by copying the gradients from v q to v .
By replacing ∂ ˆ x ∂v q · ∂v q ∂v with∂
ˆ x∂v , we can simplify the Eq 6 to ∇ x L ( Q ( x ) , y, θ ) =
∂
L ∂ ˆ x · ∂ ˆ x∂v · ∂v∂x , which has derivative everywhere.
Although the solution seems workable theoretically, the huge cost makes it impractical on large-scalevision tasks.
The bottleneck mainly lies on that ∂ ˆ x∂v and ∂v∂x require the adversarial gradients backwardthrough Enc and Dec .
Actually, a generator capable of producing high-quality images always has alarge amount of parameters.
Compared with original adversarial training which only needs F forgradient calculation, it requires more than tripled GPU memory and computation cost.
[Figure]
distributional difference with clean images.
(a), (b) present the difference on mean and variance statistics respectively.
To solve this problem, we propose an efficientalternative solution.
Since ˆ x ≃ x is empiricallyobserved for an ideal discretizer Q , we can alsouse a straight-through estimator between ˆ x andx , which is given by
[Equation]
Finally, we can solve the worst δ by∇ ˆ x L
(ˆ x, y, θ ) .
By this way, the computationcost of DAT has been largely reduced.
Compared with original adversarial training, it onlyhas extra computation cost on VQGAN forward, which is relatively controllable.
For clarity, let us restate the pipeline of our DAT.
For each training image x , DAT first use VQGANto get discrete reconstruction ˆ x .
By feeding ˆ x to classifier F , a worst-case perturbation δ can beestimated by computing the gradient of ˆ x towards maximizing the classification loss.
The perturbedimage thus can be created by adding δ on original x .
Finally, x + δ is discretized by VQGAN againand acts as the adversarial input, on which F is trained by minimizing the classificaiton loss.
Thedetails of our DAT is summarized in Algorithm 1.
Explaining the Effectiveness of DAT from the Perspective of Distribution We give an empiricalanalysis to explain why DAT can improve the robustness and generalization without sacrificing cleanaccuracy.
Previous work [26] has pointed out that the underlying distributions of adversarial examplesare different from clean images.
Training on both clean and adversarial images will force the Batch
Normalization (BN) [45] to estimate an inaccurate mixture statistics of feature distribution, and thusimpact the standard performance.
We study this effect by sampling 1000 mini-batches in ImageNetvalidation set, and generate corresponding adversarial images for AT and our DAT.
For each batchwe calculate the mean and variance statistics of last BN of ResNet50.
Then the Pearson correlationcoefficient (PCC) between the statistics on clean and adversarial examples is computed for showingthe distributional difference.
Figure 2 shows the frequency histogram of the distributional differenceon 1000 mini-batches.
For training samples of DAT, the peak of the histogram is at 0.95, which isgreater than AT.
It suggests that DAT generates discrete adversarial examples much closer with the clean distributions.
Therefore, training on these examples will reduce the shift of clean distribution in
AT, yielding both the robustness and generalization improvement.
Experiments
To demonstrate the versatility of our method, we experiment Discrete Adversarial Training (DAT) onmultiple tasks including image classification, object detection and self-supervised learning.
4.1 Image Classification
Implementation We implement DAT on two representative architectures: ResNet50 [46] and
ViTs [20].
For ResNet50, we first experiment DAT with vanilla training recipes using "robustness"library 1 .
Then we combine DAT with other orthogonal robust training techniques: DeepAugment [47]and AugMix [34].
Only cross entropy loss is used for generating discrete adversarial examples.
The
JSD loss in AugMix is optimized merely on clean samples.
For ViTs, we adopt ViT-B/16 asbaseline models, which is trained by the recipes in AugReg [48].
Besides, we use DAT to conductsupervised finetuning on downstream ImageNet classification task based on a self-supervised ViTHuge pretrained by MAE [19].
By default, we refer ViT to ViT-B/16 in all tables and figures.
Benchmarks The trained model is evaluated in three aspects: 1) in-distribution performance on
ImageNet-Validation set; 2) adversarial robustness on white-box FGSM [49] and transfer-basedblack-box attack dataset DamageNet [50]; 3) out-of-distribution robustness on ImageNet(IN)-A,
IN-C, IN-V2, IN-R, IN-Sketch and Stylized IN.
Each of them represents a type of out-of-distributionscenario where the classifier is prone to make mistakes.
IN-A [51] places the ImageNet objects inhard contexts; IN-C [52] applies a series of noise, blur, digital and weather corruptions; IN-R [47]collects online images with artificial creation, e.g., cartoons, graphics, video game renditions, etc;
IN-Sketch [53] contains images described by sketches; Stylized IN [3] destroys the texture butmaintains the shape feature by conducting style transfer on ImageNet images.
Except for IN-C whichis measured by mCE, we report the top-1 accuracy on all above datasets.
Results We report all results in Table 1.
For fair comparison, we add DAT on base methods withoutmodifying the original training hyper-parameters, such that improvement is entirely attributed to the
DAT.
For ResNet50, DAT achieves significant improvement on both clean accuracy, adversarial andout-of-distribution robustness.
The improvement seems greater when combining DAT with DeepAugment and AugMix.
For ViTs, we find DAT is compatible with other complex augmentations suchas MixUp [54], CutMix [55] or RandAugment [56] used in AugReg, yielding greater improvement.
Compared with plain ViT, AugReg-ViT and ViT with discrete representation called DrViT [41], DATwith AugReg achieves better performance.
The best result is from ViT-Huge pretrained by MAE [19]and finetuned by DAT, which suggests DAT is also effective in downstream fine-tuning tasks.
Additionally, we also compare DAT with other robust training strategies in Table 2.
AugReg-ViT isadopted as the baseline model.
Most strategies, e.g., AdvProp [26] and Debiased [57] are proposedfor ResNet with auxiliary BatchNorm.
We show these methods cannot work properly on ViTs withonly LayerNorm.
Compared with Pyramid AT [28], our DAT has lower clean accuracy but yieldsstronger robustness.
More results of strategies comparison on ResNet50 refer to Appendix B.
4.2 Self-Supervised Learning
Implementation We experiment DAT on three self-supervised methods: SimCLR [58], SimSiam [59] and recently proposed MoCov3 [60].
The discrete adversarial training is only conductedduring pre-training stage, and the learned representation is evaluated on downstream tasks by standardpipeline [61].
We craft adversarial examples based on RoCL [62], which attacks the pre-trainingobjective by maximizing the contrastive loss.
For preventing the cost explosion, we pre-train
[Table]
DAT on
[Table]
Benchmarks For self-supervised learning, we adopt ImageNet-1K for both training and indistribution testing.
Beyond that, in order to give more comprehensive assessment, we build threedownstream tasks to metric the transferability of the learned visual representation.
Specifically,the linear evaluation reports the top-1 accuracy on five classification datasets: Flowers, CIFAR10,
Caltech101, Cars and DTD.
For downstream evaluation of object detection, we present mAP, AP50,
AP75 on Pascal VOC2007 [63].
ADE20K [64] is used for semantic segmentation task, and both themean intersection over union (mIoU) and accuracy are reported.
Results As shown in Table 3, DAT can enhance the learned representation on ImageNet andget 0.97%, 0.58% and 0.25% improvement on MoCov3, SimCLR, SimSiam respectively.
Forexcluding that DAT is not just over-fitting on ImageNet, we transfer the representations on downstreamrecognition, object detection, semantic segmentation tasks.
The results suggest that DAT enhances theself-supervised representations with better transferability.
In particular, MoCov3 with DAT achievessignificant improvement in all downstream tasks.
This conclusion echoed with previous works [9],which find adversarially robust models often perform better on transfer learning.
4.3 Object Detection
Implementation We implement DAT on two popular detectors: EfficientDet [65] and YOLOv3 [66].
Object detection generally has two sub-tasks: classification and localization.
Det-AdvProp [67]proposes to select more vulnerable sub-task to generate adversarial images, and use auxiliary BN fortraining.
Instead, DAT regards the two sub-tasks as a whole, and attacks the overall detection loss toproduce adversarial images.
Besides, DAT does not modify BN in detectors.
As the memory andcomputation cost of VQGAN increased quadratic with the input resolution, DAT become unaffordablewhen input size is large.
Therefore, we only experiment DAT on lightweight version of EfficientDetand YOLOv3 with input size smaller than 512.
Benchmarks We train the detectors using the COCO 2017 object detection dataset [68] and evaluatethem on COCO’s validation set.
COCO-C [69] is used for testing the robustness to natural corruptions.
[Table] [Table]
[Table]
Results We compare the detectorswith DAT, Det-AdvProp [67] and vanillatraining in Table 4.
Although DetAdvProp has been shown effective on
EfficientDet with size larger than D0,we find on smaller detectors, the promotion of Det-AdvProp is subtle.
On
EfficientDet-Lite0 and YOLOv3-320,it even gets worse on COCO mAPthan vanilla training.
While our DATachieves better result on both clean andcorrupted input.
EfficientDet-Lite0 with
DAT get 27.3 and 17.89 mAP on COCOand COCO-C, resulting in 65.53% Relative rPC.
By comparison, vanilla YOLOv3 models have lower Relative rPC, showing it is morevulnerable than EfficientDet at same clean mAP.
After equipped with DAT, YOLOv3-320 can get20.55 mAP on COCO-C, leading to 7.75% improvement on rPC.
4.4 Ablations
Impact of the Codebook in DAT A general understanding is that the codebook with larger Kshould have stronger representation power.
As suggested in Table 5, when the K is reduced from16384 to 256, the FID of generated images increases 0.35.
We show DAT on larger codebook size canachieve better generalization.
However, the clean accuracy seems no improvement with increasing of
K .
We think the reason is that the reconstruction quality has already met the demand of DAT.
Andthe improvement on clean accuracy is saturated when K further increases.
Different Types of Discretizer Q
Our work is based on the hypothesis of an ideal Q with no lossin discretization process.
However, such perfect Q is not existing in practice.
So we study if and howthe ability of Q affects the performance of our DAT in Table 5.
The results show DAT performs betterby using discretizer with higher FID.
We find clean accuracy declines 1.3% on DALL-E, showing itis important for choosing a powerful discretizer.
Types of pre-training datasets have little impact.
Wefind the discretizer pre-trained on OpenImages [70] and transferred to discretize ImageNet images,can also achieve comparable results.
The Performance on Different Magnitude α
We present the DAT results on ResNet50 and ViTwith different magnitude α in Figure 3.
α = 0 means the model is only trained on images augmentedby VQGAN with no adversarial training process.
We show DAT with α = 0 makes the models havehigh clean accuracy but the lowest robustness.
With the increase of α , there is still a robustness andaccuracy trade-off.
DAT with α = 0 .
4 on ResNet50 achieves the best adversarial robustness butgeneralization is getting worse.
By contrast, we surprisingly find ViT has the lower sensibility on α .
Even if ViT is trained on DAT with α = 0 . 4 , there is still no great drop of clean and OOD accuracy.
We suspect that ViT is more suitable for training on discrete examples, and the strong modelingability makes ViT greater than ResNet50.
[Figure]
��� ��� ��� ��� ��� ���������
[Figure]
���� ���� ���� ����
[Figure]
��������
[Figure]
��� ��� ��� ���
[Figure]
���������
[Figure]
���� ���� ���� ���� � � � � �
[Figure]
� � � � � �
[Figure] � � � � � [Figure] Results on Stronger Attacks In the main experiment, only one-step FGSM is used for examiningthe robustness under white-box adversarial attacks.
To give more comprehensive evaluation, weadditionally test our DAT under stronger AutoAttack [73], and two unrestricted attacks named AdvDrop [17] and PerC-Adversarial [18].
The result is shown in Figure 4.
DAT brings the improvementof robustness under all three attackers.
ViT trained with DAT achieved extremely high robust accuracyon PerC-Adversarial, which suggests DAT also effects well in defense against unrestricted adversarialattacks.
More details can be referred to Appendix C.��� ��� ��� ��� ��� ���� ��� ���� ���� ���� ���� � � � � � � � � �� � � � � � �������� ������������ ��� ������� (a) AutoAttack [73] ���� ���� ���� ���� ���� ������������������ ��� ���� ���� ���� ���� � � � � � � � � �� � � � � � �������� ������������ ��� ������� (b) AdvDrop [17] �� �� �� �� �� ����������������� ��� ���� ���� ���� ���� � � � � � � � � �� � � � � � �������� ������������ ��� �������
[Figure]
Limitations and Conclusions
In this paper, we find transferring NLP-style adversarial training to vision models can enhance thelearned visual representation effectively.
We propose Discrete Adversarial Training (DAT), whereimages are presented as discrete visual words by VQGAN, and the model is training on exampleswhich have the adversarially altered discrete visual representation.
DAT needs not to modify themodel architecture and works for both CNNs and ViTs across multiple tasks.
DAT reports the state-ofthe-art robustness on ImageNet-C and Stylized-ImageNet, exhibiting strong generalization.
However,
DAT still costs increased training time, this limitation also holds for any adversarial training.
Thestrict assumption of an ideal discretizer is another potential limitation, despite DAT has used powerful
VQGAN model to approach this assumption.
Overall, this work is an empirical exploration of visualadversarial training in discrete space.
All the above limitations are remained as the future optimizationdirection, and we will further seek for more deeper theoretical explanation of the effectiveness ofdiscrete representation in the next work.
Checklist
For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper’s
contributions and scope?
[Yes]
(b) Did you describe the limitations of your work?
[Yes]
(c) Did you discuss any potential negative societal impacts of your work?
[No] There are
no negative societal impacts needed to discuss.
(d) Have you read the ethics review guidelines and ensured that your paper conforms to
them?
[Yes]
If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results?
[N/A]
(b) Did you include complete proofs of all theoretical results?
[N/A]
If you ran experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experi-
mental results (either in the supplemental material or as a URL)?
[Yes]
(b) Did you specify all the training details (e.g., data splits, hyperparameters,
how they
were chosen)?
[Yes]
(c) Did you report error bars (e.g., with respect to the random seed after running experi-
ments multiple times)?
[No] The experiment is expensive and need long time, so
we
couldn’t run multiple times
(d) Did you include the total amount of compute and the type of resources used (e.g., typeof GPUs, internal cluster, or cloud provider)?
[Yes] See in Appendix
If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators?
[Yes]
(b) Did you mention the license of the assets?
[Yes]
(c) Did you include any new assets either in the supplemental material or as a URL?
[No]
We do not release new assets
(d) Did you discuss whether and how consent was obtained from people whose data you’re
[Table]
using/curating?
[N/A]
[Table]
(e) Did you discuss whether the data you are using/curating contains personally identifiable
[Table]
information or offensive content?
[N/A]
[Table]
If you used crowdsourcing or conducted research with human subjects...
[Table]
(a) Did you include the full text of instructions given to participants and screenshots, if
[Table]
applicable?
[N/A]
[Table]
(b) Did you describe any potential participant risks, with links to Institutional Review
[Table]
Board (IRB) approvals, if applicable?
[N/A]
[Table]
(c) Did you include the estimated hourly wage paid to participants and the total amount
[Table]
spent on participant compensation?
[N/A]
[Table]
The Appendix is organized as follows.
Appendix A extends the discussion on training of VQGAN.
Appendix B presents more experimental results including comparison of robust training strategies,effect analysis on different perturbations, images corruptions and inference with the discretizer Q .
Besides, we analyse the training budget of our DAT.
Appendix C discusses the implementation detailsof the three attackers in ablation experiments.
Finally we do some visualizations in Appendix D.
A Details of Training VQGAN
We add more details about how VQGAN can be trained to discretize a continous image.
The forwardpass of VQGAN has been introduced in Sec 3.2.1.
Suppose a reconstructed image ˆ x , the trainingobjective for VQGAN is defined between ˆ x and x as:
[Equation]
where ∥ x − ˆ x ∥ precept is the perceptual reconstruction loss instead of L 2 loss, sg [ · ] denotes the stopgradient operation, and ∥ sg [ v q ] − Enc ( x ) ∥ 22 is the commitment loss [38].
A patch-based discriminator
D is introduced for improving the quality of generated images by adversarial learning [74].
In this work, we use the pre-trained VQGAN weights for DAT directly, which are opened on GitHub 34 .
VQGAN with f = 8 , d = 4 and K = 16384 is used for main experiments.
We acknowledge theauthors of [13, 42], whose works have greatly promoted our DAT.
B More Experimental Results
[Table]
B.1 Strategies Comparison on ResNet
[Table]
Table 6 presents the comparison results of DAT with other robust training strategies on ResNet50.
Note that Advprop, Fast Advprop and Debiased use auxiliary BN while Pyramid AT and DAT not.
[Table]
Advprop achieves the best clean accuracy.
The reason may lie in the auxiliary BN reduces the impact
[Table]
of adversarial examples on standard performance.
On ResNet50, DAT is not always the best on therobustness benchmarks.
By augmenting with the style transferred data, Debiased achieves best on
IN-C, IN-Sketch and Stylized IN.
On the contrary, such robust training method proposed for ViTs,
[Table]
e.g. Pyramid AT, is not incompatible with ResNet50 and obtain unsatisfactory results.
However, our
DAT is a general method which works for both CNNs and ViTs
[Table]
and can be more practical.
[Table]
B.2 DAT with Different Perturbations
Table 7 counts for the percentage of the modified visual words with different magnitude α .
Weshow only 3.8% of the visual words are changed when we set α as 0.1.
This proportion doesnot have negative impact on the trained models, but even somewhat benefits the clean accuracy.
With larger proportion of visual words being adversarially altered, the standerd performance and
[Table] [Table]
[Table]
generalization are getting worse.
We also experiment DAT with random perturbations.
To introducingthe randomness, we selects 3.8% visual words and replaces them with other words.
We find thisoperation can slightly improvement the generalization of learned representation, but it still cannotachieve the comparable effect as our DAT.
It suggests adversarially altering the visual words is abetter way.
[Table]
B.3 The Effect of DAT on Corruptions in ImageNet-C
To analyse the effect of DAT on each image corruption in ImageNet-C, we report the detailed resultsin Table 8.
For ResNet50, we find DAT reduces the accuracy on images with contrast and fogcorruptions.
It demonstrates that ResNet50 trained by DAT can be sensitive to the image lack of thehierarchy.
However, for ViT, DAT can improve the performance on all corruptions.
It suggests DATworks more efficiently on transformer-based vision models
[Table]
B.4 Training Budget for DAT
DAT is experimented on 32 2080Ti GPUs.
We compare the training cost with other robust trainingstrategies in same setting.
The results is shown in Table 9.
DAT only needs one attack step togenerate discrete adversarial examples, which makes it less expensive than standard adversarialtraining.
However, DAT still requires 3.5 × training budget than normal training.
We believe thatreducing the cost of DAT is necessary, which will be remained as the future work.
[Table]
B.5 Inference with the Discretizer Q
In this work, we delete the discretizer Q at inference time.
However, there is another option thatremaining the discretizer for test inputs.
To study the effect of this alternative, we report someresults in Table 10.
Although inference with Q brings improvement on adversarial robustness, itmeanwhile harms the standard performance and generalization.
The inference cost also increases bythe additional computation on Q .
Therefore, such alternative cannot yield the best trade-off on speedand performance, which is not adopted by our DAT.
ImageNet
Adversarial Robustness
Out of Distribution Robustness Methods
FGSM
DamageNet
A
C ↓
V
R
Sketch
Stylized
ResNet50 + DAT (w/o Q ) 76.
10.8 ResNet50 + DAT (w/ Q ) 74.
10.16 ViT
[Figure]
DAT (w/o Q
[Figure]
23.13 ViT
[Figure]
DAT (w/ Q ) 80.
[Figure]
B.6 Is it necessary for bounding δ ?
Traditional adversarial attacks always add constraints on perturbations.
While in this work, thereare no restrictions on δ .
To explore if bounding δ is necessary in DAT, we add l ∞ bound on δ withdifferent ϵ and re-run the DAT.
The result is shown in Table 11, DAT achieves best performance whenδ is not bounded.
The worst result is appeared when δ is bounded with ϵ = 1 / 255 .
With larger ϵ , theresults become better.
Therefore, it seems bounding δ in our DAT is not necessary, and even playsnegative affect on the overall performance.
[Table]
C Implementation of the Stronger Attacks in Ablation Experiments
For AutoAttack, we attack a subset of ImageNet provided in RobustBench 5 , which consists of 5000images.
Three perturbations bounded with l ∞ -norm of 1 / 255 , 0 .
5 / 255 and 0 .
25 / 255 are adopted.
For AdvDrop, the test dataset is 1000 random sampled images on ImageNet, which is provided inthe official implementaton 6 .
The bound of the quantization table is a key factor in AdvDrop whichcontrols the attack strength.
We use three bounds with 10, 15 and 20 to regularize the quantizationtable.
For PerC-Adversarial, we use the Perceptual Color distance Alternating Loss (PerC-AL)method to generate adversarial examples.
PerC-Adversarial uses the test data of Defense Against
Adversarial Attack Challenge in NeurIPS 2017.
We change the attack strength by three differentattack iterations: 20, 40 and 60.
[Figure]
Original 𝛼 = 𝛼 =0.
𝛼 =0.
𝛼 =0. 𝛼 =0.
D VisualizationD.1 Attention Visualization
We visualize the attention of ViT trained by DAT in Figure 5(b).
For the object with unusual renditionsin ImageNet-R, ViT cannot attend to semantically relevant image regions.
While our DAT can locatethe attention to the central object more related for the classification.
This phenomenon is also reflectedby the statistical average of the attention in Figure 5(c).
By randomly sampling 1000 images in
ImageNet-R and averaging the attention maps, we find the attentions of our DAT are more global.
Compared with ViT which puts much attentions on the corners of the image found by prior work [20],our DAT additionally attends the central regions in where the classified object is often located.
D.2 Shape-bias Analysis
We conduct an analysis based on shape-bias, which represents the fraction of correct decisions basedon object shape.
The result is shown in Figure 5(a).
The averaged scores on 16 categories is denotedby the colored vertical line.
We compare decisions with Humans, ResNet50 w/ and w/o DAT, ViT w/and w/o DAT.
Human decisions are highly based on shape, which achieve the best average fraction of0.96 to correctly recognize an image by shape.
By comparison, ViT and ResNet50 still have largegap with humans on the ability of learning shape features.
In this work, we find our DAT can help forimproving the fraction of shape-based decisions of models.
It suggests DAT regularizes the models tolearn texture independent shape features, and behave more like a human.
D.3 Comparison of the Reconstruction Quality
We compare the reconstruction quality of different discretizers Q in Figure 6.
VQGAN withk =
16384 and f = 8 can retain the most of the image details, which has the least impact on theclassification models when used for training.
With the growing of the downsampling factor f , somefine-grained attributes of the objects can be changed.
For example, in third row the spotted texture onthe peacock’s tail is partly lost after reconstruction.
Compared with VQGAN models, DALL-E blursthe image to a greater extent, yielding a low quality reconstructed image.
Accordingly, DAT whichuses DALL-E for image discretization performs worst on clean accuracy in Table 5.
It shows that thereconstruction quality is indeed proportional to the standard performance in DAT.
D.4 Visualization of Discrete Adversarial Examples
We visualize the discrete adversarial examples which is generated by DAT for training in Figure 7.
With the growing of α , the alteration on images become larger.
However, different from traditionaladversarial example which essentially adds global high-frequency noise on images, we find DATmodifies the properties of the local part of the object.
For example, in the fifth row of Figure 7, thediscrete adversarial example is changing the eye color of the cat.
Such modification is large butimperceptible and semantic-preserving.
There are also some failure case where DAT changes thesemantics.
In sixth row of Figure 7, after discrete reconstruction, the otter in image looks more like adog.
We believe that such cases are only a minority, and will not affect the overall performance of
DAT.
D.5 Comparing Discrete Perturbations with Traditional Pixel-Space Perturbations
DAT claims using discrete representation can help for crafting more meaningful semantic perturbations.
To give more evidence for the above point, we compare the proposed Discrete Adversarial
Examples (DAEs) with traditional pixel-space Adversarial Examples (AEs) in Figure 8.
Discreteperturbations have following three superior properties:
80 c o l o r s 111 c
o l o r s 222 c
o l o r s 187 c
o l o r s 184 c
o l o r s 241 c o l o r s
Discrete AEs (Ours) Original Image
Pixel-Space AEs
Discrete AEs (Ours) Original Image
Pixel-Space AEs
N u m b e r o f c
o l o r s
F r e qu e n c y S
p e c t r u m
P e r t u r b a t i o n V
i s u a li z
a t i o n
Discrete perturbations create more realistic AEs.
We add a visualization of pixel-space AEsand DAEs in first row of Figure 8.
Pixel-space perturbations lead to noisy images.
By calculatingthe number of colors [17], we find pixel-space AEs add more invalid colors, resulting in a noisyimage.
While discrete perturbations have minor changes on the color numbers of original image,its modification is harder to be perceived by humans.
To give quantitative results, we additionallycompare the FID score of our discrete AEs with pixel-space AEs.
We show our discrete AEs achieve14.65 FID while pixel-space AEs get 65.18 FID.
The results are also consistent with our visualpresentation result in Figure 8.
Discrete perturbations have more low frequency component.
We conduct frequency analysison DAEs.
Pixel-space perturbations introduce more high frequency component.
It may lead thepixel-space AEs to far away from natural distributions.
However discrete perturbations will notintroduce unnecessary high-frequency components in original image.
Discrete perturbations are more structural.
From the perturbation visualization in third row of
Figure 8, we find discrete perturbations have more structured information about objects, shown itattends to more important locations.
While pixel-wise perturbations are noisy and disordered.
D.6 Visualization of the Straight-Through Gradients and Backward Gradients in DAT
We visualize the estimated straight-through gradients in Eq 7 and the directly backward gradients in
Eq 6.
As shown in Figure 9, the approximated gradient by straight-through estimator does accuratelyestimate the ground-truth gradients in Eq 6.
It reflects the rationality of the proposed efficientstraight-through gradient in DAT.
S t r a
i g h t - T
h r o u
g h
G r a d i e n t s
B a c k w a r d
G r a d i e n t s