ProFeAT: Projected Feature Adversarial Training for Self-Supervised Learning of Robust Representations

We thank the reviewer for their encouraging comments and valuable feedback. We clarify their concerns below and upload a new version of the paper incorporating their feedback.

• Clarifications on tables:
  • Yes, SA stands for standard accuracy in the tables. We mention this in the captions of all tables in the updated draft for better clarity.
  • In the updated draft, we bold the best results in each row of Table-4 as suggested.
  • Our training and evaluation uses an $\ell_\infty$ perturbation bound of 8/255 as mentioned in Section-2.
  • We update the terminology used for DeACL results with our teacher model from "Reproduced" to "Our Teacher" for better clarity.
• DynACL: While initially we presented only 500 epoch result on the WideResNet-34-10 architecture due to limited compute, we have later verified that our method outperforms even the 1000 epoch run. We present results of a 1000 epoch run for DynACL++ on the WideResNet-34-10 architecture below:

We note that the 500 epoch DynACL++ run gives better results, possibly due to robust overfitting in a 1000 epoch run. We added these results in Table-3 of the updated draft.

• Highlighting the best result in column PGD-20:

  • The gap between the true robustness of a model (which can be approximated by accuracy against AutoAttack or GAMA) and the robustness against an attack such as PGD-20 (with a small number of optimization steps) depends on the local linearity of the loss surface. For a perfectly linear loss surface, a single-step attack such as FGSM can also find the adversary effectively. However, for more convoluted loss surfaces, multiple attack steps with adaptively reducing step size and better loss functions are required to find the true loss maxima. Thus, a lower gap between PGD-20 and AutoAttack implies better smoothness of the loss surface.
  • Let us consider a case where the proposed method has better robust accuracy against AutoAttack and worse accuracy against PGD-20 (such as DeACL vs. Ours in Table-3). This happens because the proposed method has a smoother loss surface (due to better robustness) and thus PGD 20 step attack is able to reliably find the adversarial attack that exists. Hence, for a given value of Robust Accuracy against AutoAttack, a lower value of PGD-20 is better than having a higher value. Thus, we believe it is misleading to highlight the best PGD-20 accuracy. We clarify this in Section-2 of the updated draft.

• Better results on larger models: For a sufficiently complex task, a scalable approach should result in better performance on larger models given enough data. Although the task complexity of adversarial self-supervised learning is high, the gains in prior approaches are marginal with an increase in model size, while the proposed method results in significantly improved performance on larger capacity models. We discuss the key factors that result in better scalability below:

  • As discussed in Section-4.1, a mismatch between training objectives of the teacher and ideal goals of the student causes a drop in student performance. This primarily happens because of the overfitting to the teacher training task. As model size increases, the extent of overfitting increases. The use of a projection layer during distillation alleviates the impact of this overfitting and allows the student to retain more generic features that are useful for the downstream robust classification objective. Thus, a projection layer is more important for larger model capacities where the extent of overfitting is higher.
  • Secondly, as the model size increases, there is a need for higher amount of training data for achieving better generalization. The proposed method has better data diversity as it enables the use of more complex data augmentations in adversarial training by leveraging supervision from weak augmentations at the teacher.

We hope this clarifies the concerns of the reviewer. We will be happy to answer any further questions as well.

We thank the reviewer for their insightful comments and valuable feedback. We clarify their concerns below.

1. Additional methods for evaluating the pretrained models: As discussed in Section-2, we primarily rely on the standard linear probing evaluation, as freezing the backbone can give a more reliable estimate of the robustness of the representations learned when compared to a finetuning framework that can alter the representations significantly. However, we agree that other types of evaluations such as KNN and finetuning can be valuable in comprehensively comparing the nature of representations learned. Therefore, as suggested, we present below the performance of the proposed method when compared to the best baseline DeACL on evaluation metrics such as KNN and Adversarial Full Finetuning (AFF):

• We compare the performance of DeACL (best baseline) and ProFeAT (Ours) on CIFAR-10 and CIFAR-100 datasets with WideResNet-34-10 architecture. The model is first pretrained using the respective self-supervised adversarial training algorithm, and further we compute the standard accuracy (SA) and robust accuracy against GAMA (RA-G) using several methods such as standard linear probing (LP), training a 2 layer MLP head (MLP), and performing KNN in the feature space (k=10).

• We note that the proposed method achieves improvements over the baseline across all evaluation methods.

  • Since the training of classifier head in LP and MLP is done using standard training and not adversarial training, the robust accuracy reduces as the number of layers increases (from linear to 2-layers), and the standard accuracy improves.
  • The standard accuracy of KNN is better than the standard accuracy of LP for the baseline, indicating that the representations are not linearly separable. Whereas, as is standard, for the proposed approach, LP standard accuracy is higher than that obtained using KNN.
  • The adversarial attack used for evaluating the robust accuracy using KNN is generated using GAMA attack on a linear classifier. The attack is suboptimal since it is not generated by using the evaluation process (KNN), and thus the robust accuracy against such a weak attack is higher.

• We next present the Adversarial Full Finetuning (AFF) performance on the downstream task of transfer learning from CIFAR-10/ CIFAR-100 to STL-10 and Caltech-101 respectively on WideResNet-34-10 architecture. AFF is performed using TRADES algorithm for 25 epochs.

• The proposed method outperforms DeACL by a large margin. Further, by using merely 25 epochs of adversarial finetuning, the proposed method achieves improvements of around 4% on CIFAR-10 and 11% on CIFAR-100 when compared to the linear probing accuracy presented in Table-5, highlighting the practical utility of the proposed method. The AFF performance of the proposed approach is better than that of a supervised TRADES pretrained model as well.

             (response continued in the next comment)
  

We thank the reviewer for their encouraging comments and valuable feedback. We present our responses to their questions below.

1. Effect of each component in the proposed method: While we present extensive ablation experiments for each component of the proposed method, we agree with the reviewer that one table that summarizes it all, and shows the impact of each component/ combination of any two components is a valuable addition to our work. We present a table that shows this below (SA:Standard Accuracy or Clean accuracy, RA-PGD20: Robust Accuracy against PGD-20, RA-G: Robust Accuracy against GAMA):

• A tick mark in the Projector column imples that a frozen pretrained projector is used for the teacher and student, with the defense loss being enforced at the feature and projector as shown in Eq.3 of the main paper.

• E1 represents the baseline or DeACL defense, and E9 represents the proposed defense or ProFeAT.

• Projector: A key component of the proposed method is the introduction of the projector. We observe significant gains in clean accuracy (4.76%) by introducing the frozen pretrained projector along with defense losses at the feature and projector (E1 vs. E2). The importance of the projector is also evident by the fact that removing the projector from the proposed defense results in a large drop (5.7%) in clean accuracy (E9 vs. E5). In combination with other components in the table as well, the projector improves the performance significantly (E4 vs. E6, E3 vs. E7, E5 vs. E9). We observe an improvement of 9.18% in clean accuracy when the projector is introduced in the presence of the proposed augmentation strategy (E3 vs. E7). This is significantly higher than the gains obtained by introducing the projector over the baseline, which is 4.76% (E1 vs. E2).

• Augmentations: The proposed augmentation strategy is seen to improve performance, specifically robust accuracy, across all combinations. Introducing the proposed augmentation strategy in the base DeACL defense improves the robust accuracy by 2.47% (E1 vs. E3). The importance of the proposed augmentation strategy is also evident by the fact that in the absence of the same, there is a 4.48% drop in clean accuracy and 2.12% drop in robust accuracy (E9 vs. E6). Further, when combined with other components as well, the proposed augmentation strategy shows good improvements (E4 vs. E5, E2 vs. E7, E6 vs. E9).

• Attack loss: The proposed attack objective is designed to be consistent with the proposed defense strategy, where the goal is to enforce smoothness at the student in the feature space and similarity with the teacher in the projector space. As shown in Table-16, the proposed method is not very sensitive to different choices of attack losses. The impact of the attack loss in feature space can be seen in combination with the proposed augmentations, where we observe an improvement of 2.5% in clean accuracy alongside a marginal improvement in robust accuracy (E3 vs. E5). However, in presence of projector, the attack results in only marginal robustness gains, possibly because the clean accuracy is already high (E9 vs. E7).

• Defense loss: We do not introduce a separate column for defense loss as it is applicable only in the presence of the projector. We show the impact of the proposed defense losses in the last two rows (E8 vs. E9). The proposed defense loss improves the clean accuracy by 1.4% and robust accuracy marginally.

     (response continued in the next comment)
  

• A mechanism for why the combination is needed: For a sufficiently complex task, a scalable approach should result in better performance on larger models given enough data. Although the task complexity of adversarial self-supervised learning is high, the gains in prior approaches are marginal with an increase in model size, while the proposed method results in significantly improved performance on larger capacity models. We discuss the key factors that result in better scalability below:
  • As discussed in Section-4.1, a mismatch between training objectives of the teacher and ideal goals of the student causes a drop in student performance. This primarily happens because of the overfitting to the teacher training task. As model size increases, the extent of overfitting increases. The use of a projection layer during distillation alleviates the impact of this overfitting and allows the student to retain more generic features that are useful for the downstream robust classification objective. Thus, a projection layer is more important for larger model capacities where the extent of overfitting is higher.
  • Secondly, as the model size increases, there is a need for higher amount of training data for achieving better generalization. The proposed method has better data diversity as it enables the use of more complex data augmentations by leveraging supervision from weak augmentations at the teacher.

2. Performance on small datasets: We agree with the reviewer that it is important to show the transfer learning performance on small datasets. Towards this, we show the transfer learning performance from CIFAR-10/CIFAR-100 to STL-10 with linear probing in Table-5 of the main paper. However, in practice it is common to finetune the full network for better downstream performance. We thus present transfer learning results to STL-10 and Caltech-101 using lightweight adversarial full finetuning (AFF). Caltech-101 contains 101 object classes and 1 background class, with 2416 samples in the train set and 6728 samples in the test set. The number of samples per class range from 17 to 30, and thus this is a suitable dataset to highlight the practical importance of adversarial self-supervised pretrained representations for low-data regime. For Adversarial Full Finetuning (AFF), a base robustly pretrained model is finetuned using the TRADES adversarial training for 25 epochs. We present results on WideResNet-34-10 models that are pretrained on CIFAR-10 and CIFAR-100 respectively. (SA: Standard Accuracy, RA-PGD20: Robust Accuracy against PGD-20, RA-G: Robust Accuracy against GAMA)

• We note that the proposed method outperforms DeACL by a large margin. Further, we note that by using merely 25 epochs of adversarial finetuning using TRADES, the proposed method achieves improvements of around 4% on CIFAR-10 and 11% on CIFAR-100 when compared to the linear probing accuracy presented in Table-5, highlighting the practical utility of the proposed method. The AFF performance of the proposed approach is better than that of a supervised TRADES pretrained model as well.

We sincerely hope our rebuttal addresses the reviewers concerns. We will be happy to answer any further questions as well.

We thank the reviewer for their valuable feedback. We clarify their concerns below and upload a new version of the paper incorporating their feedback.

• Novelty:

  • The removal of last few layers for better generalization was first introduced in a transfer learning setting in 2014 [1] and later adapted to self-supervised learning in the seminal work SimCLR [2]. Despite this, there have been several recent works on the use of projection layer and understanding its role in self-supervised and supervised learning, as highlighted by Bordes et al. (2023)[3], and this is still an active area of research. We propose to use a frozen pretrained projector for self-supervised adversarial training using distillation from a standard SSL trained network, which is significantly different from all existing works. We further hypothesize why the projector helps, and verify the same using well-designed experiments in both standard and adversarial self-supervised distillation.
  • We find that the use of strong augmentations results in more diverse attacks as shown in Fig.2. While this results in better robust generalization, it also leads to a more complex training objective. The proposed approach maps the representations corresponding to these diverse strong augmentations at the student to the representations corresponding to weak augmentations (which are close to the unaugmented images) at the teacher, allowing the student to be invariant to strong augmentations without increasing the training complexity. Although a combination of weak and strong augmentations is used in other areas such as semi-supervised learning as well, the justification for using this strategy is different.

  The effective use of augmentations in supervised and self-supervised adversarial training has been very challenging, and it is common to use the basic pad+crop augmentation alone for adversarial training [4-7]. Thus, although the use of weak and strong augmentations together is not new, we believe there is significant value in leveraging this for self-supervised adversarial training using a distillation framework, where the need for such a method is different from prior works.

• We list our contributions below for better clarity -

  • Our finding that the use of a projection layer during self-supervised distillation can bridge the gap in clean accuracy between self-supervised adversarial training and supervised adversarial training methods
  • Our hypotheses on why the projection layer helps, which is not only a valuable contribution to adversarial self-supervised learning but can also motivate a better understanding of the role of the projector in standard self-supervised distillation. We support our hypotheses using well-designed experiments in Tables-1 and 2.
  • The use of weak and strong augmentations for the teacher and student respectively, to strike a balance between improving perturbation diversity and limiting training complexity.
  • Understanding the role of different training losses at the feature and projector.
  • Strong empirical results that push the state-of-the-art in self-supervised adversarial training by a large margin, and bridge the gap with respect to supervised adversarial training methods.

[1] Jason Yosinski, Jeff Clune, Yoshua Bengio, and Hod Lipson. How transferable are features in deep neural networks? In Z. Ghahramani, M. Welling, C. Cortes, N. Lawrence, and K.Q. Weinberger (eds.), Advances in Neural Information Processing Systems, volume 27. Curran Associates, Inc., 2014.

[2] Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. ICML 2020

[3] Florian Bordes, Randall Balestriero, Quentin Garrido, Adrien Bardes, and Pascal Vincent. Guillotine regularization: Improving deep networks generalization by removing their head., TMLR 2023.

[4] L. Rice, E. Wong, and J. Z. Kolter. Overfitting in adversarially robust deep learning. ICML 2020

[5] S. Gowal, C. Qin, J. Uesato, T. Mann, and P. Kohli. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03593, 2020.

[6] H. Zhang, Y. Yu, J. Jiao, E. Xing, L. El Ghaoui, and M. I. Jordan. Theoretically principled trade-off between robustness and accuracy. ICML 2019

[7] Chaoning Zhang, Kang Zhang, Chenshuang Zhang, Axi Niu, Jiu Feng, Chang D Yoo, and In So Kweon. Decoupled adversarial contrastive learning for self-supervised adversarial robustness. ECCV 2022

       (response continued in the next comment)

Dear Reviewers,

We sincerely thank you for your time and valuable feedback on our work. We believe that we have addressed all the concerns/ questions in the rebuttal and eagerly look forward to hearing your thoughts on the same. We have also updated our draft based on the feedback received. We request you to kindly review our responses and update the scores if our rebuttal addresses your concerns.

Thanks!