PaperlayerView exact revision on arXiv

Source-linked AI summary

Understanding Zero-Shot Adversarial Robustness for Large-Scale Models

Chengzhi Mao, Scott Geng, Junfeng Yang, Xin Wang, Carl Vondrick

arXiv:2212.07016v2cs.CV

TL;DR

CLIP’s zero-shot generalization is vulnerable to imperceptible adversarial perturbations, and standard adversarial training can sacrifice unseen-task accuracy. The paper compares adaptation methods and losses, proposes text-guided contrastive adversarial training, and finds improved zero-shot robustness, with finetuning strongest when text guidance is available.

  • Problem

    The paper addresses how to achieve adversarial robustness on unseen tasks when the defender lacks access to those tasks and standard training can reduce zero-shot generalization.

  • Method

    TeCoA uses cross-modal contrastive learning to align adversarial visual features with correct text embeddings and is combined with finetuning or visual prompt tuning.

  • Results

    Across 15 zero-shot datasets, TeCoA improves adversarial robustness over CLIP by an average of 31%, with finetuning reaching 38.18% from 6.57%.

  • Takeaways & Limitations

    Visual prompt tuning is more effective without text, whereas finetuning provides higher gains when textual information guides adaptation.

  • Takeaways & Limitations

    The setup assumes an attacker has unrestricted access to new-task ground truth while the defender has no access.

Abstract

from arXiv · show

Pretrained large-scale vision-language models like CLIP have exhibited strong generalization over unseen tasks. Yet imperceptible adversarial perturbations can significantly reduce CLIP's performance on new tasks. In this work, we identify and explore the problem of \emph{adapting large-scale models for zero-shot adversarial robustness}. We first identify two key factors during model adaption -- training losses and adaptation methods -- that affect the model's zero-shot adversarial robustness. We then propose a text-guided contrastive adversarial training loss, which aligns the text embeddings and the adversarial visual features with contrastive learning on a small set of training data. We apply this training loss to two adaption methods, model finetuning and visual prompt tuning. We find that visual prompt tuning is more effective in the absence of texts, while finetuning wins in the existence of text guidance. Overall, our approach significantly improves the zero-shot adversarial robustness over CLIP, seeing an average improvement of over 31 points over ImageNet and 15 zero-shot datasets. We hope this work can shed light on understanding the zero-shot adversarial robustness of large-scale models.

1 INTRODUCTION

Large-scale vision-language models generalize well to unseen tasks but remain vulnerable to imperceptible adversarial perturbations. This paper studies adaptation strategies and training losses for preserving zero-shot capability while improving adversarial robustness.

  • Motivation: Foundation models support zero-shot recognition from textual descriptions across new visual categories and applications.Their use in critical applications makes reliability under adversarial examples important.
  • Problem: Adversarial training improves robustness on the task supplying mined examples but can reduce generalization to unseen tasks.The paper frames zero-shot robustness as a distinct challenge beyond robustness on learned tasks.
  • Problem: An imperceptible perturbation of at most 1/255 can subvert CLIP’s prediction.Finetuning CLIP with standard adversarial training improves ImageNet robustness but significantly reduces accuracy on unseen datasets and classes.
  • Approach: The proposed TeCoA loss uses text-guided contrastive learning to align adversarial visual features with correct text embeddings.It is applied with model finetuning and visual prompt tuning to retain CLIP’s zero-shot alignment while improving robustness.
  • Results: Across 15 zero-shot image datasets, the best TeCoA model improves adversarial robustness over CLIP by an average of 31%.Visual prompt tuning is more effective without textual information, while finetuning has higher gains when texts are used during adaptation.

2 RELATED WORK

Prior work studies zero-shot generalization, adversarial robustness, robustness transfer, contrastive learning, and pretrained-model adaptation. This paper positions its contribution at the intersection of these areas through cross-modal contrastive adversarial learning.

  • Zero-Shot Generalization: Zero-shot methods recognize unseen classes and tasks by mapping visual features into semantic spaces or generating visual features from semantic descriptions.
  • Adversarial Robustness: Adversarial training improves robustness on the task used for training, but its effectiveness for zero-shot robustness remains unclear.
  • Transferability of Robustness: Prior studies report that robustness can transfer across tasks, through multitask training, finetuning, or gradient matching.
  • Contrastive Learning: Contrastive learning has trained large-scale image-language models and aligned clean and adversarial image features in prior adversarial methods.This paper introduces a cross-modal image-text contrastive loss for adversarial contrastive learning.
  • Adapting Pretrained Models: Finetuning and linear probing are established adaptation methods, while prompt tuning and visual prompting offer lighter-weight alternatives.

3 MODEL ADAPTATION FOR ZERO-SHOT ADVERSARIAL ROBUSTNESS

This section frames zero-shot adversarial robustness as adapting CLIP with limited attacked-task data while preserving transfer to unseen tasks. It compares parameter- and input-based adaptation with training objectives, emphasizing text-guided contrastive learning.

  • Adaptation methods: The adaptation methods include linear probing, partial or full finetuning, and visual prompting through image modifications or appended visual prompt tokens.Finetuning changes model parameters, whereas visual prompt tuning adapts inputs instead.
  • Problem: Zero-shot adversarial robustness evaluates whether large-scale vision-language models remain robust on new tasks when the defender lacks access to those tasks.The setup is more challenging than robustness evaluation on the trained task.
  • Problem: Standard adversarial training improves robustness on seen tasks but fails on attacked data from unseen tasks, reducing zero-shot generalization.The method trains on mined adversarial examples but does not retain CLIP’s transferability in this setting.
  • Adaptation methods: The study treats adaptation methods and training objectives as major factors, investigating visual prompt tuning alongside finetuning for zero-shot adversarial robustness.Visual prompt tuning learns a prompt added to the input image, while finetuning updates model parameters.
  • Training objective: TeCoA uses cross-modal text-to-image contrastive learning to align adversarial image features with text embeddings rather than relying only on one-hot supervision.Adversarial examples are generated using image-text contrastive loss, then the vision encoder is optimized on them.
  • Training objective: Contrastive adversarial training without text provides comparison variants using one-hot labels or image-to-image contrastive learning.These variants test whether zero-shot robustness gains arise from language supervision or from contrastive-loss formulation alone.

4 EXPERIMENTS

Experiments evaluate TeCoA across 16 datasets and compare adaptation methods, training losses, data regimes, perturbation strengths, prompt designs, and robustness–clean-accuracy trade-offs. Finetuning with TeCoA achieves the strongest overall zero-shot robustness, while visual prompting is more effective without text guidance.

  • Experimental setup: 16 tasks: Table 1 evaluates 12 adaptation variants using 100-step PGD attacks, reporting robust accuracy by dataset and average performance.The evaluation compares TeCoA with visual prompting, finetuning, and multiple baseline losses.
  • Adaptation methods: 31.84%: Adversarial visual prompting raises average robustness from 6.57% for CLIP, outperforming standard adversarial finetuning without text guidance.Standard adversarial finetuning reaches 10.62% average robust accuracy, whereas VP(Adv.) reaches 31.84%.
  • Training losses: 38.18%: TeCoA finetuning achieves the best overall performance, whereas contrastive losses without language supervision underperform TeCoA and standard adversarial training.The results indicate that language supervision is important for zero-shot adversarial robustness.
  • Experimental results: 31 points: Finetuning with TeCoA improves average accuracy from 6.57% to 38.18% across the evaluated datasets.The experiments cover ImageNet and 15 zero-shot datasets.
  • Data and robustness analysis: More training data generally improves zero-shot robust accuracy, and TeCoA finetuning surpasses unadapted CLIP even with one shot per class.Increasing the training set from 1 to 1,000 shots per category improves robustness, while clean performance changes little in the corresponding figure.
  • Design analysis: Visual prompt tokens outperform image-level prompts, and visual prompting is more effective than partial finetuning when the same small number of parameters is optimized.Increasing perturbation strength lowers robust accuracy, but TeCoA still transfers robustness to zero-shot tasks; weight interpolation can improve both robust and clean accuracy at a sweet spot.

5 CONCLUSION

The paper studies zero-shot adversarial robustness in large-scale vision-language models, identifies adaptation factors, and proposes TeCoA for improving CLIP's robustness.

  • The study identifies adaptation methods and training losses as factors affecting zero-shot adversarial robustness.
  • TeCoA is a text-guided contrastive adversarial training loss for model finetuning and visual prompting.
  • Extensive experiments show TeCoA improves CLIP's zero-shot adversarial robustness.

A.1.1 ZERO-SHOT CLEAN ACCURACY OF OUR ADAPTED MODEL

The section reports clean-image accuracy results for the adapted models in Table 3.

  • Table 3 reports accuracy on clean images.

A.2 AUTOATTACK EXPERIMENT

Under the stronger AutoAttack evaluation, TeCoA improves zero-shot robust accuracy over vanilla CLIP across perturbation bounds, while attack strength affects measured robustness.

  • Up to 36 points of robust-accuracy improvement over vanilla CLIP is achieved under AutoAttack across the evaluated perturbation bounds.
  • 37.02 robust accuracy is achieved by FT (TeCoA) at ϵ = 1/255 under AutoAttack.
  • AutoAttack uses fractional attack vectors, whereas PGD100's minimum step size is 1, producing a stronger evaluation.
  • AutoAttack evaluates 16 tasks and 12 methods, reporting each method's average performance in the last column.
  • 9 points is the average robustness improvement over CLIP at ϵ = 4/255 under AutoAttack.

A.3 TRAINING LOSSES AND ALGORITHMS

The section formalizes the training algorithms using an image encoder, a frozen text encoder, and labeled image data.

  • The formulations use Fθ as the image encoder and T as the frozen text encoder.
  • The dataset D contains image-label pairs (x, y) with one-hot labels.

A.3.1 STANDARD ADVERSARIAL TRAINING WITH CROSS-ENTROPY LOSS (ADV.)

Standard adversarial training appends a learnable linear classifier to the feature extractor, generates adversarial images by maximizing cross-entropy loss, and updates the feature extractor to minimize that loss on the attacks.

  • Standard adversarial training appends a learnable linear layer Cφ to the feature extractor Fθ and uses cross-entropy classification loss.The classifier is initialized as learnable before adversarial training.
  • The method first trains Cφ on standard images, then generates attacked images xa by maximizing L(Cφ(Fθ(xa)), y).Attacks are generated from a natural image x with one-hot label y.
  • The feature extractor parameters θ are updated to minimize the same loss on generated adversarial examples, as summarized in Algorithm 1.The algorithm alternates attack generation with training on the resulting adversarial examples.

A.3.2 CONTRASTIVE ADVERSARIAL TRAINING LOSS (COADV.)

The contrastive adversarial training framework replaces one-hot cross-entropy supervision with contrastive image-code or image-text alignment, and applies it through prompt tuning or finetuning. Its evaluations compare language-guided and image-only adaptation across zero-shot datasets, including challenging domain-shifted binary tasks.

  • Contrastive adversarial training loss: Contrastive training replaces one-hot labels and cross-entropy with a dictionary of category-code embeddings for learning image-code alignment.
  • Contrastive adversarial training loss: The contrastive objective marks matching image-code pairs as positive and other pairs as negative, using cosine similarity, temperature τ, and adversarial examples.
  • TeCoA adaptation: TeCoA generates adversarial attacks with its contrastive loss and updates the selected parameters on those examples; θ denotes either prompt parameters or the whole model.
  • Unlabeled adaptation: For unlabeled images, CLIP retrieves the nearest text embedding as a pseudo-label before TeCoA training on the image and pseudo-text pair.
  • Results: TeCoA outperforms existing methods except LP(CE) and VPT(Adv.) on HateMemes and PCAM, where domain shift and binary tasks remain challenging.The passage reports accuracies near random guessing for these datasets: 54% on HateMemes and 52.5% on PCAM.
  • Visual prompt tuning: Token-level visual prompts append tokens to the vision-transformer input while keeping the remaining transformer parameters and computations unchanged.
Loading 2212.07016v2…