论文标题
通过离散对抗训练增强视觉表示
Enhance the Visual Representation via Discrete Adversarial Training
论文作者
论文摘要
对抗性训练（AT）通常被认为是防御对抗性例子的最有效的方法之一，可能会在很大程度上损害标准绩效，因此对工业规模的生产和应用的有用性有限。令人惊讶的是，这种现象在自然语言处理（NLP）任务中完全相反，在该任务中甚至可以从中受益。我们注意到NLP任务中AT的优点可能来自离散和符号输入空间。为了借用NLP风格的优势，我们提出了离散的对抗培训（DAT）。 DAT利用VQGAN改革图像数据以离散类似文本的输入，即视觉单词。然后，它可以最大程度地减少这种离散图像的最大风险，并具有象征性的对抗扰动。我们从分布的角度进一步提供了解释，以证明DAT的有效性。作为增强视觉表示的插件技术，DAT可以在多个任务上取得重大改进，包括图像分类，对象检测和自我监督学习。尤其是，该模型通过胶带自动编码（MAE）预先训练并由我们的DAT进行微调，而没有额外的数据可以在Imagenet-C上获得31.40 MCE，并且在Stylized-Imagenet上可以在32.77％的TOP-1准确性上获得新的最新技术。该代码将在https://github.com/alibaba/easyrobust上找到。
Adversarial Training (AT), which is commonly accepted as one of the most effective approaches defending against adversarial examples, can largely harm the standard performance, thus has limited usefulness on industrial-scale production and applications. Surprisingly, this phenomenon is totally opposite in Natural Language Processing (NLP) task, where AT can even benefit for generalization. We notice the merit of AT in NLP tasks could derive from the discrete and symbolic input space. For borrowing the advantage from NLP-style AT, we propose Discrete Adversarial Training (DAT). DAT leverages VQGAN to reform the image data to discrete text-like inputs, i.e. visual words. Then it minimizes the maximal risk on such discrete images with symbolic adversarial perturbations. We further give an explanation from the perspective of distribution to demonstrate the effectiveness of DAT. As a plug-and-play technique for enhancing the visual representation, DAT achieves significant improvement on multiple tasks including image classification, object detection and self-supervised learning. Especially, the model pre-trained with Masked Auto-Encoding (MAE) and fine-tuned by our DAT without extra data can get 31.40 mCE on ImageNet-C and 32.77% top-1 accuracy on Stylized-ImageNet, building the new state-of-the-art. The code will be available at https://github.com/alibaba/easyrobust.
