Adversarial Contrastive Learning via Asymmetric InfoNCE

Current Adversarial CL frameworks directly inherit CL’s conventional contrastive loss (e.g., InfoNCE) to evaluate the similarity between adversarial and clean views in a symmetric fashion. This can result in ineffective or even conflicting updates during CL training as aforementioned. To address this challenge, we propose a generic Asymmetric InfoNCE loss (A-InfoNCE) to incorporate the asymmetric influences between different contrast instances, given by:

where $\rm sim^{\alpha}(\cdot)$ is a generalized similarity metric that enables the incorporation of asymmetric relationships (a concrete instantiation is described in the next section); $\lambda^{p}$ and $\lambda^{n}$ are asymmetric weighting factors for positive and negative pairs, respectively. It is worth noting that although A-InfoNCE is proposed to address the identity confusion issue in Adversarial CL, it can be easily extended to other CL settings when the asymmetric characteristics between different views need to be captured. A-InfoNCE can also generalized to many existing CL methods, for example, $\mathcal{P}(i)$ and $\mathcal{N}(i)$ can be altered to different choices of positive and negative views; ${\rm sim^{\alpha}}(z_{i},z_{j})$ is also changeable to a symmetric similarity metric for $z_{i}$ and $z_{j}$. $\lambda^{p}$ and $\lambda^{n}$ control the weights of different positive/negative pairs. Generalization strategies are itemized below:

• •

  If ${\rm sim^{\alpha}}(z_{i},z_{j})$ is a symmetric similarity metric and $\lambda^{p},\lambda^{n}=1$, it degrades to the conventional InfoNCE loss used in CL [9].

• •

  If $\mathcal{P}(i)$ is altered, it corresponds to positives sampling [44, 3, 45] . When we add adversaries into $\mathcal{P}(i)$, it degenerates to the conventional Adversarial CL objectives, where $\lambda^{p},\lambda^{n}=1$ with symmetric ${\rm sim^{\alpha}}(z_{i},z_{j})$ [32, 27, 18].

• •

  If we seek better $\mathcal{N}(i)$, it echos negative sampling methods [39, 28] such as Moco [24], which maintains a queue of consistent negatives; or mimics DCL [13] that debiases $\mathcal{N}(i)$ into true negatives.

• •

  If we change $\lambda^{p}$ and $\lambda^{n}$, it mirrors the pair reweighting works [13, 39] that assign different weights to each pair according to a heuristic measure of importance such as similarity.

While most existing methods adopt a symmetric similarity metric, we claim that in some scenarios the asymmetric similarity perspective needs to be taken into account, especially when the quality and property of different views vary significantly. In this paper, we focus on the study of Adversarial CL, and demonstrate the benefits of capturing the asymmetric relationships between adversaries and clean views. Specifically, we design two instantiations to model the asymmetric relationships between adversarial and clean samples, as detailed in next section. Both instantiations can be integrated into the proposed A-InfoNCE framework.

Adversarial samples with different identities may attract their anchors (clean samples) in a contradicting manner to the exertion of CL. By weakening the learning signal from these adversarial examples in positive contrast (as inferior positives that attract the anchors less), we can effectively mitigate the undesired pull from clean samples via an adaptive gradient stopping strategy.

Besides inferior positives, we also propose an alternative view of adversaries as hard negatives [39] that be pushed away from surrounding data points with higher weights. This can potentially assuage the confusion brought by adversarial samples of the current instance residing too close to the negative samples of the same instance (as illustrated in Figure 1 (d)). Furthermore, this strategy encourages the model towards more robustness-aware, by giving adversarial samples possessing undiscriminating features higher weights in the pretraining stage, further enhancing Adversarial CL.

In practice, we assign a weight of similarity to each pair. To set a basis for weight assigning, we adopt a simple and adaptive weighting strategy used in [39], i.e., taking each pair’s similarity as its weight, with $w_{i,j}=\exp({\rm{sim}}(z_{i},z_{j})/t)$. By doing so, the adversaries with bad instance-level identity (greater similarity to negative samples) can be automatically assigned with higher weights. The weights can adaptively decay as the instance identity recovers during training.

However, as the commonly-used $\mathcal{N}(i)$ is uniformly sampled from the entire data distribution $p(x)$ [13] (e.g., SimCLR [9] uses other instances in the current batch as negative samples), simply taking similarities as weights may heavily repel semantically-similar instances whose embeddings should be close. To estimate the true negatives distribution $p^{-}(x)$ , we take advantage of PU-learning [16, 17] and resort to DCL,HCL [13, 39] to debias negative sampling.

PU-learning [16] decomposes the data distribution as: $p(x)=\tau p^{+}(x)+(1-\tau)p^{-}(x)$, where $p^{+}(x),p^{-}(x)$ denote the distribution of data from the same or different class of $x$, and $\tau$ is the class prior. Thus $p^{-}(x)$ can be rearranged as $p^{-}(x)=\big{(}p(x)-\tau p^{+}(x)\big{)}/(1-\tau)$. We can use all instances and positive augmentations containing adversarial samples of $x$ to estimate $p(x)$ and $p^{+}(x)$, respectively. Following [13], we debias the negative contrast part in (3) as:

where $M,N$ are the numbers of postives and negatives, $w_{i,k}^{n}$ is the aforementioned weights for negatives, $w_{i,j}^{p}$ is a expandable weight for positives (set as 1 in our implementation, other choices can be further explored in the future work).

In Table 1, we report standard accuracy and robust accuracy of each model, learned by different pre-training methods over CIFAR-10 and CIFAR-100. Following previous works [32, 27, 18] and common practice in contrastive learning [9, 24], we first use unlabeled images in CIFAR-10/-100 to pre-train, then introduce labels to finetune the model. As shown in Table 1, our methods achieve noticeable performance improvement over baselines in almost all scenarios, when replacing the original loss with our proposed adversarial CL loss.

In comparison with RoCL, $\mathcal{L}^{IP}$ brings significant performance boost on both standard and robust accuracy consistently across different training methods (row 4 vs. 3, row 14 vs. 13) (except for RA of AFF on CIFAR10). Comparing to AdvCL, $\mathcal{L}^{IP}$ also brings noticeable margin (row 8 vs. 7, row 18 vs. 17). This can be attributed to that $\mathcal{L}^{IP}$ aims to lower the priority of adversaries and prevent clean samples moving towards other instances, which results in better instance discrimination and improves clean [48] and robust accuracy. $\mathcal{L}^{HN}$ also yields substantial boost on robust and standard accuracy (e.g., row 15 vs. 13). We hypothesize this is due to that $\mathcal{L}^{HN}$ helps alert the model to adversarial samples by assigning higher weights for adversaries in negative contrast. When combined together, in most settings both standard and robust accuracy are further boosted, especially for Linear Probing. This is because directly mitigating the negative impact of identity confusion by $\mathcal{L}^{IP}$ and helping adversarial get rid of false identities by $\mathcal{L}^{HN}$ can complement each other, bringing further performance boost.

Learning robust features that are transferable is a main goal in self-supervised adversarial learning. It is of great significance if models pre-trained with a huge amount of unlabeled data possess good transferability by merely light-weight finetuning. For example, Linear Probing is often 10$\times$ quicker than conventional adversarial training, with only a linear classifier trained.

Here we evaluate the robust transferability of the proposed approach, by transfering CIFAR-10 and CIFAR-100 to STL-10, i.e., use unlabeled images in CIFAR-10/-100 to pretrain, then use STL-10 to finetune and evaluate the learned models. As shown in Table 2, our methods yield both clean and robust accuracy gains in most settings, up to 1.48% (33.62% vs. 32.14%) in robust accuracy and 2.74% (67.19% vs. 64.45%) in clean accuracy.

We design a basic adversarial contrastive model, named CoreACL, to study the effect of each component in our proposed methods. CoreACL only contains the contrastive component with three positive views: two clean augmented views and one adversarial view of the original image.

Figure 3 shows the distribution of normalized Euclidean distance over all negative pairs. We take AdvCL [18] as the baseline and compare it with its enhanced versions with our methods. Generally, our methods can shift the original distribution curve right (larger distance), meaning that treating adversaries as inferior positives or hard negatives encourages the model to separate negative pairs further apart and induce better instance discrimination. This suggests that our proposed methods effectively mitigate the negative impacts of identity confusion.

Figure 4 provides 2-D visualization (t-SNE [34] on CIFAR-10) for the embeddings learnt by SimCLR [9], RoCL [32] and RoCL enhanced by $\mathcal{L}^{IP}$ (RoCL-IP). Each class is represented in one color. Compared to SimCLR, RoCL representations are corrupted by adversaries and exhibit poor class discrimination. RoCL-IP yields better class separation compared with RoCL. This shows that asymmetric similarity consideration eases instance-level identity confusion.

In order to verify the effectiveness of the proposed method, in this section, we further evaluate the robustness of our method under a broader range of powerful attacks: $1)$ AutoAttack [14] (an ensemble of four strong diverse attacks, which is widely considered as the strongest attack for robustness evaluation), $2)$ CW attack [4] (CW-200), $3)$ PGD attack with restart [35] (PGD-200), $4)$ One-pixel attack [41], $5)$ Spatial Transformation attack [49], as well as $6)$ Color Channel attack [30]. PGD-200 and CW-200 both restart 5 times with 40 optimization steps each restart.

In Table 5, we report the robust accuracy under these attacks with AdvCL serving as baseline on CIFAR100. The results show that our methods can improve robustness under all different attacks across almost all settings, e.g., 21.43% vs. 19.57% under AutoAttack and 29.56% vs. 27.13% under PGD-200 attack, with loss function $\mathcal{L}^{IP+HN}$ (Equation 3.2.2), under Linear Probing.

Table 6 provides results on CIFAR10 under canonical optimization-based attack methods: PGD-200, CW-200 and AutoAttack. Our methods also yield robustness gain in almost all settings.

Besides, we also report results compared with RoCL under PGD-200, CW-200 and AutoAttack in Table 7, which further validate the effectiveness of the proposed methods. For instance, 25.09% vs. 23.51% under CW-200 attack, Adversarial Full Finetuning scheme, on CIFAR100.