# Towards Robust and Accurate Visual Prompting

Qi Li1 Liangzhi Li1 Zhouqiang Jiang1 Bowen Wang2
1MeetYou AI Lab 2Osaka University
<EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS>Corresponding author.

###### Abstract

Visual prompting, an efficient method for transfer learning, has shown its
potential in vision tasks. However, previous works focus exclusively on VP
from standard source models, it is still unknown how it performs under the
scenario of a robust source model: Whether a visual prompt derived from a
robust model can inherit the robustness while suffering from the
generalization performance decline, albeit for a downstream dataset that is
different from the source dataset? In this work, we get an affirmative answer
of the above question and give an explanation on the visual representation
level. Moreover, we introduce a novel technique named Prompt Boundary Loose
(PBL) to effectively mitigates the suboptimal results of visual prompt on
standard accuracy without losing (or even significantly improving) its
adversarial robustness when using a robust model as source model. Extensive
experiments across various datasets show that our findings are universal and
demonstrate the significant benefits of our proposed method.

##  1 Introduction

Harnessing knowledge from large-scale models allows for efficient training on
new tasks compared to learning from scratch [49, 53, 15, 5, 29]. Researchers
have proposed numerous paradigms for conducting knowledge transfer in pre-
trained models, such as fine-tuning [32, 39, 64] and linear probing. Yet, they
necessitate parameters or layer modifications, making them computationally
intensive and less generalizable. To mitigate these issues, an efficient
alternative known as Visual Prompting (VP) [4] or model reprogramming [59, 21,
13, 45] has emerged. It keeps the pre-trained model frozen while learning to
add prompt to the inputs. Since no changes have been made to the model itself
and the prompts are with very few parameters, it achieves efficient and
lightweight knowledge transfer.

Figure 1: RSVP are visually more human aligned. The proposed PBL method under
RSVP brings benefits both in robustness and generalization ability.

However, as shown in Fig.1, current works default set the source model as
standard models obtained by standard training which is easy to be disturbed by
adversarial attacks [26, 8, 67, 33, 28, 3, 6, 16, 12]. Correspondingly, robust
models obtained by adversarial training [55, 2, 23, 58, 57, 40] have
robustness (adversarial accuracy) against adversarial attacks but is often
plagued by the decline of performance (standard accuracy) [9, 60, 27, 65, 1,
68], and the process of adversarial training requires much more computing
resources [63, 61, 36] than standard training due to its bi-level training
process. Considering the good generalization ability of the VP from a Standard
Source model (SSVP) and its lightweight in training, it is meaningful to study
the properties of VP from a Robust Source model (RSVP). We naturally raise the
following series of questions: Whether RSVP can inherit the robustness? Will
it also suffer from suboptimal performance? If so, how to explain this
phenomenon and how to alleviate it?

The gaps in comprehending the characteristics of RSVP and the absence of a
definitive remedy for its defects spurred the advancement of our work, which,
to the best of our knowledge, is the first work under this scenario. We find
that RSVP can inherit the robustness of its source model, and also encounter
the same sub-optimal standard accuracy that affects generalization ability.
Besides, an explanation for the above phenomenon from the view of VP’s visual
representation has been proposed: RSVP is more in accordance with human
perception. Moreover, we propose Prompt Boundary Loose (PBL), the first
solution that aims at improving the generalization ability of RSVP. By
maintaining the complex decision boundary of the robust model while increasing
the mapping range of each label in a target downstream dataset, PBL
successfully helps RSVP to maintain (or even greatly enhance) its robustness
while redeeming its generalization ability.

Contribution. We explored the previously uncharted territory of VP under an
RSVP scenario. Our findings both quantitatively and qualitatively verify the
inheritance of robustness from a robust source model in the VP tasks. We also
proposed a strategy PBL to kill two birds with one stone: Alleviate the
generalization suboptimality of RSVP without negative (or even with
significant positive) effects on robustness. Sufficient experiments fully
prove the universality of the above phenomenon and the wide applicability of
PBL.

##  2 Related Work

Prompt Learning in vision tasks. Given the success of prompt tuning in Natural
language processing (NLP) [7, 20, 44, 42, 41], numerous studies have been
proposed to explore its potential in other domains, such as vision-related and
multi-modal scenarios [14, 24, 69, 70]. Nevertheless, most of these works
still primarily focus on text prompting. VPT [35] takes the first step to
visual prompting by adapting vision transformers to downstream tasks with a
set of learnable tokens at the model input. Concurrently, VP [4] follows a
pixel-level perspective to optimize task-specific patches that are
incorporated with input images. Although not outperforming full fine-tuning,
VP yields an advantage of parameter-efficiency, necessitating significantly
fewer parameters and a smaller dataset to converge.

Subsequent works explored the properties of VP from different angles. [11]
proposed to use different label mapping methods to further tap the potential
of VP. [48] proposed to restrict access to the structure and parameters of the
pre-trained model, and put forward an effective scheme for learning VP under a
more realistic setting. In addition, [10] explores the use of VP as a means of
adversarial training to improve the robustness of the model, however, their
method is limited to the in-domain setting, which is contrary to the original
cross-domain transfer intention of VP. It is worth noting that current works
on VP are all focused on scenarios where the pre-trained source model is a
standard model, and no work has yet investigated the characteristics of VP
when originating from a robust source model.

Robust Model and Adversarial Training. [26] were the first to propose the
concept of adversarial examples, in which they added imperceptible
perturbations to original samples, fooling the most advanced Deep Neural
Networks (DNNs) of that time. Since then, an arms race of attack and defense
has begun [8, 67, 33, 28, 3, 34, 43], with numerous studies exploring
different setups for attacks and defenses. Among the array of defense
techniques, adversarial training stands out as the quintessential heuristic
method and has spawned a range of variant techniques [58, 66, 23, 55, 2, 57,
40]. It’s broadly recognized that although robust models may exhibit
adversarial robustness, this typically comes at the expense of reduced
standard accuracy[9, 60, 51, 27, 65, 1, 25, 68], meaning their generalization
abilities are compromised.

Numerous studies have delved into the above trade-off phenomenon. [60]
proposed that there may exist an inherent tension between the goal of
adversarial robustness and that of standard generalization, discovering that
this phenomenon is a consequence of robust classifiers learning fundamentally
different feature representations than standard classifiers. [1] analyzed the
characteristics of adversarial training from the perspective of mixed
features, pointing out that adversarial training could guide models to remove
mixed features, leading to purified features (Feature Purification), thus
visually conforming more to human perception. Moreover, some works believe
that the trade-off between adversarial robustness and standard accuracy can be
avoided [50] and provide experimental or theoretical proofs. There is yet a
perfect explanation for this phenomenon. Current research indicates that VP is
effective at learning and transferring knowledge from standard source models.
However, the inheritance of the unique properties of robust source models by
VP remains an area that urgently requires exploration. In this paper, we
explored this hitherto unexplored territory for the first time and present the
first solution to the negative effects observed in this scenario.

##  3 Preliminaries

Standard and Adversarial Training. In standard classification tasks, the main
goal is to enhance standard accuracy, focusing on a model’s ability to
generalize to new data samples that come from the same underlying
distribution. The aim here is defined as achieving the lowest possible
expected loss:

$\min_{\theta}\mathbb{E}_{(x,y)\sim D}[\mathcal{L}(x,\theta,y)]$ (1)

where $(x,y)\sim D$ represents the training data $x$ and its label $y$ sampled
from a particular underlying distribution $D$, and $\mathcal{L}$ represents
the cross-entropy loss.

After [26] firstly introduce the concept of adversarial training, some
subsequent works further refined this notion by formulating a min-max problem
where the goal is to minimize classification errors against an adversary that
add perturbations to the input to maximize these errors:

$\min_{\theta}\mathbb{E}_{(x,y)\sim
D}[\max_{\delta\in\Delta}\mathcal{L}(x+\delta,\theta,y)]$ (2)

where $\Delta$ refers to the set representing the perturbations allowed to be
added to the training data $x$ within the maximum perturbation range
$\epsilon$, we can define it as a set of $l_{p}$-bounded perturbation, i.e.
$\Delta=\\{\delta\in R^{d}\mid\lVert\delta\rVert_{p}\leq\epsilon\\}$.

Visual Prompt Learning under Robust Model. For a specific downstream dataset,
the goal of visual prompt learning is to learn a prompt that can be added to
the data thus allowing the knowledge of a pre-trained model to be transferred
to it. The objective can be formally expressed as follows:

$\displaystyle\min_{\varphi}\,\mathbb{E}_{(x_{t},y_{t})\sim
D_{t}}[\mathcal{L}(\mathcal{M}(f_{\theta^{*}}(\gamma_{\varphi}(x_{t})),y_{t}))]$
(3)
$\displaystyle\text{s.t.}\quad\theta^{*}=\min_{\theta}\,\mathbb{E}_{(x_{s},y_{s})\sim
D_{s}}[\mathcal{L}(x_{s},\theta,y_{s})]$

when the pre-trained model is a robust model, the conditional term in Eq.3 is
changed to:

$\theta^{*}=\min_{\theta}\,\mathbb{E}_{(x_{s},y_{s})\sim
D_{s}}[\max_{\delta\in\Delta}\mathcal{L}(x_{s}+\delta,\theta,y_{s})]$ (4)

where $D_{t}$ and $D_{s}$ represent the distribution of the downstream dataset
and the source dataset, respectively; $f_{\theta^{*}}(\cdot)$ represents the
frozen pre-trained model, which is parameterized by the optimal parameters
$\theta^{*}$; $\gamma_{\varphi}({\cdot})$, parameterized by $\varphi$,
represents the visual prompt that needs to be learned; $\mathcal{M}(\cdot)$
represents the pre-defined label mapping method.

##  4 Method

As mentioned earlier, existing works primarily focus on understanding VP in
the context of standard models, the unique characteristics of inheritance
under RSVP as well as solutions for its specific disadvantages remain to be
explored. In this section, we address the previously raised questions and
present our solution.

###  4.1 Observations

Robustness Inheritance of Visual Prompt. Initially, we investigate the extent
to which a source model’s robustness transfers to visual prompts that are
trained on downstream datasets distinct from the source dataset. For the
selection of robust models, we use the models collected in RobustBench [18],
an open-source benchmark which is widely used in the field of trustworthy
machine learning. Specifically, we select one standard model and three robust
models trained with ImageNet [19] under the $l_{\infty}$-norm, they are
referred to as S20 [54], E19 [22] and W20 [63]. Without loss of generality, we
used FGSM (Fast Gradient Sign Method) attack [26] to assess the model’s
robustness, datasets selected here are flowers102 (F-102) [47], SVHN [46] and
DTD [17]. The experiment results are shown in Fig.2, among which Fig.2 (a) and
Fig.2 (b) represent the results under different label mapping methods,
respectively. The bar chart represents the result of standard accuracy while
the line chart represents the result of adversarial accuracy. ‘Original’
represents the corresponding results of the source model on its original
source dataset without VP.

(a) Random Label Mapping

(b) Iterative Label Mapping

Figure 2: The performance of VP on standard accuracy (histogram) and
adversarial accuracy (line chart) when using a standard model or different
robust models as the source model. ‘Original’ represents the result on the
source dataset without VP. Figure 3: Visual representation of SSVP (columns 1
& 5) and RSVP (columns 2-4 & 6-8) obtained during a certain training period.
For SSVP, only meaningless noise can be observed, while for RSVP, we get a
representation consistent with human perception. Figure 4: Pipeline of the
proposed Prompt Boundary Loose (PBL).

The bar charts in Fig.2 illustrate that visual prompts derived from a standard
source model exhibit no robustness. In contrast, visual prompts trained with
robust source models demonstrate markedly improved robustness compared to
their standard-trained counterparts. Moreover, we observe that a given source
model yields varying outcomes across different downstream datasets. Similarly,
for a specific downstream dataset, the results differ when using various
source models.

Generalization Ability Encountered Degradation. We further examine the
disparities in standard accuracy between SSVP and RSVP across various
downstream datasets. The line charts in Fig.2 illustrate a decrease in
generalization ability for RSVP compared to SSVP, mirroring the performance
trend observed in the source model itself.

In addition, we can also find that there’s no obvious relationship between the
performance gaps of various robust source models and the RSVP performance
disparities derived from them. This suggests that enhancing the robustness or
generalization ability of the source model does not necessarily translate to
similar improvements in RSVP. In fact, such attempts may be ineffective or
even detrimental. Thus, a tailored approach is essential for RSVP to boost its
generalization ability while maintaining or potentially increasing its
robustness. Our proposed PBL method represents an initial foray into
addressing this challenge.

Visual Representation of Visual Prompt from Robust Models. All current VP-
related works focus on the case of SSVP. Under this setting, the resulting VP
appears to be random noise without any meaningful visual representation, as
shown in columns 1 and 5 of Fig.3. In this work, we visualize RSVP and
surprisingly find that RSVP (as shown in columns 2-4 and 5-8 of Fig.3) can get
a visual representation which aligns well with human perception. This
phenomenon universally occurs across different robust models, different label
mapping methods and different datasets.

The above phenomenon offers potential insights into RSVP’s inheritance of
robustness from source models. Recalling Eq.3 and Eq.4, VP with learnable
parameters receives as input an original image and gets an image-like output
(hereinafter referred to as trainable image). This trainable image is then fed
into the pre-trained source model for prediction. If VP and the original image
are regarded as a whole, then the process of training VP can essentially be
seen as the process of calculating and updating loss gradient with respect to
part of the input image pixels. Prior works [60, 1] suggest that adversarial
robustness and standard generalization performance might be at odds with one
another, which is attributed to the fact that the feature representations of
standard and robust models are fundamentally different. To illustrate, in the
absence of a Visual Prompt (VP), when one calculates the loss gradient with
respect to the input image pixels (this operation can highlight the input
features that significantly influence the loss and hence the model’s
prediction), it becomes evident upon visualization that robust models develop
representations that are more aligned with prominent data features and human
perception, which is consistent with the traits exhibited by RSVP.

###  4.2 Prompt Boundary Loose

The above experimental findings indicate that while RSVP does inherit the
source model’s robustness, it similarly suffers from a decline in standard
accuracy akin to that of the source model, significantly constraining its
practical applicability. As shown in Fig.4, we introduce the Prompt Boundary
Loss (PBL) to solve this defect.

Previous research [10] delved into VP as a means of adversarial defense for a
standard pre-trained model. Their findings indicated that while VP-enriched
adversarial training can enhance model robustness, it also leads to a marked
decrease in standard accuracy. The experiments conducted by [10] were confined
to in-domain scenarios, i.e., the source and downstream datasets were
identical. As shown later, we carry out experiments on further adversarial
training of RSVP under cross-domain conditions and affirm that the observed
trade-off between standard accuracy and robustness hold true as well. To sum
up, since RSVP itself suffers from the decline of standard accuracy, further
adversarial training would only exacerbate this issue and increase computing
resource consumption and time usage, which is unrealistic and meaningless.

Referring back to Eq.3 and Eq.4, every input image from the target downstream
dataset is first processed by RSVP, and then by the source model, to yield a
predicted probability $f_{\theta^{*}}(\gamma_{\varphi}(x_{t}))$ that aligns
dimensionally with that of the source dataset. Subsequently, by employing the
pre-defined label mapping method $\mathcal{M}(\cdot)$, we obtain the final
predicted probability for the target dataset. In the RSVP scenario, the source
model is an adversarial-trained model, whose decision boundary is more complex
than a standard-trained one, while utilizing the pipeline of VP, the decision
boundary of the frozen source model is unchangeable, which will greatly
increase the learning difficulty of RSVP. One might assume that enhancing the
RSVP’s learning capabilities from a complex decision boundary could be
achieved by scaling it up to introduce more trainable parameters.
Nevertheless, existing research [4] suggests that such scaling offers marginal
benefits to VP performance, and beyond a certain threshold, it may even
adversely affect its efficacy. Motivated by the aforementioned insights and
observations, we introduce PBL as an initial step towards advancing the
functionality of RSVP.

Specifically, PBL can be defined as a function $\mathcal{Q}(\cdot)$, which
receives the output of the source model
$f_{\theta^{*}}(\gamma_{\varphi}(x_{t}))$ and a temperature $\mathcal{T}$ as
inputs, and combines the elements of $f_{\theta^{*}}(\gamma_{\varphi}(x_{t}))$
according to $\mathcal{T}$ to output an intermediate vector with a smaller
dimension than the original output, then do the label mapping step
$\mathcal{M}(\cdot)$ on this vector to get the final prediction for the target
downstream dataset. By formalizing the objective function with PBL, we get:

$\displaystyle\min_{\varphi}\,\mathbb{E}_{(x_{t},y_{t})\sim
D_{t}}[\mathcal{L_{PBL}}(\mathcal{M}(\mathcal{Q}(f_{\theta^{*}}(\gamma_{\varphi}(x_{t})),\mathcal{T}),y_{t}))]$
(5)
$\displaystyle\text{s.t.}\quad\theta^{*}=\min_{\theta}\,\mathbb{E}_{(x_{s},y_{s})\sim
D_{s}}[\max_{\delta\in\Delta}\mathcal{L}(x_{s}+\delta,\theta,y_{s})]$

We assume that the dimension of the output of the source model is $n$, and
record the original output $f_{\theta^{*}}(\gamma_{\varphi}(x_{t}))$ as a
vector $V=(v_{1},v_{2},...,v_{n})$. We deal with $n/\mathcal{T}$ elements at
once and divide $V$ into $\mathcal{T}$ parts, each of which is marked as:

$\displaystyle
V_{i}=(v_{(i-1)n/\mathcal{T}+1},v_{(i-1)n/\mathcal{T}+2},...,v_{in/\mathcal{T}}),$
(6) $\displaystyle i=1,2,...,\mathcal{T}$

Suppose the intermediate vector is called $\mathcal{I}$, its $i^{th}$ element
is the maximum value in the $i^{th}$ partition of $V$, i.e.,
$I_{i}=\max(V_{i})$, which means taking the maximum confidence score in the
current merged block as a representative value, as shown in Fig.4.
$\mathcal{I}$ can be expressed as:

$\mathcal{I}=(\max(V_{1}),\max(V_{2}),...,\max(V_{T}))$ (7)

The underlying intuition of the intermediate vector $\mathcal{I}$ lies in
leveraging the knowledge the source model has learned from the source dataset
to its fullest potential in the early stage of knowledge transfer. In
addition, the looser decision area increases the quality of label mapping,
thereby reducing the prediction difficulty of the downstream dataset. Finally,
we can use $\mathcal{I}$ to map the downstream dataset and get final
predictions:

$\displaystyle\mathcal{L_{PBL}}(\mathcal{M}(\mathcal{Q}(f_{\theta^{*}}(\gamma_{\varphi}(x_{t})),\mathcal{T}),y_{t}))$
(8)
$\displaystyle=\mathcal{L_{PBL}}(\mathcal{M}(\mathcal{Q}(V,\mathcal{T}),y_{t}))$
$\displaystyle=\mathcal{L_{PBL}}(\mathcal{M}(\mathcal{I},y_{t}))$

Note that upon applying VP to data from the same class in the downstream
dataset, the source model may yield varying predictions (with the highest
prediction probability associated with different classes). Furthermore, each
data point within the same class could exhibit multiple high confidence
scores. The temperature $\mathcal{T}$ in PBL can formally loosen the decision
boundary of $f_{\theta^{*}}(\cdot)$ thus reduce the difficulty of prediction
and alleviate the low accuracy caused by the aforementioned phenomenon.
Simultaneously, it preserves and leverages the intricate decision boundary of
the source model, ensuring that the robustness transferred from the source
model is well conserved. We find that PBL is highly compatible with existing
label mapping methods; it can function as a seamless, plug-and-play
enhancement to facilitate the training of a more effective VP.

LM | Dataset | ResNet18 | ResNet50 | Wide-ResNet50-2
---|---|---|---|---
Adv. (w/o) |  Adv. (w) |  Std. (w/o) |  Std. (w) |  Adv. (w/o) |  Adv. (w) |  Std. (w/o) |  Std. (w) |  Adv. (w/o) |  Adv. (w) |  Std. (w/o) |  Std. (w)
Random Label Mapping | F-102 | 33.33% | 32.79% | 5.24% | 7.43% | 40.57% | 46.02% | 4.30% | 4.63% | 19.33% | 45.92% | 4.83% | 5.24%
DTD | 26.47% | 39.36% | 4.02% | 5.56% | 25.97% | 37.17% | 4.55% | 6.68% | 45.16% | 42.14% | 5.50% | 8.33%
SVHN | 71.67% | 74.21% | 32.23% | 34.28% | 67.50% | 59.08% | 30.18% | 34.70% | 52.62% | 58.16% | 35.50% | 38.75%
G-RB | 53.03% | 78.71% | 12.42% | 13.84% | 74.35% | 77.16% | 11.95% | 14.11% | 75.38% | 80.99% | 15.08% | 17.87%
E-Sat | 46.45% | 47.70% | 50.72% | 53.46% | 43.59% | 50.91% | 53.05% | 57.78% | 42.46% | 52.73% | 54.23% | 56.31%
O-Pets | 5.83% | 14.75% | 3.27% | 4.99% | 14.39% | 16.57% | 3.60% | 4.93% | 18.85% | 24.60% | 3.33% | 6.76%
CI-100 | 75.07% | 77.13% | 3.53% | 4.95% | 66.26% | 72.20% | 4.97% | 5.16% | 77.77% | 74.06% | 3.79% | 5.61%
S-Cars | 13.04% | 13.11% | 0.57% | 0.76% | 6.66% | 20.37% | 0.56% | 0.67% | 28.81% | 32.69% | 0.73% | 0.83%
Iterative Label Mapping | F-102 | 40.65% | 44.66% | 18.88% | 22.82% | 34.36% | 34.86% | 17.70% | 22.45% | 34.38% | 37.25% | 19.53% | 20.71%
DTD | 41.11% | 44.03% | 15.96% | 18.79% | 43.09% | 50.87% | 18.38% | 20.45% | 54.28% | 50.14% | 20.04% | 21.45%
SVHN | 61.67% | 65.85% | 34.47% | 35.44% | 52.76% | 57.77% | 33.85% | 34.96% | 52.85% | 54.32% | 36.67% | 37.60%
G-RB | 68.96% | 67.92% | 17.47% | 20.24% | 74.42% | 75.15% | 17.64% | 19.46% | 62.23% | 64.82% | 18.50% | 19.26%
E-Sat | 41.21% | 42.13% | 59.20% | 61.83% | 47.32% | 47.36% | 58.12% | 63.10% | 53.87% | 53.68% | 55.59% | 60.72%
O-Pets | 32.84% | 35.55% | 16.60% | 23.00% | 38.53% | 38.15% | 27.15% | 33.74% | 38.25% | 37.18% | 34.21% | 36.17%
CI-100 | 65.34% | 68.99% | 11.60% | 12.81% | 60.80% | 59.19% | 11.51% | 12.70% | 64.69% | 64.71% | 10.97% | 12.28%
S-Cars | 20.26% | 25.00% | 1.90% | 2.29% | 24.44% | 27.22% | 1.68% | 2.10% | 33.57% | 33.14% | 1.78% | 2.23%

Table 1: Performance of our proposed Prompt Boundry Loose (PBL) under RSVP
setting over eight downstream datasets and three pre-trained robust source
models (ResNet-18, ResNet-50 and Wide-ResNet50-2 trained on ImageNet). Adv.
(w/o) and Std. (w/o) means Adversarial Accuracy and Standard Accuracy without
using PBL, while Adv. (w) and Std. (w) means Adversarial Accuracy and Standard
Accuracy when using PBL. The better outcomes are marked in bold.

##  5 Experiments

In this section, we empirically demonstrate the effectiveness of the proposed
PBL method in both adversarial and standard accuracy under RSVP on several
different datasets and models, and explored the characteristics of PBL from
multiple perspectives.

Dataset | f-102 | DTD | SVHN | G-RB | E-Sat | O-Pets | Cl-100 | S-Cars
---|---|---|---|---|---|---|---|---
$\mathcal{T}$ | 3 | 15 | 10 | 10 | 6 | 15 | 4 | 5

Table 2: $\mathcal{T}$ used in different datasets.

###  5.1 Experimental Settings

$\bullet$ Models and Datasets. We use two types of source model: Standard
Source Model and Robust Source Model, both of which include ResNet-18,
ResNet-50 and WideResNet-50-2 pre-trained on ImageNet-1K. For Standard Source
Model, we use the pre-trained models from torch and timm [62], while for
Robust Source Model, we use the pre-trained models from RobustBench [18] same
as in Fig.2, and for each backbone we select one robust model, all of which
come from [54] and are collected by RobustBench. As for datasets, we consider
to evaluate the performance of PBL over 8 downstream datasets: Flowers102
(F-102) [47], DTD [17], GTSRB (G-RB) [56], SVHN [46], EuroSAT (E-Sat) [30,
31], OxfordPets (O-Pets) [52], StanfordCars (S-Cars) [37] and CIFAR100
(CI-100) [38].

$\bullet$ Evaluations and Baselines. Without lose of generality, we consider
two different generally applicable label mapping methods [11]: Random Label
Mapping (RLM) and Iterative Label Mapping (ILM). RLM refers to randomly
matching the labels of source dataset to those of the target dataset before
training, while ILM refers to re-matching the labels of the source dataset to
those of the target dataset according to the prediction frequencies of the
source model after each iteration, so as to make full use of the training
dynamics of VP. For each LM-Dataset-Backbone combination, we explore the
standard accuracy (Std. Acc) as well as the adversarial accuracy (Adv. Acc)
with or without PBL and FGSM is used as an attack method. Moreover, we delve
into the impact of further adversarial training under RSVP, analyzing the
results from the aspects of Std. Acc, Adv. Acc, time usage and computing
resource consumption. Additionally, we dissect PBL’s characteristics through
various lenses, including temperature effects and prediction confidence
dynamics.

###  5.2 PBL brings benefits to RSVP

Tab.1 shows the effectiveness of our proposed PBL method under the RSVP
scenario, considering the combination of 8 different datasets, 3 different
backbones and 2 different LM methods. The first two columns for each backbone
demonstrates the capability of PBL in inheriting and maintaining (or even
improving) robustness, while the latter two columns show its effectiveness in
improving standard accuracy. The temperature $\mathcal{T}$ used under each
dataset in Tab.1 is shown in Tab.2. It is significant to observe that a
consistent temperature setting $\mathcal{T}$ across diverse backbone and LM
method pairings yields uniform performance enhancements, which confirms the
general advantages of PBL. Subsequent experiments will detail how temperature
$\mathcal{T}$ influences performance across various datasets.

Tab.1 demonstrates that our proposed PBL method notably enhances performance
in nearly all settings. Particularly, the standard accuracy achieved with PBL
consistently surpasses that without it across all setups. For example, with
ResNet50 as backbone, Std. Acc of E-Sat dataset is improved by 4.73% under RLM
and 4.98% under ILM. As for robustness, except for a slight decrease in a few
setups, the Adv. Acc is well maintained or even greatly improved. For
instance, when the backbone and LM methods are ResNet18 and RLM, the Adv. Acc
of DTD increases by 12.89% and the Adv. Acc of OxfordPets increases by 8.92%.
Moreover, our findings indicate that superior label mapping methods (e.g., ILM
over RLM) can enhance standard accuracy but do not guarantee that VP can
better inherit the robustness of the source model. For instance, with ResNet18
as backbone and without PBL, robustness of E-Sat drops from 46.45% under RLM
to 41.21% under ILM—a reduction of 5.24%. Similarly, robustness of CI-100
decreases from 75.07% with RLM to 65.34% with ILM. In most cases, our PBL
method generally enables VP to better inherit robustness of the source model,
regardless of the label mapping method applied.

(a) Random Mapping

(b) Iterative Mapping

Figure 5: The performance improvement of PBL in EuroSAT, DTD and OxfordPets at
different temperatures $\mathcal{T}$, the standard accuracy is represented by
solid lines and circles, while the adversarial accuracy is represented by
dotted lines and asterisks. The range of temperature $\mathcal{T}$ is set
between 1 and 20.

Note that the computation of adversarial accuracy presupposes the model’s
correct initial classification of a sample—we only attempt an attack on
samples that the model has accurately identified pre-attack. Hence, employing
PBL typically results in a larger set of samples subject to
attack—attributable to the overall enhancement in standard accuracy.
Therefore, when using PBL, it becomes more challenging to preserve or enhance
the Adv. Acc of RSVP, thereby indicating that PBL provides a more accurate
gauge of robustness.

###  5.3 Understanding of PBL

In this section, we explore the characteristics of PBL and some potential
factors that is likely to affect the performance.

$\bullet$ General advantages at different temperature $\mathcal{T}$. We
explored the effect of different temperature $\mathcal{T}$ on the performance
of PBL. Without losing generality, we set temperature $\mathcal{T}$ to five
values between 1 and 20 on EuroSAT, DTD and OxfordPets with ResNet50 as the
backbone. The value of $\mathcal{T}$ = 1 is set as the zero point to indicate
the baseline performance without PBL. Performance at different temperatures is
measured as the improvement rate relative to this baseline. The results are
shown in Fig.5.

We can find that regardless of the temperature setting, PBL consistently
yields substantial gains in standard accuracy across the board. Specifically,
PBL enhances standard accuracy by approximately 10% across all temperature
setups on EuroSAT. With DTD, employing RLM as the label mapping method
typically results in a 40% increase, while OxfordPets sees a peak improvement
of around 80%. In addition, adversarial accuracy remains stable across various
$\mathcal{T}$ values, with notable improvements observed at certain points.
For example, with RLM, adversarial accuracy on E-SAT at $\mathcal{T}$ = 5, DTD
at $\mathcal{T}$ = 15, and O-Pets at $\mathcal{T}$ = 5 increases by 20%, 40%,
and 50%, respectively.

(a) Training Dynamics of EuroSat

(b) Training Dynamics of GTSRB

Figure 6: The training dynamics for the EuroSat and GTSRB datasets during the
first 50 epochs utilizing RLM. PBL proves beneficial in the early stage of
training.

Dataset | Perf. | w/o. PBL | w/o. PBL+AT | w. PBL | w. PBL+AT
---|---|---|---|---|---
F-102 | Std. | 17.70% | 16.16% | 22.45% | 19.20%
Adv. | 34.36% | 53.27% | 34.86% | 52.43%
DTD | Std. | 18.38% | 17.61% | 20.45% | 19.27%
Adv. | 43.09% | 51.68% | 50.87% | 51.23%
O-Pets | Std. | 27.15% | 24.83% | 33.74% | 31.53%
Adv. | 38.53% | 37.10% | 38.15% | 38.14%

Table 3: The result of using four different combinations of strategies in
different datasets. AT can improve robustness in some cases, however,
sometimes it can not bring considerable gain but will consume more resources.
In contrast, PBL can improve standard accuracy while maintaining robustness
regardless of whether AT is utilized or not.

Figure 7: Time usage and computing resource consumption under different
combinations of PBL and AT. The bar chart represents time usage while the line
chart represents the computing resource consumption. Results are the mean
values per epoch.

It is worth noting that different LM methods exhibit a consistent trend in
standard accuracy gains across varying temperatures. For instance, on the DTD
dataset, performance enhancement exhibits an ‘M-shaped’ pattern with rising
temperatures, peaking at $\mathcal{T}$ = 5 and $\mathcal{T}$ = 15,
outperforming adjacent temperature values. One possible explanation is that
different LM methods may tap into specific phases of the VP training dynamics,
including initialization and subsequent updates, to enhance overall
performance. RLM sets the mapping at beginning and maintains it throughout
later iterations, making it dependent solely on the quality of the
initialization. ILM continuously revises its mapping sequence post-
initialization (which can be seen as a re-initialization), capitalizing on the
evolving training dynamics of VP. Meanwhile, PBL select and pre-define a
dynamic initialization for each training iteration from the potential
distribution, enhancing the default settings and thereby improving the
efficacy of different LM methods. To verify this hypothesis, Fig.6 displays
the training dynamics for the EuroSat and GTSRB datasets. From the onset,
employing PBL yields a higher initial average confidence score and a lower
training loss compared to the non-PBL setup. This advantage was maintained or
even enhanced throughout the subsequent training process, demonstrating the
superior performance offered by PBL in the initialization phase.

LM | Dataset | ResNet18 | ResNet50
---|---|---|---
Std. Acc (w/o) | Std. Acc (w) | Std. Acc (w/o) | Std. Acc (w)
RLM | f-102 | 12.02% | 13.28% | 9.83% | 12.06%
gtsrb | 47.14% | 49.05% | 45.67% | 46.83%
C-100 | 9.95% | 11.36% | 9.61% | 10.82%
ILM | f-102 | 29.03% | 30.82% | 26.23% | 26.67%
gtsrb | 52.86% | 54.22% | 53.94% | 55.61%
C-100 | 25.08% | 27.34% | 38.87% | 40.50%

Table 4: Comparison of standard accuracy with and without PBL under SSVP.

$\bullet$ PBL brings benefits to SSVP. It’s intolerable to observe an
improvement in standard accuracy solely for RSVP if it coincides with a
substantial decrease for SSVP, as such a scenario would severely limit the
practicality of the proposed method. Thus, we conduct additional experiments
to assess PBL’s performance with SSVP and anticipate that PBL will not
detrimentally impact the generalization performance. As shown in Tab.4, we are
gratified to find that PBL not only markedly enhances the standard and
adversarial accuracy in the RSVP context but also boosts the standard accuracy
under SSVP—a welcome additional benefit, albeit not the primary aim of PBL.
Thus, PBL emerges as a versatile technique for enhancing the performance of VP
across various source model types.

$\bullet$ The intolerability of adversarial training for VP. We further
examine the efficacy of additional adversarial training for RSVP in cross-
domain transfer learning context. Note that the standard accuracy for RSVP is
considerably lower than that for SSVP as a price of robustness. Thus,
additional adversarial training for RSVP could exacerbate the reduction in
standard accuracy. While this may yield robustness, a model that is robust yet
lacks generalization ability is meaningless.

In Tab.3 and Fig.7, we assess the impact of PBL and Adversarial Training (AT).
Our analysis encompasses standard and adversarial accuracy, as well as average
time usage and computing resource consumption over 200 training epochs, under
four distinct combinations of PBL and AT. As shown in Tab.3, while adversarial
training alone enhances RSVP’s robustness (columns 1 & 2), it notably
compromises standard accuracy. Even in some cases, e.g, with DTD and
OxfordPets as target datasets, adversarial training not only leads to a
reduction in standard accuracy but also offers negligible robustness gains
(columns 2 & 3), while significantly increasing computational resource
consumption ($\simeq 1.5\times$) and time usage ($\simeq 6\times$), which is
intolerable. In contrast, applying PBL without adversarial training (columns 1
& 3) enhances the standard accuracy of RSVP and preserves or even boosts its
robustness. When combining PBL with adversarial training, PBL mitigates the
drop in standard accuracy typically induced by adversarial training and
sustains robustness enhancements (columns 2 & 4), without additional time
usage or computational resource consumption.

##  6 Conclusion

In this paper, we undertake an unprecedented exploration of the properties of
Robust Source Model Visual Prompt (RSVP). We discover that RSVP inherit the
robustness of the source model and provide an interpretation at visual
representation level. Moreover, RSVP also experience suboptimal results in
terms of standard accuracy. To address this problem, we introduce the first
solution known as Prompt Boundary Loose (PBL), aiming at reducing the learning
difficulty of RSVP by formally relaxing the decision boundary of the source
model in conjunction with various label mapping methods. Extensive experiments
results demonstrate that our proposed PBL not only maintains the robustness of
RSVP but also enhances its generalization ability for various downstream
datasets.

## References

  * Allen-Zhu and Li [2022] Zeyuan Allen-Zhu and Yuanzhi Li.  Feature purification: How adversarial training performs robust deep learning.  In _2021 IEEE 62nd Annual Symposium on Foundations of Computer Science (FOCS)_ , pages 977–988. IEEE, 2022.
  * Andriushchenko and Flammarion [2020] Maksym Andriushchenko and Nicolas Flammarion.  Understanding and improving fast adversarial training.  _Advances in Neural Information Processing Systems_ , 33:16048–16059, 2020.
  * Andriushchenko et al. [2020] Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein.  Square attack: a query-efficient black-box adversarial attack via random search.  In _European conference on computer vision_ , pages 484–501. Springer, 2020.
  * Bahng et al. [2022] Hyojin Bahng, Ali Jahanian, Swami Sankaranarayanan, and Phillip Isola.  Exploring visual prompts for adapting large-scale models.  _arXiv preprint arXiv:2203.17274_ , 2022.
  * Bao et al. [2021] Hangbo Bao, Li Dong, Songhao Piao, and Furu Wei.  Beit: Bert pre-training of image transformers.  _arXiv preprint arXiv:2106.08254_ , 2021.
  * Brendel et al. [2017] Wieland Brendel, Jonas Rauber, and Matthias Bethge.  Decision-based adversarial attacks: Reliable attacks against black-box machine learning models.  _arXiv preprint arXiv:1712.04248_ , 2017.
  * Brown et al. [2020] Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al.  Language models are few-shot learners.  _Advances in neural information processing systems_ , 33:1877–1901, 2020.
  * Chakraborty et al. [2018] Anirban Chakraborty, Manaar Alam, Vishal Dey, Anupam Chattopadhyay, and Debdeep Mukhopadhyay.  Adversarial attacks and defences: A survey.  _arXiv preprint arXiv:1810.00069_ , 2018.
  * Chan et al. [2019] Alvin Chan, Yi Tay, Yew Soon Ong, and Jie Fu.  Jacobian adversarially regularized networks for robustness.  _arXiv preprint arXiv:1912.10185_ , 2019.
  * Chen et al. [2023a] Aochuan Chen, Peter Lorenz, Yuguang Yao, Pin-Yu Chen, and Sijia Liu.  Visual prompting for adversarial robustness.  In _ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)_ , pages 1–5. IEEE, 2023a.
  * Chen et al. [2023b] Aochuan Chen, Yuguang Yao, Pin-Yu Chen, Yihua Zhang, and Sijia Liu.  Understanding and improving visual prompting: A label-mapping perspective.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 19133–19143, 2023b.
  * Chen and Gu [2020] Jinghui Chen and Quanquan Gu.  Rays: A ray searching method for hard-label adversarial attack.  In _Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining_, pages 1739–1747, 2020.
  * Chen et al. [2021] Lingwei Chen, Yujie Fan, and Yanfang Ye.  Adversarial reprogramming of pretrained neural networks for fraud detection.  In _Proceedings of the 30th ACM International Conference on Information & Knowledge Management_, pages 2935–2939, 2021.
  * Chen et al. [2022] Shoufa Chen, Chongjian Ge, Zhan Tong, Jiangliu Wang, Yibing Song, Jue Wang, and Ping Luo.  Adaptformer: Adapting vision transformers for scalable visual recognition.  _Advances in Neural Information Processing Systems_ , 35:16664–16678, 2022.
  * Chen and He [2021] Xinlei Chen and Kaiming He.  Exploring simple siamese representation learning.  In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_ , pages 15750–15758, 2021.
  * Cheng et al. [2019] Shuyu Cheng, Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu.  Improving black-box adversarial attacks with a transfer-based prior.  _Advances in neural information processing systems_ , 32, 2019.
  * Cimpoi et al. [2014] Mircea Cimpoi, Subhransu Maji, Iasonas Kokkinos, Sammy Mohamed, and Andrea Vedaldi.  Describing textures in the wild.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , pages 3606–3613, 2014.
  * Croce et al. [2021] Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein.  Robustbench: a standardized adversarial robustness benchmark.  In _Thirty-fifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track_ , 2021.
  * Deng et al. [2009] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei.  Imagenet: A large-scale hierarchical image database.  In _2009 IEEE conference on computer vision and pattern recognition_ , pages 248–255. Ieee, 2009.
  * Devlin et al. [2018] Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova.  Bert: Pre-training of deep bidirectional transformers for language understanding.  _arXiv preprint arXiv:1810.04805_ , 2018.
  * Elsayed et al. [2018] Gamaleldin F Elsayed, Ian Goodfellow, and Jascha Sohl-Dickstein.  Adversarial reprogramming of neural networks.  _arXiv preprint arXiv:1806.11146_ , 2018.
  * Engstrom et al. [2019] Logan Engstrom, Andrew Ilyas, Hadi Salman, Shibani Santurkar, and Dimitris Tsipras.  Robustness (python library), 2019.
  * Ganin et al. [2016] Yaroslav Ganin, Evgeniya Ustinova, Hana Ajakan, Pascal Germain, Hugo Larochelle, François Laviolette, Mario Marchand, and Victor Lempitsky.  Domain-adversarial training of neural networks.  _The journal of machine learning research_ , 17(1):2096–2030, 2016.
  * Gao et al. [2023] Peng Gao, Shijie Geng, Renrui Zhang, Teli Ma, Rongyao Fang, Yongfeng Zhang, Hongsheng Li, and Yu Qiao.  Clip-adapter: Better vision-language models with feature adapters.  _International Journal of Computer Vision_ , pages 1–15, 2023.
  * Geirhos et al. [2018] Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A Wichmann, and Wieland Brendel.  Imagenet-trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness.  _arXiv preprint arXiv:1811.12231_ , 2018.
  * Goodfellow et al. [2014] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and harnessing adversarial examples.  _arXiv preprint arXiv:1412.6572_ , 2014.
  * Gowal et al. [2020] Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli.  Uncovering the limits of adversarial training against norm-bounded adversarial examples.  _arXiv preprint arXiv:2010.03593_ , 2020.
  * Guo et al. [2019] Chuan Guo, Jacob Gardner, Yurong You, Andrew Gordon Wilson, and Kilian Weinberger.  Simple black-box adversarial attacks.  In _International Conference on Machine Learning_ , pages 2484–2493. PMLR, 2019.
  * He et al. [2022] Kaiming He, Xinlei Chen, Saining Xie, Yanghao Li, Piotr Dollár, and Ross Girshick.  Masked autoencoders are scalable vision learners.  In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_ , pages 16000–16009, 2022.
  * Helber et al. [2018] Patrick Helber, Benjamin Bischke, Andreas Dengel, and Damian Borth.  Introducing eurosat: A novel dataset and deep learning benchmark for land use and land cover classification.  In _IGARSS 2018-2018 IEEE International Geoscience and Remote Sensing Symposium_ , pages 204–207. IEEE, 2018.
  * Helber et al. [2019] Patrick Helber, Benjamin Bischke, Andreas Dengel, and Damian Borth.  Eurosat: A novel dataset and deep learning benchmark for land use and land cover classification.  _IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing_ , 2019.
  * Howard and Ruder [2018] Jeremy Howard and Sebastian Ruder.  Universal language model fine-tuning for text classification.  _arXiv preprint arXiv:1801.06146_ , 2018.
  * Ilyas et al. [2018] Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin.  Black-box adversarial attacks with limited queries and information.  In _International conference on machine learning_ , pages 2137–2146. PMLR, 2018.
  * Jang et al. [2019] Yunseok Jang, Tianchen Zhao, Seunghoon Hong, and Honglak Lee.  Adversarial defense via learning to generate diverse attacks.  In _Proceedings of the IEEE/CVF International Conference on Computer Vision_ , pages 2740–2749, 2019.
  * Jia et al. [2022a] Menglin Jia, Luming Tang, Bor-Chun Chen, Claire Cardie, Serge Belongie, Bharath Hariharan, and Ser-Nam Lim.  Visual prompt tuning.  In _European Conference on Computer Vision_ , pages 709–727. Springer, 2022a.
  * Jia et al. [2022b] Xiaojun Jia, Yong Zhang, Baoyuan Wu, Jue Wang, and Xiaochun Cao.  Boosting fast adversarial training with learnable adversarial initialization.  _IEEE Transactions on Image Processing_ , 31:4417–4430, 2022b.
  * Krause et al. [2013] Jonathan Krause, Michael Stark, Jia Deng, and Li Fei-Fei.  3d object representations for fine-grained categorization.  In _Proceedings of the IEEE international conference on computer vision workshops_ , pages 554–561, 2013.
  * Krizhevsky et al. [2009] Alex Krizhevsky, Geoffrey Hinton, et al.  Learning multiple layers of features from tiny images.  2009\.
  * Kumar et al. [2022] Ananya Kumar, Aditi Raghunathan, Robbie Jones, Tengyu Ma, and Percy Liang.  Fine-tuning can distort pretrained features and underperform out-of-distribution.  _arXiv preprint arXiv:2202.10054_ , 2022.
  * Kurakin et al. [2016] Alexey Kurakin, Ian Goodfellow, and Samy Bengio.  Adversarial machine learning at scale.  _arXiv preprint arXiv:1611.01236_ , 2016.
  * Lester et al. [2021] Brian Lester, Rami Al-Rfou, and Noah Constant.  The power of scale for parameter-efficient prompt tuning.  _arXiv preprint arXiv:2104.08691_ , 2021.
  * Li and Liang [2021] Xiang Lisa Li and Percy Liang.  Prefix-tuning: Optimizing continuous prompts for generation.  _arXiv preprint arXiv:2101.00190_ , 2021.
  * Liao et al. [2018] Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu.  Defense against adversarial attacks using high-level representation guided denoiser.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , pages 1778–1787, 2018.
  * Liu et al. [2023] Pengfei Liu, Weizhe Yuan, Jinlan Fu, Zhengbao Jiang, Hiroaki Hayashi, and Graham Neubig.  Pre-train, prompt, and predict: A systematic survey of prompting methods in natural language processing.  _ACM Computing Surveys_ , 55(9):1–35, 2023.
  * Neekhara et al. [2022] Paarth Neekhara, Shehzeen Hussain, Jinglong Du, Shlomo Dubnov, Farinaz Koushanfar, and Julian McAuley.  Cross-modal adversarial reprogramming.  In _Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision_ , pages 2427–2435, 2022.
  * Netzer et al. [2011] Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng.  Reading digits in natural images with unsupervised feature learning.  2011\.
  * Nilsback and Zisserman [2008] Maria-Elena Nilsback and Andrew Zisserman.  Automated flower classification over a large number of classes.  In _2008 Sixth Indian conference on computer vision, graphics & image processing_, pages 722–729. IEEE, 2008.
  * Oh et al. [2023] Changdae Oh, Hyeji Hwang, Hee-young Lee, YongTaek Lim, Geunyoung Jung, Jiyoung Jung, Hosik Choi, and Kyungwoo Song.  Blackvip: Black-box visual prompting for robust transfer learning.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 24224–24235, 2023.
  * Pan and Yang [2009] Sinno Jialin Pan and Qiang Yang.  A survey on transfer learning.  _IEEE Transactions on knowledge and data engineering_ , 22(10):1345–1359, 2009.
  * Pang et al. [2022] Tianyu Pang, Min Lin, Xiao Yang, Jun Zhu, and Shuicheng Yan.  Robustness and accuracy could be reconcilable by (proper) definition.  In _International Conference on Machine Learning_ , pages 17258–17277. PMLR, 2022.
  * Papernot et al. [2017] Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami.  Practical black-box attacks against machine learning.  In _Proceedings of the 2017 ACM on Asia conference on computer and communications security_ , pages 506–519, 2017.
  * Parkhi et al. [2012] Omkar M Parkhi, Andrea Vedaldi, Andrew Zisserman, and CV Jawahar.  Cats and dogs.  In _2012 IEEE conference on computer vision and pattern recognition_ , pages 3498–3505. IEEE, 2012.
  * Raina et al. [2007] Rajat Raina, Alexis Battle, Honglak Lee, Benjamin Packer, and Andrew Y Ng.  Self-taught learning: transfer learning from unlabeled data.  In _Proceedings of the 24th international conference on Machine learning_ , pages 759–766, 2007.
  * Salman et al. [2020] Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry.  Do adversarially robust imagenet models transfer better?  _Advances in Neural Information Processing Systems_ , 33:3533–3545, 2020.
  * Shafahi et al. [2019] Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein.  Adversarial training for free!  _Advances in Neural Information Processing Systems_ , 32, 2019.
  * Stallkamp et al. [2011] Johannes Stallkamp, Marc Schlipsing, Jan Salmen, and Christian Igel.  The german traffic sign recognition benchmark: a multi-class classification competition.  In _The 2011 international joint conference on neural networks_ , pages 1453–1460. IEEE, 2011.
  * Tramer and Boneh [2019] Florian Tramer and Dan Boneh.  Adversarial training and robustness for multiple perturbations.  _Advances in neural information processing systems_ , 32, 2019.
  * Tramèr et al. [2017] Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel.  Ensemble adversarial training: Attacks and defenses.  _arXiv preprint arXiv:1705.07204_ , 2017.
  * Tsai et al. [2020] Yun-Yun Tsai, Pin-Yu Chen, and Tsung-Yi Ho.  Transfer learning without knowing: Reprogramming black-box machine learning models with scarce data and limited resources.  In _International Conference on Machine Learning_ , pages 9614–9624. PMLR, 2020.
  * Tsipras et al. [2018] Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry.  Robustness may be at odds with accuracy.  _arXiv preprint arXiv:1805.12152_ , 2018.
  * Wang and Zhang [2019] Jianyu Wang and Haichao Zhang.  Bilateral adversarial training: Towards fast training of more robust models against adversarial attacks.  In _Proceedings of the IEEE/CVF international conference on computer vision_ , pages 6629–6638, 2019.
  * Wightman [2019] Ross Wightman.  Pytorch image models.  https://github.com/rwightman/pytorch-image-models, 2019.
  * Wong et al. [2020] Eric Wong, Leslie Rice, and J Zico Kolter.  Fast is better than free: Revisiting adversarial training.  _arXiv preprint arXiv:2001.03994_ , 2020.
  * Wortsman et al. [2022] Mitchell Wortsman, Gabriel Ilharco, Jong Wook Kim, Mike Li, Simon Kornblith, Rebecca Roelofs, Raphael Gontijo Lopes, Hannaneh Hajishirzi, Ali Farhadi, Hongseok Namkoong, et al.  Robust fine-tuning of zero-shot models.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 7959–7971, 2022.
  * Xie et al. [2020a] Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan L Yuille, and Quoc V Le.  Adversarial examples improve image recognition.  In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_ , pages 819–828, 2020a.
  * Xie et al. [2020b] Cihang Xie, Mingxing Tan, Boqing Gong, Alan Yuille, and Quoc V Le.  Smooth adversarial training.  _arXiv preprint arXiv:2006.14536_ , 2020b.
  * Zhang and Li [2019] Jiliang Zhang and Chen Li.  Adversarial examples: Opportunities and challenges.  _IEEE transactions on neural networks and learning systems_ , 31(7):2578–2593, 2019.
  * Zhang and Zhu [2019] Tianyuan Zhang and Zhanxing Zhu.  Interpreting adversarially trained convolutional neural networks.  In _International conference on machine learning_ , pages 7502–7511. PMLR, 2019.
  * Zhou et al. [2022a] Kaiyang Zhou, Jingkang Yang, Chen Change Loy, and Ziwei Liu.  Conditional prompt learning for vision-language models.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 16816–16825, 2022a.
  * Zhou et al. [2022b] Kaiyang Zhou, Jingkang Yang, Chen Change Loy, and Ziwei Liu.  Learning to prompt for vision-language models.  _International Journal of Computer Vision_ , 130(9):2337–2348, 2022b.