Focusing on what humans see: Robustness enhancement through adversarial supervised contrastive learning

Abstract

Deep Neural Networks (DNNs) have various vulnerabilities such as unpredictable behavior on adversarial examples. Adversarial training (AT) encourages models to learn robust, human-perceptible features rather than non-robust features present in the data distribution, which, although imperceptible to humans, are utilized for classification and lead to adversarial examples. However, while traditional AT methods achieve robustness against adversarial attacks, they suffer from various performance degradations. We hypothesize that this phenomenon is related to cross-entropy loss, and can be mitigated by using contrastive loss, which learns common features across samples through batch-wise comparisons. In response, we propose Robust Supervised Contrastive Learning (RSupCon), which extends supervised contrastive learning to the adversarial domain with two strategies: combining various augmentations and separating the anchor and contrast sets. The combined augmentations encourage the model to focus on learning robust features, and separating the contrast set reduces the learning of non-robust features. With these two strategies, RSupCon effectively helps the model discriminate robust features within images transformed in various ways and adversarial examples. Experiments on benchmark datasets demonstrate that RSupCon offers adversarial robustness comparable to traditional AT methods while mitigating performance degradation. Visual evidence further confirms the ability of our method to learn representations centered on robust features. Furthermore, several experimental results and analyses offer novel insights into non-robust features and adversarial training.