[Paper Review] Adversarially-Trained Deep Nets Transfer Better

Francisco Utrera, Evan Kravitz+3 more|arXiv (Cornell University)|Jul 11, 2020

Adversarial Robustness in Machine Learning26 references24 citations

TL;DR

This paper demonstrates that adversarially-trained deep neural networks transfer more effectively to new domains than naturally-trained models, despite worse generalization on the source domain. The improvement arises from adversarial training biasing feature representations in early layers toward more natural, generic image structures, enhancing transferability even with limited target data.

ABSTRACT

Transfer learning has emerged as a powerful methodology for adapting pre-trained deep neural networks to new domains. This process consists of taking a neural network pre-trained on a large feature-rich source dataset, freezing the early layers that encode essential generic image properties, and then fine-tuning the last few layers in order to capture specific information related to the target situation. This approach is particularly useful when only limited or weakly labelled data are available for the new task. In this work, we demonstrate that adversarially-trained models transfer better across new domains than naturally-trained models, even though it's known that these models do not generalize as well as naturally-trained models on the source domain. We show that this behavior results from a bias, introduced by the adversarial training, that pushes the learned inner layers to more natural image representations, which in turn enables better transfer.

Motivation & Objective

• To investigate why adversarially-trained models generalize better in transfer learning despite poorer performance on the source domain.
• To understand the underlying mechanism driving improved transferability in adversarially-trained networks.
• To explore whether adversarial training induces a bias toward more natural image representations in early layers.
• To compare transfer performance between adversarially-trained and naturally-trained models on downstream tasks with limited labeled data.

Proposed method

• Pre-train deep neural networks on a large source dataset using adversarial training to improve robustness to input perturbations.
• Freeze the early convolutional layers of the pre-trained model to retain learned generic features.
• Fine-tune only the final layers on a new, smaller target dataset with limited or weak supervision.
• Analyze the internal representations of the frozen early layers to assess their alignment with natural image statistics.
• Compare transfer performance between adversarially-trained and naturally-trained models on multiple downstream tasks.
• Use activation statistics and feature visualization to demonstrate that adversarial training promotes more natural image representations in early layers.

Experimental results

Research questions

• RQ1 Does adversarial training improve transfer learning performance despite worse generalization on the source domain?
• RQ2 What specific inductive bias does adversarial training introduce in the network's internal representations?
• RQ3 How do the feature representations learned by adversarially-trained models compare to those of naturally-trained models in terms of natural image structure?
• RQ4 To what extent does the improved transferability stem from the network's ability to learn more generic, transferable features?
• RQ5 Can the bias toward natural image representations explain the superior transfer performance of adversarially-trained models?

Key findings

• Adversarially-trained models achieve significantly better transfer performance on downstream tasks compared to naturally-trained models, even when the latter generalize better on the source domain.
• The improvement in transferability is attributed to a bias introduced by adversarial training that encourages early layers to learn more natural image representations.
• Feature activations in adversarially-trained models show stronger alignment with natural image statistics, such as edge and texture patterns, compared to naturally-trained models.
• The bias toward natural image representations is most pronounced in the early convolutional layers, which are frozen during transfer.
• Even with limited labeled data in the target domain, adversarially-trained models consistently outperform their naturally-trained counterparts in transfer learning benchmarks.
• The results suggest that adversarial training can serve as a regularizer that enhances feature transferability by promoting more generic and robust feature learning.