Exploring Adversarially Robust Training for Unsupervised Domain Adaptation

Abstract

Unsupervised Domain Adaptation (UDA) methods aim to transfer knowledge from a labeled source domain to an unlabeled target domain. UDA has been extensively studied in the computer vision literature. Deep networks have been shown to be vulnerable to adversarial attacks. However, very little focus is devoted to improving the adversarial robustness of deep UDA models, causing serious concerns about model reliability.Adversarial Training (AT) has been considered to be the most successful adversarial defense approach. Nevertheless, conventional AT requires ground-truth labels to generate adversarial examples and train models, which limits its effectiveness in the unlabeled target domain. In this paper, we aim to explore AT to robustify UDA models: How to enhance the unlabeled data robustness via AT while learning domain-invariant features for UDA? To answer this, we provide a systematic study into multiple AT variants that potentially apply to UDA. Moreover, we propose a novel Adversarially Robust Training method for UDA accordingly, referred to as ARTUDA. Extensive experiments on multiple attacks and benchmarks show that ARTUDA consistently improves the adversarial robustness of UDA models.

SRoUDA: Meta Self-Training for Robust Unsupervised Domain Adaptation

“…Meanwhile, the main challenges for incorporating AT in UDA is the missing label information in target domain while AT needs ground-truth labels for generating adversarial examples. To address this issue, existing methods either skip the AT (Awais et al 2021) or use self-supervised methods (Lo and Patel 2022) to generate adversarial examples. For instance, Awais et al (Awais et al 2021) directly explored the robustness transfer in UDA process instead of using the AT, and proposed to use an external pre-trained robust model for robust feature distillation during UDA process.…”

“…Despite its effectiveness, its performance is limited by the teacher model's perturbation budget and sensitive to the architecture of teacher model. On the other hand, Lo et al (Lo and Patel 2022) proposed to use a self-supervised adversarial example generation for injection of AT into UDA. Sadly, such adversarial example generation cannot guarantee the inner-maximization in AT, thus leading to unsatisfied model robustness.…”