RobustPrompt: Learning to defend against adversarial attacks with adaptive visual prompts

Abstract

Adversarial training stands out as one of the most effective techniques for enhancing robustness by enriching the training data with adversarial examples. Nonetheless, when faced with various perturbation budgets, the model’s performance can suffer notable degradation. This occurs because different perturbations induce distinct distribution shifts in adversarial examples. In order to enhance performance on specific perturbations, fine-tuning is commonly employed. However, this approach can lead to catastrophic forgetting, where improvements on specific tasks come at the cost of degrading performance on previously learned ones. We frame this challenge as an incremental domain learning problem in continual learning. Inspired by the application of prompt techniques in vision models, we introduce RobustPrompt, which integrates additional guidance information regarding perturbation characteristics into the adversarial training process. This approach enables the model to adaptively enhance its robustness under varying budget perturbations. Specifically, we define an adaptive prompt pool composed of a noise level predictor and corresponding prompts for different perturbations. During training, prompts are injected into different layers of the model, thereby guiding the model to focus on correct features. Experiments demonstrate that RobustPrompt enhances the adversarial robustness of the state-of-the-art Swin Transformer Base model, achieving an average improvement of 61.1% against PGD attacks and 56.9% against AutoAttack across five white-box settings; an average improvement of 76.1% against VMI-FGSM attacks across five black-box settings; an average improvement of 53.7% on five datasets with natural noise. Our results underscore the potential of RobustPrompt as a useful tool for enhancing the reliability and robustness of transformers in image classification tasks.