Adversarially trained linear transformers transfer robustness to new tasks
Adversarially Trained Linear Transformers Are Optimal Robust In-Context Learners for Gaussian Mixtures
Machine LearningComputer Vision and Pattern Recognition
Summary
Models can be tricked by small changes called adversarial attacks. Usually, defending against these attacks requires retraining for each new task, which is costly. The authors show that a single model trained with adversarial defense on multiple tasks can be robust against attacks on new, unseen tasks without extra training. This works especially well for tasks involving classifying data drawn from mixtures of Gaussian distributions. They prove their model reaches the best possible robust accuracy by learning from clean examples within the new task context.
What this means in practice
- •For machine learning engineers: Build models that retain adversarial robustness across different classification tasks without retraining for each new one.
- •For security software developers: Deploy more reliable AI models that resist adversarial attacks on unseen data distributions by using pre-trained robust transformers.
Tested on simulated data.
Authors
Soichiro Kumano
Abstract
Adversarial training is one of the most reliable defenses against adversarial attacks, but its high computational cost must generally be paid anew for each task. Robust foundation models offer a promising alternative: adversarially pretrain a model once and then transfer its robustness to downstream tasks through lightweight adaptation. However, a fundamental question remains open: can robustness acquired during pretraining transfer to unseen tasks without further adversarial training? In this study, we answer this question affirmatively. A single model adversarially pretrained at scale can achieve optimal robustness on new tasks without additional task-specific training. Specifically, we show that, for a family of Gaussian-mixture classification tasks, a sufficiently deep linear transformer adversarially trained across tasks can asymptotically attain the robust Bayes error on previously unseen tasks through in-context learning from clean demonstrations. By contrast, a standardly trained model cannot. We further analyze convergence under gradient flow, an accuracy--robustness trade-off, and demonstration complexity.