{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/adversarial-examples-are-not-real-features-1","title":"Adversarial Examples Are Not Real Features","arxiv_id":"2310.18936","date":"2023-10-29","proceeding":"NeurIPS 2023 11","authors":["Ang Li","Yifei Wang","Yiwen Guo","Yisen Wang"],"abstract":"The existence of adversarial examples has been a mystery for years and attracted much interest. A well-known theory by \\citet{ilyas2019adversarial} explains adversarial vulnerability from a data perspective by showing that one can extract non-robust features from adversarial examples and these features alone are useful for classification. However, the explanation remains quite counter-intuitive since non-robust features are mostly noise features to humans. In this paper, we re-examine the theory from a larger context by incorporating multiple learning paradigms. Notably, we find that contrary to their good usefulness under supervised learning, non-robust features attain poor usefulness when transferred to other self-supervised learning paradigms, such as contrastive learning, masked image modeling, and diffusion models. It reveals that non-robust features are not really as useful as robust or natural features that enjoy good transferability between these paradigms. Meanwhile, for robustness, we also show that naturally trained encoders from robust features are largely non-robust under AutoAttack. Our cross-paradigm examination suggests that the non-robust features are not really useful but more like paradigm-wise shortcuts, and robust features alone might be insufficient to attain reliable model robustness. Code is available at \\url{https://github.com/PKU-ML/AdvNotRealFeatures}.","url_abs":"https://arxiv.org/abs/2310.18936v4","url_pdf":"https://arxiv.org/pdf/2310.18936v4.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"adversarial-examples-are-not-real-features-1","repo_url":"https://github.com/pku-ml/advnotrealfeatures","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[{"task_slug":"contrastive-learning","task_name":"Contrastive Learning"},{"task_slug":"self-supervised-learning","task_name":"Self-Supervised Learning"}],"methods":[{"method_slug":"diffusion","method_name":"Diffusion"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2310.18936","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2310.18936"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/PKU-ML/AdvNotRealFeatures","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/pku-ml/advnotrealfeatures","reach":{"status":"ok"}}],"summary":{"ran":2,"ran_honours":1,"ran_draft_wrong":1,"unverified":1},"by_repo_kind":{"official":{"samples":5,"ran":4,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":5,"samples":[{"code_sha256_prefix":"dea5e071f2ca7bcc","entry":"DEFAULT_INITIALIZER","repo":"PKU-ML/AdvNotRealFeatures","repo_kind":"official","path":"AdvNotRealFeatures/DM/ddpm_torch/modules.py","file_url":"https://github.com/PKU-ML/AdvNotRealFeatures/blob/HEAD/AdvNotRealFeatures/DM/ddpm_torch/modules.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"dea5e071f2ca7bcc"}},{"code_sha256_prefix":"ca8727ed2076e4a1","entry":"ntuple","repo":"PKU-ML/AdvNotRealFeatures","repo_kind":"official","path":"AdvNotRealFeatures/DM/ddpm_torch/modules.py","file_url":"https://github.com/PKU-ML/AdvNotRealFeatures/blob/HEAD/AdvNotRealFeatures/DM/ddpm_torch/modules.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ca8727ed2076e4a1"}},{"code_sha256_prefix":"cc4c605a1dd69746","entry":"random_indexes","repo":"PKU-ML/AdvNotRealFeatures","repo_kind":"official","path":"AdvNotRealFeatures/MIM/model.py","file_url":"https://github.com/PKU-ML/AdvNotRealFeatures/blob/HEAD/AdvNotRealFeatures/MIM/model.py","link_basis":"harvester_set","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"cc4c605a1dd69746"}},{"code_sha256_prefix":"0dee20694ea4b3ee","entry":"take_indexes","repo":"PKU-ML/AdvNotRealFeatures","repo_kind":"official","path":"AdvNotRealFeatures/MIM/model.py","file_url":"https://github.com/PKU-ML/AdvNotRealFeatures/blob/HEAD/AdvNotRealFeatures/MIM/model.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"0dee20694ea4b3ee"}},{"code_sha256_prefix":"3d758ab8c3fd224d","entry":"train_classifier","repo":"PKU-ML/AdvNotRealFeatures","repo_kind":"official","path":"AdvNotRealFeatures/CL/train_cl.py","file_url":"https://github.com/PKU-ML/AdvNotRealFeatures/blob/HEAD/AdvNotRealFeatures/CL/train_cl.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"3d758ab8c3fd224d"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}