Adversarial Training (AT), which is commonly accepted as one of the most effective approaches defending against adversarial examples, can largely harm the standard performance, thus has limited usefulness on industrial-scale production and applications. Surprisingly, this phenomenon is totally opposite in Natural Language Processing (NLP) task, where AT can even benefit for generalization. We notice the merit of AT in NLP tasks could derive from the discrete and symbolic input space. For borrowing the advantage from NLP-style AT, we propose Discrete Adversarial Training (DAT). DAT leverages VQGAN to reform the image data to discrete text-like inputs, i.e. visual words. Then it minimizes the maximal risk on such discrete images with symbolic adversarial perturbations. We further give an explanation from the perspective of distribution to demonstrate the effectiveness of DAT. As a plug-and-play technique for enhancing the visual representation, DAT achieves significant improvement on multiple tasks including image classification, object detection and self-supervised learning. Especially, the model pre-trained with Masked Auto-Encoding (MAE) and fine-tuned by our DAT without extra data can get 31.40 mCE on ImageNet-C and 32.77% top-1 accuracy on Stylized-ImageNet, building the new state-of-the-art. The code will be available at https://github.com/alibaba/easyrobust.

翻译：Aversarial Traination(AT)通常被公认为是对抗对抗性实例的最有效方法之一,它可能在很大程度上损害标准性能,因此对工业规模的生产和应用作用有限。令人惊讶的是,这种现象在自然语言处理(NLP)任务中完全相反,在这种任务中,AT甚至可以有利于一般化。我们注意到AT在NLP任务中的优点可以来自离散和象征性的投入空间。为了从NLP-stype AT中借取优势,我们提议DAT利用Discrete Aversarial Traination(DAT)。DAT利用VQGAN将图像数据改为离散的文本类投入,即视觉字眼。然后,它将这种离散图像的最大风险降到最低,而具有象征性的对抗性干扰。我们从分发的角度进一步解释ATT的效用。DAT作为增强视觉代表性的插播和游戏技术,我们提议DAT在包括图像分类、对象探测和自我监督学习在内的多项任务上有很大的改进。特别是,在MAS-E-E-E-AF-Ex-Ex-stal dalding Dmakeding the ASyal-dal-dal-dal-dal-stat-stat-makeding the Dmakedal-makedingdaldaldal-daldaldaldal-daldaldaldaldaldaldaldaldaldaldaldaldald.