Adversarially Trained Object Detector for Unsupervised Domain Adaptation

Unsupervised domain adaptation, which involves transferring knowledge from a label-rich source domain to an unlabeled target domain, can be used to substantially reduce annotation costs in the field of object detection. In this study, we demonstrate that adversarial training in the source domain can be employed as a new approach for unsupervised domain adaptation. Specifically, we establish that adversarially trained detectors achieve improved detection performance in target domains that are significantly shifted from source domains. This phenomenon is attributed to the fact that adversarially trained detectors can be used to extract robust features that are in alignment with human perception and worth transferring across domains while discarding domain-specific non-robust features. In addition, we propose a method that combines adversarial training and feature alignment to ensure the improved alignment of robust features with the target domain. We conduct experiments on four benchmark datasets and confirm the effectiveness of our proposed approach on large domain shifts from real to artistic images. Compared to the baseline models, the adversarially trained detectors improve the mean average precision by up to 7.7%, and further by up to 11.8% when feature alignments are incorporated. Although our method degrades performance for small domain shifts, quantification of the domain shift based on the Frechet distance allows us to determine whether adversarial training should be conducted.


Introduction
In the field of computer vision, object detection is a fundamental task, which involves localizing and classifying objects in an image. Advancements in deep learning have resulted in various types of object detectors being proposed (Girshick 2015;Ren et al. 2015;Liu et al. 2016;Redmon and Farhadi 2018;Zhao et al. 2019;Tan, Pang, and Le 2020). In most cases, they require supervised learning on a large amount of annotated data (Everingham et al. 2010;Lin et al. 2014). Furthermore, to achieve the expected performance, the training and test data must belong to the same domain.
However, domain shifts resulting from changes in weather, painting style, and other factors often occur in practical applications, thereby resulting in a loss of accuracy. In object detection tasks, during annotation, bounding boxes are required for all the objects in the images. Therefore, creating a new training dataset in the shifted domain is impractical. An effective solution to this issue is domain adaptation, which involves transferring knowledge from a label-rich source domain to a label-poor or unlabeled target domain (Ganin et al. 2016). Specifically, unsupervised domain adaptation assumes that the target domain has no labels (Zhao et al. 2020). In recent studies, several approaches have been proposed for implementing unsupervised domain adaptation in object detection tasks (Oza et al. 2021). The most common approach is adversarial feature learning, which involves aligning the source and target features using a feature extractor competing with a domain discriminator (Chen et al. 2018;Saito et al. 2019;Chen et al. 2021b). Other approaches, such as pseudo-labeling in the target domain (Kim et al. 2019;Li et al. 2021) and imageto-image translation (Hsu et al. 2020;Chen et al. 2020) have also been proposed.
In this study, we explore the application of unsupervised domain adaptation in the field of object detection. Further, we demonstrate that the learning of robust features in the source domain through adversarial training enhances object detection in the target domain with a large domain shift. Recent studies on adversarial training have revealed the existence of non-robust and robust features (Ilyas et al. 2019). The former are sensitive to perturbation, but they are still necessary for attaining high accuracy. The latter are highly stable and close to human perception . Robust and non-robust features are visualized in Fig. 1. We hypothesize that for domain adaptation, non-robust features are highly domain-specific features, and thus, they are susceptible to domain shifts, whereas robust features are informative in both the source and target domains. This idea is inspired by studies that have recently shown that adversarially trained models demonstrate improved transfer performance compared to standard-trained models (Salman et al. 2020;Utrera et al. 2021). These studies focus on transfer learning in cases where the target domain has a small number of labels. Contrarily, we focus on unsupervised domain adaptation, where the target domain has no labels. In addition to learning robust features through adversarial training, to ensure the increased alignment of such features with the target domain, we propose a novel approach that combines adversarial training and adversarial feature learning (Saito et al. 2019).
In our experiments on the benchmark datasets of real to artistic image adaptation, the adversarially trained detector improves the mean average precision by up to 7.7% compared to that of the standard-trained detector. When combined with adversarial feature learning, the improvement in mean average precision reaches 11.8%. Although our method degrades the performance for small domain shifts such as different weather conditions, quantifying the domain shift using the Fréchet distance allows us to predict domain adaptation performance with adversarial training in advance. In addition, we analyze various adversarial training methods for object detection. We demonstrate that several proposed techniques that have been suggested to be robust against adversarial examples are not substantially different from the simplest adversarial training method in terms of their application in unsupervised domain adaptation.
The contributions of this study are as follows: • To the best of our knowledge, this is the first study on the effectiveness of adversarial training in unsupervised domain adaptation. We establish that, for large domain shifts, adversarially trained detectors achieve improved accuracy in the target domain compared to standardtrained detectors.
• We propose a method that combines adversarial training with adversarial feature learning to ensure the enhanced alignment of the source and target features. Experimental results show that our proposed method achieves improved domain adaptation performance compared to approaches that solely rely on adversarial training.
• We introduce a quantification of the domain shift using the Fréchet distance, which allows us to predict the domain adaptation performance with adversarial training.
• We show that several adversarial training methods that have been proposed to improve robustness against adversarial examples do not differ substantially in terms of performance with respect to unsupervised domain adaptation.

Related Work
In this section, we review the literature pertaining to studies on object detection, domain adaptation, and adversarial training.

Object detection
Object detection is a fundamental task in computer vision as well as image classification. Many object detectors have achieved high accuracy due to advancements in deep neural networks (Girshick 2015;Ren et al. 2015;Liu et al. 2016;Redmon and Farhadi 2018;Zhao et al. 2019;Tan, Pang, and Le 2020). Most of them rely on supervised learning using large annotated datasets, such as PASCAL Visual Object Classes (VOC) (Everingham et al. 2010) and Microsoft Common Objects in Context (MSCOCO) (Lin et al. 2014). Generally, creating a new dataset for object detection is more time-consuming than creating one for image classification because it requires instance-level annotations. In this study, we use You Only Look Once v3 (YOLOv3), which is a wellknown object detector with excellent inference speed and accuracy (Redmon and Farhadi 2018).

Domain adaptation
Domain adaptation is a technique for adapting a model trained using a label-rich domain to a label-poor domain.
Recently, unsupervised domain adaptation has attracted significant attention in computer vision tasks, such as image classification and semantic segmentation (Zhao et al. 2020). Many domain adaptation approaches have also been proposed for object detection (Oza et al. 2021). Typical approaches include adversarial feature learning (Chen et al. 2018;Saito et al. 2019;Chen et al. 2021b), pseudo-labelbased self-training (Kim et al. 2019;Li et al. 2021), and image-to-image translation (Hsu et al. 2020;Chen et al. 2020). Adversarial feature learning employs an adversarial objective between the domain discriminator and feature extractor (Ganin et al. 2016). The domain discriminator attempts to accurately classify the source and target images, whereas the feature extractor attempts to fool the domain discriminator. As a result, the model can extract similar features from the source and target domains. The pseudo-labelbased self-training approach trains the model by assigning pseudo-labels to the target images based on the knowledge obtained from the source domain. Image-to-image translation converts the source images into target-like images using CycleGAN (Zhu et al. 2017) or similar methods. The model is then trained using the converted images and the original labels obtained from the source domain.
We propose a new method based on adversarial training for unsupervised domain adaptation in object detection. Moreover, our proposed method can be combined with adversarial feature learning, which is the most common approach.

Adversarial training
One of the vulnerabilities of deep neural network-based models is the existence of adversarial examples that perturb the inputs and cause such models to make mistakes (Szegedy Figure 2: Framework of the proposed method. F 1 and F 2 are object detection networks, D is a domain discriminator, and GRL is a gradient reversal layer. First, we propagate the source images with the initial perturbations δ 0 and then compute the adversarial perturbations δ * using the gradients of the losses. Then, adversarial training on the source images perturbed by δ * and adversarial feature learning on the source and target images are performed. et al. 2014). During adversarial training, a model is trained using adversarial examples generated from the training data to ensure that the model is robust against input perturbations. Note that adversarial training is different from adversarial feature learning. The most typical methods for creating adversarial examples are the fast gradient sign method (FGSM) (Goodfellow, Shlens, and Szegedy 2015) and the projected gradient descent (PGD) (Madry et al. 2018). Such methods mainly focus on image classifiers. However, studies on the adversarial training of object detectors have also been conducted from the perspective of multi-task learning in object detection (Zhang and Wang 2019;Chen et al. 2021a).
In a recent study, the researchers demonstrated that adversarial examples result from the presence of non-robust features that are highly predictive but imperceptible to humans (Ilyas et al. 2019). Standard-trained models rely on such non-robust features, whereas adversarially trained models extract robust features that are aligned with human perception ). This attribute gave rise to an unintended but useful inference, i.e., adversarially trained models are highly effective in transferring knowledge to new domains compared to standard-trained models (Salman et al. 2020;Utrera et al. 2021).
Inspired by the observations presented above, we propose adversarial training in the source domain as an approach for implementing unsupervised domain adaptation in object detection. The robust features acquired from the source domain are informative in the dissimilar target domain. Furthermore, the enhanced alignment of robust features with the target domain can be achieved through adversarial training combined with adversarial feature learning.

Proposed Method
In this section, we first formulate the problem and describe the adversarial training in the source domain for YOLOv3 (Redmon and Farhadi 2018). We then introduce an approach for combining adversarial training and adversarial feature learning to ensure robust and target-aligned feature acquisition. The framework of our proposed method is illustrated in Fig. 2.

Problem setting
To implement unsupervised domain adaptation in object detection, we obtain labeled data (x s , {y s , b s }) from the source domain D s and unlabeled data x t from the target domain D t . Here, x s and x t represent the input images, y s represents the class label, and b s represents the bounding box. Generally, two domains, D s and D t , have different data distributions. The goal of domain adaptation is to improve the detection performance in the target domain D t using the labeled data in the source domain and the unlabeled data in the target domain. To avoid notational clutter, we use D s and D t to denote the data distributions of the source and target domains, respectively.
In this study, we use YOLOv3, which is a well-known object detector. The objective of standard training in the source domain for YOLOv3 can be expressed as follows: where L det denotes the detection loss, and F denotes the YOLOv3 network. Because F outputs the class prediction, bounding box prediction, and objectness score, L det can be decomposed into the classification loss, localization loss, and objectness loss as follows: Here, L cls is used to measure the difference between the predicted and ground-truth classes, L loc is used to measure the misalignment between the predicted and ground-truth boxes, and L obj is used to verify the existence of the predicted objects.

Adversarial training in the source domain
Our main objective is to demonstrate that adversarial training in the source domain can be employed as an approach for achieving unsupervised domain adaptation. The robust features acquired through adversarially trained detectors are expected to be useful for dissimilar target domains and improve detection accuracy in the target domain. The objective of adversarial training can be expressed as follows: where δ * represents adversarial perturbation. δ * is designed to cause the detector to make mistakes, and it is usually too small to be perceived by humans. Therefore, as shown in (3), the detector is dependent on the robust features that are aligned with human perception. We shall now introduce several designs of perturbations δ * for YOLOv3 based on the FGSM (Goodfellow, Shlens, and Szegedy 2015) and PGD (Madry et al. 2018). We shall then describe δ * used in our experiments.
FGSM. The FGSM creates an adversarial perturbation in a single gradient step. A straightforward approach for generating an adversarial perturbation involves using the gradient of L det as follows: where P denotes the projection onto the L ∞ -norm -ball {δ | δ ∞ ≤ } for some > 0, and δ 0 represents the initial value of the perturbation. As shown in (4),δ det is calculated as a signed gradient of L det with respect to δ 0 . The adversarial perturbation δ det is then obtained using (5). Alternatively, one can generate adversarial perturbations δ cls , δ loc , and δ obj based on the three task losses presented in (2) in a similar manner. First,δ cls ,δ loc , andδ obj are generated as follows: The final perturbations are then obtained as shown in (5).
From the perspective of multi-task learning in object detection, (Zhang and Wang 2019) showed that the direct use of L det , as shown in (4), results in gradient misalignment between tasks, thereby causing decreased robustness against adversarial examples. To avoid this problem, they proposed an adversarial training method, which selects a single task perturbation that maximizes L det . Hereinafter, we denote this perturbation as δ mtl , which is generated for YOLOv3 as follows: Generally, δ 0 is set to zero for the FGSM, which is referred to as the zero-initialized FGSM in this study. However, a recent study showed that initializing δ 0 using a random value uniformly sampled from [− , ] results in enhanced robustness against adversarial examples (Wong, Rice, and Kolter 2020). We refer to this as the randominitialized FGSM.
PGD. PGD generates stronger perturbations than those generated using the FGSM by iterating the gradient steps. Adversarial training using PGD is known to be effective in enhancing adversarial robustness. However, this approach is computationally expensive. With a step size parameter α, the generation of adversarial perturbation using PGD can be expressed as follows: Here,δ (t) can be computed using arbitrary losses in object detection, as described for the FGSM.
Default perturbation δ * in our experiments. We employ δ det generated using the zero-initialized FGSM as the default δ * in our main experiments, because this is the simplest strategy for adversarial training. In Section 4.4, comparisons among the zero-initialized FGSM, randominitialized FGSM, and PGD are conducted, as well as a comparison of the losses used to generate perturbations. Although PGD, the random-initialized FGSM, and the use of δ mtl are known to enhance robustness to adversarial examples (Madry et al. 2018;Wong, Rice, and Kolter 2020; Zhang and Wang 2019), we establish that the simplest adversarial training method, i.e., the zero-initialized FGSM with δ det , is sufficient in terms of performance with respect to domain adaptation.

Robust and target-aligned feature learning
Through adversarial training in the source domain, as described above, the model is expected to learn robust features that are also informative to the target domain. However, since the model is not trained in the target domain, the robust features acquired through the model are discrepant from the robust features in the target domain. Therefore, we aim to enhance domain adaptation performance by aligning the robust features to the target domain.
For this purpose, we incorporate adversarial feature learning, which is a typical approach for implementing domain adaptation. Specifically, we employ a local feature alignment approach that matches features, such as texture and color, between the source and target domains (Saito et al. 2019). In this study, the detector F is decomposed as follows: F 2 • F 1 , where F 1 represents the first dozens of the network layers, and F 2 represents the rest of the layers in the network. The output of F 1 is the input of the domain discriminator D across the gradient reversal layer (Ganin et al. 2016). The feature extractor F 1 outputs a feature map of width W and height H, and the domain discriminator D outputs a domain prediction map whose width and height are the same as those of the input from F 1 . In our setting, the domain discriminator D aims to ensure that the domain predictions for the source images are equal to zero and that those for the target images are equal to one. In contrast, the feature extractor F 1 is trained in a manner that ensures the domain predictions are opposite to those D aims for. Owing to the gradient reversal layer, the losses of adversarial feature learning can be summarized as follows: where D(·) wh denotes the (w, h)-th entry of the outputs of D. Note that we add an adversarial perturbation δ * to the source image x s , as shown in (11). Combined with the objective of adversarial training in the source domain, (3), the overall objective is expressed as fol- where λ represents the weight required to ensure the balance between adversarial training and adversarial feature learning. The signs of the gradients back-propagated from D to F 1 are reversed through the gradient reversal layer.

Experiments
In this section, we demonstrate the effectiveness of our approach through domain adaptation experiments conducted on benchmark datasets. In addition, we compare various methods and parameters for generating adversarial perturbations in adversarial training, and we observe the effect of the choice on the domain adaptation performance.

Datasets
For large domain shifts, we use PASCAL VOC (Everingham et al. 2010) as the source dataset and Clipart1k, Wa-tercolor2k, and Comic2k (Inoue et al. 2018) as the target datasets. PASCAL VOC is a dataset comprising real-world images with 20 object classes. The training sets (VOC2007trainval and VOC2012-trainval) comprise 16,551 images, and the test set (VOC2007-test) comprises 4,952 images. Clipart1k is a dataset comprising graphical images and has the same object classes as PASCAL VOC. The training set comprises 500 images, and the test set comprises 500 images. Watercolor2k and Comic2k are datasets comprising watercolor and comic images, respectively. Both datasets have six object classes, which are defined in PASCAL VOC, and they comprise 1,000 training and 1,000 test images. The appearances of objects significantly differ between the real images in the PASCAL VOC dataset and the artistic images in the Clipart1k, Watercolor2k, and Comic2k datasets. For small domain shifts, we use Cityscapes (Cordts et al. 2016) as the source dataset and FoggyCityscapes (Sakaridis, Dai, and Van Gool 2018) as the target dataset. Cityscapes is a dataset comprising urban street scenes with eight object classes. The training set comprises 2,975 images, and the test set comprises 500 images. FoggyCityscapes is a dataset rendered from Cityscapes with fog simulation; it comprises the same number of images as the Cityscapes dataset. The weather conditions are different in the two datasets, but the appearances of the objects are similar. Examples of the datasets are shown in Fig. 3.

Implementation details
In this study, we use YOLOv3 (Redmon and Farhadi 2018), which is a well-known object detector. The network with the first 26 convolutional layers of Darknet-53 in YOLOv3 is used as the feature extractor F 1 , which is introduced in Section 3.3, and the rest of the network is used as F 2 . The domain discriminator D is designed following the original local domain classifier (Saito et al. 2019). The training images are applied using Mosaic data augmentation (Bochkovskiy, Wang, and Liao 2020) and resized to 416 × 416 pixels. In all the experiments, a model pre-trained using the MSCOCO (Lin et al. 2014) dataset is used as the initial weight. We train the models for 50 epochs on the size of the source dataset. The optimizer is a stochastic gradient descent with a momentum of 0.937 and a weight decay of 5.0×10 −4 . The learning rate decreases from 1.0 × 10 −2 to 2.0 × 10 −3 through the cosine annealing schedule, and linear warmup is used for the first three epochs.
During evaluation, the test images are resized, so that the longer side is 416. We evaluate the average precision (AP) and mean AP (mAP) on the test data using an IoU threshold of 0.5. The reported results are the average of over three runs of similar training procedures. All the experiments are implemented using the PyTorch framework installed on the Ubuntu operating system running on a computer with an NVIDIA TITAN RTX GPU.
Standard training. Only the source dataset is used, and the batch size is set to 16. We add a zero tensor to the source image instead of δ * , which is presented in (3).
Adversarial training. Only the source dataset is used, and the batch size is similar to that for standard training. By default, δ det generated using the zero-initialized FGSM with = 1/255 is used as δ * . For detailed analysis, the method and parameters for generating δ * are modified as required.
Adversarial feature learning. When adversarial feature learning is combined, both the source and target datasets are used. The batch size is set to 32: 16 from the source dataset and 16 from the target dataset. We set λ = 1.0 in (13).

Results
Large domain shift. We first conduct experiments on adaptations in large domain shifts from real to artistic images. Specifically, adaptations from PASCAL VOC to Cli-part1k, Watercolor2k, and Comic2k are evaluated.
First, we list the results on the Clipart1k dataset in Table 1. Adversarial training (AT) outperforms standard training (ST) by 7.7% in terms of mAP. In addition, AT outperforms ST combined with adversarial feature learning (ST+AFL) by 1.6%, even though the target dataset is not used for AT. AT combined with AFL (AT+AFL) outperforms the other methods for 14 classes in terms of AP and improves the mAP by 11.8% compared to that of ST. Next,   we list the results on the Watercolor2k dataset in Table 2. AT and AT+AFL improve the mAP over that of ST by 6.1% and 6.4%, respectively. AT+AFL outperforms the other methods for four classes in terms of AP, although the improvement achieved through AT is limited compared to that on other datasets. Finally, we list the results on the Comic2k dataset in Table 3. AT and AT+AFL improve the mAP over that of ST by 2.8% and 6.7%, respectively. AT+AFL outperforms the other methods for four classes in terms of AP.
In summary, adversarially trained models outperform standard-trained models, and further improvements in their performance can be achieved by incorporating AFL. Specifically, the finding that AT using only the source dataset results in improved performance in the target domain is interesting because general domain adaptation methods utilize images in the target domain. The reason behind these results can be explained as follows. In the adaptation of real to artistic images, the non-robust features acquired through ST in the source domain are not informative in the target domain owing to the large domain shift. As a result, ST degrades performance in the target domain. Contrarily, the robust features acquired through AT are informative in the target domain, and thus, they can maintain performance in the target domain. Combined with AFL, the robust features are aligned with the target domain, thereby resulting in further performance improvement.
Small domain shift. We also evaluate the effectiveness of our proposed method on a small domain shift. Specifically, an adaptation between different weather conditions, from Cityscapes to FoggyCityscapes, is performed. The results are listed in Table 4. Contrary to the results for large do-main shifts, AT and AT+AFL decrease the mAP by 17.7% and 13.7% compared to ST, respectively. In this adaptation scenario, the ST+AFL approach demonstrates the best performance in all the classes in the target domain.
For adaptation between similar domains, the non-robust features acquired through ST are also informative in the target domain. Therefore, the detection performance of standard-trained models in the target domain is highly dependent on non-robust features. In contrast, AT makes the detector rely on robust features instead of non-robust features. Because robust features are less informative than nonrobust features, AT is known to result in a reduction in accuracy in the source domain . Correspondingly, for small domain shifts, the application of AT results in decreased performance in the target domain.

Analysis
Quantifying the domain shift magnitude. AT in the source domain improves performance for a large shifted target domain, but degrades performance for a small shifted target domain. Therefore, quantifying the magnitude of the domain shift is necessary to determine whether our approach should be applied. Fréchet inception distance (FID) (Heusel et al. 2017), which computes the Fréchet distance (FD) of two distributions using the feature space of the Inception-v3 model , is known as a measure to evaluate the difference between image sets. We compute FD using the feature space of the YOLOv3 model instead of the Inception-v3 model, because it allows feature extraction along the object detection task. In the experiments, we use feature maps extracted from the YOLOv3 backbone network, which is pre-trained using the MS COCO dataset.
First, we perform experiments on the PASCAL VOC dataset to verify the effectiveness of the FD to measure the domain shift. To control the domain shift magnitude, we apply style transfer to the PASCAL VOC test set via adaptive instance normalization (AdaIN) (Huang and Belongie 2017). The content-style trade-off β, which manipulates the balance between content and style images, is varied from 0.0 to 1.0 in increments of 0.1. Three style images used in our experiments and examples of the stylized images are shown in Fig. 4. The FD is computed between the original PASCAL VOC training set and each stylized PASCAL VOC test set. We then conduct ST and AT on the training set and evaluate how much AT improves the mAP for each stylized test set compared to ST. The results are shown in Fig. 5. As β is increased, the FD between the training set and the stylized test set becomes larger. Correspondingly, the ratio of the mAP of AT to that of ST also increases. These results suggest that   Methods and parameters for adversarial training. AT using the random-initialized FGSM or PGD is known to make the model significantly robust to adversarial examples compared to AT using the zero-initialized FGSM (Madry et al. 2018;Wong, Rice, and Kolter 2020). In addition, the value of is a crucial factor in AT. In this study, we analyze the impact of the methods and parameters for AT on the performance of unsupervised domain adaptation.
We conduct AT using the zero-initialized FGSM, randominitialized FGSM, and PGD on the PASCAL VOC dataset using the gradient of L det and varying . When = 0, ST is performed instead of AT. PGD is performed in 10 steps, and the step size is set to α = 1.5 /10. Fig. 6 shows the mAP values for the source (PASCAL VOC) and target (Clipart1k, Watercolor2k, and Comic2k) test sets in each setting. In the source domain, all the methods show a decrease in mAP as the value of increases. This is because AT prevents the model from acquiring predictive and nonrobust features. In the target domain, all the methods show an improvement in mAP compared to ST ( = 0). Interestingly, we establish that the three methods, known to differ in robustness against adversarial examples, are not substantially different in their performance in the target domain. This result indicates the intriguing phenomenon that the domain adaptation performance of adversarially trained models does not depend on their robustness. Considering the computational cost, the zero-initialized FGSM and randominitialized FGSM are better choices for domain adaptation. On the other hand, the best value of depends on the target dataset and method; thus, must be adjusted according to the setting.
Loss for generating adversarial perturbations. The total loss of object detection comprises several task losses, as shown in (2), for YOLOv3. Therefore, determining the loss to be used to generate adversarial perturbations is a crucial factor. To prevent gradient misalignment between tasks, the technique of selecting a single task loss that maximizes the total loss has also been proposed (Zhang and Wang 2019), as shown in (9). We analyze the impact of these loss choices on the performance of domain adaptation.
We conduct AT using the zero-initialized FGSM on the PASCAL VOC dataset by varying the loss used to generate zero-initialized FGSM random-initialized FGSM PGD Figure 6: Results of AT using the zero-initialized FGSM, random-initialized FGSM, and PGD on the PASCAL VOC dataset with different values of . We report the mAP values on the PASCAL VOC, Clipart1k, Watercolor2k, and Comic2k test sets. δ * . Table 6 shows the mAP values in the target domain for detectors trained using each adversarial perturbation. AT using δ det demonstrates the best performance for the Clipart1k and Watercolor2k datasets, and it is only 0.2% lower than the best performance for the Comic2k dataset. The use of δ mtl is within only 0.6% of the best performance on all datasets. With δ cls , δ loc , and δ obj , which use a single task loss, the mAP values for the Watercolor2k dataset are much lower than the best performance by 1.3% to 2.1%. These results suggest that domain adaptation performance is highly stable when all the task losses are considered during AT, as in the case of δ det and δ mtl . As mentioned in Section 3.2, δ mtl is known to be more robust than δ det against adversarial examples because δ det results in gradient misalignment between tasks, whereas δ mtl does not. However, δ det shows a higher mAP value than δ mtl . This indicates that the acquisition of robust features for domain adaptation must be considered separately from robustness against adversarial examples.

Conclusion
In this study, we explored the implementation of unsupervised domain adaptation in the field of object detection. Further, we proposed a method based on adversarial training in the source domain. To the best of our knowledge, this is the first application of adversarial training in unsupervised domain adaptation. The robust features acquired using adversarially trained detectors are informative in a largely shifted target domain, thereby resulting in improved detection performance. In contrast, for small domain shifts where the non-robust features acquired through standard training are informative in both domains, adversarially trained detectors degrade performance in the target domain. We also proposed a method for aligning the robust features with the target domain through adversarial feature learning and, using this approach, we demonstrated further improved performance for large domain shifts.