Title: REJECT ILLEGAL INPUTS: SCALING GENERATIVE CLASSIFIERS WITH SUPERVISED DEEP INFOMAX

Abstract: Deep Infomax (DIM) is an unsupervised representation learning framework by maximizing the mutual information between the inputs and the outputs of an encoder, while probabilistic constraints are imposed on the outputs. In this paper, we propose Supervised Deep InfoMax (SDIM), which introduces supervised probabilistic constraints to the encoder outputs. The supervised probabilistic constraints are equivalent to a generative classifier on high-level data representations, where class conditional log-likelihoods of samples can be evaluated. Unlike other works building generative classifiers with conditional generative models, SDIMs scale on complex datasets, and can achieve comparable performance with discriminative counterparts. With SDIM, we could perform classification with rejection. Instead of always reporting a class label, SDIM only makes predictions when test samples' largest logits surpass some pre-chosen thresholds, otherwise they will be deemed as out of the data distributions, and be rejected. Our experiments show that SDIM with rejection policy can effectively reject illegal inputs including outof-distribution samples and adversarial examples.

1. INTRODUCTION:

Non-robustness of neural network models emerges as a pressing concern since they are observed to be vulnerable to adversarial examples (Szegedy et al., 2013; Goodfellow et al., 2014) . Many attack methods have been developed to find imperceptible perturbations to fool the target classifiers (Moosavi-Dezfooli et al., 2016; Carlini & Wagner, 2017; Brendel et al., 2017) . Meanwhile, many defense schemes have also been proposed to improve the robustnesses of the target models (Goodfellow et al., 2014; Tramèr et al., 2017; Madry et al., 2017; Samangouei et al., 2018) .

An important fact about these works is that they focus on discriminative classifiers, which directly model the conditional probabilities of labels given samples. Another promising direction, which is almost neglected so far, is to explore robustness of generative classifiers (Ng & Jordan, 2002) . A generative classifier explicitly model conditional distributions of inputs given the class labels. During inference, it evaluates all the class conditional likelihoods of the test input, and outputs the class label corresponding to the maximum. Conditional generative models are powerful and natural choices to model the class conditional distributions, but they suffer from two big problems: (1) it is hard to scale generative classifiers on high-dimensional tasks, like natural images classification, with comparable performance to the discriminative counterparts. Though generative classifiers have shown promising results of adversarial robustness, they hardly achieve acceptable classification performance even on CIFAR10 (Li et al., 2018; Schott et al., 2018; Fetaya et al., 2019) . (2) The behaviors of likelihood-based generative models can be counter-intuitive and brittle. They may assign surprisingly higher likelihoods to out-of-distribution (OoD) samples (Nalisnick et al., 2018; Choi & Jang, 2018) . Fetaya et al. (2019) discuss the issues of likelihood as a metric for density modeling, which may be the reason of non-robust classification, e.g. OoD samples detection.

In this paper, we propose supervised deep infomax (SDIM) by introducing supervised statistical constraints into deep infomax (DIM, Hjelm et al. (2018) ), an unsupervised learning framework by maximizing the mutual information between representations and data. SDIM is trained by optimizing two objectives: (1) maximizing the mutual information (MI) between the inputs and the high-level data representations from encoder; (2) ensuring that the representations satisfy the supervised statistical constraints. The supervised statistical constraints can be interpreted as a generative classifier on high-level data representations giving up the full generative process. Unlike full generative models making implicit manifold assumptions, the supervised statistical constraints of SDIM serve as explicit enforcement of manifold assumption: data representations (low-dimensional) are trained to form clusters corresponding to their class labels. With SDIM, we could perform classification with rejection (Nalisnick et al., 2019; Geifman & El-Yaniv, 2017) . SDIMs reject illegal inputs based on off-manifold conjecture (Samangouei et al., 2018; Gu & Rigazio, 2014) , where illegal inputs, e.g. adversarial examples, lie far away from the data manifold. Samples whose class conditionals are smaller than the pre-chosen thresholds will be deemed as off-manifold, and prediction requests on them will be rejected. The contributions of this paper are :

• We propose Supervised Deep Infomax (SDIM), an end-to-end framework whose probabilistic constraints are equivalent to a generative classifier. SDIMs can achieve comparable classification performance with similar discrinimative counterparts at the cost of small over-parameterization. et al., 2018) .

Let E φ be an encoder parameterized by φ, working on the training set X = {x i } N i=1 , and generating output set Y = {E(x i )} N i=1 . DIM is trained to find the set of parameters φ such that: (1) the mutual information I(X, Y ) is maximized over sample sets X and Y. (2) the representations, depending on the potential downstream tasks, match some prior distribution. Denote J and M the joint and product of marginals of random variables X, Y respectively. MINE estimates a lower-bound of MI with Donsker-Varadhan (Donsker & Varadhan, 1983 ) representation of KL-divergence: x,y) ]

I(X, Y ) = D KL (J||M) ≥ E J [T ω (x, y)] -log E M [e Tω(

(1) where T ω (x, y) ∈ R is a family of functions with parameters ω represented by a neural network. Since in representation learning we are more interested in maximizing MI, than its exact value, non-KL divergences are also favorable candidates. We can get a family of variational lower-bounds using f -divergence representations (Nguyen et al., 2010) :

I f (X, Y ) ≥ E J [T ω (x, y)] -E M [f * T ω (x, y) ] (2)

where f * is the Fenchel conjugate of a specific divergence f . For KL-divergence, f * (t) = e (t-1) . A full f * list is provided in Tab. 6 of Nowozin et al. (2016) . Noise-Contrastive Estimation (Gutmann & Hyvärinen, 2010) can also be used as lower-bound of MI in "infoNCE" (Oord et al., 2018) .

3. SUPERVISED DEEP INFOMAX:

All the components of SDIM framework are summurized in Fig. 1 . The focus of Supervised Deep InfoMax (SDIM) is on introducing supervision to probabilistic constraints of DIM for (generative) classification. We choose to maximize the local MI, which has shown to be more effective in classification tasks than maximizing global MI (Hjelm et al., 2018) . Equivalently, we minimize J MI :

EQUATION

where L φ (x) is a local M × M feature map of x extracted from some intermediate layer of encoder E, and Ĩ can be any possible MI lower-bounds. 

3.1. EXPLICIT ENFORCEMENT OF MANIFOLD ASSUMPTION:

By adopting a generative approach p(x, y) = p(y)p(x|y), we assume that the data follows the manifold assumption: the (high-dimensional) data lies on low-dimensional manifolds corresponding to their class labels. Denote x the compact representation generated with encoder E φ (x). In order to explicitly enforce the manifold assumption , we admit the existence of data manifold in the representation space. Assume that y is a discrete random variable representing class labels, and p( x|y) is the real class conditional distribution of the data manifold given y. Let p θ ( x|y) be the class conditionals we model parameterized with θ. We approximate p( x|y) by minimizing the KL-divergence between p( x|y) and our model p θ ( x|y), which is given by:

EQUATION

where the first item on RHS is a constant independent of the model parameters θ. Eq. 4 equals to maximize the expectation E x,y∼p( x,y) [log p θ ( x|y)].

In practice, we minimize the following loss J NLL , equivalent to empicically maximize the above expectation over { xi = E φ (x i ), y i } N i=1 :

EQUATION

Besides the introduction of supervision, SDIM differs from DIM in its way of enforcing the statistical constraints: DIM use adversarial learning (Makhzani et al., 2015) to push the representations to the desired priors, while SDIM directly maximizes the parameterized class conditional probability.

Maximize Likelihood Margins Since a generative classifier, at inference, decides which class a test input x belongs to according to its class conditional probability. On one hand, we maximize samples' true class conditional probabilities (classes they belong to) using J NLL ; On the other hand, we also hope that samples' false class conditional probabilities (classes they do not belong to) can be minimized. This is assured by the following likelihood margin loss J LM :

J LM = 1 N • 1 C -1 N i=1 C c=1,c =yi max(log p( xi |y = c) + K -log p( xi |y = y i ), 0) 2 (6)

where K is a positive constant to control the margin. For each encoder output xi , the C -1 truefalse class conditional gaps are squared1 , which quadratically increases the penalties when the gap becomes large, then are averaged.

Putting all these together, the complete loss function we minimize is:

J SDIM = α • J MI + β • J NLL + γ • J LM (7)

Parameterization of Class Conditional Probability Each of the class conditional distribution is represented as an isotropic Gaussian. So the generative classifier is simply a embedding layer with C entries, and each entry contains the trainable mean and variance of a Gaussian. This minimized parameterization encourages the encoder to learn simple and stable low-dimensional representations that can be easily explained by even unimodal distributions. Considering that we maximize the true class conditional probability, and minimize the false class conditional probability at the same time, we do not choose conditional normalizing flows, since the parameters are shared across class labels, and the training can be very difficult. In Schott et al. (2018) , each class conditional probability is represented with a VAE, thus scaling to complex datasets with huge number of classes, e.g. ImageNet, is almost impossible.

3.2. DECISION FUNCTION WITH REJECTION:

A generative approach models the class-conditional distributions p(x|y), as well as the class priors p(y). For classification, we compute the posterior probabilities p(y|x) through Bayes' rule:

p(y|x) = p(x|y)p(y) p(x) ∝ p(x|y)p(y)

The prior p(y) can be computed from the training set, or we simply use uniform class prior for all class labels by default. Then the prediction of test sample x * from posteriors is:

EQUATION

The drawback of the above decision function is that it always gives a prediction even for illegal inputs. Instead of simply outputting the class label that maximizes class conditional probability of x * , we set a threshold for each class conditional probability, and define our decision function with rejection to be:

EQUATION

The model gives a rejection when log p(x DefenseGAN (Samangouei et al., 2018) models real data distribution with the generator G of GAN. At inference, instead of feeding the test input x to the target classifier directly, it searches for the "closest" sample G(z * ) from generator distribution to x as the final input to the classifier. It ensures that the classifier only make predictions on the data manifold represented by the generator, ruling out the potential adversarial perturbations in x. PixelDefend (Song et al., 2017) takes a similar approach which uses likelihood-based generative model -PixelCNN to model the data distribution.

Both DefenseGAN and PixelDefend are additionally trained as peripheral defense schemes agnostic to the target classifiers. Training generative models on complex datasets notoriously takes huge amount of computational resources (Brock et al., 2018) . In contrast, the training of SDIM is computationally similar to its discriminative counterpart. The verification of whether inputs are offmanifold is a built-in property of the SDIM generative classifier. The class conditionals of SDIM are modeled on low-dimensional data representations with simple Gaussians, which is much easier, and incurs very small computations. The last layer of encoder is a d-way fully-connected layer. To construct a discriminative counterpart, we simply set the output size of the encoder's last layer to C for classification. We use ResNet10 (n = 1) on MNIST, FashionMNIST, and ResNet26 (n = 3) on CIFAR10, SVHN.

5. EXPERIMENTS:



5.1. EVALUATION ON CLEAN DATA:

We report the classification accuracies (see Tab. 1) of SDIMs and the discriminative counterparts on clean test sets . Results show that SDIMs achieve the same level of accuracy as the discriminative counterparts with slightly increased number of parameters (17% increase for ResNet10, and 5% increase for ResNet26). We are aware of the existence of better results reported on these datasets using more complex models (Huang et al., 2017; Han et al., 2017) or automatically designed architectures (Cai et al., 2018) , but pushing the state-of-the-art is not the focus of this paper. 

Decision with Rejection:

We also investigate the implications of the proposed decision function with rejection under different thresholds. The results in Tab. 2 show that choosing a higher percentile as threshold will reject more prediction requests. At the same time, the classification accuracies of SDIM on the left test sets become increasingly better. This demonstrate that out rejection policy tend to reject the ones on which SDIMs make wrong predictions. 

5.3. ROBUSTNESS AGAINST ADVERSARIAL EXAMPLES AND DETECTION:

We comprehensively evaluate the robustness of SDIMs against various attacks:

• gradient-based attacks: one-step gradient attack FGSM (Goodfellow et al., 2014) , its iterative variant projected gradient descent (PGD, Kurakin et al. (2016) ; Madry et al. (2017) ), CW-L 2 attack (Carlini & Wagner, 2017) , deepfool (Moosavi-Dezfooli et al., 2016 ). • score-based attacks: local search attack (Narodytska & Kasiviswanathan, 2016) .

• decision-based attack: boundary attack (Brendel et al., 2017) .

Attacks Using Cross-Entropy We find that SDIMs are much more robust to gradient-based attacks using cross-entropy, e.g. FGSM and PGD, since the gradients numerically vanish as a side effect of the likelihood margin loss J LM of SDIM. This phenomenon is similar to some defences that try to hinder generations of adversarial examples by masking the gradients on inputs. While full generative classifiers in Li et al. (2018) still suffer from these attacks. See Supp. D.1 for detailed results.

Conservative Adversarial Examples Adversarial attacks aim to find the minimal perturbations that sufficiently change the classification labels, i.e. flip other logits to be the largest one. We show case examples on MNIST generated by untargeted attacks and their logits in Tab. 4 (See Supp. D.2 for examples of CIFAR10). Though these attacks successfully flip the logits, they are designed to be conservative to avoid more distortions to the original images. As a result, the largest logits of adversarial examples are still much lower than the thresholds, so they can be detected by our rejection policy. We find that our rejection policy performs perfectly on MNIST, but fails to detect all adversarial examples on CIFAR10 except for Boundary attack (See Tab. 5). It seems to be a well-known observation that models trained on CIFAR10 are more vulnerable than one trained on MNIST. Gilmer et al. (2018) connects this observation to the generalization of models. They found that many test samples, though correctly classified, are close to the misclassfied samples, which implies the existence of adversarial examples. If a model has higher error rate, it would take smaller perturbations to move correctly classified samples to misclassified areas. .9 -143.1 189.9 Table 5 : Detection rates of our rejection policies. We perform untargeted adversarial evaluation on the first 1000 images of test sets. CW-L 2 is not involved here, but carefully investigated below.

but also the largest logit larger than some threshold value? Unlike the conservativeness on paying more distortions of other attacks, CW attack allows us to control the gap between largest and second largest logits with some confidence value κ.

We perform targeted CW attacks with confidences κ = {0, 500, 1000} (Tab. 6). We find that increasing the confidences help increasing the largest logits of adversarial examples to some extent, but may lead to failures of generation. The sensitivity to confidence values is also different given different targets. The success rates of generating adversarial examples monotonically decreases with the confidences increasing (Tab. 7). Note that on discriminative counterparts, CW-L 2 with the same settings easily achieves 100% success rates. This means that explicitly forcing data representations to form clusters with maximum margins between them help increase average distances between normal samples and the nearest misclassified areas, thus increase the hardness of finding minimal adversarial perturbations . In this case, it takes a large enough adversarial perturbation to move a sample from its cluster to the other. Meanwhile, detection rates remain satisfactory on MNIST, but obviously decline on CIFAR10. For victim generative classifiers in (Li et al., 2018) under CW-L 2 attack, the detection rates of adversarial examples using the proposed detection methods can be > 95% on MNIST, but fall < 50% on even CIFAR10-binary (their models don't scale on CIFAR10, and CW-L 2 with non-zero confidences are also not evaluated). Discussions on off-manifold conjecture Gilmer et al. (2018) challenges whether the off-manifold conjecture holds in general. They experiment on synthetic dataset-two high-dimensional concentric spheres with theoretical analyses, showing that even for a trained classifier with close to zero test error, there may be a constant fraction of the data manifold misclassified, which indicates the existence of adversarial examples within the manifold. But there are still several concerns to be addressed: First, as also pointed out by the authors, the manifolds in natural datasets can be quite complex than that of simple synthesized dataset. Fetaya et al. (2019) draws similar conclusion from analyses on synthesized data with particular geometry. So the big concern is whether the conclusions in Gilmer et al. (2018); Fetaya et al. (2019) still hold for the manifolds in natural datasets. A practical obstacle to verify this conclusion is that works modeling the full generative processes are based on manifold assumption, but provide no explicit manifolds for analytical analyses like Gilmer et al. (2018); Fetaya et al. (2019) . While SDIM enables explicit and customized manifolds on high-level data representations via probabilistic constraints, thus enables analytical analyses. In this paper, samples of different classes are trained to form isotropic Gaussians corresponding to their classes in representation space (other choices are possible). The relation between the adversarial robustness and the forms and dimensionalities of data manifolds is to be explored. Second, in their experiments, all models evaluated are discriminative classifiers. Considering the recent promising results of generative classifiers against adversarial examples, would using generative classifiers lead to different results? One thing making us feel optimistic is that even though the existence of adversarial examples is inevitable, Gilmer et al. (2018) suggest that adversarial robustness can be improved by minimizing the test errors, which is also supported by our experimental differences on MNIST and CIFAR10.

6. CONCLUSIONS:

We introduce supervised probabilistic constraints to DIM. Giving up the full generative process, SDIMs are equivalent to generative classifiers on high-level data representations. Unlike full conditional generative models which achieve poor classification performance even on CIFAR10, SDIMs attain comparable performance as the discriminative counterparts on complex datasets. The training of SDIM is also computationally similar to discriminative classifiers, and does not require prohibitive computational resources. Our proposed rejection policy based on off-manifold conjecture, a built-in property of SDIM, can effectively reject illegal inputs including OoD samples and adversarial examples. We demonstrate that likelihoods modeled on high-level data representations, rather than raw pixel intensities, are more robust on downstream tasks without the requirement of generating real samples.

A CLASSIFICATION WITH REJECTION:

A very related work to our paper is (Nalisnick et al., 2019) • MNIST, FashionMNIST: All images are resized to 32 × 32 from 28 × 28. We scale the images pixels to [0, 1], and normalization is not used for fair comparisons with the baselines in (Li et al., 2018) .

• CIFAR10, SVHN: We follow the simple data augmentation in (He et al., 2016) for training: 4 pixels are padded on each side, and a 32 × 32 crop is randomly sampled from the padded image or its horizontal flip. For testing, we only evaluate the single view of the original 32 × 32 image. All image pixels are also scaled to [0, 1].

No other data augmentations or processings are used except for the explicitly listed above.

B.2 MODELS AND TRAINING SETTINGS:



MI computation:

The local MI J MI is computed between the 4 × 4 feature maps and the encoder outputs. We use lower-bound of Jensen-Shannon divergence to estimate the MI I JSD (X, Y ), and leave other lower-bounds unexplored. In practice, we find using other bounds would take more computational resources. However, we think better results can be expected if using these bounds according to the experimental results reported in Hjelm et al. (2018) . The input of T ω is positive or negative pair of local feature map L φ (x) and encoder output E φ (x).

MI evaluation network:

The positive pairs, samples from the joint distribution, are constructed by concat the encoder output E φ (x) and the corresponding feature map L φ (x) of the given batch. The negative pairs, samples from product of marginals, can be constructed by E φ (x) and shuffled L φ (x) along the batch-axis.

Optimization We set α = β = γ = 1 in our experiments. The constant K in the likelihood margin loss J LM is 10. All models are trained 500 epochs, and we always save the checkpoints reporting the minimum ongoing training losses for evaluation. We use optimizer Adam (Kingma & Ba, 2014) with default learning rate 0.001.

This phenomena is similar to what some defenses using gradient obfuscation want to achieve. Defensive distillation (Carlini & Wagner, 2016) masks the gradients of cross-entropy by increasing the temperature of softmax. But for CW attacks, which do not use cross-entropy, and operate on logits directly, this could be ineffective. -306.5 -244.3 -326.4 CW-L2 129.9 -555.3 235.4 -353.1 -471.6 -400.3 -342.7 -367.2 -486.4 -326.4 Boundary 213.9 -417.4 -458.3 -548.0 -587.4 -236.3 214.0 -1246.1 -171.2 -555.6 LocalSearch 165.2 -485.7 190.9 -325.6 -439.0 -379.0 -318.8 -327.5 -357.9 -272.3 Table 9 : Full logits of adversarial examples generated with different attacks. The original image is the fist sample of class 0 of CIFAR10 test set. The first row gives the 1st percentile thresholds, and the second row shows the logits of the original image. The largest logits are marked in bold.

:

Using squared margin, we achieve slightly better results in our experiments than simple margin.

We use cleverhans in this evaluation. There are two types of implementations in cleverhans. By default rand init is set to True, the PGD is randomized. If rand init is False, then the implementation is Basic Iterative Method(Kurakin et al., 2016)

Figures and Tables:

Figure 1: Components of SDIM framework. (1)The encoder E φ takes input x, and produces pairs of local feature maps L φ (x) and global representations E φ (x). (2) The MI evaluation network T ω maps every possible positive pairs and negative pairs to MI scores specified by corresponding MI lower-bound. Negative pairs are simply obtained by combine all unpaired local feature maps and global representations within the same mini-batch. (3) Supervised constraints are imposed on the global representations x = E φ (x) with loss J NLL + J LM for generative classification. The true class conditionals are maximized, while false class conditionals are minimized. See following parts of this section for details.

Figure 4: The adversarial classification accuracies of SDIM and GBZ on MNIST under FGSM-L ∞ and PGD-L ∞ attacks. On the right are the generated adversarial examples with from 0 to 0.5.

Figure 5: The adversarial classification accuracies of SDIM and GBZ on CIFAR10 under FGSM-L ∞ and PGD-L ∞ attacks. On the right are the generated adversarial examples with from 0 to 0.5.

• We propose a simple but novel rejection policy based on off-manifold conjecture: SDIM outputs a class label only if the test sample's largest class conditional surpasses the prechosen class threshold, otherwise outputs rejection. The choice of thresholds relies only on training set, and takes no additional computations. • Experiments show that SDIM with rejection policy can effectively reject illegal inputs, including OoD samples and adversarial examples generated by a comprehensive group of adversarial attacks.

Table content: <table/>

Off-Manifold ConjectureGrosse et al. (2017) observe that adversarial examples are outside the training distribution via statistical testing.

Table content: <table/>

Clean test accuracies of SDIMs and the discriminative counterparts.Is Fully Generative Model Necessary for Generative Classification? In the evaluations ofLi et al. (2018) andSchott et al. (2018), both model class conditional probability with VAE(Kingma & Welling, 2013;Rezende et al., 2014), and achieve acceptable accuracies (> 98%) on MNIST. However, it is hard for fully conditional generative models to achieve satisfactory classification accuracies even on CIFAR10. On CIFAR10, methods inLi et al. (2018) achieve only < 50% accuracy. They also point out that the classification accuracy of a conditional PixelCNN++(Salimans et al., 2017) is only 72.4%. The test accuracy of ABS in(Schott et al., 2018) is only 54%. In contrast, SDIM could achieve almost the same performance with similar discriminative classifier by giving up the full generative process, and building generative classifier on high-level representations.Li et al. (2018) improves the accuracy to 92% by feeding the features learned by powerful discriminative classifier-VGG16(Simonyan & Zisserman, 2014) to their generative classifiers, which also suggests that modeling likelihood on high-level representation (features) is more favorable for generative classification than pixel-level likelihood of fully generative classifiers. For classification tasks, discovering discriminative features is much more important than reconstructing the all the image pixels. Thus performing generative classification with full generative models may not be the right choice.

Table content: <table><tr><td>Model</td><td># Parameters</td><td colspan="3">MNIST FashionMNIST CIFAR10</td><td>SVHN</td></tr><tr><td>Disc. (ResNet10, n = 1)</td><td>1.25M</td><td>99.42%</td><td>94.25%</td><td>-</td><td>-</td></tr><tr><td>SDIM (ResNet10, n = 1)</td><td colspan="2">1.46M ( 17% ↑) 99.55%</td><td>94.58%</td><td>-</td><td>-</td></tr><tr><td colspan="2">Disc. (ResNet26, (n = 3)) 4.39M</td><td>-</td><td>-</td><td>92.35%</td><td>95.96%</td></tr><tr><td>SDIM (ResNet26, n = 3)</td><td>4.60M ( 5% ↑)</td><td>-</td><td>-</td><td>92.53%</td><td>95.74%</td></tr></table>

Classification performances of SDIMs using the proposed decision function with rejection. We report the rejection rates of the test sets and the accuracies on the left test sets for each threshold. For each in-distribution class c, we evaluate the log-likelihoods of the whole OoD dataset. Samples whose log-likelihoods are lower the class threshold δ c will be detected as OoD samples. Same evaluations are applied on conditional Glows with 10th percentile thresholds, but the results are not good. The results are clear and confirm that SDIMs, generative classifiers on

Table content: <table><tr><td>5.2 OUT-OF-DISTRIBUTION SAMPLES DETECTION</td></tr><tr><td>Class-wise OoD detections are performed, and mean detection rates over all in-distribution classes</td></tr><tr><td>are reported in Tab. 3.</td></tr></table>

Mean detection rates of SDIMs and Glows with different thresholds on OoD detection.

Table content: <table/>

Full logits of the adversarial examples generated with different attacks. The original image is the first sample of class 0 of MNIST test set. The first row gives the 1st percentile thresholds, and the second row shows the logits of the original image. The largest logits are marked in bold.

Table content: <table><tr><td>Attacks</td><td colspan="4">MNIST 1st Per. 2nd Per. 1st Per. 2nd Per. CIFAR10</td></tr><tr><td>DeepFool</td><td colspan="4">98.00% 98.60% 61.10% 64.30%</td></tr><tr><td>Boundary</td><td>100%</td><td>100%</td><td>100%</td><td>100%</td></tr><tr><td colspan="2">LocalSearch 99.90%</td><td>100%</td><td colspan="2">88.80% 93.10%</td></tr></table>

Adversarial examples generated with targeted CW with different confidences. The original image is the fist sample of class 0. The first row gives the 1st percentile thresholds. Below the images are the logits corresponding to the given targets. "-" denotes failure of generation.

Table content: <table><tr><td>Attacks</td><td colspan="5">MNIST 1st Per. 2nd Per. success rate 1st Per. 2nd Per. success rate CIFAR10</td></tr><tr><td>CW-L2(κ = 0)</td><td>100%</td><td>100%</td><td>84.65%</td><td>93.93% 94.80%</td><td>70.84%</td></tr><tr><td>CW-L2(κ = 500)</td><td colspan="2">99.78% 99.78%</td><td>76.61%</td><td>76.55% 84.07%</td><td>61.26%</td></tr><tr><td colspan="3">CW-L2(κ = 1000) 90.24% 95.98%</td><td>45.56%</td><td>47.86% 75.13%</td><td>48.86%</td></tr></table>

Targeted adversarial evaluations results of our rejection policies on the first 1000 test samples. We report the detection rates with different thresholds and success rates of generating adversarial examples.

Table content: <table/>

, which propose a hybrid model modeling distribution of features p(features) and predictive distribution p(targets|features) at the same time. Normalizing flow is used to learn invertible features as inputs of discriminative model, i.e. predictive distribution, and provides evaluation of features x * . Inputs out of the training data distribution are rejected by setting a threshold for p(x * ). For SDIM, illagel inputs are rejected by setting thresholds for each of the class conditional. The class conditionals are modeled on the data representations from encoder regularized by MI loss J MI . The hybrid model inNalisnick et al. (2019) can successfully distinguish in-distribution dataset and OoD dataset. While SDIM reject illegal inputs including OoD dataset samples and adversarial examples with more fine-grained class conditionals.

Table content: <table><tr><td>Geifman &amp; El-Yaniv (2017) propose a selection method to perform selective classification with</td></tr><tr><td>desired risk level given a trained model, but they focus on discriminative models.</td></tr><tr><td>B EVALUATION DETAILS</td></tr><tr><td>B.1 DATA PROCESSING</td></tr></table>

Following Hjelm et al. (2018), we parameterize the MI evaluation network T ω as a 1 × 1 convolutional neural network with architecture: Local MI evaluation concat-and-convolve network architecture.

Table content: <table><tr><td>Operation</td><td colspan="2">Size Activation</td></tr><tr><td colspan="2">Input → 1 × 1 conv 256</td><td>ReLU</td></tr><tr><td>1 × 1 conv</td><td>256</td><td>ReLU</td></tr><tr><td>1 × 1</td><td>1</td><td/></tr></table>

-386.1 -379.2 -319.8 -370.2 -357.2 -356.9 -259.3 -291.9 -239.0 DeepFool 153.4 -391.6 -344.1 -262.6 -376.1 -345.9 215.1

Table content: <table><tr><td>Samples</td><td>original</td><td colspan="2">deepfool</td><td colspan="2">cw-L2</td><td colspan="2">boundary</td><td colspan="2">JSMA</td></tr><tr><td>1st Per.</td><td>408.6 396.6</td><td>375.9</td><td>378.4</td><td>363.3</td><td>376.7</td><td>409.4</td><td>383.0</td><td>397.1</td><td>412.2</td></tr><tr><td>original</td><td>424.2</td><td/><td/><td/><td/><td/><td/><td/><td/></tr></table>

Peer review (iclr2020):
The paper proposed a supervised method for robust classification. By utilizing mutual information constrain on the encoder, supervised probabilistic constraint on the class conditional probability, and introducing a margin to the maximum likelihood, the proposed method can manage a high classification accuracy and detect the out of distribution data. The motivation is good, the writing is OK. The structure of the paper needs to be refined. The experiments are not very strong. Several concerns are listed: 1. It will be better if the author can show a structure map for Encoder, classification, class condition embedding, and mutual information evaluation networks, to clarify their relationships. 2. In Table 2, what is the accuracy for the rejection (outlier detection)? 3. The choose of the threshold for rejection is tricky. It will be better if the author can provide some rules for choosing the threshold which can be generalized to a new dataset. 4. The overall loss functions have three components, what is the contribution of different components to the final performance experimentally? 5. The architecture for encoder is large. Is it proper for Mnist which is a relatively simple dataset? 6. The comparison talked in the paragraph “Is Fully Generative Model Necessary for Generative Classification”, are these accuracies obtained from a comparable network size? It only makes sense if they are obtained using a comparable parameter size.