Indirect Gradient Matching for Adversarial Robust Distillation

## Abstract

Abstract Adversarial training significantly improves adversarial robustness, but superior performance is primarily attained with large models.
This substantial performance gap for smaller models has spurred active research into adversarial distillation (AD) to mitigate the difference.
Existing AD methods leverage the teacher’s logits as a guide.
In contrast to these approaches, we aim to transfer another piece of knowledge from the teacher, the input gradient.
In this paper, we propose a distillation module termed Indirect Gradient Distillation Module (IGDM) that indirectly matches the student’s input gradient with that of the teacher.
We hypothesize that students can better acquire the teacher’s knowledge by matching the input gradient.
Leveraging the observation that adversarial training renders the model locally linear on the input space, we employ Taylor approximation to effectively align gradients without directly calculating them.
Experimental results show that IGDM seamlessly integrates with existing AD methods, significantly enhancing the performance of all AD methods.
Particularly, utilizing IGDM on the CIFAR-100 dataset improves the AutoAttack accuracy from 28.06% to 30.32% with the ResNet-18 model and from 26.18% to 29.52% with the MobileNetV2 model when integrated into the SOTA method without additional data augmentation.
The code will be made available.

## 1 Introduction

Recently, adversarial attacks have revealed the vulnerabilities of deep learning-based models [, , ], raising critical concerns in safety-important applications [, , ].
Thus, much research has been done on defense technologies to make deep learning more reliable[, , , , , ].
Among adversarial defense mechanisms, adversarial training is one of the most effective methods to enhance adversarial robustness [, , ].
However, there is a significant performance gap between large and small models in adversarial training.
Since light models with less computational complexity are preferred in practical applications, increasing the robustness of light models is necessary.
To address this, adversarial training incorporates distillation methodologies which are commonly employed to boost the performance of light or small models [, , , ].

In the teacher-student architecture of knowledge distillation, prevailing methods leverage the teacher’s features or logits [, , , ]. Adversarial distillation (AD) approaches extend this paradigm by incorporating the teacher’s logits as a guide within their adversarial training framework [, , , , ]. Recent studies have specifically focused on tailoring the inner maximization problem of adversarial training, particularly by involving the teacher model in the generation of adversarial examples [, ].
In this paper, we exploit another knowledge of teachers: input gradient, which is helpful in the outer minimization of adversarial training.

Figure: Figure 1: Conceptual diagram of Indirect Gradient Distillation Module. We match the gradient in the input space with knowledge distillation. Since adversarial robust models are locally linear, matching the gradient has the effect of matching the output points of the surrouding input marked with ‘stars’, as illustrated in the top right figure. Consequently, gradient matching involves matching the teacher and student point by point in the output space, as depicted in the bottom right.
Refer to caption: extracted/5277544/figure/robust_distill_v5.png

We observe that adversarial training makes models locally linear on the input space and this linearity starts from the early stage of training.
The property of being locally linear enables the application of the first-order Taylor expansion, facilitating the alignment of gradients between the teacher and student models without the need for explicit gradient calculations.
We demonstrate that matching input gradients between teacher and student contributes to point-to-point alignment, allowing the student to better imitate the robust teacher.
In the top right of [Fig. 1](#S1.F1), if the input gradients between the teacher and the student match as depicted in the red line, then the output of the points located on the red line, denoted as stars, will also match.
We show that the output of random points around $x$ also becomes similar to the teacher as illustrated in the bottom right of [Fig. 1](#S1.F1).
This alignment causes the student to mimic the teacher and reduces the capacity gap between teacher and student.

In this paper, we propose Indirect Gradient Distillation Module (IGDM), which indirectly aligns the student’s gradient with that of the teacher.
Since existing AD methods are mainly designed to match only logits, IGDM can be used in conjunction with them.
Through extensive experimental results, we verify that our method successfully complements the robustness of existing AD methods.

Our contributions are as follows:

- •
We propose a methodology to transfer the gradient information from the teacher to the student through the exploitation of the local linearity inherent in adversarial training.
This stands in contrast to prevailing AD methods, which primarily concentrate on the distillation of logits.
- •
Based on the analysis, we propose the Indirect Gradient Distillation Module (IGDM), which indirectly distills the gradient information. Its modular design allows easy integration into existing AD methods.
- •
IGDM notably improves robustness across various attack scenarios, demonstrating significant AutoAttack robustness trained on the CIFAR-100 dataset: 30.32% on ResNet-18 and 29.52% on MobileNetV2.
Furthermore, our module is effective even without employing the teacher model in the inner maximization.

## 2 Related work

### 2.1 Adversarial Training

Adversarial training (AT) involves generating adversarial examples during the training process to enhance model robustness.
The objective function of AT is a minimization-maximization problem as follows.

$$ $\min_{\mathbf{w}}\mathbb{E}_{(\mathbf{x},y)\sim\mathit{D}}\left(\max_{\| \boldsymbol{\delta}\|_{p}\leq\epsilon}\left[l_{obj}(\mathbf{x}+\boldsymbol{ \delta},y)\right]\right),$ (1) $$

where $\mathbf{w}$ is model parameters, $\mathit{D}$ is a data distribution of $\mathbf{x}$ and corresponding labels $y$,
$\boldsymbol{\delta}$ is perturbation causing the largest loss within $l_{p}$ norm of $\epsilon$, and $l_{obj}$ is an objective function such as cross-entropy loss.
Multi-step PGD attack [] is commonly utilized to solve the inner maximization problem of [Eq. 1](#S2.E1), and various regularization loss functions have been introduced for the outer minimization problem.
TRADES [] incorporates the Kullback-Leibler (KL) divergence loss between the predictions of clean and adversarial images.
MART[] introduces per-sample weights based on the confidence of each sample.
Due to their simplicity and effectiveness, TRADES and MART are commonly used as baseline methods in adversarial training [, , , , , ].
Moreover, several strategies such as data augmentation [, ], and diverse loss functions [], have been introduced.

Although defending against strong adversarial attack strategies[, , ] is challenging, highly robust models have also been developed.
Low Temperature Distillation (LTD) [] points out the shortcomings of one-hot labels in adversarial training and advocates the use of soft labels as an alternative approach.
Better Diffusion Models for Adversarial Training (BDM-AT) [] explores methods for the more efficient utilization of diffusion models within the context of adversarial training.
Improved Kullback–Leibler Adversarial Training (IKL-AT) [] inspects the mechanism of KL divergence loss and proposes the Decoupled Kullback-Leibler divergence loss.
However, since these models utilize large architectures, there is a need to improve adversarial robustness in smaller models.

### 2.2 Adversarial Robust Distillation

Adversarial Robustness Distillation (ARD) [] is the first study to propose the AD.
ARD reveals that students can more effectively acquire robustness when guided by a robust teacher within an adversarial training framework.
RSLAD [] highlights the significance of the smooth logit learned by the teacher in robust distillation.
It diverges from ARD by eliminating the student’s cross-entropy loss, relying solely on guidance from the teacher’s output.
Furthermore, RSLAD incorporates teachers into the adversarial image generation process.
AdaAD [] generates more sophisticated adversarial images through the integration of the teacher during the inner maximization process.
Introspective Adversarial Distillation (IAD) [] concentrates on assessing the reliability of the teacher and introduces a confidence score of the information provided by the teacher.
Previous AD methods utilize the teacher’s logits as a guide, but our approach incorporates the distillation of gradient information as well.

### 2.3 Gradient Distillation

In knowledge distillation, gradient information has been used in various ways [, , , ], computed in either input space or weight space.
For example, an exploration of the diversity among teacher models in the weight gradient space aids in identifying an optimal direction for training the student network [].
Another study examines the capacity gap between teachers and students, focusing on the perspective of weight gradients similarity [].
Conversely, input space gradients find applications in knowledge distillation for tasks such as object detection [] or language model [].
These methods all compute the gradient directly, which is different from our approach.

## 3 Method

In knowledge distillation, students attempt to emulate teachers by aligning their features or outputs with those of the teachers.
However, the need for more comprehensive knowledge transfer arises in the context of adversarial robustness, given that adversaries introduce perturbations to input data.
Consequently, the transfer of extensive knowledge from the input neighborhood becomes crucial.
However, transferring knowledge of all points one by one is impractical due to the infinite number of vicinity points.
To address this problem, we match the input gradients of the student and the teacher.
This gradient alignment is essential in facilitating the student’s emulation of the teacher.
The following sections elucidate how we can match the gradients without direct calculation.

### 3.1 Locally Linearity of Adversarial Training

Unlike natural training, adversarially trained models are capable of first-order Taylor expansion on the input.
The output for small noise around x can be expressed as follows.

$$ $f(\textbf{x}+\boldsymbol{\epsilon})=\underbrace{f(\textbf{x})+\left(\frac{ \partial f(\textbf{x})}{\partial\textbf{x}}\right)^{T}\boldsymbol{\epsilon}}_{ \text{first-order approximation}}+\underbrace{\vphantom{\left(\frac{\partial f (\textbf{x})}{\partial\textbf{x}}\right)}O(\|\boldsymbol{\epsilon}\|^{2})}_{ \text{remainder}},$ (2) $$

where $f$ is the model and $\boldsymbol{\epsilon}$ is sufficiently small noise with the same dimension as the x.
To investigate the impact of the remainder, we compute the proportion occupied by the remainder in [Eq. 2](#S3.E2).
Here, we apply uniform noise with a size of 8$/$255 as the perturbation $\epsilon$, which is a common size in adversarial attacks.
We first examine the remainder proportion in an adversarially well-trained model: LTD[], BDM-AT[], and IKL-AT[] where we summarized the performance in [Table 1](#S4.T1).
In [Fig. 2](#S3.F2), the remainder proportions are computed to be very small, with values of 0.012, 0.012, and 0.016 for three adversarially-trained models LTD, BDM-AT, and IKL-AT, respectively.
In other words, $f(\textbf{x}+\boldsymbol{\epsilon})$ can be approximated to the first-order Taylor expansion since the remainder proportion is negligible.
Thus, we utilize this local linearity of the adversarially well-trained models.

Next, we investigate whether the model retains the local linearity in adversarial training, not in the case of a fully-trained model.
We test three training strategies: natural training, adversarial training via ten steps of PGD, and adversarial distillation [] using the BDM-AT teacher.
In [Fig. 2](#S3.F2), the remainder proportion continuously increases in natural training, while it consistently remains small in both adversarial training and adversarial distillation.
Therefore, employing first-order Taylor expansion is feasible during adversarial training and distillation procedures.
In the following section, we demonstrate how the locally linear property enables the matching of input gradients between the teacher and the student.

Figure: (a)
Refer to caption: extracted/5277544/figure/ratio_teacher.png

Figure: Figure 3: Summary diagram of AD with IGDM. IGDM indirectly obtains input gradients of both the teacher and the student by calculating output differences and perform distillation to match the gradients. IGDM can be seamlessly integrated with existing AD methods.
Refer to caption: extracted/5277544/figure/model.png

### 3.2 Gradient Matching via Output Differences

For an input x, we define $\textbf{x}_{\epsilon_{1}}$ and $\textbf{x}_{\epsilon_{2}}$ as follows:

$$ $\textbf{x}_{\epsilon_{1}}=\textbf{x}+\boldsymbol{\epsilon_{1}}\ ,\ \textbf{x}_ {\epsilon_{2}}=\textbf{x}+\boldsymbol{\epsilon_{2}},$ (3) $$

where $\boldsymbol{\epsilon_{1}}$ and $\boldsymbol{\epsilon_{2}}$ represent small perturbations of the same dimension as the input x.
For adversarially trained or training model $f$, the output of $\textbf{x}_{\epsilon_{1}}$ and $\textbf{x}_{\epsilon_{2}}$ can be approximated using first-order Taylor expansion through the input space:

$$ $\begin{split}f(\textbf{x}_{\epsilon_{1}})\approx f(\textbf{x})+\left(\frac{ \partial f(\textbf{x})}{\partial\textbf{x}}\right)^{T}\boldsymbol{\epsilon_{1} },\\ f(\textbf{x}_{\epsilon_{2}})\approx f(\textbf{x})+\left(\frac{\partial f( \textbf{x})}{\partial\textbf{x}}\right)^{T}\boldsymbol{\epsilon_{2}},\end{split}$ (4) $$

where we neglect the remainder term based on the observations in [Section 3.1](#S3.SS1).
To extract and align the gradients between the student and the teacher models, we utilize the output differences as follows:

$$ $L=D\left(f_{S}(\textbf{x}_{\epsilon_{1}})-f_{S}(\textbf{x}_{\epsilon_{2}})\ , \ f_{T}(\textbf{x}_{\epsilon_{1}})-f_{T}(\textbf{x}_{\epsilon_{2}})\right),$ (5) $$

where $f_{S}$ and $f_{T}$ represent the student and teacher models, while $D$ denotes a distance metric like L2 or KL loss.
This loss can be reformulated using [Eq. 4](#S3.E4) as follows:

$$ $L=D\left(\left(\frac{\partial f_{S}(\textbf{x})}{\partial\textbf{x}}\right)^{T }(\boldsymbol{\epsilon_{1}}-\boldsymbol{\epsilon_{2}})\ ,\ \left(\frac{ \partial f_{T}(\textbf{x})}{\partial\textbf{x}}\right)^{T}(\boldsymbol{ \epsilon_{1}}-\boldsymbol{\epsilon_{2}})\right).$ (6) $$

Since $\boldsymbol{\epsilon_{1}}-\boldsymbol{\epsilon_{2}}$ is inner-producted on both sides within the distance metric, optimizing the given loss achieves the alignment of the gradients between the student and the teacher models, *i.e*.,

$$ $\begin{split}\frac{\partial f_{S}(\textbf{x})}{\partial\textbf{x}}\approx\frac {\partial f_{T}(\textbf{x})}{\partial\textbf{x}}\end{split}.$ (7) $$

### 3.3 Indirect Gradient Distillation Module (IGDM)

To effectively integrate the gradient matching through output differences into AD methods, we select the $\boldsymbol{\epsilon_{1}}$ and $\boldsymbol{\epsilon_{2}}$ as constant multiples of the adversary perturbation $\boldsymbol{\delta}$ from the AD methods, *i.e*., $\boldsymbol{\epsilon_{1}}-\boldsymbol{\epsilon_{2}}\propto\boldsymbol{\delta}$.
Since the adversarial perturbation $\boldsymbol{\delta}$ closely aligns with the gradient direction, the inner product of gradient and $\boldsymbol{\epsilon_{1}}-\boldsymbol{\epsilon_{2}}$ in [Eq. 6](#S3.E6) can be effectively increased with the adversarial perturbation.
In other words,
$(\frac{\partial f_{S}(\textbf{x})}{\partial\textbf{x}})^{T}(\boldsymbol{
\epsilon_{1}}-\boldsymbol{\epsilon_{2}})\propto(\frac{\partial f_{S}(\textbf{x
})}{\partial\textbf{x}})^{T}\boldsymbol{\delta}$ remains large, facilitating the enhanced alignment of gradients using loss function in [Eq. 6](#S3.E6) during training.
If $\boldsymbol{\epsilon_{1}}-\boldsymbol{\epsilon_{2}}$ were random noise, its inner product would be zero when the noise is orthogonal to the gradient, thereby making no contribution to the alignment of gradients.

Finally, Indirect Gradient Distillation Module (IGDM) loss is formulated as:

$$ $\begin{split}L_{IGDM}=T(\alpha)\cdot D\left(f_{S}(\textbf{x}+\beta\boldsymbol{ \delta})-f_{S}(\textbf{x}-\gamma\boldsymbol{\delta})\right.\\ \left.\ ,\ f_{T}(\textbf{x}+\beta\boldsymbol{\delta})-f_{T}(\textbf{x}-\gamma \boldsymbol{\delta})\right).\end{split}$ (8) $$

Here, $T(\alpha)$ is a non-negative, increasing hyperparameter function throughout the training epochs, mitigating the risk of falling into the local minima in the initial training phases.
Both $\beta$ and $\gamma$ are non-negative hyperparameters.
Our model architecture is depicted in [Fig. 3](#S3.F3).
Since IGDM complements the objective function by matching the gradients between the teacher and student models, the integration of IGDM with other AD methods becomes feasible in the following manner:

$$ $l_{obj}=L_{AD}+L_{IGDM},$ (9) $$

where $L_{AD}$ stands for the objective function of other AD methods such as ARD [], RSLAD [], AdaAD [], etc.

### 3.4 Enhancing Teacher-Student Alignment through Gradient Matching

In this section, we elucidate the role of gradient matching in facilitating students to emulate their teachers.
An underlying aim of knowledge distillation is to foster alignment between the teacher and the student.
In AD, the alignment should take into account not only clean images but also adversarial images.
For instance, RSLAD[] attempts to match both clean and adversarial images by using the following objective function:

$$ $l_{obj}=\min_{\theta}\left[\text{KL}(S_{\theta}(\mathbf{x}),T(\mathbf{x}))+ \text{KL}(S_{\theta}(\mathbf{x}+\boldsymbol{\delta}),T(\mathbf{x}))\right].$ (10) $$

AdaAD[] points out there is a non-negligible property of local variance on teacher model: for $\forall\boldsymbol{\delta_{1}}\neq\boldsymbol{\delta_{2}}$, $T(\mathbf{x}+\boldsymbol{\delta}_{1})\neq T(\mathbf{x}+\boldsymbol{\delta}_{2})$.
Therefore, to align the student and teacher under the local variance, AdaAD employs the following loss function.

$$ $l_{obj}=\min_{\theta}\text{KL}(S_{\theta}(\mathbf{x}+\boldsymbol{\delta}),T( \mathbf{x}+\boldsymbol{\delta})).$ (11) $$

In other words, AdaAD emphasizes matching between $T(\mathbf{x}+\boldsymbol{\delta})$ and $S(\mathbf{x}+\boldsymbol{\delta})$ where $\boldsymbol{\delta}$ is a small perturbation.

While RSLAD and AdaAD explicitly try to match the output between teacher and student, IGDM implicitly matches teacher and student.
We define point-wise distance $D(\mathbf{x},\boldsymbol{\delta})=\lVert f_{T}(\mathbf{x}+\boldsymbol{\delta})
-f_{S}(\mathbf{x}+\boldsymbol{\delta})\rVert$.
Then given $\mathbf{x}$, the upper bound of $D(\mathbf{x},\boldsymbol{\delta})$ for sufficiently small $\boldsymbol{\delta}$ is as follows.

$$ $\begin{split}D(\mathbf{x},\boldsymbol{\delta})&\approx\left\lVert(f_{T}( \mathbf{x})-f_{S}(\mathbf{x})+\left(\frac{\partial f_{T}(\textbf{x})}{\partial \textbf{x}}-\frac{\partial f_{S}(\textbf{x})}{\partial\textbf{x}}\right)^{T} \boldsymbol{\delta}\right\rVert\\ &\leq\left\lVert(f_{T}(\mathbf{x})-f_{S}(\mathbf{x})\right\rVert+\left\lVert \left(\frac{\partial f_{T}(\textbf{x})}{\partial\textbf{x}}-\frac{\partial f_{ S}(\textbf{x})}{\partial\textbf{x}}\right)^{T}\boldsymbol{\delta}\right\rVert, \\ \end{split}$ (12) $$

where the inequality came out through the triangle inequality.
We see that the distance $D(\mathbf{x},\boldsymbol{\delta})$ is bounded by the output term and the gradient term.
Hence, the better the gradient matching, the smaller the upper bound of $D(\mathbf{x},\boldsymbol{\delta})$ becomes.
Therefore, IGDM implicitly aligns the teacher and student in a points-wisely manner.

## 4 Experiments

We explain about experimental setup, followed by comparative performance evaluations of the proposed IGDM method against various AT and AD methods.

### 4.1 Settings

We utilized the CIFAR-10 and CIFAR-100[] datasets for our experiments.
Random crop and random horizontal flip were applied, while other augmentations were not utilized.
Our training methods encompassed conventional adversarial training methods (PGD-AT[] and TRADES[]), as well as adversarial distillation techniques including ARD[], IAD[], RSLAD[], and AdaAD[].
In our comparative analysis, we integrated IGDM into all of these methods, and we used shortened notations to represent the methods with IGDM.
For example, when IGDM is combined with ARD, we denote it as ARD + IGDM or IGDM${}_{\text{ARD}}$.
We fixed the hyperparameters of all given methods used in the experiment as original paper, and detailed information is in the supplementary materials.
Then, we only adjusted the hyperparameters of IGDM, $\alpha$, $\beta$, and $\gamma$.
For the surrogate loss of IGDM, we employed KL divergence loss, but using alternative surrogate losses, such as L1 and L2 loss, yields nearly indistinguishable results.

#### Teacher and Student Models

We selected three teacher models including LTD[], BDM-AT[], and IKL-AT[].
The LTD model is widely adopted in prior AD research, while the others have achieved high-ranking performance in RobustBench[], demonstrating superior robustness against AutoAttack[].
The detailed information can be found in [Table 1](#S4.T1).
For student models, we employed the ResNet-18[] and MobileNetV2[] architectures.

**Table 1: Performance (%) of the teacher models.**
| Dataset | Teacher(Architecture) | Clean | PGD | AA |
| --- | --- | --- | --- | --- |
| CIFAR-10 | LTD(WRN-34-10) | 85.21 | 60.89 | 56.94 |
| BDM-AT(WRN-28-10) | 92.44 | 70.63 | 67.31 |  |
| IKL-AT(WRN-28-10) | 92.16 | 71.09 | 67.73 |  |
| CIFAR-100 | LTD(WRN-34-10) | 64.07 | 36.61 | 30.57 |
| BDM-AT(WRN-28-10) | 72.58 | 44.24 | 38.83 |  |
| IKL-AT(WRN-28-10) | 73.80 | 44.14 | 39.18 |  |

#### Evaluation Metrics

After training, we evaluate the performance using five metrics: Clean, PGD, AutoAttack (AA) accuracy, mean Gradient Distance (GD), and mean Gradient Cosine similarity (GC).
Clean refers to the accuracy of the test dataset.
PGD assesses the robustness against 20 steps of PGD attack following the methodology in [], while AA evaluates the model’s robustness against the AutoAttack method [].
All attacks were conducted within an $l_{\infty}$-norm bound of $8/255$.
Two additional metrics are introduced: GD and GC.
GD measures the average L2 distance between the input gradients of the teacher and those of the student, thus smaller values are preferred.
GC quantifies the cosine similarity between the teacher and student input gradients.
As the gradients of the student model align more closely with those of the teacher model, the metric approaches one from zero.

**Table 2: Adversarial distillation result on ResNet-18 with three teacher models on CIFAR-10 and CIFAR-100. The clean, PGD, and AA each indicate performance (%), and GD and GC are mean gradient distance and mean gradient cosine similarity values, respectively. The numbers in bold indicate improved performance.**
| Dataset | Method | Teacher models & Evaluation metrics |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| LTD[] | BDM-AT[] | IKL-AT[] |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
| Clean | PGD | AA | GD$\Downarrow$ | GC$\Uparrow$ | Clean | PGD | AA | GD$\Downarrow$ | GC$\Uparrow$ | Clean | PGD | AA | GD$\Downarrow$ | GC$\Uparrow$ |  |  |
| CIFAR-10 | PGD-AT | 84.52 | 42.80 | 41.12 | 0.408 | 0.382 | 84.52 | 42.80 | 41.12 | 0.409 | 0.290 | 84.52 | 42.80 | 41.12 | 0.409 | 0.286 |
| +IGDM | 84.20 | 45.09 | 43.00 | 0.188 | 0.421 | 84.09 | 44.58 | 42.60 | 0.194 | 0.328 | 84.31 | 45.64 | 43.21 | 0.171 | 0.331 |  |
| TRADES | 82.46 | 49.13 | 47.09 | 0.124 | 0.521 | 82.46 | 49.13 | 47.09 | 0.131 | 0.425 | 82.46 | 49.13 | 47.09 | 0.131 | 0.425 |  |
| +IGDM | 83.50 | 54.64 | 48.83 | 0.088 | 0.560 | 83.07 | 55.59 | 49.19 | 0.104 | 0.458 | 83.14 | 54.91 | 48.76 | 0.098 | 0.455 |  |
| ARD | 85.04 | 53.27 | 49.49 | 0.051 | 0.603 | 85.31 | 49.16 | 45.95 | 0.092 | 0.381 | 85.41 | 49.36 | 45.32 | 0.087 | 0.389 |  |
| +IGDM | 83.85 | 54.28 | 51.09 | 0.042 | 0.699 | 84.65 | 50.82 | 46.90 | 0.079 | 0.436 | 84.75 | 51.47 | 47.10 | 0.075 | 0.445 |  |
| IAD | 84.33 | 54.24 | 50.09 | 0.047 | 0.619 | 84.64 | 49.09 | 45.78 | 0.090 | 0.403 | 85.22 | 49.70 | 45.96 | 0.083 | 0.393 |  |
| +IGDM | 84.49 | 56.55 | 51.09 | 0.038 | 0.724 | 83.30 | 56.77 | 50.91 | 0.059 | 0.538 | 83.27 | 56.20 | 50.02 | 0.061 | 0.518 |  |
| RSLAD | 83.59 | 55.98 | 52.13 | 0.036 | 0.754 | 85.18 | 52.32 | 48.95 | 0.071 | 0.519 | 85.55 | 52.13 | 48.83 | 0.069 | 0.531 |  |
| +IGDM | 82.96 | 57.33 | 53.23 | 0.034 | 0.761 | 84.29 | 53.75 | 50.09 | 0.066 | 0.536 | 84.59 | 53.65 | 49.83 | 0.065 | 0.541 |  |
| AdaAD | 85.13 | 57.27 | 53.38 | 0.030 | 0.822 | 86.90 | 54.27 | 50.83 | 0.064 | 0.573 | 86.59 | 54.25 | 50.86 | 0.062 | 0.570 |  |
| +IGDM | 84.53 | 57.78 | 54.06 | 0.029 | 0.836 | 86.03 | 55.14 | 51.31 | 0.063 | 0.580 | 86.10 | 55.41 | 51.29 | 0.060 | 0.587 |  |
| CIFAR-100 | PGD-AT | 55.80 | 19.88 | 18.86 | 0.452 | 0.389 | 55.80 | 19.88 | 18.86 | 0.173 | 0.403 | 55.80 | 19.88 | 18.86 | 0.460 | 0.306 |
| +IGDM | 60.49 | 33.72 | 28.02 | 0.086 | 0.668 | 61.17 | 35.11 | 29.01 | 0.105 | 0.555 | 62.91 | 35.25 | 28.89 | 0.122 | 0.534 |  |
| TRADES | 53.56 | 25.85 | 22.02 | 0.178 | 0.456 | 53.56 | 25.85 | 22.02 | 0.190 | 0.375 | 53.56 | 25.85 | 22.02 | 0.199 | 0.354 |  |
| +IGDM | 59.29 | 32.08 | 26.10 | 0.076 | 0.684 | 60.88 | 32.26 | 25.50 | 0.094 | 0.517 | 62.41 | 31.79 | 24.02 | 0.116 | 0.467 |  |
| ARD | 61.34 | 31.19 | 25.74 | 0.108 | 0.592 | 61.51 | 30.23 | 24.77 | 0.142 | 0.439 | 61.38 | 27.59 | 23.18 | 0.178 | 0.400 |  |
| +IGDM | 60.14 | 33.74 | 28.30 | 0.087 | 0.670 | 60.28 | 35.75 | 29.42 | 0.100 | 0.570 | 61.55 | 35.24 | 28.87 | 0.117 | 0.546 |  |
| IAD | 60.12 | 32.91 | 26.29 | 0.102 | 0.596 | 59.92 | 31.47 | 25.15 | 0.135 | 0.443 | 61.09 | 29.25 | 23.61 | 0.173 | 0.403 |  |
| +IGDM | 62.73 | 33.69 | 27.49 | 0.086 | 0.674 | 62.99 | 34.76 | 27.76 | 0.104 | 0.549 | 64.20 | 33.71 | 27.03 | 0.132 | 0.506 |  |
| RSLAD | 60.01 | 32.39 | 26.94 | 0.089 | 0.658 | 60.22 | 32.16 | 26.76 | 0.118 | 0.492 | 61.18 | 30.54 | 25.27 | 0.147 | 0.444 |  |
| +IGDM | 60.43 | 34.02 | 28.51 | 0.077 | 0.709 | 62.06 | 35.67 | 29.78 | 0.096 | 0.582 | 63.55 | 35.26 | 29.10 | 0.119 | 0.541 |  |
| AdaAD | 63.34 | 33.39 | 27.81 | 0.077 | 0.736 | 64.43 | 33.21 | 28.06 | 0.107 | 0.567 | 65.36 | 32.29 | 26.89 | 0.133 | 0.525 |  |
| +IGDM | 61.70 | 34.37 | 28.83 | 0.071 | 0.764 | 64.44 | 36.19 | 30.32 | 0.093 | 0.632 | 66.00 | 34.47 | 29.22 | 0.119 | 0.582 |  |

**Table 3: Performance of AdaAD and IGDM${}_{\text{AdaAD}}$ with different inner loss on CIFAR-100, using the ResNet-18 student and the BDM-AT teacher. The ‘w/o $T_{in}$’ indicates the use of PGD for inner loss without the teacher, *i.e*., inner loss utilizing only the student. ‘T/E’ denotes the time per epoch in minutes.**
| Method | AA | GD | GC | T/E |
| --- | --- | --- | --- | --- |
| AdaAD | 28.06 | 0.107 | 0.567 | 10.62 |
| AdaAD w/o $T_{in}$ | 25.62 | 0.141 | 0.447 | 2.26 |
| IGDM${}_{\text{AdaAD}}$ | 30.32 | 0.093 | 0.632 | 11.21 |
| IGDM${}_{\text{AdaAD}}$ w/o $T_{in}$ | 29.34 | 0.098 | 0.580 | 3.36 |

**Table 4: Adversarial distillation result on MobileNetV2 with three teacher models on CIFAR-10 and CIFAR-100. The clean, PGD, and AA each indicate performance (%), and GD and GC are mean gradient distance and mean gradient cosine similarity values, respectively. The numbers in bold indicate improved performance.**
| Dataset | Method | Teacher models & Evaluation metrics |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| LTD[] | BDM-AT[] | IKL-AT[] |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
| Clean | PGD | AA | GD$\Downarrow$ | GC$\Uparrow$ | Clean | PGD | AA | GD$\Downarrow$ | GC$\Uparrow$ | Clean | PGD | AA | GD$\Downarrow$ | GC$\Uparrow$ |  |  |
| CIFAR-10 | PGD-AT | 83.52 | 44.47 | 41.19 | 0.171 | 0.505 | 83.52 | 44.47 | 41.19 | 0.175 | 0.406 | 83.52 | 44.47 | 41.19 | 0.175 | 0.401 |
| +IGDM | 83.37 | 47.06 | 43.50 | 0.107 | 0.524 | 83.27 | 47.12 | 43.79 | 0.112 | 0.423 | 83.08 | 47.23 | 43.46 | 0.112 | 0.422 |  |
| TRADES | 81.57 | 50.49 | 46.88 | 0.062 | 0.605 | 81.57 | 50.49 | 46.88 | 0.074 | 0.492 | 81.57 | 50.49 | 46.88 | 0.073 | 0.489 |  |
| +IGDM | 80.95 | 52.92 | 47.97 | 0.039 | 0.650 | 81.17 | 52.88 | 47.47 | 0.051 | 0.498 | 80.54 | 52.65 | 47.56 | 0.055 | 0.491 |  |
| ARD | 84.18 | 52.16 | 48.11 | 0.054 | 0.578 | 84.38 | 48.26 | 44.02 | 0.091 | 0.371 | 84.68 | 48.03 | 44.11 | 0.087 | 0.376 |  |
| +IGDM | 82.27 | 53.33 | 49.93 | 0.042 | 0.673 | 82.13 | 52.19 | 47.24 | 0.067 | 0.485 | 81.93 | 52.21 | 47.45 | 0.067 | 0.489 |  |
| IAD | 83.38 | 52.71 | 48.45 | 0.051 | 0.592 | 83.79 | 48.36 | 44.02 | 0.088 | 0.385 | 84.25 | 48.58 | 44.15 | 0.082 | 0.39 |  |
| +IGDM | 83.65 | 54.57 | 50.14 | 0.038 | 0.704 | 81.07 | 54.12 | 48.96 | 0.059 | 0.514 | 81.48 | 54.34 | 49.07 | 0.059 | 0.515 |  |
| RSLAD | 82.60 | 54.55 | 50.44 | 0.040 | 0.706 | 84.69 | 50.94 | 47.38 | 0.074 | 0.491 | 85.36 | 51.43 | 47.69 | 0.072 | 0.503 |  |
| +IGDM | 81.97 | 55.60 | 51.11 | 0.039 | 0.707 | 84.08 | 52.65 | 48.73 | 0.071 | 0.501 | 83.65 | 53.38 | 48.65 | 0.060 | 0.510 |  |
| AdaAD | 84.24 | 55.96 | 51.60 | 0.034 | 0.777 | 85.21 | 51.45 | 47.55 | 0.069 | 0.516 | 85.31 | 52.10 | 48.03 | 0.066 | 0.524 |  |
| +IGDM | 83.57 | 56.18 | 52.15 | 0.033 | 0.791 | 83.47 | 52.84 | 49.03 | 0.062 | 0.538 | 83.92 | 53.17 | 49.08 | 0.061 | 0.541 |  |
| CIFAR-100 | PGD-AT | 59.23 | 24.04 | 21.58 | 0.194 | 0.486 | 59.23 | 24.04 | 21.58 | 0.204 | 0.408 | 59.23 | 24.04 | 21.58 | 0.211 | 0.392 |
| +IGDM | 57.40 | 33.53 | 27.70 | 0.080 | 0.680 | 57.66 | 33.83 | 27.87 | 0.099 | 0.548 | 59.75 | 33.59 | 27.02 | 0.120 | 0.517 |  |
| TRADES | 51.05 | 24.83 | 20.62 | 0.119 | 0.460 | 51.05 | 24.83 | 20.62 | 0.132 | 0.377 | 51.05 | 24.83 | 20.62 | 0.148 | 0.351 |  |
| +IGDM | 56.81 | 29.87 | 23.38 | 0.081 | 0.640 | 57.80 | 29.47 | 22.05 | 0.097 | 0.469 | 59.40 | 27.83 | 20.12 | 0.120 | 0.417 |  |
| ARD | 60.55 | 30.82 | 25.28 | 0.111 | 0.569 | 61.06 | 31.25 | 24.70 | 0.137 | 0.445 | 61.52 | 28.00 | 23.40 | 0.164 | 0.420 |  |
| +IGDM | 58.43 | 33.31 | 27.86 | 0.087 | 0.650 | 58.81 | 33.34 | 27.45 | 0.111 | 0.518 | 60.31 | 32.54 | 27.09 | 0.134 | 0.492 |  |
| IAD | 56.11 | 29.55 | 24.22 | 0.106 | 0.547 | 56.35 | 28.96 | 23.43 | 0.129 | 0.430 | 58.39 | 28.40 | 23.06 | 0.147 | 0.418 |  |
| +IGDM | 58.60 | 31.36 | 25.64 | 0.090 | 0.617 | 57.65 | 31.97 | 25.60 | 0.106 | 0.506 | 59.58 | 30.96 | 25.42 | 0.128 | 0.478 |  |
| RSLAD | 60.43 | 32.37 | 26.85 | 0.092 | 0.632 | 61.29 | 31.74 | 26.18 | 0.121 | 0.490 | 61.95 | 30.16 | 25.09 | 0.157 | 0.441 |  |
| +IGDM | 60.36 | 33.99 | 28.00 | 0.079 | 0.696 | 60.56 | 35.24 | 29.52 | 0.099 | 0.571 | 62.48 | 35.25 | 28.82 | 0.118 | 0.547 |  |
| AdaAD | 61.43 | 30.58 | 25.03 | 0.091 | 0.649 | 61.89 | 29.54 | 23.80 | 0.118 | 0.497 | 62.35 | 28.51 | 23.01 | 0.140 | 0.470 |  |
| +IGDM | 59.88 | 32.60 | 27.01 | 0.080 | 0.702 | 60.58 | 33.38 | 26.93 | 0.097 | 0.577 | 61.59 | 32.43 | 25.62 | 0.121 | 0.531 |  |

### 4.2 Main Results

We present the comprehensive results of integrating IGDM into AT and AD methods and their original versions in [Table 2](#S4.T2) and [Table 4](#S4.T4).
IGDM significantly improves robustness, regardless of the original methods, datasets, student models, or teacher models.
IGDM demonstrates notably enhanced AA robustness on the CIFAR-100 dataset, achieving 30.32% on ResNet-18 and 29.52% on MobileNetV2.
Interestingly, we also observe a correlation between performance and both GD and GC.
To provide a clearer visualization of this relationship, we plot the relationship between GD and robustness as well as GC and robustness in [Fig. 4](#S4.F4).
As the regression lines show, robustness increases as GD decreases, and robustness increases as GC increases.
This highlights the positive impact of aligning the gradients between the teacher and student models and supports our analysis in [Eq. 12](#S3.E12).
More importantly, we consistently observe a decrease in GD and an increase in GC when IGDM is applied.

Figure: Figure 4: Correlation between GC and AutoAttack ($top$), and correlation between GD and AutoAttack ($bottom$). All results are achieved through different methods with ResNet-18 and a BDM-AT teacher on CIFAR-100. The values for IGDM and AD methods are the same with [Table 2](#S4.T2). Others represent the results of additional experiments conducted under the same configuration.
Refer to caption: x2.png

### 4.3 Simple Inner Maximization with IGDM

Recent AD methods commonly utilize a teacher model for inner maximization [, ].
While these approaches improve the robustness of the student, employing the teacher in inner maximization involves considerable time consumption.
Specifically, AdaAD utilizes the backward function of the teacher model, leading to increased processing time due to the substantial weight size of the teacher’s architecture.
In contrast, IGDM demonstrates strong performance even when employing simple inner maximization without the teacher model.
We measured AA, GD, GC, and time per epoch in [Table 3](#S4.T3) in both cases, with and without the teacher model in inner maximization.
The second row demonstrates a significant drop in robustness when AdaAD’s outer minimization is retained, but the inner maximization is switched to the PGD attack solely on the student model.
However, in the fourth row, employing IGDM${}_{\text{AdaAD}}$ without the teacher model for inner maximization still achieves superior robustness and gradient matching over AdaAD while reducing training time by threefold.
Therefore, utilizing IGDM enables achieving strong robustness with a simple inner loss, reducing training time significantly and offering flexibility by eliminating the need for the teacher model in the inner loss.

### 4.4 Point-wise alignment

We argue in [Eq. 12](#S3.E12) that IGDM is helpful for point-wise alignment.
To experimentally validate this assertion, we compared the distances between the teacher and the student model.
We calculated D($f_{S}(\mathbf{x}+\boldsymbol{\delta}),f_{T}(\mathbf{x}+\boldsymbol{\delta}))$ for three cases: when $\boldsymbol{\delta}$ is $\mathbf{0}$, random noise from uniform distribution, and adversarial perturbation in [Table 5](#S4.T5).
We utilize L2 distance for $D$.
For the adversarial noise, we conducted an adversarial attack using the inner maximization loss corresponding to each method, with a fixed number of steps at 20.
In all cases, we observed an improvement in alignment when using IGDM.
In particular, IGDM enhanced alignment against not only adversarial noise but also random noise.
This outcome shows that our module contributes to point-wise alignment, as demonstrated in [Eq. 12](#S3.E12).

**Table 5: Point-wise alignment with IGDM on CIFAR-100, using the ResNet-18 student model and the BDM-AT teacher model. The numbers in bold indicate enhanced point alignment.**
| Method | $D(f_{S}(\mathbf{x}+\boldsymbol{\delta}),f_{T}(\mathbf{x}+\boldsymbol{\delta}))$ |  |  |
| --- | --- | --- | --- |
| Noise | $\boldsymbol{\delta}=\mathbf{0}$ | $\boldsymbol{\delta}\sim U[-8/255,8/255]$ | $\boldsymbol{\delta}$ = adv |
| ARD | 23.93 | 23.93 | 28.49 |
| +IGDM | 13.19 | 13.12 | 15.33 |
| IAD | 23.76 | 23.74 | 28.11 |
| +IGDM | 13.43 | 13.42 | 16.84 |
| RSLAD | 19.06 | 19.02 | 23.74 |
| +IGDM | 12.38 | 12.33 | 15.16 |
| AdaAD | 18.00 | 17.94 | 25.29 |
| +IGDM | 12.95 | 12.94 | 18.57 |

### 4.5 Ablation Studies

In this section, we conduct more extensive experiments, including black-box attacks and unseen norm attacks.
Here, we chose the CIFAR-100 dataset with ResNet-18 architecture.
In the case of the teacher, we selected BDM-AT.

**Table 6: The robust accuracy of unseen norm attacks and a black-box attack. The numbers in bold indicate improved performance.**
| Method | Unseen | Black-box |  |
| --- | --- | --- | --- |
| PGD-L1 | PGD-L2 | VMI-FGSM |  |
| PGD-AT | 30.33 | 28.73 | 49.18 |
| +IGDM | 45.21 | 42.68 | 53.54 |
| TRADES | 30.82 | 31.71 | 48.06 |
| +IGDM | 48.75 | 41.88 | 50.19 |
| ARD | 43.11 | 39.51 | 53.57 |
| +IGDM | 48.77 | 43.77 | 54.20 |
| IAD | 39.62 | 39.37 | 52.89 |
| +IGDM | 45.86 | 43.57 | 54.58 |
| RSLAD | 41.41 | 41.05 | 53.24 |
| +IGDM | 44.50 | 43.76 | 53.78 |
| AdaAD | 44.80 | 42.45 | 54.73 |
| +IGDM | 45.18 | 43.76 | 54.98 |

#### Robustness against unseen and black-box attacks

To demonstrate that we effectively distill the robustness of a teacher model, we also measured performance against the different attack scenarios in [Table 6](#S4.T6).
First, we assessed the performance against PGD-L1 and PGD-L2 unseen attacks in a white-box setting.
We set L1 boundary and L2 boundary as $12$ and $128/255$, respectively.
Experimental results show that adding our module increases performance for both L1 and L2 unseen attacks.
Subsequently, we evaluated performance against transfer-based black-box attacks.
We employed the VMI-FGSM attack method [] and utilized the ResNet50 model as a surrogate model.
We employed an $\epsilon$ boundary of $16/255$, a commonly utilized value in transfer attacks [, , ].
The performance was the best when our module was added to AdaAd as shown in [Table 6](#S4.T6).
Overall, our module improves the performance of existing adversarial distillation methods against various attacks.

#### Robustness against larger boundary attack

In the context of adversarial attacks, an increase of perturbation boundary $\epsilon$ corresponds to a stronger attack, leading to lower model robustness against such attacks. However, adversarially well-trained models demonstrate enhanced robustness against attacks with larger perturbation boundaries.
To evaluate this, we conducted experiments by training models with the conventional $\epsilon$ of $8/255$ and testing them with larger perturbation sizes in both PGD and AutoAttack, as illustrated in [Fig. 5](#S4.F5).
Remarkably, when employing IGDM, we observed increased robustness compared to other AD methods.
This suggests that IGDM has acquired more resilient features against stronger attacks.

Figure: Figure 5: PGD and AutoAttack robust accuracy against stronger attack with larger $\epsilon$ boundary. $\text{IGDM}_{\text{ARD}}$ is implemented for our method.
Refer to caption: x3.png

## 5 Conclusion

We have proposed a novel method Indirect Gradient Distillation Module (IGDM) for adversarial distillation.
In contrast to conventional adversarial distillation methods that primarily focus on distilling the logits of the teacher model, we concentrate on distilling the gradient information of the teacher model.
Notably, we obtain these gradients indirectly by leveraging the locally linear property, a characteristic of adversarially trained models.
Furthermore, IGDM can be seamlessly applied to existing adversarial distillation methods.
Extensive experimental results demonstrate that the student model with IGDM successfully follows the gradients of the teacher model, resulting in significantly enhanced robustness.

## Peer Reviews

confidence: 3
contribution: 3
initial_rating: 8
presentation: 3
questions: See Weaknesses
soundness: 3
strengths: 1. Aligning the input gradients of the teacher and student is an insightful and interesting approach.

2. IGDM is a simple and effective method that can be easily applied as a regularization term to other AD methods, achieving consistent performance improvements.

3. Comprehensive experimental results and ablation studies demonstrate the effectiveness of IGDM.

4. The paper is well-written and easy to follow.
summary: This paper aims to improve the adversarial robustness of lightweight or small models using adversarial distillation. Unlike directly using the teacher's logits as a guide, the authors focus on distilling the input gradients of the teacher model to achieve point-wise alignment between the teacher and student. The proposed IGDM can integrate with other AD methods and has demonstrated consistent performance improvements across different datasets.
weaknesses: Overall, this paper is logically coherent and well-argued. The effectiveness of IGDM is based on the assumption of the locally linear property of adversarial robust models, and preliminary experiments in Section 3.1 support this assumption. However, the data and models used in the experiments are relatively simple. Validating the effectiveness of IGDM on more general models, such as ViT or CLIP, and on more complex tasks, such as detection and segmentation, could provide more universal insights for future research.

---

confidence: 4
contribution: 3
initial_rating: 5
presentation: 3
questions: 1. I am confused about Figure 1(a) in the paper. In the distillation architecture, the teacher model is already trained, while the student model is not. In the feature space, the manifolds of the models are different. Even if the directions of the gradients are the same, the manifold spaces are inconsistent, and the paths they take should also be different. Therefore, the adversarial samples of the teacher model and the student model cannot be consistent. One way to prove this is to use the adversarial samples generated by the teacher model and the student model to attack another model to see if the attack effects are consistent.

2  In Figure 2, in adversarial training and adversarial distillation, why is it that in the early stages of training, when the student model should not be robust yet, why does the remainder proportion of the model not increase?
soundness: 3
strengths: 1. The authors propose a novel distillation module called the Indirect Gradient Distillation Module (IGDM) and provide a theoretical foundation for why gradient matching through output differences works, leveraging the local linearity of adversarially trained models. But, I have some doubts about the theoretical assumptions here. The fragility of neural networks is attributed to the linear properties of neural networks[1], and the paper assumes this local linear property to solve the gradient, which is contrary to the conclusions of previous related research. So, does this method really simulate the gradient of the network?

2. Extensive experiments across different datasets, student models, and teacher models validate the effectiveness of IGDM in improving robustness against various attack scenarios.

[1] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. ICLR, 2015.
summary: The paper focuses on improving the adversarial robustness of DNNs through adversarial distillation. Specifically, it addresses the challenge that smaller models, which are preferred for their computational efficiency, lag behind larger models in terms of robustness against adversarial attacks. The authors propose the Indirect Gradient Distillation Module (IGDM), which aims to transfer the input gradient knowledge from a robust teacher model to a student model, indirectly matching the student’s input gradient with the teacher's.  The experimental results demonstrate the effectiveness of the proposed approach in significantly improving adversarial robustness.



Based on the detailed response by the authors, I decided to improve my rating!
weaknesses: 1.  Although the paper did a lot of experiments, I think it is not fair enough. For example, the teacher model used in the paper is usually better than the teacher models of other methods. So if other methods also use the same teacher model, can they also achieve good robustness?

2. Line 160 of the paper mentions that using gradients directly is difficult, which is important for the motivation of the paper, so it needs to be reflected in the main context rather than being placed in the Appendix.

---

confidence: 5
contribution: 3
initial_rating: 5
presentation: 3
questions: Please check the details in weaknesses.
soundness: 3
strengths: 1. The author obtains the gradients indirectly by taking advantage of the local linear characteristics of the adversarially trained model, thereby significantly enhancing robustness.
2. The modular design of IGDM enables it to be easily integrated with existing adversarial distillation methods.
3. Through a large number of experimental results, the author has verified that IGDM can successfully enhance the robustness of the existing adversarial distillation methods.
summary: This paper proposes a new method named Indirect Gradient Distillation Module (IGDM) for adversarial distillation. Different from the traditional adversarial distillation methods that mainly focus on distilling the logits of the teacher model, this method emphasizes distilling the gradient information of the teacher model. By taking advantage of the local linear characteristics of the adversarially trained model, these gradients are obtained indirectly, thereby significantly enhancing robustness.
weaknesses: The loss function of the Indirect Gradient Distillation Module (IGDM) proposed in this paper is derived from the first-order Taylor function expansion, which is similar to the situation of making the training loss become low-curvature [in d - f]. In fact, the research works in [e, f] also used similar techniques, but they mainly studied the problems in traditional adversarial training. If the teacher network in this paper is changed to only input natural images, the proposed loss in the paper may degenerate into an evolutionary target of the aforementioned works. Therefore, the author needs to conduct a comparative analysis between their method and the existing works that are also based on the first-order Taylor function expansion, and analyze the differences. Moreover, what will be the result if the regularization loss of the existing works is added to the adversarial distillation target?

The authors utilize the internal loss to generate adversarial perturbations. It would be better to elaborate on its formulaic representation in the main paper. Is the cross-entropy used directly? How much impact do different internal losses have on the results? What would be the effect if the adversarial perturbations are generated using Equation 9?

Some of more recent works, that are about the adversarial distillation, are missing, such as [a-c]. 

a. Adversarially Robust Distillation by Reducing the Student-Teacher Variance Gap. ECCV 2024

b. PeerAiD: Improving Adversarial Distillation from a Specialized Peer Tutor. CVPR 2024

c. Improving Adversarial Robustness via Information Bottleneck Distillation. NeurIPS 2023

d. Efficient Training of Low-Curvature Neural Networks. NeurIPS 2022.

e. Adversarial Robustness through Local Linearization. NeurIPS 2019.

f. Relating Adversarially Robust Generalization to Flat Minima. ICCV 2021.

---

confidence: 4
contribution: 3
initial_rating: 5
presentation: 3
questions: Figure 2a says that the "remainder proportion" of the adversarial robust teachers is shown in Table 1. However, One would wonder, comparing Figure 2a and Table 1, how to make sense of these two different metrics. Figure 2a y-axis is "proportion," Table 1 has clean accuracy and attacked accuracy values. How can one calculate "proportion" from Table 1 to make sense of Figure 2a?

It has not been demonstrated how preparation values 0.012 and 0.016 have arrived. It is not clear if the proposition nose value is the accuracy value. From the equation, it appeared to be a noise term, but making reference to Table 1 makes one feel it is an accuracy term.

Figure 2b also under explains as to how one can relate Equation 2 and Figure 2b. 

The paper claims to do an "input gradient" matching Figure 1 and Line 151. However, the gradient matching is done via the discrepancy between student and teacher models model outputs. It is unclear how this method differs from other methods that do gradient distillation.
soundness: 3
strengths: The main strength of the paper is the extensive set of experiments on Indirect Gradient Distillation Modules (IGDM) for adversarial training via adversarial distillation methods. The IGDM is use used as an additive loss for adversarial knowledge distillation (Equation 9), which is claimed to be the first Indirect gradient matching compared to direct gradient matching.
summary: The paper presents an Indirect Gradient Distillation Module (IGDM) for adversarial training via adversarial distillation methods. 
It claims to match the input space gradient between teacher and student models with knowledge distillation. The main claim is "indirect" gradient matching/alignment compared to direct gradient alignment, which is available in the literature. Central to the paper is equation 2 (first-order Taylor expansion of adversarially trained models) and equation 8, which is the formulation of IGMD. The paper performs an exhaustive list of experiments. However, there is no indication of making code available for reproducibility is indicated in the paper.
weaknesses: The paper does not make it clear how this way gradient matching is "indirect." From Figure 1 and Figure 2 and the related explanation, it is not clear why this is "indirect" gradient distillation.  There is no comparative picture presented to clarify the comparison/contrast between  Indirect Gradient  and Direct Gradient distillation. 

Except for Table 7, It is not explicitly mentioned or clear that they run the other (SOTA) algorithms themselves or that the results were taken from the reported results. If experiments were re-run, other hyperparameter setting descriptions were not given or not referred to which hyperparameter setting were used, e.g., home many epoch os training.

There are some inconsistencies in making results bold for best results in some tables and not in some tables.

Meta-review: This paper investigates adversarial distillation, focusing on small student models. Compared to vanilla distillation strategies, a key enhancement here is to indirectly match the input gradients between a robust teacher model and a student model. The empirical results demonstrate consistent improvements over baseline methods.

Overall, the reviewers found the paper well-written and easy to follow, and they appreciated its novelty and effectiveness. But meanwhile, several major concerns are raised, including 1) the term "Indirect Gradient Matching" (especially regarding the word "indirect") is somewhat unclear and confusing; 2) missing discussions about prior related works that enforce low curvature; and 3) some experimental setups, as well as tables and figures, require further explanation and clarification.

During the rebuttal and the discussion stage, the authors actively provided additional experiments and clarifications to address these concerns. As a result, three reviewers positively rate the quality of this paper. Reviewer Pxd3 remained slightly negative about this submission, but the AC found no concerning points remaining from their feedback. Therefore, the final decision is acceptance.

The authors must integrate the additional experiments, clarifications, and discussions from the rebuttal into the camera-ready version and correct any typos or mistakes pointed out by the reviewers.

Decision: Accept (Poster)