Drop-Bottleneck: LEARNING DISCRETE COMPRESSED REPRESENTATION FOR NOISE-ROBUST EXPLORATION
Year: 2021

Abstract:
We propose a novel information bottleneck (IB) method named Drop-Bottleneck, which discretely drops features that are irrelevant to the target variable. DropBottleneck not only enjoys a simple and tractable compression objective but also additionally provides a deterministic compressed representation of the input variable, which is useful for inference tasks that require consistent representation. Moreover, it can jointly learn a feature extractor and select features considering each feature dimension’s relevance to the target task, which is unattainable by most neural network-based IB methods. We propose an exploration method based on Drop-Bottleneck for reinforcement learning tasks. In a multitude of noisy and reward sparse maze navigation tasks in VizDoom (Kempka et al., 2016) and DMLab (Beattie et al., 2016), our exploration method achieves state-of-the-art performance. As a new IB framework, we demonstrate that Drop-Bottleneck outperforms Variational Information Bottleneck (VIB) (Alemi et al., 2017) in multiple aspects including adversarial robustness and dimensionality reduction.

heading: 1 INTRODUCTION
text: Data with noise or task-irrelevant information easily harm the training of a model; for instance, the noisy-TV problem (Burda et al., 2019a) is one of well-known such phenomena in reinforcement learning. If observations from the environment are modified to contain a TV screen, which changes its channel randomly based on the agent’s actions, the performance of curiosity-based exploration methods dramatically degrades (Burda et al., 2019a;b; Kim et al., 2019; Savinov et al., 2019).
The information bottleneck (IB) theory (Tishby et al., 2000; Tishby & Zaslavsky, 2015) provides a framework for dealing with such task-irrelevant information, and has been actively adopted to exploration in reinforcement learning (Kim et al., 2019; Igl et al., 2019). For an input variable X and a target variable Y , the IB theory introduces another variable Z, which is a compressed representation of X . The IB objective trains Z to contain less information about X but more information about Y as possible, where the two are quantified by mutual information terms of I(Z;X) and I(Z;Y ), respectively. IB methods such as Variational Information Bottleneck (VIB) (Alemi et al., 2017; Chalk et al., 2016) and Information Dropout (Achille & Soatto, 2018) show that the compression of the input variable X can be done by neural networks.
In this work, we propose a novel information bottleneck method named Drop-Bottleneck that compresses the input variable by discretely dropping a subset of its input features that are irrelevant to the target variable. Drop-Bottleneck provides some nice properties as follows:
• The compression term of Drop-Bottleneck’s objective is simple and is optimized as a tractable solution.
• Drop-Bottleneck provides a deterministic compressed representation that still maintains majority of the learned indistinguishability i.e. compression. It is useful for inference tasks that require the input representation to be consistent and stable.
• Drop-Bottleneck jointly trains a feature extractor and performs feature selection, as it learns the feature-wise drop probability taking into account each feature dimension’s relevance to the target task. Hence, unlike the compression provided by most neural network-based IB
methods, our deterministic representation reduces the feature dimensionality, which makes the following inference better efficient with less amount of data.
• Compared to VIB, both of Drop-Bottleneck’s original (stochastic) and deterministic compressed representations can greatly improve the robustness to adversarial examples.
Based on the newly proposed Drop-Bottleneck, we design an exploration method that is robust against noisy observations in very sparse reward environments for reinforcement learning. Our exploration maintains an episodic memory and generates intrinsic rewards based on the predictability of new observations from the compressed representations of the ones in the memory. As a result, our method achieves state-of-the-art performance on multiple environments of VizDoom (Kempka et al., 2016) and DMLab (Beattie et al., 2016). We also show that combining our exploration method with VIB instead of Drop-Bottleneck degrades the performance by meaningful margins.
Additionally, we empirically compare with VIB to show Drop-Bottleneck’s superior robustness to adversarial examples and ability to reduce feature dimensionality for inference with ImageNet dataset (Russakovsky et al., 2015). We also demonstrate that Drop-Bottleneck’s deterministic representation can be a reasonable replacement for its original representation in terms of the learned indistinguishability, with Occluded CIFAR dataset (Achille & Soatto, 2018).

heading: 2 RELATED WORK

heading: 2.1 INFORMATION BOTTLENECK METHODS
text: There have been a number of IB methods that are approximations or special forms of the original IB objective. Variational Information Bottleneck (VIB) (Alemi et al., 2017) approximates the original IB objective by establishing variational bounds on the compression and prediction terms. Chalk et al. (2016) propose the same variational bound on the IB objective in the context of sparse coding tasks. Conditional Entropy Bottleneck (CEB) and Variational Conditional Entropy Bottleneck (VCEB) (Fischer, 2020; Fischer & Alemi, 2020) use an alternative form of the original IB objective derived under the Minimum Necessary Information (MNI) criterion to preserve only a necessary amount of information. The IB theory (Tishby et al., 2000) has been used for various problems that require restriction of information or dealing with task-irrelevant information. Information Dropout (Achille & Soatto, 2018) relates the IB principle to multiple practices in deep learning, including Dropout, disentanglement and variational autoencoding. Moyer et al. (2018) obtain representations invariant to specific factors under the variational autoencoder (VAE) (Kingma & Welling, 2013) and VIB frameworks. Amjad & Geiger (2019) discuss the use of IB theory for classification tasks from a theoretical point of view. Dai et al. (2018) employ IB theory for compressing neural networks by pruning neurons in networks. Schulz et al. (2020) propose an attribution method that determines each input feature’s importance by enforcing compression of the input variable via the IB framework.
Similar to our goal, some previous research has proposed variants of the original IB objective. Deterministic information bottleneck (DIB) (Strouse & Schwab, 2017) replaces the compression term with an entropy term and solves the new objective using a deterministic encoder. Nonlinear information bottleneck (NIB) (Kolchinsky et al., 2019) modifies the IB objective by squaring the compression term and uses a non-parametric upper bound on the compression term. While DIB is always in the deterministic form, we can flexibly choose the stochastic one for training and the deterministic one for test. Compared to NIB, which is more computationally demanding than VIB due to its non-parametric upper bound, our method is faster.

heading: 2.2 REINFORCEMENT LEARNING WITH INFORMATION BOTTLENECK METHODS
text: The IB theory has been applied to several reinforcement learning (RL) tasks. Variational discriminator bottleneck (Peng et al., 2019) regulates the discriminator’s accuracy using the IB objective to improve adversarial training, and use it for imitation learning. Information Bottleneck Actor Critic (Igl et al., 2019) employs VIB to make the features generalize better and encourage the compression of states as input to the actor-critic algorithm. Curiosity-Bottleneck (Kim et al., 2019) employs the VIB framework to train a compressor that compresses the representation of states, which is still informative about the value function, and uses the compressiveness as exploration signals. InfoBot (Goyal et al., 2019) proposes a conditional version of VIB to improve the transferability of a goal-conditioned policy by minimizing the policy’s dependence on the goal. Variational bandwidth
bottleneck (Goyal et al., 2020) uses a modified, conditional version of VIB, and solves RL tasks with privileged inputs (i.e. valuable information that comes with a cost). Our exploration method differs from these methods in two aspects. First, we propose a new information bottleneck method that is not limited to exploration in RL but generally applicable to the problems for which the IB theory is used. Second, our method generates exploration signals based on the noise-robust predictability i.e. the predictability between noise-robust representations of observations.

heading: 3 DROP-BOTTLENECK

heading: 3.1 PRELIMINARIES OF INFORMATION BOTTLENECK
text: Given an input random variable X , the information bottleneck (IB) framework (Tishby et al., 2000; Tishby & Zaslavsky, 2015) formalizes a problem of obtaining X’s compressed representation Z, which still and only preserves information relevant to the target variable Y . Its objective function is
minimize−I(Z;Y ) + βI(Z;X), (1) where β is a Lagrangian multiplier. The first and second terms are prediction and compression terms, respectively. The prediction term I(Z;Y ) encourages Z to preserve task-relevant information while the compression term I(Z;X) compresses the input information as much as possible.
As reviewed in the previous section, there have been several IB methods (Alemi et al., 2017; Chalk et al., 2016; Achille & Soatto, 2018; Strouse & Schwab, 2017; Kolchinsky et al., 2019), among which the ones derived using variational inference such as Variational Information Bottleneck (VIB) (Alemi et al., 2017) have become dominant due to its applicability to general problems.

heading: 3.2 DROP-BOTTLENECK
text: We propose a novel information bottleneck method called Drop-Bottleneck (DB), where the input information is compressed by discretely dropping a subset of input features. Thus, its compression objective is simple and easy to optimize. Moreover, its representation is easily convertible to a deterministic version for inference tasks (Section 3.3), and it allows joint training with a feature extractor (Section 3.4). While discrete dropping of features has been explored by prior works including Dropout (Srivastava et al., 2014), DB differs in that its goal is to assign different drop probabilities to feature variables based on their relevance to the target variable.
For an input variableX = [X1, . . . , Xd] and a drop probability p = [p1, . . . , pd] ∈ [0, 1]d, we define its compressed representation as Z = Cp(X) = [c(X1, p1), . . . , c(Xd, pd)] such that
c(Xi, pi) = b · Bernoulli(1− pi) ·Xi, where b = d d−∑k pk , (2) for i = 1, . . . , d. That is, the compression procedure drops the i-th input feature (i.e. replaced by zero) with probability pi. Since the drop probability is to be learned, we use a scaling factor b to keep the scale of Z constant. We use a single scaling factor for all feature dimensions in order to preserve the relative scales between the features.
With the definition in Equation (2), we derive the compression term of DB to minimize as
I(Z;X) = d∑ i=1 I(Zi;X1, . . . , Xd|Z1, . . . , Zi−1) (3)
= d∑ i=1 [I(Zi;Xi|Z1, . . . , Zi−1) + I(Zi;X1, . . . , Xd \Xi|Z1, . . . , Zi−1, Xi)] (4)
= d∑ i=1 I(Zi;Xi|Z1, . . . , Zi−1) ≤ d∑ i=1 I(Zi;Xi) = Î(Z;X) (5)
using that Zi⊥X1, . . . , Xi−1, Xi+1, . . . , Xd|Z1, . . . , Zi−1, Xi and Zi⊥Z1, . . . , Zi−1|Xi. Note that Î(Z;X) − I(Z;X) = (∑d i=1H(Zi) ) − H(Z1, . . . , Zd) = TC(Z) where TC(Z) is the
total correlation of Z and H(·) denotes the entropy, and Î(Z;X) = I(Z;X) if X1, . . . , Xd are independent. To provide a rough view on the gap, due to the joint optimization with the compression
term Î(Z;X) and the prediction term I(Z;Y ), Z becomes likely to preserve less redundant and less correlated features, and TC(Z) could decrease as the optimization progresses.
Finally, DB’s new compression term, Î(Z;X), is computed as
Î(Z;X) = d∑ i=1 I(Zi;Xi) = d∑ i=1 ( H(Xi)−H(Xi|Zi) ) (6)
= d∑ i=1 ( H(Xi)− pi ·H(Xi|Zi = 0)− (1− pi) ·H(Xi|Zi = bXi) ) (7)
≈ d∑ i=1 ( H(Xi)− pi ·H(Xi)− (1− pi) · 0 ) = d∑ i=1 H(Xi)(1− pi). (8)
From Equation (7) to Equation (8), we use the two ideas: (i) H(Xi|Zi = 0) = H(Xi) because Zi = 0 means it contains no information about Xi, and (ii) H(Xi|Zi = bXi) = 0 because Zi = bXi means Zi preserves the feature (i.e. Zi fully identifies Xi) and thus their conditional entropy becomes zero. Importantly, DB’s compression term is computed as the simple tractable expression in Equation (8). As the goal of the compression term is to penalize I(Z;X) not H(X), the drop probability p is the only parameter optimized with our compression term. Thus, each H(Xi) can be computed with any entropy estimation method such as the binning-based estimation, which involves quantization for continuous Xi, since the computation has no need to be differentiable.
However, one issue of Equation (8) is that Z is not differentiable with respect to p as Bernoulli distributions are not differentiable. We thus use the Concrete relaxation (Maddison et al., 2017; Jang et al., 2016) of the Bernoulli distribution to update p via gradients from Z:
Bernoulli(p) ≈ σ ( 1
λ (log p− log(1− p) + log u− log(1− u))
) , (9)
where u ∼ Uniform(0, 1) and λ is a temperature for the Concrete distribution. Intuitively, p is trained to assign a high drop probability to the feature that is irrelevant to or redundant for predicting the target variable Y .

heading: 3.3 DETERMINISTIC COMPRESSED REPRESENTATION
text: With Drop-Bottleneck, one can simply obtain the deterministic version of the compressed representation as Z̄ = C̄p(X) = [c̄(X1, p1), . . . , c̄(Xd, pd)] for
c̄(Xi, pi) = b̄ · 1(pi < 0.5) ·Xi, where b̄ = d∑
k 1(pk < 0.5) . (10)
b̄ is defined similarly to b with a minor exception that the scaling is done based on the actual, deterministic number of the dropped features. The deterministic compressed representation Z̄ is useful for inference tasks that require stability or consistency of the representation as well as reducing the feature dimensionality for inference, as we demonstrate in Section 5.4.

heading: 3.4 TRAINING WITH DROP-BOTTLENECK
text: We present how Drop-Bottleneck (DB) is trained with the full IB objective allowing joint training with a feature extractor. Since DB proposes only a new compression term, any existing method for maximizing the prediction term I(Z;Y ) can be adopted. We below discuss an example with Deep Infomax (Hjelm et al., 2019) since our exploration method uses this framework (Section 4). Deep Infomax, instead of I(Z;Y ), maximizes its Jensen-Shannon mutual information estimator
IJSDψ (Z;Y ) = 1
2
( EPZY [−ζ(−Tψ(Z, Y ))]− EPZ⊗PY [ζ(Tψ(Z, Ỹ ))] + log 4 ) , (11)
where Tψ is a discriminator network with parameter ψ and ζ(·) is the softplus function. Finally, the IB objective with Drop-Bottleneck becomes
minimize−IJSDψ (Z;Y ) + β d∑ i=1 H(Xi)(1− pi), (12)
which can be optimized via gradient descent. To make p more freely trainable, we suggest simple element-wise parameterization of p as pi = σ(p′i) and initializing p ′ i ∼ Uniform(a, b). We obtain the input variable X from a feature extractor, whose parameters are trained via the prediction term, jointly with p and ψ. In next section, we will discuss its application to hard exploration problems for reinforcement learning.

heading: 4 ROBUST EXPLORATION WITH DROP-BOTTLENECK
text: Based on DB, we propose an exploration method that is robust against highly noisy observations in a very sparse reward environment for reinforcement learning tasks. We first define a parametric feature extractor fφ that maps a state to X . For transitions (S,A, S′) where S,A, and S′ are current states, actions and next states, respectively, we use the DB objective with
X = fφ(S ′), Z = Cp(X), Y = Cp(fφ(S)). (13)
For every transition (S,A, S′), the compression term I(Z;X) = I(Cp(fφ(S′)); fφ(S′)) encourages Cp to drop unnecessary features of the next state embedding fφ(S′) as possible. The prediction term I(Z;Y ) = I(Cp(fφ(S′));Cp(fφ(S))) makes the compressed representations of the current and next state embeddings, Cp(fφ(S)) and Cp(fφ(S′)), informative about each other.
Applying Equation (13) to Equation (12), the Drop-Bottleneck objective for exploration becomes
minimize−IJSDψ (Cp(fφ(S′));Cp(fφ(S))) + β d∑ i=1 H((fφ(S ′))i)(1− pi). (14)
While fφ, p, and Tψ are being trained online, we use them for the agent’s exploration with the help of episodic memory inspired by Savinov et al. (2019). Starting from an empty episodic memory M , we add the learned feature of the observation at each step. For example, at time step t, the episodic memory is M = {C̄p(fφ(s1)), C̄p(fφ(s2)), . . . , C̄p(fφ(st−1))} where s1, . . . , st−1 are the earlier observations from that episode. We then quantify the degree of novelty of a new observation as an intrinsic reward. Specifically, the intrinsic reward for st is computed utilizing the Deep Infomax discriminator Tψ , which is trained to output a large value for joint (or likely) input and a small value for marginal (or arbitrary) input:
riM,t(st) = 1 t− 1 t−1∑ j=1 [g(st, sj) + g(sj , st)] , s.t. g(x, y) = ζ(−Tψ(C̄p(fφ(x)), C̄p(fφ(y))), (15)
where g(st, sj) and g(sj , st) denote the unlikeliness of st being the next and the previous state of sj , respectively. Thus, intuitively, for st that is close to a region covered by the earlier observations in the state space, riM,t(st) becomes low, and vice versa. It results in a solid exploration method capable of handling noisy environments with very sparse rewards. For computing the intrinsic reward, we use the DB’s deterministic compressed representation of states to provide stable exploration signals to the policy optimization.

heading: 5 EXPERIMENTS
text: We carry out three types of experiments to evaluate Drop-Bottleneck (DB) in multiple aspects. First, we apply DB exploration to multiple VizDoom (Kempka et al., 2016) and DMLab (Beattie et al., 2016) environments with three hard noise settings, where we compare with state-of-the-art methods as well as its VIB variant. Second, we empirically show that DB is superior to VIB for adversarial robustness and feature dimensionality reduction in ImageNet classification (Russakovsky et al., 2015), and we juxtapose DB with VCEB, which employs a different form of the IB object, for the same adversarial robustness test, in Appendix A. Finally, in Appendix B, we make another comparison with VIB in terms of removal of task-irrelevant information and the validity of the deterministic compressed representation, where Appendix C provides the visualization of the task-irrelevant information removal on the same task.

heading: 5.1 EXPERIMENTAL SETUP FOR EXPLORATION TASKS
text: For the exploration tasks on VizDoom (Kempka et al., 2016) and DMLab (Beattie et al., 2016), we use the proximal policy optimization (PPO) algorithm (Schulman et al., 2017) as the base RL
method. We employ ICM from Pathak et al. (2017), and EC and ECO from Savinov et al. (2019) as baseline exploration methods. ICM learns a dynamics model of the environment and uses the prediction errors as exploration signals for the agent. EC and ECO are curiosity methods that use episodic memory to produce novelty bonuses according to the reachability of new observations, and show the state-of-the-art exploration performance on VizDoom and DMLab navigation tasks. In summary, we compare with four baseline methods: PPO, PPO + ICM, PPO + EC, and PPO + ECO. Additionally, we report the performance of our method combined with VIB instead of DB.
We conduct experiments with three versions of noisy-TV settings named “Image Action”, “Noise” and “Noise Action”, as proposed in Savinov et al. (2019). We present more details of noise and their observation examples in Appendix E.1. Following Savinov et al. (2019), we resize observations as 160×120 only for the episodic curiosity module while as 84×84 for the PPO policy and exploration methods. We use the official source code1 of Savinov et al. (2019) to implement and configure the baselines (ICM, EC and ECO) and the three noise settings.
For the feature extractor fφ, we use the same CNN with the policy network of PPO from Mnih et al. (2015). The only modification is to use d = 128 i.e. 128-dimensional features instead of 512 to make features lightweight enough to be stored in the episodic memory. The Deep Infomax discriminator Tψ consists of three FC hidden layers with 64, 32, 16 units each, followed by a final FC layer for prediction. We initialize the drop probability p with pi = σ(p′i) and p ′ i ∼ Uniform(a, b) where a = −2, b = 1. We collect samples and update p, Tψ, fφ with Equation (14) every 10.8K and 21.6K time steps in VizDoom and DMLab, respectively, with a batch size of 512. We duplicate the compressed representation 50 times with differently sampled drop masks, which help better training of the feature extractor, the drop probability and the discriminator by forming diverse subsets of features. Please refer to Appendix E for more details of our experimental setup.

heading: 5.2 EXPLORATION IN NOISY STATIC MAZE ENVIRONMENTS
text: VizDoom (Kempka et al., 2016) provides a static 3D maze environment. We experiment on the MyWayHome task with nine different settings by combining three reward conditions (“Dense”, “Sparse” and “Very Sparse”) in Pathak et al. (2017) and three noise settings in the previous section. In the “Dense”, “Sparse” and “Very Sparse” cases, the agent is randomly spawned in a near, medium and very distant room, respectively. Thus, “Dense” is a relatively easy task for the agent to reach the goal even with a short random walk, while “Sparse” and “Very Sparse” require the agent to perform a series of directed actions, which make the goal-oriented navigation difficult.
Table 1 and Figure 1 compare the DB exploration with three baselines, PPO, PPO + ICM, and PPO + ECO on the VizDoom tasks, in terms of the final performance and how quickly they learn. The results suggest that even in the static maze environments, the three noise settings can degrade the performance of the exploration by large margins. On the other hand, our method with DB shows robustness to such noise or task-irrelevant information, and outperforms the baselines in all the nine challenging tasks, whereas our method combined with VIB does not exhibit competitive results.

heading: 5.3 EXPLORATION IN NOISY AND RANDOMLY GENERATED MAZE ENVIRONMENTS
text: As a more challenging exploration task, we employ DMLab (Savinov et al., 2019), which are general and randomly generated maze environments where at the beginning of every episode, each maze is procedurally generated with its random goal location. Thanks to the random map generator, each method is evaluated on test mazes that are independent of training mazes. As done in Savinov et al. (2019), we test with six settings according to two reward conditions (“Sparse” and “Very Sparse”) and the three noise settings. In the “Sparse” scenario, the agent is (re-)spawned at a random location when each episode begins or every time it reaches the goal i.e. the sparse reward; the agent should reach the goal as many times as possible within the fixed episode length. The “Very Sparse” is its harder version: the agent does not get (re-)spawned near or in the same room with the goal.
Table 1 compares between different exploration methods on the DMLab tasks. The results demonstrate that our DB exploration method achieves state-of-the-art performance with significant margins from the baselines on all the 6 tasks, and performs better than our method equipped with VIB as well. The plots too suggest that our method provides stable exploration signals to the agent under different environmental and noise settings. As mentioned in Section 5.1, our method can achieve better per-
1https://github.com/google-research/episodic-curiosity.
formance even using much lower resolution observations of 84×84 than 160×120 of EC and ECO. Also, excluding the policy network, our method maintains 0.5M parameters, which is significantly smaller compared to ECO with 13M parameters. Please refer to Appendix D for an ablation study,
Figure 2 shows evolution examples of the drop probability distribution over training time steps. It overviews the role of drop probability p in DB. As the joint training of the feature extractor fφ with p progresses, p gets separated into high- and low-value groups, where the former drops task-irrelevant or redundant features and the latter preserves task-relevant features. This suggests that in the DMLab environments, the DB objective of Equation (14) successfully encourages dropping the features unrelated to transition between observations and also the deterministic compressed representation becomes stable as the training progresses.

heading: 5.4 COMPARISON WITH VIB: ADVERSARIAL ROBUSTNESS & DIMENSION REDUCTION
text: We experiment with image classification on ImageNet (Russakovsky et al., 2015) to compare DropBottleneck (DB) with Variational Information Bottleneck (VIB) (Alemi et al., 2017), the most widely-used IB framework, regarding the robustness to adversarial attacks and the reduction of feature dimensionality. We follow the experimental setup from Alemi et al. (2017) with some exceptions. We use β1 = 0.9 and no learning rate decay for DB’s Adam optimizer (Kingma & Ba, 2015). For prediction, we use one Monte Carlo sample of each stochastic representation. Additionally, we provide a similar comparison with the mutual information-based feature selection method.
Robustness to adversarial attacks. Following Alemi et al. (2017), we employ the targeted `2 and `∞ adversarial attacks from Carlini & Wagner (2017). For each method, we determine the first 200 validation images on ImageNet that are classified correctly, and apply the attacks to them by selecting uniformly random attack target classes. Please refer to Appendix E.2 for further details.
Table 2 shows the results. For the targeted `2 attacks, choosing the value of β from [0.003162, 0.1] provides the improved robustness of DB with the maximum at β = 0.01. On the other hand, VIB has no improved robustness in all ranges of β. For the targeted `∞ attacks, DB can reduce the attack success rate even near to 0% (e.g. β = 0.003162 or 0.01). Although VIB decreases the attack success rate to 15.5% at β = 0.1, VIB already suffers from the performance degradation at β = 0.1 compared to DB (Figure 3), and increasing β accelerates VIB’s degradation even further. Note that the validation accuracies of both VIB and DB are close to zero at β = 0.3162.
Dimensionality reduction. Figure 3 compares the accuracy of DB and VIB by varying β on the ImageNet validation set. Overall, their accuracies develop similarly with respect to β; while VIB is slightly better in the lower range of β, DB produces better accuracy in the higher range of β. Note that DB (determ.) shows the almost identical accuracy plot with DB. Importantly, DB (determ.) still achieves a reasonable validation accuracy (≥ 75%) using only a few feature dimensions (e.g. 8) out of the original 1024 dimensions. This suggests that DB’s deterministic compressed representation can greatly reduce the feature dimensionality for inference with only a small trade-off with the performance. It is useful for improving the efficiency of the model after the training is complete. On the other hand, VIB has no such capability. Finally, as Figure 3 shows, the trade-off between the dimensionality reduction and the performance can be controlled by the value of β.
Comparison with feature selection. As the deterministic representation of DB, DB (determ.), provides the dimensionality reduction, we also empirically compare DB with the univariate mutual information-based feature selection method for obtaining the feature space with a reduced dimensionality. In the experiments, the same features provided to DB and VIB are given as input to the feature selection method as well, and for a more straightforward comparison, we let the feature se-
lection method preserve the same number of features as DB (determ.). Refer to Appendix E.3 for further details of the feature selection procedure. Figure 4 shows the classification accuracy of the two methods for the same numbers of features. The results show that while the mutual informationbased feature selection method could provide a marginal performance benefit when a larger subset of the pre-trained features is preserved, DB is significantly better at retaining the accuracy with a small number of feature dimensions. For instance, DB achieves the accuracy over 71% even with 4 features, but the accuracy of feature selection method drops from ≈ 68% to ≈ 10% when the number of features is < 26. Also, we make a comparison of the adversarial robustness; Table 3 suggests that the features preserved with the feature selection method show almost no robustness to the targeted `2 and `∞ attacks, where every attack success rate is ≥ 97%. On the other hand, DB (determ.) can reduce the success rate to 20% for the `2 and to 2% for the `∞ attacks with 8 features.

heading: 6 CONCLUSION
text: We presented Drop-Bottleneck as a novel information bottleneck method where compression is done by discretely dropping input features, taking into account each input feature’s relevance to the target variable and allowing its joint training with a feature extractor. We then proposed an exploration method based on Drop-Bottleneck, and it showed state-of-the-art performance on multiple noisy and reward-sparse navigation environments from VizDoom and DMLab. The results showed the robustness of Drop-Bottleneck’s compressed representation against noise or task-irrelevant information. With experiments on ImageNet, we also showed that Drop-Bottleneck achieves better adversarial robustness compared to VIB and can reduce the feature dimension for inference. In the exploration experiments, we directly fed the noisy observations to the policy, which can be one source of performance degradation in noisy environments. Therefore, applying Drop-Bottleneck to the policy network can improve its generalization further, which will be one interesting future research.

heading: ACKNOWLEDGMENTS
text: We thank Myeongjang Pyeon, Hyunwoo Kim, Byeongchang Kim and the anonymous reviewers for the helpful comments. This work was supported by Samsung Advanced Institute of Technology, Basic Science Research Program through the National Research Foundation of Korea (NRF) (2020R1A2B5B03095585) and Institute of Information & communications Technology Planning & Evaluation (IITP) grant funded by the Korea government (MSIT) (No.2019-0-01082, SW StarLab). Jaekyeom Kim was supported by Hyundai Motor Chung Mong-Koo Foundation. Gunhee Kim is the corresponding author.

heading: A COMPARISON WITH VCEB: ADVERSARIAL ROBUSTNESS
text: In this section, we compare Drop-Bottleneck (DB) with Variational Conditional Entropy Bottleneck (VCEB) (Fischer, 2020; Fischer & Alemi, 2020) on the same ImageNet (Russakovsky et al., 2015) tasks for the adversarial robustness as in Section 5.4. VCEB variationally approximates the CEB objective, which is defined as
minimize−I(Z;Y ) + γI(Z;X|Y ). (16) Note that Equation (16) is an alternative form of the original IB objective, Equation (1), as I(Z;X,Y ) = I(Z;Y ) + I(Z;X|Y ) = I(Z;X) + I(Z;Y |X) and I(Z;Y |X) = 0 (∵ Z⊥Y |X). As in Section 5.4, we employ the experimental setup from VIB (Alemi et al., 2017) with small modifications to the hyperparameters for the Adam optimizer (Kingma & Ba, 2015) that β1 = 0.9 and no learning rate decay is used. Additionally for VCEB, we apply the configurations suggested by Fischer & Alemi (2020): 1) at test time, use the mean of the Gaussian encoding instead of sampling from the distribution, and 2) reparameterize γ = exp(−ρ) and anneal the value of ρ from ρ = 100 to the final ρ during training. For our experiments, the annealing is performed via the first 100000 training steps, where each epoch consists of 6405 steps.
Employing the experimental setup from Alemi et al. (2017), we adopt the targeted `2 and `∞ adversarial attacks from Carlini & Wagner (2017). We determine the first 200 correctly classified validation images on ImageNet for each setting and perform the attacks where the attack target classes are chosen randomly and uniformly. Further details are described in Appendix E.2.
Figure 5 visualizes the classification accuracy for each corresponding final value of ρ, and the adversarial robustness results are shown in Table 4. Overall, both VCEB and DB provide meaningful robustness to the targeted `2 and `∞ attacks. For the targeted `2 attacks, although VCEB could achieve the higher average perturbation distance over successful attacks, DB and its deterministic form show better robustness compared to VCEB in terms of the attack success rates: 18.5% (DB at β = 0.01) and 20.0% (DB (determ.) at β = 0.01) versus 45.0% (VCEB at the final ρ = 3.454). For the targeted `∞ attacks, DB and its deterministic version again achieve the lower attack success rates than VCEB: 1.5% and 2.0% (DB and DB (determ.) at β ∈ {0.003162, 0.01})) versus 12.5% (VCEB at the final ρ = 3.454).

heading: B REMOVAL OF TASK-IRRELEVANT INFORMATION AND VALIDITY OF DETERMINISTIC COMPRESSED REPRESENTATION
text: We experiment Drop-Bottleneck (DB) and Variational Information Bottleneck (VIB) (Alemi et al., 2017) on occluded image classification tasks to show the following:
• DB can control the degree of compression (i.e. degree of removal of task-irrelevant information) in the same way with VIB as the popular IB method.
• DB’s deterministic compressed representation works as a reasonable replacement for its stochastic compressed representation and it maintains the learned indistinguishability better than the attempt of VIB’s deterministic compressed representation.
We employ the Occluded CIFAR dataset using the experimental settings from Achille & Soatto (2018). The Occluded CIFAR dataset is created by occluding CIFAR-10 (Krizhevsky, 2009) images with MNIST (LeCun et al., 2010) images as shown in Figure 6a, and each image has two labels of CIFAR and MNIST. We use a modified version of All-CNN-32 (Achille & Soatto, 2018) equipped with an IB method (either of DB or VIB) for the feature extractor whose output dimension is d. Each
run consists of two phases. In the first phase, we train the feature extractor with a logistic classifier using both the classification loss for CIFAR and the compression objective of the IB method. Fixing the trained feature extractor, we train a logistic classifier for MNIST in the second phase. We train two different versions of classifiers for each of VIB and DB using stochastic or deterministic compressed representation from the feature extractor. For the deterministic representation of VIB, we use the mode of the output Gaussian distribution.
Figures 6b–6d contain the experimental results with d = 32, d = 64, and d = 128. In the first phase, DB retains only a subset of features that concentrate more on the CIFAR part of the images. Thus, the trained feature extractor preserves less information about the MNIST parts, and the errors of the MNIST classification are high. The first observation is that for both DB and VIB with the original stochastic compressed representation, nuisance plots show that increasing β from the minimum value to ∼ 0.1/d barely changes the primary CIFAR errors but grows the nuisance MNIST errors up to ∼ 90% (i.e. the maximum error for the 10-way classification). With even larger β, enforcing stronger compression results in the increase of the primary errors too, as shown in primary plots. This suggests that both DB and VIB provide fine controllability over the removal of task-irrelevant information.
Secondly, if we move our focus to the nuisance (deterministic) plots in Figures 6b–6d, which show the test errors on the nuisance MNIST classification with the feature extractor’s deterministic representation, the results become different between DB and VIB. In DB, the nuisance (deterministic) plots follow the nuisance plots in the range of β where the compression takes effect (i.e. where the nuisance errors increase). Moreover, the two plots get closer as β increases. It means that Drop-Bottleneck’s deterministic compressed representations maintain the majority of the indistinguishability for the task-irrelevant information learned during the first phase, especially when β is large enough to enforce some degree of the compression. On the other hand, VIB’s nuisance (deterministic) plots are largely different from the nuisance plots; even the primary errors rise before the nuisance (deterministic) errors reach their maximum values. This shows that employing the mode of VIB’s output distribution as its deterministic representation results in loss of the learned indistinguishability.
In summary, we confirm that DB provides controllability over the degree of compression in a similar way as VIB. On the other hand, DB’s deterministic representation can be a reasonable replacement
Published as a conference paper at ICLR 2021
<latexit sha1_base64="nqNivqwghFLAMo4S/orI5/LIhf8=">AAACQXicbZA7T8MwFIWd8irhFWBksShITFHSh4CtEgtjkehDaqPKcZ3Wqp1EtoNURf1rLPwDNnYWBhBiZcFpM0DKkSwdffde3evjx4xK5TgvRmltfWNzq7xt7uzu7R9Yh0cdGSUCkzaOWCR6PpKE0ZC0FVWM9GJBEPcZ6frTm6zefSBC0ii8V7OYeByNQxpQjJRGQ6vnwMFExgiTtGY3OJ+bbhFUi6BWBPUiaJjm0Ko4trMQXDVubiogV2toPQ9GEU44CRVmSMq+68TKS5FQFDMyNweJJHrHFI1JX9sQcSK9dJHAHJ5rMoJBJPQLFVzQ3xMp4lLOuK87OVITWaxl8L9aP1HBlZfSME4UCfFyUZAwqCKYxQlHVBCs2EwbhAXVt0I8QQJhpUPPQnCLX141nart1u3ru3qleZbHUQYn4BRcABdcgia4BS3QBhg8glfwDj6MJ+PN+DS+lq0lI585Bn9kfP8A8iOsNg==</latexit>
<latexit sha1_base64="JGVCzDK7maudYi82rd6vr6iXoIU=">AAAB73icbVBNS8NAEJ3Ur1q/qh69LFbBU0mKoN4KXjxWsB/QhrLZTtqlm03c3Qgl9E948aCIV/+ON/+N2zYHbX0w8Hhvhpl5QSK4Nq777RTW1jc2t4rbpZ3dvf2D8uFRS8epYthksYhVJ6AaBZfYNNwI7CQKaRQIbAfj25nffkKleSwfzCRBP6JDyUPOqLFSh3KVCCqxX664VXcOskq8nFQgR6Nf/uoNYpZGKA0TVOuu5ybGz6gynAmclnqpxoSyMR1i11JJI9R+Nr93Ss6tMiBhrGxJQ+bq74mMRlpPosB2RtSM9LI3E//zuqkJr/2MyyQ1KNliUZgKYmIye54MuEJmxMQSyhS3txI2oooyYyMq2RC85ZdXSatW9S6rN/e1Sv0sj6MIJ3AKF+DBFdThDhrQBAYCnuEV3pxH58V5dz4WrQUnnzmGP3A+fwA4DpAC</latexit>
<latexit sha1_base64="sAqeXSM/H0okFPUcwvbQNQ5k6zQ=">AAAB8XicbVDLSgNBEJyNrxhfUY9eBqPgKewGQb0FvHiMYB6YLGF20psMmccyMyuEJX/hxYMiXv0bb/6Nk2QPmljQUFR1090VJZwZ6/vfXmFtfWNzq7hd2tnd2z8oHx61jEo1hSZVXOlORAxwJqFpmeXQSTQQEXFoR+Pbmd9+Am2Ykg92kkAoyFCymFFinfRIUquEihiHfrniV/058CoJclJBORr98ldvoGgqQFrKiTHdwE9smBFtGeUwLfVSAwmhYzKErqOSCDBhNr94is+dMsCx0q6kxXP190RGhDETEblOQezILHsz8T+vm9r4OsyYTFILki4WxSnHVuHZ+3jANFDLJ44Qqpm7FdMR0YRaF1LJhRAsv7xKWrVqcFm9ua9V6md5HEV0gk7RBQrQFaqjO9RATUSRRM/oFb15xnvx3r2PRWvBy2eO0R94nz/kpJD7</latexit>
<latexit sha1_base64="blpf+Uw5LAEtiLXE5AdSlQOdP9Y=">AAAB63icbVBNS8NAEJ34WetX1aOXxSp4KkkR1FvBi8cK9gPaUDabSbt0dxN2N0Ip/QtePCji1T/kzX9j0uagrQ8GHu/NMDMvSAQ31nW/nbX1jc2t7dJOeXdv/+CwcnTcNnGqGbZYLGLdDahBwRW2LLcCu4lGKgOBnWB8l/udJ9SGx+rRThL0JR0qHnFGbS6FiHpQqbo1dw6ySryCVKFAc1D56ocxSyUqywQ1pue5ifWnVFvOBM7K/dRgQtmYDrGXUUUlGn86v3VGLjIlJFGss1KWzNXfE1MqjZnIIOuU1I7MspeL/3m91EY3/pSrJLWo2GJRlApiY5I/TkKukVkxyQhlmme3EjaimjKbxVPOQvCWX14l7XrNu6rdPtSrjfMijhKcwhlcggfX0IB7aEILGIzgGV7hzZHOi/PufCxa15xi5gT+wPn8ARJNji4=</latexit>
<latexit sha1_base64="m0dYKyP7f/fvK1+U1929YD8BrYo=">AAAB63icbVDLSgNBEOz1GeMr6tHLYBQ8hd0gqLeAF48RzAOSJcxOZpMh81hmZoWw5Be8eFDEqz/kzb9xNtmDJhY0FFXddHdFCWfG+v63t7a+sbm1Xdop7+7tHxxWjo7bRqWa0BZRXOluhA3lTNKWZZbTbqIpFhGnnWhyl/udJ6oNU/LRThMaCjySLGYE21yKtRoNKlW/5s+BVklQkCoUaA4qX/2hIqmg0hKOjekFfmLDDGvLCKezcj81NMFkgke056jEgpowm986QxdOGaJYaVfSorn6eyLDwpipiFynwHZslr1c/M/rpTa+CTMmk9RSSRaL4pQjq1D+OBoyTYnlU0cw0czdisgYa0ysi6fsQgiWX14l7XotuKrdPtSrjfMijhKcwhlcQgDX0IB7aEILCIzhGV7hzRPei/fufSxa17xi5gT+wPv8ASevjjw=</latexit>
<latexit sha1_base64="fiCDVqFvy+NGs/rVI5kRS11XVWY=">AAAB7HicbVBNS8NAEJ34WetX1aOXxSp4KkkR1FvBi8cKpi20oWy2k3bpZhN2N0IJ/Q1ePCji1R/kzX/jts1BWx8MPN6bYWZemAqujet+O2vrG5tb26Wd8u7e/sFh5ei4pZNMMfRZIhLVCalGwSX6hhuBnVQhjUOB7XB8N/PbT6g0T+SjmaQYxHQoecQZNVbyR4nS2K9U3Zo7B1klXkGqUKDZr3z1BgnLYpSGCap113NTE+RUGc4ETsu9TGNK2ZgOsWuppDHqIJ8fOyUXVhmQKFG2pCFz9fdETmOtJ3FoO2NqRnrZm4n/ed3MRDdBzmWaGZRssSjKBDEJmX1OBlwhM2JiCWWK21sJG1FFmbH5lG0I3vLLq6RVr3lXtduHerVxXsRRglM4g0vw4BoacA9N8IEBh2d4hTdHOi/Ou/OxaF1zipkT+APn8wf8pI65</latexit>
<latexit sha1_base64="6dj/LXsL4SCH9q9KSuRXf6ZyozQ=">AAAB63icbVBNS8NAEJ3Ur1q/qh69LFbBU0lKQb0VvHisYD+gDWWz3TRLdzdhdyOU0L/gxYMiXv1D3vw3btoctPXBwOO9GWbmBQln2rjut1Pa2Nza3invVvb2Dw6PqscnXR2nitAOiXms+gHWlDNJO4YZTvuJolgEnPaC6V3u956o0iyWj2aWUF/giWQhI9jkko5YMqrW3Lq7AFonXkFqUKA9qn4NxzFJBZWGcKz1wHMT42dYGUY4nVeGqaYJJlM8oQNLJRZU+9ni1jm6tMoYhbGyJQ1aqL8nMiy0nonAdgpsIr3q5eJ/3iA14Y2fMZmkhkqyXBSmHJkY5Y+jMVOUGD6zBBPF7K2IRFhhYmw8FRuCt/ryOuk26l6zfvvQqLUuijjKcAbncAUeXEML7qENHSAQwTO8wpsjnBfn3flYtpacYuYU/sD5/AEw1I5C</latexit>
for its original stochastic representation in terms of preserving the learned indistinguishability, which is not exhibited by VIB.
C VISUALIZATION OF TASK-IRRELEVANT INFORMATION REMOVAL
In this section, we visualize the removal of task-irrelevant information with Drop-Bottleneck (DB). To this end, we employ the Occluded CIFAR dataset (Achille & Soatto, 2018) with the same experimental setup as in Appendix B. Each image of Occluded CIFAR dataset is one of the CIFAR-10 (Krizhevsky, 2009) images occluded by MNIST (LeCun et al., 2010) digit images. In the first phase of the experiments, the feature extractor and the classifier are trained on the primary (occluded CIFAR classification) task in a normal way. During the second phase, the learned feature extractor is fixed, and only a new classifier is trained on the nuisance (MNIST classification) task. In Appendix B, we quantitatively showed that the feature extractor with DB could focus more on the occluded CIFAR images and preserve less information about the MNIST occlusions. We take a qualitative approach in this section and visualize the phenomenon using Grad-CAM (Selvaraju et al., 2017). Grad-CAM is popular for providing visual explanation given convolutional neural networks with their target values (e.g. target logits in classification tasks).
We first sample multiple test images from the Occluded CIFAR dataset, and load full, trained models, which include the feature extractor, primary classifier and nuisance classifier. We then obtain the activation maps for the last convolutional layer of the feature extractor on the primary and nuisance tasks. On the primary task, we compute the activation maps simply targeting the logits for the sample labels. However, on the nuisance task, we get the activation maps of all the logits and aggregate them by taking the maximum of the maps at each pixel location. Therefore, the aggregated maps on the
nuisance task visualize the activation related to not only the logits for the true class labels but also the other logits, capturing most of the feature usage induced during the training on the nuisance task.
Figure 7 compares two trained models: the d = 128 model without DB, and the d = 128 model with DB (deterministic). We use the DB model with β = 5.623/d for the visualization, as the value is sufficiently large enough to enforce strong compression while it still keeps the primary error not high. Figure 7a shows that regarding the logits for the nuisance (MNIST) task, a large portion of each image including the MNIST digit is activated in most cases, and thus it indicates that the feature extractor trained without DB preserves much of the nuisance features. On the other hand, Figure 7b visualizes that the feature extractor with DB outputs notably less of the nuisance features, preventing the nuisance classifier from learning correctly.
To sum up, we provide the visual demonstration that on the classification task with the Occluded CIFAR dataset, the feature extractor equipped with DB trained on the primary task could discard majority of the nuisance i.e. task-irrelevant information given a value of β that is strong enough.

heading: D ABLATION STUDY: EXPLORATION WITHOUT DROP-BOTTLENECK
text: We perform an ablation study to show Drop-Bottleneck (DB)’s ability of dealing with task-irrelevant input information. We examine the performance of the same exploration method as described in Section 4 but without DB; that is, the feature vectors are fully used with no dropping. In order to emphasize the effectiveness of DB for noisy and task-irrelevant information, we conduct experiments with both noisy and original (i.e. without explicit noise injection) settings.
Table 5 shows the results on “Very Sparse” DMLab environments with “Image Action”, “Noise”, “Noise Action” and “Original” settings. Compared to “Original” setting where observations contain only implicit, inherent noisy information irrelevant to state transitions, DB brings much more significant improvement to exploration methods in “Image Action”, “Noise”, and “Noise Action” settings, which inject explicit, severe transition-irrelevant information to observations. These results suggest that DB plays an important role handling noisy or task-irrelevant input information.

heading: E DETAILS OF EXPERIMENTS
text: We describe additional details of the experiments in Section 5. For all the experiments with DB, each entropy H(Xi) is computed with the binning-based estimation using 32 bins, and the drop probability p is initialized with pi = σ(p′i) and p ′ i ∼ Uniform(a, b) for a = −2, b = 1.
E.1 DETAILS OF EXPLORATION EXPERIMENTS
To supplement Section 5.1, we describe additional details of the VizDoom (Kempka et al., 2016) and DMLab (Beattie et al., 2016) exploration experiments. We collect training samples in a buffer and update p, Tψ, fφ with Equation (14) periodically. We use Adam optimizer (Kingma & Ba, 2015) with a learning rate of 0.0001 and a batch size of 512. In each optimization epoch, the training samples from the buffer are re-shuffled. For each mini-batch, we optimize the Deep Infomax (Hjelm et al., 2019) discriminator Tψ with 8 extra epochs with the same samples, to make the Jensen-Shannon mutual information bound tighter. This way of training Tψ only runs forward and backward passes on Tψ for the fixed output of the feature extractor fφ, and thus can be done with low computational cost. β is the hyperparameter that determines the relative scales of the compression term and the Deep Infomax Jensen-Shannon mutual information estimator. It is tuned to β = 0.001/128 for DB and β = 0.0005/128 for VIB. To make experiments simpler, we normalize our intrinsic rewards with the running mean and standard deviation.
Table 6 and Table 7 report the hyperparameters of the methods for VizDoom and DMLab experiments, respectively. We tune the hyperparameters based on the ones provided by Savinov et al. (2019). Unless specified, we use the same hyperparameters with Savinov et al. (2019).
Under the three noise settings suggested in Savinov et al. (2019), the lower right quadrant of every observation is occupied by a TV screen as follows.
• “Image Action”: Every time the agent performs a specific action, it changes the channel of the TV randomly to one of the 30 predefined animal images.
• “Noise”: At every observation, a new noise pattern is sampled and shown on the TV screen (independently from the agent’s actions).
• “Noise Action”: Same as “Noise”, but the noise pattern only changes when the agent does a specific action.
Figure 8 shows some observation examples from VizDoom and DMLab environments with “Image Action” and “Noise” settings.
E.2 DETAILS OF ADVERSARIAL ROBUSTNESS EXPERIMENTS
For the experiments, each input image is sized as 299 × 299 × 3 and each pixel value is ranged [−1, 1]. We perform our adversarial robustness experiments based on the official source code2 of Carlini & Wagner (2017). For the targeted `2 attack we increase the number of binary search steps to 20 and use a batch size of 25. Other than the two, the default hyperparameters are used.
E.3 DETAILS OF RUNNING FEATURE SELECTION METHOD
The input of the feature selection method is the same as DB’s and VIB’s: the input features are obtained with a pre-trained model of Inception-ResNet-v2 on ImageNet (Russakovsky et al., 2015). We randomly pick 100k samples out of the total 1281167 training samples of ImageNet, and compute the relevance scores for features using those samples by estimating the mutual information between each feature and its label using the entropy estimation with the k-nearest neighbors (Kraskov et al., 2004; Ross, 2014). Given the computed scores, we perform the feature selection by preserving the features with the highest scores.
E.4 DETAILS OF OCCLUDED IMAGE CLASSIFICATION EXPERIMENTS
We use a modified version of All-CNN-32 (Achille & Soatto, 2018). The model architecture for feature dimension d is described in Table 8. Batch normalization (Ioffe & Szegedy, 2015) is applied to Conv layers, and the ReLU (Nair & Hinton, 2010; Glorot et al., 2011) activation is used at every hidden layer. We use the Adam optimizer (Kingma & Ba, 2015) with a learning rate of 0.001. To ensure the convergence, in each training, the model is trained for 200 epochs with a batch size of 100.

Review summaries:
The paper contributes a novel method, Drop-Bottleneck (DB), for discretely dropping input features that are irrelevant for predicting the target variable. Key idea is to instantiate the compression term of the information bottleneck framework with learned term that sets irrelevant feature dimensions to 0. To this end, a drop probability is learned for each dimension. Dimensions that have a lower probability than 0.5 (a fixed threshold) of being relevant are set to 0.

This paper proposes an information bottleneck method, Drop-Bottleneck, that allows the input to be compressed by dropping each input feature with probability p_i. The model then learns the drop probability vector p = [p_1, ... , p_n], where dropping "redundant" features will reduce the "compression penalty" term I(XZ). The approach is demonstrated in experiments in (1) robust exploration setting for RL, (2) adversarial attacks on ImageNet, and (3) an experiment showing that their approach is able to maintain performance on ImageNet with reduced dimensionality.