MixACM: Mixup-Based Robustness Transfer via Distillation of Activated Channel Maps
Year: 2022

Abstract:
Deep neural networks are susceptible to adversarially crafted, small and imperceptible changes in the natural inputs. The most effective defense mechanism against these examples is adversarial training which constructs adversarial examples during training by iterative maximization of loss. The model is then trained to minimize the loss on these constructed examples. This min-max optimization requires more data, larger capacity models, and additional computing resources. It also degrades the standard generalization performance of a model. Can we achieve robustness more efficiently? In this work, we explore this question from the perspective of knowledge transfer. First, we theoretically show the transferability of robustness from an adversarially trained teacher model to a student model with the help of mixup augmentation. Second, we propose a novel robustness transfer method called Mixup-Based Activated Channel Maps (MixACM) Transfer. MixACM transfers robustness from a robust teacher to a student by matching activated channel maps generated without expensive adversarial perturbations. Finally, extensive experiments on multiple datasets and different learning scenarios show our method can transfer robustness while also improving generalization on natural images.

heading: 1 Introduction
text: Deep learning models have achieved impressive performance on a wide variety of challenging tasks such as image recognition, natural language generation, game playing, etc. However, these models are susceptible to even small changes in the input space. It is possible to craft tiny changes in the input such that a model classifies unaltered input correctly but classifies the same input incorrectly after small and visually imperceptible perturbations [71, 27]. These altered inputs are known as adversarial examples, and this vulnerability of the state-of-the-art models has raised serious concerns [41, 58, 10, 47].
Many defense mechanisms have been proposed to train deep models to be robust against such adversarial perturbations. These techniques include defensive distillation [57], gradient regularization [29, 58, 62], model compression [21, 45], activation pruning [23, 59], adversarial training [49], etc. Among them, Adversarial Training (AT) is one general strategy that is the most effective [4].
∗Equal Contribution. †This work was carried out at Huawei Noah’s Ark Lab. The webpage for the project is available at: awais-
rauf.github.io/MixACM ‡Corresponding Author.
35th Conference on Neural Information Processing Systems (NeurIPS 2021).
In general, adversarial training is a kind of data augmentation technique that trains a model on examples augmented with adversarial changes [49]. The adversarial training consists of an inner, iterative maximization loop to augment natural examples with adversarial perturbations, and an outer minimization loop similar to normal training. Many different methods have been introduced to improve robustness [76, 15, 52, 91, 79, 66, 94, 78, 7, 81, 39, 44, 56], but all of them are fundamentally based on the principle of training on adversarially augmented examples.
Adversarial training is more challenging compared with normal training. Better robust generalization requires larger capacity models [49, 53, 80]. Even over-parameterized models that can easily fit data for normal training [92] may have insufficient capacity to fit adversarially augmented data [97]. The sample complexity of adversarial training can be significantly higher than normal training, and it requires more labeled [64] or unlabeled data [76, 15, 52, 91]. The inner maximization for the generation of adversarial perturbations for adversarial training is significantly more expensive computationally as it requires iterative gradient steps with respect to the inputs (e.g., adversarial training takes ∼7x more time compared with normal training). Adversarial training also degrades the performance of a model on natural examples significantly [53, 94].
Can we attain robustness more efficiently, i.e., with less data, small capacity models, without extra back-propagation steps, and at no significant sacrifice of clean accuracy? For normal training, knowledge transfer is one possible paradigm for the efficient training of deep neural networks. In normal knowledge transfer, a pre-trained teacher model is leveraged to efficiently train a student model on the same or similar dataset [70]. However, knowledge transfer methods are designed to transfer features related to normal generalization which may be at odds with robustness [74, 38]. A recent line of work has explored transferring or distilling robustness from pre-trained models [32, 67, 25, 16]. Although these techniques are effective, they also require extra gradient computation and may not work in some cases.
In this work, we argue that a better approach for robustness transfer is to distill intermediate features of a robust teacher, generated on mixup examples. Our proposed approach does not require any additional gradient computation and works well with smaller models and fewer data samples. It can also effectively transfer robustness across models and datasets.
We begin with the theoretical analysis and show that adversarial loss of a student model can be bounded with two terms: natural loss and distance between the student and teacher model on mixup examples. To minimize the distance between robust teacher and student, we proposed a new distillation method. Our proposed distillation method is based on channel-wise activation analysis of robustness by Bai et al. [7] and other studies showing that adversarially trained models learn fundamentally different features [38, 74, 99].
Channels of a convolutional neural network learn different disentangled representations which, when combined, describe specific semantic concepts [8]. Samples of different classes activate different channels for an intermediate layer. However, adversarial examples make these channels activate more uniformly thereby destroying class-related information. Adversarial training solves this issue by forcing a similar channel-activation pattern for normal and adversarial examples [7]. Our proposed distillation method generates activated channel maps from a robust teacher which has already learned robust channel-activation patterns. The student, then, is forced to match these activated channel maps.
We have conducted extensive experiments to show the effectiveness of our method using various datasets and under different learning settings. We start by exhibiting the ability of our method to transfer robustness without requiring adversarial examples. We then show that our method can distill robustness from large pre-trained models to smaller models and it can transfer robustness across datasets. We also show that our method is capable to robustify a model even with a small number of examples. Concisely, our contributions are as follows:
1. We show that adversarial loss of a student model can be bounded with the distance between robust teacher and student model on mixup examples.
2. We propose a new method to transfer robustness from the intermediate features of robust pre-trained models.
3. We have demonstrated effectiveness of our method with experiments on CIFAR-10, CIFAR100, and ImageNet datasets. We showed that MixACM can achieve adversarial robustness comparable to the state-of-the-art methods without generating adversarial examples. Our method also improves clean accuracy significantly.

heading: 2 Related Work
text: Adversarial Training and Robust Features. Adversarial attacks are considered to be a security concern [9, 71, 27, 14], and many methods have been proposed to defend against such attacks [29, 27, 57, 30, 58, 73, 49, 12, 43, 62, 21, 45, 23, 59]. Adversarial training [49] is the most effective defense [4] among these methods. The fundamental principle of adversarial training is to generate adversarial perturbation during training by doing iterative back-propagation w.r.t. input. The model is then trained on these perturbed examples. Building upon this principle, different aspects of adversarial training have extensively been studied, e.g., effect of large unlabeled data [76, 15, 91], theoretical aspects to improve the trade-off between accuracy and robustness [94], improving parts of adversarial training for better robustness [78, 81, 56, 7, 28], making adversarial training fast [52, 66, 79, 1], pruning with adversarial training [87, 65], adversarial training with unlabeled data [39], etc. Our work is different from these methods as our main concern is robustness transfer without generating adversarial perturbations. Another line of work studied the effects of adversarial training and showed that adversarial training learns ‘fundamentally different’ [53] features compared with normal training [38, 86, 100]. Our method is motivated by these studies and is designed to leverage these robust features.
Knowledge and Robustness Transfer. Knowledge transfer is training a student model more efficiently on a dataset with the help of a teacher model trained on a similar or related dataset [70]. Many different settings have been explored to achieve this objective by using soft labels produced by teacher [11, 35], knowledge learned by intermediate layers of teacher also called feature distillation [61, 89, 37, 88, 75, 40, 68, 34, 33, 72], or matching input gradients [89, 70]. However, the main objective of these knowledge transfer methods is improving the generalization on natural, unperturbed images. Our work is fundamentally different from these works as we want to transfer robustness.
Our work is motivated by [32, 67, 25, 16, 6] showing transferability of robustness. Hendrycks et al. [32] showed that robust features learned on large datasets like ImageNet can improve adversarial training. Shafahi et al. [66] showed that robust pre-trained models can act as feature extractors in transfer learning. These two methods are limited in application as pre-trained models are used as backbone models. In [25], the authors showed that the robustness can be distilled more efficiently from a large pre-trained teacher model to a smaller student model by using the teacher-produced class scores on adversarial examples. Compared with [25], our method does not require any adversarial training. In [16], the distillation is performed by matching the gradient of the teacher and student, requiring fine-tuning teacher on target dataset and back-propagation to get gradients of the teacher and student w.r.t. inputs and training of a discriminator. Compared with [16], our proposed method does not require any back-propagation steps in addition to those carried out in normal training.
Activation and Robustness. Many works have explored the role of activations in the robustness from different angles, such as modifying output of intermediate layers to improve adversarial training [82, 23, 48, 51, 84], using different activation functions [59, 77, 85, 28, 55, 7, 5] or interpretation of what is learned by adversarial training with activations [86, 7]. However, we leveraged activations to transfer robustness. Our distillation method is inspired by the channel-wise analysis of robustness proposed by Bai et al. [7].
Mixup Augmentation and Robustness. Mixup augmentation was introduced to improve the generalization however, it also improved performance against one-step adversarial attacks [95]. This motivated many mixup-based adversarial defense methods, e.g., Pang et al. [54], Lee et al. [42], Archambault et al. [3], Bunk et al. [13], Chen et al. [17]. These defense methods primarily improve adversarial training by mixup. Our work, however, is different as we explore the role of the mixup in robustness transfer from both theoretical and algorithmic perspectives. Our theoretical work is based on [98] that showed a connection between mixup and robustness theoretically. Goldblum et al. [25] also briefly empirically explored the effect of some augmentation methods on robustness transfer.

heading: 3 Setup
text: We consider task of mapping input x ∈ X ⊆ Rd to label y ∈ Y = {1, 2, . . . ,K}. Given the training data D = {(x1, y1), ..., (xn, yn)}, the goal is to learn a classifier f : X → Rk from a hypothesis space F . Let L ( f(x), y ) be the loss function that measures that how poorly the classifier f(x)
predicts the label y. Suppose f can be decomposed into g ◦ h, where h ∈ H is a feature extractor and g ∈ G stands for the classifier on top of feature extractor. Adversarial Augmentation: Adversarial training augments natural examples with adversarial perturbations which are attained by maximizing the loss, i.e., x̃ = x+δ where δ = arg max‖δ′‖p≤ L ( f(x+
δ′), y ) . Here ‖ · ‖p stands for Lp norm. Throughout this paper, we take p =∞. We denote the adversarial loss [49] as:
L̃(f,D) = 1 n n∑ i=1 max ‖δ‖∞≤ L(f(xi + δ), yi),
where is the perturbation budget that governs the adversarial robustness of the model.
Mixup Augmentation: Mixup constructs virtual examples by linearly combining two examples [54]: x̃ij(λ) = λxi + (1− λ)xj , and ỹij(λ) = λyi + (1− λ)yj , where λ ∈ [0, 1] follows the distribution Pλ. The mixup loss is
Lmix(f,D) = 1
n2 n∑ i=1 n∑ j=1 Eλ∼Pλ [L(f(x̃ij(λ)), ỹij(λ))].

heading: 4 Analysis: How to Transfer Robustness?
text: In this section, we provide an analysis on how to transfer robustness with knowledge distillation and mixup augmentation. We first explore this problem from a theoretical perspective and show that student’s adversarial loss can be decomposed into the sum of the teacher’s adversarial loss and the distillation loss. Furthermore, these two loss functions can be approximated by mixup-based augmentation. We then discuss how we can design a distillation loss that distills robustness from the intermediate features of a robust model.

heading: 4.1 Theoretical Analysis
text: Robustness Transfer. We give a generalization bound for the robust test error via distillation. Different to the classical bound, we compress the hypothetical space F into a smaller space derived by the teacher feature extractor. Hsu et al. [36] points out that the distillation helps to derive a finegrained analysis for the prediction risk and avoid getting a vacuous generalization bound. Therefore, we take the following theorem as a starting point to derive robustness transfer. We consider the loss function L(f(x), y) = 1− φγ ( f(x), y ) , where φγ is the softmax function with temperature γ > 0:
φγ ( f(x), y ) =
exp(f(x)y/γ)∑K k=1 exp(f(x)k/γ) .
Theorem 4.1. Let the temperature γ > 0 be given. Then, with probability 1− δ, for any f ∈ F ,
E [
max ‖δ‖∞≤
I{ŷ(x+ δ) 6= y} ] ≤ 2L̃(f,D) + 8
γ L̃dis(f,D) + 4RS(ΨT ) +
16 n + 6
√ 2/δ
2n , (1)
where RS is the Rademacher complexity, ΨT = {max‖δ‖∞< L(g ◦ hT (x+ δ), y), g ∈ G} and
L̃dis(f,D) = 1
n inf g∈G n∑ i=1 max ‖δ‖∞< ∣∣f(xi + δ)− g ◦ hT (xi + δ)∣∣. On the right hand side of (1), two terms depend on the classifier f , i.e., the adversarial loss L̃(f,D) and the distillation loss L̃dis(f,D). Thus, we can minimize 2L̃(f,D) + 8L̃dis(f,D)/γ to find a classifier with small robust test error. Note that the loss function L is bound above by the cross-entropy loss. So L̃(f,D) can be replaced with a common-used adversarial loss based on cross-entropy. Adversarial Robustness, Transfer and Mixup. However, solving the maximization problem for δ is time-consuming, which is a severe problem in adversarial training especially for large models. For binary classification task with logistic loss function, Zhang et al. [98] proved that L̃(f,D) can be
bounded above by Lmix(f,D). In addition, the distillation loss that measures the distance between the student model and the teacher model also considers the worst-case δ. In our algorithm, we use the KL divergence or Euclidean distance and mixup sample to design the distillation loss. Inspired by the Theorem 3.3 in [98], we present the following example to illustrate the rationality behind our design. Theorem 4.2. Suppose that Y = {0, 1} and L is the logistic loss. Let f be a fully connected neural network with ReLU activation function or max-pooling. Suppose a learnt teacher model fT with the same network structure is given. Denote Ddis = { ( xi, f T (xi) ) , i = 1, . . . , n}. Under certain assumptions, we have for any positive scalar α,
L̃(f,D) + αL̃(f,Ddis) ≤ Lmix(f,D) + αLmix(f,Ddis).
This result shows that both the adversarial loss and the distillation loss can be bounded above by their mixup loss. Please see Appendix.B for more details and complete proof. Here the distillation loss is formulated by the prediction accuracy for pseudo-labels generated by a learnt teacher model, which is also considered by [15].

heading: 4.2 Considerations for Algorithmic Design
text: In order to transfer robustness, our theoretical analysis suggests minimizing the distance between teacher and student on mixup examples. However, as observed by Goldblum et al. [25] and our experiments in Section 6, minimization of KL-Divergence between the outputs of teacher and student models is not enough. How can we reduce the gap between the teacher and student more effectively? Based on previous work [24, 86, 7], we hypothesize that the gap between latent space of robust teacher and student is large and it requires distillation from intermediate features.
To reduce the distance between the latent spaces of robust teacher and student, we get inspiration from recent channel-based analysis of robustness [7] and works on the interpretation of what is learned by robust models [53, 38, 86]. Specifically, we consider convolution channels of CNNs to be fundamental learning blocks: each channel learns class-specific patterns and the output of the model is a combination of these basic patterns. As noted by [38], these basic blocks learn both robust and non-robust features with natural training. Adversarial examples amplify non-robust features while suppressing the robust features, e.g., adversarial examples frequently activate channels that are rarely activated by natural examples [7]. Adversarial training works by suppressing non-robust channels and making the activation frequency of natural and adversarial examples similar.
Motivated by this analysis, we propose Activated Channel Map (ACM) transfer loss. Our method extracts the activated channel maps of the robust model’s intermediate features on mixup examples. The student is then forced to mimic these maps. Specifically, we consider the maximum value of each channel as a proxy for the extent of how activated a channel is: a channel is less activated if it has a smaller maximum value and more activated if it has a high maximum value. We then make the student match the normalized activation map of the teacher. And, further analysis of our method is presented in the supplementary material. We present the core of our method in the next section.

heading: 5 Methodology
text: 5.1 Activated Channels Maps (ACM) Transfer Loss
In this section, we introduce our Mixup-Based Robustness Transfer method. As discussed above, the method aims to transfer robustness from a robust teacher model fT to a student model fS via matching activated channel maps of a robust teacher on mixup augmented examples. An overview of our method is given in Figure 1.
The purpose of robust teacher is to supervise the student’s focus on robust features. This is achieved by matching activated channel maps of teacher and student. The activated channel maps of a model is extracted as follows: given i-th block activationsAi (output of i-th layer), we apply a function gc : RB×C×H×W → RB×C×1×1 to get the activated channel map ai = gc(Ai), as illustrated in Figure 2. The activated channel map of student and teacher may differ in scale. The contribution of each channel in the final output, on the other hand, depends only on the relative value compared with other channels. Therefore, we first normalize this map. To force the student to mimic the teacher’s activated channel maps, we use `2 distance between the normalized activated channel maps of teacher and student. For i-th layer, we can define ACM loss as:
Lacmi(ATi ,ASi ) = ‖ aTi ‖aTi ‖2 − a S i ‖aSi ‖2 ‖22.
We minimize this distance at the end of each block of the models. A block is a set of convolution layers grouped like residual blocks in ResNets [31]. For a student and teacher model with d such blocks, the total ACM loss becomes as follows: Lacm(x; fT , fS) = ∑d i=0 Lacmi(fT (x)i, fS(x)i), where f(x)i represents output of the model at i-th block.
Mapping Function (gc): The aim of activated channel map function (gc) is to extract a map of least to most activated channels. For this purpose, we used maximum value of each channel: gc(x) = maxi xi∀i ∈ {0, ..., cl}, where cl is number of channels in l-th layer.

heading: 5.2 Transferring Robustness with Different Feature Sizes
text: Our method extracts a scalar value corresponding to each channel in a layer. Until now, we assume that the teacher and student have the same number of channels. For this case, we only need the gc mapping function. To accomplish knowledge transfer across models with a different number of channels, we need to apply transformation either on a teacher or student’s activated channel maps. We experimented with two transformations: adaptive pooling and affine transformation.
Adaptive Pooling: Pooling is used in most CNN architectures to reduce the size of feature vectors and gain invariance to small transformations of the input. The pooling layer works by dividing the input into patches and taking an average or maximum value over these patches. By changing the size of these patches, pooling can also be used for up-sampling. Pooling operation can be described as follows: y[p] = maxq∈Ω(p) x[q], where Ω represents a patch or neighbourhood of x[p]. We use PyTorch implementation of 1d adaptive maximum pooling to either down or up-sample teacher or student output.
Affine Transformation: We can also use the learning function to convert the input size to output size. For this, we use a fully connected layer. Based on our ablation studies described in supplementary material, we use adaptive pooling as a default in our method.

heading: 5.3 KL Divergence Loss with Soft Labels
text: Soft labels have shown to be useful for adversarial robustness by Pang et al. [55]. Therefore, for distillation on the same dataset (e.g., where teacher and student have the same classification layer), we minimize the KL divergence between the logits provided by teacher and student following [35, 25]. The KLD loss becomes as follows: Lkld(x; fT , fS) = γ2KL(yT (γ), yS(γ)), where γ is
the temperature parameter, and y(γ) is output logits of a model normalized by temperature parameter as used by Hinton et al. [35]. We omit this loss term when transferring from one dataset to another.

heading: 5.4 Mixup Fueled Distillation
text: Our theoretical analysis suggest minimizing distance between teacher and student with mixup examples. To this end, we use mixup to linearly combine inputs and outputs and minimize loss on these inputs. The final training objective for the student is as follows:
min fS
E(x,y)∼DEλ∼Pλ [ (1− αkld)Lmix + αkldLkld + αacmLacm ] ,
where αkld and αacm are hyperparameters for corresponding loss terms.

heading: 6 Experiments
text: In this section, we empirically evaluate our method for robustness transfer. We primarily show the effectiveness of our method under three settings: 1) Robustness Transfer in Section 6.1 to demonstrate that our method can transfer robustness from a pre-trained teacher to student without generating adversarial examples; 2) Robustness transfer from larger to smaller models in Section 6.2 to show its effectiveness under distillation settings; and 3) robustness transfer under transfer learning settings, e.g., from one dataset to another dataset and robustness with smaller dataset sizes in Section 6.3.
Evaluation of Robustness: We evaluate MixACM and other methods against standard FGSM and PGD-k as well as the strongest auto-attack by Croce and Hein [19]: a parameter-free adversarial attack designed to give a reliable evaluation of robustness. It is an ensemble of four white and black-box attacks. Apart from these, we also report robustness of our robust models on auto pgd-ce [19], auto pgd-dlr [19], FAB [18] and query-based black-box attack called Square attack [2]. For PGD-k, we use the standard value of step size (2/255), and evaluated the model with an increasing number of iterations (k), including an extreme version: PGD-500.
Pre-Trained Robust Models: For CIFAR experiments, we use WideResNet-28-10 and WideResNet34-20 [90] provided by Gowal et al. [28]. For ImageNet experiments, we use adversarially trained ResNet-50 provided by Salman et al. [63].
Training Details: For CIFAR experiments, we use WideResNet-34-10 [90] as student model following [16]. All student models for our proposed method are trained without adversarial perturbations.
We trained them for 200 epochs, using batch size of 128, a learning rate of 0.1, cosine learning rate scheduler [46], momentum optimizer with weight decay of 0.0005. For our loss, we use αacm = 5000. For KD loss, we use temperature value of γ = 10 and αkld = 0.95 and the value for mixup coefficient is αmixup = 1 whereas λ ∼ Beta(αmixup, αmixup) following [95]. ImageNet models are trained for 120 epochs. Additional training details are in the supplementary material.

heading: 6.1 Transferring Robustness without Adversarial Examples
text: CIFAR-10: To show the effectiveness of our method for robustness transfer and compare it with stateof-the-art, we follow settings of [16]: WideResNet-34-10 as a student on CIFAR-10. We compare our method with two kinds of defense methods: general variants of adversarial training and three robustness transfer methods. For our method, the average ± variance of five runs for our method are shown in Table 1. The robustness of our method is comparable to most state-of-the-arts adversarial training methods while still maintaining significantly higher clean accuracy.
ImageNet: We also consider high-resolution, large-scale ImageNet dataset [22]. This dataset is significantly more challenging for robustness [84, 83]. The results of our method for ResNet-50 student are shown in Table 2. For our method, we show two results: one with only mixup augmentation and one with mixup and random augmentation [20]. We observed that addition of random augmentation further improves the results of our method. Our method outperforms both Free [66] and Fast [79] AT in accuracy and robustness, significantly.

heading: 6.2 Robustness Distillation for Model Compression
text: A benefit of our method is its ability to distill robustness across models. To show this, we conduct two sets of experiments. First, we show robustness distillation from WideResNet-28-10 to WideResNet16-10 for CIFAR-10 and CIFAR-100 datasets. The results are shown in Table 3. To see the effect of robustness transfer across different models, we also conduct an experiment where we changed the size of the model in terms of depth, the number of channels, or both, e.g., WideResNet-28-10 to WideResNet-16-5. The results are shown in Table 4. Our method works well for both larger-to-smaller
as well as smaller-to-larger models. However, our method does not perform well when both depth and number of channels are decreased dramatically, e.g., from WideResNet-34-20 to WideResNet-10-1 (student’s size is 0.04% of teacher’s size). To elaborate further, we discuss this in the supplementary material.

heading: 6.3 Robust Transfer Learning
text: To further show the effectiveness of our method, we conduct two sets of experiments under transfer learning settings: transfer learning from one dataset to another dataset and transfer learning with fewer data samples. For first experiment, we follow Hendrycks et al. [32]’s setting: our teacher model is a WideResNet-28-10 trained on ImageNet of size 32 × 32 and student is a WideResNet-34-10. The results for the CIFAR-100 dataset under these settings are shown in Table 5.
For the second part, we show the effectiveness of our method with fewer data points. To this end, we randomly choose a smaller portion of CIFAR-10 and conducted experiments on this smaller portion of data with our method as well with PGD-7 adversarial training. The results are shown in Figure 3. Our method outperforms adversarial training significantly for both robustness and clean accuracy. Using just 30% of the data, our method can match the robustness and clean accuracy of a robust model trained on all the data.

heading: 6.4 Ablation Studies
text: Effect of Individual Components: To see the effect of individual components of our proposed method, we perform an experiment where we try different settings. The results are shown in Table 6(a). ACM loss alone is sufficient to transfer significant robustness but adding mixup and soft labels improves the transferability. However, the improvement in robustness comes at the cost of clean accuracy. Also, note that only soft labels are not enough to transfer robustness as shown by KD Only column. This is in line with the observations of Goldblum et al. [25].
Role of Intermediate Features: To understand the role of low, mid, and high-level features, we performed experiments on CIFAR-10 by progressively changing blocks used for distillation. For this ablation study, we kept all the standard settings reported in the paper (supplementary material section A.1). Our correspondence of blocks and features is as follows: block 2: low-level features; block 3: mid-level features; block 4: high-level features. Please note that block 1 corresponds to the output of the first layer only. Therefore, we do not call it low-level features.
The results are reported in Table 6 (b). In summary, all level features (low, mid, high level) improve robustness and accuracy. However, mid-level features seem to be more critical for robustness and high-level features for accuracy. For more details, please refer to supplementary material.
Other Ablation Studies: We have conducted several additional ablation studies and discussed them in the supplementary material (Section A). We recapitulate the purpose of these ablation studies here for reference. First, we conducted a study to understand the effect of direct distillation vs. distillation via MixACM. Second, we performed an ablation study to see the effect of three hyperparameters used by our loss (αacm, αkld, γ). Third, we performed a study to see how different transforms (gc(.)) effect the results. Fourth, to see the limitation of our method, we performed an experiment with progressively decreasing the size of student. Finally, we also compared activation maps of a normally trained student, teacher and model trained with our method.

heading: 7 Conclusion
text: In this paper, we have investigated robustness transfer from a theoretical and algorithmic perspective. The general principle behind most successful adversarial defense methods is the generation of adversarial examples during training. However, adversarial training is complicated as it requires more data, larger models, higher compute resources and degrades clean accuracy. We investigated whether we can have robustness more efficiently through robustness transfer. To this end, we first presented a theoretical result bounding adversarial loss of student model with the distance between robust teacher and student on mixup examples. We, then, proposed a novel robustness transfer method that is based on channel-wise analysis of robustness. Our method can achieve significant robustness against challenging and reliable auto-attack as well as other standard attacks while outperforming previous work in terms of clean accuracy. The proposed method also works well for the distillation of robustness to a smaller model, and for transfer learning with fewer data points.
Acknowledgements: Authors are thankful to Ferjad Naeem, Dr. Nauman, and anonymous reviewers for their valuable feedback.

Review summaries:
This paper proposes a robustness transfer method that combines mixup data augmentation, distillation from both prediction and intermediate features.   It is motivated by the theoretical insight that robust test error can be decomposed into adversarial loss plus distillation loss, and both of them can be upper bounded by mixup loss. Motivated by some other previous work, the KL divergence with the teacher model’s prediction and L2 distance with the teacher model’s intermediate activated feature maps are also added to the final loss of the student model. So the loss is composed of three terms: mixup loss, KL divergence between predictions, and L2 distance between the intermediate activation maps.   Experiments on popular datasets such as CIFAR-10, CIFAR-100 and ImageNet demonstrate it’s superiority compared with a variety of baselines.  

This paper proposes a method for robustness transfer. Based on the theoretical analysis, an activated channel maps-based distillation along with mixup is proposed to replace the traditional adversarial loss for robustness transfer. Experiments on CIFAR10, CIFAR100, and ImageNet datasets with different settings demonstrate the proposed method achieves outstanding performance.

This paper aims to transfer the robustness from a robust teacher model to student model with the help of mixup augmentation. It proposes the MixACM method to transfer the robustness from teacher model to student model by matching their channel-wise activation maps.  From the theoretical perspective, it showed that adversarial loss can be bounded with the natural loss and distance between the student and teacher model on mixup examples. Empirically, extensive experiments are conducted including robustness transfer, distillation and transfer learning to demonstrate the effectiveness of the method.