CEB Improves Model Robustness
Authors: Ian Fischer
Alex A. Alemi
Venue:  (2020)
Keywords: Information Theory
Adversarial Robustness

Abstract: We  demonstrate  that  the  Conditional  Entropy  Bottleneck  (CEB)  can  improve model robustness.  CEB is an easy strategy to implement and works in tandem with data augmentation procedures. We report results of a large scale adversarial robustness study on CIFAR-10, as well as the IMAGENET-C Common Corruptions Benchmark.

Under review as a conference paper at ICLR 2020
CEB IMPROVES MODEL ROBUSTNESS
Anonymous authors Paper under double-blind review
ABSTRACT
We demonstrate that the Conditional Entropy Bottleneck (CEB) can improve model robustness. CEB is an easy strategy implement and works in tandem with data augmentation procedures. We report results of large scale adversarial robustness study on CIFAR-IO, as well as the IMAGENET-C Common Corrup- tions Benchmark, IMAGENET-A, and PGD attacks.
INTRODUCTION
We aim to make models that make meaningful predictions beyond the data they were trained on. Generally we want models to be robust. Broadly, robustness is the ability of model to continue making valid predictions as the distribution the model is tested on moves away from the empirical training distribution. The most commonly reported robustness metric is simply test set per- formance, where we verify that our model continues to make valid predictions on what we hope represents valid draws from the exact same data generating procedure.
Adversarial robustness tests robustness in a worst case setting, where an attacker (Szegedy et al. 2013) makes limited targeted modifications the input that are fooling as possible. Many ad- versarial attacks have been proposed and studied (Szegedy et al. 2013) Carlini & Wagner 2011bb a Kurakin et al., 20166a Madry et al., 2017). Most machine-leared systems are currently believed to be vulnerable to adversarial examples. Many defenses have been proposed, but very few have demonstrated robustness against a powerful, general-purper
adversary (Carlini & Wagner] 2017a] Athalye al.) 2018). While robustness to adversarial attacks continues to attract interest, recent dis- cussions have emphasized the need to consider other forms of robustness as well (Engstrom et al.) 2019). The Common Corruptions Benchmark (Hendrycks & Dietterich] 2019) measures image mod- els robustness to more mild but real world sorts of perturbations. Even these modest perturbations can be very fooling for traditional architectures.
One of the few general purpose strategies that demonstrably improves model robustness is Data Augmentation (Cubuk al. 2018 Lopes al. 2019 Yin et al. 2019). However, would be nice to identify loss-based solutions that can work in tandem with the data augmentation approaches. Intuitively, by performing modifications of the inputs training time, the model is prevented from being too sensitive to particular features of the inputs that don't survive the augmentation procedure.
Alternatively, can try make our models more robust by making them less sensitive to the inputs in the first place. The goal of this work is to experimentally investigate whether, by systematically limiting the complexity of the extracted representation using the Conditional Entropy Bottleneck (CEB), we can make our models more robust in all three of these senses: test set generalization (e.g., classification accuracy on "clean" test inputs), worst-case robustness, and typical-case robustness.
1.1 CONTRIBUTIONS
This paper is primarily empirical. We demonstrate:
CEB models are easy implement and train.
* CEB models demonstrate improved generalization performance over deterministic base- lines on CIFAR-10 and ImageNet.
CEB models show improved robustness to adversarial attacks CIFAR-10.
CEB models show improved robustness on the IMAGENET-C Common Corruptions Benchmark, the IMAGENET-A Benchmark, and targeted PGD attacks.

---

Under review as a conference paper at ICLR 2020
Additionally, show that adversarially-trann trained models fail to generalize attacks they weren't t trained on, by comparing the results on Lg PGD attacks from Madry et al. (2117) to our results on the same baseline architecture. This result underscores the importance of finding ways to make models robust that do not rely on knowing the form of the attack ahead of time.
BACKGROUND
2.1 INFORMATION BOTTLENECKS
The Information Bottleneck (IB) objective (Tishby et al. 2000) aims learn a stochastic repre- sentation % p(=[x: that retains as much information about target variable Y while being as compressed as possible. The objective
max ((;Y) -(())))(
(I)
uses Lagrange multiplier (--p) to trade off between the relevant information (I(Z;Y) and com- plexity the representation (2) Because Z depends only on X (Z + + Y): Z and Y conditionally independent given Z:
((2 11Z++) I [[;
This allows us to write the information bottleneck of Equation in an equivalent form:
max (2; - -===
(3)
Just as the original Information Bottleneck objective (Equation (T) admits natural variational lower bound (Alemi et al., 2017), so does this form. We can variationally lower bound the mutual information between representation and the targets with variational decoder g(yl2):
p(ylz) p(v)
I(zY)) = [ptz.))p(=la) log
2 (YY + (p(ss))(ssz)) [log (v]l=)]
(4)
While we may not know HY) exactly for real world datasets, in the information bottleneck for- mulation it is a constant outside of our control and so can be dropped in our objective. We can variationally upper bound our residual information:
I(2: XIY) = pptx.))p(el)) log p(z(2,)) p(=ly)
p(2
S Ep(z.))ptle)) log
(5)
((=ly)
with a variational class conditional marginal (=ly) that approximates f do pl (2 ((rl)))))))))))))))))))))))) Putting both bounds together gives the Conditional Entropy Bottleneck objective (Fischer 2018):
p(2 ((=lg)
min Pe log <(ul))) e - Plog p(z(a)
(6)
Compare this with the Variational Information Bottleneck (VIB) objective Alemi et al. 2017):
min Ep( m) log4(ul>> a(-p) log p(2[#) pla x)
g(2)
The difference between CEB and VIB is the presence of a class conditional versus unconditional variational marginal. As be seen in Equation (5) using unconditional marginal provides looser variational upper bound on (()). CEB (Equation (6) can be thought as a tighter variational approximation than VIB (Equation 77) Equation (3). Since Equation 33) is equivalent
to the IB objective (Equation CEB can be thought of as tighter variational approximation to the IB objective than VIB.
The IB objective ordinarily written with a I Lagrange multiplier 3 = (- with natural range from to Here we use the sigmoid function: o--p) = Tee to reparameterize in terms of a control parameter p on the whole real line. As p the bottlencck turns off.
2

---

Under review as a conference paper at ICLR 2020
2.2 IMPLEMENTING CEB MODEL
In practice, turning an existing classifier architecture into CEB model is very simple. For the stochastic representation p(z|z) we simply use the original architecture, replacing the final softmax layer with a dense layer with d outputs. These outputs are then used to specify the means of d-dimensional Gaussian distribution with unit diagonal covariance. That is, to form the stochastic representation, independent standard normal noise is simply added to the output of the network (z = x + e). For every input, this stochastic encoder will generate random d-dimensional output vector. For the variational classifier g(y|=) any classifier network can be used, including just linear softmax classifier as done in these experiments. For the variational conditional marginal g(>ly) helps to the same distribution as output by the classifier. For the simple unit variance Gaussian encoding we used in these experiments, this requires learning just d parameters per class. For ease of implementation, this can be represented single dense linear layer mapping from a one-hot representation of the labels to the d-dimensional output, interpreted as the mean of the corresponding class marginal.
In this setup the CEB loss takes a particularly simple form:
E wyy (f(x) + - log e e - CTP 2 (f(x))b))((() My + 2c)
(8)
3
Here the first term is the usual softmax classifier loss, but acting on our stochastic representation 2 = f(x) + e, which is simply the output of our encoder network f(x) with additive Gaussian noise. The wy is the yth row of weights in the final linear layer outputing the logits. My the learned class conditional means for our marginal. e are standard normal draws from an isotropic unit variance Gaussian with the same dimension loss is a stochastic sampling of the KI. divergence between our encoder likelihood and the class conditional marginal likelihood. p controls the strength of the bottleneck and can vary the whole real line. As p + oo the bottleneck is turned off. In practice we find that values near but above 0 tend to work best for modest size models, with the tendency for the best p to approach 0 as the model capacity increases. Notice that in expectation the second term in the loss is (f(x) py)) which encourages the learned means By to converge the average of the representations of each element in the class. During testing we use the mean encodings and remove the stochasticity.
our encoding fzz). The second term in the
In its simplest form, CEB training classifier amounts to injecting Gaussian random noise in the penultimate layer and learning estimates of the class averaged output of that layer with the stochastic regularization shown. Appendix B we show simple modifications to the TPU-compatible ResNet implementation available on GitHub from the Google TensorFlow Team that produce the same core ResNet-50 models we use for our ImageNet experiments.
2.3 ADVERSARIAL ATTACKS AND DEFENSES
Attacks. The first adversarial attacks were proposed in Szegedy et al. (2013): Goodfellow et al.
(2015). Since those seminal works, enormous variety of attacks has been proposed ( (Krrkin al.
2016a b): MoosaviiDeezoool er al. (2016): Carlini & Wagner (2017b); Madry et al. (2017) Eykholt al. (2017); Baluja Fischer (2017). 1017),.0 etc.). In this work, we will primarily consider the Projected Gradient Descent (PGD) attack (Madry et al. 2017), which is a multi-step variant of the early Fast
Gradient Method (Goodfellow al. 2015). The attack can be viewed as having four parameters: p.
the norm of the attack (typically 2 or co), the radius the the p-norm ball within which the attack permitted to make changes to an input, n, the number of gradient steps the adversary is permitted to take, and e,, the per-step limit to modifications of the current input. In this work, we consider L2 and Los attacks varying e and n, and with E; =
Defenses. A common defense for adversarial examples is adversarial training. Adversarial train- ing was originally proposed in (Szegedy et al. (201)), but was not practical until the Fast Gradient Method was introduced. It has been studied in detail, with varied techniques (Kurakin et al. 2016b Madry et al. 2017; Ilyas et al., 2019 Xie et al. 2019). Adversarial training clearly be viewed as a form of data augmentation (Tsipras et al.] 2018). where instead of using some fixed set of func- tions to modify the training examples, we the model itself in combination with
more
3

---

Under review as a conference paper at ICLR 2020
adversarial attacks to modify the training examples. As the model changes, the distribution of modi- fications changes as well. However, unlike with non-adversarial data augmentation techniques, such AUTOAUG, adversarial training techniques considered in the literature so far cause substantial re- ductions in accuracy on clean test sets. For example, the CIFAR-10 model described in Madry et al.) (2017) gets 95.5% accuracy when trained normally, but only 87.3% when trained L.sc adversarial examples. More recently, Xie et al. (2019) adversarially trains ImageNet models with impressive robustness to targeted PGD Loo attacks, but only 62.32% accuracy on the non-adversarial test set, compared to 78.81% % accuracy for the same model trained only on clean images.
2.4 COMMON CORRUPTIONS
The Common Corruptions Benchmark (Hendrycks & Dietterich 2019) offers a real world test of model robustness in light of common image processing pipeline corruptions. Figure 4 shows ex- amples of the 15 corruptions present in the benchmark. IMAGENET-C a modified test set of Imagenet images with the 15 corruptions applied at five different strengths. Within each corruption type we evaluated the average error each of the five levels (F,g E. Pees) To summa- rize the performance across all corruptions we report not only the average corruption error across all 15 tasks (avg = 15 Ee Ee), but also the commonly reported Mean Corruption Error (mCE), which reweights the errors on each task according to the performance of baseline ALEXNET model (Hendryeks Dietterich 2019)
Ees FALEXNET
mCE- 15
(9)
===1
There are slightly different pipelines that have been used in the literature for the IMAGENET-C task (Lopes et al., 2019). In this work we used the ALEXNET normalization numbers and data formulation as in Yin et al. (2019).
2.5 NATURAL ADVERSARIAL EXAMPLES
The IMAGENET-A A Benchmark (Hendrycks et al. 2019 is dataset of 7,500 naturally "adversarial" examples across 200 ImageNet classes The images exploit commonly occuurinn weaknesses in ImageNet models, such as relying textures often seen with certain class labels.
EXPERIMENTS
3.1 FASHION-MNIST EXPERIMENTS
As a warm up, we consider Wide ResNet (Zagoruyko & Komodakis 2016) models trained on Fash- ion MNIST (Xiao et al. 2017), and evaluated targeted PGD 12 and Lox attacks. All of the attacks are targeting the trouser class of Fashion MNIST, as that is the most distinctive class. Targeting a
Accuracy (1).
2(=2.33
La Success
L Success (L)
100
93.5
4.5
93.0
4.0
92.0
92.5
3.5
91.5
VIB Det.
3,0
91.0
90.5
2.0
-10
1
2
3
4
5
-1
10
2
3
4
5
-10
2
3
4
10
2
3
4
Figure 1: Clean accuracy, maximum rate lower bound Rx < I(Z:X) seen during training, and robustness to targeted PGD L2 and La attacks on CEB, VIB, and Deterministic models trained on Fashion MNIST. We can see that any given value p. the CEB models dominate the VIB models on both accuracy and robustness, while having essentially identical maximum rates. None of these models are adversarially trained.
4

---

Under review as a conference paper at ICLR 2020
less distinctive class, such as one of the shirt classes, would confuse the difficulty of classifying the different shirts and the robustness of the model to adversaries. To measure robustness to the targeted attacks, we count the number of predictions that changed from correct prediction on the clean im- age to an incorrect prediction of the target class on the adversarial image, and divide by the original number of correct predictions. Results are shown in Figure T
In this experiment we wanted to compare the performance of VIB, CEB, and a deterministic base- line. In Figure (left) we see that both VIB and CEB have improved accuracy over the deterministic baseline. In order to compare the relative complexity of the learned representations for the two models, in the second panel we show the maximum lower bound seen during training on the rate;
E log R ΣE p(=|ze] S [(Z X) using the encoder's minibatch marginal for both VIB and CEB The two sets of models show nearly the same rate lower bound at each value of p.
p(z[z)
The right two panels of Figure show robustness to the targeted PGD L2 and Los attacks. Here CEB outperforms VIB. We also see for both models that as decreases, the robustness to both attacks increases. In line with the proposed Minimum Necessary Information criterion from Fischer (0188) at p 0 we end up with CEB models that have hit exactly 2.3 nats for the rate lower bound, have maintained high accuracy, and have strong robustness to both attacks. Moving to p = -1 gives only small improvement to robustness, at the cost of a large decrease in accuracy.
3.2 CIFAR-10 10 EXPERIMENTS
28x 10 Wide ResNet Experiments We trained set of 25 28x10 Wide ResNet (WRN) CEB models on CIFAR-10 at p -0.5, .... 5], well as a deterministic baseline. They trained for 1500 epochs, lowering the learning rate by a factor of 0.3 after 500, 1000, and 1250 epochs. This long training regime
due to our of the original AUTOAUG policies, which requires longer training. The only additional modification we made to the basic 28x10 WRN architecture was the removal of all Batch Normalization (loffe & Szegedy (0155) layers. Every small CIFAR-10 model we have trained with Batch Normalization enabled has had substantially worse robustness to Los PGD adversaries, even though typically the accuracy is much higher. For example, 28x10 WRN CEB models rarely exceeded more than 10% adversarial accuracy. However, it was always still the case that lower values of p gave higher robustness. As a baseline comparison, a deterministic 28x10 WRN with BatchNorm, trained with AUTOAUG reaches 97.3% accuracy on clean images, but 0% accuracy on Losc PGD attacks at = 8 and n 20. Interestingly, that model was noticeably more robust to L2 PGD attacks than the deterministic baseline without BatchNorm, getting 73% accuracy compared to 66%. However, it was still much weaker than the CEB models, which get over 80% accuracy on the same attack (Figure 2 Additional training details are in Appendix A.
Figure 2 demonstrates the adversarial robustness of CEB models to both targeted L2 and Loc at- tacks. The CEB models show marked improvement in robustness to L2 attacks compared to an adversarially-traine bascline from Madry et al. (2017) (denoted Madry). Figure 3 shows the ro- bustness of five of those models to PGD attacks to represent the most robust models across most of the range of p we trained. Note that of the 25 CEB models we trained, only the models with p > succesfully trained. The remainder collapsed to chance performance. This is something we observe on all datasets when training models that are too low capacity. Only by increasing model capacity does it become possible to train at low p. Note that this result is predicted by the theory of the onset of learning in the Information Bottleneck and its relationship to model capacity from Wu al. (0019).
varied. We selected the four CEB models
62x7 Wide ResNet Experiments. In order to explore the effect of model size on training, and to train at lower p. we trained the largest Wide ResNet we could fit on a single GPU with a batch size of 250. This was a 62x7 model similar to the ones above, including the use of AUTOAUG, but we additionally enabled BatchNorm. We were able to train at p = with this larger model, which reached 97.51% % accuracy. This result is better than the 28x10 Wide ResNet from AUTOAuG by 0.19 percentage points, although it is still worse than the Shake- Drop model from that paper. We additionally tested the model the new CIFAR-10.1 test set (Recht et al., 2018), getting accuracy of 93.6%. This is a gap of 3.9 percentage points, which is better than all of the results reported in that paper, and substantially better than the Wide ResNet results (but still inferior to the Shake-Drop
This lower bound on T(X; Z) is the "InfoNCE with tractable encoder" hound from Poole al. 2019
5

---

Under review as a conference paper at ICLR 2020
AUTOAUG results). The same model 5 reached 97.05% accuracy the normal test set and 91.9% on the 11. test set, showing that increased p gave substantially worse generalization.
To test robustness of these models, we swept for both PGD attacks, which we show in Figure 3 The main result is that the 62 x 7 CEB, model not only has substantially higher accuracy than baseline Wide ResNets trained with AUTOAUG, it also beats the adversarially-traiee both the L2 and the Log attacks at almost all values of c. We also show that this model is even more robust to two transfer attacks, where we used the 62x7 CEB, model and the adversarially- trained model to generate PGD attacks, and then test them on the CEB, model. This result helps to counter possible claims that these models are doing "gradient masking" (the more compelling evidence against gradient masking is that the robustness of the model is strongly correlated with the hyperparameter p. whose only effect to constrain the amount of information the model captures).
model on
We additionally tested both models on the CIFAR-10 10 Common Corruptions test sets. At the time of training. we were unaware that AUTOAUG's default policies for CIFAR-10 contain brightness and contrast augmentations that amount to training those two corruptions from Common Corruptions (as mentioned in Yin et al. (2019)) so our results are not appropriate for direct comparison with other results in the literature. However, they still allow us to compare the effect of bottlenecking the information between these two large models. The p = 5 model reached an mCE of 61.2. The p 0 model reached an mCE of 52.0, which is dramatic relative improvement.
3.3 IMAGENET EXPERIMENTS
To demonstrate CEB's ability to improve robustness to real world data shifts, we trained six dif- ferent types of networks on ImageNet at 224 x 224 resolution and two different sizes of RESNET, RESNET-50 and RESNET-152. and then tested them on IMAGENET-C, IMAGENET-A, and targeted PGD attacks. As simple baseline we trained RESNET-50 networks with no data augmentation. We then trained the same networks but as CEB networks at ten different values of p = (1, 2.... 10). AUTOAUG (Cubuk et al. 2018) has previously been demonstrated to improve robustness markedly on IMAGENET-C so next we trained our baseline RESNET-50 model with AUTOAUG. We similarly trained these AUTOAUG models as CEB models with ten different values of p. IMAGENET-C num- bers are also sensitive to the model capacity. To assess whether CEB can benefit larger models we repeated the experiments with a modified RESNET-50 network where every layer made twice as wide. Finally, we repeated the above six model types with RESNET- 152 baselines and CEB models without AUTOAUG, with AUTOAUG, and with AUTOAUG and twice as wide. All other hyperpa- rameters (learning rate schedule, L2 weight decay scale, etc.) remained the same across all models. In total we trained 66 ImageNet models deterministic baselines varying augmentation, width, and depth, and 60 CEB models additionally varying p. The results for the RESNET-50 models are summarized in Figure and Table For RESNET-152, see F and Table 2
The CEB models highlighted in Fad Tables and were selected by cross validation. These were values of p that gave the best clean test set accuracy. Despite being selected for classical generalization, these models also demonstrate a high degree of robustness on both average- and worst-case perturbations. In the case that more than one model gets the same test set accuracy, we choose the model with the lower p. since we know that lower P correlates with higher robustness. The only model where we had to make this decision was for RESNET- 152 with AUTOAUG, where five models all were within 0.1 1% of each other, so we chose the p 3 model, rather than P (5...)).
IMAGENET-C C and IMAGENET-A. Both data augmentation and increasing model capacity have positive effects on robustness to both IMAGENET-C and IMAGENET-A, but for all three classes of models CEB gives substantial additional improvements.
Targeted PGD Attacks. We tested on the random-targe target version of the PGD L2 and L.c at- tacks (Kurakin et al.] (0166)). both at c 16, n = 20, and c, = 2, which is considered be a strong attack still (Xie et al. 2019). Similar to our results on CIFAR-10, model capacity makes substantial difference to whitebox adversarial attacks. In particular, none of the ResNet-50 models perform well, getting less than 1 1% top-1 accuracy. However, the Resnet- 152 CEB models show dramatic improvement over the deterministic baseline models, with I accuracy increasing from 'The mCE computed relative to baseline model. We use the baseline model from Yin al. 2019).

---

Under review as a conference paper at ICLR 2020
1.0
CEB Acc
0.8
XXx CEB L
Accuracy
CLB
0.6
Det. Acc
Det.
0.4
m.
Det.
Madry Acc
0.2
Madry L
Madry
0.0
2
3
4
5
P
Figure 2: CEB p vs. test set accuracy, and L2 and Lee PGD adversarial attacks on CIFAR-10. The attack parameters were selected to be about equally difficult for the adversarially-traine WRN 2840 model from Madry et al. (2017) (grey dashed and dotted lines). The deterministic baseline (Det.) only gets 8% accuracy
the Lx attacks, but gets 66% on the L2 attack, substantially better than the 45.7% the udversarially-traiee trained model, which makes it clear that the adversarially- model failed to generalize in any reasonable way to the L2 attack. The CEB models always substantially more robust than Det., and many of them outperform Madry even on the Los attack the Madry model was trained on, but for both attacks there is clear general trend toward more robustness as decreases. Finally, the CEB and Det. models all reach about the same accuracy, ranging from 93.9% 95.1%. with Det. at 94.4%. In comparison, Madry only gets 87.3%. We emphasize that none of the CEB models is ad adversarially trained.
28x10 CEB.;
20x10 CEB, oeweo 28x10 Det.
9-0 62x7 CEB
x- CEB,
CEO,
28x10
28x10 Madry
Madry CIB,
100
100
80
80
Accuracy
60
60
0
10
15 Ly
20
25
0
20
80
100
300
1000
L2e
Figure 3: Untargeted adversarial attacks small and large CIFAR-10 10 models showing both strong robustness to PGD L22 and Loo attacks, as well as excellent test accuracy of 97.5%. Left: Accuracy untargeted Log attacks at different values of for all 10,000 test set examples. 28x10 and 62x7 indicate the Wide ResNet size. CEB,, indicates a CEB model trained at p x. Madry is the adversarially-trained model from Madry et al. (2117) (values provided by Aleksander Madry), Madry was trained with steps of Loc PGD at 8 (grey dashed line). 62x7 CEB, is the CEB model with the highest accuracy (97.51%) trained at p 0. 62x7 CEB, the CEB model with the highest accuracy (97.05%) trained at 5. CEB; CCEB, is transfer attacks from the 62x7 CEB; model to the 62x7 CEBg model. Madry CEBB, transfer attacks from the Madry model to the 62x7 CEB, model. All of the CEB models with p < 4 outperform Madry across most of the values of e, even though they were not adversarially-trained. The 62x7 CEB, model is even more robust to transfer attacks than to the direct whitebox attacks. Right: Accuracy at different values e. Note the switch to log scale on the x axis at Lgc = 100. All values are collected at 20 steps of PGD. It is interesting to note that both the small and the large CEB, models have essentially identical robustness, in spite of very different numbers of parameters, and that the Det. model eventually outperforms the CEB, models L2 attacks at relatively high accuracies. We emphasize that none of the CEB models is adversarially trained.
untargeted L2 attacks

---

Under review as a conference paper at ICLR 2020
type
CEBx2
50x2
CEB
50
CEB-aa
50-aa
p
2
NA
NA
NA
Clean
20.5%
21.8%
22.3%
22.5%
23.0%
24.0%
mCE
65.6%
69.7%
69.9%
72.2%
77.7%
81.2%
Average CE
51.9%
55.2%
55.3% %
57.2%
61.5% %
64.3%
Gaussian Noise
53.1% %
57.2%
57.4 %
59.8%
66.0% %
71.3%
Shot Noise
53.8%
57.9%
58.0 %
60.2%
68.0% %
72.8%
Impulse Noise
59.4%
63.8%
63.1 %
66.4%
71.4%
76.8%
Defocus Blur
60.0%
61.9%
63.5 %
64.4%
66.0%
66.3%
Glass Blur
63.8%
65.0%
66.1 %
67.1%
74.0%
74.5%
Motion Blur
57.1 %
60.6%
60.4% %
63.2%
64.2%
66.3%
Zoom Blur 59.2%
62.1%
62.6% %
65.2%
64.1 %
64.5%
Snow 61.1%
65.8%
64.8%
68.3%
71.0%
74.5%
Frost 56.3%
59.5%
59.9%
62.0%
66.0%
68.3%
Fog 47.4%
52.8%
50.2%
53.0%
60.1%
63.3%
Brightness 28.8%
31.1%
30.7% %
31.8%
34.7%
36,4%
Contrast 52.5%
55.6%
56.8%
57.3%
65.8%
68.4%
Elastic Transform
51.6%
54.0%
54.8%
55.8%
56.8%
57.8%
Pixelate
36.2%
38.2%
39.2%
40.6%
49,8%
55.7%
Jpeg Compression 38.8%
41.7%
41.9% %
42.3%
45.0%
47.9%
ImageNet-A
89.0%
90.5%
92.5%
93.3%
95.1 %
96.8%
PGD PGD Leo
99.4%
99.9%
99.6%
99. 99.9%
99.7%
99.9%
99.4%
99.9%
99.6%
99.9%
99.7%
99.9%
Table 1: Baseline and cross-validated CEB values for the ImageNet experiments. The middle columns show a RESNET-50 model trained with AUTOAUG ("50") versus the corresponding CEB network ("CEB"). The right columns ("-aa") remove AUTOAUG from the data processing pipeline, and the left columns ("x2") are models that are twice as wide. The CEB values reported here are denoted with the dots in Figure 4 Lower values are better in all cases, and the lowest value in pairs of columns is shown in bold. Table gives the same results for the RESNET- 152 models.
0.09% to 17.09% between the deterministic baseline and the 1 models without AUTOAUG, relative increase 187 times, and increases nearly as large for the AUTOAUG and wide AUTOAUG models. Interestingly, for the PGD attacks, AUTOAUG was detrimental the RESNET- 152 mod- els without AUTOAUG were more robust than those with AUTOAUG. Only the wide RESNET- models with AUTOAUG exceeded the robustness of the narrow RESNET-152 without AUTOAUG.
CONCLUSION
The Conditional Entropy Bottleneck (CEB) provides simple mechanism improve robustness of image classifiers. We have shown that CEB gives a tighter variational bound on the IB objective than the closely-related VIB, while also having consistently better test accuracy and robustness. We have shown strong trend toward increased robustness as decreases in the standard 28x10 Wide RESNET model on CIFAR-10, and that this increased robustness does not come the expense of accuracy relative to the deterministic baseline. We have shown that CEB models at a range of p es- sentially dominate an adversarially-trained baseline model, even on the attack the adversarial model was trained and have incidentally shown that the adversarially-trrined model generalizes to at least one other attack less well than deterministic baseline. Finally, we have shown that on Ima- geNet, CEB provides substantial gains over deterministic baselines in both validation accuracy and robustness to Common Corruptions, Natural Adversarial Examples, and targeted Projected Gradient Descent attacks. We hope these empirical demonstrations inspire further theoretical and practical study of the use bottlenecking techniques to encourage improvements to both classical general- ization and robustness.
8

---

Under review as a conference paper at ICLR 2020
clean
20.2%
mCE
CK
4
65.7%
avg
52.0%
gaussian_nooe _ooiee
53.3%
shot_noiss
54.1%
impulse_noise
59.2%
defocus_blus blur
141
60.7%
glass_blur
63.3%
motion_blus
57.2%
zoom_bie blur
snow
61.2%
frost
ERL
Σ3
56.6%
fog
5
brightness
28.5%
contrast
E
52.5%
Dasticctransfom
51.1%
pixelate
1
36.3%
jpeg_ comppssomresio
&
38.9%
ImageNet-A
87.7%
PGD L.c
99.6%
PGD L2
99.6%
10
20
30
40
50
60
70
80
90
100
Error
Summary of the IMAGENET-C experiments. In the main part of the figure (in blue), the average errors (lower is better) across corruption magnitude are shown for 33 different net- works for each of the labeled Common Corruptions (Hendrycks & Dietterich/ 2019). IMAGENET- A (Hendrycks et al. 2019), and targeted PGD attacks (Madry et al.) (017). The networks come pairs, with the vertical lines denoting responding color the errors for each of 10 different CEB trained networks are shown with varying = [1, 2.... 10]. arranged from 10 at the top to at the bottom. The light blue lines denote a baseline RESNET-50 model trained without AUTOAUG. The blue lines show the same network (and baseline) but with AUTOAUG. The dark blue lines show RESNET-50 AUTOAUG networks that made twice as wide. In this way and enlarging the model, as well as the additive effect of CEB on each model. At the top in red are shown the same data for three summary statisties. clean denotes the clean errors of each of the networks. mCE denotes the ALEXNET regularized average corruption errors. avg shows an equally weighted average across all common corruptions. The dots denote the value for each CEB network and each corruption at p", the optimum for the network as measured in terms of clean accuracy. The values these dots and the baseline values are given in detail in Table Figure and Table give the same data for the RESNET- 1552 models.
Figure 4:
baseline network's performance and then in the cor-
separately see the effect of both data augmentation

---

Under review as a conference paper at ICLR 2020
clean
19.2%
mCE
60.5%
avg
47.8%
gaussian_noke noise
48.3%
shot noise
impulse_noise
52.3%
defocus blur
54.7%
glass_but blur
4
60.8%
motion_blle blur
50.4%
zoom blur
56.8%
snow
C
56.6%
frost
fog
44.4%
brightness
26.9%
contrast
elastic traisifrr
47.8%
pixelate
33.9%
jpeg_ comp_coopressoon
35.3%
ImageNet-A
84.4% < $NL 3
PGD
81.4%
PGD Lg
81.0% 0%
10
20
30
40
50
60
70
80
90
100
Error
Figure 5: Replication of Figure but for RESNET- 152. The deeper model shows marked improve- ment across the board. Notice in particular the adversarial robustness to Loo and Lg PGD attacks for the CEB models over the deterministic baselines.
type
CEB-152x2
152x2
CEB-152
152
152-aa
152-aa -a
p
NA
3
NA
NA
Clean
19.2%
20.7%
19.9%
20.7%
21.6 %
22.4%
mCE
60.5 %
64.8%
63.0%
64.6%
71.9%
76.9%
Average CE
47.8%
51.3%
49.7
51.1%
56.9 %
60.8%
Gaussian Noise
48.3%
53.0%
49.7%
$1.9%
60.3%
67.8%
Shot Noise
49.0%
53.6%
50.3%
52.5%
62.0%
69.2%
Impulse Noise
52.3%
58.4%
54.2%
56.7%
63.0%
72.2%
Defocus Blur
54.7%
58.0%
57.8%
56.7%
61.5%
61.4%
Glass Blur
60.8%
63.1%
60.3%
62.1%
69.2%
70.5%
Motion Blur
50.4%
55.6%
55.0%
56.7%
57.4% %
59.25
7oom Blur 56.8%
59.0%
58.8%
59.3%
61.7%
Snow
56.6 %
61.6%
57.8%
61.5%
66.1%% %
70.6%
Frost 52.4%
54.8%
54.6%
55.7%
61.1 %
64.4%
Fog 44.4%
49.3%
46.0%
49.6%
56.2%
59.3%
Brightness
26.9%
28.8%
28.2%
28.7%
32.6%
34.5%
Contrast 47.4%
50.3%
51.1%
50.5%
61.3%
64.9%
Elastic Transform
47.8%
49.2%
49.4%
50.5%
52.2%
53.7%
Pixelate 33.9%
36.4%
36.1%
36.1%
48.2%
56.5%
Jpeg Compression
35.3%
37.9%
36.5%
37.4%
42.4%
47.0%
ImageNet-A
84.4%
86.2%
87.6%
87.9%
91.6% %
93.4%
PGD La PGD Loo
81.4% $1.0 %
99.9% 99.3%
84.9%
99.9%
84.2% 84.1 %
99.99
%
99.4%
99.5%
Table 2: Same as Table I above but for a deeper RESNET- 152 model. Note that for the bascline 152x2 and 152 models. the smaller model (152) actually has better mCE and equally good top-1 accuracy, indicating that the wider model may be overfitting, but the CEB- 152x2 model substantially outperforms both of them across the board.
10

---

Under review as a conference paper at ICLR 2020
REFERENCES
Alexander A Alemi, lan Fischer, Joshua V Dillon, and Kevin Murphy. Deep Variational Information Bottleneck, In International Conference on Learning Representations, 2017. URL http://
stxiv.org// (000/001000410
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of security: Circumventing defenses to adversarial examples. arXiv preprint arXiv: (04i:v/80000040000 2018.
Shumeet Baluja and Ian Fischer. Adversarial transformation networks: Learning to generate adver- sarial examples. arXiv preprint arXiv:1703.09380 2017.
Nicholas Carlini and David Wagner. Adversarial examples are not easily detected: Bypassing ten detection methods. In Proceedings of the 10th ACM Workshop Artificial Intelligence and Security, pp. 3-14. ACM, 2017a.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy (SP), pp. 39-57. IEEE, 2017b.
Ekin D Cubuk, Barret Zoph, Dandelion Mane, Vijay Vasudevan, and Quoc V Le. Autoaugment: Learning augmentation policies from data. arXiv preprint
2018
Logan Engstrom, Justin Gilmer, Gabriel Goh, Dan Hendrycks, Andrew Ilyas, Aleksander Madry, Reiichiro Nakano, Preetum Nakkiran, Shibani Santurkar, Brandon Tran, Dimitris Tsipras, and Eric Wallace. A discussion of "adversarial examples are not bugs, they are features'. Distill, 2019. doi: 1..23915/distill0000199 https///isstill.pubb/ http://iilllllub22/0/o////////-e
Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning models. arXiv preprint 777.v:1707.08945, 2017.
lan Fischer. The Conditional Entropy Bottleneck. Open Review, 2018.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In CoRR, 2015.
Google TensorFlow Team. Cloud TPU ResNet Implementation. https://github: hom.tttobo/cooocccccmmmmmmm Accessed: 2019-09-
httpa///w./..ooeeee////////////a 30.
Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common cor- ruptions and perturbations. arXiv preprint arXiv: 2019,
Dan Hendrycks, Kevin Zhao, Steven Basart, Jacob Steinhardt, and Dawn Song. Natural adversarial examples. arXiv preprint arXiv:1907.07174, 2019.
Andrew lyyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. arXiv preprint M0M5v:9905.02111 2019.
Sergey Ioffe and Christian Szegedy. Batch normalization: Accelerating deep network training by reducing internal covariate shift. arXiv preprint arXiv:/502.03 1502.03 2015.
Diederik Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In International Conference on Learning Representations, 2015. URL http:::/axxxvvoor///bbb
6980
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. arXiv preprint arXiv:1607.0255 02533,,,..3..... 2016a.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. arXiv preprint 161 .0/236 2016b.
11

---

Under review as a conference paper at ICLR 2020
Raphael Gontijo Lopes, Dong Yin, Ben Poole, Justin Gilmer, and Ekin D. Cubuk. Improving bustness without sacrificing accuracy with patch gaussian augmentation. 2019.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks, arXiv preprint arXiv: 17XXv:1706.06083. 2017.
Seyed-Mohsen Moosavi-Dezfooli. Alhussein Fawzi, and Pascal Frossard. Deepfool: simple and accurate method to fool deep neural networks. In Proceedings of the IEEE Conference on Com- puter Vision and Pattern Recognition, pp. 2574-2582, 2016.
B. Poole, S. Ozair, A. den Oord, A. A. Alei, and G. Tucker. On Variational Bounds of Mutual Information. JCML2201,, 2019. URL Bttphttss://arxtttt wttp://wwwwv...aa/////aaaa///// 06922
Benjamin Recht, Rebecca Roelofs, Ludwig Schmidt, and Vaishaal Shankar. Do cifar-10 classifiers generalize to cifar-10? arXiv preprint arXiv:1806.0044 2018.
C. Szegedy, Zaremba, I. Sutskever, Bruna, Erhan, I. Goodfellow, and R. Fergus. Intriguing properties of neural networks. arXiv: 1312.6199, 2013. URL https::/ts/ttte http//awwvvv...raaaeee/.ee 1.312.6999
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.
Naftali Tishby, Fernando Pereira, and William Bialek. The information bottleneck method. arXiv preprint physics/0004057, 2000.
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be odds with accuracy. arXiv preprint arXiv: 12152, 2018
Tailin Wu, Ian Fischer, Isaac Chuang, and Max Tegmark. Learnability for the information bottle- neck. Uncertainty in AI, 2019.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: a novel image dataset for benchmark- ing machine learning algorithms. arXiv: 1708.07747, 2017. URL httts://axxiv..rrt
abs/1708.070 07747
Cihang Xie, Yuxin Wu, Laurens van der Maaten, Alan Yuille, and Kaiming He. Feature denoising for improving adversarial robustness. In Proceedings of the IEEE Conference Computer Vision and Puttern Recognition, pp. 501-509, 2019.
Dong Yin, Raphael Gontijo Lopes, Jonathon Shlens, Ekin D. Cubuk, and Justin Gilmer. fourier perspective model robustness in computer vision. 2019.
Zagoruyko and N. Komodakis. Wide Residual Networks. arXiv: 1605.07 07146, 2016. URL
https: /ttp::///rxtii abs /
12

---

Under review as a conference paper at ICLR 2020
A
EXPERIMENT DETAILS
Here we present additional technical details for the CIFAR-10 and ImageNet experiments.
A.1 CIFAR-10 EXPERIMENT DETAILS
We trained all of the models using Adam (Kingma Ba 2015) at a hase learning rate of 10-3. We lowered the learning rate three times by factor of 0.3 each time. The only additional trick to train the CIFAR- 10 models was to start with = 100, anneal down to = 10 over epochs, and then anneal to the target over one epoch once training exceeded a threshold of 20%. This jump-start method is inspired by experiments on VIB Wu et al. 2019). makes it much easier to train models at low p. and appears to not negatively impact final performance.
For the 62x7 models, we used the data augmentation policies for CIFAR-10 10 found by AUTOAUG and trained the models for 800 epochs, lowering the learning rate by factor of 10 at 400 and 600 epochs.
A.2 IMAGENET EXPERIMENT DETAILS
We follow the learning rate schedule for the ResNet 50 from Cubuk al. (2018), which has top learning rate of 1.6, trains for 270 epochs, and drops the learning rate by factor of 10 at 90, 180, and 240 epochs. The only difference for all of our models is that we train at batch size of 8192 rather than 4096. Similar the CIFAR-10 models, in order ensure that the ImageNet models train at low p. we employ a simple jump-start. We start at p 100 and anneal down to the target over 12,000 steps. The first learning rate drop occurs bit after 14,000 steps. Also similar to the CIFAR 28x10 WRN experiments, none of the models we trained at p succeeded, indicating that RESNET- 50 and WRN 50x2 both have insufficient capacity to fully learn ImageNet. We were able to train RESNET-151 152 at p = O, but only by disabling L2 weight decay and using a slightly lower learning rate. Since that involved additional hyperparameter tuning, don't report those results here, beyond noting that it is possible, and that those models reached top-1 accuracy around 72%.
13

---

Under review as a conference paper at ICLR 2020
B CEB EXAMPLE CODE
Here we give the core changes needed to make ResNet CEB models, based on the TPU-compatible ResNet implementation from the Google TensorFlow Team
In model.py:
def seuet__v__geeeattrrr (block,tn, in, layers, num_classes, ...);
def moael (inputs, is (s_training):
Buiid the ResNet model as normad up to the following Lines: inputs tf. reshape
inputs, [-1, 2048 if block_fn is bottleneck_block else 512]) Now, instead of the final dense layer, just return inputs, which for ResNet50 models is (batch_ size, 2048] tensor.
return inputs
Listing I: Modifications to the model py function.
In resnet_main, py add the following imports and functions: import tensorflow tensorflow.probbbillt as tfp
tfd - tfp.distributiin
def ezx dist
"""Buiids the encoder distribution, e
dist h.t..alliivaritttelmmaaliie (loc=x) return dist
def bay_diisttt (y, num_elasse==1000, 2. 2_dims=2048): """Builds the backwards distribution, b(zly). ***
y_onehot tf.one_hot (y, num_classes)
mus = tf. dyyyersrddneeey dist ttt.buuttirrriitteeeaaabbbbaaa (Lo==muus moc==uss
z_dims, activation-Nene)
return dist
def eyz_dist (z, num_elasses-1000)
""*Boiids the classifier distribution, c "**
For the classifier, we are using exactly same dense layer
$ initialization as was used for the final layer that we removed $ from model.py.
logits = te.layers.densel
2, num num_classes, activaticn-Nene,
het.o./.nttaaleeetttt.aaaoooooo. http:a/wwooo..mmmaaiaaiaaaaaaaaa (stddeee return det.catteorricaalllggc
def (erp(global_sten) start_step, end_step, start_val, end_val): "*"otility function linearly interpolate two values. ean
interp (tf. (global_steg
start_step, ff.ftea)32)
/ tf. cast (end step start_step, tf. ff.atta)32))
interp = ti st.maximum (0.0, tf (.minimmm(1.))) interp))
return start_val (1.0 interp) end val interp
Listing 2: Modification to the head gresnet.main.ge
14

---

Under review as a conference paper at ICLR 2020
Still in resnet_main.py, modify resnet_model_fa as follows:
def fe (features, labels, mode, params) :
Nothing changes until after the definition of builo_network: def quild_networe
Elided, unchanged implementation of
if params ('precisionn] 'bflcat16'; butlo_netwozk now returns the pre-logits, so we'll change the variable name from logits to net. with tf.contrib. wfw.riiattp..bfotlll...... (_scopp)___)cp net build_networkk
net cast (net, float33))
elif params | 'precision') 'float32'; net (etwork))
# Get the encoder, ezzxx)
with tf.variable_scopa a'epp''eex', ('ezx', reuse-tf.AUTO_REEE
62x = ezx_dist (net)
# Get the backwards encoder, b(aly);
with tf. tf.variable_sane e_scppeep_____eeeeeee___eeeee___ ('bzy', bzy bzy_dist (labels)
# Only sample z during training. Otherwise, just pass through
# the mean value of the encoder.
if mode tf.
IRAIN:
eax.eemple
else:
ezx. mean ()
Get the classifier, c(ylz): with tf. ta.vabieble scope ('oyz', Bonssett..AUT__BEE cyz (2, params)
cyz. logits is the same what the unmodified RosNet model would return. logits cyz.
# Compute the individual conditional entropies:
hzx -ezx Log__oggpporl (z) (z)
$ (2
hzy Log_prob
#(2IY) fupper bound)
hyz -cyz.log_prae (labels) #(YI%) fupper bound)
g (()22IY) (21X)) (Z/YY)
#
>= -hzx hzy =: Rex, the residual information.
rex -hzx + hzy
rho = 3.0 # You should make this a hyporparamoter. rho_to_ tammmmaaaaaaaa lambda rho: 1.0 up.exp (rho) gamma tf. cast gamma (rho), ff.float32)
# Get the global step now, so that we can adjust rho dynamically. global_step = wwrrainnget_glball_sstte
anneal the 12000 You should make this hyperparameter.
if anneal rho > 0:
Anneal rho from 100 down to the target rho over the first anheal_rho steps.
gamma lerp (global__stee, 0, aneal_rho, rho gammaa (100.0), gamma)
# Replace all the softmax cross-ents cross-entropy loss computation with # the following line:
loss tf. ref.ceduue_mmal (gamma rex + hyz)
# The rest of resnet_model_ft can remain unchanged.
Listing 3: Modifications to resnet_modell. in resnet.main
15


Reviews:
[{"review_id": "r1gbwXWiFr", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "TITLE\nCEB Improves Model Robustness\n\nREVIEW SUMMARY\nAs a thorough empirical evaluation of a new method for training deep neural networks, this paper is a useful contribution.\n\nPAPER SUMMARY\nThe paper presents an empirical study of the robustness of neural network classifiers trained using a conditional entropy bottleneck regularization.\n\nCLARITY\nThe paper is well written and easy to follow. Results are presented in a way that gives the reader a good overview, but figure quality / legibility could be improved.\n\nORIGINALITY\nThe CEB method is an original (but minor) modification of a well known method. \n\nSIGNIFICANCE\nThe primary contribution of the paper is a thorough experimental evaluation of the particular regularization method presented in the paper. While this is certainly useful, it would have been even better with more comparison with other regularization methods. The paper clearly demonstrates the benefits of CEB, which is of interest in itself.\n\nFURTHER COMMENTS\nConsider making a more clear distinction between generalization and robustness.\n\"are are\" Double word.\n\"all machine-learned systems...highly vunerable\" Too strong statement.\n\"VIB\" Abbreviation not defined in the text.\nFigure 1, 2 and 3 are a bit hard to read (especially the dotted lines)\n\n", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper."}, "extra_text": {}}, {"review_id": "SJlrME_6Yr", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper studied the effectiveness of Conditional Entropy Bottleneck (CEB) on improving model robustness. Three tasks are considered to demonstrate its effectiveness; generalization performance over clean test images, adversarially perturbed images, and images corrupted by various synthetic noises. The experiment results demonstrated that CEB improves the model robustness on all considered tasks over the deterministic baseline and adversarially-trained classifiers. \n\nThe proposed idea is simple, easy to implement, and generally applicable to various classification networks. I especially enjoyed the nice experiment results; indeed, it has been widely observed that many existing approaches on adversarial training sacrifice the classification performance to improve the robustness over adversarial examples [1]. The proposed approach sidesteps such a problem since it does not require adversarial retraining. It is surprising to see that the proposed method is still able to achieve stronger robustness than the models based on adversarial training.\n\nOne of my major concerns is that it has a large overlap with Fischer (2018) in terms of methodology, experiment settings, and empirical observations, which limits the general contribution of the paper. Fischer (2018) first proposed CEB objective and showed its effectiveness in various tasks, including the adversarial defense. Although this paper extends the results on adversarial defense to CIFAR 10 dataset and includes additional ablative experiments and experiments on other types of input noises, it ends up confirming very similar observations/conclusions in Fischer (2018). Although Fischer (2018) is an unpublished work, I think that it is fair to consider that as a prior work since it is properly cited in the paper.   \n\nMy other concern is that the experiment misses comparisons against other adversarial defense approaches, which makes it difficult to understand the degree of robustness this model can achieve. The current comparisons are mostly focused on deterministic and VIB baselines, which are useful to understand the core argument of the paper, but insufficient to understand how useful CEB could be in the purpose of adversarial defense. Especially, I believe that some recent approaches that do not require adversarial training, such as [A2], are worth comparisons.  \n\nBelow are some minor comments/questions on the paper.\n1. Section 3.2: For this experiment, BN is removed from the classification network; it would be still beneficial to see the baseline performance with BN (deterministic model) to better compare the classification performance on clean test data.\n2. Section 3.3: The performance on both baseline and the proposed model on clean data is far lower than the SOTA models. Some clarification would be helpful.\n3. It would be great to see further clarifications of improvement in CEB over VIB; currently, it is very simply justified that it is because CEB optimizes tighter variational bound on Eq.(3) than VIB. But it would also be great to see justifications from various angles (e.g. in the context of adversarial defense).  \n", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I made a quick assessment of this paper.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}, {"review_id": "B1xkJ3EhtB", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper modifies existing classifier architectures and training objective, in order to minimize \"conditional entropy bottleneck\" (CEB) objective, in attempts to force the representation to maximize the information bottleneck objective. Consequently, the paper claims that this CEB model improves general test accuracy and robustness against adversarial attacks and common corruptions, compared to the softmax + cross entropy counterpart. This claim is supported by experimental results on CIFAR-10 and ImageNet-C datasets.\n\nIn overall, the manuscript is easy-to-follow with a clear motivation. I found the experimental results are also promising, at least for the improved test accuracy and corruption robustness. Regarding the results about adversarial robustness, however, it was really confusing for me to understand and validate the reported values. I would like to increase my score if the following questions could be addressed:\n\n- It is not clear whether adversarial training is used or not in CEB models for the adversarial robustness results. If the results were achieved \"without\" adversarial training, these would be somewhat surprising for me. At the same time, however, I would want to see more thorough evaluation than the current, e.g. PGD with more n, random restart, gradient-free attacks, or black-box attacks.\n- I wonder if the paper could provide a motivation on why the AutoAug policy is adopted when training robust model. Personally, this is one of the reasons that makes me hard to understand the values presented in the paper.\n- Figure 3, right: Does this plot indicates that \"28x10 Det\" is much more robust than \"28x10 Madry\"? If so, it feels so awkward for me, and I hope this results could be further justified in advance.\n- Figure 3: It is extremely difficult to understand the plots as the whole lines are interleaved on a single grid. I suggests to split the plots based on the main claims the paper want to demonstrate.\n- How was the issue of potential over-fitting on rho handled, e.g. using a validation set?\n- In general, I slightly feel a lack of justification on why the CEB model improves robustness. In Page 5: \"... Every small model we have trained with Batch Normalization enabled has had substantially worse robustness, ...\" - I think this line could be a critical point, and need further investigations in a manner of justifying the overall claim.", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper proposes CEB, Conditional Entropy Bottleneck, as a way to improves the robustness of a model against adversarial attacks and noisy data. The model is tested empirically using several experiments and various datasets.

We appreciate the authors for submitting the paper to ICLR and providing detailed responses to the reviewers' comments and concerns. After the initial reviews and rebuttal, we had extensive discussions to judge whether the contributions are clear and sufficient for publication. In particular, we discussed the overlap with a previous (arXiv) paper and decided that the overlap should not be considered because it is not published at a conference or journal. Plus the paper makes additional contributions.

However, reviewers in the end did not think the paper showed sufficient explanation and proof of why and how this model works, and whether this approach improves upon other state-of-the-art adversarial defense approaches.

Again, thank you for submitting to ICLR, and I hope to see an improved version in a future publication.
Decision: Reject