Reject Illegal Inputs: Scaling Generative Classifiers with Supervised Deep Infomax
Authors: Xin WANG
SiuMing Yiu
Venue:  (2020)
Keywords: generative classifiers
selective classification
classification with rejection

Abstract: Deep Infomax~(DIM) is an unsupervised representation learning framework by maximizing the mutual information between the inputs and the outputs of an encoder, while probabilistic constraints are imposed on the outputs. In this paper, we propose Supervised Deep InfoMax~(SDIM), which introduces supervised probabilistic constraints to the encoder outputs. The supervised probabilistic constraints are equivalent to a generative classifier on high-level data representations, where class conditional log-likelihoods of samples can be evaluated. Unlike other works building generative classifiers with conditional generative models, SDIMs scale on complex datasets, and can achieve comparable performance with discriminative counterparts.  With SDIM, we could perform \emph{classification with rejection}.
Instead of always reporting a class label, SDIM only makes predictions when test samples' largest logits surpass some pre-chosen thresholds, otherwise they will be deemed as out of the data distributions, and be rejected.  Our experiments show that SDIM with rejection policy can effectively reject illegal inputs including out-of-distribution samples and adversarial examples.

Under review as a conference paper at ICLR 2020
REJECT ILLEGAL INPUTS: SCALING GENERATIVE CLASSIFIERS WITH SUPERVISED DEEP INFOMAX
Anonymous authors Paper under double-blind review
ABSTRACT
Deep Infomax (DIM) is an unsupervised representation learning framework by maximizing the mutual information between the inputs and the outputs of an en- coder, while probabilistic constraints are imposed on the outputs. In this paper, we propose Supervised Deep InfoMax (SDIM), which introduces supervised proba- bilistic constraints to the encoder outputs. The supervised probabilistic constraints are equivalent to a generative classifier on high-level data representations, where class conditional log- log-likelhhoods of samples be evaluated. Unlike other works building generative classifiers with conditional generative models, SDIMs scale complex datasets, and can achieve comparable performance with discrimina- tive counterparts. With SDIM, we could perform classification with rejection. Instead of always reporting class label, SDIM only makes predictions when test samples' largest logits surpass some pre-chosen thresholds, otherwise they will be deemed as out of the data distributions, and be rejected. Our experiments show that SDIM with rejection policy can effectively reject illegal inputs including out- of-distribution samples and adversarial examples.
INTRODUCTION
Non-robustness of neural network models emerges a pressing concern since they are observed to be vulnerable to adversarial examples (Szegedy et al. 2013
Goodfellow et al.) 2014). Many attack methods have been developed to find imperceptible perturbations to fool the target classi- fiers (Moosavi-Dezfooll et al.) 2016; Carlini & Wagner| 2017 Brendel et al. 2017). Meanwhile, many defense schemes have also been proposed to improve robustnesses of the target mod-
els (Goodfellow et al.) 2014 Tramer et al.) (21700111200 Madry et al. 2017 Samangouei et al.) 2018).
important fact about these works is that they focus on discriminative classifiers, which directly model the conditional probabilities of labels given samples. Another promising direction, which
almost neglected so far, is to explore robustness generative classifiers (Ng Jordan 2002). A generative classifier explicitly model conditional distributions of inputs given the class labels. During inference, it evaluates all the class conditional likelihoods of the test input, and outputs the class label corresponding
the maximum. Conditional generative models are powerful and natu- ral choices to model the class conditional distributions, but they suffer from two big problems: (1) it is hard to scale generative classifiers on high-dimensional tasks, like natural images classifica- tion, with comparable performance to the discriminative counterparts. Though generative classifiers have shown promising results of adversarial robustness, they hardly achieve acceptable classifica- tion performance even on CIFAR10 (Li et al. 2018 Schott et al.) 2018)) Fetaya et al. 2019). (2) The behaviors of likelihood- assign surprisingly higher likelihoods to out-of-distribution (OoD) samples (Nalisnick et al.) 2018 Choi & Jang. 2018). |eetaya et al. (2019) discuss the issues of likelihood as a metric for density modeling, which may be the reason of non-robust classification, e.g. OoD samples detection.
generative models can be counter intuutii and brittle. They may
In this paper, we propose supervised deep infomax (SDIM) by introducing supervised statistical constraints into deep infomax (DIM, Hjelm et al. (018)), unsupervised learning framework by maximizing the mutual information between representations and data. SDIM is trained by opti- mizing two objectives: (1) maximizing the mutual information
(MI) between the inputs and the high-level data representations from encoder; (2) ensuring that the representations satisfy the super- vised statistical constraints. The supervised statistical constraints be interpreted generative

---

Under review as a conference paper at ICLR 2020
classifier high-level data representations giving up the full generative process. Unlike full gener- ative models making implicit manifold assumptions, the supervised statistical constraints of SDIM serve explicit enforcement of manifold assumption: data representations (lw-dimensional) are trained to form clusters corresponding to their class labels. With SDIM, we could perform classifica- tion with rejection (Nalisnick al., 2209 Geifman & Yaniv (017). SDIMs reject illegal inputs based on off-manifold conjecture (Samangouci et al., 2018;) Gu & Rigazio 20144), where illegal inputs, e.g. adversarial examples, lie far away from the data manifold. Samples whose class con- ditionals are smaller than the pre-chosen thresholds will be deemed as off-manifold, and prediction requests on them will be rejected. The contributions of this paper are:
We propose Supervised Deep Infomax (SDIM), an end-to-end framework whose proba- bilistic constraints are equivalent to a generative classifier. SDIMs can achieve compara- ble classification performance with similar discrinimative counterparts at the cost of small over prerraarttteiztioonnn
We propose simple but novel rejection policy based on off-manifold conjecture: SDIM outputs class label only if the test sample's largest class conditional surpasses the pre- chosen class threshold, otherwise outputs rejection. The choice of thresholds relies only on training set, and takes no additional computations.
Experiments show that SDIM with rejection policy can effectively reject illegal inputs, including OoD samples and adversarial examples generated by a comprehensive group of adversarial attacks.
2 BACKGROUND: DEEP INFOMAX
Deep InfoMax (DIM, Hjelm et al. (0018) is an unsupervised representation learning framework by maximizing the mutual information (MI) of the inputs and outputs of an encoder. The computation of MI takes only input-output pairs with the deep neural networks based esimator MINE (Belghazi al. 2018)
Let Eg be an encoder parameterized by ø working on the training set X' = {>; and generating output set y = {E<x:) DIM is trained to find the set of parameters & such that: (1) the mutual information I(X, Y) is maximized over sample sets X' and V (2) the representations, depending on the potential downstream tasks, match some prior distribution. Denote J and M the joint and
product of marginals of random variables X, Y respectively. MINE estimates lower-bound of MI with Donsker- Varadhan (Donsker & Varadhan 1983) representation of KL-divergence:
(1) where (2(x,)) v) E RR is family of functions with parameters represented by neural network. Since in representation learning we are more interested in maximizing MI, than its exact value, non- KL divergences are also favorable candidates. We can get a family of variational bownddbouns using
I(X,Y) = DKL (J 2 (z]T, y) - log (xx
f-divergence representations (Nguyen et al. 20100):
(X, > [T v)] Exlff (xx,
where f is the Fenchel conjugate of specific divergence f. For KL-divergence, ((((== c(t-1), A full f" list is provided in Tab. 6 of Nowozin et al. (2016). Coiss-Coonrasttive Estimation (Gutmann & Hyvärinen 2010) can also be used lower-boune of MI in "infoNCE" (Oord et al. 2018)
3 SUPERVISED DEEP INFOMAX
All the components of SDIM framework are summurized in Fig. [ The focus of Supervised Deep InfoMax (SDIM) is introducing supervision to probabilistic constraints of DIM for (generative) classification. We choose to maximize the local MI, which has shown to be more effective in classi- fication tasks than maximizing global MI (Hjelm al. 2018). Equivalently, we minimize JMn:
M²
1
JMI
> I(L E((())))
(3)
2
where (x(x) is a local M x M feature map of æ extracted from some intermediate layer of encoder F. and I can be any possible MI lower-bounds.
2

---

Under review as a conference paper at ICLR 2020
Encoder E
Scores
Positive Features
MI Evaluation T
Local Feature Maps
Global Feature
Negative Features
N
Class Conditionals
Supervised Constraints
Figure 1: Components of SDIM framework. (1)The encoder Es takes input and produces pairs of local feature maps La (x) and global representations (x)x). (2) The MI evaluation network Th maps every possible positive pairs and negative pairs to MI scores specified by corresponding MI lower-bound. Negative pairs are simply obtained by combine all unpaired local feature maps and global representations within the same mini-batch. (3) Supervised constraints imposed on the global representations z = (x(x) with loss JNLI. + JiM for generative classification. The true class conditionals maximized, while false class conditionals are minimized. See following parts of this section for details.
3.1 EXPLICIT ENFORCEMENT OF MANIFOLD ASSUMPTION
By adopting a generative approach p(x, y) p(y)p(aly) we assume that the data follows the man- ifold assumption: the hhigh-dimensional) data lies on low-dimensional manifolds corresponding to their class labels. Denote z the compact representation generated with encoder (x)) In order to explicitly enforce the manifold assumption. sentation space. Assume that y is discrete random variable representing class labels, and p( fly) is the real class conditional distribution of the data manifold given y. Let po (xlly) be the class condi- tionals we model parameterized with 0. We approximate p(oly) by minimizing the KL-divergence between p(mly) and our model pe (mly), which is given by:
admit the existence of data manifold in the repre-
D (p(lly)llo y)) Eg Ba.urp( log (maly) log (o(l)))
(4)
-Ea.y=p( [log p( [y]] Ea (log pe (āly)]
where the first item on RHS is a constant independent of the model parameters 0. Eq. 4 equulss to maximize the expectation ( [log po (0 [y)].
In practice, we minimize the following loss JNLL. equivalent to empicically maximize the above expectation over (Ø. Eg(2;), y:
JNLI = -Rz.y=((a.))
log pa (maly:)
(5)
N
Besides the introduction of supervision, SDIM differs from DIM in its way of enforcing the statisti- cal constraints: DIM use adversarial learning (Makhzani et al. 2015) to push the representations to the desired priors, while SDIM directly maximizes the parameterized class conditional probability.

---

Under review as a conference paper at ICLR 2020
Maximize Likelihood Margins Since generative classifier, inference, decides which class test input x belongs to according to its class conditional probability. On one hand, we maximize samples' true class conditional probabilities (classes they belong to) using JNLL; On the other hand, we also hope that samples' false class conditional probabilities (classes they do not belong to) can be minimized. This is assured by the following likelihood margin loss JIM:
JLM N C-1
1 1
Σ
max((oogp(ējj))) = c) + K logp(2;;11 = y:). 0)
(6)
am c=
where K is a positive constant to control the margin. For each encoder output ã,, the C - true- false class conditional gaps are squared" which quadratically increases the penalties when the gap becomes large, then are averaged.
Putting all these together, the complete loss function we minimize is: JSDIM = a FMr + B -NILL + FIM
Parameterization of Class Conditional Probability Each of the class conditional distribution is represented as an isotropic Gaussian. So the generative classifier is simply a embedding layer with C' entries, and each entry contains the trainable mean and variance of Gaussian. This minimized parameterization encourages the encoder to learn simple and stable low-dimensional representations that can be easily explained by even unimodal distributions. Considering that maximize the true class conditional probability, and minimize the false class conditional probability at the same time, do not choose conditional normalizing flows, since the parameters shared across class labels, and the training can be very difficult. In InhSchott et al. (2018), each class conditional prohability rep- resented with VAE, thus scaling to complex datasets with huge number of classes, c.g. ImageNet, is almost impossible.
3.2 DECISION FUNCTION WITH REJECTION
A generative approach models the class-conditional distributions p(æly), well as the class priors p(y). For classification, we compute the posterior probabilities p(y (>) through Bayes' rule:
plylz) xz) p(zly)p(U) p(xly)p(() p(x)
The prior p(y) can be computed from the training set, or we simply use uniform class prior for all class labels by default. Then the prediction of test sample x" from posteriors is:
y arg max log p(x ly= -y=c).
(8)
c=[1..c]
The drawback of the above decision function is that it always gives a prediction even for illegal inputs. Instead of simply outputting the class label that maximizes class conditional probability of x=, we set a threshold for each class conditional probability, and define our decision function with rejection to be:
y"' Rejection, otherwise
if log p(= (y") 8y-
The model gives rejection when log p<x*==("))))))>>>>)))))))")))p (1²)) is smaller than the threshold by- Note that here we can use p(==" ly" and p(z""y(""" ly") interchangeably. This also known as selective classification (Geff man & El- Yaniv 2017) or classification with reject option (Nalisnick et al.] (Se9) Supp.
4 RELATED WORKS
Robustness of Likelihood-based Generative Models Though likelihood- based generative mod- els have achieved great success in samples synthesis, the behaviors of their likelihoods can be counter-intuitive. Flow-based models (Kingma & Dhariwal 2018) and as well as VAEs (Kingma & Welling 2013), surprisingly assign even higher likelihoods to out-of- cittoo-ddittibution samples than the samples in the training set (Nalisnick et al. 2018; Choi & Jang 2018). Pixel-level statistical analyses in Nalisnick et al. (2018) show that OoD dataset may "sit inside of" the in-distribution dataset (i.e. with roughly the same mean but smaller variance).
Using squared margin, achieve slightly better results in our experiments than simple margin.
4

---

Under review as a conference paper at ICLR 2020
Off-Manifold Conjecture Grosse et al. (2017) observe that adversarial examples outside the training distribution via statistical testing.
DefenseGAN (Samangouci al. 2018) models real data distribution with the generator G of GAN. At inference, instead of feeding the test input æ to the target classifier directly, it searches for the the final input the classifier. It ensures that the classifier only make predictions on the data manifold represented by the generator, ruling out the potential adversarial perturbations in æ. PixelDefend (Song et al. 2017) takes similar approach which uses likelihood-basee generative model - PixeICNN to model the data distribution.
"closest" sample G(=") from generator distribution
Both DefenseGAN and PixelDefend additionally trained as peripheral defense schemes agnos- tic to the target classifiers. Training generative models on complex datasets notoriously takes huge amount of computational resources (Brock et al., 2018). In contrast, the training of SDIM is com- putationally similar to its discriminative counterpart. The verification of whether inputs are off- manifold is a built-in property of the SDIM generative classifier. The class conditionals of SDIM modeled on low-dimensional data representations with simple Gaussians, which is much easier, and incurs very small computations.
EXPERIMENTS
Datasets We evaluate the effectiveness of the rejection policy of SDIM on four image datasets: MNIST, FashionMNIST (both resized to 32 32 from 28 x 28); and CIFAR 10, SVHN. See App. App.[.]] B.
for details of data processing. For out-of- distrributioon samples detection,
the dataset pairs
which likelihood based generative models fail (Nalisnick et al. 2018 Choi & Jang 2018): Fash- ionMNIST (in)-MNIST (out) and CIFARIO (in)-SVHN (out). Adversarial examples detection evaluated on MNIST and CIFAR1O.
Choice of thresholds It is natural that choosing thresholds based what the model knows, i.e. training set, and can reject what the model does not know, i.e. possible illegal inputs. We set one threshold for each class conditional. For each class conditional probability, choose to evaluate on two different thresholds: /sl and 2nd percentiles of class conditional log-likelihoods of the correctly classified training samples. Compared the detection methods proposed in Li et al. (2018). our choice of thresholds is much simpler, and takes no additional computations.
Models A typical SDIM instance consists of three networks: an encoder, parameterized by Φ. which outputs d-dimensional representation; mutual information evaluation networks, i.e. Te in Eqn. ( and Equ. 2 and C-way class conditional embedding layer, parameterized by 6, with each entry 2d-dimensional vector. We set d = 64 in all our experiments.
For encoder of SDIM, use ResNet (He et al. 2016) on 32 with stack of 8n layers, and 4 filter sizes {32, 64, 128, 256}. The architecture is summarized as:
output map size 32 x 32
x 16
8 x
layers # filters
1 2m
2n
2n
32
64
128
256
The last layer of encoder is d-way fully-connected layer. To construct discriminative coun- terpart, we simply set the output size of the encoder's last layer to C' for classification. We use ResNet10 (n = 1) MNIST, FashionMNIST, and ResNet26 (n = 3) on CIFARIO, SVHN.
5.1 EVALUATION ON CLEAN DATA
We report the classification accuracies (see Tab. I of SDIMs and the discriminative counterparts on clean test sets Results show that SDIMs achieve the same level of accuracy as the discriminative counterparts with slightly increased number of parameters (17% increase for ResNet10, and 5% increase for ResNet26). We are aware of the existence of better results reported on these datasets using more complex models (Huang et al.) 2017): Han et al., (017)) or automatically designed archi- tectures (Cai et al. 2018), but pushing the state-of-the-are is not the focus of this paper.
5

---

Under review as a conference paper at ICLR 2020
Model
# Parameters
MNIST
FashionMNIST
CIFARIO
SVHN
Disc. (ResNet10, 1)
1.25M
99,42%
94.25% 94.58%
SDIM (ResNet10, n 1)
1.46M 17% f)
99.55%
Disc. (ResNet26, (n 3))
4.39M
92.35%
95.96%
SDIM (ResNe126, 71 3)
4.60M (5% f)
92.53%
95.74%
Table Clean test accuracies of SDIMs and the discriminative counterparts.
Is Fully Generative Model Necessary for Generative Classification? In the evaluations of Li et al. (2018) and Schott et al. (2018). both model class conditional probability with VAE (Kingma
& Welling 2013 Rezende et al. 2014), and achieve acceptable accuracies (> 98%) on MNIST. However, hard for fully conditional generative models achieve satisfactory classification curacies even on CIFAR10. On CIFAR I0, methods in Li et al. (2018) achieve only < 50% accuracy.
They also point out that the classification accuracy of a conditional PixeICNN+ (Salimans al., 2017] is only 72.4%. The test accuracy of ABS in (Schott et al. 2018) is only 54%. In contrast, SDIM could achieve almost the same performance with similar discriminative classifier by giving up the full generative process, and building generative classifier on high-level representations. [L] ett al. (2118) improves the accuracy to 92% by feeding the features learned by powerful discrimi- native classifier-VGol
(Simonyan & Zisserman 2014) to their generative classifiers, which also suggests that modeling likelihood on high-level representation (features) is more favorable for gener- ative classification than pixel-level likelihood of fully generative classifiers. For classification tasks, discovering discriminative features is much more important than reconstructing the all the image pixels. Thus performing generative classification with full generative models may not be the right choice.
Decision with Rejection We also investigate the implications of the proposed decision function with rejection under different thresholds. The results in Tab. show that choosing higher percentile as threshold will reject more prediction requests. At the same time, the classification accuracies of SDIM on the left test sets become increasingly better. This demonstrate that out rejection policy tend to reject the ones on which SDIMs make wrong predictions.
1sl percentile
2nd percentile
Dataset
Original Acc.
Ace. Left
Rej. Rate
Acc. Left
Rej. Rate
MNIST
99.55%
99.95%
3.02%
99.97%
4.00%
FashionMNIST
94.58%
96.45%
4.63%
96.94%
6.60%
CIFAR10
92.53%
96.18%
8.90%
96.60%
10.86%
SVHN
95.74%
97.43%
3.99%
98.00%
6.36%
Table Classification performances of SDIMs using the proposed decision function with rejection. We report the rejection rates of the test sets and the accuracies on the left test sets for each threshold.
5.2 OUT-OF-DISTRIBUTIOO SAMPLES DETECTION
Class-wise OoD detections are performed, and mean detection rates over all in-distribution classes are reported in Tab. 3 For each in-distribution class c, we evaluate the likelihooos of the whole OoD dataset. Samples whose log- ligeliicissodds are lower the class threshold 6, will be detected as OoD samples. Same evaluations are applied on conditional Glows with 10th percentile thresholds, but the results are not good. The results are clear and confirm that SDIMs, generative classifiers on high-level representations, are more effective on classification tasks than fully conditional generative models raw pixels. Note that fully generative models including VAE used in Li et al. (2018); Schott et al. (2018) fail on OoD detection. The stark difference between SDIM and full generative models (flows or VAEs) is that SDIM models samples' likelihoods in the high-level representation spaces, while generative models evaluate directly on the raw pixels. See Supp. C for more results about the histograms of the class conditionals of in-out distributions.

---

Under review as a conference paper at ICLR 2020
Model
FashhonNNNISTI)n-WNISTTToo
CIFARIO(i--SVHNouu)
SIIM(Ix/ Per.)
99.36%
94.24 %
(2nM(2nd Per.)
99. 64%
95.81
Glow(/Oth Per.)
3.53%
0.02%
Table 3: Mean detection rates of SDIMs and Glows with different thresholds on OoD detection.
5.3 ROBUSTNESS AGAINST ADVERSARIAL. EXAMPLES AND DETECTION
We comprehensively evaluate the robustness of SDIMs against various attacks:
gradient-based attacks: one-step gradient attack FGSM (Goodfellow et al. 2014). its iter- ative variant projected gradient descent (PGD, Kurakin al. (20T6); Madry et al. (2077).
CW-L2 attack (Carlini & Wagner 2017). deepiool (Moosavi-Deztooll et al. 2016).
score-based attacks: local search attack (Narodytska Kasiviswanathan 2016).
decision-based attack: boundary attack (Brendel et al. 2017).
Attacks Using Cross-Entropy We find that SDIMs are much more robust to gradient-based at- tacks using cross-entropy, e-g. FGSM and PGD, since the gradients numerically vanish side effect of the likelihood margin loss FLM of SDIM. This phenomenon similar to some defences that try hinder generations of adversarial examples by masking the gradients inputs. While full generative classifiers in Li et al. (2018) still suffer from these attacks. See Supp. D.I for detailed results.
Conservative Adversarial Examples Adversarial attacks aim to find the minimal perturbations that sufficiently change the classification labels, i.e. flip other logits to the largest one. We show case examples on MNIST generated by untargeted attacks and their logits in Tab. [ Supp. D.2 for examples of CIFARIO). Though these attacks successfully flip the logits, they are designed to be conservative to avoid more distortions to the original images. As result, the largest logits of adversarial examples are still much lower than the thresholds, so they can be detected by our rejection policy. We find that rejection policy performs perfectly on MNIST, but fails detect all adversarial examples on CIFARIO except for Boundary attack (See Tab. 5) It seems to be a well-known observation that models trained CIFAR10 are MNIST. Gilmer et al. (2018) connects this observation to the generalization of models. They found close the misclasstied samples, which implies the existence of adversarial examples. If a model has higher error rate, would take smaller perturbations move correctly classified samples to misclassified areas.
vulnerable than one trained
that many test samples, though correctly classified,
Samples
Original
DeepFool
CW-TTa
Boundary
LocalSearch
1st Original
477.6
465.2
481.1
477.7
465.4
407.2
474.5
470.4
472.3
463.5
482.5
-64.5
-40.8
-378.8
-082.5
-40..8
-473.8
-850.0
-41.00
-699.2
DeepFool
243.4
-306.4
-172.4
-394.1
-38.3
-181.0
243.5
-944.2
-107.7
-524.1
CW-L2
175.9
-244.9
-486.4
-287.5
-500.8
-257.6
-409.5
-233.5
-174.3
176.5
Boundary -58.5
11.5
205.7
-149.7
-41.11
-308.0
-356.3
205.8
-223.3
-250.3
LocalScarch
180.4
-225.3
-481.9
-281.3
498.9
-223.2
-378.8
-257.9
-143.1
189.9
Table 4: Full logits of the adversarial examples generated with different attacks. The original image the first sample of class 0 of MNIST test set. 'hee first row gives the 1t percentile thresholds, and the second row shows the logits of the original image. The largest logits marked in bold.
Adversarial examples with more confidence Based on the observations above, natural question should ask is: generate adversarial examples with not only successfully flipped logits,

---

Under review as a conference paper at ICLR 2020
MNIST
CIFARIO
Attacks
1st Per.
2nd Per.
1st Per.
2nd Per.
DeepFool
98.00%
98.60%
61.10%
64.30%
Boundary
100%
100%
100%
100%
LocalSearch
99.90%
100%
88.80%
93.10%
Table 5: Detection rates of our rejection policies. We perform untargeted adversarial evaluation on the first 1000 images of test sets. CW-L2 is not involved here, but carefully investigated below.
but also the largest logit larger than some threshold value? Unlike the conservativeness on paying more distortions of other attacks, CW attack allows us control the gap between largest and second largest logits with some confidence value k.
{0, 500, 1000} (Tab. 6). We find that in- creasing the confidences help increasing the largest logits of adversarial examples to some extent, but may lead to failures of generation. The sensitivity to confidence values is also different given different targets. The success rates of generating adversarial examples monotonically decreases with the confidences increasing (Tab. 7]. Note that on discriminative counterparts, CW-T.2 with the same settings easily achieves 100% success rates. This means that explicitly forcing data representations form clusters with maximum margins between them help increase average distances between normal samples and the nearest misclassified areas, thus increase the hardness of finding minimal adversarial perturbations In this case, takes a large enough adversarial perturbation move sample from its cluster to the other. Meanwhile, detection rates remain satisfactory on MNIST, but obviously decline on CIFARIO. R10. For victim generative classifiers in (Li et al. 2018) under CW-L2 attack, the detection rates of adversarial examples using the proposed detection methods can be 95% on MNIST, but fall < 50% on even CIFAR 10-binary (their models don't scale on CIFAR and CW-L2 with non-zero confidences are also not evaluated).
We perform targeted CW attacks with confidences
1st Per.
477.6
465.2
481.1
477.7
465.4
407.2
474.5
470.4
472.3
463.5
O
O
O
O
6
O
O
K =
482.5
105.0
283.9
189.4
-76.8
230.4
151.5
-9.5
138.6
137.5
O
O
O
O
O 341.4
8 = 500
482.5
448.5
395.2
80.4
406.0
378.3
293.3
K = 1000
482.5
435.8
480.0
259.1
328.9
448.7
355.2
Table 6: Adversarial examples generated with targeted CW with different confidences. The original image the fist sample of class The first gives the /st percentile thresholds. Below the images are the logits corresponding to the given targets. "_" denotes failure of generation.
MNIST
CIFARIO 2nd Per:
Attacks
1st Per.
2nd Per.
success rate
1st Per.
success rate
CW-L2(N = 0)
100%
100%
84.65%
93.93%
94.80%
70.84%
CW-L2(K = 500)
99.78%
99.78%
76.61 %
76.55%
84.07%
61.26 61.26%
CW-L2(K = 1000)
90.24%
95.98%
45.56%
47.86%
75.13%
48.86%
Table 7: Targeted adversarial evaluations results of our rejection policies the first 1000 test sam- ples. We report the detection rates with different thresholds and success rates of generating adver- sarial examples.
Discussions on off-mmaniolld conjecture Gilmer et al. (2018) challenges whether the off off-manifold conjecture holds in general. They experiment synthetic dataset-two high-dimensional concentric
8

---

Under review as a conference paper at ICLR 2020
spheres with theoretical analyses, showing that even for trained classifier with close zero test ror, there may be a constant fraction of the data manifold misclassified, which indicates the existence of adversarial examples within the manifold. But there still several concerns to be addressed: First, as also pointed out by the authors, the manifolds in natural datasets can be quite complex than that of simple synthesized dataset. |Fetaya et al. (2019) draws similar conclusion from analyses synthesized data with particular geometry. So the big concern is whether the conclusions in Gilmer al.) (2018); Fetaya al. (2019) still hold for the manifolds in natural datasets. A practical ob- stacle to verify this conclusion is that works modeling the full generative processes are based on manifold assumption, but provide no explicit manifolds for analytical analyses like Gilmer et al. 20188) Fetaya al. (019). While SDIM enables explicit and customized manifolds on high-level data representations via probabilistic constraints, thus enables analytical analyses. In this paper, samples of different classes are trained to form isotropic Gaussians corresponding to their classes in representation space (other choices are possible). The relation between the adversarial robustness and the forms and dimensionalities of data manifolds is to be explored. Second, in their experi- ments, all models evaluated are discriminative classifiers. Considering the recent promising results of generative classifiers against adversarial examples, would using generative classifiers lead to dif- ferent results? One thing making us feel optimistic is that even though the existence of adversarial examples inevitable, Gilmer et al. (2018) suggest that adversarial robustness can be improved by minimizing the test errors, which is also supported by our experimental differences on MNIST and CIFARIO.
CONCLUSIONS
We introduce supervised probabilistic constraints DIM. Giving up the full generative process, SDIMs are equivalent to generative classifiers on high-level data representations. Unlike full condi- tional generative models which achieve poor classification performance even on CIFARIO, SDIMs attain comparable performance the discriminative counterparts complex datasets. The training of SDIM is also computationally similar to discriminative classifiers, and does not require pro- hibitive computational resources. Our proposed rejection policy based off-manifold conjecture, a built-in property of SDIM, can effectively reject illegal inputs including OoD samples and ad- versarial examples. We demonstrate that likelihoods modeled on high-level data representations, rather than raw pixel intensities, are more robust on downstream tasks without the requirement of generating real samples.

---

Under review as a conference paper at ICLR 2020
REFERENCES
Mohamed Ishmael Belghazi, Aristide Baratin, Sai Rajeswar, Sherjil Ozair, Yoshua Bengio, Aaron Courville, and R Devon Hjelm. Mine: mutual information neural estimation. arXiv preprint arXiv:/80J.04002 2018.
Wieland Brendel, Jonas Rauber, and Matthias Bethge. Decision- adversarial attacks: Reliable attacks against black-box machine learning models. arXiv preprint /ttl::://222444444 2017.
Andrew Brock, Jeff Donahue, and Karen Simonyan. Large scale gan training for high fidelity natural image synthesis. arXiv preprint arXiv: 1096, 2018.
Han Cai, Ligeng Zhu, and Song Han. Proxylessnas: Direct neural architecture search on target task and hardware. arXiv preprint arXiv:1812.003332 2018.
Nicholas Carlini and David Wagner. Defensive distillation is not robust to adversarial examples. arXiv preprint arXiv:1607.0433 2016.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy (SP), pp. 39-57. IEEE, 2017.
Hyunsun Choi and Eric Jang. Generative ensembles for robust anomaly detection. arXiv preprint 39, 2018.
Monroe D Donsker and SR Srinivasa Varadhan. Asymptotic evaluation of certain markov process expectations for large time. iv. Communications Pure and Applied Mathematics, 36(2):183- 212, 1983.
Ethan Fetaya, Jacobsen, and Richard Zemel. Conditional generative models are not robust. arXiv preprint /901v/9996.0/// 171, 2019.
Yonatan Geifman and Ran EI- Yaniv. Selective classification for deep neural networks. In Advances in neural information processing systems, pp. 4878-4888 2017.
Justin Gilmer, Luke Metz, Fartash Faghri, Samuel S Schoenbolz, Maithra Raghu, Martin Watten- berg, and Ian Goodfellow. Adversarial spheres. arXiv preprint arXiv:1801.02777 2018.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.
Kathrin Grosse, Praveen Manoharan, Nicolas Papernot, Michael Backes, and Patrick McDaniel. On the (statistical) detection adversarial examples. arXiv preprint arXiv:1702.06288 2017.
Shixiang Gu and Luca Rigazio. Towards deep neural network architectures robust to adversarial
examples. arXiv preprint arXiv:1412.5068, 2014.
Michael Gutmann and Aapo Hyvärinen. Noise-contrastive estimation: new estimation principle for unnormalized statistical models. In Proceedings of the Thirteenth International Conference on Artificial Intelligence and Statistics, pp. 297-304, 2010.
Dongyoon Han, Jiwhan Kim, and Junmo Kim. Deep pyramidal residual networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 5927-5935, 2017.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference computer vision and pattern recognition, pp- 770-778, 2016.
R Devon Hjelm, Alex Fedorov, Samuel Trischler, and Yoshua Bengio. Learning deep representations by mutual information estimation and maximization. arXiv preprint I 1808. 0667006670 2018.
Karan Grewal, Phil Bachman, Adam
Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 4700-4708, 2017.
10

---

Under review as a conference paper at ICLR 2020
Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014.
Diederik P Kingma
and and Max Welling. Auto-encoding variational Bayes. In International Conference on Learning Reprexentations, 2013.
Durk P Kingma and Prafulla Dhariwal. Glow: Generative flow with invertible Ixl convolutions, In Advances in Neural Information Processing Systems, pp. 10215-10224, 2018.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world.
arXiv preprint 160i 167.0033, 2016.
Yingzhen Li, John Bradshaw, and Yash Sharma. Are generative classifiers more robust to adversarial attacks? arXiv preprint arXiv: 1802.0655, 2018.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks, arXiv preprint wrXiv:1706.06085 2017.
Alireza Makhzani, Jonathon Shlens, Navdeep Jaitly, Ian Goodfellow, and Brendan Frey. Adversarial autoencoders. arXiv preprint 1 2015.
Seyed-Mohsen Gbosavi-Dezfooli Alhussein Fawzi, and Pascal Frossard. Deepfool: simple and accurate method fool deep neural networks. In Proceedings of the IEEE conference on com- puter vision and pattern recognition, pp. 2574-2582, 2016.
Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, Dilan Gorur, and Balaji Lakshminarayannnn Do deep generative models know what they don't 't know? arXiv preprint arXiv: 18000:18/0. 2018.
Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, Dilan Gorur, and Balaji Lakshminarayanan. Hybrid models with deep and invertible features. arXiv preprint arXiv:1902.0276: 2019.
Nina Narodytska and Shiva Prasad Kasiviswanathan. Simple black-box adversarial perturbations for deep networks. arXiv preprint 1rXiv:1612.06229, 2016.
Andrew Y Ng and Michael I Jordan. On discriminative vs. generative classifiers: A comparison of logistic regression and naive bayes. In Advances in neural information processing systems, pp- 841-848, 2002.
XuanLong Nguyen, Martin J Wainwright, and Michael Jordan. Estimating divergence functionals and the likelihood ratio by convex risk minimization. IEEE Transactions on Information Theory, 56(11):5847-581, 2010.
Sebastian Nowozin, Botond Cseke, and Ryota Tomioka. f-gan: Training generative neural samplers using variational divergence minimization. In Advances neural information processing systems, pp. 271-279, 2016.
Aaron van den Oord, Yazhe Li, and Oriol Vinyals. Representation learning with contrastive predic- tive coding. arXiv preprint 1rXiv.1807.037444 2018
Danilo Jimenez Rezende, Shakir Mohamed, and Daan Wierstra. Stochastic backpropagation and ap- proximate inference deep generative models. In International Conference on Machine Learn- ing, pp. 1278-1286. 2014.
Tim Salimans, Andrej Karpathy, Xi Chen, and Diederik P Kingma. Pixelcnn++: Improving the pixelenn with discretized logistic mixture likelihood and other modifications. arXiv preprint arXiv: m00::000000555/ 2017.
Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-gan gan: Protecting classifiers against adversarial attacks using generative models. arXiv preprint arXiv: 11805006603 2018.
Lukas Schott, Jonas Rauber, Matthias Bethge, and Wieland Brendel. Towards the first adversarially robust neural network model on mnist. arXiv preprint arXiv: a 1805.09190, 2018.
11

---

Under review as a conference paper at ICLR 2020
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.15580 2014.
Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman. Pixeldefend: Leveraging generative models to understand and defend against adversarial examples. arXiv preprint arXiv: 10766, 2017.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXivv1312.661 2013.
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, lan Goodfellow, Dan Bonch, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and defenses. arXiv preprint arXiv:/705.077 2017.
12

---

Under review as a conference paper at ICLR 2020
A CLASSIFICATION WITH REJECTION
A very related work to our paper is Nalisnick et al. 2019). which propose a hybrid model modeling distribution of features p(features) and predictive distribution p(targets features) at the same time. Normalizing flow is used to learn invertible features as inputs of discriminative model, i.e. predictive distribution, and provides evaluation of features x². Inputs out the training data distribution are rejected by setting threshold for p(æ"). ). For SDIM, illagel inputs are rejected by setting thresholds for each of the class conditional. The class conditionals are modeled on the data representations from encoder regularized by MI loss JMI- The hybrid model in Nalisnick al. (2099) successfully
distinguish in- ri-distribution dataset and OoD dataset. While SDIM reject illegal inputs including OoD dataset samples and adversarial examples with more fine-grate tne-grained class conditionals.
Geifman & EI- Yaniv (017)) propose a selection method to perform selective classification with desired risk level given trained model, but they focus on discriminative models.
B EVALUATION DETAILS
B.1 DATA PROCESSING
MNIST, FashionMNIST: All images resized to 32 X 32 from 28 x 28. We scale the images pixels to [0, 1). and normalization is not used for fair comparisons with the baselines in (Li et al. 2018).
CIFAR1O, SVHN: We follow the simple data augmentation in (He et al. 2016) for training: 4 pixels are padded on each side, and a 32 x 32 crop is randomly sampled from the padded image or its horizontal flip. For testing, only evaluate the single view of the original 32 x 32 image. All image pixels are also scaled to [o, 1].
No other data augmentations or processings are used except for the explicitly listed above.
B.2 MODELS AND TRAINING SETTINGS
MI computation The local MI JMI is computed between the 4 x 4 feature maps and the encoder outputs. We use lower-bound of Jensen-Shannon divergence to estimate the MI IJSD X Y), and leave other lower-bounds unexplored. In practice, we find using other bounds would take more computational resources. However, we think better results can be expected using these bounds according to the experimental results reported in Hjelm et al. 2018).
MI evaluation network Following Hjelm et al. 2018). we parameterize the MI evaluation net- work Ta as convolutional neural network with architecture:
Operation
Size
Activation
Input + 1 x 1 conv 1 conv 1 1 1
256
ReLU
256
ReLU
Table 8: Local MI evaluation concat-and-convolk network architecture.
The input of To is positive negative pair of local feature map Lz(x) and encoder output Ex(x). The positive pairs, samples from the joint distribution, are constructed by concat the encoder output Eø(w) and the corresponding feature map Læ(x) of the given batch. The negative pairs, samples from product of marginals, can be constructed by Fx(2x) and shuffled I.g (m: along the batch-axis.
y = 1 in our experiments. The constant K in the likelihood margin loss JIM is 10. All models trained 500 epochs, and we always save the checkpoints reporting the minimum ongoing training losses for evaluation. We use optimizer Adam (Kingma & Bal 2014) with default learning rate 0.001.
Optimization We set a = 8
13

---

Under review as a conference paper at ICLR 2020
C ADDITIONAL RESULTS OF OUT-OF-DISTRIBUTION DETECTION
In
Fastioeeic
out
DUT
out
out
OUR
MMST
PcskamiiiST clou
NochietWWs coss
Ko ckep
Figure 2: Class-wise distributions of the class conditionals of both in-distribution samples and out- of-distribution samples. The in-out distribution pair is FeshioMMNIST-MNIST.
in
in CLE
out
OLt
cut
CEARID-daess
(FARLO
Figure 3: wlass-wise distributions of the class conditionals of both in-distribution samples and out- of-distribution samples. The in-out distribution pair is CIFARIO-SVHN.
D ADDITIONAL RESULTS OF ADVERSARIAL EVALUATIONS
D.1 ROBUSTNESS AGAINST ATTACKS USING CROSS-ENTROPY
We make comparisons between SDIM and GBZ (Li et al. 2018), which consistently performs best in Deep Bayes.
FGSM and PGD-Txcc The results in Fig and Fig show that SDIM performs consistently better than the baseline. We find that increasing the distortion factor of FGSM has influences of SDIM's accuracy, and the adversarial examples keep the same. Recall that the class conditionals optimized to keep considerable margin. Before evaluating the cross entropy loss, softmax is applied on the class conditionals log fogp(#)c) to generate a even sharper distribution. So for the samples that are correctly classified, their losses are numerically zeros, and the gradient on inputs V. y) are also numerically zeros. The PGD-Loc we use here is the randomized version (Madry al. 2017 which adds a small random perturbation before the iterative loop. The randomness originally introduced to generate different adversarial examples for adversarial training, but here it breaks the zero loss so that the gradient on inputs V.Ja (æ, y) will not be zeros in the loop. FGSM can also be randomized (Tramèr al. 2017), which can be seen one-step variant of randomized PGD.
We use cleverhans in this evaluation. There are two types of implementations in cleverhans. By default rand_ini jnit is set to True, the PGD is randomized. If nand init is False, then the implementation is Basic Iterative Method (Kurakin 2016)
14

---

Under review as a conference paper at ICLR 2020
This phenomena is similar to what some defenses using gradient obfuscation want achieve. De- fensive distillation (Carlini & Wagner 2016) masks the gradients of cross-entropy by increasing the temperature of softmax. But for CW attacks, which do not cross-entropy, and operate on logits directly, this could be ineffective.
FGSM L.
PGD Lm
7 2
7 2
1.0
1.0
0.8
7 2
0.8
7
2
7 2
7 2
0.6
0.6
7 2
7
2 Z
0.4
0.4
SDIM
7 2
SDIM
7
0.2
GBZ
0.2
GBZ
7 2
7
2
0.0
0.0
0.1
0.2
0.3
0.4
0.5
0.2
0.3
0.4
0.5
Figure 4: The adversarial classification accuracies of SDIM and GBZ on MNIST under FGSM-L. Lo and PG attacks. On the right are the generated adversarial examples with from 0 to 0.5.
FGSM L..
PGD L..
1.0
1.0
SDIM
0.8
0.8
GBZ
Adv Ace
0.6
0.6
0.4
0.4
SDIM
0.2
GBZ
0.2
0.0 0.0
%
0.05
0.1
0.2
0.3
0.05
0.3
Figure 5: The adversarial classification accuracies of SDIM and GBZ CIFARIO under FGSM- Loo and PGD-Loc attacks. On the right are the generated adversarial examples with e from 0 to 0.5.
D.2 ADVERSARIAL EXAMPLES OF CIFAR10
Samples
original
deepfool
cw-T-2
houndary
ISMA
1st Per.
408.6
396.6
375.9
378.4
363.3
376.7
409.4
383.0
397.1
412.2
original
424.2
-386.1
-379.2
-319.8
-370.2
-357.2
-356.9
-259.3
-291.9
-239.0
DeepFool
153.4
-391.6
-344.1
-262.6
-376.1
-345.9
215.1
-306.5
-244.3
-326.4
CW-L2
129,9
-555.3
235.4
-353.1
-471.6
-400.3
-342.7
-367.2
-486.4
-326.4
Boundary
213.9
-417.4
-458.3
-548.0
-587.4
-236.3
214.0
-1246.1
-171.2
-555.6
LocalScarch
165.2
-485.7
190.9
-325.6
-439.0
-379.0
-318.8
-327.5
-357.9
-272.3
Table 9: Full logits of adversarial examples generated with different attacks. The original image is the fist sample of class 0 of CIFAR10 10 test set. The first row gives the 1t percentile thresholds, and the second row shows the logits of the original image. The largest logits are marked bold.
15


Reviews:
[{"review_id": "rkxXYzgb9r", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper studies classification problems via a reject option. A reject option could be useful in prediction problems to handle Out-of-distribution examples. The classification procedure studied in this paper builds on three components 1. An auto-encoder that obtains a latent low-dimensional representation of the data point 2.  A generative model that models the class-conditional probability model and 3.  a margin based loss function that learns a classifier that provides a large probability mass to the class-conditional distribution corresponding to the correct class.  The final decision procedure is to reject an input if the best class conditional probability is small and to use the class corresponding to the best class conditional probability otherwise. \n\nOn the whole I like the paper and think that the problem tackles an important problem. I have a few comments\n1. I would like to see what is the log-likelihood assigned by the proposed procedure on OOD samples and would like to see a comparison of the log-likelihood assigned by other procedures.", "extra_scores": {"experience_assessment": "I do not know much about this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "N/A"}, "extra_text": {}}, {"review_id": "SylJmNTn5H", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper proposes a scalable approach to train generative classifiers using information maximizing representation learning, with the motivation that generative classifiers could be more robust to adversarial attacks than discriminative classifiers. An off-the-shelf mutual information maximizer (MINE, DIM) is used to learn low-dimensional representations of images. Then, class-conditioned generative models of the representations are learned avoiding full generative modeling of the images. An additional loss is used to train the generative classifier which maximizes likelihood margins. Finally, percentile-based thresholds of the class log-probabilities is proposed to be used to reject classification for out-of-manifold inputs.\n\nThe paper cites existing literature which indicates that generative classifiers might be more robust to adversarial attacks, and uses recently-proposed representation learning techniques to scale up learning generative generative classifiers. The motivation of the proposed technique is clear, and the problem itself is relevant. Similar prior work use generative modeling at the pixel-level. Generative modeling of representations is novel, afaik.\n\nThe technique is evaluated on out-of-distribution sample detection (FashionMnist->MNIST and Cifar10->SVHN) and adversarial attacks. FGSM, PGD, CW-L2 attack, deepfool.\n\nThe experiments section is not very clearly written. Some of the evaluation itself is nonstandard in which only the first example of digit 0 of MNIST is used. The paper needs to have a clearer explanation and interpretation of the results. It’s not clear what the logits in table 4 and table 6 are, and what is being shown by the comparison.\n\nSummary: The authors propose a new technique for training generative classifiers with the aim to improve robustness to adversarial attacks and confidence on out-of-distribution samples. The method is well-motivated and explained, but the experiment section is not very clearly written and I’m not confident whether the technique represents an advancement in the state-of-the-art or not.\n\nMisc comments:\n\n“By adopting a generative approach p(x, y) = p(y)p(x|y), we assume that the data follows the manifold assumption: the (high-dimensional) data lies on low-dimensional manifolds corresponding to their class labels.”\n\nThis sentence seems to be making a stronger claim than is needed, which is possibly incorrect. Assuming a generative approach doesn’t require assuming the manifold assumption. \n\nNit: “possible MI low-bounds”\nNit: “state-of-the-arts”\nTypo: “The original image is the fist sample of class 0”\n", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_checking_correctness_of_derivations_and_theory": "N/A", "review_assessment:_checking_correctness_of_experiments": "I did not assess the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper."}, "extra_text": {}}, {"review_id": "Syeg3q4AtH", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper proposed a supervised method for robust classification. By utilizing mutual information constrain on the encoder, supervised probabilistic constraint on the class conditional probability, and introducing a margin to the maximum likelihood, the proposed method can manage a high classification accuracy and detect the out of distribution data. \n\nThe motivation is good, the writing is OK. The structure of the paper needs to be refined.  The experiments are not very strong. Several concerns are listed:\n\n1.\tIt will be better if the author can show a structure map for Encoder, classification, class condition embedding, and mutual information evaluation networks, to clarify their relationships.\n2.\tIn Table 2, what is the accuracy for the rejection (outlier detection)?\n3.\tThe choose of the threshold for rejection is tricky. It will be better if the author can provide some rules for choosing the threshold which can be generalized to a new dataset.\n4.\tThe overall loss functions have three components, what is the contribution of different components to the final performance experimentally?\n5.\tThe architecture for encoder is large. Is it proper for Mnist which is a relatively simple dataset?\n6.\tThe comparison talked in the paragraph “Is Fully Generative Model Necessary for Generative Classification”, are these accuracies obtained from a comparable network size? It only makes sense if they are obtained using a comparable parameter size.\n", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper combines a well-known, recently proposed unsupervised representation learning technique technique with a class-conditional negative log likelihood and a squared hinge loss on the class-wise conditional likelihoods, and proposes to use the resulting conditional density model for generative classification. The empirical work appears to validate the claim that their method leads to good out of distribution detection, and better performance using a rejection option. The adversarial defense results are less clear. Reporting raw logits is a strange choice, and difficult to interpret; the table is also difficult to read, and this method of reporting makes it difficult to compare against existing methods.

The reviewers generally remarked on presentation issues. R1 asked about the contribution of various loss terms, a matter I feel is underexplored in this work, and the authors mainly replied with a qualitative description of loss behaviour in the joint system, which I don't believe was the question. R1 also asked about the choice of thresholds and the issues of fairness of comparison regarding model capacity, neither of which seemed adequately addressed. R3 remarked on the clarity being lacking, and also that "Generative modeling of representations is novel, afaik." (It is not; see, for example, the VQ-VAE line of work where PixelCNN priors are fit on top of representations, and layer-wise pre-training works of the mid 2000s, where generative models were frequently fit on greedily trained feature representations, sometimes in conjunction with a joint generative model of class labels).  R2's review was very brief, and with a self-reported low confidence, but their concerns were addressed in a subsequent update.

There are three weaknesses which are my grounds for recommending rejection. First, this paper does a poor job of situating itself in the wider body of literature on classification with rejection, which dates to at least the 1970s (see Bartlett & Wengkamp, 2006 and the references therein). Second, the empirical work makes little comparison to other methods in the literature; baselines on clean data are self-generated, and the paper compares to no other adversarial defense proposals. In a minor drawback, ImageNet results are also missing; given that one of the purported advantages of the method is scalability, a large scale benchmark would have strengthened this claim. Third, no ablation study is undertaken that might give us insight into the role of each term of the loss. Given that this is a straightforward combination of well-understood techniques, a fully empirical paper ought to deliver more insight into the combination than this manuscript has.
Decision: Reject