Improving robustness of softmax corss-entropy loss via inference information
Authors: Bingbing Song
Wei He
Renyang Liu
Shui Yu
Ruxin Wang
Mingming Gong
Tongliang Liu
Wei Zhou
Venue:  (2021)
Keywords: Adversarial defense
Loss function
Neural networks robustness

Abstract: Adversarial examples easily mislead the vision systems based on deep neural networks (DNNs) trained with the softmax cross entropy (SCE) loss. Such a vulnerability of DNN comes from the fact that SCE drives DNNs to fit on the training samples, whereas the resultant feature distributions between the training and adversarial examples are unfortunately misaligned. Several state-of-the-arts start from improving the inter-class separability of training samples by modifying loss functions, where we argue that the adversarial examples are ignored and thus limited robustness to adversarial attacks is resulted. In this paper, we exploit inference region which inspires us to involve a margin-like inference information to SCE, resulting in a novel inference-softmax cross entropy (I-SCE) loss, which is intuitively appealing and interpretable. The inference information is a guarantee to both the inter-class separability and the improved generalization to adversarial examples, which is furthermore demonstrated under the min-max framework. Extensive experiments show that under strong adaptive attacks, the DNN models trained with the proposed I-SCE loss achieve superior performance and robustness over the state-of-the-arts.

Under review as a conference paper at ICLR 2021
IMPROVING ROBUSTNESS OF SOFTMAX CORSS- ENTROPY LOSS VIA INFERENCE INFORMATION
Anonymous authors Paper under double-blind review
ABSTRACT
Adversarial examples easily mislead the vision systems based on deep neural net- works (DNNs) trained with the softmax cross entropy (SCE) loss. Such a vulner- ability of DNN comes from the fact that SCE drives DNNs to fit on the training samples, whereas the resultant feature distributions between the training and ad- versarial examples are unfortunately misaligned. Several state-of-the-arts start from improving the inter-class separability of training samples by modifying loss functions, where we argue that the adversarial examples are ignored and thus lim- ited robustness to adversarial attacks is resulted. In this paper, we exploit infer- ence region which inspires us to involve a margin-like like inference information to SCE, resulting in novel inference-softmar cross entropy (I-SCE) loss, which is intuitively appealing and interpretable. The inference information is guarantee to both the inter-class separability and the improved generalization ial examples, which is furthermore demonstrated under the min-max framework. Extensive experiments show that under strong adaptive attacks, the DNN models trained with the proposed I-SCE loss achieve superior performance and robustness over the state-of-the-are
adversar-
INTRODUCTION
Although deep neural networks have achieved state-of-the-art performance on various tasks (Szegedy et al., 2015; Zagoruyko Komodakis 2016; He et al.] 2015 Huang et al.. 2016 Larsson iet (016)). it is recently shown that adversarial examples by adding imperceptible disturbances are not hard to fool well-trained neural networks (Szegedy et al. 2014 Goodfellow et al. 2015).
leading to malfunction in intelligent systems such as image classification (Goodfellow et al. 2015
Szegedy al.] 2014). natural language processing (Jia & Liang 2017] Carlini & Wagner 2018),
and autonomous driving (Liu et al. 2019; Chernikova et al., 2019). The vulnerability to adversar- ial attacks indicates that the neural networks do not convey proper feature representations and may overfit on the training samples which are even of large amounts (llyas et al., 2019). A reason of this issue is about the loss function used in training. Take the softmax cross entropy (SCE) loss as an example, which is widely adopted in regressing probabilities and is a core building block for high performance. The neural networks trained with SCE are shown to be limited in robustness to input perturbation, hence being suboptimal in real applications where adversarial attacks exist (Carlini & Wagner| 2017 Goodfellow et al. 2015 Kurakin et al. 2017b Moosavi-Dezfooli et al. 2016 Papernot et al. 2016a)).
The above issue brings many attempts that optimize SCE to enhance the robustness and anti-attack properties of neural networks (Sun et al. 2014, Schroff al. [015 Wen et al., 2016; Wan et al.) 2018 Pang et al., 2020). These methods follow the same principle that they minimize the losses to maximally fit the training examples. However, the adversarial examples have a misaligned dis- tribution with the training data, meaning that the fitted models in training could be repellent to the adversarial data [llyas et al. 2019). In fact, given a well-trained model, the distribution difference between the training and adversaria data is blind region to the model, where we term the infer- ence region. The samples in this region are expected to be generalizable by the well-traine model, which is not the case in existing methods, resulting in the vulnerability of neural networks (Szegedy jet al. 2014). The reason why this region exists, according to our analyses, is that the model overfits on the training data even when large amounts of data is accessible in training and the adversarial data

---

Under review as a conference paper at ICLR 2021
is clearly absent. Hence, how to generalize the samples in this region still remains unresolved. Unfortunately, the above methods fail to take this fact into consideration.
In this paper, exploit the inference region between the distributions of training data and adver- sarial examples. This region guides us to develop an inference schema which imposes a margin- like inference information the predicted logit of the network. Based this, we propose an inference- softmax cross entropy (I-SCE) loss. In this loss, the inference information is intuitively regarded as an additive term imposed on the prediction, which is extremely easy implement and appealing. We further show the robustness of I-SCE under the Min-Max framework. Under severe adversarial attacks, I-SCE still maintains high accuracy and robustness, and has better resistance. The experi- ments on MNIST and CIFARIO demonstrate that the proposed loss produces improved effectiveness and robustness compared with the state-of-the-aae methods.
2 RELATED WORK
Adversarial attacks exist widely in open environment, imposing critical robustness demand of neural networks to the security quality and the overall performance of systems. Therefore, how to design an anti-attack and robust neural network has attracted the interest of many researchers, which are briefly reviewed in this section.
Szegedy al. (2014) first proposed the concept of adversarial examples and employed the L-BFGS method as the solver of a disturbed problem to mislead neural networks. Goodfellow et al. (2015) proposed the Fast Gradient Symbol Method (FGSM) to generate adver- sarial examples with single gradient step. Before backpropagation, FGSM was used to perturb the input of the model, which was an early form of adversarial training. MMosavi-Dezzooll et al. (2116) proposed the DeepFool which calculated the minimal necessary disturbance and applied to construct adversarial examples. By imposing the Eg regularization to limit the disturbance scale, DeepFool achieved good performance. After this, Madry et al. (2018) proposed the projected gra- dient descent (PGD) attack which had a strong attack strength, and was used in adversarial training to improve robustness. Recently, Guo et al.) (2019) developed a local searching- based technique to construct a numerical approximation of the gradient, which was then used to perturb small part of the input image.
Adversarial attack:
The features of adversarial examples could follow a different distribution from the clean training data, making the defense progress very difficult. Distillation temperature was used to stabilize the gradient during training. thereby reducing the sensitivity of the model to disturbances (Papernot et al., 2016b). Metzen et al. (2017) introduced a novel model to detect adversarial examples. [Chen et al. (2017) injected annealing noise into the softmax function during training alleviate the early saturation problem of softmax loss. Xie et al. (2018) proposed the use of random resizing and random padding on images for defense. Ross& & Doshi-Veless (2018) and Yan ct al. (2018) proposed to regularize the gradients during training to improve the model robustness. Farnia et al. (2019) used spectral regularization as the gradient penalty which was combined with adversarial training to alleviate vulnerability. In addition, data augmentation (Zhang et al.] 2018 typical option enhance the generalization ability of neural networks and to reduce the risk of overfitting on training data. However, this option could not completely solve the problem of adversarial attack which always generated new kinds of adversarial examples. As a top performer, the adversarial training (AT) achieved advanced robustness in different adversarial attack environments (Kurakin al.] 2017a| Miyato et al. 2017; Madry et al. 2018; [inha et al. 2018 Najafi et al., 2019; Shafahi et al. 2019). By using extra adversarial examples, it enabled the model to learn more generalizable feature representations. The AT mechanism accepted various losses and regularizers, and was a powerful tool to resist attacks. Despite of this, AT might sacrifice the performance on clean input and was computationally expensive (Xie et al., (019).. [Schmidt et al. 2018) showed that the sample complexity of robust learning might be much larger than standard learning.
Adversarial defense:
Hendrycks al. 2020)
Robust loss functions: Lots of studies have been conducted to improve the widely used SCE loss function, most of which focused on encouraging higher intra-class compactness and greater separa- tion between classes. The comparing loss (Sun al. 2014) and the triplet loss (Schroff et al. 2015) were proposed to improve the internal compactness of each class which, however, suffered from the slowed training process and the unstable convergence. Center loss (Wen et al. 2016) avoided
2

---

Under review as a conference paper at ICLR 2021
the problem of slow convergence and instability by minimizing the Euclidean distance between fea- tures and the corresponding class centers, but the resultant robustness was not satisfactory. [Luu et al. (2016) converted the softmax loss to the cosine space, and proposed that the angular distance margin favoured high intra-class compactness and inter-class separability. WWan et al. (2018) proposed the large-margin Gaussian Mixture loss, which used the Gaussian mixture distribution ing data and increased the distance between feature distributions of different classes. Pang et al. (2020) proposed the Max-Mahalanobis center (MMC) loss to induce dense feature regions, which encouraged the model to concentrate on learning ordered and compacted representations.
fit the train-
Different from the previous works which improve the loss function to better fit the data distribution, the proposed method (i.e. I-SCE) is much simple and interpretable way to enable the neural networks to learn freely. Moreover, we advocate that I-SCE encourages the models to be more generalizable with respect to the adversarial data instead of being overfitting on the training data.
3 METHODS
In this section, we introduce the inference-softmax cross entropy loss by first presenting the defini- tion of inference region, which motivates us to develop an inference schema.
3.1 INFERENCE REGION
Current neural networks tend to overfit on the by-hand clean training data which, however, cannot work out a robust model and instead, makes them vulnerable to adversarial attacks. We advocate that this scenario is caused by the misaligned distribution between the clean training data and the adversarial data, and overfitting prevents the model to be tolerant to input perturbations. The distri- bution difference is termed as inference region, which characterizes why adversarial examples are outliers the neural networks trained on clean data. Given Figure as illustration, the features of adversarial examples reside outside the feature space of training examples, whereas the decision boundary specified by the well-trained model closely fit the training data area. Considering that the type of adversarial attack incrementally appear in real scenarios, the decision boundary in Figure aa) is not good enough to give the right prediction, even if several kinds of input perturbation are involved in training. Instead, adversarial attacks are assumed to result in an isotropic expansion of the feature space, where the expanded region is the inference region as shown in Figure b). Then, our task is to encourage the model generalizable to this region.
The softmax cross entropy (SCE) loss is a typical loss function used in training deep models, which imposes a hard constraint on the label of the input, i.e. regressing the probability of 1 on the cor- rect label and the probability of O on the incorrect labels (generally in the case of one-hot label representation). Unfortunately, the hard constraint, cess in training, and on the other hand, makes the resultant model over-confident on the predictions, hence bringing the issue of vulnerability. This has already been mentioned in the literatures of label smoothing (Szegedy et al.] 2016: Papernot et al., 2011bb) Müller et al. 2019 Pereyra et al.) 2017] Zou et al., 2019), which solves the problem by designing a soft label or soft output distribution, T.e. regressing the probabilities of - e and e/ K on the correct and incorrect labels, respectively, where K is the number of task labels. We give an intuitive explanation of the above discussion in Figure (a) and Figure b). As seen, the SCE encourages the label regression from one side along the 0-1 axis, whereas the label smoothing drives the regression from both sides around the target probabilities.
one hand, causes a difficult regression pro-
Besides, we also identify that the margin- idea in SCE is similar the label smoothing. Specif- ically, the soft label implies a margin between the true distribution and the soft output distribution. Considering that softmax tributions can induce a margin between features in the logit layer of neural network, as in the ArcFace loss (Deng et al. 2019). From Figure (c)), we see that ArcFace pushes regression towards the target angles from both sides in a circle axis.
monotonically increasing function, margin between the label dis-
While the above analyses inform us that the regression is performed from either one side or both sides, here, propose alternative definition of soft label which could be regressed from arbitrary directions in feature space. Specifically, we free the circle constraint in ArcFace and impose the additive margin to the features only normalized by 1.2-norm. In this way, the resultant features
3

---

Under review as a conference paper at ICLR 2021
6
Inferenge region
x+o
(a)
(b)
Train examples feature space
Adversarial examples
Inference
Decision
feature space
feature space
boundary
The grey circle region contains the features of the clean data x, and the orange circle region contains the features of the adversarial data x + where å the adversarial perturbation. When using SCE, the optimized decision boundary is located closely the clean data area as shown in subfigure (a), whereas the expected boundary is around the adversarial data shown in subfigure (b). Considering the isotropic expansion of the space caused by adversarial perturbation, the inference region is then induced from the annular area.
Figure I: Illustration of the inference region:
Other class
Correct class
Other class
Correct class
(a)
1
0
/K
(b)
1-E
1
Other closs
Correct cless
Other
margin
margin
(c)
(d)
Figure 2: Intuitive explanation of label regression. (a) the softmax cross entropy case Which regresses the probabilities from one side. (b) is the label smooth case which regresses the soft labels from both sides. (c) the ArcFace case which regresses the targets on a circle axis feature space, i.e. encouraging the circular margins between different classses. (d) is the inference softmax cross entropy case which regresses the targets from all directions, i.e. encouraging the isotropic margins between different classes.
not necessarily located circle sphere, and on the contrary. the marge is isotropically posed around each sample in the feature space, as shown in Figure d). We will empirically demonstrate the effectiveness of this operation over the ArcFace.
By implementing this margin idea, the inference information is then contained in the margin, which could help to avoid overfitting and to improve the generalization ability of the feature repre- sentation, driving the decision boundary towards the boundary of inference region in feature space. Hence, the small perturbation of an adversarial examples not easy to cross the decision boundary, greatly alleviating the problem of vulnerability. This schema is simple, interpretable, and effective as demonstrated in experiments. In the following, we present the seerennce-sffmaa cross entropy in details.
3.2 ITFRRNCE-SOFFMAA CROSS ENTROPY
To derive robust loss for neural network training, in this section, apply the inference-schema on SCE and propose an inference-softmaxx cross entropy (I-SCE) loss, which could encourage the tolerance of the model adversarial perturbations, thus avoid overfitting.

---

Under review as a conference paper at ICLR 2021
Given k-class classification task, the posterior probability predicted by the deep model using soft- max is
ef(())
P(u' = ilz)) E,ehia
(1)
where i E [1. k] is the label candidate, and fi is the prediction function for the i-th class which specifies both the backbone and the softmax layer in typical classification network. To improve the vulnerability of SCE, we impose the inference information to the logits produced by the neural networks and propose an inference softmax
f
Pr(y/ i|x) e + Ejzz eb()))
which then induces the snferecce-sfftmaa cross entropy loss as
CM(GAA0)4H)))))11(( I-SCE E yo In CM + Ejjs efiaa)
(3)
where 1 if the ground truth label of is and otherwise 0, and 2 1 is used to scale the predication f(()) and control the gradient update rate on the right class. Note that we use yi as an indicator of the inference information, that is, and m only imposed on the right class instead of all classes. As seen, the implementation of this loss is very easy by simply adding a scalar and a constant the prediction of the right class, which is unaggressive the original training code of neural networks.
In the implementation of I-SCE, we find that the case of f. > fg.j i possibly occurs, which reduces the effect of m. To address this issue, we normalize f(x) by To to increase the numerical stabilization. During the inference process, Eq. 2 is calculated by firstly finding the index i of the maximal value (xx) among E [1, ki] and then applying 8 and m on the i-th class according to this equation. This operation does not change the class decision since s and m O.
3.3 ROBUSTNESS ANALYSIS OF I-SCE
3.3.1 EXPECTED INTERVAL. OF CORRECT CLASS
To demonstrate the robustness of I-SCE, analyze the expected intervals of the correct class pre- dicted by both I-SCE and SCE. Here, assume the minimum perturbation 5 which makes the model just misclassified. The prohability that the SCE model recognizes the adversarial sample x + 5 as the correct label i is
gh(l+0)
P(i|a + +
(4)
Regarding the I-SCE model, the probability then
Pili + d) e=f((x+d))m + Ejfz ef(a+o)
(5)
The expected intervals of the correct class by using SCE and I-SCE are defined as
L = P(ilx) P(i|x + ef(()) efilato)
(6)
Ethtl E, cls(u+o)
and
= = P((l - P)(
(=)())
(++(++))+
(+((())- EEjrehlo e=f((2+0)+m + Ejgeella+
respectively. The vulnerability of SCE to adversarial attacks states that f(r + 8) < f(x). Con- sidering that the perturbation 8 is just value that misleads the SCE model, the expected interval measures the maximal level of perturbation that the model is robust on. The larger the interval is, the more robust the model is. Starting from this point, show the following property of I-SCE:
5

---

Under review as a conference paper at ICLR 2021
now
cos
0.07
5.0
8.2
(a)
(b)
(c)
(d)
Figure 3: Performance of I-SCE under different parameter settings. The x-axis is 8, the y-axis is m, and the z-axis is the accuracy. (a) Deepfool attack on MNIST. (b) Deepfool attack on CIFARIO. (c) Untargeted PGD attack on MNIST. (d) Untargeted PGD attack on CIFAR1O.
se Se
When 2 m O, and
[ (E e 0, L1 is larger than L.
(e*f(())) Eis cf1
The condition in the above property is both theoretically demonstrated and empirically validated in Appendix A.2 This states that the robustness of I-SCE is improved compared with SCE.
3.3.2
MIN-MAX FRAMEWORK
The above robustness conclusion also applicable the Min-Max framework (Madry al. 2018), which is typical framework of adversarial attack and defense. The Min-Max framework formu- lated as
min p(0), where p(0) = E( max ((0, 6.
(8)
[JES
where 0 is the model parameter and ó is the input perturbation. The internal maximization is an attack process that finds the perturbation that maximally mislead the model 6. The external mini- mization defense process that encourages the model tolerant to such an attack. We use Pı and p to represent the objective losses by using I-SCE and SCE, respectively. Given an input perturbation and a trained model {fz}, we have when & 2 1 and m >
Pi 6) P(iæ +),
which is proven in Eq. 12 of Appendix A.2 This states that the P3 results in a lower loss than P. i.e. P1 p. Hence, the lower loss indicates the better defense performance adversarial attacks, which demonstrates the improved robustness of I-SCE.
3.4 RELATIONSHIP WITH LARGE MARGIN LEARNING
While the proposed method (I-SCE) could be viewed margin-based loss, the difference the ArcFace loss is how the margin (or inference information) is applied to the logits. ArcFace loss normalizes the features and the weights such that the resultant features are located on a hyper- sphere, and the training process regresses the class targets along the surface of the hyper-sphere. Instead, the proposed method only normalizes the features features in a free space, in which case the regression process can be performed in any direction. We advocate that freeing the sphere constraint will bring performance improvement of adversarial defencing, which is demonstrated in the experiments. The reason of the effectiveness may be that the adversarial perturbation causes a large variation the feature space. Constraining the features hyper-sphere would bring a large feature shift if the normalization direction (to the sphere) is undesirable. By contrast, the proposed method prefers isotropic tolerance to feature perturbations, hence being better.
the weights in order to locate
EXPERIMENTS
In this section, conduct series of experiments MNIST (Lecun & Bottou 1998) and CIFAR- 10 (Krizhessky & Hinton 2009) to demonstrate the effectiveness of the proposed I-SCE. The back- bone used in implementation ResNet-32 with five stages (He et al. 2016), which is optimized

---

Under review as a conference paper at ICLR 2021
Table Classification accuracy (%)
under PGD attack on MNIST.
0.02
0.04
Method
Clean
PGD10 wm
PGD10
PGD
PGD
50
PGD aM
PGD
PGD
PGD
50
SCE
99.53
64.38
16.03
0.34
0.02
15.15
4.05
0.32
0.01
Center
99.46
39.29
14.55
3.16
4.18
16.64
2.90
0.61
0.49
L-GM
99.59
54.31
34.21
2.41
0.70
20.64
13.68
0.25
0.67
ArcFace
99.43
84.03
68.34
52.12
13.08
64.50
48.73
30.75
6.03
MMC
99.45
80.87
53.26
46.06
7.69
58.63
35.35
29.76
4.45
1-SCE
99.57
85,48
70.48
63.47
12.74
68.08
49.70
46.61
6.78
Random
99.30
65.10
20.40
0.34
0.14
15.64
14.25
0.32
0.12
LS
99.54
66.88
33.99
0.37
0.02
21.69
1.25
0.36
0.01
AT
99.25
97.73
98.86
13.62
6.73
90.59
94.44
0.74
0.01
Table 2: Classification accuracy (%) under PGD attack on CIFARIO.
0.01
0.04
Method
Clean
PGD
PGD.
PGD
PGID
PGD
PGDD
PGIDO
PGD
50
50
50
50
SCE
90.45
19.00
6.74
6.17
0.02
6.29
4.28
5.56
0.01
Center
88.98
25.09
5.33
4.55
1.07
10.82
3.94
3.08
0.98
L-GM
89.02
20.39
16.04
6.47
0.24
6.84
8.04
5.04
0.20
ArcFace
90.11
31.44
34.28
9.69
0.95
8.84
23.33
3.36
1.02
MMC
89.97
31.83
20.56
10.84
1.59
16.78
15.97
4.52
1.47
I-SCE
89.09
36.95
44.86
14.82
5.26
16.86
25.50
5,51
1.95
Random
86.09
21.29
57.12
7.51
28.75
7.17
20.77
5,62
0.46
LS
90.35
20.20
5.57
6.38
0.01
6.17
4.27
5,99
0.01
AT 83.48
56.30
77.95
7.87
0.08
25.36
24.05
7.15
0.07
by using the Adam algorithm (Kingma & Ba, 2013). employ white-box attack and the black- box attack including the targeted and untargeted PGD (Madry al.) 2018). deepfool (Moosavi- Dezfooli et al. (2016), and SimBA Guo et al. 2019). We select the state-of-the-arts as competitors, such the Center Toss (Wen et al. 2016) 6). the large-margin Gaussian Mixture (L-GM) loss (Wan et al., 2018), ArcFace loss (Deng et al.] (019). the Max-Mahalanobis center (MMC) loss (Pang al. 2020), the random method (Xie et al. 2018). Label Smoothing (Szegedy 2016), and the adversarial training (AT) method (Madry et al. 2018).
4.1 ABLATION STUDIES
There are two hyper-parameters and m in the proposed I-SCE, which affects the defense perfor- mance. We set the ranges as E [1, and m E (0, 0.1], and densely evaluate the performance of I-SCE under different settings and different attacks. Figure illustrates the results, from which we see that the performance highly correlated with the settings, the attack types, and the datasets. Therefore, to get better robustness, the parameters need to be reset in different tasks by using small validation set. the following experiments, make fair comparison, we set s and m 0.1.
F
4.2 COMPARISON WITH STATE-OF-THE-AREE
PGD attack: The PGD attack is a strong white-box untargeted and targeted attack. We use L2 constrained untargeted and targeted PGD attacks for comparison. The results listed in Table [ and Table 2 The Clean column the accuracy on clean samples, e is the perturbation level, and PGD 10.50 represents the targeted or untargeted attacks with 10 or 50 iterations. The results indicate that I-SCE produces better performance than the others in most cases. While AT sometimes achieves good performance, it has a noticeable sacrifice of accuracy on clean examples, e.g. on CIFARIO and has weaker defense against strong PGD attacks than I-SCE. By constrast, I-SCE preserves high

---

Under review as a conference paper at ICLR 2021
Table 3: Classification aceuracy (%) under Deepfool attack.
MNIST
CIFARIO
0.01
c
0.04
0.01
0.04
Method
Clean
1F
DF50
DF10
DF50
Clean
DF'
2F
DF
DF
SCE
99.53
27.16
23.74
26.75
23.58
90.45
10.24
4.95
10.29
4.86
Center
99.46
7.58
3.58
7.23
3.34
88.98
10.06
8.01
9.85
7.96
L-GM
99.59
3.81
1.92
3,26
1.76
89.02
17.98
6.63
17.34
6.58
ArcFace
99.43
74.04
64.35
73.09
64.05
90.11
62.45
54.90
62.24
54.01
MMC
99.45
2.46
3.07
2.42
3.05
89.97
4.28
2.57
4.12
2.48
I-SCE
99.60
90.30
78.21
89.24
77.78
89.09
67.50
60.78
67.14
60.74
Random
99.30
27.03
24.30
27.12
22.99
84.15
21.09
14.41
18.09
5.69
LS
99.54
27.24
17.77
26.72
17.62
90.35
10.03
5.05
9.63
4.97
AT
99.25
32.21
5.10
31.50
4.51
83.48
47.60
23.10
46.40
22.39
Table 4: Classification accuracy (%) under SimBA attack.
MNIST
CIFARTO
Method
Clean
c= 0.5
c
c 1.5
Clean
c= 0.5
c
c 1.5
SCE
99.33
97.00
91.23
88.43
90.17
77.60
72.77
70.17
Center
99.25
96.20
91.04
88.17
89.27
81.80
77.94
76.48
MMC
99.18
98.38
97.42
96.15
89.77
82.57
77.83
76.17
I-SCE
99.40
98.73
97.90
97.10
89.63
85.93
83.33
82.07
Random
98.90
94.84
92.32
86.12
89.48
76.54
72.74
71.30
AT 98.86
97.32
66.98
49.94
83.46
80.14
75.40
72.22
performance on clean data. Under several attack cases, e.g. e 0.04, I-SCE performs better than the others and is comparable with MMC and AT.
Deepfool attack: The Deepfool attack generates minimal input perturbations mislead the neu- ral Networks. Here, we use the L2 constrained Deepfool attack on MNIST and CIFAR1O. From the results in Table it is clearly observed that I-SCE produces much higher performance than all competitors, which have very limited defense ability against Deep fool. The performance improve- ment of I-SCE above 50% in most cases, which is significant and exciting. In real applications, the minimal disturbance generated by Deepfool is more usual than the strong offensive disturbance generated by PGD. Therefore, the results indicate that I-SCE is more suitable and can achieve better performance in real scenarios than the other methods.
Black-box attack: Robust performance is critical to claim reliable robustness against the black-box attacks (Carlini al. 2019). SimBA (Guo al. 2019) is black-box query-based attack, which is employed here. We set the frequency of query as 300 times per image on MNIST and 500 times per image CIFAR10. The results under different disturbance levels shown in Table from which we see that I-SCE has higher accuracy and little sacrifice of accuracy compared with the others.
This evidence indicates that I-SCE can induce reliable robustness rather than the false one caused by, e.g., gradient mask (Athalye et al. 2018).
Feature embedding: To visually investigate the effect of I-SCE, we compute 3d representation of the input by adding three- sioeeddmmnsiionl embedding layer before the output layer. The embedded points are plotted in Figure where the samples are selected from the test of MNIST and CIFAR10 without any perturbation. As seen, the samples of SCE distribute confusedly in the space, where little perturbations on the samples could change the category decision. contrast, I-SCE produces separable clusters for each classes with large margins among them, which hence has higher tolerance to the perturbations than the other competitors.
8

---

Under review as a conference paper at ICLR 2021
50e
Conter
GM
MMC
I-SCE
MNIST
Center
HMCC
I-CC
CIFAR10
Figure 4: Illustration of three-dimensional feature embedding.
CONCLUSION
The original SCE loss induces the model to fit the distribution of the clean data, which is shown vulnerable adversarial attacks. We advocate that the vulnerability is caused by the unawareness of the inference region during learning. Targeting at this issue, propose an inference-SCC loss that avoids overfitting by imposing an additive inference information the output of the neural network such that the sensitive class region of the model is expanded. In this way, the model has higher generalization ability to the adversarial examples. Extensive experiments demonstrate superiority of I-SCE compared with the state-of-the-art Especially in the case of strong attacks, I-SCE still remains high robustness.
REFERENCES
Anish Athalye, Nicholas Carlini, and David A. Wagner. Obfuscated gradients give false sense of security: Circumventing defenses adversarial examples. In Proceedings of the 35th Inter- national Conference on Machine Learning, ICML 2018, Stockholmsmässan, Stockholm, Sweden, July 15, 2018, Proceedings of Machine Learning Research. PMLR, 2018.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy, SP 2017, San Jose, CA, USA, May 22-26, 2017, pp. 39-57. IEEE Computer Society, 2017. doi: 10. 109/SP.21799
Nicholas Carlini and David A. Wagner. Audio adversarial examples: Targeted attacks on speech- to-text. In 2018 IEEE Security and Privacy Workshops, SP Workshops 2018, San Francisco, CA, USA, May 24, 2018. IEEE Computer Society, 2018.
Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian J. Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. CoRR, 2019.
Binghui Chen, Weihong Deng, and Jumping Du. Noisy softmax: Improving the generalization ability of DCNN via postponing the early softmax saturation. In 2017 IEEE Conference on Computer Vi- sion and Pattern Recognition, CVPR 2017, Honolulu, HI, USA, July 21-26, 2017. IEEE Computer Society, 2017.
Alesia Chernikova, Alina Oprea, Cristina Nita-Rotaru, and BackGyu Kim. Are self-driving cars secure? evasion attacks against deep neural networks for steering angle prediction. In 2019 IEEE Security and Privacy Workshops, SP Workshops 2019, San Francisco, CA, USA, May 19-23, 2019. IEEE, 2019.
Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou. Areface: Additive angular margin loss for deep face recognition. In IEEE Conference Computer Vision and Pattern Recogni-

---

Under review as a conference paper at ICLR 2021
tion, CVPR 2019, Long Beach, CA. USA. June 16-20. 2019, pp. (690-4669. Computer Vision Foundation IEEE, 2019. doi: 10.1 00.119/CCVRR.2219000222
Farzan Farnia, Jesse M. Zhang, and David Tse. Generalizable adversarial training via spectral nor- malization. In 7th International Conference Learning Representations, ICLR 2019, New Or- leans, LA, USA, May 6-9, 2019. OpenReview.net, 2019.
lan Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015.
Chuan Guo, Jacob R. Gardner, Yurong You, Andrew Gordon Wilson, and Kilian Q. Weinberger. Simple black-box adversarial attacks. In Proceedings of the 36th International Conference on Machine Learning, ICML 2019, 9-15 June 2019, Long Beach, California, USA, Proceedings of Machine Learning Research. PMLR, 2019.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. CoRR, abs/1512.03385, 2015.
Kaiming He, Xiangyu Zhang. Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. CoRR, 2016.
Dan Hendrycks, Norman Mu, Ekin Dogus Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshmi- narayaman. Augmix: simple data processing method to improve robustness and uncertainty. In 8th International Conference on Learning Representations, ICLR 2020, Addis Ababu, Ethiopia, April 26-30, 2020. OpenReview.net, 2020.
Gao Huang. Zhuang Liu, and Kilian Q Weinberger. Densely connected convolutional networks. CoRR, abs//608.d.e 10s//608..6993,, 2016.
Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurlPS 2019, 8-14 December 2019, Vancouver, BC, Canada, 2019.
Robin Jia and Percy Liang. Adversarial examples for evaluating reading comprehension systems. In Proceedings of the 2017 Conference on Empirical Methods in Natural Language Processing, EMNLP 2017, Copenhagen, Denmark, September 9-11, 2017. Association for Computational Linguistics, 2017.
Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In 3rd Inter- national Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015.
A. Krizhevsky and G. Hinton. Science Department, University of Toronto, Tech. Rep, 01 2009.
Learning multiple layers of features from tiny images. Computer
Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial machine learning at scale. In 5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings. OpenReview.net, 2017a
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In 5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Workshop Track Proceedings. OpenReview.net, 2017b.
Gustav Larsson, Michael Maire, and Gregory Shakhnarovich. Fractalnet: Ultra-deep neural net- works without residuals. CoRR, abs/ 605.07644 2016.
Lecun and L Bottou. Gradient-based based learning applied to document recognition. Proceedings of the IEFF, 1998.
10

---

Under review as a conference paper at ICLR 2021
Aishan Liu, Xianglong Liu, Jiaxin Fan. Yuqing Ma, Anlan Zhang, Huiyuan Xie, and Dacheng Tao. Perceptual-sensse sensitive GAN for generating adversarial patches. In The Thirty-Third AAAI Confer- ence on Artificial Intelligence, AAAI 2019, The Thirty-First Innovative Applications of Artificial Intelligence Conference, IAAI 2019, The Niuth AAAI Symposium on Educational Advances in Ar- rificial Intelligence, EAAI 2019, Honolulu, Hawaii, USA, January 27 February 1, 2019. AAAI Press, 2019.
Weiyang Liu, Yandong Wen, Zhiding Yu, and Meng Yang. Large-margin softmax loss for volutional neural networks. In Proceedings of the 33nd International Conference on Machine Learning, ICML 2016, New York City, NY, USA, June 19-24, 2016, JMLR Workshop and Confer- ence Proceedings. JoLR.org, 2016.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant to adversarial attacks. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 May 3, 2018, Confer- ence Track Proceedings. OpenReview.net, 2018.
Jan Hendrik
Metzen, Tim Genewein, Volker Fischer, and Bastian Bischoff. On detecting adversarial perturbations. In 5th International Conference on Learming Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings. OpenReview.net, 2017.
Takeru Miyato, Andrew M. Dai, and Ian J. Goodfellow. Adversarial training methods for semi- supervised text classification. In 5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings. OpenReview.net, 2017.
Seyed-Mohsen Moosavi-Dezfooli,, Alhussein Fawzi, and Pascal Frossard. Deepfool: A simple and accurate method to fool deep neural networks. In 2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA, June 27-30, 2016. IEEE Computer Society, 2016. doi: 10.1 10.1109/CVPR.20162225
Rafael Müller, Simon Kornblith, and Geoffrey E. Hinton. When does label smoothing help? In Advances in Neural Information Processing Systems 32: Annual Conference on Neural Informa- fion Processing Systems 2019, NeurlPS 2019, 8- 14 December 2019, Vancouver, BC, Canada, pp- 4696-4705, 2019.
Amir Najafi, Shin-ichi Maeda, Masanori Koyama, and Takeru Miyato. Robustness to adversarial perturbations in learning from incomplete data. In Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, 8-14 December 2019, Vancouver, BC, Canada, pp. 5542-5552 2019.
Tianyu Pang, Kun Xu, Yinpeng Dong, Chao Du, Ning Chen, and Jun Zhu. Rethinking softmax cross-entropy loss for adversarial robustness. In 8th International Conference on Learning Rep- resentations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. OpenReview.net, 2020.
Nicolas Papernot, Patrick D. McDaniel, Somesh Jha, Matt Fredrikson, Z. Berkay Celik, and Anan- thram Swami. The limitations of deep learning in adversarial settings. In IEEE European Sympo- sium on Security and Privucy, E 2016, Saarbrücken, Germany, March 21-24, 2016. IEEE, 2016a.
Nicolas Papernot, Patrick D. McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as a defense to adversarial perturbations against deep neural networks. In IEEE Symposium on Security and Privacy, SP 2016, San Jose, CA, USA, May 22-26, 2016. IEEE Computer Society, 2016b.
Gabriel Pereyra, George Tucker, Jan Chorowski, Lukasz Kaiser, and Geoffrey E. Hinton. Regulariz- ing neural networks by penalizing confident output distributions. In 5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Workshop Track Proceedings. OpenReview.net, 2017.
Andrew Slavin Ross and Finale Doshi-Velez. Improving the adversarial robustness and interpretabil- ity deep neural networks by regularizing their input gradients. In Proceedings of the Thirty- Second AAAI Conference on Artificial Intelligence, (AAAI-18), the 30th innovative Applications
11

---

Under review as a conference paper at ICLR 2021
of Artificial Intelligence (IAAI-18), and the 8th AAAI Symposium on Educational Advances in Ar- rificial Intelligence (EAAI-18), New Orleans, Louisiana, USA, February 2-7, 2018. AAAI Press, 2018.
Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry, Adver- sarially robust generalization requires more data. In Advances in Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems 2018, NeurIPS 2018, 3-8 December 2018. Montréal, Canada, 2018.
Florian Schroff, Dmitry Kalenichenko, and James Philbin. Facenet: A unified embedding for face recognition and clustering. In IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2015, Boston, MA, USA, June 7-12, 2015. IEEE Computer Society, 2015.
Ali Shafahi, Mahyar Najbbi, Amin Ghiasi, Zheng Xu, John P. Dickerson, Christoph Studer, Larry S. Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! In Advances in Neural In- formation Processing Systems 32: Anmual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, 8-14 December 2019, Vancouver, BC, Canada, 2019.
Aman Sinha, Hongseok Namkoong, and John C. Duchi. Certifiable distributional robustness with principled adversarial training. ICLR, abs/1710.10571, 2018.
Yi Sun, Yuheng Chen, Xiaogang Wang. and Xiaoou Tang. Deep learning face representation by joint In Advances in Neural Information Processing Systems 27: Annual Conference on Neural Information Processing Systems 2014, December 8-13 2014, Montreal, Quebec, Canada, 2014.
adentification-veriicctiii
Christian Szegedy, Wojeiech Zaremba, llya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfel- low, and Rob Fergus. Intriguing properties of neural networks. In 2nd International Conference Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings, 2014.
Christian Szegedy, Vincent Vanhoucke, Sergey loffe. Jonathon Shlens, and Zbigniew Wojna. Re- thinking the inception architecture for computer vision. CORR, abs/151 2015.
Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jonathon Shlens, and Zbigniew Wojna. Re- thinking the inception architecture for computer vision. In 2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas. NV. USA, June 27-30, 2016, pp. 2818- 2826. IEEE Computer Society, 2016. doi: 10. 10.11099CVP..2006.3330
Weitao Wan, Yuanyi Zhong, Tianpeng Li, and Jiansheng Chen. Rethinking feature distribution for loss functions image classification. In 2018 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2018, Salt Lake City, UT, USA, June 18-22, 2018. IEEE Computer Society, 2018
Yandong Wen, Kaipeng Zhang, Zhifeng Li, and Yu Qiao. A discriminative feature learning approach for deep face recognition. In Computer Vision ECCV 2016 14th European Conference, Amster- dam, The Netherlands, October 11-14, 2016, Proceedings. Part VII, Lecture Notes in Computer Science. Springer, 2016.
Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan L. Yuille. Mitigating adversarial effects through randomization. In 6th International Conference on Learning Representatinss, ICLR 2018 Vancouver: BC, Canada, April 30- May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018
Cihang Xie, Yuxin Wu, Laurens van der Maaten, Alan L. Yuille, and Kaiming He. Feature denois- ing for improving adversarial robustness. In IEEE Conference on Computer Vision and Patlern Recognition, CVPR 2019, Long Beach, CA, USA, June 16-20, 2019. Computer Vision Foundation / /EEE, 2019.
Ziang Yan, Yiwen Guo, and Changshui Zhang. Deep defense: Training dans with improved adver- sarial robustness. In Advances in Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems 2018, NeurIPS 2018, 3-8 December 2018, Montréal, Canada, 2018
12

---

Under review as a conference paper at ICLR 2021
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. CoRR, abs/1605.07146, 2016.
Hongyi Zhang, Moustapha Cissé, Yann N. Dauphin, and David Lopez-Paz. mixup: Beyond empiri- cal risk minimization. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018. httltttss://ppeeeeeee http://wwww..eoooooddoeee.../ httpe//ooounndr11ool1--1111
net
Yang Zou, Zhiding Yu, Xiaofeng Liu, B. V. K. Vijaya Kumar, and Jinsong Wang. Confidence regularized self self-training. In 2019 IEEE/CVF International Conference on Computer Vision, ICCV 2019, Seoul, Korea (South), October 27- November 2, 2019, pp. 5981-5990. IEEE, 2019. doi: 10.1109//CCV22011.000666
A APPENDIX
A.1 EXPERIMENTS ON SHALLOW NETWORKS
In real applications on mobiles, shallow networks are generally preferred because of low computa- tional costs. Hence, in this section, we evaluate the robustness of the proposed I-SCE with shallow networks. Specifically, we following the same settings of competitors and attack methods as Sec- [ion[4 The backbone network is LeNet-5 (Lecun & Bottou 1998) for MNIST and an 8-layer neural network for CIFARI0.
Table and Table 6 illustrate the performance under the PGD attack on MNIST and CIFAR1O, respectively. The results indicate that I-SCE performs surprisingly well all cases of attack, while remaining slight sacrifice of accuracy on clean data. Notably, the performance gaps between I-SCE and the others are above 50% in many cases, which validates the effectiveness of the proposed schema. More importantly, under severe attacks, I-SCE still shows strong robustness.
Table lists the results of all methods under the Deepfool attack. We find that the performance of I-SCE is comparable with the state-of-the-arts. MMC produces the best accuracy under attacks, but has noticcable sacrifice of accuracy on clean data. By contrast, I-SCE shows better trade-off between accuracy and robustness.
A.2 PROVE OF THE PROPERTY ON EXPECTED INTERVAL. OF CORRECT CLASS
According to the definition L and L in Eq.
6 and Eq. 7 we can derive
(ff(())+
()(((+)))
L - edf(())- + E Ejseel Spate e
(10)
eli(a)
elilato)
Ej + -Eets(tt)
By defining
fx(x))m
ef((x)
= Pr(iz)) - P(ilx) esfi(a)mm El(e)
(1I)
el((a
Σ, eh(4)
then have
(m/
ef(())
Mf(x)) = Pr(ilo) P(]|)) + + +Ejnetlla) Ejetle
()(((=)m E, ebb(() etile) (c + EEjt ebi(m))
(enf(aa)mm Σ cbil)) Ejetle (li(t)= Enjr eti(0) ehila) Σ Dizt eb(a))
(12)
(entilo)+m + Ejjr edi(s)) E(pt))())))) Ej elil)) Ejtre ((ll))
edilae))
(csfile)tm + Ejtt ets(x)) E, E, ets(a)
13

---

Under review as a conference paper at ICLR 2021
Table Performance (%) of shallow neural networks under PGD attack on MNIST.
0.02
0.04
Method
Clean
PGD10
PGD10
5
PGD
PGD
PGD fer
PGD
PGD
tar
SCE
99.12
65.55
91.43
0.75
6.12
6.40
52.47
0.72
2.71
Center
98.17
74.44
96.65
1.21
0.43
8.97
72.04
1.20
0.30
L-GM
97.92
72.08
25.54
50.17
0.03
50.43
2.73
49.32
0.01
MMC
91.02
82.34
82.96
35.32
12.30
56.49
53.74
35.21
7.14
I-SCE
98.42
98.74
98.40
98.55
95.28
98.67
98.15
98.25
90.74
Random
98.09
79.62
89.92
0.70
19.03
25.02
55.71
0,66
4.71
AT
96.76
93.91
64.56
1.96
51.30
84.38
45.60
1.76
16.44
Table 6: Performance (%) of shallow neural networks under PGD attack on CIFARIO.
0.01
0.04
Method
Clean
PGD
PGD
PGD
PGD
PGD mm
PGD tor
PGD
PGD
50
SCE
77.53
11.79
25.42
11.06
1.10
10.39
8.74
10.22
0.05
Center
76.46
11.10
18.69
10.97
0.35
10.13
4.52
6.40
0.12
L-GM
74.30
22.77
11.05
21.37
0.30
20.15
2.78
0.01
0.13
MMC
73.20
48.63
42.54
25.43
27.12
20.90
27.52
15.32
14.59
I-SCE
81.22
80.71
81.15
80.70
80.53
80.71
80.59
80.70
79.75
Random
78.71
15.23
24.53
9.78
1.37
10.41
9.70
10,20
0.21
AT
78.81
44.04
36.11
9.30
30.00
11.36
35,82
8.62
28.38
The above equation gives us that [([(()) > = (l(x)m -ef((a) > (f)))
eJatay Hence, when the
- (s - 1))((z) + m =
f((z)- f((x)
parameters s and m satisfy $ 2 ((x)-m and m 0, h(f h(f(z)) > 0. When s = and m = 0, fx(=)
Pr(ilz) degenerates to P(ilz).
Similarly, regarding 11/(xx + 6)), we have
h(f(æ + 6)) = Pili + 8) P(ixx+
eh(o+0)
c0h(ut0)+m Σ Ejjjedi E, edi(ato)
(13)
Σ Ej (es(ittt))) -f((zt))
(e=h(u+0)+m Ejjs el((+t))) E, cb(
When s 2 f((z+5)-m and m > 0, h(f(f+ 0)) > 0. fla+d)
Based on the above derivations, we calculate
L L = h(f(x)) h(s(x
(14)
To analyze the sign of the above equation, compute the derivative of h(f(2)) with respective to fz(x)) as
fmlm)mm
(f(e) Eee5te
oh([(z))
(3,((a) m
0f((z)
0f((z)
fm(x)))
Eeblo) efila)
Σ elll))
(15)
(e*fila)+m
+Ejti
141
Jt1 edi(a))
86 #l(x))m
Σ elilo)(
E, (nnn)))
(60S(())mm EEjge
141
14

---

Under review as a conference paper at ICLR 2021
Table 7: Performance (%) of shallow neural networks under Deepfool attack.
MNIST
CIFARIO
0.01
C 0.04
0.01
0.04
Method
Clean
1F
DF
DF10
DFs0
Clean
1F
DF50
1F
DF50
SCE
99.12
4.95
2.17
4.16
2.05
77.53
15.58
13.40
15.20
13.10
Center
98.17
26.98
17.63
24.49
16.10
76.46
6.40
1.45
6.32
1.43
L-GM
97.92
8.04
5.74
6,29
4.67
74.30
5.69
1.80
5,44
1.79
MMC
91.02
9.08
9.06
7.12
6.58
73.20
20.07
19.86
19.75
19.64
I-SCE
98.42
97.48
28.26
92.62
25.13
81.22
29.38
21.39
28.21
20.48
Random
98.09
71.46
42.60
59.34
49.49
78.71
28.75
21.54
31.75
25.44
AT
96.76
4.08
1.70
3.35
1.43
78.81
66.51
30.39
66.09
29.77
3029
1005
0001
1000
12
16
0.0
Figure 5: Parameter selection s.m
Considering that the perturbation is a just value that misleads the network, > f(x+ When 0, h(f(x)) is monotonically increasing.
sr." (=))+m
ef()))
s and m satisfy (e=f((")+** +2 eli This guarantees that L1- L O.
C Eiwpy
se mm
O is not easy validate in the of s 2 and m 0. Here, we conduct an experiment to empirically demonstrate its validation. Specifically, we compute the empirical values Σjsr cf)(z) fi() 0.97 by averaging the
However, the condition (o=f)(=)+m*55 +E, este
corresponding values of all samples in MNIST and CIFARIO. By employing these values, (m())m
pff()) plot the 3D surface of z (e*fil))*m Enn, J C Jhtrp with respect to and m, which is
shown in Figure The surface indicates that is always larger than O when > I and >> 0. This empirically demonstrates the validness the conditions in the property.
15


Reviews:
[{"review_id": "zLDm2sBZEco", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Paper proposes a modification to the widely adopted \"Softmax Cross Entropy\" (SCE) loss function that they refer to as I-SCE, with I standing for \"Inference\", that is designed for making the loss function more robust to adversarial examples. \n\nThe presentation of the idea is major mathematical flaws which make the idea authors are trying to present hard to grasp. \n\nThe main idea of the paper is to stretch the logit for the \"true\" class. This idea is presented in Eq. (7), where the logit term is stretched using the affine function x -> sx + m\n\nThis idea is introduced in the paper higher up, at Eq. (1) with adding a constant term to a probability! I had never seen a probability that is obtained from another one by adding a constant to the former. The reason being that adding a constant will break the \"sum to one\" property of a probability density function.  This is the first misleading / confusing math formula, which is used again in Eq. (3) & (4)\n\nAnother mathematical flaw in the paper is the text following Eq. (5): \"This equation indicates that DKLI (P (y)∥Q(y)) − DKL(P (y)∥Q(y)) < 0, showing how inference KL divergence avoids the overfitting scenario.\". I do not see why the difference of KL divergences being negative implies that overfitting is avoided. Perhaps authors can explain?\n\nFigure 1 is not related to the text: why don't we have m but delta instead here? I don't get what this figure means\n\nFigure 2 is misleading as well: which one is x, which one is y which is z axis, and what is presented here? can you add text to the axes so that I could understand what is going on there? how does this represent an adversarial attack anyway? \n\n\n\n \n\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "PtHnrdH1s1A", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The authors propose a loss function that is robust to the adversarial samples and claims the training with this loss function makes the model achieve better generalization ability.\nHowever, there are a number of problems in this claim.\n\nThe method does not ground on a solid theoretical analysis\\\nI tried to interpret the analysis, but failed.\n1. The right hand side of Eq(1) does not satisfy the rule of the probability. i.e., it does not satisfy $\\sum_y P(y|x) = 1$ when $\\sum_y P(y’|x) = 1$ and $m$ is a non-zero constant.\nThus the difference between two KLs around Eq.(5) does not make sense because $KL[P|Q]$ works as a valid divergence only when $P$ and $Q$ are probability distributions.\n2. We cannot derive Eq.(3) from Eq.(1)\n3.  If we add $m$ inside the exponential at the numerator for all the class $i$, it is equivalent not to add anything because it vanishes after normalization.\n4. There is a lack of the explanation why the adversarial training is not sufficient. It seems for me adversarial training will be a natural choice if we want to make the model robust to the adversarial training. \n\nStrange statement\\\nThe authors wrote “Since the ground truth distribution of training data is **known**, $H(P(y))$ is a constant and hence,”\nUsually we assume the ground truth distribution is **unknown**, if we know the ground truth distribution, there is no need to train the model. We can get immediately the minimizer of the loss. This may be a typo, but even if it is the mistake of “unknown”, still the statement is strange because it does not relate to whether $H(P(y))$ is a constant or not.\n\nExperiment is not convincing\\\nThe adversarial training works well for this experiment. Although the authors claim the adversarial training has a noticeable sacrifice of accuracy on clean examples. The mechanism is not well studied.\nAlso the authors tested their method only on MNIST and CIFAR10. It is not so appealing.\n\nReference\\\nThe intuition of the authors claim has a relationship with the distributional robust learning. The authors should discuss the relationship with these methods.\\\nA. Sinha, et al., “Certifiable distributional robustness with principled adversarial training,” in ICLR 2018\\\nAmir et al., “Robustness to Adversarial Perturbations in Learning from Incomplete Data” in NeurIPS 2019.\n\n-----------------------------------------------\nI appreciate the authors to improve the clarity and consistency of the method.\nI understand it has a practical value, easy to use and yet benefit from the method.\nHowever, if the authors want to stress its practical value, we need more convincing experimental results beyond MNIST and CIFAR10.\nThus I concluded it is still below the acceptance threshold.", "extra_scores": {}, "extra_text": {}}, {"review_id": "PTFB2E4PWSs", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The authors present a new inference-SCE loss in order achieve a higher robustness to adversarial attacks. \nThey evaluate their model based on 2 datasets and compare their approach to several well known baselines. \n\nThe works seems convincing, even though I would have liked to see more extensive experiments on more complex dataset than CIFAR10 and MNIST.", "extra_scores": {}, "extra_text": {}}, {"review_id": "75r-dn29CaR", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Summary:\nThe paper claims that the vulnerability of DNN w.r.t adversarial samples comes from the overfitting issue when applying softmax cross-entropy loss. They propose I-SCE to mitigate the overfitting issue and show good performance in several adversarial attacks benchmarks. \n\nThe main concern from my point is the originality of this paper.  The author claims that avoiding overfitting can help improve the robustness under adaptive attacks. So the proposed method can be regarded as a regularization method to prevent overfitting issues. However, I think the proposed method shares a lot of similarity with label/model smoothing[1,2]. Also, the objective function eq8 basically is the same as Cosface loss function [3]. \n\n1) For eq. 1 and section 3.2, the authors state that the proposed method tends to produce the model prediction Q(y) close to P(y)-m instead of P(y). I think this is also the claim of label smoothing which avoids the model to output overconfident predictions w.r.t ground truth. \n2) For eq.8, I would say the objective function is almost exactly the same as cosface loss ([3] eq.4) where s is the scale factor, m is the margin.  The cosface loss improves the model inter-class separability by setting a margin. I am not sure whether the proposed method benefits from inter-class separability or claimed label smoothing. \n\nOverall, though the paper achieves good performance in several adaptive attacks benchmarks, I think the novelty of this paper is limited. Specifically, it shares a similar motivation and objective function to label smoothing and cosface. I hope the authors can elaborate on the difference between your work and label smoothing.\n\n[1] Regularizing Neural Networks by Penalizing Confident Output Distributions, Gabriel Pereyra et al.\n[2] Confidence Regularized Self-Training, Yang Zou et al.\n[3] CosFace: Large Margin Cosine Loss for Deep Face Recognition, hao et al.", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper presents an inference-softmax cross entropy (I-SCE) loss, a modification to the widely adopted "Softmax Cross Entropy" (SCE) loss, to achieve better robustness against adversarial attacks. The original submission had critical issues on motivation, theoretical analysis and experiments. Although the authors provided a revised version, it needs another round of thorough examination before publishing. 
Decision: Reject