Towards Adversarial Robustness of Bayesian Neural Network through Hierarchical Variational Inference
Authors: Byung-Kwan Lee
Youngjoon Yu
Yong Man Ro
Venue:  (2021)

Abstract: Recent works have applied Bayesian Neural Network (BNN) to adversarial training, and shown the improvement of adversarial robustness via the BNN's strength of stochastic gradient defense. However, we have found that in general, the BNN loses its stochasticity after its training with the BNN's posterior. As a result, the lack of the stochasticity leads to weak regularization effect to the BNN, which increases KL divergence in ELBO from variational inference. In this paper, we propose an enhanced Bayesian regularizer through hierarchical variational inference in order to boost adversarial robustness against gradient-based attack. Furthermore, we also prove that the proposed method allows the BNN's stochasticity to be elevated with the reduced KL divergence. Exhaustive experiment results demonstrate the effectiveness of the proposed method by showing the improvement of adversarial robustness, compared with adversarial training (Madry et al., 2018) and adversarial-BNN (Liu et al., 2019) under PGD attack and EOT-PGD attack to the $L_{\infty}$ perturbation on CIFAR-10/100, STL-10, and Tiny-ImageNet.

Under review as a conference paper at ICLR 2021
TOWARDS ADVERSARIAL ROBUSTNESS OF BAYESIAN NEURAL NETWORK THROUGH HIERARCHICAL VARI- ATIONAL INFERENCE
Anonymous authors Paper under double-bling blind review
ABSTRACT
Recent works have applied Bayesian Neural Network (BNN) to adversarial train- ing, and shown the improvement of adversarial robustness via the BNN's strength of stochastic gradient defense. However, we have found that in general, the BNN loses its stochasticity after its training with the BNN's posterior. As a result, the lack of the stochasticity leads weak regularization effect the BNN, which increases KL. divergence in ELBO from variational inference. In this paper, we propose enhanced Bayesian regularizer through hierarchical variational infer- ence in order to boost adversarial robustness against gradient- based attack. Fur- thermore, we also prove that the proposed method allows the BNN's stochasticity to be elevated with the reduced KI. divergence. Exhaustive experiment results demonstrate the effectiveness of the proposed method by showing the improve- ment of adversarial robustness, compared with adversarial training (Madry et al.) 2018) and adversarial-BNN (Liu et al., 2019) under PGD attack and EOT-PGD attack to the Lx perturbation CIFAR- 100100, STL-10, and Imageem.
INTRODUCTION
Deep neural networks have achieved impressive performance wide variety of machine learning tasks. Despite the breakthrough outcomes, deep neural networks are easily deceived from adver- sarial attack with the carefully crafted perturbations (Szegedy et al.) 2014 Goodfellow et al. 2015] Chen et al.) 2017; Carlini & Wagner 2017 Papernot et al. 2017 Eykholt et al.) 2018 Madry et al., 2018). Injecting these perturbations into clean inputs (i.e., adversarial examples), which are imper- ceptible to the human eyes, fools the estimators in the deep neural networks. Weak reliability due to the invisible perturbations has affected security problems in deep learning applications (Apruzzese)
ett al. 2019 Wang et al. 2019b; Sagduyu al. 2019 Rosenberg et al. 2020).
To defend such adversarial examples, many algorithms have been studied to improve adversarial robustness far. Adversarial training, where deep neural networks trained adversarial amples, is one the few defense strategies against strong adversarial attacks (Huang et al.) (015)] Zantedeschi et al.] 2017 Kurakin et al. 2017 Madry et al. 20188] Athalye et al. 2018a] Liu al. 2018). Among them, Madry et al. (2018) has shown that ad advessarially trained networks can be ro- bust white-box attacks with the knowledge of the network parameters. Besides, most of the above studies have agreed with that adversarial training shows an effective adversarial robustness against several white-box attacks.
Meanwhile, adversarial training and BNN have been combined to improve adversarial robustness with stochastic approach through variational inference. In fact, the variational inference maximizes Evidence Lower Bound (ELBO) to find an approximate posterior closely following the true poste- rior for the machine learning tasks (Graves) 2011 Kingma & Welling 2014 Blundell et al. 2015 Hernández-Lobato & Adams 2015). Based the variational inference, adversarial training with BNN has accomplished the achievement of adversarial robustness by implicitly using the approxi- mate posterior against the adversarial perturbations (Mescheder et al. 2017] Ye & Zhu 2018). They have focused on training the network parameters or spaces itself on the maximum ELBO without obtaining the approximate posterior directly.

---

Under review as a conference paper at ICLR 2021
Contrary to the above studies, Liu al. (2019) presents adversarial training with BNN, called "adversarial- to deal with the approximate posterior explicitly. They straightforwardly learn Gaussian parameters (e.g., mean and variance) of the approximate posterior as follows: N(u,," instead of the weight parameters. Alternatively, the weight parameters are sampled by the approximate posterior, such that w μ + de, where the stochastic sampler is gererated from < (0, 1). The stochastic sampler provides the change of the weight parameters with the learned Gaussian parameters. The variation of them creates stochastic gradient, helping the improvement of adversarial robustness (Carbone et al. 2020
~
However, we find that in general, the approximate posterior's 's variance converges to zero-like small value as follows: w ~ (p,,0² = 0) after training the BNN with its posterior. Although the stochastic sampler helps the weight parameters to change, they become fixed-like parameters, such that w j + ( O)e. The lack of their stochasticity causes the BNN's stochasticity to be vanished so that the BNN cannot easily respond to slightly different inputs within the same class. In other words, the vanished stochasticity breaks the regularization effect in the BNN, which increases KL divergence in the ELBO. The broken BNN regularizer produces an ill-posed posterior, thus resulting in weak adversarial robustness. This is because the broken regularizer hinders the maximum ELBO from approximating the true posterior against the adversarial perturbations. Therefore, an enhanced BNN regularizer is required better approximate the true posterior for adversarial robustness.
In this paper, we present the enhanced Bayesian regularizer through hierarchical variational infer- ence in order boost adversarial robustness compared the BNN regularizer from variational inference. Furthermore, we also prove that the proposed method significantly intensifies the BNN's stochasticity by introducing closed form approximation of conjugate prior for the true posterior. In the end, we validate the effectiveness of the proposed method by showing the improvement of adver- sarial robustness, compared with adversarial training (Madry et al., 2018) and adversarial BBNN (Liu et al. 2019) under PGD attack as well as EOT-PGD attack to the Lx perturbation on CIFAR-100 10/11///11/ 10/100, STI- 10, and Tiny- Net.
Our contributions of this paper can be summarized into two-fold as follows.
We newly design an enhanced Bayesian regularizer through hierarchical variational infer- ence built with concept of the conjugate prior, and verify that the proposed method further strengthens the BNN's stochasticity, compared to the BNN regularizer based on variational inference.
We conduct exhaustive experiments to validate the effectiveness of the proposed method by adversarial robustness, and exhibit the outstanding performance compared with adver- sarial training and adversarial-Bae under both PGD attack and EOT-PGD attack on four benchmark datasets: CIFAR-100/00 STL-10, and Tiny-ImageNet.
PRELIMINARY
In this section, we specify the notations used in our paper at first and summarize the related works on adversarial attack/defense, and adversarial training with BNN.
Notations. Let x denote the clean image from given dataset, and y denote the class label corre- sponding the clean image. Let D and Dade indicate each clean dataset and adversarial dataset, such that (z, y) ~ D and (zndee .y) ~ Dude, A deep neural network f parameterized by weight parameters is denoted by (x). Adversarial examples are represented by aad = + 5, where 6 denotes the adversarial perturbations. In order to align the experiments in the previous works, we the cross-entropy loss J (fw (a), y) for image classification. Moreover, regard 5 the Lo perturbation within b-bal,, such that [|0]|.o < 7. Here, Il: describes the Loo.
2.1 ADVERSARIAL DEFENEE
Adversarial Attacks. The goal of adversarial attacks is generating the adversarial examples to deceive the prediction of the deep neural networks. Most of them produce the adversarial examples by the gradient of the loss function over the input. Goodfellow et al. (2015) introduces a single-step attack called Fast Gradient Sign Method (urak), et al. (2017) proposes iterative- FFGM with multiple-step attack. Further, Carlini & Wagner (2017) presents C& W attack to overcome
Kurakin
2

---

Under review as a conference paper at ICLR 2021
defensive distillation (apeenot et al. 2016), encompassing range of attacks cast from the same optimization framework. On the other hand, Athalyy et al. (2018a) analyzes the effectiveness of Projected Gradient Descent (PGD) method (Madry et al. 2018) perform adversarial attack to the Tas perturbation. PGD attack is an iterative algorithm by computing the gradient of the loss in the direction of the highest loss and projecting it back to the Loo perturbation around the clean image. We use the PGD attack for the experiments of adversarial robustness, which can be written as:
ade 2-
II adv + sign (VaJ (fw(z)) v0 ( W 17,7
(1)
where Han is the function to project its argument to the surface of x's y-neighbor ball {arl I. zrl..0 S <T}. and y denotes step size. For the adversarial defense utilizing random- ized classifiers, an adaptive attack such as Expectation over Transformation (EOT) is known to be effective because it allows an attacker to compute the actual gradient over the expected transfor- mation to the stochastic classifiers (Athalye et al. 2018a|b). Inspired from the EOT attack, we can modify Eq. ① and adjust more efficient PGD attack (Zimmermann) 2019).
adv T1+1
II 2,7
Ft odv 1 sign E V (fio)z)
})}
Zimmermann (2019) applies the averaged-gradinn over the multiple weight parameters to generate the adversarial examples, and shows that this efficient PGD attack degrades the BNN's adversarial robustness. This is because the averaged weraged-gradient can attack all of the possibly sampled weight parameters in the BNN. In other words, the averaged-gradient attack weakens the BNN's advantage of stochastic gradient defense. In this paper, we call the efficient PGD attack, namely EOT-PGD attack, and take to validate the effecttivness of the proposed method.
Adversarial Defense. The aim of adversarial defense to secure deep learning networks against adversarial attacks. There are generally three main categories of defense strategies (Silva & Najañ- rad, 2020; Hao-Chen et al. 2020p. (I) Gradient masking/obfuscation: a defender intentionally hides the gradient information of deep neural networks in order to confuse adversaries, because most at- tack algorithms are based on the classifier's gradient information (Papernot et al.. 2016 Buckman
ett al. 2018: Guo et al. 2018 Dhillon et al. 2018). (2) Adversarial detections: they focus on dis- tinguishing whether the input is benign or adversarial (Metzen et al.] 2017] Grosse et al.) 2017 7 Xu
eet al. 2017). When they succeed to detect the adversarial attack in the inpur, the classifiers stop mak- ing a decision. (3) Robust optimization: it is a well-known paradigm that aims to obtain solutions under bounded feasible regions. Especially, its main interest from an adversarial perspective, is im- proving the classifier's 's robustness by changing the learning scheme of deep neural networks (Cisse)
ct al. 2017
Hein & Andriushchenko 2017
Raghunathan et al. 2018 Wong Kolter 2018
Adversarial training (Goodfellow et al.) 2015 Kurakin et al. 2017 Madry et al. 2018) is one of the famous robust optimization methods in deep learning fields, which allows the deep neural network to learn robust parameters against the adversarial examples. [Mdry et al.]2018) tries to find the optimal weight parameters against adversarial dataset Dadu to improve adversarial robustness under PGD attack to the T. perturbation, by minimizing the pre-defined loss L for the machine learning tasks. The formulation can be written as:
w arg min
E
[C (Ju (z ),y)
(a Dado
where add is generated from the PGD attack as described in Eq. The optimal weight parameters w" get the capacity of adversarial defense to confront the adversarial perturbations.
2.2 ADVERSARIAL TRAINING WITH BNN
Many studies have mingled with adversarial training and BNN through variational inference. Here, variational inference imposes the probabilistic approach on the network parameters spaces to ob- tain a closed form approximation of the true posterior based on the maximum ELBO, thus leading to
well-posed inference (Welling & Teh 2011 Paisley al. 2012 Hoffman et al. 2013 Salimans & Knowles 2013: Kingma & Welling 2014; Rezende et al. 2014). Likewise, finding the closed form
from adversarial perspective lead to well-posed inference for adversarial robustness. Thus,
3

---

Under review as a conference paper at ICLR 2021
Ho
W~NHo.
Mean
Mcan
Normul-Inverse Gamma sampling
Gaussian sampling
f
M-M(Ho²)
W
W
σ²
y
W y +
W
+ JoEy + (Wbe y
Variance
Variance
σ 19(V, ((V,4)
v
(0) udversurial---eee
(b) Ours
Figure 1: Diagrams that describe the methods of sampling the weight parameters for (a) with adversarial-BNN and (b) the proposed method. The weight parameters in (a) are sampled from the Gaussian distribution q(w) as an approximate posterior through variational inference, and those in (b) are sampled from the Normal-Inverse Gamma distribution q(1,, d²) as an approximate conju- gate prior through hierarchical variational inference. Red circles denote the learning parameters in the BNN, black circles denote the random variables sampled from the described probability distri- butions, and the black arrows indicate the sampling order.
adversarial training with BNN tries approximate true posterior against adversarial perturbations: p(w Dadv) to indirectly utilize it to conduct the well-posed inference for adversarial robustness. Fundamentally, the reason we should approximate the true posterior is attributed by its intractability because of a high dimensional dependency of adversarial dataset p p(Dad"). Thus, variational infer- ence for adversarial robustness introduces an approximate posterior the closed form of ((w) as practical estimator to approximate the true posterior, where the formulation can be written as:
log ply zddv) DKL(a(w) p(w Dade))
+
E (on)
[logp(y aadv w)] - (xx(((w) p(w)).
ELBO
We should minimize KL divergence DEL (g(w) || p(w Dadu)) above to make the probability- distance close between the two probability distributions. But, this KI. divergence is still intractable measurement, and we alternatively maximize the ELBO in Eq. 4. which has the same effect to minimize this KL divergence. This is because the log-probability log p(y zadv) in Eq. (4) is consistent with the change of the weight parameters w. The formulation of variational inference
also can be represented to lower bound as: log ( xadv) Z ELBO.
Some of the studies (Mescheder al. 2017 Ye Zhu 2018
Wang al. 2019a Carbone al.
2020) are to improve adversarial robustness by maximizing the ELBO. Others (Feinman et al.] 2017 Smith & Gal [2088] Wang al., (2018) are detect the adversarial examples by predicting Bayesian uncertainty (Gal & Ghahramani 2016 Kendall & Gal 2017 Pearce et al., (020). which are also based on the maximum ELBO. These previous studies have implicitly examined the approximate posterior to better learn the network parameters spaces, instead of directly shaping the approxi- mate posterior.
Unlike the previous studies, Liu et al. 2019) proposes "adversarial-BNN which combines adver- sarial training and the BNN to improve adversarial robustness by shaping the approximate posterior explicitly. Liu et al. designs its posterior ( = NM,, o²) and considers Gaussian parameters (c.g., mean, variance) of it as learning parameters. In this work, the first term the BLBO represents the expected log-likelihood calculated from the cross-entropy as follows: N. EN J (f (æade), v) by Monte-Carlo sampling, where denotes the sampling number. As shown in Fig. Ia). the weight parameter (n(1) is sampled by the approximate posterior's mean and variance 14, a², such that (+) = (+) Here, (i) is the stochastic sampler, such that (i) (0.
The second term the ELBO normally represents a regularization term for an approximate posterior the BNN's posterior. This term can be computed from the KL divergence between the approxi- mate posterior g(w) ((w) and a prior p(w) which is usually set to A/ 1) for variational inference. In other words, this KI divergence has role of BNN regularizer in ELBO, and this regularizer
4

---

Under review as a conference paper at ICLR 2021
important factor for adversarial robustness. This is because once the BNN regularizer is increased unexpectedly, the minimum ELBO produces an ill-posed posterior, creating weak adversarial robust- ness. In contrast, the BNN regularizer is reduced, the maximum ELBO allows for the well-posed inference due to strong regularization effect bringing in better approximating the true posterior. In addition to the aspect of the BLBO, there many studies showing that high regularization perfor- mance improves adversarial robustness (Saito et al., 2018: Yu et al. 2019 Zhang & LLang 2019
Sun al. 2019 Terjek 2020 Zhang et al. 2020).
3 PROPOSED METHOD
Adversarial training with BNN has expanded generic probability to adversarial probability, and has shown the improvement of adversarial robustness. However, as mentioned in the Section I the van- ished stochasticity declines adversarial defense functionality of the BNN. To investigate the BNN's stochasticity, we introduce a concept of the conjugate prior, and develop a new ELBO motivated by the conjugate prior. The conjugate prior can provide a key to how the Gaussian parameters of the approximate posterior q(w) are trained during adversarial training. Based on our findings in the con- jugate view, we will design an enhanced Bayesian regularizer that solves the stochasticity problem causing weak adversarial robustness. Before we explain the proposed method, we firstly introduce two parts: (1) the conjugate prior of the Gaussian posterior, (2) hierarchical variational inference for building new ELBO with this concept of conjugate prior.
Gaussian Conjugate Prior.
The conjugate prior of the Gaussian posterior is called the Gaussian conjugate prior. In the conjugate view, the true posterior p(w (D) is no longer posterior, but is the likelihood p(u DD o²) given the Gaussian parameters p. o² when assuming the true posterior is Gaussian. Here, Gaussian conjugate prior is the probability distribution p(u, o² D) for the Gaussian parameters of the true posterior. The conjugate prior takes an benefit to approximate the true posterior by modeling such Gaussian parameters, thus guiding well-posed posterior. But, the conjugate prior is also intractable to deal with, similar to the true posterior because they are same distribution family. Therefore, we introduce an approximate conjugate prior q(u, o²), in the shape of Normal-Inverse Gamma distribution, to approximate the conjugate prior of the true posterior. The formulation of the approximate conjugate prior can be written as follows:
q(u, o²) = N' (H Ho: og) IG (o² 11, 11,
(5)
It can be factorized into the Normal distribution q(m) = N (N Po, oi) and the Inverse Gamma dis- tribution g(a²) = IG (a² 1) independently by mean-field approximation (Kingma & Welling, 2014]. In the Normal distribution, μl denotes the mean prior knowledge of the approxımate poste- rior q(w), and of denotes the variance of the approximate posterior's 'sss mean. In addition, in the Inverse Gamma distribution, denotes the degree of freedom on positive real set which determines the shape of this distribution, and denotes the variance prior knowledge of the approximate posterior.
Here, the approximate conjugate prior can sample each of the Gaussian parameters independently. The Normal distribution samples the approximate posterior's mean, and the Inverse Gamma distribu- tion samples its variance. As illustrated in Fig. [b), tractable parameters μoo og. v. and v in g(v, o?) can generate the mean μ and the variance a² of the approximate posterior, where p -o + 0 and 0² v2,2, such that E/ NN 1), c IG 1). In addition, the generated mean and the variance are both used to sample the weight parameters: w Po + dD (1/,,))1/2e. We call it Normal-Inverse Gamma sampling. More importantly, the approximate conjugate prior has more number of the tractable parameters than the approximate posterior g(w). which significantly help sampling the weight parameters for complex representation.
Hierarchical Variational Inference. Next, we tackle the way the approximate conjugate prior makes closed form approximation of the conjugate prior as a same family of true posterior. We modify the BLOO in Eq. (4) to build up a new ELBO with the approximate conjugate prior, namely hierarchical- ELBO, which can be written as:
E (H.02) [logp(y zadv . + σe)] - DKu(alu, o²) 03).
(6)
The first term stands for the classification performance taken from the cross-entropy. The sec- ond term represents the BNN regularizer in hierarchical-EL.BO equivalent to that in the ELBO as
5

---

Under review as a conference paper at ICLR 2021
depicted in Eq. 4
The second term can be computed by the KL divergence between the approx-
imate conjugate prior q(u, o²) and a hierarchical prior p(n, d²). Note that the hierarchical prior is factorized into the mean prior p(u o²) and the variance prior p(o²). Then, the above KL di- vergence can be decomposed into two equations: (I) [= [DKz(q(u) p(u [f)]] and (2) Dxz(a(0²) II p(o²)) (see Appendix A). In order to make two equations tractable, both the mean prior and the variance prior should be set, similar to the setting the prior p(w) = -O 1) in the ELBO from variational inference. Since the prior is Gaussian, the hierarchical prior can be formed to Gaussian conjugate prior, Normal-Inverse Gamma, where we keep the prior knowledge of the mean and the variance with zero and one, respectively. We set the mean prior N (0, (0, "2)
for (1), where À denotes inverse scale factor to the variance o². In addition. the variance prior is set to (v, 1) for (2). Here, is set to the same parameters both in q(o²) and p( to reduce computational complexity in calculating (2).
On the above settings for the hicrarchical prior p(p, the second term can be tractably expanded with the summation of the two equations (see Appendix which can be written as:
DKI(a(u, o²) ll p(u, x²)) = = اكーمك Ay + ++2 + log (Aco3,))
20, [((s)) (7)
20y
2
where M denotes the number of weight parameters in the deep neural networks, and represents the jth parameters for the jth approximate conjugate prior. The function G has the formulation of Digamma function, such that G(vz) I" (vr))T(r))-
ELBO vs Hierarchical-ELBO. Until we control the parameters X, of the hierarchical prior p(p, d²), the ELBO is essentially same to the hierarchical-ELBO. Also, the BNN regularizer in the ELBO is identical to that in the hierarchical-EL.BO. This is because have replaced the weight parameters in the ELBO with the Gaussian parameters for the extension, as described in Eq. (6). Different from the fixed prior p(w) = NN 1) in the ELBO, controllable parameters X, of the hierarchical prior p(u, o²) can allow the BNN regularizer in the hierarchical- ELBO to change adaptively. As a consequence, properly chosen parameters À and v can reduce the KL divergence, helping well-posed posterior with the maximum hierarchical-EI. ELBO.. The formulation of the hierarchical-ELBB can be also represented to lower bound with the ELBO as follows: log ply æadv) 2 hierarchical-EL.BO ELBO, where the hierarchical-E1.BB better approximates the true posterior than the ELBB..
nothing but we just
Enhanced Bayesian Regularizer. Now, we focus on the optimization of the BNN regularizer in the hierarchical-EL.31 to reduce the KL divergence. By gradient results over the controllable parameters: 0 D KL 0 and 8v, DKL 0, we can easily obtain the optimal value ax,
but the optimal value n* is intractable to acquire, since the gradient result is intractable as follows: du G(v) 2μ vo + log v 1. We should indirectly find the optimal value D² by applying the above gradient results to the KI. divergence, which can written as:
DKildlu, p( = Σ log
+
Vi
G(v,)
1 1 G(v,) + logu, 3 (8)
2
H(w)
where the function (v²)) is decreasing and convergent function (see Appendix We examine this function is converged to zero, as My gets large enough. With the optimal value o infinite, the KI. divergence in the hiL can be definitely reduced.
M E log (1+ 1 The proposed method provides more tight lower bound than the ELBO, such that the formulation can be described as follows: log p(y x xdde) ) Z hierarchical-EL..
Finally, we propose the enhanced Bayesian regularizer follows:
>> ELBO. Based on the tight lower bound, the enhanced Bayesian regularizer aids to the acquisition of the well-posed posterior to boost adversarial robustness. Consequently, we have verified that the proposed method considerably inten- sifies the BNN regularizer by designing the hierarchical-EI -EBOO in the conjugate view. In practical, we can compute the proposed method for each training iteration, such as Expectation-Maaxt Maximiiaaioiiiiiooonnn (EM) step. We describe the algorithm for the proposed method below.

---

Under review as a conference paper at ICLR 2021
Algorithm 1 Code for adversarial training in the BNN with the enhanced Bayesian regularizer
1: Require: a (learning rate), Mo and do (learning parameters)
2: for (Ir 2) in do
Training procedure per epoch
3: W. & Mo oge, (0,
> Sample the weight parameters b PGD attack to generate adversarial examples > Predict the outputs given the adversarial examples b Calculate the cross-entropy loss
4:
rado -- attack(2, (z, y, w)
5:
k 4-fw(( (2adu)
6:
L1 + -(..V)
7:
L2 + _j=1 logg(1
+ Mun
D Calculate the proposed method p Calculate the hierarchical-EII in Eq. (6) Update the learning parameters
0.3
8:
c f, + L2
9: (4o, 00) & (NO
a Dpo
8C
00
2L Doo
10: end for
Theoretical Analysis. On the above optimization with infinite v*, the Inverse Gamma dis- tributions are converged to delta probability distribution, such that lim g(o²) = 8(a²), limy+ p(a²) 8(o²). Hence, stochasticity after its training with the approximate posterior (w) via the zero convergence variance. For the hierarchical-EL. -LBOO, the tractable parameter & is not required anymore during sampling the weight parameters in Fig. (b). This is because 62 is sampled to zero from delta distribution such that 622 8(c,2) lim,-- lim -o Ig(v, 1). Thus, only the Normal distribution ((k) N(uu, of is involved in sampling the weight parameters as follows: w = Ai + oge. Here, according to the decomposition of the second term in Eq. (6) (()) is learned to follow the mean prior p(u | o²) with the optimal parameter X" such that lim p(u o²) = NO k(u, + aā)), where k is statistically proven be above one (see Appendix DD). Then, the variance dg of q(p) follows the variance k(m, + ob) of the mean prior, which is definitely larger than the variance og. In short, training the BNN with the approximate conjugate prior leads increase the change the weight parameters, such that w Po + at)t.. Therefore, we verify that the proposed method allows for the enhancement of the BNN's stochasticity through hierarchical-ELBB.
discover that the BNN from the ELBO generally loses its
EXPERIMENTS
In this section, we validate adversarial robustness of the proposed method compared to strong base- lines in various datasets. Since our method is inspired by adversarial training (Madry et al., 2018), BNN (Blundell al. 2015), and adversarial-BN. (Liu et al. 2019), these three comparison meth- ods are natural baseline methods.
Implementation Details. We conduct exhaustive experiments on not only a standard low dimen- sional dataset (CIFAR-10), but also more challenging datasets such as CIFAR-100, STL-10 (Coates et al. 2011), and ImageNet (Le & Yang 2015). STL-10 has 5,000 training images and 8,000 testing images with size of 96x96 pixels. Timy-ImageNet is a small subset of ImageNet dataset, containing 100,000 training images, 10,000 validation images, and 10,000 testing images separated in 200 different classes, whose dimensions are 64x64 pixels. Two vanilla networks, VGG and Model A are adopted our baseline networks. Model A is trained for STL-10 while the others trained via VGG, Each baseline network is trained with L 0.03 perturbation magnitude during ad- versarial training stage for comparing baseline methods and Ours. For validation, we apply the PGD attack and EOT-PGD attack to the test set, and adjust Lx perturbation magnitude of the adversarial perturbation å from 0 to 0.03 within the perturbation magnitude used in adversarial training.
Computational complexity. According to Theoretical Analysis above, the number of learning parameters in the proposed method is same number of those in the adversarial-BNN. Thus, there is no excessive computational complexity to implement the proposed method.
Hlype--paaameter To fairly validate adversarial robustness, we equally set hyper-parameter set- tings that learning rate equals to 0.01 with Adam (Kingma & Ba 2015), and the learning parameters (mean and variance) are initialized to each U 1/-1/vc///// (c: channel number) and 0.1 (what
Publicly at http://///.tttooo/////////////// master/stTi0

---

Under review as a conference paper at ICLR 2021
The statistical summaries for the weight parameters compared with adversarial-BNN and Ours. We include mean, variance, and KL divergence (KLD). We describe the average of KLD for all layers in deep neural networks. Outperforming statistical results are marked in bold. The proposed method provides non-zero mean, higher variance (see Appendix F.. and lower KLD.
Table I:
CIFAR-10 10
S11.-10
CIFAR-100
Tiny- ImageNet
Mean
Variance
KLD
Mcan
Variance
KLD
Mcan
Variance
KLD
Mcan
Variance
KLD
adv-BNN adv-Ours
0
0.073
6,25
0.085
1.28
0
0.073
8.87
0
0.069
15.53
0.004
0.141
1.12
0.003
0.101
0.96
0.003
0.118
1.01
0.015
0.226
1.42
(PO0] 11
500057L-11 STL-10
(100) GIFAR-100
[PO0] Tey-Imagohii
70
374
(80)
2 601
10
0.235 3.11
2015 1.00
6005
2.055
2011
5.15
0/22
0.325
0.33
0.035
3.01
6/0
0,02
0.33
0.395
0.21
2.11
1.02
5.05
0.33
Perarbatoon Magritads
Pertubstionn Maggaadee
Perturbation Magiiluds
Perurbirion Magrituds
[EOT D1FA
[EOT|POO] STL-10
[BOT CIFAR-100
(EOT)P00) Tryy ImoggMet
23-660
10-0.1
30
23
22
0/4/
Pertabadon Magritate
Perturatioon Magnitude
Perturaatinn Magnitade
Pertabbrdo Nagrihade
Figure 2: Comparison of classification accuracy under PGD attack (first row) and EOT-PGD attack (second row) the Los perturbation magnitude on different datasets: CIFAR-IO, STL-10, CIFAR- 100, and Tiny-ImageNo
we are interested in after training). For PGD attack, we set the number of steps T to 10 in adversarial training stage and 30 in test stage, and set the step size n, to 2,55. For EOT-PGD attack, we equally use the spperr-arrmeterss of PGD attack and set the number of samples to 10.
Stochasticity and Regularization. Tab. shows comparison of statistical summaries for the weight parameters such mean, variance and KL. divergence in adversarial training with BNN and Ours. The summaries shows that naively putting BNN to adversarial training reduces the variance, and even fails to maintain the initial variance 0.1. In addition, the decreased variance causes higher KL divergence. This phenomenon shows an empirical evidence on the recall of the vanished stochas- ticity from adversarial training with BNN, where the broken BNN regularizer increases the KL divergence. Conversely, the proposed method shows comparatively higher variance (more increased variance than the initial variance) and lower KL. divergence (6.7 times lower on average across all datasets). Therefore, we expect the proposed method to have a strong regularization effect so that the robustness discrepancy between adversarial-Be -NNN and Ours becomes greater in large datasets with more classes such as CIFAR- 100 and TinyIImaeNNet
Robustness under white-box PGD and EOT-PGD attack. First, we compare adversarially trained baseline networks with baseline methods and Ours by adversarial robustness under the white-box PGD attack (first row in the Fig. 2 and EOT-PGD (second row in the Fig. 2 the Los perturbation. As illustrated in this figure, adversarial-BN has greater performance on STL-10 than naive adver- sarial training, but it has lower performances on the other datasets. While, the proposed method outperforms baseline methods to all datasets.
Ablation studies. We conduct three ablation studies: (1) attacking with higher perturbation mag- nitude (8 > 0.03) than the perturbation magnitude of adversarial training, (2) adversarial training with large perturbation magnitude (ō 0.06) on WideResNet (Zagoruyko & Komodakis 2016). and (3) comparison of clean training and adversarial training with BNN and Ours. The two abla- tion studies (1) and (2) are represented in Fig. where the proposed method generally surpasses baseline methods, although it converges to the performances of baseline methods in much higher perturbation magnitude. For the ablation study (3), the statistical summaries of clean training on
8

---

Under review as a conference paper at ICLR 2021
Table 2: The statistical summaries between clean training without adversarial examples and adver- sarial training on WideResNet. The descriptions in this table are the same as Tab.
Clean training (8 0)
Adversarial training (4 0.06)
CIFAR-10
CIFAR-I00 100
CIFAR-I0
CIFAR- 100
Mcan
Variance
KLD
Mcan
Variance
KLD
Mcan
Variance
KLD
Mean
Variance
KLD
BNN Ours
0.077
5.82
0,065
23,59
adv-BNN adv-Ours
0.077
5.82
0
0.075
7.48
0.044
0.178
1.87
0.052
0,122
2.24
0.015
0.192
1.01
0.051
0.146
1.42
(M00) CIAM-110
30
0..1
29
20
Puttu
Perturtation Magntadee
Parturtortion Magnituce
JEon-P22) D1FAS-10
(EOT BTL-18
[EOT POO) CIRAR
[EOT POO] CIPAR 100
0.11
Curs
20
15
0.35 0
0.34
2.00
Perturbation Magrisado
Pertarbation Megnilude
Peeturtation Maggibade
Perturtarian Magnitace
(6) perturbtett magnitude on Reseline networks (6 0.03)
(b) adversarial trsining on WideResNet 0.06)
Figure 3: Comparison of classification accuracy for two ablation studies: (a) attacking with higher perturbation magnitude (8 > 0.03) than the maximum magnitude described in Fig. 2 on baseline networks (VGG, Model A) for CIFAR-10 and STL-10, (b) adversarial training with large perturba- tion magnitude (ò = 0.06) on WideResNet for CIFAR-IO and CIFAR-100, These graphs are under PGD attack (first row) and EOT-PGD attack (second row) to the L perturbation magnitude.
baseline networks (VGG, Model A) are illustrated in Appendix of clean training and adversarial training with BNN and Ours on WideResNet. They show that both variances of BNN are lower than those of Ours. That is, this vanished stochasticity also happens in normal BNN when clean training. Here, we can analyze that the superior robustness of Ours does not come from the improvement of classification accuracy by itself.
Further, Tab. 2 compares those
Discussion. We tackle why the proposed method is effective to EOT-like attack. In general, a ran- domized network provides stochastic tolerance obfuscating the gradient-based attack, which uses a single sample of the randomness. Especially, the BNN's stochasticity makes an attacker confused incorrectly estimate the true gradient. But, EOT-like attack easily bypasses this stochasticity by taking the expectation over multiple weight parameters. However, our re-birth of BNN's stochastic- ity against EOT-like attack can be mathematically represented by Taylor series (see Appendix G Now that it is possible to demonstrate the effectiveness of the proposed method against EOT-like attack, we can insist that the proposed method is not just obfuscating the gradient, but helping the deep neural networks to have strong adversarial robustness.
CONCLUSION
As mentioned in Theoretical Analysis at the Section 3 we have found that the BNN generally loses its stochasticity after its training with the BNN's posterior via the zero convergence variance. To solve it, we newly design the enhanced Bayesian regularizer with improved stochasticity through the hicrarchical-ELBB under a concept of the conjugate prior. In addition, we have analyzed the improved stochasticity is effective to BOT-like attack. We believe the hierarchical-ELLBO better approximates the true posterior against adversarial perturbations by the tight lower bound more than the ELBO, thus boosting the adversarial robustness. Further progress can be made by investigating the hierarchical-ELDR to explore generative models, such as Variational Auto uuto-Encoder (VAE) and Generative Adversarial Network (GAN) for scalable machine learning tasks.

---

Under review as a conference paper at ICLR 2021
REFERENCES
G. Apruzzese, M. Colajanni. L. Ferretti, and M. Marchetti. Addressing adversarial attacks against security systems based on machine learning. In 2019 11th International Conference on Cyber Conflict (CyCon), volume 900, pp. 1-18. 2019.
Anish Athalye, Nicholas Carlini, and David A. Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses adversarial examples. In ICML, pp. 274-283, 2018a. URL mww.mmm...mmm wtw.a/ppeee//////aaaaaaaa
http::/proceediing
html
Anish Athalye, Logan Engstrom, Andrew Hyas,, and Kevin Kwok. Synthesizing robust adversar- ial examples. volume 80 Proceedings of Machine Learning Research, pp. 284-293, Stock- holmsmässan, Stockholm Sweden, 10-15 Jul 2018b. PMLR. URL BRRphttp/pproceeiinng
mlr. wwwpspessseeeee. v80
Charles Blundell, Julien Cornebise, Koray Kavukcuoglu, and Daan Wierstra. Weight uncertainty in neural networks. In Proceedings of the 32nd International Conference on International Confer- ence on Machine Learning- Volume 37, ICML'15, pp. 1613-1622. JMLR.org, 2015.
Jacob Buckman, Aurko Roy, Colin Raffel, and lan Goodfellow. Thermometer encoding: One hot way resist adversarial examples. In International Conference Learning Representations, 2018.
Ginevra Carbone, Matthew Wicker, Luca Laurenti, Andrea Patane, Luca Bortolussi, and Guido Sanguinetti. Robustness of Bayesian Neural Networks to Gradient- Gradient-Based Attacks. arXiv e-prints, art. 2rXiv:2002.043599 February 2020.
N. Carlini and D. Wagner. Towards evaluating the robustness of neural networks. 2017 IEEE Symposium on Security and Privacy (SP), pp. 39-57, 2017.
Nicholas Carlini and David Wagner. Adversarial examples are not easily detected: Bypass- ing ten detection methods. In Proceedings of the 10th ACM Workshop Artificial Intelli- gence and Security, AlSec '17, pp. 3-14, New York, NY, USA, 2017. Association for Com- puting Machinery. ISBN 9781450352024, doi: 10.1145/3128572.314044
URL
https:
//doi. 1145/ T1E.11///11822.11111
Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. Zoo: Zeroth order op- timization based black-box attacks to deep neural networks without training substitute models. Proceedings of the 10th ACM Workshop Artificial Intelligence and Security, 2017.
Moustapha Cisse, Piotr Bojanowski, Edouard Grave, Yann Dauphin, and Nicolas Usunier. Parseval networks: Improving robustness to adversarial examples. arXiv preprint arXiv: 1704008847, 2017.
Adam Coates, Andrew Ng. and Honglak Lee. An analysis of single-layer networks in unsupervised feature learning. In Proceedings of the fourteenth international conference on artificial intelli- gence and statisties, pp. 215-223, 2011.
Guneet S. Dhillon, Kamyar Azizzadenesheli, Jeremy D. Bernstein, Jean Kossaifi, Aran Khanna, Zachary C. Lipton, and Animashree Anandkumar. Stochastic activation pruning for robust adversarial defense. In International Conference on Learning Representations, 2018. URL
https::/ http::///peereeieeeeemee .ne// www.foorruiiiiio utne///ooouu111--1uu44aa22
K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and
D. Song. Robust physical-world attacks on deep learning visual classification, In 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1625-1634, 2018.
Reuben Feinman, Ryan R. Curtin, Saurabh Shintre, and Andrew B. Gardner. Detecting adversarial samples from artifacts. ArXiv, abs/1 703.00410, 2017.
Yarin Gal and Zoubin Ghahramani. Dropout bayesian approximation: Representing model un- certainty in deep learning. In Proceedings of the 33rd International Conference on International Conference Machine Learning- Volume 48, ICML 16, pp. 1050-1059 1059. JML Mo...org. 2016.
10

---

Under review as a conference paper at ICLR 2021
Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations, 2015. URL http://
arxiv. www. wwt.:/ggg/abbsaa.eee.. httg//ab/14411... 6572
Alex Graves.
Practical variational inference for neural networks. In J. Shawe-Taylor, R. S. Zemel, P. Bartlett, F. Pereira, and K. Q. Weinberger (eds.), Advances in Neural Information Processing Systems 24, pp. 2348-2356. Curran Associates, Inc., 2011. URL httpthtppppppp.s...pppp cc/
pdf
Kathrin Grosse, Praveen Manoharan, Nicolas Papernot, Michael Backes, and Patrick McDaniel. On the (statistical) detection of adversarial examples. arXiv preprini arXiv:/702.06280) 2017.
Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens van der Maaten. Countering adversarial images using input transformations. In International Conference on Learning Representations, 2018. URL
Han Xu Yao Ma Hao-Chen, Liu Debayan Deb, Hui Liu Ji-L Tang Anil, and Jain. Adversarial attacks and defenses in images, graphs and text: review. International Journal of Automation and Computing, 17(2):151-178, 2020.
Matthias Hein and Maksym Andriushchenko. Formal guarantees on the robustness of a classifier against adversarial manipulation. In Advances in Neural Information Processing Systems, pp- 2266-2276, 2017.
José Miguel Herbández-Lobato and R. Adams. Probabilistic backpropagation for scalable learning of bayesian neural networks. In ICML, 2015.
Matthew D. Hoffman, David M. Blei, Chong Wang, and John Paisley. Stochastic variational inference. Journal of Machine Learning Research, 14(4):1303-1347, 2013. URL http:
wtt.i/aaaaooaaallaaaaaamaa html
Ruitong Huang, Bing Xu, Dale Schuurmans, and Csaba Szepesvári. Learning with strong adver- sary. http://arrxiv.orgaas//555// 1.03034, 11 2015.
Alex Kendall and Yarin Gal. What uncertainties do we need in bayesian deep learning for computer vision? In I. Guyon, U. V. Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vish- wanathan, and R. Garnett (eds.), Advances in Neural Information Processing Systems 30, pp. 5574-5584. Curran Associates, Inc., 2017. URL http: /papers//pppp.aappp n ps cc/paper/ pttpppcppppppppp.../..ccpppppp -e- need i www.nnaaaaaaanaaeae deep--aasssaaaee--eeeeep------e- -ewrmepppeeeeee-aoaaaaaae
comptter-iittinn. ot..opp....o..ooooooooooooooooo.
pdf
Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In Yoshua
Bengio and Yann LeCun (eds.), 3rd International Conference Learning Representations, ICLR 2015, San Diego, CA, USA. May 7-9, 2015, Conference Track Proceedings, 2015. URL http:
ab1/112 6980
Diederik P Kingma and Max Welling. Auto-encoding variational bayes. In International Confer- htwp:/ewwwwwwwwweeeeeeeeeeeeeeee ntrt/orummfttetee
ence on Learning Representations, 2014. URL
3 9Fydd
Alexey Kurakin, J. J. Goodfellow, and Samy Bengio. Adversarial machine learning at scale. 2017.
URL pectts://azxiie org/ aww.aassliii 01236
Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 231N, 7, 2015.
Xuanqing Liu, Minhao Cheng, Huan Zhang, and Cho-Jui Hsich. Towards robust neural networks via random self-ensemble. In Vittorio Ferrari, Martial Hebert, Cristian Sminchisescu, and Yair Weiss (eds.), Computer Vision - ECCV 2018, pp. 381-397, Cham, 2018. Springer International Publishing. ISBN 978-3-030-01234-2.
Xuanqing Liu, Yao Li, Chongruo Wu, and Cho-Jui Hsich. Adv-BNN: Improved adversarial defense through robust bayesian neural network. In International Conference on Learning Representa- fions, 2019. URL

---

Under review as a conference paper at ICLR 2021
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant to adversarial attacks. In International Conference on Lear- ing Representations, 2018. URL httpt::/t///eeeeeee /t// net Forum Ett.:rrrrmmiid111AaaA
Lars Mescheder, Sebastian Nowozin, and Andreas Geiger. Adversarial variational bayes: Unifying variational autoencoders and generative adversarial networks. In Proceedings of the 34th Inter- national Conference on Machine Learning Volume 70, ICML'IT 17, pp. 2391-2400. JMLR.org, 2017.
Jan Hendrik Metzen, Tim Genewein, Volker Fischer, and Bastian Bischoff. On detecting adversarial perturbations. arXiv preprint 1702:0007 2017.
John Paisley, David M. Blei, and Michael I. Jordan. Variational bayesian inference with stochas- tic search. In Proceedings of the 29th International Coference on International Conference on Machine Learning, ICML' 12, pp. 1363-1370, Madison, WI, USA, 2012. Omnipress. ISBN 9781450312851.
Nicolas Papernot, Patrick D. McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as defense to adversarial perturbations against deep neural networks. 2016 IEEE Symposium Security and Privacy (SP), pp. 582-597, 2016.
Nicolas Papernot, P. McDaniel, Ian J. Goodfellow, S. Jha, Z. Y. Celik, and A. Swami. Practical black-box attacks against machine learning. Proceedings of the 2017 ACM on Asia Conference Computer and Communications Security, 2017.
Tim Pearce, Felix Leibfried, and Alexandra Brintrup. Uncertainty in neural networks: Approxi- mately bayesian ensembling. volume 108 of Proceedings of Machine Learning Research, pp. 234 244, Online, 26-28 Aug 2020. PMLR. URL
mlr. press/
9108/pearce22a.ntee html
Aditi Raghunathan, Jacob Steinhardt, and Percy Liang. Certified defenses against adversarial exam- ples. arXiv preprint arXiv: 2018.
Danilo Jimenez Rezende, Shakir Mohamed, and Daan Wierstra. Stochastic backpropagation and approximate inference in deep generative models. volume 32 of Proceedings of Machine Learning Research, pp. 1278-1286, Bejing, China, 22-24 Jun 2014. PMLR. URL http:
//proceedings ml press vv2
v32 rewendeleeeeeeee 4. html
Ihai Rosenberg, Asaf Shabtai, Yuval Elovici, and Lior Rokach. Adversarial Learning in the Cyber Security Domain. arXiv e-prints, art. m:Xiv:2007.024000 July 2020.
Y. E. Sagduyu, Y. Shi, and T. Erpek. lot network security from the perspective of adversarial deep learning. In 2019 16th Annual IEEE International Conference on Sensing, Communication, and Networking (SECON), pp. 2019.
Kuniaki Saito, Yoshitaka Ushiku, Tatsuya Harada, and Kate Saenko. Adversarial dropout reg- ularization. In International Conference on Learning Representations, 2018. URL https:
//openreview. 1
Tim Salimans and David A. Knowles. Fixed-form variational posterior approximation through stochastic linear regression. Bayesian Anal., 8(4):837-88) 882, 12 2013. doi: 10.1214/13-BA88.
URL http:htt::///
121401.1214133 BB8888
Samuel Henrique Silva and Peyman Najafirad. Opportunities and challenges in deep learning ad- versarial robustness: A survey. arXiv preprint arXiv:2007.00753 2020.
Lewis Smith and Yarin Gal. Understanding measures of uncertainty for adversarial example detec- tion. In Amir Globerson and Ricardo Silva (eds.), Proceedings of the Thirty-Fourd Conference on Uncertainty in Artificial Intelligence. UAI 2018, Monterey, California. USA, August 6-10, 2018, pp. 560-569 569. AUAI Press, 2018 URL http:://aaa...ooo/oo//////eeeeee papers//07.po
12

---

Under review as a conference paper at ICLR 2021
S. Sun, P. Guo, L. Xie, and M. Hwang. Adversarial regularization for attention based end-to-end robust speech recognition. JEEE/ACM Transactions on Audio, Speech, and Language Processing, (((1))1826-1888, 2019.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfel- low, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2014.
org/ 1312. 6199
Dávid Terjék. Adversarial regulaiiiotreallariizaiiooo In International Conference on Learning Repre- sentations, 2020. URL http:p/:e/ppeneeeeeeeeeeeerroooe
Kang Wang, Rui Zhao, Hui Su, and Qiang Ji. Generalizing eye tracking with bayesian adversarial learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogni- fion (CVPR), June 2019a.
Kuan-Chich Wang, Paul Vicol, James Lucas, Li Gu, Roger B. Grosse, and Richard S. Zemel. Adversarial distillation of bayesian neural network posteriors. In Jennifer G. Dy and Andreas Krause (eds.), Proceedings of the 35th International Conference on Machine Learning, ICML 2018, Stockholmsmässsan, Stockholm, Sweden, July 10-15, 2018, volume 80 of Proceedings of Machine Learning Research, pp. 5177-5186. PMLR, 2018. URL http::/pproceeddnng/
m1 ww..prss/vvl http/////wwww/ggg//// wang html
Xianmin Wang, Jing Li, Xiaohui Kuang, Yu Tan, and Jin Li. The security of machine learning in an adversarial setting: A survey. Journal of Parallel and Distributed Computing, 130:12 doi: https://oii.ong/// 1pw. 7/ w/www.ak recc wwteeeetttcccccceieeeeeeeee cttp://sceeeceerrrtreee////////a
23, 2019b. ISSN 0743-7315.
URL http:
com/
Max Welling and Yee Whye Teh. Bayesian learning via stochastic gradient langevin dynamics. In Proceedings of the 28th International Conference on International Conference on Machine Learning, ICML'11, pp. 681-688, Madison, WI, USA, 2011. Omnipress. ISBN 97814503061999 195.
Eric Wong and Zico Kolter. Provable defenses against adversarial examples via the convex outer 5286 5286-5295. P8886-5229.,,RR adversarial polytope. In International Conference on Machine Learning, pp. 2018.
Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv preprint arXivv1704.01155 2017.
Nanyang Ye and Zhanxing Zhu. Bayesian adversarial learning. In S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa-Bianchi, and R. Garnett (eds.), Advances in Neural In-
formation Processing Systems 31, pp. 6892-6901. Curran Associates, Inc., 2018, URL http: //papers.nnpp cc wwtppcpppppccccccccccccccee baapee///2llbaayssaaan - -eweerrrrrial--Larinnnnn pdf
Bing Yu, Jingfeng Wu, Jinwen Ma, and Zhanxing Zhu. Tangent-normal adversarial regularization for semi-supervised learning. In Proceedings of the IEEE/CV Conference on Computer Vision and Pattern Recognition (CVPR), June 2019.
Sergey Zagoruyko and Nikos Komodakis. arXiv:1605.07146, May 2016.
Wide Residual Networks. arXiv e-prints, art.
Valentina Zantedeschi, Maria-Irina Nicolae, and Ambrish Rawat. Efficient defenses against adver- sarial attacks. Proceedings of the 10th ACM Workshop Artificial Intelligence and Security, 2017.
Han Zhang, Zizhao Zhang, Augustus Odena, and Honglak Lee. Consistency regularization for generative adversarial networks. In International Conference on Learning Representcatinss 2020. URL wtthtttt:: httttp:://openrevieee wtt id= 1wwllxkkkkpppp
Yuchen Zhang and Percy Liang. Defending against whitebox adversarial attacks via randomized discretization. In AISTATS, 2019.
Roland S. Zimmermann. Comment on "Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Network". arXiv e-prints, art S1Ci::19770009999 July 2019.
13

---

Under review as a conference paper at ICLR 2021
A DECOMPOSITION OF KL DIVERGENCE IN HIERARCHICAL-ELLO
The approximate conjugate prior g(u,, o²) can be independently factorized into the Normal dis- tribution ((4) and the Inverse Gamma distribution g(o²) by the mean-field approximation. The hierarchical prior p(u, o²) is factorized into the mean prior p(u a²) and the variance prior p(o²).
The KL divergence the hierarchical-LLBBO can be decomposed as follows:
(xL(O(u,02) |1 p(u, o²))
Iʃ a(m, 02) o0) log a(1 0²) plu, 02) dudoz
/ʃ ((v))((²)) log a())((o?) plu? (o2) dpdo²
(9)
/ʃ ((H))((²))))) log q()) plu 02) dpdo + // a(u))(())) g(02)
p(o2) audo?
/a()2) If ((1) log g(m)
p(u 02) du do² + a(00)) log log g(03) p(o2) do² do?
= (DKz(O(A) ll plu [o)))] + +DILa(O") p(o2)).
B FULL EXPANSION OF KL DIVERGENCE IN HIBRARCHICAL-ELBO
The first term in the KI. divergence at the hierarchical-ELBOO can be written as:
Egang(02) (DKL(G(H) |l 1( [d]]]
M
Σ
E Ro3-g(of) (Dxc(((1s) 11 p(u5 of))]
(by Lemma B.4
3=1
(10)
0 + nb,
1
XJ ]
1
E )(3))(
log
(by Lemma B.
22, 03
2
0o.
2
M
0 + M0.
A7 b4
11 (vy)
1]
log
(by Lemma B.2
2x," 13
2
2
2
2
3=1
where
a(w)) = NNu,) (40,),
p(u (o)) = N 10,1'007 03).
(1I)
14

---

Under review as a conference paper at ICLR 2021
The second term in the KL divergence at the hierarchical-ELBB can be written
M
Σ
(by Lemma B.4
(12)
1/1 -1 Dj log 13 uj 4/
Σ
(by Lemmal B.3
where
{ - I9(o]) kg)))), p(oz)= = I9(0}) Uy k2,1). 1).
(13)
Full expansion of the KL divergence be computed by the summation of the above terms Eq. 10 and Eq. 12.. The formulation can be written as:
20y
M M ==1
+ +1 +2
2v + 1
1 (Vz)
DKzla(uoo") ll p(u,
=
+ +log
2
(1.0
2
2
r (V))
(14)
Lemma B.1. KL divergence between two Gaussian distributions.
Dkc((()))l((z)) 0² + (Mg ppp
1
0²
log
2 p
2
0
2'
where
(xx) N Mg. o p(x) = N(x
Mpp og)
Lemma B.2. The expected Inverse Gamma distribution
1
E2wg(z) (log x/ log I' ['vv)
E Ex)g(a)
[(v)*
where
((x) = Ig(( (2,b)) = 132"
x (((+1) exp (-vxx-
[(v]
15

---

Under review as a conference paper at ICLR 2021
Lemma B.3. KL divergence between two Inverse Gamma distributions
Píp x. (v+1) exp (- 1
DkL((())ll((z)) / ((x) log
(v+ 1) exp (- dx
[(r]
= =f ((x)) log
exp (-(1h - &2))0 dr
= = ((x) v log
Uu - (1/ -(1'
16 -1 dx
upp
= vllog 1/4
- (1)) 2)p) /
g(x)
dx
1pp
x
1/ =vlog
v( -1bp) tbp))
(by Lemma B.2
1pp
4/4
where
((x) = II v. 14),
p(z) IG(x 2/p)
Lemma B.4. KL divergence with independent random variables
Dku((())lo(=))= /f /
/ ((x)) log ((x)
da fiidx2 ... da
p(x)
|1 . a()) J/
II g p(a,)
d dx
do M
Σ 11 .
M
/ ((x)) log g(1;)
dxy dx2 da
p(x,))
M
((x;)) log (( day x II a(xx)dos
M
p(
Dxu (xo(((=)))lotz))
DEL DKL (((x))))ll)(zz)
1=1
where
M
M
x (2,, ... (.M) ((x) = II ((x)). p(x) II p(x.).
16

---

Under review as a conference paper at ICLR 2021
C
FUNCTION ANALYSIS
30
10
20
11(2)
H((r))
10
-10
-20
-10
-30
5
10
15
20
25
30
10
15
20
25
30
"
(a) The function
(b) The derivative of the function H
Figure 4: Function analysis for (a) the function H, and (b) the derivative of the function H,
where
1 G(s)) + log Vj
H(v,)
G(Uj)
2 dvg
2
2
(15)
1 2
Vj
I' (Mz) T(v;)
1
+ log Uj >
2 k=0
(Vj + k)²
2
and
lim H()))) 0+ +00
(16)
where
H'(vz)) V/j d²
G(u:) 2v3
du²
(17)
Vj
1 <0
(Vj + k-)3
20g
k=0
and
lim H';x;)) = = 45
(18)
D PROOF OF k VALUE
The Normal distribution q(H) = N(ug. o.) is learned to follow the mean prior p(H o²) =
\( (A²)- with the optimal value X* = w va?
+ingtoj5 The mean prior's variance equals to V (ng + o))) Here, 62² o² is sampled from IG(p, 1), depicted in the Fig. bb. Thus, the v
variance is written as: vega (H) + o,) Now, we can statistically estimate Me," by the expectation over 6 IG(v, 1). Then, it satisfies E.e, [PEza] --a 1. Hence, the mean prior p(u 0²) can be designed to (0, k(pg + of)), where & > 1.
17

---

Under review as a conference paper at ICLR 2021
E CLEAN TRAINING WITHOUT ADVERSARIAL EXAMPLES
Table 3:
On the clean training, the statistical summaries for the weight parameters compared with BNN and Ours. We include mean, variance, and KL divergence (KLD). We describe the average of KLD for all layers in deep neural networks. Outperforming statistical results marked in bold.
CIFAR-I0
STL-10
CIFAR-100
Tiny- Net
Mean
Variance
KLD
Mean
Variance
KLD
Mean
Variance
KLD
Mean
Variance
KLD
BNN
0.071
7.7
0.051
2.5
0.068
15.4
0.064
26.7
Ours
0.003
0.129
1.0
0.002
0.092
0.007
0.109
1.4
0.028
0.211
1.8
(P00)
(P00)
(P00) Try ImageeMer
14h
10
64
60
20
2015
8.0
600
0.05
0015
0,22
0.33
0.305
0.15
0.22
3.2
0.00
c015
002
Portatbadon Mageiade
Magnitute
Magebbudo
Magiaute
(TOT-P00) CERAR-10
[EOT-PGO STL-12
(TOT-P00) CIRAR-102
[SOT-POD] Thy-lnagehel
0.99
Out
20
2.00
Pertuttdon Megriade
Perturbation Magritude
Perurtorion Magritdo
Mag
Figure 5: Comparison of classification accuracy without adversarial training. These graphs are under PGD attack (first row) and EOT-PGD attack (second row) the Too perturbation magnitude on different datasets: CIFAR-10, STI-10, CIFAR-100, and Tiny-mmageNet.
F NON-ZERO MEAN AND HIGHER VARIANCE
Non-zero Mean. According to the experiment results in Tab. 13 the mean learned from adver- sarial training with BNN follows zero, while the mean from the proposed method follows non-zero. Analyzing KL divergences between ELBO and hicrarchical-ELa nomenon. The relationship of their KL divergences can be written as follows:
can provide a clue to this phe-
DKL(a(u, o²) o(u, DKI(a(w) l| p(w))
(19)
for hicrarchical-ELBB0
for ELBO
The left KL divergence above represents the proposed method to better approximate the true poste- rior by the tight lower bound of hierarchical-ELB2 and the right one denotes the BNN regularizer in ELBO during adversarial training with BNN. Through the optimization described in the Section the proposed method can be much smaller than the BNN regularizer. Based on this relationship of Eq. (19). it is not required that hierarchical-Ei BEL.O concentrates on learning its KL divergence due to already optimized strong regularization. In contrast, ELBO more tries to reduce its KL divergence to improve regularization effect through the zero mean, the purpose of which is addressing weak regularization effect attributed by the vanished stochasticity. At this time, the proposed method rel- atively more focuses to learn the expected log- likelioooo in the hierarchical-EI does not have to be zero, Instead, the mean is adaptively learned according to the characteristics of the datasets.
where the mean
18

---

Under review as a conference paper at ICLR 2021
Higher Variance. As also shown in Tab. I the proposed method promotes higher variance compared to the initial variance 0.1. While, adversarial training with BNN has lower variance causing the lack of its stochasticity. We contemplate whether the stochasticity and higher variance purely affects the adversarial robustness of the deep neural networks. To examine this impact, we handle the magnitude of the derivative the log-likelihood over the weight parameters, which can be written as follows:
d log ply add w)
1 d de
log ply
aado 1 oe)
(20)
where w = = + de, such that e (0, 1). Note that for mathematical convenience, the denoted j and 6² correspond to the mean and the variance respectively in both adversarial training with BNN and Ours.
Eq. (20) explicates the magnitude of the change in the cross-entropy as the weight parameters change from the variation of e, which can be represented to: dw ade. Once the variance gets much smaller due to the vanished stochasticity, the magnitude becomes larger. That is, prediction results of the deep neural networks differ significantly from the slight change of the weight parameters, 1 a( O)e. The large change in cross-entropy makes ELBO inconsistent, and
such that loses adversarial robustness. contrast, once the variance from the proposed method gets much larger, the prediction results robust the large change of the weight parameters, where the mag- nitude becomes smaller. Accordingly, Eq. (20) guides the proposed method to keep the maximum hierarchical-ELBBO consistent by the higher variance, thus better obtaining well-posed inference to boost adversarial robustness. Consequently, we verify that the higher variance has a positive impact on adversarial robustness by itself with large BNN's s stochasticity.
G ROBUSTNESS OF PROPOSED METHOD AGAINST EOT-LIKE ATTACK
Let T(w) = V.J (f (z.. where w denotes the weight parameters w = + ae, such that e ~- ((0, 1). Note that for mathematical convenience, the denoted μ and o² correspond to the mean and the variance respectively in both adversarial training with BNN and Ours.
Expectation Transformation (EOT) attack is well-known adaptive attack targeting randomized neural networks. The EOT-like attack easily bypasses the stochasticity of randomized classifiers by taking the expectation over the multiple weight parameters to compute the actual gradient. The formulation of the expected 7 over the weight parameters can be written as follows:
E,, [T(w)] = [T ac)].
(21)
According to Taylor series, the above equation can be written as follows:
(e) + (oe)²
E. [e)] = [.(T())+
1 (n) +...]
2!
(22)
(ac)2
= [.[ +B, (oETT E,l
7 (4) +....
21
actual gradicut
For naive adversarial training (a is not used), the expected can be written as:
E, [T()) T(u).
(23)
For adversarial training with BNN, the variance o² the approximate posterior ((w) becomes to be reduced, Taylor series ends up with first-order approximation. Eq. (2) can be written
19

---

Under review as a conference paper at ICLR 2021
E. [T + [e)] = E,(T([]]
+ [E.[oTT(()) = T(p),
(24)
which equals the result of the expected T from naive adversarial training in Eq. (23) On the other hand, the proposed method can enhance the BNN's stochasticity with the large enough variance o². Hence, the remaining higher order terms of Taylor series in Eq. (22) still survive at even degree, which can be written as:
E, (T + ]c)] = B.(T(H) + (e) + (oc)
(n) +...]
2!
(25)
0²
T(u)
T
2
gradient
stochastic tolerant terms
The remaining terms of Taylor series make a difference from the actual gradient as opposed to adversarial training and adversarial-BAi BNN. Here, these terms retain stochastic tolerance against EOT- like attack, thus bringing the improvement of adversarial robustness as the effectiveness of the proposed method.
20


Reviews:
[{"review_id": "y_Xl8eyYieW", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "In this paper the authors study the adversarial robustness of BNNs on large scale datasets. BNNs have been shown to be a more robust learning paradigm due to their uncertainty/stochasticity. Given the empirical observation that adversarially trained BNN posterior variances converge to zero (which the authors need to do much more to show as this is not a well-established phenomena), the authors propose a hierarchical prior where they put a prior over the parameters of the Gaussian prior normally used  in mean-field variational inference. The authors show that performing approximate inference with a hierarchical prior leads to an increased variational posterior variance, which the authors claim is correlated to the observation of increased adversarial robustness. \n\nI think the empirical results are solid, and the direction of the paper is ultimately an important one. I truly encourage the authors to continue to pursue this topic. \n\nUnfortunately, this paper is severely handicapped by its lack of clarity in terms of accurate contextualization, and its pervasive use of misnomers.  These misnomers are so prevalent that they would certainly lead uninformed readers to incorrect conclusions about Bayesian deep learning. \n\n* On the “true posterior:”  There are many places throughout the paper where the authors discuss/reference the computation of the true posterior for a Bayesian deep neural network. This can only be done by exact Bayesian inference. That includes (1) proper marginalization over the space of parameters (2) normalization wrt p(X). Given a DNN with non-linear activations, computation of the true posterior is intractable. Despite this, the authors claim that one can infer the true posterior via variation inference methods (bottom of pg 1). Variational inference makes a closed form approximation of the posterior that one tries to learn the parameters of. Even learning the optimal parameters does not guarantee convergence, outside of the case of conjugation.  Further on this, computing the true adversarial posterior is even more intractable given that the intractability of computing the optimal adversarial example compounds the issue of performing exact Bayesian inference.\n\n* Conjugate priors and hierarchical priors are distinct under the Bayesian framework. Despite this, the authors name their hierarchical prior the “conjugate” prior. In this work, the authors suggest placing a prior distribution over the parameters of their prior distribution (i.e. a hierarchical prior), yet call it a conjugate prior. A conjugate prior in the standard Bayesian literature is a prior which is known to be in the same family as the true posterior. It is not known, and likely not true, that for general approximate Bayesian neural networks (e.g. mean-field approximations) the true or approximate posterior is Gaussian. Thus, it is likely false to call a mean-field prior approximation a “conjugate” prior.\n\n * Robust Optimization is the special case of adversarial training where only adversarial data is used. The authors conflate adversarial optimization (optimization with respect to an adversarial objective) with robust optimization which has a rich history in optimization prior to its application to deep learning. The end of section 2.1 should have its terminology corrected.  \n\n* On the notion of ‘regularization’ in Bayesian deep learning. In several places the authors refer to the regularization term of the ELBO objective. This regularization term is the KL divergence with the prior distribution. While the prior distribution could be said to have a regularization effect on the posterior, saying that the prior distribution is a regularizer is reductive and probably misleading.\n\n\n----------------------------------------------\n\nFollowing the author's rebuttal I think the paper has benefitted from further experiments and from further clarifications. I would like to thank the authors for carefully considering my feedback and for modifying their paper in the directions I suggested. Ultimately, like I said in my original review, I think this is a very interesting and well-motivated problem, but I still have a few doubts. In particular, the doubt about the paper's use of the term of \"conjugate\" remains. In their rebuttal the authors use the term approximate-conjugate prior, but I am not sure that this is satisfactory as being conjugate means you have knowledge of the form of the true posterior's closed form, which is not the case for BNNs. \n\nI have increased my score to reflect that I think the authors are moving in a promising direction and I hope that they will continue with this work. One thing I will note on the experimental side of things is that having greater variance is indeed interesting, but it may or may not be correlated with increased uncertainty and this may be interesting to investigate in a future version of this work.\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "vp6VvPN7d8", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Updates:\nThe author addressed my concerns about the experiments. Though the improvement is marginal and I still have some concerns, I’m ok to accept the paper. I’ll change my score to 6.\n========================\n\nSummary:\nThe paper studied the adversarial Bayesian Neural Network and found that the stochasticity of it vanished. As stochasticity can help improve robustness against adversarial examples, the author proposed to use conjugate prior of Gaussian posterior to improve stochasticity of the model and robustness at the same time.\n\nStrength:\nExperiments show that the proposed method outperforms adversarial-BNN and adversarial training on several benchmark datasets and the stochasticity of the proposed model is larger than adversarial-BNN.\n\nWeakness:\nThe evaluation is somehow questionable. Checked the original paper of adversarial-BNN and found that the performances of adversarial-BNN is much better than reported in this paper. In both papers, VGG16 is the base structure of BNN, but the reported performances of adv-BNN and adversarial training are different in two papers on CIFAR10.\n\nCIFAR10 Results\n\n| $\\epsilon$ | adv-BNN | adv-BNN(in this paper) | adv | adv (in this paper)|\n|:------:|:-----:|:------:|:-----:|:------:|\n| 0 | 79.7 | 62 | 80.3| 72 |\n|0.015 | 68.7 | 54| 58.3 | 60 |\n\nIt could be a problem of hyper-parameter tuning. Could the author provide some explanation on this?\n\nIn experiments, the models on CIFAR10 and STL10 are trained with $L_\\infty$ perturbation magnitude of 0.03. They are evaluated under PGD and EOT-PGD with $L_\\infty$ in $[0,0.03]$. The range of attack perturbation magnitude on CIFAR10 and STL10 could be larger, such as $[0,0.08]$, to better compare the baselines with the proposed method.\n\nClarity and Correctness:\nThe paper is well written and easy to follow but the experiments might be problematic.\n\nReproducibility:\nCode of the method is not available.\n\nConclusion:\nThe idea is clear and novel but experiment results need more elaboration. Overall, I think the paper is marginally below the acceptance threshold. I like the idea of using conjugate prior to improve stochasticity and robustness. However, I'm a little bit concerned about the experiment results. If that can be addressed, I'm willing to accept the paper.\n\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "buAl4XO_88G", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Summary:\n\nThis paper presents a new adversarial training for BNNs with variational inference (VI). Specifically, Adv-BNN training of Liu et al. 2019 uses a standard normal prior for VI of BNNs.  The paper observes that the above method may have vanished stochasticity that reduces the robustness and the proposed method extends it with a conjugate prior constructed by a normal distribution and an inverse gamma distribution. This extension results in a stronger regularisation of the weights of BNNs, which can enhance the robustness against adv attacks and leads to a hierarchical inference. The method is reported to have better performance than vanilla adv training and adv-BNN training on several benchmark datasets.\n\nPros:\n- It is an interesting and motivative observation that AdV-BNN has vanished stochasticity issue, which is important for BNNs.\n\n- The proposed method is a straightforward way to address the vanished stochasticity issue.\n\n- The results in Table 1 are intuitive, which directly shows the proposed method has more stochasticity than Adv-BNNs.\n\nCons:\n\n- It is concerning that the reported performance of Adv-BNN in this paper has a significant difference than that reported in the original paper. In this paper, Adv-BNN performs worse than the vanilla adv training with a large margin, which is a bit surprised. Therefore, it is unclear whether it is Adv-BNN not working or it is the settings/implementations of this paper having something wrong. Given this fact, the performance reported in this paper seems to be ungrounded. It is hard to justify the true performance advantage reported in this paper.\n\n- The approach might be less related to the topic of \"hierarchical inference\", as it's only replacing the standard Gaussian with a normal-inverse-gamma distribution, which only affects the KL divergence in this case, where there are no intermediate variables are inferred.\n\n- Minor: Some of the notations and equations are a bit unclear. For example, q has been used to denote the posterior but it denotes the prior in Eq. (5)\n\n--------------------------------------------------------------------------------------------------------------------------------------------------\n\nThe author response addresses my major concern on the experimental results. Therefore, I have updated my rating from 5 to 6.\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "-YIQpmKWob3", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper studies the adversarial robustness of DNNs with Bayesian neural networks. Although BNN has been integrated with adversarial training for better robustness, this paper argues that the previous method lacks the stochasticity (i.e., the posterior tends to have zero variance), thus limiting the robustness performance. In this paper, a new hierarchical variational inference is proposed to enhance the robustness when integrating with adversarial training. The proposed method is presented well. The experiments show the effectiveness of the proposed method.\n\nBesides, I have few concerns about this paper.\n\n1. This paper argues that the previous method (ADV-BNN) learns the posterior distribution that has near zero variance, but does not analyze why ADV-BNN causes this phenomenon. Does normal BNN models (without adversarial training) also have this issue?\n\n2. The experimental settings are unclear in the context. The parameters of PGD and EOT-PGD are not stated (e.g., number of steps, step size, number of samples in EOT, etc.). Therefore, it is hard to judge the significance of the results.\n\n3. This paper lacks the comparison with the state-of-the-art methods. A common practice is to use Wide ResNet models for adversarial training and set the L_infty norm of perturbation as 16/255. I suggest the authors to compare with the public adversarial training models.", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper improves on previous work (adv-BNN) with hierarchical variational inference. It observes that mean-field VI training for BNNs often result in close-to-deterministic approximate posterior distributions for weights, which effectively makes the BNN closer to deterministic neural network, thereby loosing the robustness advantage of stochastic neural networks. To address this, a hierarchical prior is proposed on the weights, which, together with the corresponding approximate posterior design, aims at preventing the collapse of the variances of the weights towards zero. This improved version of adv-BNN is shown to be reasonably better than the original adv-BNN and their deterministic counter-part against the PGD and EOT attacks on a various of benchmark dataset in the adversarial robustness literature.

Reviewers initially had questions about whether the comparison is fair to the original adv-BNN since the reported results were very different. This issue has been addressed by the authors during the author feedback period, after that reviewers agreed that the proposed approach is a good extension of adv-BNN towards making it more robust. They also agree that the analysis of the original adv-BNN in terms of posterior variance collapse is interesting and potentially useful, although they also pointed out the link of increased variance (with the proposed method) and better uncertainty estimation is unclear.

In revision, I would encourage the authors to clear up the confusions of the reviewers by clearly stating the comparison setting with the original adv-BNN, and better clarify the methodology.
Decision: Reject