Bayesian Learning with Information Gain Provably Bounds Risk for a Robust Adversarial Defense
Authors: Bao Gia Doan
Ehsan M Abbasnejad
Damith C. Ranasinghe
Venue: ICLR 2022 Submitted (2022)

Abstract: In this paper, we present a novel method to learn a Bayesian neural network robust against adversarial attacks. Previous algorithms have shown an adversarially trained Bayesian Neural Network (BNN) provides improved robustness against attacks. However, the learning approach for approximating the multi-modal Bayesian posterior leads to mode collapse with consequential sub-par robustness and under performance of an adversarially trained BNN. Instead, we propose approximating the multi-modal posterior of a BNN to prevent mode collapse and encourage diversity over learned posterior distributions of models to develop a novel adversarial training method for BNNs.  Importantly, we conceptualize and formulate information gain (IG) in the adversarial Bayesian learning context and prove, training a BNN with IG bounds the difference between the conventional empirical risk with the risk obtained from adversarial training---our intuition is that information gain from benign and adversarial examples should be the same for a robust BNN. Extensive experimental results demonstrate our proposed algorithm to achieve state-of-the-art performance under strong adversarial attacks.

Under review as a conference paper at ICLR 2022
BAYESIAN LEARNING WITH INFORMATION GAIN PROVABLY BOUNDS RISK FOR A ROBUST ADVERSAR- IAL DEFENSE
Anonymous authors Paper under double-blind review
ABSTRACT
In this paper, we present a novel method to learn Bayesian neural network ro- bust against adversarial attacks. Previous algorithms have shown an adversarially trained Bayesian Neural Network (BNN) provides improved robustness against at- tacks. However, the learning approach for approximating the multi-modal Bayesian posterior leads to mode collapse with consequential sub-par robustness and under performance of an adversarially trained BNN. Instead, we propose approximating the multi-modal posterior of BNN prevent mode collapse and encourage diver- sity over learned posterior distributions of models to develop novel adversarial training method for BNNs. Importantly, we conceptualize and formulate infor- mation gain (IG) in the adversarial Bayesian learning context and prove, training a BNN with IG bounds the difference between the conventional empirical risk with the risk obtained from adversarial training- our intuition is that information gain from data and adversarial examples should be the same for a robust BNN. Extensive experimental results demonstrate our proposed algorithm to achieve state-of of--oe--thhrrr-- art performance under strong adversarial attacks.
INTRODUCTION
Deep neural networks (DNNs) have demonstrated impressive performance on multiple tasks, such as image recognition (He al. 2016) or natural language processing (Vaswani al., 2017). However. despite the impressive performance, DNNs are poor at quantifying the predictive uncertainty and tend to produce overconfident predictions. Consequently, it has been shown be vulnerable to adversarial examples (AEs) (Goodfellow et al. 2015: Madry et al. 2018 Carlini & Wagner (017)) where carefully crafted perturbations are added to the inputs to drive the performance of DNNs. These perturbations are imperceptible to human eyes (Goodfellow et al.] (2055) (in the context of
image classification) but can drastically degrade the performance of the DNNs. There are various methods find such perturbations (Madry et al. [2018 Goodfellow et al. 2015 Carlini & Wagner Papernot et al.)
2016a). Importantly, these threats are also shown to be effective in the physical 2018 (018//ykholl et al. 2018) and are shown to be effective in transferring across models to make black-box attacks (Papernot et al. (2016a] 2017). Therefore, adversarial perturbations present realistic threat for DNN applications and motivate the need to develop robust DNNs.
world (Kurakin et al.
Despite the huge amount of effort to overcome the thread from AES since its first introduction in 2014 (Szegedy et al. 2014), training robust DNN against AEs is challenging. Athalye al. (2018) have shown that one of the most robust methods to defend against this threat is Adversarial Training (Madry et al. 2018). In this method, the network is trained with adversarial examples in order to create robustness against the AEs at inference time. Nevertheless, as mentioned in Ye & Zhu (2018), this method relies on the "point estimate" approach of the deep neural network ; hence lacks the capability to deal with the uncertainty of the adversary at inference time i.e. adversaries beyond the pre-defined norm. In addition, using a point estimate only defines a single decision boundary that could be manipulated easily with an adversarial input. Alternatively, one can use multiple decision boundaries, or more precisely, integrate out the effects parameters in the model. That is the premise of Bayesian learning methods Welling & Teh (201)) that define distribution over the parameters leading to Bayesian Deep Neural Networks (BNNs). Thus, the output of predictive distribution is obtained by integrating out the parameters w.r.t. their distribution.

---

Under review as a conference paper at ICLR 2022
Motivated by the intuition that removing the effects of the parameter choice lead to more robust models, (Liu et al. (019)) proposed adversarial training of BNNs and demonstrated impressive results. However, training BNNs pose significant challenge: the exact solution of posterior distribution (i.e.
the parameter distribution after observing the data) is often intractable. Efforts devoted to developing
suitable inference approach approximate the posterior involve either using Markov Chain Monte
Carlo (MCMC; asymptotically accurate but slow; see e.g. (Welling & Tch 2011)) or variational inference (efficient but inaccurate; see e.g. (Blei al.
2017)). For instance. Liu et al. (2019) uses
variational methods (Blei et al., 2017, Blundell et al.
2015) to approximate the posterior with a
unimodal Gaussian distribution. The issue with such a method for deep learning is that the parameters sampled are in the proximity of the mode and, consequently, does not capture the multi-modal aspect of the distribution. This leads to attaining only minor variations parameters and sub-par robustness.
In this study, inspired by BNNs, we consider a novel approach for robust learning. We hypothesize (I) a model that relies on the parameter distribution rather than a single point estimate which (2) predicts the same predictive distribution for both the given dataset and its adversarials, is more robust. Inspired by (Liu & Wang 2016), to achieve (1) to remedy the lack of diversity in parameters we exploit Stein Variational Gradient Descent (SVGD). SVGD marries MCMC and variational inference to attain the benefits of both. leads to sampling a set of parameter "particles" that are encouraged to be diverse fit the modes of the true posterior distribution. Further, by utilizing this approach for achieving (2), we compute the Information Gain (IG) for each input instance. In other words, we measure value of knowing the label for an input given the posterior distribution for either the given benign training set versus the adversarial counterparts. This simply translates to matching the predictive distribution of the benign the adversarial instances.
Given our intuitions, we designed an objective that satisfies our hypothesis. Further, show that our conceptualization and formulation of information gain (IG) in the adversarial Bayesian learning context bounds the difference between the conventional empirical risk with the risk obtained from adversarial training. This is the firxt such bound that establishes the relation between Bayesian learning with information gain to the generalization of empirical risk minimization (ERM). We summarize our results and contributions below:
We propose a novel method to learn a BNN robust against adversarial attacks that utilizes: i) the information gain of the instances from the dataset; and ii) SVGD to generate parameter particles that are trained in parallel to be as diverse as possible while maintaining the same measure of information content for benign and adversarial training instances. Our learning approach enables the model to both reduce the effect of single parameter choice and learn the invariant patterns that are common between the training dataset and its corresponding adversarial samples.
We show that learning a BNN with an Information Gain formulation in the Bayesian context yields an upper bound the difference between the empirical risk versus adversarial risk. As such, minimizing the learning objective we propose, provably approaches the same bounds as empirical risk minimization. This is the first time such a bound is devised and is significant provides theoretically justified approach to reducing the uncertainty due to adversarial examples.
In the adversarial training approach we propose for BNNs, in contrast to using the predictive distribution (i.e. as opposed to using the whole posterior distribution) to obtain the adversarial instances using PGD, we use samples from the posterior. This method, not only allows for a more efficient implementation, but also encourages the parameter particles remain diverse and generate dissimilar adversarial patterns. The result is more effective approach to improve robustness during training.
Comprehensive evaluations on a set of neural architectures and datasets demonstrates our approach to result in up to 20% improvement compared to the otate-of-the-art in the robustness.
2 BACKGROUND & RELATED WORK
Primer on Bayesian Learning. Given a dataset D = {x; y/) 1- a Bayesian Neural Network
N
(BNN) aims learn the posterior distribution: p(0 D) p(D ()) given the prior distribution
P(D) p(0). However, the exact solution for the posterior is often intractable due to the high dimensional
integral of the denominator even for moderately sized networks in the context of deep learning (Blei
2

---

Under review as a conference paper at ICLR 2022
et al. 2017). To overcome this, there generally two approaches. The first one is to Markov Chain Monte Carlo (MCMC) methods, which shows to be asymptotically accurate but slow (Welling variational inference methods to approach the true postenir distribution [Blundell et al. 2015). However, in the case of BNN, the true Bayesian posterior is usually complex multimodal distribution (lzmailov et al.
& Teh 20IT). Alternatively,
2021 illustrated in Figure Variational
inference, which relies on a parametric function, is too restrictive to resemble the true posterior and suffers from mode collapse
(Izmailov al. 2021 Jospin et al. 2020).
On the other hand. Wang & Liu (019);
Liu & Wang (2016) proposed provable general purpose variational inference algo- rithm named Stein Variational Gradient De- scent (SVGD) that transports set of pa- rameter particles, encouraged to be diverse, to fit the true posterior distribution; this approach can be beneficial for achieving higher performance and approximating the true posterior distribution. The visualiza- tion for different techniques sample the posterior is displayed Figure
p(o ())
MCMC methods
Variational inference methods
Stein variational gradient descent
Figure 1: Different techniques to sample the posterior.
Adversarial Attacks. Attackers add carefully crafted noise (perturbations) to the input image to fool the classifier at the inference stage. In general, the goal of the Equation i to degrade the performance of a neural network by crafting d, such that:
in
max SellaSemax
e(f(x + 58;0
(1)
||
where, p is the norm, Emax is the maximum attack budget (perturbation), é is the loss function (typically cross-entropy); J is the network, is the input, is the network parameter, and y is the ground-truth label.
For PGD (Madry al. 2018) attack, attacker starts from x X, and conducts projected gradient descent iteratively to update the adversarial example following
II Emax {x' + sign ( (J (x': )n))
where I1 is the projection the set
X. loo m
Among all the attack methods, we decided to apply PGD in our experiments because: i) PGD (Madry al. (2018) is regarded as the strongest attack in terms of the Loe norm and ii) it gives direct control over the distortion by changing Smaz. However, Liu et al. (2019) showed that one cannot directly apply a PGD attack in BNN setting. Instead, the authors suggest using a stochastic approach and proposed an updated PGD method, described in (3), for which they sample stochastic parameters o each update step t.
Immaa {x' + a- sign (Vxl (J (x';'") }n))
Adversarial Defenses. Significant research efforts describe methods to mitigate this threat, such as distillation (Papernot et al. 2016b), input denoising (Song 2019), curious readers can find more from (Kurakin et al. 2018 Among these methods, adversarial training (Madry al. 2018 shown be one the most effective and popular methods defend against adversarial attacks. The goal of adversarial training is to incorporate the adversarial search within the training process and, thus, realize robustness against adversarial examples test time. This is achieved by solving the following optimization problem:
2017)) or feature denoising (Xie et al.
0' arg min E
max <
Ble(f(x (00)))))
(4)
(
3

---

Under review as a conference paper at ICLR 2022
where D is the training data. An approximate solution can be realized by generating the PGD adversarial examples from Equation 2 and then minimizing the classification loss based on the generated adversarial examples.
Prior Art on Bayesian Defenses. Using Bayesian Neural Networks to detect adversarial attacks was proposed in (Feimman et al. 2017 Smith & Gall 2018). Ye & Zhu (2018) and Liu al. (2019) tried to combine Bayesian learning with adversarial training. Particularly, Ye & Zhu (0118) present method to jointly sample from the model's parameter posterior and the distribution of adversarial samples given the current parameter posterior. Recently, Liu et al. (2019) further developed the direction in Random Eaffmbnee @iu al., 2018) to build an peersariall--traiine Bayesian neural network method named Adv-BNN that can scales up to complex data by adding noise to each weight instead of input or hidden features as in RSE (Liu et al. 2018). Adv-BNN also incorporates adversarial training to learn variational posterior distribution to further improve model robustness against adversarial examples. However, using the variational inference method is likely to lead to mode collapse and limited the performance of the BNN (Izmallov et al., 202I) as we discussed earlier and demonstrate in our experiments in Section 4 Hence, in this work, we proposed exploring SVGD (Luu & Wang 2016) as Bayesian inference method to achieve better approximation for the multi-modal posterior of BNN. Using this approach, it is also easy to convert a traditional neural network to Bayesian counterpart without much effort to modify the traditional neural network architecture. Further, by employing the repulsive force for encouraging exploration in the parameter space, we conceptualize the information gain in Bayesian learning.
METHOD
3.1 BAYESIAN FORMULATION FOR ADVERSARIAL LEARNING
In contrast to a point estimate learned in traditional deep learning models, in Bayesian learning, the posterior of the parameters is obtained using the Bayes rule. The posterior distribution given the dataset is defined as: p(0 'D= = II(x.,))>DP p(y x, (0)p0)22 Z' where Z' is the normalizer. Similarly in the adversarial setting, given the adversarial dataset Davy. we have:
II [(xx))) P(Xadv x. y, Emax. 0)p(v x, x)0)p(
p Dav)
(5)
Z
where Z is the normalizer, p(Xadv x, y,, 0) the distribution of the Bayesian adversarial examples (we describe Bayesian adversarial examples in Section 3.2 later) and Emax is the hyper-parameter for producing the adversarial. The posterior in general intractable and we need to resort to approximations. In particular, we propose utilizing Stein variational gradient descent (SVGD) (Liu Wang 2016) which provides an approach learn multiple particles for parameters in parallel to approximate the true posterior. SVGD uses a repulsive loss to encourage the diversity of parameter particles to prevents mode collapse. This diversity enables learning multiple models to represent various patterns in the data.
During test time, given the data point x, we can approximate the robust Bayesian prediction with respect to the adversarial posterior using the Monte Carlo samples from p(0 Davv)
p x, Dani) = f p (y x, 0) p(0) Pan)dd
Σ
n
ply xx 0.), 0, p(0 Duvv), (6)
where 0 is an individual parameter particle. Notably, in practice, p(u x, 0) = softmax 0))
where / is deep neural network.
3.2 GENERATING BAYESIAN ADVERSARIAL EXAMPLES
We also integrate a Bayesian formulation of a PGD attack. Instead of sampling different stochastic parameters of in each PGD step- as in (Liu et al., 2019) and shown in Equation (3) which potentially leads to unrepresentative gradient directions, we sample random 0 from our set of parameter particles + = (0)= for PGD attack on each (benign) data example x to generate the corresponding adversarial example Xadv using:
- II Te (x' + a sign (Vrl (5 (x': .v)))
4

---

Under review as a conference paper at ICLR 2022
This equation also provides efficient way to sample adversarial example from the distribution P(Nudv x, y/, maax: 0) introduced above. Here, is the cross entropy.
This formulation, not only better approaches PGD in a Bayesian setting, but also leads to uncovering adversarial examples that exploit vulnerabilities of different parameter particles with different param- eter choices. We expect such an approach to lead robust model. However, this is possible when different parameter particles are diverse samples from multiple modes of the posterior facilitated by the Stein variational inference method. On the other hand, with conventional variational inference using simple unimodal distributions, parameters are sampled within a vicinity of one of the modes that do not adequately capture the collective vulnerability of the model.
Using the adversarial attack formulated, we can create an adversarial dataset Dady by perturbing the observed inputs. It is then a common practice to train the neural network using the adversarial dataset in conventional empirical risk minimization. However, it is unknown- other than through empirical studies how such a neural network compares to training with the original dataset. In the following. we investigate this question further to develop a new approach for robust model.
3.3 CONCEPTUALIZA INFORMATION GAIN FOR BAYESTAN LEARNING
The adversarial instances are generally known to exploit the particular patterns learned by the parameters. When integrating out the parameters in the Bayesian setting, especially under the diverse parameter particles in our approach, we implicitly remove the vulnerabilities that could arise from single choice of parameter. In addition, using the Bayesian setting we employ, we can formulate a notion of information gain that captures the impact of adding a new instance to a dataset on the distribution of the parameters. We show that the information gain can be defined as:
IG y) = P(D) Eo [l D]
- HEo //xx D11
(8)
We provide a proof of the definition in the Appendix A This formulation quantifies an instance's informativeness for a model given the training set.
Intuitively, the information gained from instance is proportionate to the reduction in the expected entropy by the predictive distribution. Our conjecture is that a robust neural network quantifies the information gain from an observation the same as its adversarial counterpart. In other words, a robust model ignores the perturbation and only considers the informative content of the input. We will employ these concepts in the following learning formulation.
3.4 FORMULATE LEARNING A ROBUST NETWORK USING INFORMATION GAIN
We formulate the objective of our training to:
1. Learn the posterior from the adversarial dataset. Since we use SGVD. this corresponds to learning multiple parameter particles. This amounts to minimizing the loss subject to the repulsive con- straint, f.e. ()) [B) [<[ (Xaav: v)]] (Xa( 0), Since the adversarial dataset is generated while training the model, it depends on the particle chosen and its parameters. To account for the vulnerability of individual parameter particle, we consider adding {f Ot), y) where the parameter particle is chosen uniformly at random, i.e. 0, ~ O and Xadv is produced using that ensure the samples
parameter particle. Since with SGVD, particles that explore different patterns in the input. As such, the posterior obtained from the adversarials are less likely to change with perturbations in the input and hence is more robust.
diverse,
have parameter
2. Achieve comparable information gain from the given dataset and that from the adversarials. Thus, ensuring: i) the information gained from data and adversarial examples is encouraged to be the same, i.e. E (x [IG()) (ss...))- [IG(x ii) the model to be not biased towards learning from the adversarial instances; and iii) the receptive fields are active for similar and prominent features.
Combining the above concepts using the Lagrangian method, we have the following objective:
1 Σ (xf(xaxv 0x). + (X 0.).8) + A[IG(x) IG(xx 0 ~ 2 L(O))= = n
k=1
5

---

Under review as a conference paper at ICLR 2022
We summarize our proposed robust Bayesian learning approach in Algorithm 1 Here, following Liu & Wang 2016), we use the RBF kernel k(0, 0*) exp
| |0-001'" and take the bandwidth / to
2h
be the median of the pairwise distances of the set of parameter particles each iteration.
Algorithm 1 Bayesian adversarial inference via SVGD
1: Input: A set of initial parameter particles [0] [0=+- observed data D.
2: Output: A set of parameter particles @ := {0, ) that approximates the true posterior
distribution PP
(
3: for (x. 1) ~ PD) do
4: Randomly sample a parameter particle 0 ~ e
5: Xadv x
6: for 1 = - do
7: Nadv [m=mee (aayy + a sign (Vxl() (Nadvi 01) ,y))} [Generate Adversarial (Eq. (
8:
end for
9:
for + n do
10:
0: <- 0: c (0;, O1) with (0: 01) Σÿ= [k(0, (.), Vo, k 0,, 0:)
11:
is the step size at the current iteration, k00, (0) is positive definite kernel that specifies the similarity between and 0', IG is the Information Gain (Eq. (8). 7, the weight control the repulsive force that enforces the diversity among parameter particles and IG objective respectively, is the cross-entropy loss function.
12: end for
13: end for
3.5 A RELATION BETWEEN ADVERSARIAL AND OBSERVATIONAL TRAINING
A typical machine learning approach minimizes the empirical risk to learn. There theoretical and empirical studies on the relation between the empirical risk and the true risk that measures the generalization ability of a learning algorithm. Generalization bounds such Rademacher complexity or VC dimension for classical approaches or more recent studies for deep learning (see Neyshabur al. (2017) underpin the theoretical framework for machine learning. However, the relation between the risk when using samples from the observational distribution (i.e. the given dataset) versus when using their adversarial counterpart remains unexplored. It important, because, while adversarial training has been commonly used, the impact of using such an approach on generalization with respect to the true data distribution unknown. We particularly consider a Bayesian model with no specific assumption on the distribution of either the adversarial examples or the perturbations to provide a generic approach. The only major assumption we make for the following bound that the distribution of the data and the corresponding adversarial are sufficiently close. That is mild assumption when we consider the adversarial instances are obtained from small perturbations of the given training dataset.
To that end, we are interested in finding the bound of Rady R where R
Te [Bix))) [Eyrpp(xx [Ty = y'lll] is the empirical risk and Ray Ep [E(,,a-))~>.., Eyr-p(s/sa [I( = y']]]] is the risk the adversarial examples. Once obtain these, following proposition summarizes our findings.
simply obtain the overall generalization and robustness bound. The
Proposition 1.
The risk of a classifier when trained the observed training set denoted by R versus when trained with adversarials denoted by Radv is bounded, i.e.
Rar R < 1- B(x,g)D exp (-(Eolro(sx Xade, v)] + A [x v)] -EE [IG wIll)
where To (x Xadra 3) = Ee puy = c x. 0) log(p(y = c Xadvi 0)), 2 and X denotes the adversarial example obtained from

---

Under review as a conference paper at ICLR 2022
the Sketch the Proof. We simplify the difference between the risks by considering that the difference
between individual mistakes is smaller than their product, i.e.
Ey -yrxp(yix,0) Byp-p(ulaan0))
[ly + y1l Ily + y2ll] - By yplplyllandd E Byr-piillaan.)
[1[y + yell
K
s Σ ply= = x, x.0)p(y Xade 0)
We then use Jensen's 's inequality when using the exp(Iog(-)) to obtain the upper bound. The complete proof is provided in the Appendix B
Then the difference between the empirical risk and the adversarial risk is minimized when the upper bound minimized. The main objective to:
Minimize cross entropy for the adversarial examples. This corresponds to matching the prediction from the adversarial data to that of the observations. Since (x,y) is given in the training, simply minimize the entropy of the adversarial examples.
2. Minimize the difference between the information gained from the dataset and its adversarial counterparts. In addition to individual predictions, the information gained from each instance has have similar effect on both networks in terms of how it changes the parameters.
Notably, since we know 1 1 exp(=2)) z, to avoid computational instabilities and gradient saturation, we consider minimizing the upper bound without the exponential function.
EXPERIMENTAL RESULTS
In this section, we verify the performance of our proposed method (IG-BNN) with other baselines in the literature two popular and standard vision tasks: i) the low dimensional dataset CIFAR- 10 (Krizhevsky et a This is a popular benchmark was used to evaluate the robustness of DNN in previous works (Madry al. 2018 Athalye et al. 2018). However, it is also known that adversarial training becomes increasingly hard for high dimensional data (Schmidt et al., 2018). Therefore, we evaluated our method on a high dimensional dataset- SENN-STTL-00
10 (Coates et al. (2011) with 5,000 training images and 8, 8,000 testing images with the dimension of 96 x 96 pixels. In all experiments. we utilized the same networks used in the state-of-the-a BNN method, Adv-BNN (Liu al.) 2019) to fairly compare the results. Specifically, we used the VGG-16 16 network architecture for 10 and the smaller ModelA network for STL-10 used in Liu et al. (019)) The number of steps and the attack budgets used for training and testing is set to be the same for fair comparison see Appendix CerudixCCiaane Table|4 Because our proposed method evaluates the robustness of a Bayesian learning method based on Adversarial Training (Madry et al.) (2018), the traditional Adversarial Training (Adv. Training) (Madry et al. 2018)) and state-of-the-art Bayesian defense, Adv Bayesian Neural Network (Adv-BNN) (Liu et al. 2019) are good baselines for comparisons. In addition, we also compare our method with networks trained with no defenses and Bayesian Neural Networks trained for the tasks.
CIFAR10
STL10
100
80
No Defense
No Defense
BNN
80
Adv. Training
Adv. Training
Test Acurscy (5)
Adl BNN
Test Aourery (36)
Adv. BNN
60
BNN (Curs)
BNN (Ours)
40
30
0.00
0.01
0.02
0.04
0.00
0.05
0.07
0.00
0.31
0.02
0.03
0.04
0.06
0.37
1_
Distartion
Distortion
Figure 2: Accuracy under PPD attack different datasets. CIFARIO is trained VGG-16 network, and STL10 is trained on ModelA similar to Adv-BNN
7

---

Under review as a conference paper at ICLR 2022
4.1 EVALUATE THE ROBUSTNESS UNDER WHITE-BOX to ATTACK
PGD attack. In this experiment, we compare the robustness of our models under the strong white-box -PGD attack. Following the recent work in (Liu et al. 2019), set the maximum (x distortion to
6max E [0: 0.07 0.005]. adjust the PGD attacks for Bayesian methods as mentioned earlier-see
Equation 3 and report the accuracy on the test set (robustness). Overall, the results-shon
in
Figure
2 illustrates the improved robustness of our method compared with Adv. BNN (Liu ct al.
2019). and the significantly better results compared to Adv. Training (Madry et al. 2018). We also provide detailed results in Table [ where: i) we show a marked increasing testing accuracy from approximately 10% to 20% compared with Adv-BNN; and a significantly higher accuracy compared with Adv. Training on the two tasks under increasing attack budgets. Although Adv-BNN helped improve robustness, we can see that the learning method is still below what could be achieved. On the other hand, IG-BNN achieved better results on both the testing data (benign) and adversarial examples (under increasing attack budgets).
Table 1: Comparing the robustness under different levels of PGD attacks (or attack budgets).
Data
Defenses
0
0,015
0,035
0.055
0.07
Adv. Training
80.3
58.3
31.1
15.5
10.3
CIFARIO
Adv-BNN
79.7
68.7
45.4
26.9
18.6
IG-BNN (Ours)
82.2
79.7
65.6
46.1
32.6
Adv. Training
63.2
46.7
27.4
12.8
7.0
STLI0
Adv-BNN
59.9
51.8
37.6
27.2
21.1
IG-BNN (Ours)
67.0
65.6
57.0
45.3
36.7
Proposed Adaptive PGD attack. An adaptive attacker might find a better way to approach the real gradient under Bayesian context, hence, generate stronger attack and degrade the robustness of a Bayesian Neural Network. Inspired from (Zimeerann) 2019). we proposed an Adaptive PGD attack where aggregate the gradients across multiple random networks for each step. While this attack is slower because it needs inference from multiple particles or network instances for each PGD step, it is able to generate stronger attack due its better representative approximation estimate the gradient. Specifically, we tailor PGD attack for a Bayesian setting and use the expectation w.r.t the parameter 0 to produce an adversarial example. That is, we can create an adversarial instance by taking multiple steps using the expected gradient across multiple models in each step towards maximizing the loss:
x+1 1l
{xt + a- sign (Eo [x (x': ,b))))
(10)
The results for proposed Adaptive PGD attack is shown in Table 2 As shown, the robustness of Ady-BNN has degraded significantly with the Adaptive PGD method although better than the Adv. Training method. On the other hand, our method, although losing some robustness compared with the previous PGD attack method, still achieves significantly higher robustness compared with other ofte-off-the-ar defense methods all the experimented vision tasks and across all attack budgets; thus, showing the effectiveness of our learning method.
Table 2: Comparing the robustness under different levels of Adaptive PGD attacks (or attack budgets).
Data
Defenses
0
0.015
0.035
0.055
0.07
Adv. Training
80.3
58.3
31.1
15.5
10.3
CIFARIO
Adv-BNN
79.7
64.2
37.7
16.3
8.1
IG-BNN (Ours)
82.2
75.3
52.2
28.9
18.1
Adv. Training
63.2
46.7
27.4
12.8
7.0
STLIO
Adv-BNN
59.9
47.9
31.4
16.7
9.1
IG-BNN (Ours)
67.0
61.7
46.1
31.9
24.3
4.2 EVALUATE THE OBFUSCATED GRADIENT EFFECT
One possible failure mode of defense methods discussed in the literature is the obfuscated gradient effect (Athalye et al.) 2018) where seemingly high adversarial accuracy is only superficial and creates false robustness. In this scenario, the network learns to obfuscate the gradients whilst showing
8

---

Under review as a conference paper at ICLR 2022
seeming robustness by making it harder for the attack to find perturbations. However, easy and effective way to verify this is to apply a black- box attack. The defense is considered to show obfuscated gradients if the black-box attack is more successful than the white-box attack. Following current practice, in this experiment, we deploy a black-box Square attack (Andriushchenko et al. in Table that our IG-BNN is also highly robust against
(2000) on the our IG-BNN model. We the black-box attack but the robustness of the black-box attack is higher than the white-box attack; this demonstrates our robustness is not simply the result of the obfuscated gradient effect.
Table 3: Blackbox attack to evaluate the obfuscated gradient effect
Data
Defenses
0.015
0.035
0.055
0.07
CIFARIO
IG-BNN (Ours)
82.2
75.3
52.2
18.1
Black-box
81.3
77.9
70.9
63.2
IG-BNN (Ours)
67.0
61.7
46.1
31.9
24.3
STLIO
Black-box
67.0
64.4
62.7
58.4
4.3 TRANSFER ATTACKS AMONG PARAMETER PARTICLES
To further evaluate the robustness and illustrate the intuition of the diverse parameter particles, we conduct experiments on the transfcrability of the adversarial examples among parameter particles and evaluate the robustness at class wise levels (i.e. the robustness we sample multiple different parameter particles for the experiment. For each parameter particle (source particles), then, using those adversarial examples generated from the source particles, attack and evaluate the robustness of other particles (larget particles). We visualize the results heatmaps with robustness as the measure (i.e. the ability to correctly identify the adversarial examples), and show the results in Figure (comprehensive results are in the Appendix Section D). Each row in the matrix shows the robustness of target particles against the AEs generated from the source particles (with the attack budget 0.015).
each class). Specifically,
generate corresponding adversarial examples for that parameter particle. And
We can observe that the adversarial examples are very effective on their source particles with 0% robustness. However, other particles are able recognize those adversarial examples correctly (high robustness) due to our Bayesian learning method where we encourage the parameter particles to be diverse and bound the difference of empirical risk versus the adversarial risk in terms of the information gain.
ship
frog
horse
CIFAR-10 pariees
Source particles
40
STL-10
10
-0
-0
Target particles
Target partic
Figure 3: Diversity of parameter particles demonstrated using the transferability of adversarial examples among particles
CONCLUSION
In this study, we presented a novel method to learn a robust BNN against adversarial attacks, Although an adversarially trained BNN improved the robustness, using our proposed Adaptive PGD attack, tailored for BNN, can drastically reduce the robustness of adversarial-traing
BNN. Our proposed IG-BNN learning method employing SVGD to encourage diverse parameter particles along with the formulated information gain under the Bayesian context to provably bound the difference of empirical risk versus adversarial risk. Through empirical experiments, we demonstrate that learning a Bayesian neural network using method leads better robustness compared with current oftte-of-the-rtt Bayesian defense methods. The learned model achieves robustness, even under strong Adaptive PGD attacks.

---

Under review as a conference paper at ICLR 2022
REFERENCES
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: query-efficient black-box adversarial attack via random search. In European Conference on Computer Vision (ECCV), 2020.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International Conference on Machine Learning (ICML). 2018.
David M Blei, Alp Kucukelbir, and Jon D McAuliffe. Variational inference: A review for statisticians. Journal of the American statistical Association. 2017.
Charles Blundell, Julien Cornebise, Koray Kavukcuoglu, and Daan Wierstra. Weight uncertainty in neural network. In International Conference on Machine Learning (ICML), 2015.
Nicholas Carlini and David Wagner. Towards Evaluating the Robustness of Neural Networks. In IEEE Symposium on Security and Privacy (S&P), 2017.
Adam Coates, Andrew Ng. and Honglak Lee. An Analysis of Single Layer Networks in Unsupervised Feature Learning. In AISTATS, 2011.
Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical- world attacks on deep learning models. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2018.
Reuben Feinman, Ryan R Curtin, Saurabh Shintre, and Andrew B Gardner. Detecting adversarial samples from artifacts. arXiv preprint
77770000010, 10, 2017.
Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and Harnessing Adversarial Examples. In International Conference on Learning Representations (ICLR), 2015.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition (CVPR), 2016.
Pavel Izmailov, Sharad Vikram, Matthew D Hoffman, and Andrew Gordon Wilson. What are bayesian neural network posteriors really like? In International Conference on Machine Learning (ICML), 2021.
Laurent Valentin Jospin, Wray Buntine, Farid Boussaid, Hamid Laga, and Mohammed Bennamoun. Hands-on bayesian neural networks-a tutorial for deep learning users. ACM Computing Surveys, 2020.
Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton. Cifar-10 (canadian institute for advanced research).
Alexey Kurakin, Ian Goodfellow, Samy Bengio, Yinpeng Dong, Fangzhou Liao, Ming Liang, Tianyu Pang. Jun Zhu, Xiaolin Hu, Cihang Xie, et al. Adversarial attacks and defences competition. In The 17 Competition:
Building Intelligent Systems. 2018
Qiang Liu and Dilin Wang. Stein Variational Gradient Descent: A General Purpose Bayesian Inference Algorithm. Advances in Neural Information Processing Systems (NIPS), 2016.
Xuanqing Liu, Minhao Cheng, Huan Zhang, and Cho-Jui Hsich. Towards robust neural networks via random self-ensemble. Proceedings of the European Conference on Computer Vision (ECCV), 2018.
Xuanqing Liu, Yao Li, Wu Chongruo, and Hsich Cho-Jui. ADV-BNN: Improved Adversarial Defense Through Robust Bayesian Neural Network. In International Conference on Machine Learning (ICML), 2019.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations (ICLR), 2018.
10

---

Under review as a conference paper at ICLR 2022
Behnam Neyshabur, Srinadh Bhojanapalli, David Mcallester, and Nati Srebro. Exploring generaliza- tion in deep learning. Advances in Neural Information Processing Systems (NIPS), 2017.
Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint 2016a.
Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z. Berkay Celik, and Ananthram Swami. The limitations of deep learning adversarial settings. In IEEE European symposium on security and privacy (EuroS& P), 2016b.
Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia conference computer and communications security (Asia CCS), 2017.
Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. Adver- sarially robust generalization requires more data. In Advances in Neural Information Processing Systems (NeurIPS), 2018.
Lewis Smith and Yarin Gal. Understanding measures of uncertainty for adversarial example detection. arXiv preprint 11XX::1803008533, 2018.
Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman. Pixeldefend: Leveraging generative models to understand and defend against adversarial examples. arXiv preprint 1710. 2017.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference Learning Representations (ICIR)) 2014.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. In Advances in neural information processing systems (NIPS), 2017.
Dilin Wang and Qiang Liu. Nonlinear stein variational gradient descent for learning diversified mixture models. In International Conference on Machine Learning (ICML), 2019.
Max Welling and Yee W Teh. Bayesian learning via stochastic gradient langevin dynamics. In International Conference on Machine Learning (ICML), 2011.
Cihang Xie, Yuxin Wu, Laurens der Maaten, Alan L Yuille, and Kaiming He. Feature denoising for improving adversarial robustness. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2019.
Nanyang Ye and Zhanxing Zhu. Bayesian adversarial learning. In Advances in Neural Information Processing Systems (NeurIPS), 2018.
Roland S Zimmermann. Comment on" ady-bnn: Improved adversarial defense through robust bayesian neural network". arXiiv preprint arXiv: 1907.00895 2019.

---

Under review as a conference paper at ICLR 2022
A DEFINITION OF INFORMATION GAIN
We first define our predictive distribution as:
p(ylx, D) = p(ulx,0))(00) ())
By the definition of information gain, have:
Σ Eplulx. D)) /
p(ulx / ()D(()))p(()) log p(yl x, 0) p(y/1, D)
[[I((x)
d0
p(D)p(ylx, D)
p(u|x, 0)
Σ plulx, (1DI00))(())))(() log
d0
P(D)
p(u|x, D)
1
/ p(u|x, (o)
p 0)
d0
p(D)
p(y|x, D)
1
Σ
p(y|x, 01px0)))(01)) [log(pl//x 0)) - log(p(y|xx D)) do
P(D)
1
Σ
/ p(y)x, (000()0)))))))llll/xxxxx. 0))d0 / p log(p(y/x, D))
P(D)
1
/ ((II log 0) Σ / plulx, O)p(0 log(p(y)x, D))
P(D)
[H//x, DJ| [/, DJ))
P(D)
[Eg [Eo x, DJ H| xx, D!G
where for the last line we assume PDD R p(Datt) as constant values. Since we are considering adversarial instances to be obtained from the observational one, this a very mild assumption and is completely in line with current line of research.
B
PROOF OF THE OBJECTIVE
We have
Radvv
R
((xD)vD
Ee sup Ey opliixa))) (1 * v)] E perpp(i)x) [I (yz + v)]
Eg
sup Ey
(T (yn * v) - T[12 # y)]
Eg sup Bys-no///a))sammmmot [|I (U1 * v) I (y2 + v)
B(
Ee sup
Bop-ppuls (21 * y2)l
where we upper bound the expected misclassification to have:
I]]
(xDD)~D Fo
Σ p(y=ci x, x)()p( = Xadvs 0)
Subsequently, we use Jensen's 's inequality and the fact that x = exp(log(x)) to have:
E (xxa)D
Eg
1 exp(log]
Σ ply x, 1) Kudv.
DI p(u=c/x.0) (0g
12

---

Under review as a conference paper at ICLR 2022
and since 1 - exp(2) is monotonically decreasing, have
K ply c x, 0)p(y Xadv: 01))
E (xx))~D
Eg
exp(log
K
$ (xx))/DD
Ee
exp
Σ
plu = c x, log(p(y = c Xadv. 01))
K
= =1 B(x.)DDD
Eø
exp
Σ
plu - c x, log(p(y - c Kadv, 0)))
Therefore, we finally have the following bound:
[[
K
00)) 1)
|aad - RR S E(
exp
Eg
Σ
ply= = x, 0) log(p(y = c Nadv 0))
(X..ass 3/
This results show that the difference between the risks is bounded by the negative cross entropy of the predictions. While informative, this bound expresses the relation between the predictions only and not how the model perform on each set (i.e. given dataset versus its corresponding adversarial).
We know
Eg (x,, Nadv: v)] 2 Bo(re(x. Xadv, U) [Eo]IG(x)] Eg [G (Xadv)) )
(11)
or
Eg Golro(x Nadv, v)] = -Eg KL = c 0)]l(( = c Xadv 0))] + Eg [HH x, D
Eo kL x, p)lp((y Xadv 0))] [Eg [G()) EE (IG
(12)
where this is true because we can subtract positive values, namely Eg Hy x, D and |E [IG(x) Eg [G((XG(()))) }]]- Hence we have for À 2 0,
-E [[G(x.)))]] )}
Radd Rl S 1-E
exp
Ee Σ ply = c | x, 0) log(p(y c Xatv; 0))] A|Ex[[
|Radv R| 1-E(,,)) exp (-(Bo|KL((()) (p()) Xate, 0)) AlBB IG(x)) - Ee [I
Then the difference between the empirical risk and the adversarial risk minimized when the upper bound is minimized. The main objective is to:
Maximize Eg Ex p(y = c x, 0) log(p(y = c Xadv, 0))] or minimize Eg (L(p(y = c x, O)]pp( = Xadv, 0)): this corresponds matching the prediction from the adversarial data to that of the observations. Since (x, y) is given in the training, for minimizing this KL-divergence we simply minimize the entropy of the adversarial examples instead;
Minimize Eg [G(x) Eg II )]: In addition to individual prediction, the information gained from each instance has to have similar effect on both networks in terms of how it changes the parameters.
Notably, since we know 1 cxp(=2) S 2, to avoid computational instabilities and gradient saturation, consider minimizing the upper bound without the exponential function in our implementation.
13

---

Under review as a conference paper at ICLR 2022
C
HYPER-PARAMETERS
Table 4: Hyper-parameters setting in our experiments
Name
Value
Notes
T'
20
#PGD iterations in attack
10
#PGD iterations in adversarial training
6max
8/255
Max lsc -nomn in adversarial training
2/255
Step size for each PGD iteration
0.01
Weight to control the repulsive force
Weight control objective
n
10
#Forward passes when doing ensemble inference
D DETAILS OF TRANSFER ATTACKS OF ADVERSARIAL EXAMPLES AMONG PARAMETER PARTICLES
Source pamcless
44
Target
Figure 4: Transferability of adversarial examples among different particles on CIFAR-10
Thx4
Nid
43
20
-1
19
Source pa
menkay
20
Targel porticles
Figure Transferability of adversarial examples among different particles on STL-10
14


Reviews:
[{"review_id": "wMFQE9_sp24", "reviewer": "Reviewer_UwZA", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n* The method appears to offer significant improvements over prior adversarial BNN defense.\n* The authors implement an appropriate adaptive attack to account for the randomness of Bayesian Neural Networks. It might be helpful to refer to the attack with the widely-used terminology of Expectation-Over-Transformation (EOT) attack, as in Athalye et. al (2018). However, the authors place much more prominence in the text on a non-adaptive PGD attack, which might cause misperceptions (see Weaknesses).\n\nWeaknesses:\n* While the authors perform an appropriate adaptive EOT attack, the plots and main results present the outcomes of a non-adaptive PGD attack. It is well known that deterministic attacks are not representative of the performance of defenses that have stochastic elements, and the authors indeed see a significant drop in accuracy. Since a defense is only as good as its performance against an optimal attack, the authors should also include a curve showing robustness for their method against adaptive attacks in Figure 2 to give fair comparison versus adversarial training.\n* The theoretical analysis appears to be quite trivial. Unless I am mistaken, adding the term $|E_\\theta [ IG(x) ] - E_\\theta [ IG(x_\\text{adv}) ] |$ in (11) only makes the bound looser and thus less useful. The theoretical presentation does not enhance the arguments of the paper.\n* The work lacks novelty, and its novel elements are not properly evaluated. The main contributions are the inclusion of SVGD and the Information Gain term. The theoretical importance of the Information Gain term is not very convincing. The authors do not perform an ablative study using just SVGD and no IG term vs. Gaussian variational inference plus IG term to narrow down which elements are important, or if both are necessary.\n* The adaptive attack is not completely explored. The authors do not mention how many EOT replicates are used. 20 PGD steps is not enough for the EOT defense performance to reach its full strength in some cases where there is a high degree of stochasticity, and more steps should be used to ensure convergence.\n\nOther Comments:\n* How are the particles $\\theta_i^0$ initialized during the testing phase? I would assume they are initialized from a set of fixed parameters identified during the training phase, is that correct? More details on this point would enhance my understanding of the work.\n* Source code would help to further evaluate this defense.", "summary_of_the_paper": "This paper explores adversarial training for Bayesian Neural Networks. In contrast to prior work which used Gaussian variational posteriors to estimate BNN parameters during adversarial training, this work uses Stein Variational Gradient Descent (SVGD) on a loss potential that includes an adversarial term similar to standard adversarial training and a term encouraging similarity between the Information Gain (IG) on natural and adversarial images. They evaluate PGD and adaptive adversarial attacks and find significant performance improvement over standard adversarial training and adversarial BNN. A theoretical justification is presented.", "summary_of_the_review": "I recommend to not accept this paper. The theoretical analysis of the Information Gain term appears vacuous and distracting, although I could be missing something. The contributions (SVGD and Information Gain for BNN posterior sampling) are not significantly novel, and their relative importance is not properly evaluated. The experimental results appear strong, but it's difficult to judge the quality of the defense experiments without being able to inspect the to source code (in particular, the implementation of the EOT attack).", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "tuoBa3tmR8f", "reviewer": "Reviewer_qjBg", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "**Strengths of the paper**\n- The information gain is useful to improve the robustness of Bayesian Neural Networks.\n- The proposed method outperforms the baselines.\n\n**Weaknesses of the paper**\n- Although the proposed method is intuitive, its framework is not solidly and rigorously developed.\n- Information gain seems identical to the mutual information $I(y,\\theta \\mid x, D)$ proposed and investigated in Bayesian Active Learning [1,2]. The authors need to discuss their proposed information gain and the mutual information proposed in [1,2].  \n\n[1] Houlsby, Neil, et al. \"Bayesian active learning for classification and preference learning.\" arXiv preprint arXiv:1112.5745 (2011).\n\n[2]  Yarin Gal, Riashat Islam, and Zoubin Ghahramani. Deep Bayesian active learning with image data. In Proceedings of the 34th International Conference on Machine Learning-Volume 70, pages 1183–1192. JMLR. org, 2017.", "summary_of_the_paper": "This paper proposes leveraging \"information gain\" with Bayesian Neural Networks to improve the robustness of Bayesian Neural Networks. Specifically, it maintains a set of particle models and uses SVGD to update this set of particle models. Furthermore, it uses the PGD-based attack to a specific particle model to craft adversarial examples and enforces the information gain of adversarial examples to be close to that of the corresponding benign examples. ", "summary_of_the_review": "The posterior $p(\\theta \\mid D_{adv})$ in Eq. (5) is not mathematically rigorous because it does not contain $D$ on the left side, but $D$ is involved on the right side. \n\nI cannot see the definition of the information gain and it seems to be identical to the mutual information proposed in [1,2]. Moreover, the first term on the right side of  Eq. (8) is $H(y \\mid x, D)$ because it is independent with $\\theta$. The second term should be $E_\\theta[H(y \\mid x, \\theta)]$ according to your derivation in Appendix.\n\nSVGD is not proposed to minimize the loss function directly. Although the update of the particle models in Algorithm 1 is fine, it requires more effort to define the distribution for which we only know its unnormalized version. Furthermore, Eq. (9) needs to have the absolute value for the difference between $IG(x)$ and $IG(x_{adv})$. In addition, the notion here is inconsistent with the lack of $y$.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "LeQSq9HYytw", "reviewer": "Reviewer_RZv2", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Unfortunately, there are many claims made in this paper which are either overly strong, incorrect, or fail to appreciate prior work. \n\nFirstly, the authors correctly note that Bayesian neural networks are empirically and theoretically more robust to attacks. I think the authors should certainly cite [1] here as a motivating example. \n\nThe authors highlight the work of Adv-BNN as state of the art for Bayesian neural networks against adversarial attacks, but this has been greatly surpassed in [2] (more on this below). Moreover, their \"proposed adaptive PGD attack\" is not their own proposal and has been used in the Bayesian robustness literature for at least 3 years. The reason this proposed attack has been used is that the one given in Adv-BNN and repeated in equations (3) and (7) of this paper is both theoretically incorrect and empirically suboptimal. As pointed out by the authors, [3] clearly states the incorrectness of the attack used in Adv-BNN and shows it is suboptimal in practice for Bayesian neural networks (further corroborated by Tables 1 and 2 of this paper). This error is the Bayesian counter-part to the expectation over transformations (EoT) attack formalized in [4] which follows up on a work the authors cite, in particular [5]. Further, in works on BNNs this \"proposal\" has been adopted and is widely used, see [1,2,6], so I think it is incorrect to deem this as a \"proposed\" attack in the evaluation/contribution section of the paper and should be moved to the related works. \n\nFurther on this, despite the clear incorrectness of equation (3) and its corresponding formulation for this paper in equation (7) according to both deterministic principles [4,5] and Bayesian principles [2,3] the authors still use this attack during training and partially during evaluation. Thus, the methodology, as presented, is suboptimal/incorrect. In fact, the results section of this paper corroborate this claim (Table 2 versus Table 1) \n\nOutside of this incorrectness, the authors propose a regularization which is simply a specific form of Adversarial Logit Pairing [7]. This paper originally appeared in NeurIPS 2018, but was later retracted after it was found that this kind of robustness is very easily attacked and provides no substantial gains see [8]. I think if the authors would like to stick to this methodology then they ought to properly evaluate their method with a Bayesian adaptation of the method in [8]. I do not doubt the theoretical perspective given by the authors, only that it is practically effective/worthwhile. Moreover, I think the authors ought to be very careful in their general use of ERM approaches to likelihoods. This is perhaps acceptable for variational inference methods which replace marginalization with maximization, but in general, the method of [2] is preferable as it works for both maximization and marginalization and is thus on better grounds from a Bayesian point of view. Further on this point, I think it would benefit the paper if the authors stated their algorithm in a more general form as simply proposing a modification of a single inference method reduces the apparent contribution. \n\nFinally, I do have a further question about the methods evaluation. Is this method compared with AdvBNN applied to SVGD? Or is AdvBNN using Bayes by Backprop (as in its original formulation)? If so, the authors should ensure that the same inference method is used between their method and that of the network they compare against as inference method is known to have a considerably effect on the robustness of Bayesian posteriors [1,2,6]. In fact, the empirical performance noted in this paper might be solely the effect of a more faithful inference method and may have no correlation with the use of their method. Unless, the \"BNN\" label in Figure 2 is also SVGD. Still, the authors ought to compare with [2] prior to making the claim that they have state of the art robustness. \n\n[1] - https://arxiv.org/abs/2002.04359 (Appeared in NeurIPS last year)\n[2] - https://arxiv.org/abs/2102.05289 (Appeared in AISTATS last year)\n[3] - https://arxiv.org/abs/1907.00895 (Correction to Adv-BNN in 2019)\n[4] - https://arxiv.org/pdf/1707.07397.pdf (Appeared in ICML 2018)\n[5] - https://arxiv.org/pdf/1802.00420.pdf (Already cited in paper but here for completeness)\n[6] - https://arxiv.org/abs/2012.12640 (Appeared in AABI 2021)\n[7] - https://arxiv.org/abs/1803.06373 (Appeared, later retracted NeurIPS 2018)\n[8] - https://arxiv.org/abs/1807.10272\n\n", "summary_of_the_paper": "In this paper, the authors propose a conjunction of Bayesian learning and regularization via information gain as a means of adversarial defense. In particular, they start from the perspective that Bayesian learning of neural network parameters ought to be more robust to adversarial examples, and then state that by jointly minimizing the risk and regularizing adversarial and clean information gain that the resulting Bayesian posterior will be even more robust. \n\nWhile this -- robustness and adversarial training of Bayesian neural networks -- is a worthwhile and important direction, the authors make several crucial mistakes and literature oversights which inhibit the potential impact of this work. ", "summary_of_the_review": "The paper is in a worthwhile direction, but ultimately has too many oversights and errors to be accepted as is. The attack methodology relied upon is known to be incorrect and suboptimal. The regularization introduced is a particular flavor of a defense which is known to be suboptimal and easily attacked. The claim of state-of-the-art performance is outdated for BNNs. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "9lZGgyRwp7e", "reviewer": "Reviewer_CwGg", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "In general, the paper is clearly written by addressing an important problem, but I still have several concerns.\n\n1.\tIt is interesting that the authors propose to use the Bayesian formulation for adversarial training. Nevertheless, the authors are expected to make a thorough analysis since the benign examples and the adversarial examples are not independent. The authors are expected to clarify the reasonability of Eq. 5.\n2.\tTo some extent, the paper is highly dependent on the information gain. However, it is nontrivial to estimate the information gain especially for the adversarial scenarios. A neural network is always overconfident for the adversarial examples. The authors are expected to clarify to how to estimate the information gain reliably. \n3.\tThe paper is inherently a regularized version for BNN with information gain. The authors are expected to clarify the novelties and technical contributions. \n4.\tIn the experimental section, the performance is significantly better than the alternative methods, e.g., Adv-BNN, especially for the adaptive attacks. The authors are expected to make thorough analysis on why or for what technical aspects it can achieve the performance improvement. \n5.\tThe authors are expected to make more comprehensive analysis, e.g., more experiments on ImageNet, more defense/attacks methods. \n   \n", "summary_of_the_paper": "In this paper, the authors propose to learn a multi-modal posterior of the Bayesian neural network to defense the adversarial attacks, which can prevent the collapse and encourage the diversity accordingly. The authors further investigate the information gain for adversarial Bayesian learning, which is used to guide the training a BNN with the information gain bound. Experimental results demonstrate tis superior performance for adversarial attacks. ", "summary_of_the_review": "The paper is easy to follow, but the authors are expected to clarify their technical contributions and make more comprehensive experiments. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Meta-review: In this paper, the authors leverage information gain in conjunction with Bayesian Neural Networks in order to to improve the robustness of Bayesian Neural Networks. However, as pointed out by reviwers, there are several mistakes in theier derivations and evaluations. Moreover, the authors failed to crrectly refer to the exisiting work proposing similar methods.
Decision: Reject