Improving Adversarial Robustness via Information Bottleneck Distillation
Authors: Huafeng Kuang
Hong Liu
YONGJIAN WU
Shin'ichi Satoh
Rongrong Ji
Venue: NeurIPS 2023 poster (2023)
Keywords: Information Bottleneck
Adversarial training
Adversarial  robustness
Knowledge distillation
TL;DR: We introduce the robust prior in variational IB and present the Information Bottleneck Distillation to improve adversarial robustness

Abstract: Previous studies have shown that optimizing the information bottleneck can significantly improve the robustness of deep neural networks. Our study closely examines the information bottleneck principle and proposes an Information Bottleneck Distillation approach. This specially designed, robust distillation technique utilizes prior knowledge obtained from a robust pre-trained model to boost information bottlenecks.  Specifically, we propose two distillation strategies that align with the two optimization processes of the information bottleneck. Firstly, we use a robust soft-label distillation method to increase the mutual information between latent features and output prediction. Secondly, we introduce an adaptive feature distillation method that automatically transfers relevant knowledge from the teacher model to the student model, thereby reducing the mutual information between the input and latent features. We conduct extensive experiments to evaluate our approach's robustness against state-of-the-art adversarial attackers such as PGD-attack and AutoAttack. Our experimental results demonstrate the effectiveness of our approach in significantly improving adversarial robustness. Our code is available at https://github.com/SkyKuang/IBD.

Improving Adversarial Robustness via Information Bottleneck Distillation
Huafeng Kuang', Hong Liu"; YongJian Wu', Shin'ichi Satoh", Rongrong Ji
Key Laboratory of Multimedia Trusted Perception and Efficient Computing, Ministry of Education of China, Xiamen University, 361005, P.R. China
National Institute of Informatics, Tokyo, 101-8430, Japan
Youut Laboratory, Tencent, Shanghai, 200233, China skykuangostu. xmu edu. cn, lymnliu.xmu@nnan xmu@gmail. com
littlekensuubencent.ccmm com, satohênii jc. rrji0xmu. www.ueuu.uuuueeeeommmmmmmo.uu...
Abstract
Previous studies have shown that optimizing the information bottleneck can signifi- cantly improve the robustness of deep neural networks. Our study closely examines the information bottleneck principle and proposes an Information Bottleneck Dis- tillation approach. This specially designed, robust distillation technique utilizes prior knowledge obtained from a robust pre-trained model to boost information bottlenecks. Specifically, we propose two distillation strategies that align with the two optimization processes of the information bottleneck. Firstly, we use a robust soft-label distillation method increase the mutual information between latent fea- tures and output prediction. Secondly, we introduce an adaptive feature distillation method that automatically transfers relevant knowledge from the teacher model to the student model. thereby reducing the mutual information between the input and latent features. We conduct extensive experiments evaluate our approach's s robustness against state-of-the-ar adversarial attackers such as PGD-attack and AutoAAtack. Our experimental results demonstrate the effectiveness of our ap- proach in significantly improving adversarial robustness. Our code is available at http://gtttuuu.oo///.. KunnSkyKKKK/BDDD
Introduction
Numerous works have shown that deep neural networks (DNNs) are easily attacked by adversarial
examples [56] 4 4 [A] which involve adding imperceptible noise inputs and causing incorrect outputs. This vulnerability of DNNs raises significant security concerns when deploying DNNs in
safety-critical applications. To address this potential threat, various adversarial defense strategies
have been proposed 44 72, 43 72). Among these defenses, adversarial training (AT) 41 is
a general solution for defending against adversarial attacks by incorporating adversarial examples generated by adversarial attack into the training process. While many AT techniques can defend against sophisticated attacks, such as AutoAttack [14] a big robust generalization gap still exists
between the training data and testing data [12.
Recent years have witnessed the growing popularity of the studies of the use of Information Bottleneck (IB) [57] in training robust DNNs (54] 64 (68). IB involves finding trade-off in intermediate features Z between relevant information for the prediction Y and nuisance information about input
X. The overall objective of IB is formulated as follows:
max -IXX)233(X220
(1)
Project lead
CCoresspondig author
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

Input
Teacher
Teacher Features
Adaptive
Disrillation
Input
CE loss
Conv
Conv
Conv
PC
Zz
Attention Matrix
Relevant information
Features
X
information
Figure I: Schematic of successive extraction of relevant information IBD. The inputs are passed through robust teacher and student get intermediate features (Z). These features then passed through an adaptive feature distillation module, where an attention- similarities between the teacher and student features. Robust information from each teacher feature is transferred to the student with the attention values. The student model also minimizes cross-entropy (CE) loss using the teacher's soft output label. Consult the section 3.2 for more details.
model determines
where denotes mutual information and 3 controls the trade-off between the two terms. Studies in [54 64 show that IB can produce concise representations leading better generalization, and can make intermediate features of DNNs less sensitive to input perturbations. On the other hand, variational information bottleneck (VIB) has also been found significantly improve the robustness of models 12, [1]. In addition, [40] replaces mutual information with the Hilbert Schmidt Independence Criterion (HSIC) and calls this the HSIC Bottleneck, and 64 further investigates the HSIC bottleneck as regularization to enhance the robustness of DNNs.
The crucial step optimizing the IB is to calculate mutual information in efficient and effective manner. An approach in [19] proposes a conditional entropy bottleneck (CEB) (see Eq. (6),, which enhances IB introducing label priors in variational inference. This approach employs backward encoder to approximate the true distribution p==ly). However, DNN processing can form a Markov chain (XX Z Y) and obey the data processing inequality: H (X) H (2) HYY.. ). and the label Y often cannot satisfy the intrinsic dimension requirement [37]. As a result, directly using label information approximate p(2ly) is imprecise. Furthermore, the backward encoder usually provides uniform priors for inputs with the same label and cannot provide customized priors based on different inputs, particularly for high- nigh-dimensional image data.
Fortunately, prior research has shown that robust pre- are-trained models can provide robust prior infor- mation enhance model robustness and certainty [27 53 21). Motivated by this, we revisit VIB through the lens of robustness distillation and further introduce a new IB objective: Information Bottleneck Distillation (IBD) (see Eq. ()). To make IBD practical, we put forward two distillation strategies meant to target the two optimization processes of the information bottleneck respectively. Firstly, utilize soft-label distillation maximize the mutual information between intermediate features and output prediction. Secondly, we use adaptive feature distillation to restrict the mutual information between the input and intermediate features, which facilitates the transfer of appropriate knowledge from the teacher model to the student model, ultimately resulting in a more accurate estimation of the distribution of student features. schematic diagram illustrating the IBD is shown in Figure
Overall, make the following contributions:
Theoretically, we utilize conditional variational inference to construct a lower bound to estimate the mutual information and reformat the IB principle by using the adversarial robustness as the prior for learning features, which is termed Information Bottleneck Distillation (IBD).
Algorithmically, realize IBD, we propose two distillation strategies: robust soft-label and adaptive feature distillation, match the two optimization processes of the information bottleneck, respectively.

---

Experimentally, we conducted extensive experiments on various benchmark datasets such as CIFAR and ImageNet. The results show the effectiveness of our IBD in improving the robustness of DNNs against most attacks (e.g., PGDD-attack and AutoAttack), and our IBD behaves more robustly than state-of-the-arr methods.
2 Background & Related Work
Adversarial Attacks. Adversarial examples observed when attacker adds human- iimeeeiippecepptblle perturbation to the inputs, which misleads DNN's output [56]. And a series of attacking algorithms are proposed [22 48 14 38). One of the most popular attacks is the Project Gradient Descent
(PGD) attack 41 which uses multi-step projected gradient descent to generate adversarial examples:
Ih 11( 1Z-1 sign CVrCes (he (he(xx-1)
sign(Va
(2)
where a is the step size, II is the project function, and Ty is the adversarial example at the k-th step, hg is DNN model with weight 0, and Lox is cross-entropy function. Another widely-used adversarial attack method is the C&W attack [4) which applies a rectifier function regularizer to generate adversarial examples near the original input. AutoAttack (AA) [14), an ensemble of
different parameter-five free attacks, is currently regarded as the most reliable evaluation of the veversriial robustness of the model. Black-box attacks, which do not require full knowledge DNNs, are more practical, and previous works [67 [8] have shown that adversarial examples generated by one model can attack other models with a high probability. Query- perturbation iteratively according to the attack objective. In this work, we test the robust performance under both white- and black-box attacks to verify the robustness of our proposed method.
black-box attacks B 9 update the
Adversarial Robustness. To counter the threat of adversarial attacks, researchers have proposed vari- ous defense methods, including defensive distillation 44 munifold-projectinn (51), pre-processing 224 669, provable defenses [45][0) 50), and adversarial training [T] 22 41]. Among these, adversarial
training (AT) 41 highly effective and widely-used solution. It involves adding adversarial
examples, generated by the adversarial attack scheme, to the training data, which can be formulated by a min-max optimization problem:
min E. max LOE hoo (aavv) (.aax)))))
where Tadv is adversarial example generated by special attack algorithm. Many variants of AT have been proposed. 711 proposed the TRADES, which characterizes the trade-off between accuracy and robustness. [66] proposed adversarial weight perturbation (AWP), which uses weight perturbation to increase the robustness of the model. In addition, some new efforts have also been devoted from different aspects including designing robustness architecture search [8] 25 29 30), and data augmentation [5] 46 63).
training strategies
43 33). adversarial regularization
42 48 39
Robustness Distillation. Knowledge distillation (KD) 28 is an effective method, wherein a well- trained teacher model is used supervise the learning of the student model. The overall objective of KD is formulated as:
min Crask (ha()))) + (Dis As
(4)
where Lrask is the task-specific loss function for the target task and Lpist is the loss function that penalizes the difference between the teacher and the student. Recent studies show that KD can also be used to enhance the adversarial robustness of student network (4.. Then, the adversarially robust distillation (ARD) method, as introduced in [21, combines adversarial training with KD to further increase the robustness of the student model under the supervision of an adversarially robust teacher network. Introspective Adversarial Distillation (IAD) 73 propose proposes method to automatically realize the intuition of the previous reliable guidance during the adversarial distillation. And, RSLAD (74 improves the performance of ARD by using robust soft labels generated by a pre-trained teacher network to replace hard labels used in (11.
3

---

3 Information Bottleneck Distillation
In this section, we revisit the concept of information bottleneck from the perspective of robust distillation and establish the IBD objective. We further propose two distillation strategies to perform the two optimization processes of the information bottleneck, respectively. Finally, we combine IBD with AT to learn robust model.
3.1 A Distillation View of Information Bottleneck
The information bottleneck theory has been used to explain deep models [58 compress models [16], and learn robust models (2. To make the IB practical, major challenge to accurately estimate the
mutual information. In (2). Variational Information Bottleneck (VIB (VIB utilizes variational inference
to construct the lower bound to estimate the mutual information. VIB is formulated as:
loga(ul>) - log p(=|z) (())
(1:Y)-BI(X3)
E
(5)
p(z.0)((z(a)
where p(2/a)) is feature distribution, ((l=)) is variational approximation to the true distribution p(yl=), and (=)) is the variational approximation to the true distribution p(=). To optimize Eq. (5) VIB uses neural networks parameterize the Gaussian densities p 2()z)) and (v]22, and treats (
as a fixed K -i-immnniional spherical Gaussian distribution g(2) = (0, (where is the size of the bottleneck). Then, the reparameterization trick and Monte Carlo sampling estimate of the gradient. This process thus allows DNNs to handle high-dimensional data, such as images, avoiding previous limitations on discrete Gaussian distribution cases.
used to get an unbiased
Next, how to determine the approximate ((2) is important in variational inference. VIB empirically treats q(=) fixed Gaussian distribution. For better approximation of (=)), [I proposes the Conditional Entropy Bottleneck (CEB), which introduces label prior information to approximate (=).. The CEB can be formulated as:
pl p(2|z)
E
logg(v/=)= - log
(6)
p(x.))((=I=)
(21y)
In detail, CEB utilizes linear mapping layer to parameterize (zly)) that takes a one-hot label y as input and outputs a vector My as the mean of the Gaussian distribution (<>l)) = (1g, I). CEB also uses an identity matrix for the variance of both (<(ly) and p(=[z). Note that CEB and VIB differ in terms of the presence of a class conditional or unconditional variational marginal, and whether (2ly) and p(=[z) have a fixed variance. Thus, by introducing such a class prior, CBE can learn an approximate distribution better. However, using the one-hot label alone to approximate high- dimensional distribution (()) is inaccurate enough due to data processing inequality and intrinsic dimension 37 particularly for high-dimensional image data.
To address this challenge, we propose leveraging adversarial robustness distillation 21 build the information bottleneck objective. This approach involves providing robust prior information obtained from robust pre-trained model, which aims to improve model robustness and reduce model uncertainty 227 53 Specifically, we replace conventional one-hot label prior information with robust prior information derived from such robust pre-trained model. We call this method Information Bottleneck Distillation (IBD). To implement IBD, we approximate (() by utilizing the intermediate features extracted by an adversarially pre- pre-trained model. and our final objective formulated as:
(ogg(ul2)-o) - Blog p(2(x) ((2lt)
I - 3I(X;
E ((z00)(=1r))
(7)
where T' is the random variable of intermediate features extracted by the adversarially pre-trained teacher model. We employ a Gaussian distribution N ((2,, with mean u(.)) and variance ö as the variational distribution (=2(t). Here. the mean ((.)) a function of the intermediate feature from the robust pre-trained model, and the variance 5 is set to an identity matrix as the same CEB. Eq. (7) provides a variational lower bound on IBD, and more detailed derivation is available in Appendix
B
For more details of the bound, we refer the reader to [2] or Appendix A

---

where p(y|z) indicates the true likelihood considered as a target label y corresponding (v]=)) is modeled by the classifier of the student model ht. During the training phase, we can use the output probability of the robust teacher model h, as the soft label yt (e to approximate 3.2 Optimization for IBD
In standard classification task, we denote hg (go f) as deep neural network with parameter Here, J: dR Rd maps the inputs X to the intermediate features Z, and 9 Rd Rdy further maps the intermediate features Z to the final outputs Y. so that Z = f(X) and g () = h2(X). Then, we denote the target student network as h2 (g. fe), and the adversarially pre-trained teacher network as h, (gr ft). Furthermore, set of intermediate features from different layers of the student model is denoted different layers of the teacher model is denoted as Zi fx(X) {2t 2 ..... 2,) Here, n and m represent the number of layers of the student and teacher models, respectively. Each feature has its own feature map size and channel dimension, denoted as e IR CxHNW" where C, H and W represent the channel numbers, feature height, and width, respectively.
Z, - (X) = {z1 , =g
and a of intermediate features from
1) Maximizing I 7(2 via Soft Label Distillation. To optimize Eq. using the gradient descent algorithm, simplify the first term the right-hand side of Eq. ( to the expected log-likelihood in the form of cross-entropy, which can be formulated as follows:
log (vl=)) = f p(v, 2) logg(vl=)dyd=
p(a.))p(=(a)
p(=)p(v]>) logg
p(z (5 log (ogg(()))))(lolo p(x))(2())) ( log ( dyddadr
(8)
[ p(ul=) log q (v)
The
the distribution of p(vl2), despite knowing the label y. According to [74), using robust soft-labels is crucial in enhancing robustness. Thus, we rewrite the first term as:
[S p(ulz) log log (u)l))y = E [-LCE(h,(=),,)) E p(=))(=)2))
E ((z.g)p(z1z))
log log <vvl=)]
(9)
p(w)
2) Maximizing -I( via Adaptive Feature Distillation. optimize the second term on the right-hand side of Eq.77 the formulation can be written as:
log p(z|z) ((2(t)
f p p(2,z) log
p(2(x) (22(t)
dzdr
p(=)p(=())
f p(z)p(2( log
p( p(2(1:)
dzdæ
(10)
(=(1)
[ p(2lz) log
p(E|æt)
E xx)
(x(lt)
Thus, we optimize the KL divergence between the feature likelihood p(2(x) and the appropriate feature probability <2](f). Here, parameterize Gaussian densities p(z[2) and q(2lt) using neural networks, where the mean of p(z(z) and ((((t) are the intermediate features of fa and fe. respectively. Both variances set to identity matrix. As result, the second term can be calculated by:
p(2 log
KL ([(((a)))l((ttt)] E f(())) p(w)
tc]. (11)
E ((a)))(4))))
E (()))(=(o)
{2((t)
where e is a constant. When optimizing DNNs using Eq. 11 as the objective, a challenge arises in selecting suitable intermediate features from models calculate the loss. This due to the fact that different intermediate features tend to have different information, especially when the student and teacher models have different architectures. Motivated by G 32, we leverage an attention-based feature distillation strategy to achieve cross-layer information transfer.
5

---

24) and Z, fz) Given two sets of the intermediate features, 2, (Z
2.....,, ,2 J, our aim is to identify similarities for all possible combinations and transfer relevant information from the teacher to the student. We compare the features of both teacher and student models by using two different pooling methods - global average pooling and channel-wise pooling. The similarity determined by two globally pooled features is used as the weight for transferring information over the distance defined by the channel-wisely averaged features. In order to identify the similarity between Ze and Z.. adopt query-key concept of the attention mechanism [6]].
" In detail, each teacher features generate query set Q {gi qf ,.."....."""...............".... ). and each student feature generate key set Kg {Kg h- ................................ ba) where the qf and kg calculated as:
q = Re (WT GAP()
(12)
th Re -AA (x"))""))
where GAP denotes the global average pooling, Re is Relu activation function, W and W linear transition parameters. It should be noted that these features possess varying transition weights, as they convey different levels of information.
By utilizing the queries and keys, attention values that represent the relation between teacher and student features calculated with softmax function:
@rwa-kk3
Aln softmax
(13)
Vd
where W dRd is bilinear weight. The bilinear weighting is utilized to generalize the attention values derived from different source ranks, as queries and keys are identified within features of distinct dimensions 33 Attni,j indicates the attention weight that captures the relation between the i-th teacher feature and the j-th student feature. Therefore, Attn can make the teacher feature = transmit its corresponding information selectively and adaptively to different student features. Finally, the second term on the right-hand side of Eq. 7 can be written as:
E
log p(2|x) (<(t))
= E p(r)
ΣΣ
n m
Attm; (TIC))
(14)
((x.))((=(=)
where T is transform function with feature map size alignment (up-sampled down-sampled), and then apply a channel-wise average pooling to get an average feature map for loss computation.
Combing Eq and Eq
14] the final objective of IBD can be defined as follows:
LIBD min E x())
(c v.)
3 Attm, (T(())-
(15)
3.3 Applying IBD to Robust Learning
IBD can be naturally applied in combination with adversarial training. The final objective function is formulated as follows:
(1 (he()aa(()((Emma)) (t (Zavv)))
Lotj min E p(x)
(16)
Σ Σ Attn,
where and 9 are two trade-off hyper-parameters. We generate adversarial examples using the same method introduced by (7I), where given a natural input Tnats generated the adversarial example Tadv by maximizing KL-divergence term. Note that the intermediate features Z₁ and Z, extracted from Talv. Finally, we utilize this new loss function to train a robust model.
3.4 Discussion
The objective of IBD is comparable to certain conventional KD techniques 6 10 32
However, the major difference is, that our IBD, the teacher model must be an adversarially trentr model that provide robust information. Additionally, we design the objective function following the

---

Table 1: Robustness comparison of the proposed approach and baseline models under different attack methods under the too norm with c 8/255 on different datasets. All the models are based on pre-activation ResNet- 18 architecture. We choose the best checkpoint according to the highest robust accuracy on the test under PGD-10. The best results are blodfaced.
Best Checkpoint
Last Checkpoint
Method
Clean
FGSM
PGD
CW
AA
Clean
FGSM
PGD
CW
AA
CIFAR-10 lus c= 8/255
SAT 41
82.97
57.77
50.85
50.09
47.73
85.16
53.97
43.03
43.71
41.58
TRADES 71
83.74
59.54
52.73
50.94
49.58
84.11
58.72
49.97
49.05
47.02
CEB
82.87
58.61
$2.94
50.22
48.87
83.39
57.74
48.79
47.67
45.85
HBaR
84.13
58.95
53.35
51.47
49.77
85.04
58.33
53.19
51.21
48.64
InfoAT
83.17
60.52
54.29
51.62
49.92
83.23
60.40
53.94
51.17
49.67
ARD 21
83.94
59.32
52.16
51.21
49.17
84.32
59.35
51,41
51.22
48.89
IAD 78
83.24
59.34
54.24
51.92
50.63
83,76
59.17
53.84
51.60
50.17
RSLAD 24
83.38
60.08
54.27
53.19
51.52
83.88
59.98
54.01
53.08
51.36
IBD (Ours)
83.17
60.75
55.13
53.62
52.11
82.95
60.94
55.04
53.49
52.05
CIFAR-100 lint
8/255
SAT 41
57.75
32.78
29.27
27.52
24.01
58.17
27.02
21.02
21.54
19.86
TRADES
58.57
32.84
29.88
26.29
25.27
57.11
32.05
28.12
25.47
24.52
CFB
55.17
32,36
30.12
26.35
25.36
55.74
30.84
26.59
24.51
23.16
HBaR
64
59.53
34,46
31.82
27.42
26.62
58.26
32.41
28.23
25.78
25.43
InfoAT 68
58.23
34.46
31.39
28.68
26.76
58.42
33.13
30.53
27.52
26.21
ARD 21
60.58
33.43
29.07
27.54
25.62
60.79
32.67
28.11
26.76
24.62
IAD 78]
57.08
34.65
30.60
27.24
25.84
57.52
33.71
29.23
27.35
25.36
RSLAD
74
57.72
34.23
31.01
28.27
26.73
57.83
34.09
30.55
28.07
26.41
IBD (Ours)
58.10
36.37
33.59
31.16
29.21
58.32
36.17
33.40
30.87
28.74
information bottleneck principle, which is theoretically proven to be lower bound of the information bottleneck. Notably, previous adversarial distillation methods 21 44 74] only consider utilizing information from the final prediction output, while ignoring the information from intermediate features. From another perspective, motivated by [3.. IBD can explore intermediate features to capture the robust information and leverage adaptive feature distillation strategy to automatically transfer appropriate features from the teacher model to the target student model. Our experiments
indicate that making full use of the intermediate features of the DNNs can improve the model's robustness effectively.
4 Experiments
In this section, we first describe the experimental setting and implementation details. We evaluate the robustness and accuracy of various widely used benchmark datasets. Finally, we conduct wealth of ablation experiments to provide a comprehensive understanding of the proposed IBD.
4.1 Experiments Settings
Baselines Setup. We conduct our experiments on three benchmark datasets including CIFAR- 10, CIFAR-100 (3)] and ImageNet [17]. We consider three types of baseline model: 1) classical
adversarial training method, including standard Standard AT [1] and TRADES [71] 2) adversarial robustness distillation, including ARD (21] IAD [73 and RSLAD 74] 3) the models trained using
variants IB, include CEB 19). HBaR 64 and InfoAT (8)
Evaluation Attack. We evaluate the defense under different white- and black-box attacks including FGSM (22) PGD 41) CW [4], and AutoAttack [14). The black-box attacks include query- based

---

Table 2:
The performance of the pre-trained teacher models under different attacks.
Dataset
Architecture
Natural Acc
FGSM
PGD-100
CW-100
AutoAttack
CIFAR-10
WideResNet-34-10
84.92
60.87
55.33
53.98
53.08
CIFAR-I00
WideResNet-34-10
57.16
33.58
30.61
27.74
26.78
ImageNet-IK
ResNet-50
64.02
38.46
34.96
Table 3: Black-box robustness results in CIFAR-10 under the boe norm with 8/255 We evaluate against transfer-based and query-based attacks.
Table 4:
Robustness comparison of the pro- posed IBD and several state-of-the-ar models under standard AutoAttack.
Trans-based
Query-based Square
Method
WRN
Clean
AA
Method
FGSM
PGD-IOU
SPSA
SAT 41
34-10
84.92
53.08
SAT
61.34
59.83
66.35
54.16
LBGAT 15
34-20
88.70
53.57
TRADES 71
63.14
60.31
67.56
54.74
TRADES
48
34-20
86.18
54.39
CEB 19
62.75
61.93
66.71
55.28
LTD
34-10
85.02
54.45
HBaR 64
63.61
60.93
68.07
56.62
IBD
34-10
83.33
55.65
InfoAT 68
64.23
62.42
68.73
57.35
TRADES + AWP [66
34-10
85,26
56.17
ARD 21
63.27
61.44
67.89
55.85
LASAT + AWP 33
34-10
84.98
56.26
IAD
73
63.53
62.13
68.42
56.21
LTD AWP ?
34-10
86.28
56.94
RSLAD
74
64.78
62.13
68.78
56.97
IBD AWP
34-10
85.21
57.18
IBD
65.54
63.98
69.63
58.34
attacks 1 and transfer-based attacks
55
The maximum pertubation set to 6 8/255 for
CIFAR-10 and CIFAR-100.
Implementation Details. For the robust pre-trained teacher models on the CIFAR dataset, we use the ResNet-18 [26] and WideResNet-34xll (70) models trained with way of TRADES (71] and AWP [66]. For the ImageNet dataset, the pre-trained teacher model (a ResNet-50) provided by [49]. The results of the pre-trained teacher models under different attacks are shown in Table g The initial learning rate is 0.1 with a piece-wise schedule which divided by 10 at epochs 100 and 150 for a total number of 200 training epochs, similar to [47). We train all models with the SGD optimizer with a momentum of 0.9, weight decay of 0.0005, and a batch size of 128. We use ResNet- 18 as the student model for most experiments by default, unless otherwise stated. We adopt the common setting that the fo threat model with radius 8/255, with the PGD attack taking 10 steps of size 2/255. In addition, performed standard data augmentation, including random crops and random horizontal flips during training. For the hyper-parameter, we set a = 0.9 and 3 = 0.8 based on our ablation studies. For more details please refer our open source code. Our implementation based on PyTorch and the code to reproduce our results is available at at/htps://githubbcomm Kykkky/uunBBDD
4.2 Adversarial Robustness Evaluation
White-box Robustness. To verify the impact of the IBD on model robustness, we first train natural model (without adversarial training). We evaluate the performance of IBD on CIFAR- 10 under ResNet-18, and IBD achieves 25.49% robust accuracy against standard AA. However, other IB-based methods (CEB and HBaR) without adversarial training can not defend AA (that means the robust accuracy is 0). We further combine IBD with adversarial training and evaluate the robustness of all bascline models and our IBD against various types of attacks. Following in [47], we report the results at both the best checkpoint and the last checkpoint. The best checkpoint is selected based on the performance under the PGD-10 attack. The results are shown in Table | Our IBD method shows better robustness of both CIFAR- 10 and CIFAR- 100 against all attacks either the best or the last checkpoints. In particular, our IBD improves the robustness by 0.59% and 2.48% on CIFAR- 10 and CIFAR- 100 respectively, compared to previous ofate-of-the-ar art methods under AutoAttack.
Black-box Robustness. To further verify the robustness of our method under black-box attacks, we evaluate our IBD and baseline methods against transfer-based attacks and query-based attacks. For transfer-based attacks, we choose a robust surrogate model, which is trained by standard adversarial training, to generate the adversarial examples. All the models are trained using the same setting
8

---

(referring to Section 4.1 We generate adversarial examples using both FGSM and PGD-100 attacks with attack budget 8/ 255 on CIFAR-10 10. For query-based attacks, we evaluate the robustness under SPSA attack 160 and Square attack [3] SPSA attack can make a full gradient evaluation by drawing random samples and obtaining the corresponding loss values. We set the number of random samples q as 128 for every iteration and 8 = 0.01 and set iteration as 10. The square attack uses random search and does not exploit any gradient approximation to produce adversarial noise, and we set the maximum number of queries as 5000. We evaluate both transfer-based and query-bases attacks on the best checkpoints. The results are shown in Table 3 We observe that the IBD-trained model is robust to different types of black-box attacks and surpasses all baseline methods. The results under the black-box attack demonstrate the robustness improvement of IBD is not caused by the obfuscated gradients.
Robustness Evaluation on Nede Many works have demonstrated larger model capacity can Therefore, we employ the large-capacity network, e.g., WideResNet (WRN) 70), as the student model. V the robustness results against AA on the CIFAR-10. We compare several state-of oftthe-rrt adversarial trained models on robust benchmark (2). We can observe that the proposed IBD indeed improves the adversarial robustness by 1.2%. Furthermore, when combined with AWP [66]. our IBD also surpasses the previously otate-of-the-art models reported by the benchmark. where every small margin of improvement is significant. Note that, our method does not use any additional datasets.
usually lead to better adversarial robustness [23 41 43
Evaluation on Large-scale ImageNet. To further verify the generalization of our method, we consider high-resolution, large-scale ImageNet dataset[17] which includes 1,000 classes and more than 1M training samples. Maintaining robustness for this dataset is particularly challenging. We use the fast adversarial training framework [65] to train all robust models. Here, the robust budgets are set as e = 2/255 and = 4/255. The results of our method for the ResNet-50 (student model) are shown in Table 5 Our IBD outperforms both Fast-AT 62 and RSLAD 74 significantly.
Table 5: Robustness comparison of the proposed approach and different fast adversarial training under different attack methods at c= 2/255 and c 4/255 on ImageNet- 1k. All the models are based on ResNet-50 architecture.
Method
Epsilon
Clean
PGD-100
AutoAttack
FAST-AT
66
65.95
37.52
35,22
RSLAD 74
2
63.64
40.49
38.35
FAST-IBD
6 2
62.03
44.31
40.94
FAST-AT 665
<= 4
60.16
27.46
24.82
RSLAD 74
6= 4
60.64
30.19
26.53
FAST-IBD
6=4 59.10
31.52
27.74
4.3 Ablation Studies
The importance robust soft label. [52] proposes leveraging label smoothing during adversarial training, and [74] also determines the robust soft label is important factor in robustness enhance- ment. We empirically verify the importance of robust soft labels our IBD, by comparing the performance of models trained using different label modification schemes: a) true label (hard label); b) smoothing label crafted by label smoothing on the true label [55]; c) natural soft label that output by non-robust pre- mre-triined model; 4) robust soft label that output by robust pre-trained model. The results are summarized Table G which demonstrates that the robust soft label is beneficial to improving the model's 's robustness.
The role of features matching. We further investigate the role of features distillation strategy in section[.22 we consider two features matching strategies: a) a hand-crafted feature distillation method, which uses the same level of features to guide the student model learning: b) an adaptive feature distillation method, which is based on attention mechanism to guide the student model learning. We conduct experiments with these two strategies on different network architectures ResNet- (Res) and WideResNet-344 34011 (WRN). The results reported in Table 7 Our adaptive feature

---

Table 6: Robustness of our IBD model trained using different types of labels on CIFAR-10 under differ- ent attacks.
Table 7: Robustness of our IBD model trained using different features matching schedule on CIFAR-10 10 under the AutoAttack.
Method
Clean
PGD
CW
AA
Architecture
Schedule
|Clean
AA
Hard label
85.25
51.64
50,49
48.35
Res Res
No matching
83.25
50.63
Label smooth
85.43
51.92
50.56
48.71
WRN Res
No matching
83.37
51.48
Natural soft label
86.38
48.08
45.70
43.79
Res - Res
Hand-crafted
82.99
51.12
Robust soft label
83.17
55.13
53.62
52.11
WRN Res
Hand-crafted
83.10
51.61
RSLAD [44
83.38
54.27
53.19
| 51.52
Res Res
Adaptive
83.24
51.46
WRN Res
Adaptive
83.17
52.11
distillation performs better than hand-crafted feature distillation in both the same and different network architectures.
The impact of the teacher. We conducted an ablation experiment by using different teacher models to verify the impact of the teacher's robustness on the performance of the student model. We conduct this experiment CIFAR- 10 with two student models: ResNet-18 and WideResNet-34-111 10, and five different teacher models which have different robustness. The results are shown in Table X in the Appendix. We observe that different robust teacher models have significant positive benefit on the student model. For the ResNet-15 18 student model, we find that the robustness of the student does not increase monotonically with that of the teacher. As the teacher model (WideRessNet-34-2) becomes more complex, the robustness of the student model decreases, compared to WideResNet-34 10. This may be due to the large gap the architecture of the teacher model and the student model. This phenomenon is called robust saturation (74). For the WideResNet-34- -4-10 student model, we found that in most cases, the student's robustness can surpass that of the teacher model. We think there are two reasons for this, one is that the performance of the teacher model is not very strong. The other is that the teacher model provides robust soft labels alleviate overfitting and improve performance. Therefore, in most cases, it is expected that the student model exceeds the teacher model, but when the teacher model is strong enough, it not easy for the student model to surpass the teacher model (e.g., WideResNet-76-10)
The impact of and B. The is trade-off the adversarial robustness and natural accuracy. We conduct ablation experiments to verify the trade-off. The results are shown in Figure ([a) in the Appendix. When we set 0.9, our method can achieve the best adversarial robustness. In the IB principle, the hyperparameters | are important to control the trade-off. Therefore, we finally choose different values of train the IBD, from which we choose the optimal value of 3. The experimental results are shown in Figure 2 in the Appendix, where the best results are achieved when setting = 0.8.
Conclusions
In this paper. we revisited the information bottleneck principle from the perspective of robustness distillation and then presented a new IB objective, called Information Bottleneck Distillation (IBD). IBD can be thought of as a tighter variational approximation to the IB objective than VIB. To optimize IBD effectively, we proposed two adaptive distillation strategies. Experimentally, we empirically demonstrated the advantage of IBD over existing methods, IB-based methods, and adversarial distillation methods on benchmark datasets.
Acknowledgments
This work was supported by National Key R&D Program of China N0.20222DD1182022, the National Science Fund for Distinguished Young Scholars (No.62025603) the National Natural Science Foundation of China (No. U21B2037, No. U22B2051, No. 62176222, No. 62176223, No. 62176226, No. 62072386, No. 62072387, No. 62072389, No. 62002305 and No. 62272401), and the Natural Science Foundation of Fujian Province of China (No.2021J01000) N0.202200600),
10

---

References
[1] Naveed Akhtar and Ajmal Mian. Threat of adversarial attacks on deep learning in computer vision: A survey. IEEE Access, 6:14410-14430, 2018.
[2] Alexander Alemi, lan Fischer, Joshua Dillon, and Kevin Murphy. Deep variational information bottleneck. arXiv preprint arXiv: /rXiv:/6/2.00410,, 2016.
[3] Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: a query-efficient black-box adversarial attack via random search. arXiv preprint arXiv: 192.0009, 2019.
[4] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In Symposium on Security and Privacy (SP), pages 39-57, 2017.
[5] Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C Duchi, and Percy S Liang. Unlabeled data improves adversarial robustness. In NeurlPS, pages 1 11192-11203, 2019.
[6] Defang Chen, Jian-Ping Mei, Yuan Zhang, Can Wang. Zhe Wang, Yan Feng, and Chun Chen. Cross-layer distillation with semantic calibration. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 7028-7036, 2021.
[7] Erh-Chung Chen and Che-Rung Lee. Ltd: Low temperature distillation for robust adversarial training. arXiv preprint arXiv:2111.02331, 2021.
[8] Hanlin Chen, Baochang Zhang, Song Xue, Xuan Gong, Hong Liu, Rongrong Ji, and David Doermann. Anti-bandit neural architecture search for model defense. ECCV, pages 70-85, 2020.
[9] Jianbo Chen, Michael I Jordan, and Martin Wainwright. Hopskipjumpattack: A query-efficient decision-bai based attack. In IEEE Symposium on Security and Privacy (SP), pages 1277-1294. IEEE, 2020.
[10] Pengguang Chen, Shu Liu, Hengshuang Zhao, and Jiaya Jia. Distilling knowledge via knowl- edge review. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 5008-5017, 2021.
[11] Zac Cranko, Aditya Krishna Menon, Richard Nock, Cheng Soon Ong, Zhan Shi, and Christian Walder. Monge blunts bayes: Hardness results for adversarial training. In ICML, 2019.
[12] Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debencdetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robusthench: standardized adversarial robustness benchmark. arXiv preprint arXiv:2010.09670, 2020.
[13] Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with a fast adaptive boundary attack. arXiv preprint 1rxiv:1907002044 2019.
[14] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In ICML, 2020.
[15] Jiequan Cui, Shu Liu, Liwei Wang, and Jiaya Jia. Learnable boundary guided adversarial training. In ICCV, pages 15721-15730, 2021.
[16] Bin Dai, Chen Zhu, Baining Guo, and David Wipf. Compressing neural networks using the variational information bottleneck. In International Conference on Machine Learning, pages 1135-1144, PMLR, 2018.
[17] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In CVPR, pages 248-255. Ieee, 2009.
[18] Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses transferable adversarial examples by translation-invarial attacks. In CVPR, pages 4312-4321, 2019.
[19] Ian Fischer. The conditional entropy bottleneck. Entropy, 22(9):999, 2020.

---

[20] Ian Fischer and Alexander A Alemi. Ceb improves model robustness. Entropy, 22(10): 1081, 2020.
[21] Micah Goldblum, Liam Fowl, Soheil Feizi, and Tom Goldstein. Adversarially robust distillation. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pages 3996-4003, 2020.
[22] lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples. In ICLR, 2015.
[23] Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against norm-bounden adversarial examples. arXiv preprint arXiv:2010003593, 2020.
[24] Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens Van Der Maaten, Countering adversarial images using input transformations. In ICLR, 2018.
[25] Minghao Guo, Yuzhe Yang, Rui Xu, Ziwei Liu, and Dahua Lin. When nas meets robustness: In search of robust architectures against adversarial attacks. In CVPR, pages 631 2020.
[26] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, pages 770-778, 2016.
[27] Dan Hendryeks, Kimin Lee, and Mantas Mazeika. Using pre-training can improve model robustness and uncertainty. In ICML, 2019.
[28] Geoffrey Hinton, Oriol Vinyals. Jeff Dean, et al. Distilling the knowledge in neural network. arXiv preprint arXiv: 150.00233,, 2(7), 2015.
[29] Ramtin Hosseini, Xingyi Yang, and Pengtao Xie. Dsma: Differentiable search of robust neural architectures. In CVPR, pages 6196 6205, 2021.
[30] Shihua Huang, Zhichao Lu, Kalyanmoy Deb, and Vishnu Naresh Boddeti. Revisiting residual networks for adversarial robustness: An architectural perspective. CVPR, 2023.
[31] Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. In NeurlPS, pages 125-136, 2019.
[32] Mingi Ji, Byeongho Heo, and Sungrae Park. Show, attend and distill: Knowledge distillation via attention- based feature matching. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 7945-7952 2021.
[33] Xiaojun Jia, Yong Zhang, Baoyuan Wu, Ke Ma, Jue Wang, and Xiaochun Cao. Las-at: Adversarial training with learnable attack strategy. In CVPR, pages 13398-13408, 2022.
[34] Jin-Hwa Kim, Jachyun Jun, and Byoung- -Tak Zhang. Bilinear attention networks. Advances in Neural Information Processing Systems, 31, 2018.
[35] Junho Kim, Byung-Kwan Lee, and Yong Man Ro. Distilling robust and non-robust features in adversarial examples by information bottleneck. Advances in Neural Information Processing Systems, 34, 2021.
[36] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. Technical report, Citeseer, 2009.
[37] Elizaveta Levina and Peter Bickel. Maximum likelihood estimation of intrinsic dimension. Advances in neural information processing systems, 17, 2004.
[38] Jie Li, Rongrong Ji, Peixian Chen, Baochang Zhang, Xiaopeng Hong, Ruixin Zhang, Shaoxin Li, Jilin Li, Feiyue Huang, and Yongjian Wu. Aha! adaptive history-driven attack for decision-basse based black-box models. In Proceedings of the IEEE/CVE International Conference on Computer Vision, pages 16168-16177, 2021.
12

---

[39] Hong Liu, Zhun Zhong, Nicu Sebe, and Shin'ich Satoh. Mitigating robust overfitting via self gelf-residual-coe residual--aliiratioon regularization. Artificial Intelligence, 317:103877, 2023.
[40] Wan-Duo Kurt Ma, JP Lewis, and W Bastiaan Kleijn. The hsic bottleneck: Deep learning without back- pook-propagation. In Proceedings of the AAAI Conference Artificial Intelligence, volume 34, pages 5085-5092, 2020.
[41] Aleksander Madry, Alcksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018.
[42] Chengzhi Mao, Ziyuan Zhong, Junfeng Yang, Carl Vondrick, and Baishakhi Ray. Metric learning for adversarial robustness. In NeurlPS, pages 480-491, 2019.
[43] Tianyu Pang, Xiao Yang, Yinpeng Dong, Hang Su, and Jun Zhu. Bag of tricks for adversarial training. In ICLR, 2021.
[44] Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as a defense to adversarial perturbations against deep neural networks. In IEEE Symposium on Security and Privacy (SP), pages 582-597, 2016.
[45] Aditi Raghunathan, Jacob Steinhardt, and Percy S Liang. Semidefinite relaxations for certifying robustness to adversarial examples. In NeurlPS, pages 10877-10887, 2018.
[46] Sylvestre-Alvise Rebuffi, Sven Gowal, Dan A Calian, Florian Stimberg, Olivia Wiles, and Timothy Mann. Fixing data augmentation to improve adversarial robustness. arXiv preprint arXiv:2103.019M4 2021.
[47] Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in adversarially robust deep learning, In ICML, pages 9194-8104. PMLR, 2020.
[48] Kevin Roth, Yannic Kilcher, and Thomas Hofmann. Adversarial training generalizes data- dependent spectral norm regularization. arXiv preprint arXiv:1906.01522 2019.
[49] Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do ad- versarially robust imagenet models transfer better? Advances in Neural Information Processing Systems, 33:3533-3545, 2020.
[50] Hadi Salman, Jerry Li, Ilya Razenshteyn, Pengchuan Zhang, Huan Zhang, Sebastien Bubeck, and Greg Yang. Provably robust deep learning via adversarially trained smoothed classifiers. In NeurlPS, pages 11289-113000 13000, 2019.
[51] Pouya Samangouei. Maya Kabkab, and Rama Chellappa. Defense-gan. Protecting classifiers against adversarial attacks using generative models. In ICLR, 2018.
[52] Ali Shafahi, Amin Ghiasi, Furong Huang, and Tom Goldstein. Label smoothing and logit squeezing: a replacement for adversarial training? arXiv preprint arXiv:1910.1158: 2019.
[53] Ali Shafahi, Parsa Saadatpanah, Chen Zhu, Amin Ghiasi, Christoph Studer, David Jacobs, and Tom Goldstein. Adversarially robust transfer learning. arXiv preprint 100.vv1905.082222 2019.
[54] Ohad Shamir, Sivan Sabato, and Naftali Tishby. Learning and generalization with the informa- tion bottleneck. Theoretical Computer Science, 41 (21((230):2266-2222 2010.
[55] Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jon Shlens, and Zbigniew Wojna. Re- thinking the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 181-22226 2016.
[56] Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Good- fellow, and Rob Fergus. Intriguing properties of neural networks. In ICLR, 2014.
[57] Naftali Tishby, Fernando C Pereira, and William Bialek. The information bottleneck method. arXiv preprint physics/0004057, 2000.
[58] Naftali Tishby and Noga Zaslavsky. Deep learning and the information bottleneck principle. In 2015 ieee information theory workshop (itw), pages 1-5. IEEE, 2015.
13

---

[59] Florian Tramer, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. Ensemble adversarial training: Attacks and defenses. In ICLR, 2018.
[60] Jonathan Uesato, Brendan O' O'donoghue, Pushmeet Kohli, and Aaron Oord. Adversarial risk and the dangers of evaluating against weak attacks. In ICML, pages 5025-5034, PMLR, 2018.
[61] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in newral information processing systems, 30, 2017.
[62] Xiaolong Wang, Yufci Ye, and Abhinav Gupta. Zero-shot recognition via semantic embeddings and knowledge graphs. In CVPR, pages 6857-6866, 2018.
[63] Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan. Better diffusion models further improve adversarial training. ICMI., 2023.
[64] Zifeng Wang. Tong Jian, Aria Masoomi, Stratis loannidis, and Jennifer Dy, Revisiting hilbert- schmidt information bottleneck for adversarial robustness. Advances in Neural Information Processing Systems, 34, 2021.
[65] Eric Wong. Leslie Rice, and J Zico Kolter. Fast is better than free: Revisiting adversarial training. In ICLR, 2020.
[66] Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. In NeurlPS, 2020.
[67] Lei Wu, Zhanxing Zhu, Cheng Tai, et al. Understanding and enhancing the transferability of adversarial examples. arXiv preprint arXiv:/802.09707 2018.
[68] Mengting Xu, Tao Zhang, Zhongnian Li, and Daoqiang Zhang. Infoat: Improving adversarial training using the information bottleneck principle. IEEE Transactions on Neural Networks and Learning Systems, 2022.
[69] Yuzhe Yang, Guo Zhang, Dina Katabi, and Zhi Xu. Me-net: Towards effective adversarial robustness with matrix estimation. In ICML, 2019.
[70] Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In BMVC, 2016.
[71] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML., 2019.
[72] Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankanhalli. Attacks which do not kill training make adversarial learning stronger. In ICML, pages 11278-11221 11287. PMLR, 2020.
[73] Jianing Zhu, Jiangchao Yao, Bo Han, Jingfeng Zhang, Tongliang Liu, Gang Niu, Jingren Zhou, Jianliang Xu, and Hongxia Yang. Reliable adversarial distillation with unreliable teachers. arXiv preprini arXiv:2 106. 04928, 2021.
[74] Bojia Zi Shihao Zhao, Xingjun Ma, and Yu-Gang Jiang. Revisiting adversarial robustness dis- tillation: Robust soft labels make student better. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 16443-16452 2021.
14

---

A Variational Information Bottleneck
We show the derivation process of Variational Information Bottleneck (VIB), which is provided by [5 The information bottleneck (IB) [37] expresses a trade-off intermediate features Z between information useful for output prediction Y and information retained about the input X. The objective of IB can be formulated as follows:
IB(0) max (Z; 3I(Z,X).
(17)
where I denotes mutual information and controls the trade-off between the two terms.
The first term can be expressed as follows:
I(Z;Y)= f p(y.2) log p(y,2) dydz
p())p(z)
(18)
ff p(y.2) log p()1z)
dydz
p(y)
To apply it to a deep neural network 0g (g * f): The ((ylz) is modelled by the classifier g. Based on variational inference, it is a closed form for true likelihood p(ylz). This approximation is formulated by KL divergence and then the following inequality is constructed as follows:
f plylz) logp(y)z)dy) f p(ulz) log <y)
K (L(p((22)la(X12)) 20
(19)
which helps get the objective of IB to be tractable. With this equality, the first term in Eq. 17 can be represented to a lower bound as:
p(u. log g(ulz)
I(Z;Y) 2
dydz p(u)
f p(u. 2) loga(1) ((((=))ddddd) f p(u, log
ʃ ply. log (1)=)) f logp(ddd
(20)
= f ply, 2) log (u)= dyydz + H(Y)
2 f p(y 2) log ( d)ddd= = (p(a,))p(sls) [log [(][=)]
where a positive constant H(Y) denotes the Shannon entropy of target labels.
The second term in Eq. 17 is described as
T(Z:X)= f (22 log p(2,z)
dzdr
p(x)p(=)
(21)
- ((2,z))ogg
p(210) dadx
p(=)
where a dataset probability p(z) is erased on the fraction. Here, an approximate feature probability (Z) introduced appropriate the feature probability pZZ). As similar to Eq.T9) the relationship between (Z) and p( Z) can be written and then it builds the following equality:
f p(z) logp(=)dz 2 f p(=) log ((=)dz
K (T)) 2)) 2 0
(22)
By using it, the second term constructed with an upper bound follows:
1(2;)) s f p(z,x) log p(> (x)
dzdæ
g(2)
= f p(x)x(2 (r) log p(2 ax)
dzdæ
(23)
g(2)
log p(=lr)
= (p(x)))((=
(())
where feature likelihood is denoted by p() To sum it up. the objective IB can be re-formulated with lower bound follows:
I(Z:Y) -00000I(IX)))) 2 (p( loga(ula)) Bog
(24)
(2)
15

---

B Variational Bound on IBD
In the IBD setting, there is a target model and a pre-trained teacher model. We would like to learn features Z of X that will be useful for predicting Y for the target model. T is the intermediate features extracted by the adversarially pre-trained teacher model. We can represent this problem setting with the Markov chain: Z X T. Given the conditional independence Z TIX in our Markov chain and the conditional mutual information is always non-negative [20], so learning intermediate features Z of X is equivalent minimizing 7 (X;; Z(T). Using the chain rule of mutual information, have:
= -(
(25)
The objective of IBD can be formulated as:
IBD I(ZY)) -
(26)
(27)
-H((Z)) - (((())) -H(Z)))
(28)
We will variationally lower bound the first term of Eq. (26) and upper bound the second term using three distributions: p(=[z) is the feature distribution; (=(() is an approximation of p(zly); and (()=)) ) an approximation p(y|z).
The first term of Eq. (26):
I I(Z;Y) H(Y) H(YIZ)
E p(a,)p(=(==)
loga(vl=) ([(p(v=))l<<1=))
(29)
E p(aN))(())))
logg(ulz)}
The second term of Eq. 26 (for convenience, we set 8 to 1):
2T) (2 H(2(X)
p(x)p(=|p)
(30)
p(=[x)
log
((=)p(F(p)
((((t)
So far, get the variational bound for IBD:
loga(ulz) Blog pp22z)
IBD
2
(31)
((a.))((a22))
((211)
C More Experimental Details and Results
C.1 The impact of the teacher.
Table 8: How would the performance of teachers affect that of student models?
Teacher
Natural
AA
Student
Natural
AA
Student
Natural
AA
Resnet-18
84.09
48.71
Resnet-18
83.74
50.52
WRN-34-10
84.41
53.94
Resnet-34
85.94
50.57
Resnet-18
84.92
49.84
WRN-34-10
85.79
54.17
WRN-34-10
84.92
53.08
Resnet-18
83.17
52.11
WRN-34-10
84.21
55,65
WRN-34-20
85.65
56.82
Resnet-18 18
82.82
51.64
WRN-34-10
84.73
55.71
WRN-76-10
88.54
64.25
R8snet-18
85.28
51.96
WRN-34-10
86.61
57.12
16

---

53.0
IBD
Accuracy
Robustness
52.5
52.0
Natural
AA
51.0
0.0 0.1
0.2
0.3
0.4
0.5
0.6 0.7
0.8
0.9
1.0
0.2
0.4
0.6
0.8
1.0
1.2
alpha
Beta
(a)
(b)
Figure 2: The impact of a and 8.
C.2 The impact of a and 33
C.3 Different attack budgets and steps
We plot the results of testing robust accuracy epochs and evaluate adversarial accuracy against PGD attacks under different attack budgets with a fixed attack step of 10, and we also conduct experiments using PGD attacks with different attack iterations with a fixed attack budget 8/255, The results are shown in Figure 3 Our IBD is better than standard AT, TRADES and RSLAD at larger budgets, besides, IBD is stable against large iterations attacks, e.g. PGD attack with 500 step iterations. Therefore, the results demonstrate the effectiveness of our proposed IBD.
64
80
AT
AT
62
TRADES
RSLAD
RSLAD
Accuracy
Accuracy
60
IBD
58
50
56
40
54
30
52
20
100
Attack Step
Attack Budget
Figure 3: The test robust accuracy under PGD attack with different attack budgets and attack iterations, respectively. All these experiments conducted on CIFAR-10 using ResNet- 18 architecture. (Best view in color)
C.4 Visualization of attention matrix
We visualize the attention matrices when distilling between different network architectures, as shown in Figure 4 We between feature layers, but for models of different architectures, the shallow layers of the student model will receive lot of attention, and the high-level features will correspond to each other.
that models of the same architecture achieve mutual correspondence
D Limitations.
One limitation of our method is that the accuracy of our method on natural samples does not improve significantly, This may because there exists a trade-off between robustness and natural accuracy 71 Despite this, our natural accuracy is still over 83 % on CIFAR 10, we think this is acceptable. Another limitation that our method requires robust pre-trained teacher model, which may increase training costs and training time. At present, IBD has only verified its effect the adversarial
17

---

3
4
6
10
1.0
0
0.8
0.8
2
0.4
0.4
0.2
0.2
-0.0
(a) ResNet to RosNet
(b) WideResNet to RosNet
Figure 4: The visualization of attention matrix.
robustness of DNNs. It is not yet known whether it can achieve the same effect in other applications of IB. We are further studying its generalization ability.
E Broader Impacts.
We propose adversarial defense method enhance the robustness of the model, but still need to be aware of the potential negative societal impacts it might result in. For example, the attacker can get our model and design special attack algorithm for it. At present, our model can defend against stronger attack algorithms that may appear in the future. Thus, we encourage our machine learning community to further establish more reliable adversarial robustness checking routines for machine learning models deployed in safety-critich applications.
can guarantee that
18


Reviews:
[{"review_id": "UIytYD8tsq", "reviewer": "Reviewer_fxg6", "summary": "This paper aims to improve the adversarial robustness of deep neural networks. From the perspective of the Information Bottleneck, a knowledge distillation method is proposed. It makes use of intermediate features and logits from a robust teacher to get priors for guidance in training of the student model.\n\nExperiments on CIFAR-10, CIFAR-100, and ImgaeNet are conducted. Obvious improvements are obtained when compared with previous methods.", "questions": "See weakness", "limitations": "limitations are discussed in the supplementary file.", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper gives some insights into knowledge distillation from the perspective of Information Bottleneck.\n2. The distillation method shows impressive results on model robustness.", "weaknesses": "1. From the perspective of knowledge distillation, feature-based methods have already been explored by previous methods, like [9], [ref1].\nAs the paper claims, the major difference between the proposed method and previous distillation methods is that an adversarially-trained robust model is used as the teacher.\n\n [ref1] Fitnets: Hints for thin deep nets. ICLR 2015.\n\n2. It is interesting that the students can have stronger robustness than their teachers.     \nHow would the performance of teachers affect that of student models?     \nWill the robustness of student models be enhanced when a more robust teacher model is deployed?      \n\n\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for your valuable feedback! Here is our response to the concerned questions.\n#### **Q1: From the perspective of knowledge distillation, feature-based methods have already been explored by previous methods.**\n**A1**: Thanks for your comment. Our approach indeed resembles the feature-based distillation methods. \nHowever, we would like to highlight that the motivation behind our IBD and the optimization techniques is fundamentally different from those of the previous methods:\n\n1) We utilize conditional variational inference to construct a lower bound to estimate the mutual information and reformat the IB principle by using the adversarial robustness as the prior for learning features, which is termed Information Bottleneck Distillation (IBD). The optimization of our IBD complies with the Information Bottleneck Principle, which makes the target model learns more relevant information and discard nuisance information.\n\n2) From the perspective of robust distillation, previous adversarial robust distillation methods only optimize the output distribution of the model, while ignoring the feature information of the model.  Previous work [1] has shown that there are two kinds of features in the neural network: robust and non-robust features.  Therefore, we adopt the robust model as the teacher model and use the adversarial robustness as the prior for learning robust features. We propose an adaptive feature distillation strategy to automatically transfer robust features from the teacher model to the student model. thereby improving the robustness of the student model.\n\n#### **Q2: How would the performance of teachers affect that of student models?**\n**A2**: Thank you for your good questions. In our submitted manuscript, we only used one robust teacher network for fair experimental comparison. Following your comments, we conduct an ablation experiment by using different teacher models to verify the impact of the teacher's robustness on the performance of the student model. We conduct this experiment on CIFAR-10 with two student models: ResNet-18 and WideResNet-34-10, and five different teacher models which have different robustness. The results are shown in the Table. We can observe that different robust teacher models have a significant positive benefit on the student model. For the ResNet-18 student model, we find that the robustness of the student does not increase monotonically with that of the teacher. \nAs the teacher model (WideResNet-34-20) becomes more complex, the robustness of the student model decreases, compared to WideResNet-34-10.  This may be due to the large gap in the architecture of the teacher model and the student model. \nThis phenomenon is called **Robust saturation** [2].\nFor the WideResNet-34-10 student model, we found that in most cases, the student’s robustness can surpass that of the teacher model.\nWe think there are two reasons for this, one is that the performance of the teacher model is not very strong.\nThe other is that the teacher model provides robust soft labels to alleviate overfitting and improve performance.\nTherefore, in most cases, it is expected that the student model exceeds the teacher model, but when the teacher model is strong enough, it is not easy for the student model to surpass the teacher model (e.g., WideResNet-76-10).\n\n Teacher   | Natural  | AutoAtt   | Student  | Natural  | AutoAtt    | Student  | Natural   | AutoAtt   |\n ----  | ----  | ----  | ----  | ----  | ----  | ----  | ----  | ----  |\nResnet-18  | 84.09 | 48.71 | Resnet-18  | 83.74 | 50.52 | WRN-34-10  | 84.41 | 53.94 |\nResnet-34  | 85.94 | 50.57 | Resnet-18  | 84.92 | 49.84 | WRN-34-10  | 85.79 | 54.17 |\nWRN-34-10  | 84.92 | 53.08 | Resnet-18  | 83.17 | 52.11 | WRN-34-10  | 84.21 | 55.65 |\nWRN-34-20  | 85.65 | 56.82 | Resnet-18  | 82.82 | 51.64 | WRN-34-10 | 84.73 | 55.71 |\nWRN-76-10  | 88.54 | 64.25 | Resnet-18  | 85.28 | 51.98 | WRN-34-10  | 86.61 | 57.12 |\n\nRef:\n\n[1] Adversarial Examples Are Not Bugs, They Are Features. NeruIPS 2019.\n\n[2]  Revisiting adversarial robustness distillation: Robust soft labels make student better. ICCV 2021.\n\n\n"}, {"review_id": "U2RTX7BEF1", "reviewer": "Reviewer_rCCu", "summary": "This paper proposes the Information Bottleneck Distillation (IBD) method to enhance adversarial robustness, derived from revisiting variational information bottleneck from the perspective of robustness distillation. IBD leverages two distillation strategies to perform the optimization processes of the information bottleneck, namely soft label distillation and adaptive feature distillation. The final experimental results show that the proposed method enhances the adversarial robustness against both the white- and black-box attacks.", "questions": "Please refer to the weaknesses part.", "limitations": "The authors point out the potential limitations of the proposed method.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This paper revisits variational information bottleneck from the perspective of robustness distillation, which utilizes the intermediate features extracted by a pre-trained teacher model to approximate $q(z)$. \n2. The experimental results demonstrate that the proposed method improves the adversarial robustness against both the white- and black-box attacks.\n", "weaknesses": "1. This paper contains two hyperparameters, namely $\\alpha$ and $\\beta$. The authors should also analyze the impact of $\\alpha$ on the proposed method.\n2. In the experiment part of this paper, the classical adversarial training methods are SAT and TRADES. These benchmarks are somewhat old, and it is recommended to use newer training methods as baselines to boost the universality of the methods.\n3. There are some minor typos in this paper, such as inconsistent presentation tenses, errors in the use of singular and plural (line 99), and the representation of the cross-entropy function in Eq.(2). \n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for your valuable feedback! Here is our response to the concerned questions.\n\n#### **Q1: The impact of the hyperparameters $\\alpha$**\n\n**A1**: Thanks for your comment. The $\\alpha$ is a trade-off the adversarial robustness and natural accuracy. \nWe conduct ablation experiments to verify the trade-off. The results are shown in the following table. When we set $\\alpha = 0.9$, our method can achieve the best adversarial robustness.\n\n|  Alpha   |0.0  | 0.1   |0.2  |0.3  | 0.4   |0.5  |0.6   |0.7  | 0.8  |0.9   |1.0  |\n|  ----  | ----  | ----  | ----  | ----  | ----  | ----  | ----  | ----  | ----  | ----  | ----  |\n|  Natural   | 87.28  | 85.32  | 84.74  | 84.45  | 84.25   | 84.02  | 83.55   | 83.62  | 83.48  | 83.17  | 83.04  |\n|  AA   | 9.31  | 47.31  | 49.67  | 51.43  | 51.45  | 51.57  | 51.79   | 51.82  |  51.96  | 52.11  | 52.04  |\n\n#### **Q2: Some benchmarks are somewhat old**\n**A2**:Thanks for this fruitful advice.\nIn order to verify the effectiveness of our method, we not only compare with some classical adversarial training methods (i.e., SAT and TRADES) but also compare with several state-of-the-art adversarial trained models on the robust benchmark[1] such as LBGAT[2]  (2021), LTD[3] (2021) and LAS-AT[4] (2022), all of which are published in recent years.\nAs shown in the Table, we can observe that the proposed IBD improves the adversarial robustness by $\\sim 1.2\\%$. \n\nFurthermore, when combined with AWP [5], our IBD also surpasses the previously state-of-the-art models reported by the benchmark. where every small margin of improvement is significant. \\textbf{Note} that our method does not use any additional datasets.\n\n Method   |  WRN  |  Natural  | AA   | \n ----  | ----  | ----  | ----  | \nSAT  | 34-10 | 84.92 | 53.42 |\nLBGAT  | 34-20 | 88.70 | 53.57  | \nTRADES  | 34-20 | 86.18 |  54.39 | \nLTD | 34-10 | 85.02 |  54.45  | \nIBD | 34-10 | 83.33 |  55.65  | \nTRADES + AWP | 34-10 | 85.26 |  56.17  | \nLASAT+ AWP | 34-10 | 84.98 | 56.26  | \nLTD+ AWP | 34-10 | 86.28 | 56.94  | \nIBD+ AWP | 34-10 | 85.21 | 57.18 | \n\n#### **Q3:  Some minor typos.**\n**A3**:  Thank you very much for kindly pointing this out.  We have corrected these typos and carefully checked the manuscript to ensure that it is typos-free.\n\nRef:\n\n[1] Robustbench: a standardized adversarial robustness benchmark.2020\n\n[2] Learnable boundary guided adversarial training. ICCV 2021\n\n[3] Ltd: Low temperature distillation for robust adversarial training. 2021\n\n[4] Las-at: Adversarial training with learnable attack strategy. CVPR 2022\n\n[5] Adversarial weight perturbation helps robust generalization. NeurIPS 2020\n\n"}, {"review_id": "olbTstow8E", "reviewer": "Reviewer_4SqU", "summary": "This paper draws inspiration from prior studies that suggest robust models can offer strong prior information, thereby enhancing both the robustness and uncertainty of the model. Accordingly, we propose a new Information Bottleneck (IB) objective, which is designed to distil robustness in the context of a Variational Information Bottleneck (VIB).", "questions": "N/A", "limitations": "N/A", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "Pros:\n\n1. The proposed Information Bottleneck Distillation (IBD) method can significantly improve the robustness of Deep Neural Networks (DNNs), protecting them against most attacks such as the PGD-attack and AutoAttack.\n\n2.  The IBD method optimizes the information bottleneck efficiently and effectively by maximizing mutual information between intermediate features and output prediction via soft label distillation, and restricting the mutual information between the input and intermediate features via adaptive feature distillation.\n\n3. The adaptive feature distillation transfers appropriate knowledge from the teacher model to the student model, resulting in a more accurate estimation of the student feature distribution.\n\n4. The method was extensively tested on various benchmark datasets, including CIFAR and ImageNet, demonstrating its effectiveness and robustness compared to state-of-the-art methods.\n\n", "weaknesses": "N/A\n\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank you very much for your valuable and encouraging comments on our work!  Thanks!"}, {"review_id": "6FoIt88rqO", "reviewer": "Reviewer_wRTW", "summary": "This paper takes a closer look at the information bottleneck principle and show that specially designed robust distillation can boost information bottleneck, benefiting from the prior knowledge of a robust pre-trained model and presents the Information Bottleneck Distillation (IBD) approach. What’s more, this paper also propose two distillation strategies to match the two optimization processes of the IB, respectively. The experimental results demonstrate the effectiveness of IBD.\n", "questions": "1.The author should explicitly list the main contributions of this work, which would helps readers especially not with prior knowledge of relevant methods quickly understand the core content of the article and the value of the work, and also save reading time.\n\n2.This work proposes IBD by combining robustness distillation and information bottleneck. I am concerned about the motivation of IBD. What problem does IBD solve for robust distillation or information bottleneck in adversarial training tasks?\n\n3.The proposed IBD followed with two distillation strategies corresponding to the two optimization processes of the information bottleneck. Could the author explain more about the these two processes? My understanding is that these two strategies are designed for the two terms of the IB objective which require different optimization methods, and then integrated into the final objective function. \n\n4.From the experimental results of CIFAR-10 in Table 1, although the proposed method has improved the robustness, it seems to be obtained by sacrificing the clean accuracy. Does the author have any ideas for improvement on this trade-off?\n", "limitations": "N/A", "rating": 5, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "This article is the first to design a distillation objective function for information bottlenecks called IBD objective, and then propose two distillation strategies tor perform the two optimization processes of the information bottleneck for the further use in adversarial training.This article is the first to design a distillation objective function for information bottlenecks\n\n", "weaknesses": "See Questions part.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for your valuable feedback! Here is our response to the concerned questions.\n\n#### **Q1: The main contributions of our work.**\n**A1**: Thank you for your comment and fruitful advice. The main contributions of our work include as follows:\n1) **Theoretically**, we utilize conditional variational inference to construct a lower bound to estimate the mutual information and reformat the IB principle by using the adversarial robustness as the prior for learning features, which is termed Information Bottleneck Distillation (IBD).\n2) **Algorithmically**, to realize IBD, we propose two distillation strategies to match the two optimization processes of the information bottleneck, respectively. \nFirst, we utilize robust soft label distillation to maximize the mutual information between latent features and output prediction. \nSecond, we present an adaptive feature distillation that automatically transfers relevant knowledge from the teacher model to the student\nmodel, so that it can restrict the mutual information between the input and latent features.\n3) **Experimentally**, we conducted extensive experiments on various benchmark datasets such as CIFAR and ImageNet.\nThe results show the effectiveness of our IBD in improving the robustness of DNNs against most attacks (e.g., PGD-attack and AutoAttack), and our IBD behaves more robustly than state-of-the-art methods.\n\n#### **Q2: What problem does IBD solve for robust distillation or information bottleneck in adversarial training tasks?**\n**A2**: Thank you for your comments and sorry for the confusion.  Our motivation is to improve the robustness of the model through the efficient optimization of IB.\n\n1) How does IBD improve the optimization of IB? IBD assists the calculation of mutual information $I(x; z)$ by introducing an adversarial robust prior for each sample. Therefore, when calculating mutual information, IBD provides customized and reliable prior information according to different samples, rather a uniform priors. Our purpose is to let the model learn more relevant information and discard nuisance information.\n\n2) From the perspective of robust distillation, previous adversarial robust distillation methods only optimize the output distribution of the model, while ignoring the feature information of the model. \nPrevious work [1] has shown that there are two kinds of features in the neural network: robust and non-robust features. \nTherefore, we adopt the robust model as the teacher model and use the adversarial robustness as the prior for learning robust features.\nWe propose an adaptive feature distillation strategy to automatically transfer robust features from the teacher model to the student model. thereby improving the robustness of the student model.\n\n#### **Q3: Could the author explain more about the two processes of IB?**\n**A3**: Thank you for your comments and sorry for the confusion. IB expresses a trade-off in intermediate features $Z$ between relevant information for the prediction $Y$ and nuisance information about the input $X$.  The objective of IB can be formulated as follows:\n$\n    \\max I(Z; Y) - \\beta I(X; Z),\n$\nwhere $I$ denotes mutual information and $\\beta$ controls the trade-off between the two terms. \n\nIB involves two processes. One is maximizing the first term ($ I(Z; Y)$), which means that ensures there is a strong correlation between the learned features and the target label. This correlation is relevant information.\nthe other is maximizing the second term ($ -I(X; Z)$), which means ensuring that the learned features contain relevant information as much as possible and discard nuisance information.\n\nFor the two processes in IB, we propose two distillation strategies to match the two optimization processes, respectively. First, we utilize robust soft label distillation to maximize the mutual information between latent features and output prediction. Second, we present an adaptive feature distillation that automatically transfers relevant knowledge from the teacher model to the student model, so that it can restrict the mutual information between the input and latent features. Finally, we integrate the two proposed optimizations into a final objective function.\n\n#### **Q4: Does the author have any ideas for improvement on this trade-off ?**\n**A4**: In our final optimization objective function (Eq. (16)), we introduce the $\\alpha$ hyperparameter, which is a hyperparameter that can trade off the adversarial robustness and natural accuracy.\nWe conduct ablation experiments to verify the trade-off. The results are shown in the following. When we set $\\alpha = 0.9$, our method can achieve the best adversarial robustness. \n\n|  Alpha   |0.0  | 0.1   |0.2  |0.3  | 0.4   |0.5  |0.6   |0.7  | 0.8  |0.9   |1.0  |\n|  ----  | ----  | ----  | ----  | ----  | ----  | ----  | ----  | ----  | ----  | ----  | ----  |\n|  Natural   | 87.28  | 85.32  | 84.74  | 84.45  | 84.25   | 84.02  | 83.55   | 83.62  | 83.48  | 83.17  | 83.04  |\n|  AA   | 9.31  | 47.31  | 49.67  | 51.43  | 51.45  | 51.57  | 51.79   | 51.82  |  51.96  | 52.11  | 52.04  |\n\nIn addition, in order to improve this trade-off, we train IBD with additional training data [2] to achieve better trade-off results, Our IBD can achieve 87.82% natural accuracy and 61.22% adversarial robustness under standard autoattack, which significantly improves the trade-off.\n\nRef:\n\n[1] Adversarial Examples Are Not Bugs, They Are Features. NeruIPS 2019.\n\n[2]  Fixing Data Augmentation to Improve Adversarial Robustness NeruIPS 2021"}, {"review_id": "ZN3WsxbBqW", "reviewer": "Reviewer_Dvz1", "summary": "This paper proposes Information Bottleneck Distillation (IBD) to improve adversarial robustness from the perspective of information bottleneck principle. Specifically, two distillation strategies are proposed to boost information bottleneck. Different from the existing works, this paper utilizes the predictions of robust models to maximize the mutual information. Also, the authors design an adaptive feature distillation based on the attention mechanism to facilitate the student model to inherit knowledge from the teacher model. The experimental results demonstrate the proposed strategies are effective in improving adversarial robustness.", "questions": "As mentioned in W1 and W2, how is the last step of the derivation of Eq. (11) obtained? And, what is the effect of varying teachers on the proposed methods ?", "limitations": "The derivation details are not very clear.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "S1: This paper is technically sound, and the motivation and formulation of the proposed method are elegant.\n\nS2: Formulating the information bottleneck objective from the perspective of adversarial robustness distillation is novel and well-motivated.\n\nS3: The difference with the existing works is clearly demonstrated and discussed.", "weaknesses": "W1: Some derivation details in this paper are overly simplified and jumpy, making it difficult to understand. For example, how is the last step of the derivation of Eq. (11) obtained?\n\nW2: The proposed methods rely heavily on a robust teacher model, hence the experimental evaluation of what effect of varying teachers on the proposed methods should be conducted. \n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for your valuable feedback! Here is our response to the concerned questions.\n#### **Q1: Some derivation details in this paper are overly simplified and jumpy**\n**A1**:Thank you for your comment and sorry for the confusion. To clear up this, we further provide the detailed derivation of Eq.(11). The Eq. (11) is \n\\begin{equation}\n    \\begin{aligned}\n  \\mathop{\\mathbb{E}}\\limits_{p(x)p(z|x)}  \\left[ \\log \\frac{p(z | x)}{q(z | t)}\\right] = \\mathop{\\mathbb{E}}\\limits_{p(x)}  \\left[ \\int p(z | x) \\log \\frac{p(z | x)}{q(z|t)} d z  \\right] = \n  \\mathop{\\mathbb{E}}\\limits_{p(x)p(z|x)} \\Big[\\mathrm{KL} \\big(p(z | x) || q(z|t) \\big) \\Big].\n    \\end{aligned}\n\\end{equation}\n\nThus, we optimize the $\\mathrm{KL}$ divergence between the feature likelihood $p(z|x)$ and the appropriate feature probability $q(z|t)$. \nIn IBD, we parameterize Gaussian densities $p(z|x)$ and $q(z|t)$ using neural networks, where the mean of $p(z|x)$ and $q(z|t)$ are the intermediate features from $f_s$ and $f_t$, respectively, and the variance is set to an identity matrix.\n\nThe $\\mathrm{KL}$ divergence between two Gaussian distributions $p$ and $q$ can be obtained by\n\\begin{equation}\n\\begin{aligned}\n\\mathrm{KL}(p, q) & =-\\int p(x) \\log q(x) d x+\\int p(x) \\log p(x) d x \\\\\n& =\\frac{1}{2} \\log \\left(2 \\pi \\sigma_2^2\\right)+\\frac{\\sigma_1^2+\\left(\\mu_1-\\mu_2\\right)^2}{2 \\sigma_2^2}-\\frac{1}{2}\\left(1+\\log 2 \\pi \\sigma_1^2\\right) \\\\\n& =\\log \\frac{\\sigma_2}{\\sigma_1}+\\frac{\\sigma_1^2+\\left(\\mu_1-\\mu_2\\right)^2}{2 \\sigma_2^2}-\\frac{1}{2} \n% = \\frac{1}{2c_1} \\left(\\mu_1-\\mu_2\\right)^2 + c_2,\n\\end{aligned}\n\\end{equation}\n\nIn IBD, $\\mu_1$ is $f_t(x)$ and $\\mu_2$ is $f_s(x)$. $\\sigma_1$ and $\\sigma_2$ are identity matrices.\nAs a result, the Eq.(11) can be calculated by:\n\\begin{equation} \n    \\begin{aligned}\n  \\mathop{\\mathbb{E}}\\limits_{p(x,y)p(z|x)}  \\left[ \\log \\frac{p(z | x)}{q(z | t)}\\right] = \\mathop{\\mathbb{E}}\\limits_{p(x)p(z|x)} \\Big[\\mathrm{KL} \\big(p(z | x) || q(z|t) \\big) \\Big]\n   = \\mathop{\\mathbb{E}}\\limits_{p(x)}  \\left[  \\big(f_t(x) - f_s(x)\\big)^2 + \\text{c}  \\right],\n    \\end{aligned}\n\\end{equation}\nwhere $c$ is a constant.\n\nWhen applying Eq.(11) as an objective to optimize the DNNs, a particular challenge is how to choose appropriate intermediate features from models to calculate the loss, since the different intermediate features tend to have different levels of information, especially when the student and teacher models have different architectures. Therefore, we proposed an attention-based feature distillation strategy to achieve this optimization objective.\n\n**In order to avoid confusion about the derivation process, we will give the detailed derivation steps of each formula in the new version.**\n\n#### **Q2: How would the performance of teachers affect that of student models?**\n**A2**: Thank you for your good questions. In our submitted manuscript, we only used one robust teacher network for fair experimental comparison. Following your comments, we conduct an ablation experiment by using different teacher models to verify the impact of the teacher's robustness on the performance of the student model. We conduct this experiment on CIFAR-10 with two student models: ResNet-18 and WideResNet-34-10, and five different teacher models which have different robustness. The results are shown in the Table. We can observe that different robust teacher models have a significant positive benefit on the student model. For the ResNet-18 student model, we find that the robustness of the student does not increase monotonically with that of the teacher. \nAs the teacher model (WideResNet-34-20) becomes more complex, the robustness of the student model decreases, compared to WideResNet-34-10.  This may be due to the large gap in the architecture of the teacher model and the student model. \nThis phenomenon is called **Robust saturation** [1].\nFor the WideResNet-34-10 student model, we found that in most cases, the student’s robustness can surpass that of the teacher model.\nWe think there are two reasons for this, one is that the performance of the teacher model is not very strong.\nThe other is that the teacher model provides robust soft labels to alleviate overfitting and improve performance.\nTherefore, in most cases, it is expected that the student model exceeds the teacher model, but when the teacher model is strong enough, it is not easy for the student model to surpass the teacher model (e.g., WideResNet-76-10).\n\n Teacher   | Natural  | AutoAtt   | Student  | Natural  | AutoAtt    | Student  | Natural   | AutoAtt   |\n ----  | ----  | ----  | ----  | ----  | ----  | ----  | ----  | ----  |\nResnet-18  | 84.09 | 48.71 | Resnet-18  | 83.74 | 50.52 | WRN-34-10  | 84.41 | 53.94 |\nResnet-34  | 85.94 | 50.57 | Resnet-18  | 84.92 | 49.84 | WRN-34-10  | 85.79 | 54.17 |\nWRN-34-10  | 84.92 | 53.08 | Resnet-18  | 83.17 | 52.11 | WRN-34-10  | 84.21 | 55.65 |\nWRN-34-20  | 85.65 | 56.82 | Resnet-18  | 82.82 | 51.64 | WRN-34-10 | 84.73 | 55.71 |\nWRN-76-10  | 88.54 | 64.25 | Resnet-18  | 85.28 | 51.98 | WRN-34-10  | 86.61 | 57.12 |\n\nRef:\n\n[1]  Revisiting adversarial robustness distillation: Robust soft labels make student better. ICCV 2021.\n\n\n"}]

Author rebuttal:
We thank all reviewers for their insightful and constructive comments on our work. During the rebuttal period, we carefully addressed all the comments and suggestions raised by all reviewers. We hope that our response has properly addressed the comments of the reviewers and that its overall contribution, quality and clarity are now significantly improved! Thanks all!

Meta-review: The paper received mixed ratings initially. The reviewers think the idea is technically sound and the results are impressive. However, there are some concerns regarding the details of the method, the setting of the experiments, and some analysis in the empirical study. After the rebuttal, the reviewers were mostly satisfied with the version the authors provided and raised their scores accordingly. AC is happy to see the paper accepted and the authors revise it incorporating the reviewers' feedback.
Decision: Accept (poster)