Enhancing Adversarial Robustness Through Robust Information Quantities

Authors: EN-HUI YANG, Renhao Tan
Primary area: other topics in machine learning (i.e., none of the above)
Keywords: adversarial robustness, adversarial training

Abstract:
It is known that deep neural networks (DNNs) are vulnerable to imperceptible adversarial attacks, and this fact raises concerns about their safety and reliability in real-world applications. In this paper, we aim to boost the robustness of a DNN against white-box adversarial attacks by defining three new information quantities---robust conditional mutual information (CMI), robust separation, and robust normalized CMI (NCMI)---which can serve as robust performance metrics for the DNN. We then utilize these concepts to introduce a novel training method that constrains the robust CMI and increases the robust separation simultaneously. Our experimental results demonstrate that our method consistently enhances model robustness against C\&W and AutoAttack on CIFAR and Tiny-ImageNet datasets with and without additional synthetic data. Specifically, it is shown that our approach improves the robust accuracy of a DNN by up to 2.66\% on CIFAR datasets and 3.49\% on Tiny-ImageNet in the case of PGD attack and 1.70\% on CIFAR datasets and 1.63\% on Tiny-ImageNet in the case of AutoAttack, in comparison with the state-of-the-art training methods in the literature.

Decision: withdrawn
Reviewer scores: 6, 5, 6, 6

Reviews and discussion:
<thread>
creation date:
1730174082320

thread_type:
official_review

<thread_object>
creator: reviewer_stkw

<content>
summary:
This paper introduces several new quantities to improve the model robustness, which can also serve as measures of robust performance. The paper provides theoretical proofs for the proposed theorems and uses experiments across multiple datasets to demonstrate the effectiveness for the proposed method against various types of attacks.

strengths:
1. This paper is well-written and easy to follow.
2. The authors provide detailed proofs for the theorems proposed in this paper.
3. Experiments are conducted on multiple datasets, and the results outperform baseline methods in most scenarios.

weaknesses:
1. The primary concern with this paper is its novelty. It appears to apply conditional mutual information from paper [1] to the field of model robustness, so a clearer explanation of the paper's novel contributions would be beneficial.
2. The paper provides the model robustness results against white-box adversarial attacks. It would strengthen the evaluation if the black-box attacks also be included as a metric to assess the robustness of a model.
3. Appendix F presents the adversarial results against different perturbation budget, it would be better if TRADES and MART are also included as baseline models in this figure.
4. How are the default settings for hyper-parameters $\alpha$ and $\beta$ determined?

[1] En-Hui Yang, Shayan Mohajer Hamidi, Linfeng Ye, Renhao Tan, and Beverly Yang. Conditional mutual information constrained deep learning for classification. arXiv preprint arXiv:2309.09123, 2023.

questions:
Please refer to the weaknesses section. Additionally, would it be possible to move the visualization and pseudo-code from the appendix to the main text.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730308575227

thread_type:
official_review

<thread_object>
creator: reviewer_uhbr

<content>
summary:
This paper uses CMI and normalized CMI (NCMI) to improve an established defense (adversarial training) against adversarial attacks. The authors take CMI, NCMI and robust separation as three measurements to quantify the robustness.
Extensive experiments are conducted to verify the effectiveness of the proposed method.

strengths:
- This paper provides both theoretical and experimental results to support their statements.
- It is easy to follow the presentation of the paper.
- Incorporating CMI and NCMI into adversarial training.

weaknesses:
- The experimental improvement does not seem significant in Table 1 and 2. In a few cases, it even decreases more on clean accuracy compared to the increase in robust accuracy.
- This paper does not include enough baselines, only TRADES and MART are included. There are many papers that use MI to improve adversarial robustness, such as HBaR[1], VIB[2], and IB-RAR[3]. 
- Need more concrete ablation study, such as the different values of $\alpha$ and $\beta$ in equation(40).

[1] Revisiting Hilbert-Schmidt Information Bottleneck for Adversarial Robustness

[2] Deep variational information bottleneck

[3] IB-RAR: Information Bottleneck as Regularizer for Adversarial Robustness

questions:
- How to choose the $\lambda$ value in equation(33)? Or how to choose the $\alpha$ and $\beta$ values in equation(40)?

- Why is the code for fixing random seeds in the GitHub page commented out? Given that the improvement is minor in Table 1 and 2, I would expect to see the variance or error bars (maybe only a part of the experiments due to high computation costs) to see if there are overlaps among error bars.

- What is the difference between the proposed CMI, NCMI, and CMI, NCMI in [4]?

I will increase my rating if my concerns are properly addressed.


[4] Conditional mutual information constrained deep learning for classification.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730473155227

thread_type:
official_review

<thread_object>
creator: reviewer_nvqt

<content>
summary:
Inspired by the information geometry analyzed in the previous work, this paper proposes three advanced metrics which are robust CMI (Conditional Mutual Information, CMI), robust separation and robust NCMI (Normalized CMI, NCMI), where they can be incorporated into adversarial training methods for further enhancing the model’s robustness.

strengths:
1. The mathematical analysis is adequate for enhancing the reliability. Detailed theoretical introductions in the paper and the supplementary materials demonstrate the feasibility of information theory in the adversarial robustness.

2. The consideration of the perturbation in the worst case for learning general robust features makes a rational extension for these metrics.

weaknesses:
1. The Introduction lacks the summary about the main problem mentioned in the third paragraph of this section. Authors state that data which are near the decision boundary are in general more susceptible, and then intrdouce the definition of proposed metrics. However, how does the proposed defense solve this problem? Providing additional analyses about it may be better. 

2. The evaluations with and without synthetic data are somewhat confusing in terms of the used model’s capacity. In Table 2, why the smaller model WRN-28-10 was used for the larger dataset containing synthetic data instead of using the larger WRN-34-10? Please provide explanations for such an inconsistency.

3. It seems that ablation studies for hyper-parameters are not shown. Adding comprehensive ablation studies may be better for verifying the effectiveness of each module. Additionally, the authors can ablate the individual components of the proposed method (e.g. robust CMI vs robust separation) to demonstrate the contribution of each.

4. Cross-norm evaluations may be more convincing for the generalization ability of the proposed method. There are various evaluations about the robustness under L∞-norm, while the L2-norm attacks also deserve to be evaluated. The authors can include evaluations against specific L2-norm attacks (e.g. PGD-L2, C&W-L2) in their main results tables, in addition to the existing L$_\infty$-norm evaluations.

questions:
While authors evaluate the robustness of the checkpoint with the highest validation accuracy, I wonder if evaluations from the last checkpoint can also be presented here. Besides, the authors can include a comparison of robustness results between the checkpoint with highest validation accuracy and the last checkpoint. This comparison could reflect the potential overfitting or the stability of the robustness gains over the course of training.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730779003617

thread_type:
official_review

<thread_object>
creator: reviewer_dksg

<content>
summary:
The paper develops a new regularizer for adversarial training (AT) by extending the work of Yang et al. (2023) and introduces three new information-based metrics: robust conditional mutual information (CMI), robust separation, and robust normalized CMI (NCMI). The authors theoretically and empirically demonstrate that adversarial robustness is inversely proportional to adversarial NCMI. Based on this insight, they design an objective function that combines the AT loss with an NCMI-based regularization term. To optimize this objective, they propose a relaxed alternating algorithm.

strengths:
- The paper is technically sound, with the objective function being theoretically justified and proven.
- It shows improvement to white-box attacks.
- The paper is well-written and easy to follow.
- Experiments show improvement across the board.

weaknesses:
- While the improvement in results is consistent, it is often quite small. For example, the best AA accuracy for CIFAR-10 with WRN is improved by only about 0.25%.
- Given the iterative nature of the algorithm, it would be useful to know the time complexity of training relative to baseline methods.

questions:
1. How does the training time compare to, say, TRADES?
2. Besides training time, are there other limitations or weaknesses of the method? For instance, how does it handle class imbalance?
3. Is the drop in natural accuracy expected (theoretically)?

Additional questions (not directly related to the paper but relevant to adversarial robustness):

4. Adversarial training (AT) is often limited to very small images, and the white-box accuracy is often too low for reliable deployment. Do the authors have any ideas on how to scale AT effectively?

5. Methods based on stable diffusion have shown significantly improved performance in adversarial robustness. Could the authors comment on how their approach compares to these methods, and whether diffusion-based techniques might complement or enhance their framework?
</content>
</thread_object>

</thread>


Metareview: