Indirect Gradient Matching for Adversarial Robust Distillation

Authors: Hongsin Lee, Seungju Cho, Changick Kim
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: Adversarial Robustness, Adversarial Training, Adversarial Distillation

Abstract:
Adversarial training significantly improves adversarial robustness, but superior performance is primarily attained with large models. 
This substantial performance gap for smaller models has spurred active research into adversarial distillation (AD) to mitigate the difference. 
Existing AD methods leverage the teacher’s logits as a guide.
In contrast to these approaches, we aim to transfer another piece of knowledge from the teacher, the input gradient.
In this paper, we propose a distillation module termed Indirect Gradient Distillation Module (IGDM) that indirectly matches the student’s input gradient with that of the teacher.
Experimental results show that IGDM seamlessly integrates with existing AD methods, significantly enhancing their performance.
Particularly, utilizing IGDM on the CIFAR-100 dataset improves the AutoAttack accuracy from 28.06\% to 30.32\% with the ResNet-18 architecture and from 26.18\% to 29.32\% with the MobileNetV2 architecture when integrated into the SOTA method without additional data augmentation.

Decision: accept (poster)
Reviewer scores: 8, 8, 6, 5

Reviews and discussion:
<thread>
creation date:
1730197218454

thread_type:
official_review

<thread_object>
creator: reviewer_pxd3

<content>
summary:
The paper presents an Indirect Gradient Distillation Module (IGDM) for adversarial training via adversarial distillation methods. 
It claims to match the input space gradient between teacher and student models with knowledge distillation. The main claim is "indirect" gradient matching/alignment compared to direct gradient alignment, which is available in the literature. Central to the paper is equation 2 (first-order Taylor expansion of adversarially trained models) and equation 8, which is the formulation of IGMD. The paper performs an exhaustive list of experiments. However, there is no indication of making code available for reproducibility is indicated in the paper.

strengths:
The main strength of the paper is the extensive set of experiments on Indirect Gradient Distillation Modules (IGDM) for adversarial training via adversarial distillation methods. The IGDM is use used as an additive loss for adversarial knowledge distillation (Equation 9), which is claimed to be the first Indirect gradient matching compared to direct gradient matching.

weaknesses:
The paper does not make it clear how this way gradient matching is "indirect." From Figure 1 and Figure 2 and the related explanation, it is not clear why this is "indirect" gradient distillation.  There is no comparative picture presented to clarify the comparison/contrast between  Indirect Gradient  and Direct Gradient distillation. 

Except for Table 7, It is not explicitly mentioned or clear that they run the other (SOTA) algorithms themselves or that the results were taken from the reported results. If experiments were re-run, other hyperparameter setting descriptions were not given or not referred to which hyperparameter setting were used, e.g., home many epoch os training.

There are some inconsistencies in making results bold for best results in some tables and not in some tables.

questions:
Figure 2a says that the "remainder proportion" of the adversarial robust teachers is shown in Table 1. However, One would wonder, comparing Figure 2a and Table 1, how to make sense of these two different metrics. Figure 2a y-axis is "proportion," Table 1 has clean accuracy and attacked accuracy values. How can one calculate "proportion" from Table 1 to make sense of Figure 2a?

It has not been demonstrated how preparation values 0.012 and 0.016 have arrived. It is not clear if the proposition nose value is the accuracy value. From the equation, it appeared to be a noise term, but making reference to Table 1 makes one feel it is an accuracy term.

Figure 2b also under explains as to how one can relate Equation 2 and Figure 2b. 

The paper claims to do an "input gradient" matching Figure 1 and Line 151. However, the gradient matching is done via the discrepancy between student and teacher models model outputs. It is unclear how this method differs from other methods that do gradient distillation.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730631110793

thread_type:
official_review

<thread_object>
creator: reviewer_yghv

<content>
summary:
This paper proposes a new method named Indirect Gradient Distillation Module (IGDM) for adversarial distillation. Different from the traditional adversarial distillation methods that mainly focus on distilling the logits of the teacher model, this method emphasizes distilling the gradient information of the teacher model. By taking advantage of the local linear characteristics of the adversarially trained model, these gradients are obtained indirectly, thereby significantly enhancing robustness.

strengths:
1. The author obtains the gradients indirectly by taking advantage of the local linear characteristics of the adversarially trained model, thereby significantly enhancing robustness.
2. The modular design of IGDM enables it to be easily integrated with existing adversarial distillation methods.
3. Through a large number of experimental results, the author has verified that IGDM can successfully enhance the robustness of the existing adversarial distillation methods.

weaknesses:
The loss function of the Indirect Gradient Distillation Module (IGDM) proposed in this paper is derived from the first-order Taylor function expansion, which is similar to the situation of making the training loss become low-curvature [in d - f]. In fact, the research works in [e, f] also used similar techniques, but they mainly studied the problems in traditional adversarial training. If the teacher network in this paper is changed to only input natural images, the proposed loss in the paper may degenerate into an evolutionary target of the aforementioned works. Therefore, the author needs to conduct a comparative analysis between their method and the existing works that are also based on the first-order Taylor function expansion, and analyze the differences. Moreover, what will be the result if the regularization loss of the existing works is added to the adversarial distillation target?

The authors utilize the internal loss to generate adversarial perturbations. It would be better to elaborate on its formulaic representation in the main paper. Is the cross-entropy used directly? How much impact do different internal losses have on the results? What would be the effect if the adversarial perturbations are generated using Equation 9?

Some of more recent works, that are about the adversarial distillation, are missing, such as [a-c]. 

a. Adversarially Robust Distillation by Reducing the Student-Teacher Variance Gap. ECCV 2024

b. PeerAiD: Improving Adversarial Distillation from a Specialized Peer Tutor. CVPR 2024

c. Improving Adversarial Robustness via Information Bottleneck Distillation. NeurIPS 2023

d. Efficient Training of Low-Curvature Neural Networks. NeurIPS 2022.

e. Adversarial Robustness through Local Linearization. NeurIPS 2019.

f. Relating Adversarially Robust Generalization to Flat Minima. ICCV 2021.

questions:
Please check the details in weaknesses.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730636131836

thread_type:
official_review

<thread_object>
creator: reviewer_avuv

<content>
summary:
The paper focuses on improving the adversarial robustness of DNNs through adversarial distillation. Specifically, it addresses the challenge that smaller models, which are preferred for their computational efficiency, lag behind larger models in terms of robustness against adversarial attacks. The authors propose the Indirect Gradient Distillation Module (IGDM), which aims to transfer the input gradient knowledge from a robust teacher model to a student model, indirectly matching the student’s input gradient with the teacher's.  The experimental results demonstrate the effectiveness of the proposed approach in significantly improving adversarial robustness.



Based on the detailed response by the authors, I decided to improve my rating!

strengths:
1. The authors propose a novel distillation module called the Indirect Gradient Distillation Module (IGDM) and provide a theoretical foundation for why gradient matching through output differences works, leveraging the local linearity of adversarially trained models. But, I have some doubts about the theoretical assumptions here. The fragility of neural networks is attributed to the linear properties of neural networks[1], and the paper assumes this local linear property to solve the gradient, which is contrary to the conclusions of previous related research. So, does this method really simulate the gradient of the network?

2. Extensive experiments across different datasets, student models, and teacher models validate the effectiveness of IGDM in improving robustness against various attack scenarios.

[1] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. ICLR, 2015.

weaknesses:
1.  Although the paper did a lot of experiments, I think it is not fair enough. For example, the teacher model used in the paper is usually better than the teacher models of other methods. So if other methods also use the same teacher model, can they also achieve good robustness?

2. Line 160 of the paper mentions that using gradients directly is difficult, which is important for the motivation of the paper, so it needs to be reflected in the main context rather than being placed in the Appendix.

questions:
1. I am confused about Figure 1(a) in the paper. In the distillation architecture, the teacher model is already trained, while the student model is not. In the feature space, the manifolds of the models are different. Even if the directions of the gradients are the same, the manifold spaces are inconsistent, and the paths they take should also be different. Therefore, the adversarial samples of the teacher model and the student model cannot be consistent. One way to prove this is to use the adversarial samples generated by the teacher model and the student model to attack another model to see if the attack effects are consistent.

2  In Figure 2, in adversarial training and adversarial distillation, why is it that in the early stages of training, when the student model should not be robust yet, why does the remainder proportion of the model not increase?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730712316819

thread_type:
official_review

<thread_object>
creator: reviewer_ecu4

<content>
summary:
This paper aims to improve the adversarial robustness of lightweight or small models using adversarial distillation. Unlike directly using the teacher's logits as a guide, the authors focus on distilling the input gradients of the teacher model to achieve point-wise alignment between the teacher and student. The proposed IGDM can integrate with other AD methods and has demonstrated consistent performance improvements across different datasets.

strengths:
1. Aligning the input gradients of the teacher and student is an insightful and interesting approach.

2. IGDM is a simple and effective method that can be easily applied as a regularization term to other AD methods, achieving consistent performance improvements.

3. Comprehensive experimental results and ablation studies demonstrate the effectiveness of IGDM.

4. The paper is well-written and easy to follow.

weaknesses:
Overall, this paper is logically coherent and well-argued. The effectiveness of IGDM is based on the assumption of the locally linear property of adversarial robust models, and preliminary experiments in Section 3.1 support this assumption. However, the data and models used in the experiments are relatively simple. Validating the effectiveness of IGDM on more general models, such as ViT or CLIP, and on more complex tasks, such as detection and segmentation, could provide more universal insights for future research.

questions:
See Weaknesses
</content>
</thread_object>

</thread>
<thread>
creation date:
1733111926885

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
Global Response

comment:
Dear Reviewers,

We sincerely thank you for your thoughtful questions and constructive feedback. Your insights have been instrumental in improving the quality of our work. We have carefully addressed all the concerns raised in our rebuttal and incorporated revisions in the manuscript.
First, we deeply appreciate your recognition of the following strengths in our work:

- The extensive experiments demonstrating the effectiveness of IGDM across diverse settings.

- Our method's modular design allows for seamless integration into existing adversarial distillation (AD) frameworks.

Additionally, we are grateful for the opportunity to clarify and address several key concerns raised in the reviews:

1. **Fairness of Experimental Settings** (Reviewer **avUv**):  
   One concern was that our experiments employed more advanced and robust teacher models compared to prior AD methods. To address this, we showed that our experiments were conducted with diverse teacher models, including some used in prior works. Furthermore, we provided a detailed analysis of the robust saturation phenomenon proposed in RSLAD, offering additional experimental insights that resolve this concern. As a result, we successfully addressed the concern raised by reviewer avUv. The reviewer also responded with gratitude, acknowledging that their concern was resolved.

2. **Comparison with Low-Curvature Losses in AT** (Reviewer **yGhV**):  
   Another concern was the comparison between IGDM and low-curvature-related losses in prior adversarial training methods. Our additional experiments during the rebuttal period showed that incorporating low-curvature losses into existing AD methods often degraded robust performance (in reply to yGhV).  Furthermore, we also clarified that IGDM focuses on distilling gradient information from a well-trained teacher rather than merely reducing curvature. This distinction provides a clearer understanding of the complementary role of IGDM.  
  

3. **"Indirect" Gradient Matching Explanation** (Reviewer **Pxd3**, Reviewer **avUv**):  
 We addressed concerns regarding the indirect nature of gradient matching by providing theoretical insights through Taylor expansion, illustrating how the linear properties enable logit differences to effectively encode gradient information. Furthermore, we empirically demonstrated that logit differences indeed encapsulate gradient information by measuring gradient alignment using metrics, GC and GD, directly computed via `autograd`.



We have also improved the overall clarity of the manuscript and corrected all identified typos to ensure the paper is as clear and polished as possible. All modifications are highlighted in BLUE in the revised manuscript.
We sincerely hope that these revisions address the reviewers' concerns and enhance the overall quality of the paper. Thank you once again for your valuable feedback and for engaging deeply with our work.

Best regards,

The Authors
</content>
</thread_object>

</thread>


Metareview:
metareview:
This paper investigates adversarial distillation, focusing on small student models. Compared to vanilla distillation strategies, a key enhancement here is to indirectly match the input gradients between a robust teacher model and a student model. The empirical results demonstrate consistent improvements over baseline methods.

Overall, the reviewers found the paper well-written and easy to follow, and they appreciated its novelty and effectiveness. But meanwhile, several major concerns are raised, including 1) the term "Indirect Gradient Matching" (especially regarding the word "indirect") is somewhat unclear and confusing; 2) missing discussions about prior related works that enforce low curvature; and 3) some experimental setups, as well as tables and figures, require further explanation and clarification.

During the rebuttal and the discussion stage, the authors actively provided additional experiments and clarifications to address these concerns. As a result, three reviewers positively rate the quality of this paper. Reviewer Pxd3 remained slightly negative about this submission, but the AC found no concerning points remaining from their feedback. Therefore, the final decision is acceptance.

The authors must integrate the additional experiments, clarifications, and discussions from the rebuttal into the camera-ready version and correct any typos or mistakes pointed out by the reviewers.