Title: NEO-KD: Knowledge-Distillation-Based Adversarial Training for Robust Multi-Exit Neural Networks
Venue: NeurIPS 2023
Accepted: yes
Keywords: Multi-exit Neural Network

Adversarial Training

Knowledge Distillation

Adversarial Transferability
Abstract: While multi-exit neural networks are regarded as a promising solution for making efficient inference via early exits, combating adversarial attacks remains a challenging problem. In multi-exit networks, due to the high dependency among different submodels, an adversarial example targeting a specific exit not only degrades the performance of the target exit but also reduces the performance of all other exits concurrently. This makes multi-exit networks highly vulnerable to simple adversarial attacks. In this paper, we propose NEO-KD, a knowledge-distillation-based adversarial training strategy that tackles this fundamental challenge based on two key contributions. NEO-KD first resorts to neighbor knowledge distillation to guide the output of the adversarial examples to tend to the ensemble outputs of neighbor exits of clean data. NEO-KD also employs exit-wise orthogonal knowledge distillation for reducing adversarial transferability across different submodels. The result is a significantly improved robustness against adversarial attacks. Experimental results on various datasets/models show that our method achieves the best adversarial accuracy with reduced computation budgets, compared to the baselines relying on existing adversarial training or knowledge distillation techniques for multi-exit networks.

NEO-KD: Knowledge-Distillation-Based Adversarial Training for Robust Multi-Exit Neural Networks

Abstract

While multi-exit neural networks are regarded as a promising solution for making efficient inference via early exits, combating adversarial attacks remains a challenging problem. In multi-exit networks, due to the high dependency among different submodels, an adversarial example targeting a specific exit not only degrades the performance of the target exit but also reduces the performance of all other exits concurrently. This makes multi-exit networks highly vulnerable to simple adversarial attacks. In this paper, we propose NEO-KD, a knowledge-distillation-based adversarial training strategy that tackles this fundamental challenge based on two key contributions. NEO-KD first resorts to neighbor knowledge distillation to guide the output of the adversarial examples to tend to the ensemble outputs of neighbor exits of clean data. NEO-KD also employs exit-wise orthogonal knowledge distillation for reducing adversarial transferability across different submodels. The result is a significantly improved robustness against adversarial attacks. Experimental results on various datasets/models show that our method achieves the best adversarial accuracy with reduced computation budgets, compared to the baselines relying on existing adversarial training or knowledge distillation techniques for multi-exit networks.

1 Introduction

Multi-exit neural networks are receiving significant attention [9, 13, 26, 27, 28, 32] for their ability to make dynamic predictions in resource-constrained applications. Instead of making predictions at the final output of the full model, a faster prediction can be made at an earlier exit depending on the current time budget or computing budget. In this sense, a multi-exit network can be viewed as an architecture having multiple submodels, where each submodel consists of parameters from the input of the model to the output of a specific exit. These submodels are highly correlated as they share some model parameters. It is also well-known that the performance of all submodels can be improved by distilling the knowledge of the last exit to other exits, i.e., via self-distillation [15, 20, 24, 27]. There have also been efforts to address the adversarial attack issues in the context of multi-exit networks [3, 12].

Providing robustness against adversarial attacks is especially challenging in multi-exit networks: since different submodels have high correlations by sharing parameters, an adversarial example targeting a specific exit can significantly degrade the performance of other submodels. In other words, an adversarial example can have strong adversarial transferability across different submodels, making the model highly vulnerable to simple adversarial attacks (e.g., an adversarial attack targeting a single exit).

Motivation. Only a few prior works have focused on adversarial defense strategies for multi-exit networks [3, 12]. The authors of [12] focused on generating adversarial examples tailored to multiexit networks (e.g., generate samples via max-average attack), and trained the model to minimize the sum of clean and adversarial losses of all exits. Given the adversarial example constructed in [12], the authors of [3] proposed a regularization term to reduce the weights of the classifier at each exit during training. However, existing adversarial defense strategies [3, 12] do not directly handle the high correlations among different submodels, resulting in high adversarial transferability and limited robustness in multi-exit networks. To tackle this difficulty, we take a knowledge-distillation-based approach in a fashion orthogonal to prior works [3, 12]. Some previous studies [8, 23, 33, 34] have shown that knowledge distillation can be utilized for improving the robustness of the model in conventional single-exit networks. However, although there are extensive existing works on self-distillation for training multi-exit networks using clean data [15, 20, 24, 27], it is currently unknown how distillation techniques should be utilized for adversarial training of multi-exit networks. Moreover, when the existing distillation-based schemes are applied to multi-exit networks, the dependencies among submodels become higher since the same output (e.g., the knowledge of the last exit) is distilled to all sub-models. Motivated by these limitations, we pose the following questions: How can we take advantage of knowledge-distillation to improve adversarial robustness of multi-exit networks? At the same time, how can we reduce adversarial transferability across different submodels in multi-exit networks?

Main contributions. To handle these questions, we propose NEO-KD, a knowledge-distillationbased adversarial training strategy highly tailored to robust multi-exit neural networks. Our solution is two-pronged: neighbor knowledge distillation and exit-wise orthogonal knowledge distillation.

Given a specific exit, the first part of our solution, neighbor knowledge distillation (NKD), distills the ensembled prediction of neighbor exits of clean data to the prediction of the adversarial example at the corresponding exit, as shown in Figure 1a. This method guides the output of adversarial examples to follow the outputs of clean data, improving robustness against adversarial attacks. By ensembling the neighbor predictions of clean data before distillation, NKD provides higher quality features to the corresponding exits compared to the scheme distilling with only one exit in the same position.

The second focus of our solution, exit-wise orthogonal knowledge distillation (EOKD), mainly aims at reducing adversarial transferability across different submodels. This part is another unique contribution of our work compared to existing methods on robust multi-exit networks [3, 12] (that suffer from high adversarial transferability) or self-distillation-based multi-exit networks [15, 20, 24, 27] (that further increase adversarial transferability). In our EOKD, the output of clean data at the i -th exit is distilled to the output of the adversarial sample at the i -th exit, in an exit-wise manner. During this exit-wise distillation process, we encourage the non-ground-truth predictions of individual exits to be mutually orthogonal, by providing orthogonal soft labels to each exit as described in Figure 1b. By weakening the dependencies among different exit outputs, EOKD reduces the adversarial transferability across all submodels in the network, which leads to an improved robustness against adversarial attacks.

The NKD and EOKD components of our architectural solution work together to reduce adversarial transferability across different submodels in the network while correctly guiding the predictions of the adversarial examples at each exit. Experimental results on various datasets show that the proposed strategy achieves the best adversarial accuracy with reduced computation budgets, compared to existing adversarial training methods for multi-exit networks. Our solution is a plug-and-play method, which can be used in conjunction with existing training strategies tailored to multi-exit networks.

2 Related Works

Knowledge distillation for multi-exit networks. Multi-exit neural networks [9, 13, 26, 27, 28, 32] aim at making efficient inference via early exits in resource-constrained applications. In the multi-exit network literature, it is well-known that distilling the knowledge of the last exit to others significantly improves the overall performance on clean data without an external teacher network, i.e., via selfdistillation [15, 20, 24, 27]. However, it is currently unclear how adversarial training can benefit from self-distillation in multi-exit networks. One challenge is that simply applying existing self-distillation techniques increases adversarial transferability across different submodels, since the same knowledge

from the last exit is distilled to all other exits, increasing dependency among different submodels in the network. Compared to the existing ideas, our contribution is to develop a self-distillation strategy that does not increase the dependency of submodels as much; this helps reduce adversarial transferability of the multi-exit network for better robustness.

Improving adversarial robustness. Most existing defense methods [6, 7, 31] have mainly focused on creating new adversarial training losses tailored to single-exit networks. Several other works have utilized the concept of knowledge distillation [8, 23, 33, 34] showing that distilling the knowledge of the teacher network can improve robustness of the student network. Especially in [8], given a teacher network, it is shown that robustness of the teacher network can be distilled to the student network during adversarial training. Compared to these works, our approach can be viewed as a new self-distillation strategy for multi-exit networks where teacher/student models are trained together. More importantly, adversarial transferability across different submodels has not been an issue in previous works as the focus there has been on the single-exit network. In contrast, in our multi-exit setup, all submodels sharing some model parameters require extra robustness against adversarial attacks; this motivates us to propose exit-wise orthogonal knowledge distillation, to reduce adversarial transferability among different submodels.

Some prior works [19, 22, 29, 30] aim at improving adversarial robustness of the ensemble model, by reducing adversarial transferability across individual models. Specifically, the adaptive diversitypromoting regularizer proposed in [22] regularizes the non-maximal predictions of individual models to be mutually orthogonal, and the maximal term is used to compute the loss as usual. While the previous work focuses on reducing the transferability among different models having independent parameters, in a multi-exit network setup, the problem becomes more challenging in that all submodels have some shared parameters, making the models to be highly correlated. To handle this issue, we specifically take advantage of knowledge distillation in an exit-wise manner, which can further reduce the dependency among different submodels in the multi-exit network.

Adversarial training for multi-exit networks. When focused on multi-exit networks, only a few prior works considered the adversarial attack issue in the literature [3, 10, 11, 12]. The authors of [10, 11] focused on generating slowdown attacks in multi-exit networks rather than defense strategies. In [12], the authors proposed an adversarial training strategy by generating adversarial examples targeting a specific exit (single attack) or multiple exits (average attack and max-average attack). However, (i) [12] does not take advantage of knowledge distillation during training and (ii) [12] does not directly handle the high correlations among different submodels, which can result in high adversarial transferability. Our solution overcomes these limitations by reducing adversarial transferability while correctly guiding the predictions of adversarial examples at each exit, via self knowledge distillation.

3 Proposed NEO-KD Algorithm

Consider a multi-exit network with L exits, which is composed of L blocks { φ i } L i =1 and L classifiers { w i } L i =1 . Given the input data x , the output of the i -th exit is denoted as f θ i ( x ) , which is parameterized by the i -th submodel θ i = [ φ 1 , . . . , φ i , w i ] that consists of i blocks and one classifier. Note that all L submodels produce different predictions [ f θ 1 ( x ) , . . . , f θ L ( x ) ]. Here, since each submodel shares several blocks with other submodels, the predictions of any two submodels are highly correlated.

3.1 Problem Setup: Adversarial Training in Multi-Exit Networks

The first step for adversarial training is to generate adversarial examples. Given L different submodels { θ i } L i =1 , clean data x , and the corresponding label y , the adversarial example x adv can be generated based on single attack, max-average attack or average attack, following the process of [12]. More specifically, we have

Clean

data

Blockl

Block2

Block3

Block4

Block5

→Exit 5

Clean

data

Block1

Block2

Block3

→Exit3

0.6

0.2

1°0 1'°0

Classifier

Classifier

Classifier

Classifier

Classifier

Classifier

Class 1

4

Exit 1

Exit 2

Exit 3

Exit 4

0.4

0.3

0.2

0.1

Exit 1

Exit 2

0.5

0.3

0.1 0.1

Class 1

Class 1

NKD Loss

Exit 1

NKD Loss

Exit 2

NKD Loss

Exit 3

NKD Loss

Exit 4

NKD Loss

Adv

data

Block1

Block2

Block?

→Exit 3

EOKDLoss

EOKD

中

EOKD

Classifier

Classifier

EOKD

0.6

Classifier

Classifier

Classifier

Classifier

0.4

Exit 1

Exit 2

0.5

Adv

data

Block1

Block2

Block3

Block4

Block5

Exit 5

1

0.3

0.00.0

EOKD Loss

EOKDLoss

Class 1

0.0

0.1

3

0.0

Class 1  2  34

0'0 0'0

4

Figure 1: NEO-KD consists of two parts that together improve the adversarial robustness: NKD and EOKD. (a) NKD guides the output of the adversarial data to mimic the ensemble outputs of neighbor exits of clean data. (b) EOKD reduces adversarial transferability of the network by distilling orthogonal knowledge of the clean data to adversarial data for the non-ground-truth predictions, in an exit-wise manner. Although omitted in this figure, EOKD normalizes the likelihood before distilling the soft labels. The overall process operates in a single model, although we consider two cases depending on the input (clean or adversarial example) for a clear presentation.

which correspond to the adversarial example generated by single attack targeting exit i , max-average attack, and average attack, respectively. glyph[epsilon1] denotes the perturbation degree. In the single attack of (1), the adversarial example x adv i is generated to maximize the cross-entropy loss glyph[lscript] ( · , · ) of the target exit utilizing an attacker algorithm (e.g., PGD [21]). In the max-average attack of (2), among the adversarial examples generated by the single attack for all exits i = 1 , 2 , . . . , L , the sample that maximizes the average loss of all exits is selected. Finally, the average attack in (3) directly generates an adversarial sample that maximizes the average loss of all exits. Based on the generated x adv , a typical strategy is to update the model considering both the clean and adversarial losses of all exits as follows:

where N is the number of samples in the training set and x adv j is the adversarial example corresponding to clean sample x j generated by one of the attacks described above. However, the loss in (4) does not directly consider the correlation among submodels, which can potentially increase adversarial transferability of the multi-exit network.

3.2 Algorithm Description

To tackle the limitations of prior works [3, 12], we propose neighbor exit-wise orthogonal knowledge distillation (NEO-KD), a self-distillation strategy tailored to robust multi-exit networks. To gain insights, we divide our solution into two distinct components with different roles - neighbor knowledge distillation and exit-wise orthogonal knowledge distillation - and first describe each component separately, and then put together into the overall NEO-KD method. A high-level description of our approach is given in Figure 1.

Neighbor knowledge distillation (NKD). The first component of our solution, NKD, guides the output feature of adversarial data at each exit to mimic the output feature of clean data. Specifically, the proposed NKD loss of the j -th train sample at the i -th exit is written as follows:

which can be visualized with the colored arrows as in Figure 1a. Different from previous selfknowledge distillation methods, for each exit i , NKD generates a teacher prediction by ensembling (averaging) the neighbor predictions (i.e., from exit i -1 and exit i +1 ) of clean data and distills it to each prediction of adversarial examples.

Compared to other distillation strategies, NKD takes advantage of only these neighbors during distillation, which has the following key advantages for improving adversarial robustness. First,

by ensembling the neighbor predictions of clean data before distillation, NKD provides a higher quality feature of the original data to the corresponding exit; compared to the naive baseline that is distilled with only one exit in the same position (without ensembling), NKD achieves better adversarial accuracy, where the results are provided in Table 7. Secondly, by considering only the neighbors during ensembling, we can distill different teacher predictions to each exit. Different teacher predictions of NKD also play a role of reducing adversarial transferability compared to the strategies that distill the same prediction (e.g., the last exit) to all exit; ensembling other exits (beyond the neighbors) increases the dependencies among submodels, resulting in higher adversarial transferability. The corresponding results are also shown via experiments in Section 4.3.

However, a multi-exit network trained with only NKD loss still has a significant room for mitigating adversarial transferability further. In the following, we describe the second part of our solution that solely focuses on reducing adversarial transferability of multi-exit networks.

Exit-wise orthogonal knowledge distillation (EOKD). EOKD provides orthogonal soft labels to each exit for the non-ground-truth predictions, in an exit-wise manner. As can be seen from the red arrows in Figure 1b, the output of clean data at the i -th exit is distilled to the output of adversarial example at the i -th exit. During this exit-wise distillation process, some predictions are discarded to encourage the non-ground-truth predictions of individual exits to be mutually orthogonal. We randomly allocate the classes of non-ground-truth predictions to each exit for every epoch, which prevents the classifier to be biased compared to the fixed allocation strategy. The proposed EOKD loss of the j -th sample at the i -th exit is defined as follows:

Here, O ( · ) is the orthogonal labeling operation to make the non-ground-truth predictions to be orthogonal across all exits. For each exit, O ( · ) randomly selects glyph[floorleft] ( C -1) /L glyph[floorright] labels among a total of C classes so that the selected labels are non-overlapping across different exits (except for the ground-truth label), as in Figure 1b. Lastly, the probabilities of selected labels are normalized to sum to one. To gain clearer insights, consider a toy example with a 3-exit network (i.e., L = 3 ) focusing on a 4 -way classification task (i.e., C = 4 ). Let [ p i 1 , p i 2 , p i 3 , p i 4 ] be the softmax output of the clean sample at the i -th exit, for i = 1 , 2 , 3 . If class 1 is the ground-truth, the orthogonal labeling operation O ( · ) jointly produces the following results from each exit: [ˆ p 1 1 , ˆ p 1 2 , 0 , 0] from exit 1, [ˆ p 2 1 , 0 , ˆ p 2 3 , 0] from exit 2, [ˆ p 3 1 , 0 , 0 , ˆ p 3 4 ] from exit 3, where ˆ p indicates the normalized probability of p so that the values in each vector sum to one.

Based on Eq. (6), the output of the orthogonal label operation O ( f θ i ( x j )) for the clean data x j is distilled to f θ i ( x adv j ) which is the prediction of the adversarial example of the j -th sample at the i -th exit. This encourages the model to self-distill orthogonally distinct knowledge in an exit-wise manner while keeping the essential knowledge of the ground-truth class. By taking this exit-wise orthogonal distillation approach, EOKD reduces the dependency among different submodels, reducing the adversarial transferability of the network.

Overall NEO-KD loss. Finally, considering the proposed loss functions in Eq. (5), (6) and the original adversarial training loss, the overall objective function of our scheme is written as follows:

where α, β control the weights for each component and γ i is the knowledge distillation weight for each exit i . Since later exits have lower knowledge distillation loss than the earlier exits, we impose a slightly higher γ i for the later exits than γ i of the earlier exits. More details regarding hyperparameters are described in Appendix.

By introducing two unique components - NKD and EOKD - the overall NEO-KD loss function in Eq. (7) reduces adversarial transferability in the multi-exit network while correctly guiding the output of the adversarial examples in each exit, significantly improving the adversarial robustness of multi-exit networks, as we will see in the next section.

4 Experiments

In this section, we evaluate our method on five datasets commonly adopted in multi-exit networks: MNIST [18], CIFAR-10, CIFAR-100 [16], Tiny-ImageNet [17], and ImageNet [25]. For MNIST, we

(a) Max-average attack

(b) Average attack

(a) Max-average attack

(b) Average attack

use SmallCNN [12] with 3 exits. We trained the MSDNet [13] with 3 and 7 exits using CIFAR-10 and CIFAR-100, respectively. For Tiny-ImageNet and ImageNet, we trained the MSDNet with 5 exits. More implementation details are provided in Appendix.

4.1 Experimental Setup

Generating adversarial examples. To generate adversarial examples during training and testing, we utilize max-average attack and average attack proposed in [12]. We perform adversarial training using adversarial examples generated by max-average attack, where the results for adversarial training via average attack are reported in Appendix. During training, we use PGD attack [21] with 7 steps as attacker algorithm to generate max-average and average attack while PGD attack with 50 steps is adopted at test time for measuring robustness against a stronger attack. We further consider other strong attacks in Section 4.3. In each attacker algorithm, the perturbation degree glyph[epsilon1] is 0 . 3 for MNIST, and 8 / 255 for CIFAR-10/100, and 2 / 255 for Tiny-ImageNet/ImageNet datasets during adversarial training and when measuring the adversarial test accuracy. Other details for generating adversarial examples and additional experiments on various attacker algorithms are described in Appendix.

Evaluation metric. We evaluate the adversarial test accuracy as in [12], which is the classification accuracy on the corrupted test dataset compromised by an attacker (e.g., average attack). We also measure the clean test accuracy using the original clean test data and report the results in Appendix.

Baselines. We compare our NEO-KD with the following baselines. First, we consider the scheme based on adversarial training without any knowledge distillation, where adversarial examples are generated by max-average attack or average attack [12]. The second baseline is the conventional self-knowledge distillation (SKD) strategy [20, 24] combined with adversarial training: during adversarial training, the prediction of the last exit for a given clean/adversarial data is distilled to the predictions of all the previous exits for the same clean/adversarial data. The third baseline is the knowledge distillation scheme for adversarial training [8], which distills the prediction of clean data to the prediction of adversarial examples in single-exit networks. As in [8], we distill the last output of clean data to the last output of adversarial data. The last baseline is a regularizer-based adversarial training strategy for multi-exit networks [3], where the regularizer restricts the weights of the fully connected layers (classifiers). In Appendix we compare our NEO-KD with the recent work TEAT [7], a general defense algorithm for single-exit networks.

Inference scenarios. At inference time, we consider two widely known setups for multi-exit networks: (i) anytime prediction setup and (ii) budgeted prediction setup. In the anytime prediction setup, an appropriate exit is selected depending on the current latency constraint. In this setup, for each exit, we report the average performance computed with all test samples. In the budgeted prediction setup, given a fixed computational budget, each sample is predicted at different exits depending on the predetermined confidence threshold (which is determined by validation set). Starting from the first exit, given a test sample, when the confidence at the exit (defined as the maximum softmax value) is larger than the threshold, prediction is made at this exit. Otherwise, the sample proceeds to the next exit. In this scenario, easier samples are predicted at earlier exits and harder samples are predicted at later exits, which leads to efficient inference. Given the fixed computation budget and confidence threshold, we measure the average accuracy of the test samples. We evaluate our method in these two

(a) Max-average attack

(b) Average attack

(b) Average attack

settings and show that our method outperforms the baselines in both settings. More detailed settings for our inference scenarios are provided in Appendix.

4.2 Main Experimental Results

Result 1: Anytime prediction setup. Tables 1, 2, 3, 4, 5 compare the adversarial test accuracy of different schemes under max-average attack and average attack using MNIST, CIFAR-10/100, Tiny-ImageNet, and ImageNet, respectively. Note that we achieve adversarial accuracies between 40% - 50% for CIFAR-10, which is standard considering the prior works on robust multi-exit networks [12]. Our first observation from the results indicates that the performance of SKD [24] is generally lower than that of Adv. w/o Distill , whereas ARD [8] outperforms Adv. w/o Distill . This suggests that the naive application of self-knowledge distillation can either increase or decrease the adversarial robustness of multi-exit networks. Consequently, the method of knowledge distillation

(a) CIFAR-10

(b) CIFAR-100

(c) Tiny-ImageNet

46

27

(%) n sa esa

45

44

Adversarial Test Accuracy (%)

25

Adversarial Test Accuracy (%)

2 3 30 23 28 27 26 25 24

34

33

4324

23

21

19

9

17

38

10

12

14

16

18

20

22

15

10

20

30

40

50

60

70

300

500

700

900

1100

1300

Budget Usage (MFLOPS)

Budget Usage (MFLOPS)

Budget Usage (MFLOPS)

SKD

ARD

NEO-KD

SKDARD

NEO-KD

Adv. w/o DistillSKD—ARD

NEO-KD

(a) CIFAR-10

(b) CIFAR-100

(c) Tiny-ImageNet

50

32

37

(%) esnv sal leuesiap

49

(%) oesnsy sa iessap

31

30

Adversarial Test Accuracy (%)

36

35

48

2

41

3

46

23

45

3

44

24

29

10

12

14

16

18

20

22

10

20

30

40

50

60

70

300

500

700

900

1100

1300

Budget Usage (MFLOPS)

Budget Usage (MFLOPS)

Budget Usage (MFLOPS)

SKDARD

NEO-KD

SKDARD

NEO-KD

SKDARD

NEO-KD

significantly influences the robustness of multi-exit networks (i.e., determining which knowledge to distill and which exit to target). To further enhance robustness, we investigate strategies for distilling high-quality knowledge and mitigating adversarial transferability.

By combining EOKD with NKD to mitigate dependency across submodels while guiding a multi-exit network to extract high quality features from adversarial examples as original data, NEO-KD achieves the highest adversarial test accuracy at most exits compared to the baselines for all datasets/attacks. The overall results confirm the advantage of NEO-KD for robust multi-exit networks.

Result 2: Budgeted prediction setup. Different from the anytime prediction setup where the pure performance of each exit is measured, in this setup, we adopt ensemble strategy at inference time where the predictions from the selected exit (according to the confidence threshold) and the previous exits are ensembled. From the results in anytime prediction setup, it is observed that various schemes tend to show low performance at the later exits compared to earlier exits in the model, where more details are discussed in Appendix. Therefore, this ensemble strategy can boost the performance of the later exits. With the ensemble scheme, given a fixed computation budget, we compare adversarial test accuracies of our method with the baselines.

Figures 2 and 3 show the results in budgeted prediction setup under average attack and max-average attack, respectively. NEO-KD achieves the best adversarial test accuracy against both average and max-average attacks in all budget setups. Our scheme also achieves the target accuracy with significantly smaller computing budget compared to the baselines. For example, to achieve 41 . 21% of accuracy against average attack using CIFAR-10 (which is the maximum accuracy of Adv. w/o Distill ), the proposed NEO-KD needs 10 . 59 MFlops compared to Adv. w/o Distill that requires 20 . 46 MFlops, saving 48 . 24% of computing budget. Compared to ARD, our NEO-KD saves 25 . 27% of computation, while SKD and LW are unable to achieve this target accuracy. For CIFAR-100 and Tiny-ImageNet, NEO-KD saves 81 . 60% and 50 . 27% of computing budgets compared to Adv. w/o Distill . The overall results are consistent with the results in anytime prediction setup, confirming the advantage of our solution in practical settings with limited computing budget.

Result 3: Adversarial transferability. We also compare the adversarial transferability of our NEOKD and different baselines among exits in a multi-exit neural network. When measuring adversarial transferability, as in [29], we initially gather all clean test samples for which all exits produce correct predictions. Subsequently, we generate adversarial examples targeting each exit using the collected clean samples (We use PGD50 based single attack). Finally, we assess the adversarial transferability as the attack success rate of these adversarial examples at each exit. Figure 4 shows the adversarial transferability map of each scheme on CIFAR-100. Here, each row corresponds to the target exit for generating adversarial examples, and each column corresponds the exit where attack success rate is measured. For example, the ( i, j ) -th element in the map is adversarial transferability measured at exit

Adversarial test accuracy against average attack on CIFAR-10. NKD and EOKD work in a complementary fashion and have implicit synergies.

j , generated by the adversarial examples targeting exit i . The values and the brightness in the map indicate success rates of attacks; lower value (dark color) means lower adversarial transferability.

We have the following key observations from adversarial transferability map. First, as observed in Figure 4a, compared to Adv. w/o Distill [12], SKD [24] in Figure 4b exhibits higher adversarial transferability. This indicates that distilling the same teacher prediction to every exit leads to a high dependency across exits. Thus, it is essential to consider distilling non-overlapping knowledge across different exits. Second, when compared to the baselines [12, 24], our proposed NKD in Figure 4c demonstrates low adversarial transferability. This can be attributed to the fact that NKD takes into account the quality of the distilled features and ensures that the features are not overlapping among exits. Third, as seen in Figure 4d, the adversarial transferability is further mitigated by incorporating EOKD, which distills orthogonal class predictions to different exits, into NKD. Comparing the average of attack success rate across all exits (excluding the values of the target exits shown in the diagonal), it becomes evident that NEO-KD yields 3 . 56% and 13 . 24% gains compared to Adv. w/o Distill and SKD, respectively. The overall results confirm the advantage of our solution to reduce the adversarial transferability in multi-exit networks. These results support the improved adversarial test accuracy of NEO-KD reported in Section 4.2.

4.3 Ablation Studies and Discussions

Effect of each component of NEO-KD. In Table 6, we observe the effects of our individual components, NKD and EOKD. It shows that combining NKD and EOKD boosts up the performance beyond the sum of their original gains. Given different roles, the combination of NKD and EOKD enables multi-exit networks to achieve the state-of-the-art performance under adversarial attacks.

Effect of the type of ensembles in NKD. In the proposed NKD, we consider only the neighbor exits to distill the knowledge of clean data. What if we consider fewer or more exits than neighboring exits? If the number of ensembles is too small, the scheme does not distill high-quality features. If the number of ensembles is too large, the dependencies among submodels increase, resulting in high adversarial transferability. To see this effect, in Table 7, we measure adversarial test accuracy of three types of ensembling methods depending on the number of exits used for constructing ensembles: no ensembling , ensemble neighbors (NKD) , and ensemble all exits . In no enesmbling approach, we distill the knowledge of each exit from clean data to the output at the same position of exit for adversarial examples. In contrast, the ensemble all exits scheme averages the knowledge of all exits from clean data and provides it to all exits of adversarial examples. The ensemble neighbors approach corresponds to our NKD. The results show that the proposed NEO-KD with neighbor ensembling

enables to distill high-quality features while lowering dependencies among submodels, confirming our intuition.

Robustness against stronger adversarial attack. Weevaluate NEO-KD against stronger adversarial attacks; we perform average attack based on PGD-100 [21], Carlini and Wagner (CW) [2], and AutoAttack [5]. Table 8 shows that NEO-KD achieves higher adversarial test accuracy than Adv. w/o Distill [12] in most of cases. Typically, CW attack and AutoAttack are stronger attacks than the PGD attack in single-exit networks. However, in the context of multi-exit networks, these attacks become weaker than the PGD attack when taking all exits into account. Details for generating stronger adversarial attacks are described in Appendix.

Additional results. Other results including clean test accuracy, results with average attack based adversarial training, results with varying hyperparameters, and results with another baseline used in single-exit network, are provided in Appendix.

5 Conclusion

In this paper, we proposed a new knowledge distillation based adversarial training strategy for robust multi-exit networks. Our solution, NEO-KD, reduces adversarial transferability in the network while guiding the output of the adversarial examples to closely follow the ensemble outputs of the neighbor exits of the clean data, significantly improving the overall adversarial test accuracy. Extensive experimental results on both anytime and budgeted prediction setups using various datasets confirmed the effectiveness of our method, compared to baselines relying on existing adversarial training or knowledge distillation techniques for multi-exit networks.

References

Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: a query-efficient black-box adversarial attack via random search. In Computer VisionECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XXIII , pages 484-501. Springer, 2020.

Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp) , pages 39-57. Ieee, 2017.

Sihong Chen, Haojing Shen, Ran Wang, and Xizhao Wang. Towards improving fast adversarial training in multi-exit network. Neural Networks , 150:1-11, 2022.

Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with a fast adaptive boundary attack. In International Conference on Machine Learning , pages 2196-2205. PMLR, 2020.

Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning , pages 2206-2216. PMLR, 2020.

Junhao Dong, Seyed-Mohsen Moosavi-Dezfooli, Jianhuang Lai, and Xiaohua Xie. The enemy of my enemy is my friend: Exploring inverse adversaries for improving adversarial training. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 24678-24687, 2023.

Yinpeng Dong, Ke Xu, Xiao Yang, Tianyu Pang, Zhijie Deng, Hang Su, and Jun Zhu. Exploring memorization in adversarial training. arXiv preprint arXiv:2106.01606 , 2021.

Micah Goldblum, Liam Fowl, Soheil Feizi, and Tom Goldstein. Adversarially robust distillation. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 34, pages 3996-4003, 2020.

Dong-Jun Han, Jungwuk Park, Seokil Ham, Namjin Lee, and Jaekyun Moon. Improving lowlatency predictions in multi-exit neural networks via block-dependent losses. IEEE Transactions on Neural Networks and Learning Systems , 2023.

Mirazul Haque, Anki Chauhan, Cong Liu, and Wei Yang. Ilfo: Adversarial attack on adaptive neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 14264-14273, 2020.

Sanghyun Hong, Yigitcan Kaya, Ionut , -Vlad Modoranu, and Tudor Dumitras. A panda? no, it's a sloth: Slowdown attacks on adaptive multi-exit neural network inference. In International Conference on Learning Representations , 2020.

Ting-Kuei Hu, Tianlong Chen, Haotao Wang, and Zhangyang Wang. Triple wins: Boosting accuracy, robustness and efficiency together by enabling input-adaptive inference. In International Conference on Learning Representations , 2020.

Gao Huang, Danlu Chen, Tianhong Li, Felix Wu, Laurens Van Der Maaten, and Kilian Q Weinberger. Multi-scale dense networks for resource efficient image classification. arXiv preprint arXiv:1703.09844 , 2017.

Hoki Kim. Torchattacks: A pytorch repository for adversarial attacks. arXiv preprint arXiv:2010.01950 , 2020.

Alexandros Kouris, Stylianos I Venieris, Stefanos Laskaridis, and Nicholas Lane. Multi-exit semantic segmentation networks. In European Conference on Computer Vision , pages 330-349. Springer, 2022.

Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.

Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 231N , 7(7):3, 2015.

Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE , 86(11):2278-2324, 1998.

Sungyoon Lee, Hoki Kim, and Jaewook Lee. Graddiv: Adversarial robustness of randomized neural networks via gradient diversity regularization. IEEE Transactions on Pattern Analysis and Machine Intelligence , 2022.

Hao Li, Hong Zhang, Xiaojuan Qi, Ruigang Yang, and Gao Huang. Improved techniques for training adaptive deep networks. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 1891-1900, 2019.

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations , 2018.

Tianyu Pang, Kun Xu, Chao Du, Ning Chen, and Jun Zhu. Improving adversarial robustness via promoting ensemble diversity. In International Conference on Machine Learning , pages 4970-4979. PMLR, 2019.

Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as a defense to adversarial perturbations against deep neural networks. In 2016 IEEE symposium on security and privacy (SP) , pages 582-597. IEEE, 2016.

Mary Phuong and Christoph H Lampert. Distillation-based training for multi-exit architectures. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 13551364, 2019.

Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision , 115:211-252, 2015.

Surat Teerapittayanon, Bradley McDanel, and Hsiang-Tsung Kung. Branchynet: Fast inference via early exiting from deep neural networks. In 2016 23rd International Conference on Pattern Recognition (ICPR) , pages 2464-2469. IEEE, 2016.

Xinglu Wang and Yingming Li. Harmonized dense knowledge distillation training for multi-exit architectures. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 35, pages 10218-10226, 2021.

Qunliang Xing, Mai Xu, Tianyi Li, and Zhenyu Guan. Early exit or not: Resource-efficient blind quality enhancement for compressed images. In European Conference on Computer Vision , pages 275-292. Springer, 2020.

Huanrui Yang, Jingyang Zhang, Hongliang Dong, Nathan Inkawhich, Andrew Gardner, Andrew Touchet, Wesley Wilkes, Heath Berry, and Hai Li. Dverge: diversifying vulnerabilities for enhanced robust generation of ensembles. Advances in Neural Information Processing Systems , 33:5505-5515, 2020.

Zhuolin Yang, Linyi Li, Xiaojun Xu, Shiliang Zuo, Qian Chen, Pan Zhou, Benjamin Rubinstein, Ce Zhang, and Bo Li. Trs: Transferability reduced ensemble via promoting gradient diversity and model smoothness. Advances in Neural Information Processing Systems , 34, 2021.

Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning , pages 7472-7482. PMLR, 2019.

Wangchunshu Zhou, Canwen Xu, Tao Ge, Julian McAuley, Ke Xu, and Furu Wei. Bert loses patience: Fast and robust inference with early exit. Advances in Neural Information Processing Systems , 33:18330-18341, 2020.

Jianing Zhu, Jiangchao Yao, Bo Han, Jingfeng Zhang, Tongliang Liu, Gang Niu, Jingren Zhou, Jianliang Xu, and Hongxia Yang. Reliable adversarial distillation with unreliable teachers. arXiv preprint arXiv:2106.04928 , 2021.

Bojia Zi, Shihao Zhao, Xingjun Ma, and Yu-Gang Jiang. Revisiting adversarial robustness distillation: Robust soft labels make student better. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 16443-16452, 2021.

A Experiment Details

We provide additional implementation details that were not described in the main manuscript.

A.1 Model training

We train a SmallCNN [12] for 150 epochs with batch size 128 on MNIST [18], a MSDNet [13] for 150 epochs with batch size 128 on CIFAR-10/100 [16] and Tiny-ImageNet [17]. For ImageNet [25], since it takes a long time to train from the beginning, we finetune the pretrained model with our NEO-KD loss function for 10 epochs. All experiments are implemented with two RTX3090 GPUs. Other settings follow [12] 2 for SmallCNN and [13] 3 for MSDNet except for a channel, which is set to 8 for our experiments on CIFAR-10/100. For the optimizer, SGD is used with a momentum of 0.9 and a weight decay of 5 × 10 -4 . For the MNIST dataset, the initial learning rate is set to 0 . 01 and the learning rate is decayed 10 -fold at 50 epoch. For the CIFAR-10/100 dataset, the initial learning rate is 0 . 1 , and is decayed 10 -fold at 75 -th epoch and 115 -th epoch. For Tiny-ImageNet, the initial learning rate is set to 0 . 1 , and is decayed 10 -fold at 50 -th epoch and 100 -th epoch. For ImageNet, the learning rate is constant with 0 . 001 .

A.2 Adversarial training

During adversarial training, we use max-average attack and average attack [12] for generating adversarial examples via PGD attacker algorithm [21] with 7 -steps, while the PGD attacker algorithm with 50 -step is used for measuring robustness against a stronger attack during test time. With PGD50 attack, we measure adversarial test accuracy on 3 random seeds and average the results. For PGD attack, the perturbation degree glyph[epsilon1] = 0 . 3 is used for MNIST, glyph[epsilon1] = 8 / 255 is used for CIFAR10/100, and glyph[epsilon1] = 2 / 255 Tiny-ImageNet/ImageNet during both adversarial training and inference time. The step size δ is set to 20 / 255 for MNIST, 2 / 255 for CIFAR-10/100, and 2 3 glyph[epsilon1] (0.0052) for TinyImageNet/ImageNet. The number of iterations is commonly 50 -steps. Similarly, when measuring adversarial transferability, we also use PGD attack with 50 steps, 2 / 255 step size, and 8 / 255 epsilon value to generate adversarial attacks. With PGD attack, the attack success rate is utilized as the metric to measure adversarial transferability. We perform each experiment on 5 random seeds and average the results.

Additionally, the hyperparameter α for NKD is set to 3 , and β for EOKD is set to 1 across all experiments. On the other hand, the exit-balancing parameter γ is set to [1 , 1 , 1] for MNIST and CIFAR-10, and [1 , 1 , 1 , 1 . 5 , 1 . 5] , [1 , 1 , 1 , 1 . 5 , 1 . 5 , 1 . 5 , 1 . 5] for Tiny-ImageNet/ImageNet, CIFAR-100, respectively.

A.3 How to determine confidence threshold in budgeted prediction setup

We provide a detailed explanation about how to determine confidence threshold for each exit using validation set before the testing phase. First, in order to obtain confidence thresholds for various budget scenarios, we allocate the number of validation samples for each exit. For simplicity, consider a toy example with 3-exit network (i.e., L = 3 ) and assume the number of validation set is 3000. Then, each exit can be assigned a different number of samples: for instance, (2000, 500, 500), (1000, 1000, 1000) and (500, 1000, 1500). As more samples are allocated to the early exits, a scenario with a smaller budget can be obtained, while allocating more data to the later exits can lead to a scenario with a larger budget. More specifically, to see how to obtain the confidence threshold for each exit, consider the low-budget case of (2000, 500, 500). The model first makes predictions on all 3000 samples at exit 1 and sorts the samples based on their confidence. Then, the 2000-th largest confidence value is set as the confidence threshold for the exit 1. Likewise, the model performs predictions on remaining 1000 samples at exit 2 and the 500-th largest confidence is determined as the threshold for exit 2. Following this process, all thresholds for each exit are determined. During the testing phase, we perform predictions on test samples based on the predefined thresholds for each exit, and calculate the total computational budget for the combination of (2000, 500, 500). In this way, we can obtain accuracy and computational budget for different combinations of data numbers

(a) Max-average attack

(b) Average attack

(i.e., various budget scenarios). Figures 2 and 3 in the main manuscript show the results for 100 cases of different budget scenarios.

B Clean Test Accuracy

Table A1 shows the clean accuracy results using the model built upon adversarial training via maxaverage attack. We observe that NEO-KD generally shows comparable clean test accuracy with Adv. w/o Distill [12], especially on the more complicated dataset Tiny-ImageNet [17] while achieving much better adversarial test accuracy as reported in the main manuscript.

C Adversarial Training via Average Attack

In the main manuscript, we presented experimental results using the model trained based on maxaverage attack. Here, we also adversarially train the model via average attack [12] and measure adversarial test accuracy on CIFAR-100 dataset. Table A2 compares adversarial test accuracies of NEO-KD and other baselines against max-average attack and average attack. The overall results are consistent with the ones in the main manuscript with adversarial training via max-average attack, further confirming the advantage of NEO-KD.

D Hyperparameter Tuning

In the NEO-KD objective function, there are three hyperparameters ( α, β, γ ), where α , β control the amount of distilling knowledge from NKD, EOKD and γ increases the amount of knowledge distilled to later exits.

D.1 Hyperparameter ( α, β )

The extreme value of α and β can destroy ideal adversarial training. Too large α makes strong NKD, which results in high dependency among submodels and too small α makes weak NKD, which cannot distill enough knowledge to student exits. In contrast, too large β makes strong EOKD, which can interrupt adversarial training by distilling only sparse knowledge (likelihoods of majority classes are zero) and too small β makes weak EOKD, which cannot mitigate dependency among submodels. We select α , β values in the range of [0 . 35 , 3] and measure the adversarial test accuracy value by averaging adversarial test accuracy from all exits. The candidate ( α, β ) pairs are (0 . 35 , 1) , (1 , 0 . 35) , (0 . 35 , 0 . 35) , (0 . 5 , 1) , (1 , 0 . 5) , (0 . 5 , 0 . 5) , (1 , 1) , (2 , 1) , (1 , 2) , (2 , 2) , (3 , 1) , (1 , 3) , and (3 , 3) . When ( α, β ) is (3 , 1) , NEO-KD achieves 28 . 96% of adversarial test accuracy against max-average attack and 22 . 88% against average attack, which is the highest adversarial test accuracy among the various candidate ( α, β ) pairs. Therefore, we use (3 , 1) as ( α, β ) pair in our experiments.

D.2 Hyperparameter γ

Since the prediction difference between the last exit (teacher prediction) and later exits is smaller than the prediction difference between the last exit and early exits, later exits are less effective for taking advantage of knowledge distillation. Therefore, we provide slightly larger weights to later exits for distilling more knowledge to later exits than early exits. The candidate γ values are [1 , 1 , 1 , 1 , 1 , 1 , 1] , [1 , 1 , 1 , 1 . 5 , 1 . 5 , 1 . 5 , 1 . 5] , and [1 , 1 , 1 , 1 . 7 , 1 . 7 , 1 . 7 , 1 . 7] . As a result, when we distill 1 . 5 times more knowledge to later exits, NEO-KD achieves 28 . 96% of adversarial test accuracy against max-average attack and 22 . 88% against average attack, which is the highest adversarial test accuracy compared to providing same weights with earlier exits to later exits ( 28 . 13% for max-average and 21 . 66% for average attack) or distilling 1 . 7 times more knowledge to later exits than earlier exits ( 28 . 68% for max-average and 22 . 58% for average attack). The adversarial test accuracy value is the average of adversarial test accuracies from all exits. Therefore, we use γ = [1 , 1 , 1 , 1 . 5 , 1 . 5 , 1 . 5 , 1 . 5] in our experiments. This result proves that the exit-balancing parameter γ with an appropriate value is needed for high performance.

E Discussions on Performance Degradation at Later Exits

As can be seen from the results for the anytime prediction in the main manuscript, the adversarial test accuracy of the later exits is sometimes lower than the performance of earlier exits. This phenomenon can be explained as follows: In general, we observed via experiments that adversarial examples targeting later exits has the higher sum of losses from all exits compared to adversarial examples targeting earlier exits. This makes max-average or average attack mainly focus on attacking the later exits, leading to low adversarial test accuracy at later exits. The performance of later exits can be improved by adopting the ensemble strategy as in the main manuscript for the budgeted prediction setup.

F Comparison with Recent Defense Methods for Single-Exit Networks

The baselines in the main paper were generally the adversarial defense methods designed for multiexit networks. In this section, we conduct additional experiments with a recent defense method, TEAT [7], and compare with our method. Since TEAT was originally designed for the single-exit network, we first adapt TEAT to the multi-exit network setting. Instead of the original TEAT that generates the adversarial examples considering the final output of the network, we modify TEAT to generate adversarial examples that maximizes the average loss of all exits in the multi-exit network. Table A3 below shows the results using max-average attack on CIFAR-10/100. It can be seen that our NEO-KD, which is designed for multi-exit networks, achieves higher adversarial test accuracy compared to the TEAT methods (PGD-TE and TRADES-TE) designed for single-exit networks. The results highlight the necessity of developing adversarial defense techniques geared to multi-exit networks rather than adapting general defense methods used for single-exit networks.

(a) CIFAR-10

(b) CIFAR-100

G Comparison with SKD and ARD

Existing self-distillation schemes [20, 24] for multi-exit networks improve the performance on clean samples by self-distilling the knowledge of the last exit, as the last exit has the best prediction quality. Therefore, following the original philosophy, we also used the last exit in implementing the SKD baseline. Regarding ARD [8], since it was proposed for single-exit networks, we also utilized the last exit with high performance when applying ARD to multi-exit networks. Nevertheless, we perform additional experiments to consider comprehensive baselines using various exits for distillation. Table A4 above shows the results of SKD and ARD using a specific exit or an ensemble of all exits for distillation. The results show that our scheme consistently outperforms all baselines.

H Implementations of Stronger Attacker Algorithms

In Section 4.3 of the main manuscript, during inference, we replaced the Projected Gradient Descent (PGD) attack with other attacker algorithms (PGD100 attack, Carlini and Wagner (CW) attack [2], and AutoAttack [5]) to generate stronger attacks for multi-exit neural networks. This section provides explanation on how these stronger attacks are implemented tailored to multi-exit neural networks.

H.1 Carlini and Wagner (CW) attack

The Carlini and Wagner (CW) attack is a method of generating adversarial examples designed to reduce the difference between the logits of the correct label and the largest logits among incorrect labels. In alignment with this attack strategy, we modify the CW attack for multi-exit neural networks. In the process of minimizing this difference, our modification aims to minimize the average difference across all exits of the multi-exit neural network. Moreover, when deciding whether a sample has been successfully converted into an adversarial example, we consider a sample adversarial if it misleads all exits in the multi-exit neural network.

H.2 AutoAttack

AutoAttack produces adversarial attacks by ensembling various attacker algorithms. For our experiment, we sequentially use APGD [5], APGD-T [5], FAB [4], and Square [1] algorithms to generate adversarial attacks, as they are commonly used.

H.2.1 APGD and APGD-T

The APGD attack is a modified version of the PGD attack, which is limited by its fixed step size, a suboptimal choice. The APGD attack overcomes this limitation by introducing an adaptive step size and a momentum term. Similarly, the APGD-T attack is a variation of the APGD attack where the attack perturbs a sample to change to a specific class. In this process, we use the average loss of all exits in the multi-exit neural network as the loss for computing the gradient for adversarial example updates. Moreover, we define a sample as adversarial if it misleads all exits in the multi-exit neural network.

H.2.2 FAB

The FAB attack creates adversarial attacks through a process involving linear approximation of classifiers, projection to the classifier hyperplane, convex combinations, and extrapolation. The FAB attack first defines a hyperplane classifier separating two classes, then finds a new adversarial example through a convex combination of the extrapolation-projected current adversarial example and the extrapolation-projected original sample with the minimum perturbation norm. Here, we use the average gradient of all exits in the multi-exit neural network as the gradient for updating adversarial examples. Similar to above, we label a sample as adversarial if it can mislead all exits in the multi-exit neural network.

H.2.3 Square

The Square attack generates adversarial attacks via random searches of adversarial patches with variable degrees of perturbation and position. The Square attack algorithm iteratively samples the perturbation degree and the positions of patches while reducing the size of patches. The sampled adversarial patches are added to a sample, and the patches that maximizes the loss of the target model are selected. Here, we use the average loss of all exits in the multi-exit neural network as the loss for determining whether a sampled perturbation increases or decreases the loss of the target model. Additionally, we determine a sample as adversarial if it misleads all exits in the multi-exit neural network.

H.3 Experiment details

For all attacks, we commonly use glyph[epsilon1] = 0 . 03 as the perturbation degree and generate adversarial examples over 50 steps. All the attacks are based on L ∞ norm. For the APGD attack, we employ cross entropy loss for computing the gradient to update adversarial examples. In both the APGD-T and FAB attacks, all class pairs are considered when generating adversarial attacks. For the Square attack, the random search operation is conducted 5000 times (the number of queries). Other settings follow [14]. In terms of performance comparison against stronger attacker algorithms, we adopt adversarial training via average attack in both Adv. w/o Distill [12] and NEO-KD (our approach). However, since the original CW attack algorithm and AutoAttack algorithm were designed for single-exit neural networks, this adapted versions targeting multi-exit neural networks are relatively weak.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a knowledge distillation approach for defending against adversarial attacks in multi-exit networks. They have two different objectives: (i) leveraging self-distillation to improve adversarial robustness, (ii) reducing adversarial transferability among the submodules of the network. Since multi-exit networks have submodules that are correlated with each other, distilling knowledge from the output of clean data at the last exit to all submodules  increases the chances of adversarial transferability. To avoid this, this paper proposes a two-fold approach: (i) Neighbor knowledge distillation (NKD): generates teacher prediction at exit i by averaging the predictions of clean data from exits i-1, i and i+1 and distills it to adversarial predictions at exit i; (ii) Exit-wise orthogonal knowledge distillation (EOKD): output of clean data at exit i is distilled to adversarial example at exit i. Orthogonal labeling operation on clean predictions makes teacher predictions orthogonal across all exits. NKD helps create high quality teacher predictions improving adversarial robustness of multi-exit networks. At the same time, NKD creates different teacher predictions for each exit reducing the risk of adversarial transferability. EOKD further reduces chances of adversarial transferability.\n\nSTRENGTHS:\n1. The paper is well-written. The approach is well explained and the claims have been substantiated with results.\n\n2. NEO-KD achieves best adversarial accuracy against max-average and average attacks in all budget setups.\n\n3. The paper successfully demonstrates reduction in adversarial transferability among exits in multi-exit networks\n\nWEAKNESSES:\n1. In anytime prediction setup, NEO-KD shows low performance at the later exits for small datasets like MNIST, Cifar-10 \n\n2. NEO-KD shows low performance at early exit for mid scale datasets like TinyImageNet.\n\nQUESTIONS:\nPlease demonstrate results with ViT-tiny or small.\n\nPlease use large scale dataset like ImageNet to show the efficacy of the method.\n\nLIMITATIONS:\nLarge scale demonstration missing, given that it is an empirical paper.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-07-04"}

comments: SUMMARY:
This paper proposed a know-distillation-based method to improve the adversarial robustness of multi-exit neural networks. Extensive experiments are conducted to show the effectiveness of the proposed method.

STRENGTHS:
1. Extensive experiments are conducted to show the effectiveness of the proposed method.
2. This method is a novel combination of previous methods.
3. The paper is well-organized and easy to follow.
4. Technical details are provided in the supplementary materials.
5. Ablation study is provided.

WEAKNESSES:
1. This method is to improve the adversarial robustness of DNNs, but this paper lacks a comparison with some general defense methods, e.g., TEAT[1]. 
2. What is the advantage of distillation methods over other adversarial defense methods on this task?
3. "One challenge is that simply applying existing self-distillation techniques increases the adversarial transferability across different submodels, since the same knowledge from the last exit is distilled to all the other exits, increasing the dependency among different submodels in the network. "
I can find any support for this claim in this paper. 
4. What is the difference between the proposed method and other related work? This paper lacks a detailed/formal comparison with other related methods. 

Dong, Yinpeng, et al. "Exploring memorization in adversarial training." ICLR 2022

QUESTIONS:
1. "Considering our distillation method, NEO-KD is currently not directly applicable to object detection."
Can the author briefly explain why it cannot be applied to object detection?

LIMITATIONS:
The limitations are clearly stated.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 4
DATE: 2023-07-06

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposed a knowledge-distillation based adversarial training method, which is designed for multi-exit neural networks. The authors propose neighbor knowledge distillation to improve the robustness against adversarial attacks, and propose exit-wise orthogonal knowledge distillation to reduce the adversarial transferability across different submodels. Moreover, the proposed method is a plug-and-play method, which can be used in prevailing training strategies of multi-exit networks.\n\nSTRENGTHS:\n1.\tThis paper brings self-distillation into adversarial training, and make a good combination with multi-exit networks.\n2.\tThe experimental results on several datasets and attacks demonstrate its superiority, and the considered scenarios are sufficient.\n\nWEAKNESSES:\n1.\tThough the experimental result is extraordinary, the motivation and operation of EOKD makes me confused. I did not really get the meaning of orthogonal labeling operation $O(\\cdot)$, and the paper does not clearly elaborate the relation between orthogonal labeling and adversarial transferability reduction. Moreover, I would like to know whether EOKD will change the behavior of the output from every exit on clean examples.\n2.\tThe settings of baselines need to be discussed. The author conduct experiments of distillation-based baselines (SKD and ARD) by utilizing the prediction of the last exit, instead of every exit or random exit or another specific exit. Is there any reason to choose the last exit in baseline methods?\n\nQUESTIONS:\n1.\tI hope the authors can clarify the motivation of EOKD and the orthogonal labeling operation more clearly.\n2.\tPlease explain the setting of baselines which only use the prediction of last exit to conduct knowledge distillation.\n3.\tI would like to know the training speed of the proposed NEO-KD, as there are many extra self-distillation terms, which will complicate the computational graph.\n\nLIMITATIONS:\nAs a new adversarial training method, this paper builds a comprehensive solution, and I think this paper have discussed their limitations enough.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-06"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper presents a novel method called Neighbor Exitwise Orthogonal Knowledge Distillation (NEO-KD) for improving the adversarial robustness of multi-exit networks. The method's motivation lies in addressing the issue that existing knowledge distillation schemes are not ideal for multi-exit networks as they either increase or decrease adversarial robustness. The authors argue that the choice of the knowledge to distill and the specific exit to target significantly influence the robustness of multi-exit networks. \n\n- NKD improves the network's defense by ensuring the outputs of adversarial examples mimic the outputs of clean data, by distilling the combined predictions of clean data neighbor exits, leading to enhanced robustness and superior feature quality for corresponding exits. \n\n- EOKD concentrates on minimizing adversarial transferability between different network submodels, by distilling the output of clean data to the output of adversarial samples in an exit-by-exit manner, while promoting orthogonality in non-maximal predictions of individual exits. \n\n- Experiments demonstrate that NEO-KD outperforms existing solutions across a range of commonly adopted datasets, including MNIST, CIFAR-10/100, and Tiny-ImageNet. \n- NEO-KD demonstrates superior performance under different prediction setups (anytime and budgeted), and exhibits reduced adversarial transferability. \n- Ablation studies demonstrated the benefits of its individual components and its robustness against stronger adversarial attacks. \nOverall, the paper offers a substantial contribution to improving the adversarial robustness of multi-exit networks.\n\nSTRENGTHS:\n1) The paper presents a novel approach called NEO-KD that uses Neighbor Knowledge Distillation (NKD) and Exitwise Orthogonal Knowledge Distillation (EOKD) for enhancing adversarial robustness in multi-exit networks. This approach is distinct in its application of knowledge distillation techniques to the unique challenges posed by multi-exit networks.\n\n2) An extensive set of experiments were conducted to validate the proposed method using different datasets and adversarial attacks. This includes the use of anytime and budgeted prediction setups, and analysis of adversarial transferability. The results show the NEO-KD method's performance relative to baseline techniques.\n\n3) The paper(motivation) addresses an important problem in the area of multi-exit networks: how to enhance adversarial robustness. The proposed solution, NEO-KD, not only improves robustness, but also optimizes computation costs and reduces adversarial transferability.\n\nWEAKNESSES:\nThe approach is tested on four standard datasets: MNIST, CIFAR-10, CIFAR-100, and Tiny-ImageNet. While these are common benchmarks, the effectiveness of NEO-KD on larger datasets such as ImageNet is not demonstrated.\n\nQUESTIONS:\nThe paper incorporates the application of ensemble strategy at inference time in the budgeted prediction setup. It would be interesting to learn more about your decision process for using this approach. Specifically, how did you determine the confidence threshold for selecting the exit? Are there any trade-offs or implications if the threshold was set differently?\n\nLIMITATIONS:\n- The experiments were performed using relatively smaller datasets (CIFAR-10, CIFAR-100, MNIST, and Tiny-ImageNet), and the performance on larger datasets such as ImageNet remains unexplored.\n- The choice and implications of the confidence threshold used in the ensemble strategy during the budgeted prediction setup are not clearly explained.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-07-24"}