DERD: Data-free Adversarial Robustness Distillation through Self-adversarial Teacher Group

Venue: acmmm_org_ACMMM_2024_Conference
Published: 2024-03-01 03:43:15

Abstract: Computer vision models based on deep neural networks are proven to be vulnerable to adversarial attacks. Robustness distillation, as a countermeasure, takes both robustness challenges and efficiency challenges of edge models into consideration. However, most existing robustness distillations are data-driven, which can hardly be deployed in the data-privacy scenarios. Also, the trade-off between robustness and accuracy tends to transfer from the teacher to the student along with the robustness, and there has been no discussion on mitigating this trade-off in the data-free scenario yet. 
In this paper, we propose a Data-free Experts-guided Robustness Distillation (DERD) to extend robustness distillation to data-free paradigm, which offers three advantages: 
(1) Dual-level adversarial learning strategy achieves robustness distillation without the real data.
(2) Expert-guided distillation strategy brings a better trade-off to the student model. 
(3) A novel stochastic gradient aggregation module reconciles the task conflicts of the multi-teacher from a consistency perspective. Extensive experiments demonstrate that the proposed DERD can even achieve comparable results to data-driven methods.

Main paper: 
 introduction: 
 Computer vision (CV) systems relying on deep neural networks (DNNs) demonstrate outstanding performance across various tasks, including image classification [22] , object detection [33] , and person ReID [41, 46, 51] . However, recent studies indicate that DNNs are vulnerable to adversarial attacks, which involve the addition of carefully hand-crafted perturbations to the input. These perturbations lead to the complete deception of DNNs, resulting in incorrect decisions [16, 27, 35] . This vulnerability presents challenges to the reliable deployment of DNN-based systems.As countermeasures, various adversarial defense mechanisms have been proposed [23, 32, 39, 50] . Adversarial Training (AT) [16, 20, 27] to counter potential attacks. However, the effectiveness of AT for lightweight models is hindered due to their limited capacity and representation ability. Moreover, the deployment of large-scale adversarially trained models in practical applications is often challenging due to requirements for timeliness and memory. To address these challenges, robustness distillation [14, 52, 53] has been introduced. This approach tackles both robustness and efficiency concerns by employing a larger robust model (teacher model) to guide the robustness training of a smaller model (student model). However, most existing robustness distillation techniques are data-driven [12] methods, which may pose challenges in practical deployment scenarios where data privacy protection and transmission efficiency are crucial. Firstly, these methods often assume continuous access to the real training data throughout adversarial training and robust distillation processes. However, some sensitive and private data (e.g., facial data, pedestrian data, and patients' medical records) may become inaccessible once the model is published to the public. Secondly, some approaches rely on access to proxy or auxiliary data beyond the real data [3, 11] . Unfortunately, these methods not only require additional training data, but also suffer from performance degradation when the distribution of the proxy data differs from that of the original data. In summary, existing robustness distillation methods still face challenges for data privacy.The analyses above emphasize the crucial need to extend robustness distillation to scenarios where real data is unavailable. Data-free Knowledge Distillation [5, 12, 13, 25, 28, 42] offers valuable insights that, the inherent knowledge of a teacher model can be effectively transferred to a student model by leveraging artificially constructed pseudo data. In this approach, the teacher model guides the generation of pseudo data (no matter explicit or implicit), eliminating the necessity for real data. Similarly, the robust knowledge of a robust teacher model can be transferred to a student model using the 'generation-distillation' paradigm, as illustrated in Figure 1 .To our best knowledge, DFARD [37] is the pioneering and only work addressing the data-free robustness distillation task. However, it proposed only several trivial tricks without fully considering the unique challenges inherent in this task. Firstly, existing datafree distillation methods, including DFARD, primarily focus on mining trivial discriminative knowledge (i.e., nature knowledge) from the teacher, rather than extracting the robustness knowledge in an adversarial min-max game. Generating adversarial samples is rather difficult in the absence of authentic benign samples. Secondly, the common trade-off between robustness and accuracy [45] may be inadvertently transferred from the teacher to the student during robustness distillation. While some methods attempt to mitigate this trade-off [45, 49] , none of them addresses it in data-free scenario. Optimizing the trade-off in data-privacy scenario demands that defenders to run out of the dependency on real data and find another way out move beyond reliance on real data and explore alternative solutions, such as leveraging gradients. DFARD lacks a min-max process similar to data-driven robustness distillation, and also fails to address the sub-optimal solution resulting from the trade-off.In this paper, we propose data-free experts-guided robustness distillation (DERD) to address the aforementioned challenges. Firstly, we propose a 2-stage distillation framework. In stage-I, the student model learns natural knowledge from a natural teacher, serving as a warm-up phase, wihch provides a solid pre-training for subsequent robust learning processes [34] . In stage-II, we craft pseudo adversarial examples by maximizing the output discrepancy between the natural teacher and the adversarial-defended robust teacher. The fundamental concept of stage-II is illustrated in Fig. 2 , where the pseudo data is engineered to deceive the nature teacher while simultaneously maximizing the output descrepancy between the nature and robust teachers. Essentially, this stage forms a dual-level adversarial learning mechanism, involving (1) the adversarial mechanism between teachers and generators, and (2) the self-adversarial mechanism between the natural and robust teachers. Secondly, to mitigate the trade-off between accuracy and robustness, we employ a homogenized expert-guiding strategy, where both natural knowledge and robust knowledge are distilled from the natural teacher and robust teacher respectively, using the same surrogate data. Lastly, we introduce a stochastic gradient aggregation (SGA) module to harmonize the gradient of both natural and robust distillation tasks. This module optimizes the 'robustness-accuracy' trade-off by ensuring consistency from a gradient perspective.Our main contributions can be summarized as follows:(1) We propose a novel data-free robustness distillation method. Comparing to the only existing solution, we design a tailored 2stage framework aimed at extracting robust knowledge through a min-max game, similar to data-driven defense strategies.(2) To balance the inherent trade-off between robustness and accuracy in data-free manner, we introduce an expert-guiding strategy and employ the SGA regularizer to reconcile this optimization conflict from both sample level and gradient level.(3) Our approach demonstrates better performance on mainstream evaluation datasets compared to the only one previous data-free robustness distillation method. Furthermore, it is also comparable to the data-driven distillation methods. 
related works 2.1 knowledge distillation: 
 Knowledge distillation is a technique aimed to transfer knowledge from a large model to a more efficient and smaller model. It can be traced back to decision trees, where a decision tree is trained to mimic the output of multiple decision trees [1] . Hinton 𝑒𝑡 𝑎𝑙 . extended this idea to neural networks and termed it as 'knowledge distillation' [18] . In this approach, a compact student model learns the mapping relationship from a large, high-performance teacher model. Over time, the introduction of various variants and training techniques [30] has enabled model compression through knowledge distillation in many fields [6, 47] .The assumption of 'data availability' in vanilla knowledge distillation overlooks the more practical scenario of 'data unavailability. ' Recent research has begun to address this gap by focusing on datafree knowledge distillation methods, which is promising and draws lots of attention. For instance, Lopes 𝑒𝑡 𝑎𝑙 . [26] synthesize inputs based on pre-stored auxiliary layer-wise statistics (meta-data) of the teacher model. Chen 𝑒𝑡 𝑎𝑙 . [26] train a generator for image generation while treating the teacher model as a fixed discriminator. ADI [42] utilizes batch normalization statistics (BNS) from a pretrained teacher to optimize input noise for generating high-quality images. CMI [13] leverages local and global contrast of samples to optimize the diversity of the generator. ZSKT [28] employs adversarial distillation, transferring knowledge from teacher to student using KL divergence and spatial attention, while DFAD [12] solely utilizes MAE loss to perform the min-max process between teacher and student models for better alignment. However, these methods aim to extract benign discriminative knowledge, and directly incorporating it into robustness distillation won't be the most effective approach.Adversarial attacks aim to deceive the target model by introducing minor perturbations to the inputs. These attacks are categorized based on the level of access the attacker has to the target model,resulting in two main categories: white-box and black-box attacks. In white-box attacks, the attacker has complete access to the target model, including gradients and parameters. Mainstream white-box attack methods include gradient-based approaches [8, 16, 21, 27] , classifier-based methods [29] , and optimization-based techniques [4] . On the other hand, black-box attacks assume limited prior information about the target model. These attacks are further classified into score-based attacks, decision-based attacks, and transfer-based attacks. Decision-based attacks operate under the constraint that the attacker can only access the one-hot hard labels from the target model. For instance, the boundary attack [2] . Scorebased attacks, such as ZOO [9] , enable the attacker to obtain probability scores of the input queries, offering more detailed information beyond the final decision. Transfer-based attacks [9, 24, 40, 48, 54] involve building a proxy model of the target model, commonly used to evaluate the black-box adversarial robustness of DNNs.Adversarial defenses aim to maintain the robustness of DNNs against adversarial attack. Early heuristic defense methods, while reporting promising results, have been found to rely on 'obfuscated gradients', rendering their unreliable robustness. Adversarial training (AT) [16, 20, 27] is considered one of the most effective defenses. However, the effectiveness of AT for small models is constrained by their limited capacity. To address this, robustness distillation [14, 52, 53] is proposed, aiming to transfer robustness from a large, robust model to a more efficient, smaller model. ARD [14] and IAD [52] have demonstrated that robustness distillation can yield a student network with greater robustness than training from scratch. RSLAD [53] introduces the concept of robust soft labels (RSL) provided by the robust teacher, which can offer an effective robust representation for the student. Additionally, MTARD [49] proposes a dual-teacher structure to optimize the trade-off between accuracy and robustness in robustness distillation. Furthermore, Trades [45] and MART [38] can also be considered examples of robust self-distillation, as they leverage the model's outputs on natural samples to guide its outputs on adversarial samples.However, there have been few works to address robustness distillation in scenarios where real data is unavailable. To our best knowledge, only two works have explored data-free robustness distillation: DFHL-RS [43] and DFARD [37] . However, DFHL-RS primarily focuses on model stealing attacks rather than robust distillation and operates in a completely black-box setting. On the other hand, DFARD only introduces some basic trivial training techniques for all distillation tasks, without considering how to efficiently utilize the robust knowledge inherent in robust teachers. In contrast, our approach achieves superior data-free adversarial robustness through a tailored framework. 
methodology 3.1 preliminaries: 
 Adversarial attack (untargeted). Given a target model 𝑓 𝑤 parameterized by 𝑤, the objective of the attacker can be formulated as a conditional optimization problem:EQUATIONwhere 𝑥 ′ denotes the adversarial examples, L (•) represents the classification loss (e.g., cross entropy loss), and 𝜀 is the upper bound of the perturbation under the 𝑙 𝑝 -norm. The goal of the attacker is to deceive the target model with visually imperceptible perturbations.Adversarial defense aims to preserve the discriminability capability of 𝑓 𝑤 under adversarial attacks, i.e., achieving adversarial robustness. The objective of defense can be formalized as:arg min 𝑤 L (𝑓 𝑤 (𝑥 ′ , 𝑤), 𝑦).(EQUATIONRobustness distillation addresses both robustness and efficiency challenges. Given a student model 𝑆 𝜃 𝑆 (•) (abbreviated as 𝑆 (•)) and a teacher model 𝑇 𝜃 𝑇 (•) (abbreviated as 𝑇 (•)), the main goal of robustness distillation is to transfer the robustness of the teacher model against adversarial examples to a smaller student model:EQUATIONwhere D (•) denotes the discrepancy in output distribution between the teacher and student models, typically measured using metrics like KL divergence. Data-free robustness distillation refers to scenarios that the real data 𝑥 is inaccessible, making the real adversarial examples 𝑥 ′ based on 𝑥 also unavailable. Consequently, the defender must generate substitute data and align the mapping relationship between the teacher and student based on these pseudo data, presenting additional challenges. This process can be formalized as:EQUATIONwhere 𝐺 (•) represents the generator, which can be either explicit forms (such as generative networks [15] ) or implicit forms (such as model inversion [42] ). Here, 𝑧 denotes the random input to the generator, typically sampled from a Gaussian distribution.Our proposed Data-free Expert-guided Robustness Distillation (DERD) is a dual-stage model based on an explicit generator which also incorporates a regularizer, SGA, to reconcile the trade off between accuracy (Acc.) and robustness (Rob.), shown in Fig. 3 . The in stage-I and stage-II (including the regularizer) will be introduced in Sec 3.2 and Sec 3.3 respectively.In stage-I, we initialize the student model 𝑆 (•) and generator 𝐺 (•) using a natural teacher 𝑇 𝑛𝑎𝑡 (•). To clarity, the objective function in the stage-I primarily consists of the loss function of the generator L 𝐺 𝑠𝑡𝑎𝑔𝑒 -𝐼 and the loss function of the student model L 𝑆 𝑠𝑡𝑎𝑔𝑒 -𝐼 :EQUATIONThe optimization objective of 𝐺 (•) is to generate substitute data for real data, facilitating the distillation of natural knowledge to the student. By pairing a pre-trained teacher with a generative network 𝐺, a GAN-like framework for adversarial learning [5] is formed, enabling the generator to produce pseudo-natural data, where the teacher acts as the discriminator 𝐷. However, there are key differences from a vanilla GAN: (1) The teacher model is frozen as a supervisor 𝐷. (2) The role of the teacher model is no longer to determine the authenticity of images but rather to classify the data generated by 𝐺 into different conceptual sets, transitioning from a binary classification task to a multi-class classification task. Essentially, the teacher model provides supervisory information for training the generator 𝐺.Based on the above analysis, the primary loss of 𝐺 in a mini-batch can be formalized as:EQUATIONwhere L 𝑜ℎ represents the one-hot classification loss, 𝑧 𝑖 denotes a stochastic input, ŷ𝑖 represents a pseudo target label, and 𝑛 is the number of pseudo samples in a minibatch. This loss function aims to train 𝐺 (•) to generate pseudo data from random inputs, ensuring that the pseudo data 𝐺 (𝑧 𝑖 ) is correctly classified by 𝑇 𝑛𝑎𝑡 (i.e., the discriminator) with the corresponding pseudo target labels ŷ𝑖 .In addition to direct discriminative supervision, a common assumption is that if the generated data are discriminative, their patterns should be significantly captured by the filters in the network, leading to higher activation values in the intermediate layers. Consequently, a prior loss based on feature activation values is:EQUATIONwhere 𝐹𝑒𝑎𝑡 𝑛𝑎𝑡 (𝐺 (𝑧 𝑖 )) denotes the hidden layer features before the classifier of 𝑇 𝑛𝑎𝑡 , and the objective is for 𝐺 (•) to generate pseudo data with rich features rather than sparse trivial solutions. Besides, we aim to fully leverage the statistical prior within the teacher model, as it is trained on real data. To achieve this, we propose minimizing the discrepancy between the feature statistics of real data (indirectly encoded in the batch normalization layers of the teacher model) and pseudo data:EQUATIONwhere 𝜇 𝑙 (•) and 𝜎 𝑙 (•) represent the mean and variance of the input data in the 𝑙 𝑡ℎ layer, respectively, and X represents the distribution of real data, where 𝑥 ∈ X. This technique was initially employed in data-free distillation using model inversion [42] , but its application in generator-based approaches has been scarcely discussed. Moreover, to eliminate the model's bias for certain categories, it's typically desirable for the target label distribution of the conceptual set to be balanced. This implies that the sample quantity and occurrence probability for each category should be consistent. Given a set of output vectors for the pseudo data {𝑇 𝑛𝑎𝑡 (𝐺 (𝑧 1 )),𝑇 𝑛𝑎𝑡 (𝐺 (𝑧 2 )), • • • , 𝑇 𝑛𝑎𝑡 (𝐺 (𝑧 𝑛 ))}, the count for a specific class 𝑐 is y 𝑐 𝑇 = 𝑛 𝑖=1 𝛿 (𝑇 𝑛𝑎𝑡 (𝐺 (𝑧 𝑖 )) = 𝑐). Here, 𝛿 (•) is an indicator function:EQUATIONThen, the information entropy loss of 𝐺 (•) can be expressed as:EQUATIONwhere H info (p) = -1 𝑘 𝑖 𝑝 𝑖 log (𝑝 𝑖 ). This loss aims to maximize the entropy of the distribution of the generated classes. When the generator produces each class with equal probability, Eq. 10 is minimized.Therefore, the loss function for the generator in the stage-I can be summarized as:EQUATIONBased on the pseudo data 𝐺 (𝑧), the optimization goal of the student is to mimic the mapping relationship of the teacher model:EQUATION)where KL is the KL-divergence. After stage-I, the student 𝑆 (•) initially obtains the natural knowledge, which can be used as the initialization for stage-II. Additionally, 𝐺 (•) acquires the ability to generate pseudo natural data. As will be discussed below, pseudo data for adversarial samples can be obtained based on 𝐺 (𝑧).In stage-II, we employ the nature teacher 𝑇 𝑛𝑎𝑡 and robust teacher 𝑇 𝑟𝑜𝑏 for self-adversarial learning and expert strategy to distill natural and robust knowledge to the student model.• Self-adversary (SA). The primary task of stage-II is to find substitute data for adversarial samples to explore the robustness of the robust teacher 𝑇 𝑟𝑜𝑏 . As illustrated in Fig. 2 , a natural characteristic of adversarial samples is to maximize the discrepancy between the robust and natural teachers. Utilizing 𝐺 (𝑧) as substitute data for natural data, we construct discrepancy data 𝑥 𝑑 based on 𝐺 (𝑧) as the pseudo adversarial data, to maximize the output discrepancy between 𝑇 𝑛𝑎𝑡 and 𝑇 𝑟𝑜𝑏 in a self-adversary manner:EQUATION)EQUATION)where 𝑡 represents the iteration step. In data-free distillation, L1 loss is considered a better metric for measuring discrepancy compared to KL divergence [12, 36] . This preference arises because the gradient of KL divergence tends to be smaller than that of L1 loss, making it more susceptible to gradient vanishing. Therefore, we choose the L1 norm to quantify the output difference between 𝑇 𝑛𝑎𝑡 and 𝑇 𝑟𝑜𝑏 :EQUATION) Clearly, 𝑥 𝑑 is obtained through an iterative process. Note that the optimization process is not bound by the norm constraint, as the pseudo data do not require visual similarity. The discrepancy metric enables the pseudo-data to search for samples in the input space that can deceive the natural teacher. However, solely adopting this objective may be suboptimal, as the pseudo data may tend to deceive the robust model rather than the natural model to maximize 𝐷 (𝑇 𝑛𝑎𝑡 ,𝑇 𝑟𝑜𝑏 ). Hence, we introduce an entropy constraint in the optimization objective to ensure that the pseudo data can indeed deceive the natural teacher while maximizing the discrepancy:EQUATION)• Expert-guiding strategy (EG). Using the discrepancy data 𝑥 𝑑 , we employ the expert-guiding strategy to simultaneously distill both natural knowledge and robust knowledge into 𝑆. In MTARD [49] , where the data is available, natural knowledge is distilled using natural data, while robust knowledge is distilled using adversarial examples. However, we find that utilizing 𝑥 𝑑 for the nature teacher can also enhance the distillation of natural knowledge. This may be because 𝑥 𝑑 can serve as challenging samples for the natural teacher, further leveraging the natural knowledge. The expert distillation strategy for the student model can be formalized as:L 𝐷𝑖𝑠 = KL (𝑇 𝑛𝑎𝑡 (𝑥 𝑑 ), 𝑆 (𝑥 𝑑 )) + 𝜆 𝑟𝑜𝑏 KL (𝑇 𝑟𝑜𝑏 (𝑥 𝑑 ), 𝑆 (𝑥 𝑑 )). (17)• Gradient aggregation. Intuitively, the loss function of the expert strategy involves two optimization tasks: distillation of natural knowledge and robust knowledge. However, directly optimizing these two tasks with the gradient descent algorithm might be uncoordinated, as the gradients of the two losses may not align well. The intuitive representation, as shown in Fig. 4 , is that two optimization directions forming an obtuse angle could lead to a suboptimal aggregated direction. We verify this hypothesis in Fig. 5 . In CIFAR10 and CIFAR100, the gradients of the robustness and natural distillations consistently form an obtuse angle, resulting in a sub-optimal joint optimization of the two tasks.A similar issue has also been raised in unsupervised domain adaptation (UDA), where the domain adaptation loss and the classification loss are often have uncoordinated aggregation directions. To address this, a gradient aggregation (GA) strategy [19] has been proposed to harmonize the two tasks. GA can be formalized as:EQUATION)where 𝑔 1 and 𝑔 2 represent the gradient of the two losses, and 𝛿 (•) is the indicator as defined in Eq. ( 9). For convenience, we have:EQUATION)Hence the aggregated gradient can be simplified as:EQUATIONand the GA loss can be simplified as:EQUATION)The gradient harmonization process described above can be intuitively represented by Figs. 4 (a ) and 4 (d). Gradient aggregation (GA) does not intervene when the gradients of the two loss functions form an acute angle. However, for two loss functions whose gradients form an obtuse angle, GA calculates the orthogonal basis for the two gradient directions respectively, and then employs this orthogonal basis to achieve a more efficient gradient aggregation.• Stochastic gradient aggregation (SGA). Based on the GA module, we further propose a SGA strategy. Our objective is to introduce minor perturbations to the two original gradients, thereby exploring richer and more efficient aggregation directions and enhancing the model's robustness to gradient augmentation. This approach is based on a simple intuition: by augmenting at the gradient level, we can implicitly achieve data-level augmentation, thereby improving the richness and noise resistance of gradient aggregation [51] . Adding subtle gradient perturbations to both can be formalized as:EQUATIONwhere 𝑟 1 and 𝑟 2 are two minor stochastic gradient perturbations. Integrating Eq. 22 with respect to 𝜃 𝑆 results in a loss for SGA: where 𝜏 is a hyper-parameter controlling the gradient perturbation, and 𝑟 is the stochastic perturbation composed of 𝑟 1 and 𝑟 2. Therefore, the stochastic gradient aggregation can be realized through such a simple regularizer. To maintain training stability, similar to SGP [51] , we introduce an L2 norm constraint to the regularizer:EQUATIONEQUATION)where 𝐿 1 and 𝐿 2 represents the original task, and the regularizer can be simplified as:EQUATIONThe regularizer can be considered as a stochastic extension form of L2 regularization. On one hand, it allows the student model to explore richer gradient aggregation directions. On the other hand, it imposes the norm constraint of the student's parameters, providing regularization from the perspective of smoothness and sparsity.• Overall loss stage-II. For 𝐺 (•), the loss functions in stage-I and stage-II remain consistent (Eq. ( 10)), primarily generating natural alternative data 𝐺 (𝑧) that is more distinguishable by 𝑇 𝑛𝑎𝑡 .𝑆 (•) learns both natural and robust knowledge simultaneously from the teacher group through the 𝑥 𝑑 based on 𝐺 (𝑧), and the total loss in stage-II can be formalized as: EQUATION 
experiments 4.1 experiments setup: 
 Datasets and backbones. We evaluate our DERD on two CIFAR datasets commonly used for adversarial attack and knowledge distillation, and also discuss DERD's performance on a relatively larger dataset ImgageNet100.• CIFAR10. We employ ResNet34 [17] as the backbone for both the natural and robust teacher models, and ResNet18 & MobileNet2 [31] for the student model.• CIFAR100. ResNet50, Wide-ResNet-3420 [44] , and ResNet18 & MobileNet2 are selected as the backbones for the natural teacher, robust teacher, and student, respectively.• ImageNet100. ViT-small [10] is chosen for the natural and robust teachers, and ViT-tiny for the student.Our backbone selection is based on previous works in robust distillation [45, 53] and data-free distillation [5, 12, 42] . Additionally, we consider specific factors for each dataset. Specifically, we verify our model's feasibility within a homogenous teacher group (where the teachers share the same backbone) on CIFAR10, ascertain its performance with a heterogeneous teacher group (where the teachers own different backbones) on CIFAR100, and validate its applicability on ViT-based models using ImageNet100.Attacks. We assess the student' performance against five commonly used the white-box attacks: FGSM [16] , PGD S [27] , PGD T [45] , CW [4] , and AutoAttack [7] . For CIFAR10 and CIFAR100, we set the 𝐿 ∞ norm attack budget 𝜖 = 8/255, perturbation step size 𝜂 1 = 2/255, number of iterations 𝐾 = 10, and batch size 𝑚 = 512. For Ima-geNet100, We set 𝜖 = 0.03, 𝜂 1 = 2/255, 𝐾 = 10, and 𝑚 = 128. Additionally, besides white-box attacks, we also briefly evaluate the student's robustness against black-box attacks on CIFAR10, including transfer-based and query-based black-box attacks.Details. We employ the SGD optimizer with a momentum of 0.9 and weight decay of 5e-4 to train both the student and teacher models. The natural teacher and the robust teacher are trained over 2000 epochs, with the learning rate reduced by a factor of 0.1 at epochs 800 and 1600. Madry's AT [27] is used to train the robust teacher. For the student models, stage-I includes 2000 epochs of natural training, followed by stage-II, which consists of 100 epochs of robustness training. The initial learning rates for CIFAR10 and CIFAR100 are set to 0.01. For ImageNet100, we fine-tune pre-trained models on ImageNet as both the nature teacher and robustness teacher, with an initial fine-tuning learning rate of 0.0001. Table 1 present the evaluation results for supplementary materials the teacher models. Please refer to the suppMore details of the experimentsWhite-box robustness. Table 2 and Table 3 present the experimental results of the white-box attacks on CIFAR10 and CIFAR100. We report the results of both data-driven methods and the direct adaptation of several existing data-free distillation methods to robustness distillation. We also reported the results of DFHL_RS [43] in Table 3 , considering that model robust stealing attack (MSA) can serve as a special data-free robustness distillation. Note that DFHL_RS is only evaluated on ResNet in its original experiments. The results of existing methods are obtained from previous literature [37, 43, 53] .The results on ImageNet100 are moved to the supplementary for sapce reasons. Intuitively, our DERD demonstrates significant superiority compared to directly applying existing data-free distillation methods to robustness distillation, and it is comparable to datadriven robustness distillation methods. However, despite adopting a teacher group-based expert strategy to optimize the trade-off, the accuracy of the student on clean samples remains significantly lower than that of data-driven methods. The conflict between robustness and accuracy is undoubtedly amplified in the absence of real data. Nonetheless, our DERD brings reliable robustness to the student model without real data, and the trade-off can be mitigated by the regularizer, as demonstrated in the ablation analysis later.Black-box robstness. Following the RSLAD [53] setting, we also conduct a brief evaluation of the black-box robustness of our DERD on CIFAR10. We use ResNet50 to create adversarial samples of PGD and CW attacks for transfer-based attacks, and square attack for query-based attacks. The attack budgets are consistent with those used for white-box attacks. The experimental results are presented in Table 4 . Since there is a lack of black-box evaluation for data-free robustness distillation, we compare DERD with several common data-driven adversarial training and robustness distillation methods. Notably, our DERD achieves comparable black-box robustness, demonstrating the transferable robustness.Ablation of the modules. We conduct an ablation study to evaluate the incremental effects each module in DERD on CIFAR10 with ResNet-18 as the backbone. The results are summarized in Table 5 . The complete DERD includes stage-I and stage-II, while stage-II includes modulus of EG, SA and SGA. Note that when SA strategy works alone, DERD degenerates into training the student models by using the discrepancy data 𝑥 𝑑 and the sole robust teachers, like Eq. 12, where 𝑇 𝑛𝑎𝑡 is replaced by 𝑇 𝑟𝑜𝑏 . Intuitively, stage-I can be considered as the pre-training process to obtain the natural knowledge. The SA module effectively improves the robustness of the student model. The EG and SGA strategy comprehensively enhance the model's robustness and accuracy by promoting gradient harmony and augmentation. The results of the ablation analysis align with our expectations for the modules and highlight the importance of both SA strategy and EG / SGA module in improving the overall performance of our DERD.Without stage-I? Directly distilling robust knowledge without stage-I yields suboptimal results in terms of both accuracy and adversarial robustness. To verify this, we conduct verification experiments on CIFAR10, and the results are shown in Table 6 . The results indicate that stage-I brings a significant increment to DERD. The suboptimal robustness without stage-I may stem from two main reasons. First, generating pseudo adversarial data relies on pseudo nature data (refer to Eq. 13). The process of generating pseudo data for adversarial samples requires that the generator 𝐺 is already capable of producing pseudo natural data. Subsequently, both the generator and the student model can be further optimized based on this foundation. Secondly, it could be challenging for the student to directly acquire robust knowledge. However, initializing the student with natural knowledge can facilitate more efficient learning of robust knowledge. According to ARREST [34] , pre-training on natural knowledge can lead to more stable representations during robustness training. Therefore, it is necessary to introduce stage-I as a warm-up for both the generator 𝐺 and the student model 𝑆. 
discussion: 
 We briefly discuss the expansibility of DERD from two perspectives. Extension to model inversion framework. The model-inversionbased method is also a main paradigm of data-free distillation. Our DERD can be extended to this framework as an alternative solution. In this scenario, the explicit generator 𝐺 becomes implicit, where the input noise tensor is directly optimized.Handling absence of natural teacher. While DERD relies on the presence of both a natural teacher and a robust teacher, we propose an alternative approach for scenarios where only a robust teacher is available. We find that student tends to first learn the natural knowledge before acquiring robust knowledge, making itself a good surrogate for the natural teacher.For detailed discussions on these issues, please refer to the supplementary materials. In summary, while the alternative solutions can achieve certain accuracy and adversarial robustness, the complete DERD demonstrates significant superiority. This is attributed to the controllability of the explicit generator model and the discriminative nature knowledge provided by nature teachers. 
conclusion and outlook: 
 We consider the challenge of distilling the robustness from highperformance large models to high-efficiency small models without the real data, and propose Data-free Experts-guided Robustness Distillation (DERD), where a novel dual-level adversarial learning mechanism and an efficient stochastic gradient aggregation module are proposed. Experimental results corroborate that DERD is superior to existing attempts of data-free robustness distillation, and can even achieve robustness comparable to data-driven robustness distillation. Still, DERD relies on a strong assumption of the dualteacher hypothesis. Although effective, the concurrent requirement for both a robust teacher and a natural teacher may introduce additional memory costs and privacy threats. Furthermore, models distilled in a data-free paradigm sometimes suffer from unstable convergence, which is also a potential improvement direction.  
 
 Appendix:  


Decision: This paper presents a novel approach for robustness distillation in scenarios where original data is inaccessible. The proposed method involves a warm-up stage to train a generator for creating pseudo data, followed by a distillation stage to transfer robustness and accuracy from teacher to student models. The experiments demonstrate the effectiveness of DERD on CIFAR10, CIFAR100, and ImageNet100 datasets.

Pros:
- This approach does not require access to original training data which expands the applicable areas for adversarial training methods.

- Empirical evaluations are extensive. Considerable improvements are observed compared with existing techniques in data-free scenarios.

Cons:

- Reviewers have concerns over the hyper-parameters and other training details. The missing details make this paper less reproducible. Thus, it is recommended to release source code.

- Some reviewers question about the technical novelty of this work which looks like a combination of multiple existing losses.

Overall, this  work tackles a challenging task of adversarial training without access to source training data. The contributions to the field of robustness distillation in data-free scenarios are sufficient to be accepted by ACM MM.

Reviews: review: paper_summary: paper_summary: This paper proposed a two stage data-free distillation method to improve the adversarial robustness. While previous work DFARD applies distillation to a teacher model with generated adversarial samples, this paper introduces an additional robustness teacher model for better performance.
strength_weakness: strength_weakness: Limit research has been done on the field of improving adversarial robustness with no access to the original benign data. This paper builds their work based on DFARD. In DFARD, distillation is applied to a teacher model with generated adversarial samples. This submission proposed adding a robust teacher for better adversarial samples generation and better distillation process. To make the distillation of clean and robust teacher work, a warmup stage is also proposed. Compared with other data-free methods, in majority of the cases, their method achieves higher performance on both clean and adversarial samples.
limitations: limitations: In the third contribution, the authors claim that their performance is comparable to the data-driven distillation methods which is not true according to table 2 and table 3. In table 2 and 3, we can clearly see that their proposed methods have much lower clean accuracy than all data driven methods, and have lower robustness under autoattack than all data driven methods. This contribution is overclaimed.

Even plenty of results are shown in the submission, lots of details are missing and 
From Table 6, we can see the importance of stage 1. However, the loss components in stage 1 are mostly designed on certain assumptions and with no support of solid ablation study or results.  Details about how the other methods’ performance are collected are missing. This might bring up concern about the fairness of benchmarking with other methods. These details can’t be found in the main context, the supplement nor the attached codes. While generative samples are one of the key parts, no generated samples are revealed, no quality analysis are done. How the robust teacher is trained is also unknown. We only know that adversarial training is applied, but have no idea of the attack budget, iteration. It would be interesting if the authors can show how the generated adversarial samples would perform on clean and robust teachers. How different robust teachers would affect the performance is also worth exploring.
paper_summary: paper_summary: This paper proposes Data-free Experts-guided Robustness Distillation, which facilitates robustness distillation under the data-free setting. This is achieved by a dual-level adversarial distillation under the guidance of two teachers, a robust teacher and a nature teacher. The paper deploys a two-stage training to learn a robust student. Stage 1 warms up the generator through an adversarial training between the student and the generator. Then in the second stage, a fixed robust teacher is introduced to learn the robustness in students, while preserving a good Acc.
strength_weakness: strength_weakness: `. The two-stage design proposed in this paper is particularly intriguing. The experimental results presented in Table 3 demonstrate that the method effectively learns a robust model, outperforming other existing methods. This highlights the potential of the two-stage approach in enhancing model performance and robustness.

2. The authors have conducted comprehensive experiments on both CIFAR-10 and CIFAR-100 datasets, employing a variety of attack methods to evaluate the resilience of the proposed model. These experiments provide valuable insights into the effectiveness of the method under different adversarial scenarios.
limitations: limitations: 1. The method has been evaluated solely on CIFAR, which is a relatively small dataset for comprehensive evaluation. To enhance the credibility of the results, it would be beneficial for the authors to include evaluation outcomes on ImageNet-256 or a subset of ImageNet-256.
2. The paper demonstrates that stage 1 is crucial for developing robust student models. However, it lacks an in-depth analysis of the underlying reasons. Additional analytical results are needed to substantiate this assertion.
paper_summary: paper_summary: This study investigates the concept of data-free distillation. The authors argue that most current robustness distillation approaches rely heavily on data, making them unsuitable for deployment in data-sensitive environments. Furthermore, they highlight that the trade-off between robustness and accuracy often persists from the teacher model to the student model, and there has been a lack of discussion on addressing this trade-off within a data-free context. In response to these challenges, the authors introduce a novel Data-free Experts-guided Robustness Distillation (DERD) technique to extend robustness distillation to scenarios where data is not available. Experimental results demonstrate the effectiveness of the proposed method.
strength_weakness: strength_weakness: 1. This paper explores data-free adversarial distillation, which has important implications for secure deployment of small models based on privacy considerations.
2. The proposed method implements min-max game on DFARD.
3. This paper attempts to explore the trade-off of accuracy and robustness on DFARD.
limitations: limitations: 1. As a rigorous researcher, we generally use "adversarial example" instead of "adversarial sample".
2. Some descriptions of related work are inaccurate. DeepFool [29] is an optimized white-box attack. 
3. The motivation for the approach is not very clear. This paper introduces a lot of loss function terms, and their motivations are very vague. We believe that the relationship with the challenges of this paper needs to be re-described. In addition, many loss functions are based on existing work, which limits novelty.
4. Ablation experiments for training goals are lacking. The total loss function has 8 sub-terms, which is very difficult to train and determine the parameters. The corresponding coefficients should appear in the main body for reproducibility. Table 5 only provides stage-level ablation, and we do not know whether each sub-item is really effective, especially in Equation 11. In addition, how are the corresponding detailed parameters determined?
5. In addition, how is the trade-off of accuracy and robustness reflected? There is no relevant experiment to explain in the main body.
paper_summary: paper_summary: This paper proposes a robustness distillation method called DRED for scenarios where original data is inaccessible or absent. In general, DRED consists of two stages: a warm-up stage to train a generator for the generation of pseudo data, and a distillation stage for distilling robustness&accuracy from corresponding teacher models to student models.
strength_weakness: strength_weakness: 1. Extensive experimental results validate the effectiveness of DRED in data-free scenarios, surpassing the existing method w.r.t. robustness by a considerable amount.
2. Despite the complexity of DRED, the authors present their methods clearly and logically, making them easy to follow and understand. Illustrations are also intuitively understandable.
3. Experiment designs are reasonable, validating the effectiveness of major modules employed in the paper. Discussion and analysis are also sufficiently conducted.
limitations: limitations: I believe the general quality of the paper is good, but I do have a few concerns/questions:

1. The paper, despite its soundness and solidity, seems to care only about visual tasks, without discussion of any other modality, which might not align with the interest of MM.

2. Stage I seems to be completely driven by the natural teacher model, without justification for the genuine quality of the generated pseudo data. This could be less robust as it relies very much on how well the teacher model captures the distribution of real data, and may easily lead to overfitting. Supplementary docs have confirmed the visual inconsistency between the generated data and real data. Would adopting external supervision on the quality of generated data further boost the performance of DRED? 

3. In the self-adversary stage, the author uses discrepancy data xd for generating adversarial samples. Could the authors please elaborate on how exactly those discrepancy data xd were constructed? I did not find any further details about it.

4. Besides, as mentioned in the paper, the generation of adversarial samples is unbounded and guided by maximizing the discrepancies. Does the optimization incorporate label information to maximize the mislabeling probability? If No, would incorporating label information to guide self-adversary benefit DRED w.r.t. robustness?

5. Training a generator could be time-consuming and challenging, considering the difficulty in convergence for GAN. This could be more problematic for larger and more diverse datasets such as ImageNet. According to the appendix, the result of DRED on ImageNet is not as promising as CIFAR, significantly surpassed by SAT. This could also be the performance degradation because of the quality of generated data.
paper_summary: paper_summary: This paper proposed a dual-level data-free robustness distillation method that can distill robustness to a student model without real data. There exist two stages in the strategy including a warm-up stage for the generator and student model, and a stage to distill robustness and accuracy. Experiments on CIFAR10, CIFAR100 and ImageNet100 are conducted to demonstrate the performance of the method.
strength_weakness: strength_weakness: 1. The paper is well written and easy to follow.
2. The experimental results demonstrate the performance.
limitations: limitations: Several questions need to be addressed:

1. How are the feature statistics of real data acquired in Eq. 8 if the condition is data-free? Did you use the statistical data stored in the batch normalization layers of the teacher model? Were all BN layers involved in Eq. 8?

2. The paper maximizes the output discrepancy between $T_{nat}$ and $T_{rob}$ to create pseudo adversarial data rather than maximizes the loss of $T_{nat}$ or $T_{rob}$ or the student model like AT does. Is there any reason for it and have you tried to train the student model by AT with pseudo data?

3. The paper provides the results on CIFAR10 and CIFAR100. The results on ImageNet100 are in supplementary material. It would be better if the authors can run some comparison methods on ImageNet100 to demonstrate the performance.

4. I wonder if AT is time consuming on ViT. The paper mentioned the robust model is trained for 2000 epochs, what is the training time?

Minor:
1. Probably the equation referenced in Line 630 should be Eq.11 rather than Eq. 10?