Original: Eﬃcient Calculation of Adversarial Examples for Bayesian Neural Networks
Revised: Eﬃcient Calculation of Adversarial Examples for Bayesian Neural Networks

Original: Anonymous Authors

Original: Anonymous Institution

Original: Abstract
Revised: Abstract

Original: Calculating adversarial examples for Bayesian neural networks is cumbersome.
Revised: Calculating adversarial examples for Bayesian neural networks is cumbersome.

Original: Due to the inherent stochasticity, the gradient of the network can only be reliable approximated by sampling multiple times from the posterior, leading to a greatly increased computational cost.
Revised: Due to the inherent stochasticity, the gradient of the network can only be reliable approximated by sampling multiple times from the posterior, leading to a greatly increased computational cost.

Original: In this paper we propose to eﬃciently attack Bayesian neural networks with adversarial examples calculated for a deterministic network with parameters given by the mean of the posterior distribution.
Revised: In this paper we propose to eﬃciently attack Bayesian neural networks with adversarial examples calculated for a deterministic network with parameters given by the mean of the posterior distribution.

Original: We show in a series of experiments, that the proposed approach can be used to eﬀectively attack Bayesian neural networks while using 4.2 times less of the resources of existing adversarial example estimation methods with comparable strength.
Revised: We show in a series of experiments, that the proposed approach can be used to eﬀectively attack Bayesian neural networks while using 4.2 times less of the resources of existing adversarial example estimation methods with comparable strength.

Original: We demonstrate that this is especially helpful during adversarial training, when multiple diﬀerent model conﬁguration need to be evaluated
Revised: We demonstrate that this is especially helpful during adversarial training, when multiple diﬀerent model conﬁguration need to be evaluated.

Original: 1. Introduction
Revised: 1. Introduction

Original: Machine learning is ubiquitous.
Revised: Machine learning is ubiquitous.

Original: Starting from breakthroughs in computer vision (Krizhevsky et al., 2012; He et al., 2016) and natural language processing (Collobert and Weston, 2008); machine learning systems have evolved to play games at human level (Silver et al., 2016;
Revised: Starting from breakthroughs in computer vision (Krizhevsky et al., 2012; He et al., 2016) and natural language processing (Collobert and Weston, 2008); machine learning systems have evolved to play games at human level (Silver et al., 2016;

Original: Vinyals et al., 2019; Mnih et al., 2015), leverage drug discovery (Senior et al., 2020), recognize speech at the level of human listeners (Ram et al., 2017), and drive cars (Shankland, 2019).
Revised: Vinyals et al., 2019; Mnih et al., 2015), leverage drug discovery (Senior et al., 2020), recognize speech at the level of human listeners (Ram et al., 2017) and drive cars (Shankland, 2019).

Original: Given the inﬂuence on more and more parts of human live, the existence of adversarial examples (AEs) (Biggio et al., 2014; Szegedy et al., 2014) is worrisome.
Revised: Given the inﬂuence on more and more parts of human live, the existence of adversarial examples (AEs) (Biggio et al., 2014; Szegedy et al., 2014) is worrisome.

Original: These small perturbations, added to benign inputs, cause even state-of-the-art models to misbehave.
Revised: These small perturbations, added to benign inputs, cause even state-of-the-art models to misbehave.

Original: Recent work suggest Bayesian neural networks (BNNs) (Neal, 1995) as a more robust alternative (Feinman et al., 2017; Gal and Smith, 2018;
Revised: Recent work suggest Bayesian neural networks (BNNs) (Neal, 1995) as a more robust alternative (Feinman et al., 2017; Gal and Smith, 2018;

Original: Liu et al., 2019; Bekasov and Murray, 2018).
Revised: Liu et al., 2019; Bekasov and Murray, 2018).

Original: Carbone et al.
Revised: Carbone et al.

Original: (2020) even show that under certain assumptions the gradient has zero expectation under the posterior distribution and hence any gradient based attack in the limit is ineﬀective.
Revised: (2020) even show that under certain assumptions the gradient has zero expectation under the posterior distribution and hence any gradient based attack in the limit is ineﬀective.

Original: Despite these theoretical eﬀorts BNNs have successfully been attacked by taking multiple samples from the posterior distribution to approximate their gradient as proposed as a general attack strategy for networks with stochastic gradients (Athalye et al., 2018; Zimmermann, 2019).
Revised: Despite these theoretical eﬀorts BNNs have successfully been attacked by taking multiple samples from the posterior distribution to approximate their gradient as proposed as a general attack strategy for networks with stochastic gradients (Athalye et al., 2018; Zimmermann, 2019).

Original: While eﬀective, this approach is computationally costly.
Revised: While eﬀective, this approach is computationally costly.

Original: This is less of a problem for a malicious actor, since they simply need to ﬁnd one AE to serve their purpose.
Revised: This is less of a problem for a malicious actor, since they simply need to ﬁnd one AE to serve their purpose.

Original: Yet, from the defending parties point of view, evaluating several diﬀerent models with regards to adversarial robustness can quickly become a costly endeavor.
Revised: Yet, from the defending parties point of view, evaluating several diﬀerent models with regards to adversarial robustness can quickly become a costly endeavor.

Original: This cost is severely multiplied in the context of adversarial training (Madry et al., 2017), where adversarial examples are used in the training process to generate robust models.
Revised: This cost is severely multiplied in the context of adversarial training (Madry et al., 2017), where adversarial examples are used in the training process to generate robust models.

Original: Recognizing these problems, we introduce MEAN —an eﬃcient way to compute AEs for
Revised: Recognizing these problems, we introduce MEAN —an eﬃcient way to compute AEs for

Original: BNNs, which can easily be adopted to other types of stochastic networks.
Revised: BNNs, which can also be adopted to other types of stochastic networks.

Original: Our approach employs the means of the weight distribution as the parameters of a deterministic network of equal architecture.
Revised: Our approach employs the means of the posterior distribution as the parameters of a deterministic network of equal architecture.

Original: We then employ this network to estimate AEs which are then used to attack the original BNN.
Revised: We then employ this network to estimate AEs which are then used to attack the original BNN.

Original: In a ﬁrst experiment, we demonstrate that MEAN can be used to generate eﬀective AEs while using substantially fewer resources than existing approaches.
Revised: In a ﬁrst experiment, we demonstrate that MEAN can be used to generate eﬀective AEs while using substantially fewer resources than existing approaches.

Original: In a second experiment, we evaluate MEAN in the setting of adversarial training, where a computational eﬃcient method allows a defending party to evaluate multiple diﬀerent models with a much smaller computational budget.
Revised: In a second experiment, we evaluate MEAN in the setting of adversarial training, where a computational eﬃcient method allows a defending party to evaluate multiple diﬀerent models with a much smaller computational budget.

Original: 2. Background and Approach
Revised: 2. Background and Approach

Original: Notation: We denote with D = { ( x i , y i ) ni =1 } the training data where x i are inputs, y i the corresponding outputs and θ the network’s parameters.
Revised: Notation: We denote with D = { ( x i , y i ) n i =1 } the training data where x i are inputs, y i the corresponding outputs and θ the network’s parameters.

Original: 2.1. Background
Revised: 2.1. Background

Original: Bayesian neural networks serve as a mathematical quantiﬁed way to capture model uncertainty by marginalizing over the posterior distribution of the network’s parameters:
Revised: Bayesian neural networks serve as a mathematical quantiﬁed way to capture model uncertainty by marginalizing over the posterior distribution of the network’s parameters:

Original: [Equation]
Revised: [Equation]

Original: where the last approximation is the Monte Carlo approximation of this intractable integral.
Revised: where the last approximation is the Monte Carlo approximation of this intractable integral.

Original: Central to the training of BNNs is the derivation of the posterior distribution p ( θ |D ).
Revised: Central to the training of BNNs is the derivation of the posterior distribution p ( θ |D ).

Original: In this work we use variational inference (Graves, 2011; Kingma et al., 2015; Louizos and
Revised: In this work we use variational inference (Graves, 2011; Kingma et al., 2015; Louizos and

Original: Welling, 2016) where the true posterior is approximated via a simpler distribution q ( θ ) by maximizing the so called evidence lower bound (ELBO):
Revised: Welling, 2016) where the true posterior is approximated via a simpler distribution q ( θ ) by maximizing the so called evidence lower bound (ELBO):

Original: [Equation]
Revised: [Equation]

Original: where the last term is the Kullback-Leibler divergence between the approximate posterior and some prior distribution.
Revised: where the last term is the Kullback-Leibler divergence between the approximate posterior and some prior distribution.

Original: Adversarial examples are manipulated inputs aiming at changing the networks’ behavior.
Revised: Adversarial examples are manipulated inputs aiming at changing the networks’ behavior.

Original: They are created by adding a well-calibrated perturbation δ to a benign input.
Revised: They are created by adding a well-calibrated perturbation δ to a benign input.

Original: One of the simplest methods to determine this δ is the Fast Gradient Sign Method (FGSM)
Revised: One of the simplest methods to determine this δ is the Fast Gradient Sign Method (FGSM)

Original: (Goodfellow et al., 2015), in which the AE is created by adding an (cid:15) -step into the direction of the gradient sign of some loss function L , e.g.:
Revised: (Goodfellow et al., 2015), in which the AE is created by adding an (cid:15) -step into the direction of the gradient sign of some loss function L , e.g.:

Original: [Equation]
Revised: [Equation]

Original: In practice the δ is usually limited by an L p -norm to avoid changing the benign input too much.
Revised: In practice the δ is usually limited by an L p -norm to avoid changing the benign input too much.

Original: Improving FSGM, Projected Gradient Decent (PGD) (Madry et al., 2017) is an iterative attack which iterativly applies FGSM with a smaller stepsize than (cid:15) .
Revised: Improving FGSM, Projected Gradient Decent (PGD) (Madry et al., 2017) is an iterative attack which iterativly applies FGSM with a smaller stepsize than (cid:15) .

Original: To calculate AE for BNNs, multiple draws from the posterior are needed for reliably approximating the stochastic gradient.
Revised: To calculate AE for BNNs, multiple draws from the posterior are needed for reliably approximating the stochastic gradient.

Original: For the FGSM attack this results in:
Revised: For the FGSM attack this results in:

Original: [Equation]
Revised: [Equation]

Original: In this work, we use the loss function introduced by Carlini and Wagner (2017) instead of the more commonly used cross-entropy loss.
Revised: In this work, we use the loss function introduced by Carlini and Wagner (2017) instead of the more commonly used cross-entropy loss.

Original: The loss function is given by
Revised: The loss function is given by

Original: [Equation]
Revised: [Equation]

Original: where Z ( x , θ ) t is an arbitrary logit of an output node for input x and parameters θ .
Revised: where Z ( x , θ ) t is an arbitrary logit of an output node for input x and parameters θ .

Original: We noticed that our networks often saturated the softmax function, i.e., the networks were so conﬁdent in their prediction that the probability of the correct class eﬀectively reached 1.
Revised: We noticed that our networks often saturated the softmax function, i.e., the networks were so conﬁdent in their prediction that the probability of the correct class eﬀectively reached 1.

Original: This resulted in us being unable to calculate gradients.
Revised: This resulted in us being unable to calculate gradients.

Original: However, since the Carlini-Wagner loss function operates on the logits of the classiﬁer, it enables the creation of adversarial examples.
Revised: However, since the Carlini-Wagner loss function operates on the logits of the classiﬁer, it enables the creation of adversarial examples.

Original: 2.2. Approach
Revised: 2.2. Approach

Original: Our approach aims at reducing the cost of sampling from the posterior while at the same time generating a strong attack.
Revised: Our approach aims at reducing the cost of sampling from the posterior while at the same time generating a strong attack.

Original: This is done by transforming the stochastic gradients in eq.
Revised: This is done by transforming the stochastic gradients in eq.

Original: (4) to deterministic ones by treating the BNN as a standard neural network where the posterior means serve as the weights value.
Revised: (4) to deterministic ones by treating the BNN as a standard neural network where the posterior means serve as the weights value.

Original: We refer to this scheme of replacing the stochastic neural network with a deterministic one as MEAN .
Revised: We refer to this scheme of replacing the stochastic neural network with a deterministic one as MEAN .

Original: Note that this approach does not restrict the set of possible adversarial attacks.
Revised: Note that this approach does not restrict the set of possible adversarial attacks.

Original: Under MEAN eq.
Revised: Under MEAN eq.

Original: (4) reduces to:
Revised: (4) reduces to:

Original: [Equation]
Revised: [Equation]

Original:  Note the similarity of our approach to the rescaling of weights in dropout networks (Srivastava et al., 2014), where weights are scaled to have the same expectation under the droprate during testing as during training.
Revised: [Equation] Note the similarity of our approach to the rescaling of weights in dropout networks (Srivastava et al., 2014), where weights are scaled to have the same expectation under the droprate during testing as during training.

Original: 3. Experiments
Revised: 3. Experiments

Original: In this section we evaluate the beneﬁts of the MEAN scheme for creating AEs, in two settings: as an attack and during adversarial training.
Revised: In this section we evaluate the beneﬁts of the MEAN scheme for creating AEs, in two settings: as an attack and during adversarial training.

Original: We ﬁrst describe the general experimental setting in Section 3.1 and compare the eﬀectiveness of adversarial attacks conducted with
Revised: We ﬁrst describe the general experimental setting in Section 3.1 and compare the eﬀectiveness of adversarial attacks conducted with

Original: MEAN in Section 3.2.
Revised: MEAN in Section 3.2.

Original: Finally, in Section 3.3 we leverage the MEAN approach in the context of adversarial training.
Revised: Finally, in Section 3.3 we leverage the MEAN approach in the context of adversarial training.

Original: 3.1. Experiment Setup
Revised: 3.1. Experiment Setup

Original: In our experiments we use the MNIST and Fashion MNIST data sets (LeCun et al., 1998;
Revised: In our experiments we use the MNIST and Fashion MNIST data sets (LeCun et al., 1998;

Original: Xiao et al., 2017), both consisting of 60,000 training and 10,000 test images of size 28 ×labeled as one out of 10 classes.
Revised: Xiao et al., 2017), both consisting of 60,000 training and 10,000 test images of size 28 ×labeled as one out of 10 classes.

Original: We trained two diﬀerent CNN networks 1 using mean ﬁeld  variational inference and Adam (Kingma et al., 2015) as the optimizer.
Revised: We trained two diﬀerent CNN networks 1 using mean ﬁeld [Figure] variational inference and Adam (Kingma et al., 2015) as the optimizer.

Original: All our experiments are conducted on a Nvidia Quadro RTX 5000 graphic card.
Revised: All our experiments are conducted on a Nvidia Quadro RTX 5000 graphic card.

Original: AEs are generated using the FGSM and PGD (with 10 iteration steps) methods with varying perturbation strengths.
Revised: AEs are generated using the FGSM and PGD (with 10 iteration steps) methods with varying perturbation strengths.

Original: Note that during the evaluation we refer to the FGSM attack computed over 10 samples drawn from the posterior as FGSM-10 (15 samples—
Revised: Note that during the evaluation we refer to the FGSM attack computed over 10 samples drawn from the posterior as FGSM-10 (15 samples—

Original: FGSM-15; and so forth).
Revised: FGSM-15; and so forth).

Revised: Further, we always approximate the Bayesian predictive integral by 50 samples from the posterior.

Revised: Due to the inherent stochasticity we repeat all experiments 20 times

Original: [Figure]
Revised: [Figure]

Revised: reporting the calculated mean as well as standard deviation in form of error bars for our results.

Original: 3.2. Generating Adversarial Examples
Revised: 3.2. Generating Adversarial Examples

Original: In this section we want to evaluate whether AEs generated by the MEAN scheme are comparable to examples generated by sampling from the posterior.
Revised: In this section we want to evaluate whether AEs generated by the MEAN scheme are comparable to examples generated by sampling from the posterior.

Original: Additionally, we will also evaluate the computational cost associated with the diﬀerent approaches
Revised: Additionally, we will also evaluate the computational cost associated with the diﬀerent approaches.

Original: [Figure] We generate 1,000 AE for (cid:15) ∈ { 0.05, 0.07, 0.09, 0.11, 0.13, 0.17, 0.25 } and report themean accuracy. The resultsare depict in Figure 1.
Revised: We generate 1,000 AE for (cid:15) ∈ { 0.05, 0.07, 0.09, 0.11, 0.13, 0.17, 0.25 } and depict the results in Figure 1.

Original: When compared to the FGSM attack, MEAN is competitive up to sampling ﬁve (MNIST)  or seven (Fashion MNIST) times from the posterior.
Revised: When compared to the FGSM attack, MEAN is competitive up to sampling ﬁve (MNIST) 2 or seven (Fashion MNIST) times from the posterior.

Original: We independently measured how long it takes to convert a batch of images to AEs, by converting 10,000 batches and computing the average time.
Revised: We independently measured how long it takes to convert a batch of images to AEs, by converting 10, batches and computing the average time.

Original: The full results can be found in Table 2 in Appendix B. For MNIST, MEAN takes about 88ms to convert a single batch while FGSM-5 takes about 366ms, an increase in 315.91 %.
Revised: The full results can be found in Table 2 in Appendix C. For MNIST, MEAN takes about 88ms to convert a single batch while FGSM-5 takes about 366ms, an increase in 315.91 %.

Original: The results are mirrored for Fashion MNIST, where FGSM-7 requires around 554 % more time; proving that MEAN can be used to approximate computationally more expensive attacks.
Revised: The results are mirrored for Fashion MNIST, where FGSM-7 requires around 554 % more time; proving that MEAN can be used to approximate computationally more expensive attacks.

Original: When compared to the PGD attack, MEAN is stronger than PGD-1.
Revised: When compared to the PGD attack, MEAN is stronger than PGD-1.

Original: It is on par with
Revised: It is on par with

Original: PGD-2 on Fashion MNIST, but otherwise outperformed.
Revised: PGD-2 on Fashion MNIST, but otherwise outperformed.

Original: While surprising at ﬁrst, we hypothesize that PGD, by its iterative nature, approximates the stochastic gradient quite well.
Revised: While surprising at ﬁrst, we hypothesize that PGD, through iterative sampling, approximates the stochastic gradient quite well.

Original: Since PGD is essentially iterated FGSM, at each iteration we draw a new sample from the posterior.

Original: Thus, even PGD-1  can intuitively be thought of as sampling 10 times from the posterior (for 10 iteration steps).
Revised: Thus, even PGD-1 with 10 iteration steps can therefore be thought of as sampling 10 times from the posterior.

Original: Note, we exclusively used FGSM to generate the AEs with the MEAN scheme.
Revised: Note [Figure] we exclusively used FGSM to generate the AEs with the MEAN scheme.

Original: During our experiments we discovered that using PGD in conjunction with the deterministic network created by the MEAN scheme would overﬁt to this speciﬁc network, resulting in worse overall performance.
Revised: During our experiments we discovered that using PGD in conjunction with the deterministic network created by the MEAN scheme would overﬁt to this speciﬁc network [Figure] resulting in worse overall performance.

Original: 3.3. Adversarial Training
Revised: 3.3. Adversarial Training

Original: [Figure]
Revised: [Figure]

Original: , 15 } draws from the posterior. A higher accuracy stands for a higher robustness against adversarial attacks. We include the accuracy of a normal trained network for reference (Baseline). Best viewed in color.
Revised: [Table]

Original: As demonstrated in Section 3.2 the mean attack leads to signiﬁcantly stronger adversarial examples than computational equivalent attacks.
Revised: As demonstrated in Section 3.2 the MEAN attack leads to signiﬁcantly stronger adversarial examples than computational equivalent attacks.

Original: While the resource overhead of drawing multiple samples might be condoned by an attacker, this practice would be infeasible if a defending party wants to compare multiple models. Thus, we evaluate the eﬀectiveness of
Revised: While the resource overhead of drawing multiple samples might be condoned by an attacker, this practice would be infeasible if a defending party wants to compare multiple model architectures and hyperparameter combinations.

Original: MEAN in the context of adversarial training. Prior work suggest  using the strongest attack possible results in more robust models (Madry et al., 2017).
Revised: Even though prior work suggest that using the strongest attack possible results in more robust models (Madry et al., 2017), sampling multiple times can quickly become infeasible.

Original: However, in practice, often multiple model architecture and hyperparameter combinations have to be evaluated on diﬀerent data sets.

Original: Thus, sampling multiple times quickly becomes infeasible.

Original: Additionally, robustness often requires a trade-oﬀ in regards to accuracy (Tsipras et al., 2019), leading to evaluating even more combinations[Table] in practice.
Revised: Additionally, robustness often requires a trade-oﬀ in regards to accuracy (Tsipras et al., 2019), leading to evaluating even more combinations in practice.

Original: In this scenario MEAN can serve as a good approximation of stronger training techniques.
Revised: In this scenario MEAN can serve as a good approximation of stronger training techniques.

Original: It can be used in the early stages of development to gauge the resistanceof networks to adversary examples, while the ﬁnal model can be trained with the strongest attack possible.
Revised: It can be used in the early stages of development to gauge the resistance to adversary examples, while the ﬁnal model can be trained with the strongest attack possible.

Original: We train multiple networks using diﬀerent techniques to get a thorough understanding of how well we can utilize MEAN for training adversarial robust networks.
Revised: We train multiple networks using diﬀerent techniques to get a thorough understanding of how well we can utilize MEAN for training adversarial robust networks.

Original: We calculate adversarial examples on-the-ﬂy during the training process, mixing “normal” and adversarial samples, i.e., with probability 0 .
Revised: We calculate adversarial examples on-the-ﬂy during the training process, mixing “normal” and adversarial samples, i.e., with probability 0 .

Original: 3 we convert the current training batch to a batch of adversarial examples.
Revised: 3 we convert the current training batch to a batch of adversarial examples.

Original: The results can be found in Figure 2.
Revised: The results can be found in Figure 2.

Original: We plot the accuracy of diﬀerent training schemes when attacked with PGD in diﬀerent sample conﬁgurations ( { 5, 15 } ).
Revised: We plot the accuracy of diﬀerent training schemes when attacked with PGD in diﬀerent sample conﬁgurations ( { 5, 15 } ).

Original: Additionally, we provide the time it took to train the strongest models in Table 1 (a full table can be found in Appendix C).
Revised: Additionally, we provide the time it took to train the strongest models in Table 1 (a full table can be found in Appendix D).

Original: We can observe that
Revised: We can observe that

Original: MEAN can reliably approximate more costly techniques.
Revised: MEAN can reliably approximate more costly techniques.

Original: It is only consistently outperformed by PGD-5 and PGD-10.
Revised: It is only consistently outperformed by PGD-5 and PGD-10.

Original: Which require up to 956 % of the resources.
Revised: Which require up to 956 % of the resources.

Original: Note that we only use adversarial examples in 30 % of the training, if we would supply the adversarial examples more often the discrepancy would be even higher.
Revised: Note that we only use adversarial examples in 30 % of the training, if we would supply the adversarial examples more often the discrepancy would be even higher.

Original: 4. Conclusion
Revised: 4. Conclusion

Original: Stochastic neural networks, like the here examined Bayesian neural networks(BNNs), incorporate an inherent gradient masking eﬀect during the calculation of adversarial examples.
Revised: Bayesian neural networks incorporate an inherent gradient masking eﬀect during the calculation of adversarial examples due to their stochastic nature.

Original: Circumventing this masking comes at the cost of drawing multiple samples from the posterior for calculating the gradient.
Revised: Circumventing this masking comes at the cost of drawing multiple samples from the posterior for calculating the gradient.

Original: In this paper we proposed a simple and eﬃcient solution to avoid the computational burden for BNNs, called MEAN .
Revised: In this paper we proposed a simple and eﬃcient solution to avoid the computational burden for BNNs, called MEAN .

Original: In this scheme, we transfer the BNN into a deterministic network, of equal architecture, by using the posterior means as weight values.
Revised: In this scheme, we transfer the BNN into a deterministic network, of equal architecture, by using the posterior means as weight values.

Original: In our experiments we found that using the MEAN scheme results in attacks as eﬃcient as those produced by taking multiple samples from the gradient.
Revised: In our experiments we found that using the MEAN scheme results in attacks as eﬃcient as those produced by taking multiple samples from the gradient.

Original: Further, we found that MEAN has a high impact during adversarial training where is is only outperformed by PGD-5 and PGD-10, which require up to 956 % of the resources.
Revised: Further, we found that MEAN has a high impact during adversarial training where it is only outperformed by PGD-5 and PGD-10, which require up to 956 % of the resources.

Original: Our ﬁndings suggest, that MEAN serves as a simple and cheap baseline for calculating adversarial examples.
Revised: Our ﬁndings suggest, that MEAN serves as a simple and cheap baseline for calculating adversarial examples.

Original: Therefore, MEAN is especially relevant during hyperparamerter tuning, extensive model comparison or costly network evaluations. 
Revised: Therefore, MEAN is especially relevant during hyperparamerter tuning, extensive model comparison or costly network evaluations. Acknowledgments

Revised: We would like to thank our colleagues Lea Sch¨onherr, Thorsten Eisenhofer and our anonymous reviewers for their valuable feedback and fruitful discussions.

Revised: This work was supported by the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) under Germany’s Excellence Strategy – EXC-2092 CaSa – 390781972.

Original: Appendix
Revised: Appendix

Original: For the sake of completeness we extend this work by describing the implementation and adding further details on computational time for the results depict in the main part.
Revised: For the sake of completeness we extend this work by describing the implementation and adding further details on computational time for the results depict in the main part.

Original: A. Network Architecture
Revised: A. Network Architecture

Original: The networks are constructed using pyro 1.3 and are based on the work of Carbone et al.
Revised: The networks are constructed using pyro 1.3 and are based on the work of Carbone et al.

Original: For training the models we used mean ﬁeld variational inference with standard
Revised: For training the models we used mean-ﬁeld variational inference with standard

Original: Gaussian distributions as priors.
Revised: Gaussian distributions as priors.

Original: We used ADAM (Kingma and Ba, 2015) as our optimizer with an initial learning rate of 0.01 (MNIST) and 0.001(Fashion MNIST).
Revised: We used ADAM (Kingma and Ba, 2015) as our optimizer with an initial learning rate of 0.01 (MNIST) and 0.001(Fashion MNIST).

Original: Further, we trained for 5 (MNIST) and 10 (Fashion MNIST) epochs with a batch size of 128 for both data sets.
Revised: Further, we trained for 5 (MNIST) and 10 (Fashion MNIST) epochs with a batch size of 128 for both data sets.

Original: As our activation function we used the Leaky ReLu function (Xu et al., 2015) with a negative slope of 0.01 throughout the network.
Revised: As our activation function we used the Leaky ReLu function (Xu et al., 2015) with a negative slope of 0.01 throughout the network.

Original: [Equation]
Revised: [Equation]

Original: Fashion MNIST
Revised: Fashion MNIST

Original: [Equation]
Revised: [Equation]

Original: The network architecture for our simple CNN.
Revised: The network architecture for our simple CNN.

Original: We report in brackets:
Revised: We report in brackets:

Original: For convolution layers the amounts of feature maps learned, for dense layers the amount of hidden units, and, for pooling layers the amount of stride.
Revised: For convolution layers the amounts of feature maps learned, for dense layers the amount of hidden units, and, for pooling layers the amount of stride.

Original: We use exclusively max-pooling with a kernel size of two.
Revised: We use exclusively max-pooling with a kernel size of two.

Original: B. Time Required to Create Adversarial Examples
Revised: B. Analyzing the Gradient Direction

Revised: In this section we want to investigate how accurate the approximation of MEAN is in comparison with sampling from the posterior. To this end, for a given image, we ﬁrst obtain a ground truth gradient by sampling 100 times from the posterior. We then calculate how often the gradient entriespoint in the same direction as gradient entries obtained by using

Revised: MEAN and sampling { 1 , 5 , 10 , 20 } -times from the posterior.

Revised: We investigate the model trained on MNIST and report the result for 1,000 test images.

Revised: We summarize our ﬁndings in Figure 3.

Revised: For MEAN around 70% of the gradient entries have the same sign as the baseline.

Revised: This outperforms gradients based on { 1 , 5 , 10 } samples which is in line with the results from Section 3.

Revised: The outliers in the plot are caused by examples where the gradient entries were either zero everywhere for the ground truth and/or the objects of interest.

Revised: We hypothesize that these observation are caused by model structure in coherence to the ﬁndings of Carbone et al.

Revised: C. Time Required to Create Adversarial Examples

Original: In this Section we report the time it took for converting AEs with diﬀerent techniques.
Revised: In this section we report the time it took for converting AEs with diﬀerent techniques.

Original: We convert a batch of images 10,000 times and average over all runs.
Revised: We convert a batch of images 10,000 times and average over all runs.

Original: [Table]
Revised: [Table]

Original: C. Training Time for Adversarial Training
Revised: D. Training Time for Adversarial Training

Original: In this Section we report the time it took to adversarialy train a network given the technique used to create AEs.
Revised: In this section we report the time it took to adversarially train a network given the technique used to create AEs.

Original: it took to train a model in seconds and the increase relative to the MEAN in brackets
Revised: it took to train a model in seconds and the increase relative to the MEAN in brackets

Original: [Table]
Revised: [Table]