R EJECT I LLEGAL I NPUTS : S CALING G ENERATIVE C LASSIFIERS WITH S UPERVISED D EEP I NFOMAX
Anonymous authors
Paper under double-blind review
A BSTRACT
Deep Infomax (DIM) is an unsupervised representation learning framework by maximizing the mutual information between the inputs and the outputs of an encoder, while probabilistic constraints are imposed on the outputs.
In this paper, we propose Supervised Deep InfoMax (SDIM), which introduces supervised probabilistic constraints to the encoder outputs.
The supervised probabilistic constraints are equivalent to a generative classiﬁer on high-level data representations, where class conditional log-likelihoods of samples can be evaluated.
Unlike other works building generative classiﬁers with conditional generative models, SDIMs scale on complex datasets, and can achieve comparable performance with discriminative counterparts.
With SDIM, we could perform classiﬁcation with rejection .
Instead of always reporting a class label, SDIM only makes predictions when test samples’ largest logits surpass some pre-chosen thresholds, otherwise they will be deemed as out of the data distributions, and be rejected.
Our experiments show that SDIM with rejection policy can effectively reject illegal inputs including outof-distribution samples and adversarial examples.
I NTRODUCTION
Non-robustness of neural network models emerges as a pressing concern since they are observed to be vulnerable to adversarial examples (Szegedy et al., 2013; Goodfellow et al., 2014).
Many attack methods have been developed to ﬁnd imperceptible perturbations to fool the target classiﬁers (Moosavi-Dezfooli et al., 2016; Carlini & Wagner, 2017; Brendel et al., 2017).
Meanwhile, many defense schemes have also been proposed to improve the robustnesses of the target models (Goodfellow et al., 2014; Tram ` er et al., 2017; Madry et al., 2017; Samangouei et al., 2018).
An important fact about these works is that they focus on discriminative classiﬁers, which directly model the conditional probabilities of labels given samples.
Another promising direction, which is almost neglected so far, is to explore robustness of generative classiﬁers (Ng & Jordan, 2002).
A generative classiﬁer explicitly model conditional distributions of inputs given the class labels.
During inference, it evaluates all the class conditional likelihoods of the test input, and outputs the class label corresponding to the maximum.
Conditional generative models are powerful and natural choices to model the class conditional distributions, but they suffer from two big problems: (1) it is hard to scale generative classiﬁers on high-dimensional tasks, like natural images classiﬁcation, with comparable performance to the discriminative counterparts.
Though generative classiﬁers have shown promising results of adversarial robustness, they hardly achieve acceptable classiﬁcation performance even on CIFAR10 (Li et al., 2018; Schott et al., 2018; Fetaya et al., 2019).
The behaviors of likelihood-based generative models can be counter-intuitive and brittle.
They may assign surprisingly higher likelihoods to out-of-distribution (OoD) samples (Nalisnick et al., 2018;
Choi & Jang, 2018).
Fetaya et al.
(2019) discuss the issues of likelihood as a metric for density modeling, which may be the reason of non-robust classiﬁcation, e.g. OoD samples detection.
In this paper, we propose supervised deep infomax (SDIM) by introducing supervised statistical constraints into deep infomax (DIM, Hjelm et al.
(2018)), an unsupervised learning framework by maximizing the mutual information between representations and data.
SDIM is trained by optimizing two objectives: (1) maximizing the mutual information (MI) between the inputs and the high-level data representations from encoder; (2) ensuring that the representations satisfy the supervised statistical constraints.
The supervised statistical constraints can be interpreted as a generative classiﬁer on high-level data representations giving up the full generative process.
Unlike full generative models making implicit manifold assumptions, the supervised statistical constraints of SDIM serve as explicit enforcement of manifold assumption: data representations (low-dimensional) are trained to form clusters corresponding to their class labels.
With SDIM, we could perform classiﬁcation with rejection (Nalisnick et al., 2019; Geifman & El-Yaniv, 2017).
SDIMs reject illegal inputs based on off-manifold conjecture (Samangouei et al., 2018; Gu & Rigazio, 2014), where illegal inputs, e.g. adversarial examples, lie far away from the data manifold.
Samples whose class conditionals are smaller than the pre-chosen thresholds will be deemed as off-manifold , and prediction requests on them will be rejected.
The contributions of this paper are :
• We propose Supervised Deep Infomax (SDIM), an end-to-end framework whose probabilistic constraints are equivalent to a generative classiﬁer.
SDIMs can achieve comparable classiﬁcation performance with similar discrinimative counterparts at the cost of small over-parameterization.
• We propose a simple but novel rejection policy based on off-manifold conjecture: SDIM outputs a class label only if the test sample’s largest class conditional surpasses the prechosen class threshold, otherwise outputs rejection .
The choice of thresholds relies only on training set, and takes no additional computations.
• Experiments show that SDIM with rejection policy can effectively reject illegal inputs, including OoD samples and adversarial examples generated by a comprehensive group of adversarial attacks.
B ACKGROUND : D EEP I NFO M AX
Deep InfoMax (DIM, Hjelm et al.
(2018)) is an unsupervised representation learning framework by maximizing the mutual information (MI) of the inputs and outputs of an encoder.
The computation of MI takes only input-output pairs with the deep neural networks based esimator MINE (Belghazi et al., 2018).
Let E φ be an encoder parameterized by φ , working on the training set X
= { x i } Ni =1 , and generating output set Y =
{ E ( x i ) } Ni =1 .
DIM is trained to ﬁnd the set of parameters φ such that: (1) the mutual information I ( X, Y ) is maximized over sample sets X and Y .
(2) the representations, depending on the potential downstream tasks, match some prior distribution.
Denote J and M the joint and product of marginals of random variables X , Y respectively.
MINE estimates a lower-bound of MI with Donsker-Varadhan (Donsker & Varadhan, 1983) representation of KL-divergence:
[Equation]
where T ω ( x, y ) ∈ R is a family of functions with parameters ω represented by a neural network.
Since in representation learning we are more interested in maximizing MI, than its exact value, nonKL divergences are also favorable candidates.
We can get a family of variational lower-bounds using f -divergence representations (Nguyen et al., 2010):
[Equation]
where f ∗ is the Fenchel conjugate of a speciﬁc divergence f .
For KL-divergence, f ∗ ( t ) =
e ( t − 1) .
A full f ∗ list is provided in Tab.
6 of Nowozin et al.
Noise-Contrastive Estimation (Gutmann & Hyv¨arinen, 2010) can also be used as lower-bound of MI in “infoNCE” (Oord et al., 2018) .
S UPERVISED D EEP I NFO M AX
All the components of SDIM framework are summurized in Fig.
The focus of Supervised Deep InfoMax (SDIM) is on introducing supervision to probabilistic constraints of DIM for (generative) classiﬁcation.
We choose to maximize the local MI, which has shown to be more effective in classiﬁcation tasks than maximizing global MI (Hjelm et al., 2018).
Equivalently, we minimize J MI :
[Equation]
where L φ ( x ) is a local M × M feature map of x extracted from some intermediate layer of encoder
E , and ˜ I can be any possible MI lower-bounds.
3. E XPLICIT E NFORCEMENT OF M ANIFOLD A SSUMPTION
By adopting a generative approach p ( x , y )
= p ( y ) p ( x | y ) , we assume that the data follows the manifold assumption : the (high-dimensional) data lies on low-dimensional manifolds corresponding to their class labels.
Denote ˜ x the compact representation generated with encoder E φ ( x ) .
In order to explicitly enforce the manifold assumption , we admit the existence of data manifold in the representation space.
Assume that y is a discrete random variable representing class labels, and p (˜ x | y ) is the real class conditional distribution of the data manifold given y .
Let p θ (˜ x | y ) be the class conditionals we model parameterized with θ .
We approximate p (˜ x | y ) by minimizing the KL-divergence between p (˜ x | y ) and our model p θ (˜ x | y ) , which is given by:
[Equation]
where the ﬁrst item on RHS is a constant independent of the model parameters θ .
Eq.
4 equals to maximize the expectation E ˜ x ,y ∼ p (˜ x ,y )
[log p θ (˜ x | y )] .
In practice, we minimize the following loss J NLL , equivalent to empicically maximize the above expectation over { ˜ x i =
E φ ( x i ) , y i } Ni =1 :
[Equation]
Besides the introduction of supervision, SDIM differs from DIM in its way of enforcing the statistical constraints: DIM use adversarial learning (Makhzani et al., 2015) to push the representations to the desired priors, while SDIM directly maximizes the parameterized class conditional probability.
Maximize Likelihood Margins Since a generative classiﬁer, at inference, decides which class a test input x belongs to according to its class conditional probability.
On one hand, we maximize samples’ true class conditional probabilities (classes they belong to) using J NLL ; On the other hand, we also hope that samples’ false class conditional probabilities (classes they do not belong to) can be minimized.
This is assured by the following likelihood margin loss J LM :
[Equation]
where K is a positive constant to control the margin.
For each encoder output ˜ x
i , the C − 1 truefalse class conditional gaps are squared 1 , which quadratically increases the penalties when the gap becomes large, then are averaged.
Putting all these together, the complete loss function we minimize is:
[Equation]
Parameterization of Class Conditional Probability Each of the class conditional distribution is represented as an isotropic Gaussian.
So the generative classiﬁer is simply a embedding layer with
C entries, and each entry contains the trainable mean and variance of a Gaussian.
This minimized parameterization encourages the encoder to learn simple and stable low-dimensional representations that can be easily explained by even unimodal distributions.
Considering that we maximize the true class conditional probability, and minimize the false class conditional probability at the same time, we do not choose conditional normalizing ﬂows, since the parameters are shared across class labels, and the training can be very difﬁcult.
In Schott et al.
(2018), each class conditional probability is represented with a VAE, thus scaling to complex datasets with huge number of classes, e.g. ImageNet, is almost impossible.
3. D ECISION F UNCTION WITH R EJECTION
A generative approach models the class-conditional distributions p ( x | y ) , as well as the class priors p
( y ) .
For classiﬁcation, we compute the posterior probabilities p ( y | x ) through Bayes’ rule:
[Equation]
The prior p ( y ) can be computed from the training set, or we simply use uniform class prior for all class labels by default.
Then the prediction of test sample x ∗ from posteriors is:
[Equation]
The drawback of the above decision function is that it always gives a prediction even for illegal inputs.
Instead of simply outputting the class label that maximizes class conditional probability of x ∗ , we set a threshold for each class conditional probability, and deﬁne our decision function with rejection to be:
[Equation]
The model gives a rejection when log p ( x ∗ | y ∗ ) is smaller than the threshold δ y ∗ .
Note that here we can use p ( x ∗ | y ∗ ) and p (˜ x ∗ | y ∗ ) interchangeably.
This is also known as selective classiﬁcation (Geifman & El-Yaniv, 2017) or classiﬁcation with reject option (Nalisnick et al., 2019)(See Supp.
A)
R ELATED WORKS
Robustness of Likelihood-based Generative Models Though likelihood-based generative models have achieved great success in samples synthesis, the behaviors of their likelihoods can be counter-intuitive.
Flow-based models (Kingma & Dhariwal, 2018) and as well as VAEs (Kingma & Welling, 2013), surprisingly assign even higher likelihoods to out-of-distribution samples than the samples in the training set (Nalisnick et al., 2018; Choi & Jang, 2018).
Pixel-level statistical analyses in Nalisnick et al.
(2018) show that OoD dataset may “sit inside of” the in-distribution dataset (i.e. with roughly the same mean but smaller variance).
Off-Manifold Conjecture Grosse et al.
(2017) observe that adversarial examples are outside the training distribution via statistical testing.
DefenseGAN (Samangouei et al., 2018) models real data distribution with the generator G of GAN.
At inference, instead of feeding the test input x to the target classiﬁer directly, it searches for the “closest” sample G ( z ∗ ) from generator distribution to x as the ﬁnal input to the classiﬁer.
It ensures that the classiﬁer only make predictions on the data manifold represented by the generator, ruling out the potential adversarial perturbations in x .
PixelDefend
(Song et al., 2017) takes a similar approach which uses likelihood-based generative model - PixelCNN to model the data distribution.
Both DefenseGAN and PixelDefend are additionally trained as peripheral defense schemes agnostic to the target classiﬁers.
Training generative models on complex datasets notoriously takes huge amount of computational resources (Brock et al., 2018).
In contrast, the training of SDIM is computationally similar to its discriminative counterpart.
The veriﬁcation of whether inputs are offmanifold is a built-in property of the SDIM generative classiﬁer.
The class conditionals of SDIM are modeled on low-dimensional data representations with simple Gaussians, which is much easier, and incurs very small computations.
E XPERIMENTS
Datasets We evaluate the effectiveness of the rejection policy of SDIM on four image datasets:
MNIST, FashionMNIST (both resized to 32 × 32 from 28 × 28 ); and CIFAR10, SVHN.
See App.
B. for details of data processing.
For out-of-distribution samples detection, we use the dataset pairs on which likelihood-based generative models fail (Nalisnick et al., 2018; Choi & Jang, 2018): FashionMNIST (in)-MNIST (out) and CIFAR10 (in)-SVHN (out).
Adversarial examples detection are evaluated on MNIST and CIFAR10.
Choice of thresholds It is natural that choosing thresholds based on what the model knows, i.e. training set, and can reject what the model does not know, i.e. possible illegal inputs.
We set one threshold for each class conditional.
For each class conditional probability, we choose to evaluate on two different thresholds: 1st and 2nd percentiles of class conditional log-likelihoods of the correctly classiﬁed training samples.
Compared to the detection methods proposed in Li et al.
(2018), our choice of thresholds is much simpler, and takes no additional computations.
Models A typical SDIM instance consists of three networks: an encoder, parameterized by φ , which outputs a d -dimensional representation; mutual information evaluation networks, i.e. T ω in
Eqn.
(1) and Eqn.
(2); and C -way class conditional embedding layer, parameterized by θ , with each entry a 2 d -dimensional vector.
We set d = 64 in all our experiments.
For encoder of SDIM, we use ResNet (He et al., 2016) on 32 × 32 with a stack of 8 n + 2 layers, and 4 ﬁlter sizes { 32, 64, 128, 256 } .
The architecture is summarized as: output map size 32 ×16 ×8 × [Table] [Table] # layers 1 + 2 n 2 n 2 n 2 n #
[Table]
The last layer of encoder is a d -way fully-connected layer.
To construct a discriminative counterpart, we simply set the output size of the encoder’s last layer to C for classiﬁcation.
We use
ResNet10 ( n = 1) on MNIST, FashionMNIST, and ResNet26 ( n = 3) on CIFAR10, SVHN.
5. E VALUATION ON C LEAN D ATA
We report the classiﬁcation accuracies (see Tab. 1) of SDIMs and the discriminative counterparts on clean test sets .
Results show that SDIMs achieve the same level of accuracy as the discriminative counterparts with slightly increased number of parameters (17% increase for ResNet10, and 5% increase for ResNet26).
We are aware of the existence of better results reported on these datasets using more complex models (Huang et al., 2017; Han et al., 2017) or automatically designed architectures (Cai et al., 2018), but pushing the state-of-the-art is not the focus of this paper.
[Table]
Is Fully Generative Model Necessary for Generative Classiﬁcation?
In the evaluations of Li et al.
and Schott et al.
(2018), both model class conditional probability with VAE (Kingma & Welling, 2013; Rezende et al., 2014), and achieve acceptable accuracies ( > 98% ) on MNIST.
However, it is hard for fully conditional generative models to achieve satisfactory classiﬁcation accuracies even on CIFAR10.
On CIFAR10, methods in Li et al.
(2018) achieve only < 50% accuracy.
They also point out that the classiﬁcation accuracy of a conditional PixelCNN++ (Salimans et al., 2017) is only 72 . 4% .
The test accuracy of ABS in (Schott et al., 2018) is only 54% .
In contrast,
SDIM could achieve almost the same performance with similar discriminative classiﬁer by giving up the full generative process, and building generative classiﬁer on high-level representations.
Li et al.
(2018) improves the accuracy to 92% by feeding the features learned by powerful discriminative classiﬁer-VGG16 (Simonyan & Zisserman, 2014) to their generative classiﬁers, which also suggests that modeling likelihood on high-level representation (features) is more favorable for generative classiﬁcation than pixel-level likelihood of fully generative classiﬁers.
For classiﬁcation tasks, discovering discriminative features is much more important than reconstructing the all the image pixels.
Thus performing generative classiﬁcation with full generative models may not be the right choice.
Decision with Rejection We also investigate the implications of the proposed decision function with rejection under different thresholds.
The results in Tab. 2 show that choosing a higher percentile as threshold will reject more prediction requests.
At the same time, the classiﬁcation accuracies of
SDIM on the left test sets become increasingly better.
This demonstrate that out rejection policy tend to reject the ones on which SDIMs make wrong predictions.
[Table]
We report the rejection rates of the test sets and the accuracies on the left test sets for each threshold.
5. O UT - OF -D ISTRIBUTION S AMPLES D ETECTION
Class-wise OoD detections are performed, and mean detection rates over all in-distribution classes are reported in Tab. 3.
For each in-distribution class c , we evaluate the log-likelihoods of the whole
OoD dataset.
Samples whose log-likelihoods are lower the class threshold δ c will be detected as
OoD samples.
Same evaluations are applied on conditional Glows with 10th percentile thresholds, but the results are not good.
The results are clear and conﬁrm that SDIMs, generative classiﬁers on high-level representations, are more effective on classiﬁcation tasks than fully conditional generative models on raw pixels.
Note that fully generative models including VAE used in Li et al.
Schott et al.
(2018) fail on OoD detection.
The stark difference between SDIM and full generative models (ﬂows or VAEs) is that SDIM models samples’ likelihoods in the high-level representation spaces, while generative models evaluate directly on the raw pixels. See Supp.
C for more results about the histograms of the class conditionals of in-out distributions.
[Table]
R OBUSTNESS AGAINST A DVERSARIAL E XAMPLES AND D
We comprehensively evaluate the robustness of SDIMs against various attacks:
• gradient-based attacks: one-step gradient attack FGSM (Goodfellow et al., 2014), its iterative variant projected gradient descent (PGD, Kurakin et al.
; Madry et al.
(2017)), CW- L 2 attack (Carlini & Wagner, 2017), deepfool (Moosavi-Dezfooli et al., 2016).
• score-based attacks: local search attack (Narodytska & Kasiviswanathan, 2016).
• decision-based attack: boundary attack (Brendel et al., 2017).
Attacks Using Cross-Entropy We ﬁnd that SDIMs are much more robust to gradient-based attacks using cross-entropy, e.g. FGSM and PGD, since the gradients numerically vanish as a side effect of the likelihood margin loss J LM of SDIM.
This phenomenon is similar to some defences that try to hinder generations of adversarial examples by masking the gradients on inputs.
While full generative classiﬁers in Li et al.
(2018) still suffer from these attacks.
See Supp.
D.1 for detailed results.
Conservative Adversarial Examples Adversarial attacks aim to ﬁnd the minimal perturbations that sufﬁciently change the classiﬁcation labels, i.e. ﬂip other logits to be the largest one.
We show case examples on MNIST generated by untargeted attacks and their logits in Tab.
(See Supp.
D. for examples of CIFAR10).
Though these attacks successfully ﬂip the logits, they are designed to be conservative to avoid more distortions to the original images.
As a result, the largest logits of adversarial examples are still much lower than the thresholds, so they can be detected by our rejection policy.
We ﬁnd that our rejection policy performs perfectly on MNIST, but fails to detect all adversarial examples on CIFAR10 except for Boundary attack (See Tab. 5).
It seems to be a well-known observation that models trained on CIFAR10 are more vulnerable than one trained on
MNIST.
Gilmer et al.
(2018) connects this observation to the generalization of models.
They found that many test samples, though correctly classiﬁed, are close to the misclassﬁed samples, which implies the existence of adversarial examples.
If a model has higher error rate, it would take smaller perturbations to move correctly classiﬁed samples to misclassiﬁed areas
[Table]
Adversarial examples with more conﬁdence Based on the observations above, a natural question we should ask is: can we generate adversarial examples with not only successfully ﬂipped logits,
[Table]
We perform targeted CW attacks with conﬁdences κ = { 0 , 500 , 1000 } (Tab. 6).
We ﬁnd that increasing the conﬁdences help increasing the largest logits of adversarial examples to some extent, but may lead to failures of generation.
The sensitivity to conﬁdence values is also different given different targets.
The success rates of generating adversarial examples monotonically decreases with the conﬁdences increasing (Tab. 7).
Note that on discriminative counterparts, CW- L 2 with the same settings easily achieves 100% success rates.
This means that explicitly forcing data representations to form clusters with maximum margins between them help increase average distances between normal samples and the nearest misclassiﬁed areas, thus increase the hardness of ﬁnding minimal adversarial perturbations .
In this case, it takes a large enough adversarial perturbation to move a sample from its cluster to the other.
Meanwhile, detection rates remain satisfactory on MNIST, but obviously decline on CIFAR10.
For victim generative classiﬁers in (Li et al., 2018) under CW- Lattack, the detection rates of adversarial examples using the proposed detection methods can be > 95% on MNIST, but fall < 50% on even CIFAR10-binary (their models don’t scale on CIFAR10, and CW- L 2 with non-zero conﬁdences are also not evaluated) [Table] [Table]
Discussions on off-manifold conjecture Gilmer et al.
(2018) challenges whether the off-manifold conjecture holds in general.
They experiment on synthetic dataset-two high-dimensional concentric spheres with theoretical analyses, showing that even for a trained classiﬁer with close to zero test error, there may be a constant fraction of the data manifold misclassiﬁed, which indicates the existence of adversarial examples within the manifold.
But there are still several concerns to be addressed:
First, as also pointed out by the authors, the manifolds in natural datasets can be quite complex than that of simple synthesized dataset.
Fetaya et al.
(2019) draws similar conclusion from analyses on synthesized data with particular geometry.
So the big concern is whether the conclusions in Gilmer et al.
; Fetaya et al.
(2019) still hold for the manifolds in natural datasets.
A practical obstacle to verify this conclusion is that works modeling the full generative processes are based on manifold assumption, but provide no explicit manifolds for analytical analyses like Gilmer et al.
Fetaya et al.
While SDIM enables explicit and customized manifolds on high-level data representations via probabilistic constraints, thus enables analytical analyses.
In this paper, samples of different classes are trained to form isotropic Gaussians corresponding to their classes in representation space (other choices are possible).
The relation between the adversarial robustness and the forms and dimensionalities of data manifolds is to be explored.
Second, in their experiments, all models evaluated are discriminative classiﬁers.
Considering the recent promising results of generative classiﬁers against adversarial examples, would using generative classiﬁers lead to different results?
One thing making us feel optimistic is that even though the existence of adversarial examples is inevitable, Gilmer et al.
(2018) suggest that adversarial robustness can be improved by minimizing the test errors, which is also supported by our experimental differences on MNIST and
CIFAR10.
C ONCLUSIONS
We introduce supervised probabilistic constraints to DIM.
Giving up the full generative process,
SDIMs are equivalent to generative classiﬁers on high-level data representations.
Unlike full conditional generative models which achieve poor classiﬁcation performance even on CIFAR10, SDIMs attain comparable performance as the discriminative counterparts on complex datasets.
The training of SDIM is also computationally similar to discriminative classiﬁers, and does not require prohibitive computational resources.
Our proposed rejection policy based on off-manifold conjecture, a built-in property of SDIM, can effectively reject illegal inputs including OoD samples and adversarial examples.
We demonstrate that likelihoods modeled on high-level data representations, rather than raw pixel intensities, are more robust on downstream tasks without the requirement of generating real samples.
A C LASSIFICATION WITH R EJECTION
A very related work to our paper is (Nalisnick et al., 2019), which propose a hybrid model modeling distribution of features p ( features ) and predictive distribution p ( targets | features ) at the same time.
Normalizing ﬂow is used to learn invertible features as inputs of discriminative model, i.e. predictive distribution, and provides evaluation of features x ∗ .
Inputs out of the training data distribution are rejected by setting a threshold for p ( x ∗ ) .
For SDIM, illagel inputs are rejected by setting thresholds for each of the class conditional.
The class conditionals are modeled on the data representations from encoder regularized by MI loss J MI .
The hybrid model in Nalisnick et al.
(2019) can successfully distinguish in-distribution dataset and OoD dataset.
While SDIM reject illegal inputs including OoD dataset samples and adversarial examples with more ﬁne-grained class conditionals.
Geifman & El-Yaniv (2017) propose a selection method to perform selective classiﬁcation with desired risk level given a trained model, but they focus on discriminative models.
B E VALUATION D ETAILS B. D ATA P ROCESSING
• MNIST, FashionMNIST: All images are resized to 32 × 32 from 28 × 28 .
We scale the images pixels to [0 , 1] , and normalization is not used for fair comparisons with the baselines in (Li et al., 2018).
• CIFAR10, SVHN:
We follow the simple data augmentation in (He et al., 2016) for training: 4 pixels are padded on each side, and a 32 × 32 crop is randomly sampled from the padded image or its horizontal ﬂip.
For testing, we only evaluate the single view of the original 32 × 32 image.
All image pixels are also scaled to [0 , 1] .
No other data augmentations or processings are used except for the explicitly listed above.
B. M ODELS AND T RAINING S ETTINGS
MI computation The local MI J MI is computed between the 4 × 4 feature maps and the encoder outputs.
We use lower-bound of Jensen-Shannon divergence to estimate the MI I JSD
( X, Y ) , and leave other lower-bounds unexplored.
In practice, we ﬁnd using other bounds would take more computational resources.
However, we think better results can be expected if using these bounds according to the experimental results reported in Hjelm et al.
MI evaluation network Following Hjelm et al.
(2018), we parameterize the MI evaluation network T ω as a 1 × 1 convolutional neural network with architecture:
[Table]
The input of T ω is positive or negative pair of local feature map L φ ( x ) and encoder output E φ ( x ) .
The positive pairs, samples from the joint distribution, are constructed by concat the encoder output
E φ ( x ) and the corresponding feature map L φ ( x ) of the given batch.
The negative pairs, samples from product of marginals, can be constructed by E φ ( x ) and shufﬂed L φ ( x ) along the batch-axis.
Optimization We set α = β = γ = 1 in our experiments.
The constant K in the likelihood margin loss J LM is 10.
All models are trained 500 epochs, and we always save the checkpoints reporting the minimum ongoing training losses for evaluation.
We use optimizer Adam (Kingma &
Ba, 2014) with default learning rate 0.001.
C A DDITIONAL R ESULTS OF O UT - OF - DISTRIBUTION D ETECTION
D A DDITIONAL R ESULTS OF A DVERSARIAL E VALUATIONS D. R OBUSTNESS AGAINST ATTACKS USING CROSS - ENTROPY
We make comparisons between SDIM and GBZ (Li et al., 2018), which consistently performs best in Deep Bayes .
FGSM and PGD- L ∞
The results in Fig 4 and Fig 5 show that SDIM performs consistently better than the baseline.
We ﬁnd that increasing the distortion factor (cid:15) of FGSM has no inﬂuences of
SDIM’s accuracy, and the adversarial examples keep the same.
Recall that the class conditionals are optimized to keep a considerable margin.
Before evaluating the cross entropy loss, softmax is applied on the class conditionals log p ( x | c ) to generate a even sharper distribution.
So for the samples that are correctly classiﬁed, their losses are numerically zeros, and the gradient on inputs ∇ J x ( x , y ) are also numerically zeros.
The PGD- L ∞ we use here is the randomized version (Madry et al., 2017) 2 , which adds a small random perturbation before the iterative loop.
The randomness is originally introduced to generate different adversarial examples for adversarial training, but here it breaks the zero loss so that the gradient on inputs ∇ J x ( x , y ) will not be zeros in the loop.
FGSM can also be randomized (Tram`er et al., 2017), which can be seen as a one-step variant of randomized
PGD.
This phenomena is similar to what some defenses using gradient obfuscation want to achieve.
Defensive distillation (Carlini & Wagner, 2016) masks the gradients of cross-entropy by increasing the temperature of softmax.
But for CW attacks, which do not use cross-entropy, and operate on logits directly, this could be ineffective.
D. A DVERSARIAL EXAMPLES OF CIFAR
[Table]
[Table]
[Table]
original
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
-326.4 CW- L129.
-326.4 Boundary 213.
[Table]
LocalSearch
[Table]