summaries: This study aims at distilling feature representations (mainly the last convolution layer) into robust and non-robust features using information bottleneck. For every layer, the feature maps are partitioned into robust and non-robust for each individual example. After finding this, the paper first illustrates that selectively propagating robust features of adversarial examples built for a robust network will not degrade the accuracy but propagating non-robust features does which to some extent illustrates that the information bottleneck method has correctly identified the robust and non robust features. They also illustrate that the adversarial class label has high correlation to the Non-robust features.  This paper categorizes the intermediate features of a DNN into robust ones and non-robust ones. Through visualization, the non-robust ones display different semantic information from the true label, and thus potentially leads to the existence of AE.  The paper proposes a new AE generation algorithm targeting the non-robust feature, and beats the common attack baselines. This work utilizes an Information Bottleneck (IB) to distill robust and non-robust features in neural networks (NNs). Experiments are performed to show that the distilled features are correlated with adversarial prediction and are human-perceptible. Finally, an attack mechanism intensifying the gradient of non-robust features is proposed. The paper proposes to explicitly separate intermediate representation into robust and non-robust categories by information bottleneck, and demonstrate that the non-robust feature is related to adversarial prediction. An attack mechanism based on enforcing non-robust features gradient is proposed. The experimental results show the effectiveness of the proposed approach.  This paper focuses on robust and non-robust features in adversarial examples. This paper proposes a method of distilling robust and non-robust features via information bottleneck. Through analysis, this paper has shown the high correlation between the distilled features and the adversarial prediction. Based on that, the authors design a new attack that intensifies the gradient of non-robust features.
abstractText: Adversarial examples, generated by carefully crafted perturbation, have attracted considerable attention in research fields. Recent works have argued that the existence of the robust and non-robust features is a primary cause of the adversarial examples, and investigated their internal interactions in the feature space. In this paper, we propose a way of explicitly distilling feature representation into the robust and non-robust features, using Information Bottleneck. Specifically, we inject noise variation to each feature unit and evaluate the information flow in the feature representation to dichotomize feature units either robust or non-robust, based on the noise variation magnitude. Through comprehensive experiments, we demonstrate that the distilled features are highly correlated with adversarial prediction, and they have human-perceptible semantic information by themselves. Furthermore, we present an attack mechanism intensifying the gradient of non-robust features that is directly related to the model prediction, and validate its effectiveness of breaking model robustness.
authors.name: Junho Kim
authors.name: Byung-Kwan Lee
authors.name: Yong Man Ro
references.authors: C. Szegedy W. Zaremba I. Sutskever J. Bruna D. Erhan I. Goodfellow R. Fergus
references.title: Intriguing properties of neural networks
references.venue: International Conference on Learning Representations (ICLR), 2014.
references.authors: I.J. Goodfellow J. Shlens C. Szegedy
references.title: Explaining and harnessing adversarial examples
references.venue: International Conference on Learning Representations (ICLR), 2015.
references.authors: P.-Y. Chen H. Zhang Y. Sharma J. Yi C.-J. Hsieh
references.title: Zoo: Zeroth order optimization based blackbox attacks to deep neural networks without training substitute models
references.venue: ACM Workshop on Artificial Intelligence and Security, 2017.
references.authors: N. Carlini D. Wagner
references.title: Towards evaluating the robustness of neural networks
references.venue: 2017 IEEE Symposium on Security and Privacy (SP), pp. 39–57, IEEE Computer Society, 2017.
references.authors: N. Papernot P. McDaniel I.J. Goodfellow S. Jha Z.Y. Celik A. Swami
references.title: Practical black-box attacks against machine learning
references.venue: ACM ASIA Conference on Computer and Communications Security (ACM ASIACCS), 2017.
references.authors: K. Eykholt I. Evtimov E. Fernandes B. Li A. Rahmati C. Xiao A. Prakash T. Kohno D. Song
references.title: Robust physical-world attacks on deep learning visual classification
references.venue: Conference on Computer Vision and Pattern Recognition (CVPR), pp. 1625–1634, 2018.
references.authors: A. Madry A. Makelov L. Schmidt D. Tsipras A. Vladu
references.title: Towards deep learning models resistant to adversarial attacks
references.venue: International Conference on Learning Representations (ICLR), 2018. 10
references.authors: G. Apruzzese M. Colajanni L. Ferretti M. Marchetti
references.title: Addressing adversarial attacks against security systems based on machine learning
references.venue: International Conference on Cyber Conflict (CyCon), vol. 900, pp. 1–18, IEEE, 2019.
references.authors: X. Wang J. Li X. Kuang Y. an Tan J. Li
references.title: The security of machine learning in an adversarial setting: A survey
references.venue: Journal of Parallel and Distributed Computing, vol. 130, pp. 12 – 23, 2019.
references.authors: Y.E. Sagduyu Y. Shi T. Erpek
references.title: Iot network security from the perspective of adversarial deep learning
references.venue: International Conference on Sensing, Communication, and Networking (SECON), pp. 1–9, 2019.
references.authors: I. Rosenberg A. Shabtai Y. Elovici L. Rokach
references.title: Adversarial learning in the cyber security domain
references.venue: arXiv preprint arXiv:2007.02407, 2020.
references.authors: A. Shafahi W.R. Huang C. Studer S. Feizi T. Goldstein
references.title: Are adversarial examples inevitable
references.venue: International Conference on Learning Representations (ICLR), 2018.
references.authors: L. Schmidt S. Santurkar D. Tsipras K. Talwar A. Madry
references.title: Adversarially robust generalization requires more data
references.venue: Neural Information Processing Systems (NeurIPS), 2018.
references.authors: D. Tsipras S. Santurkar L. Engstrom A. Turner A. Madry
references.title: Robustness may be at odds with accuracy
references.venue: International Conference on Learning Representations (ICLR), 2019.
references.authors: A. Ilyas S. Santurkar D. Tsipras L. Engstrom B. Tran A. Madry
references.title: Adversarial examples are not bugs, they are features
references.venue: Neural Information Processing Systems (NeurIPS), vol. 32, 2019.
references.authors: L. Engstrom J. Gilmer G. Goh D. Hendrycks A. Ilyas A. Madry R. Nakano P. Nakkiran S. Santurkar B. Tran D. Tsipras E. Wallace
references.title: A discussion of ’adversarial examples are not bugs, they are features
references.venue: Distill, 2019. https://distill.pub/2019/advex-bugs-discussion.
references.authors: N. Tishby F.C. Pereira W. Bialek
references.title: The information bottleneck method
references.venue: Proc. of the 37-th Annual Allerton Conference on Communication, Control and Computing, pp. 368–377, 1999.
references.authors: A. Alemi I. Fischer J. Dillon K. Murphy
references.title: Deep variational information bottleneck
references.venue: International Conference on Learning Representations (ICLR), 2017.
references.authors: K. Schulz L. Sixt F. Tombari T. Landgraf
references.title: Restricting the flow: Information bottlenecks for attribution
references.venue: International Conference on Learning Representations (ICLR), 2019.
references.authors: M.D. Zeiler R. Fergus
references.title: Visualizing and understanding convolutional networks
references.venue: European Conference on Computer Vision (ECCV), pp. 818–833, Springer, 2014.
references.authors: J. Yosinski J. Clune T. Fuchs H. Lipson
references.title: Understanding neural networks through deep visualization
references.venue: International Conference on Machine Learning Workshop on Deep Learning, Citeseer.
references.authors: D. Bau B. Zhou A. Khosla A. Oliva A. Torralba
references.title: Network dissection: Quantifying interpretability of deep visual representations
references.venue: Conference on Computer Vision and Pattern Recognition (CVPR), pp. 6541–6549, 2017.
references.authors: C. Olah A. Satyanarayan I. Johnson S. Carter L. Schubert K. Ye A. Mordvintsev
references.title: The building blocks of interpretability
references.venue: Distill, 2018. https://distill.pub/2018/building-blocks.
references.authors: L. Engstrom A. Ilyas S. Santurkar D. Tsipras B. Tran A. Madry
references.title: Adversarial robustness as a prior for learned representations
references.venue: arXiv preprint arXiv:1906.00945, 2019.
references.authors: C. Olah A. Mordvintsev L. Schubert
references.title: Feature visualization
references.venue: Distill, vol. 2, no. 11, p. e7, 2017.
references.authors: S. Kullback R.A. Leibler
references.title: On information and sufficiency
references.venue: The annals of mathematical statistics, vol. 22, no. 1, pp. 79–86, 1951.
references.authors: C.-J. Simon-Gabriel Y. Ollivier L. Bottou B. Schölkopf D. Lopez-Paz
references.title: First-order adversarial vulnerability of neural networks and input dimension
references.venue: International Conference on Machine Learning (ICML), pp. 5809–5817, PMLR, 2019.
references.authors: C. Qin J. Martens S. Gowal D. Krishnan K. Dvijotham A. Fawzi S. De R. Stanforth P. Kohli
references.title: Adversarial robustness through local linearization
references.venue: Neural Information Processing Systems (NeurIPS), vol. 32, 2019.
references.authors: K. Simonyan A. Zisserman
references.title: Very deep convolutional networks for large-scale image recognition
references.venue: International Conference on Learning Representations (ICLR), 2015. 11
references.authors: S. Zagoruyko N. Komodakis
references.title: Wide residual networks
references.venue: British Machine Vision Conference (BMVC), 2016.
references.authors: L. Van der Maaten G. Hinton
references.title: Visualizing data using t-sne
references.venue: Journal of machine learning research, vol. 9, no. 11, 2008.
references.authors: A. Krizhevsky G. Hinton
references.title: Learning multiple layers of features from tiny images
references.venue: 2009.
references.authors: Y. Netzer T. Wang A. Coates A. Bissacco B. Wu A.Y. Ng
references.title: Reading digits in natural images with unsupervised feature learning
references.venue: 2011.
references.authors: Y. Le X. Yang
references.title: Tiny imagenet visual recognition challenge
references.venue: CS 231N, vol. 7, p. 7, 2015.
references.authors: R. Fong A. Vedaldi
references.title: Net2vec: Quantifying and explaining how concepts are encoded by filters in deep neural networks
references.venue: Conference on Computer Vision and Pattern Recognition (CVPR), pp. 8730–8738, 2018.
references.authors: S. Kaur J. Cohen Z.C. Lipton
references.title: Are perceptually-aligned gradients a general property of robust classifiers
references.venue: NeurIPS Workshop: Science Meets Engineering of Deep Learning (NeurIPS SEDL), 2019.
references.authors: D. Erhan Y. Bengio A. Courville P. Vincent
references.title: Visualizing higher-layer features of a deep network
references.venue: University of Montreal, vol. 1341, no. 3, p. 1, 2009.
references.authors: A. Nguyen J. Yosinski J. Clune
references.title: Understanding neural networks via feature visualization: A survey
references.venue: Explainable AI: interpreting, explaining and visualizing deep learning, pp. 55–76, Springer, 2019.
references.authors: A. Mahendran A. Vedaldi
references.title: Understanding deep image representations by inverting them
references.venue: Conference on Computer Vision and Pattern Recognition (CVPR), pp. 5188–5196, 2015.
references.authors: A. Kurakin I.J. Goodfellow S. Bengio
references.title: Adversarial machine learning at scale
references.venue: International Conference on Learning Representations (ICLR), 2017.
references.authors: F. Croce M. Hein
references.title: Reliable evaluation of adversarial robustness with an ensemble of diverse parameterfree attacks
references.venue: International Conference on Machine Learning (ICML), 2020.
references.authors: F. Croce M. Hein
references.title: Minimally distorted adversarial examples with a fast adaptive boundary attack
references.venue: Proceedings of the 37th International Conference on Machine Learning (H. D. III and A. Singh, eds.), vol. 119 of Proceedings of Machine Learning Research, pp. 2196–2205, PMLR, 13–18 Jul 2020.
references.authors: H. Zhang Y. Yu J. Jiao E. Xing L. El Ghaoui M. Jordan
references.title: Theoretically principled trade-off between robustness and accuracy
references.venue: International Conference on Machine Learning (ICML), pp. 7472–7482, PMLR, 2019.
references.authors: Y. Wang D. Zou J. Yi J. Bailey X. Ma Q. Gu
references.title: Improving adversarial robustness requires revisiting misclassified examples
references.venue: International Conference on Learning Representations (ICLR), 2020.
references.authors: N. Inkawhich K. Liang L. Carin Y. Chen
references.title: Transferable perturbations of deep feature distributions
references.venue: International Conference on Learning Representations (ICLR), 2019.
references.authors: J.-H. Jacobsen J. Behrmann R. Zemel M. Bethge
references.title: Excessive invariance causes adversarial vulnerability
references.venue: International Conference on Learning Representations (ICLR), 2018.
references.authors: V.A. Banks K.L. Plant N.A. Stanton
references.title: Driver error or designer error: Using the perceptual cycle model to explore the circumstances surrounding the fatal tesla crash on 7th may 2016
references.venue: Safety Science, vol. 108, pp. 278–285, 2018.
references.authors: V. Antun F. Renna C. Poon B. Adcock A.C. Hansen
references.title: On instabilities of deep learning in image reconstruction and the potential costs of ai
references.venue: Proceedings of the National Academy of Sciences, 2020. 12
sections.heading: 1 Introduction
sections.text: Deep neural networks (DNNs) have achieved remarkable performances in a wide variety of machine learning tasks. Despite the breakthrough outcomes, DNNs are easily fooled from adversarial attacks, with crafted perturbations [1, 2, 3, 4, 5, 6, 7]. These perturbations are imperceptible to human eyes, but simply adding them to clean images (i.e., adversarial examples) can effectively deceive classifiers. Such a vulnerability affects security problems [8, 9, 10, 11], bringing in the weak reliability of DNNs.
  Previous works have broadly investigated the reason for the widespread of such adversarial examples. Goodfellow et al. [2] have argued that adversarial vulnerability is induced from the excessive linearity nature of DNNs in high-dimensional spaces. Several works [1, 12] have regarded the primary cause of the adversarial examples as statistical variation with aberrations in data manifold. Schmidt et al. [13] have suggested that the pervasiveness of the examples should not be considered as a drawback of training methods for DNNs, since the available dataset may not be large enough to train them robustly.
  In recent years, Tsipras et al. [14] have suggested an intriguing analysis that the disagreement between standard and adversarial accuracy stems from differently trained feature representation. In this literature, Ilyas et al. [15] further have demonstrated the adversarial examples are inevitable results of standard supervised training and arisen from well-generalized features in the dataset. They have analyzed the adversarial examples are originated from brittle and unintelligible features (i.e., non-robust features) that are arbitrarily manipulated with the imperceptible noise, and shown that the
  ∗Equal contribution. † Corresponding author.
  35th Conference on Neural Information Processing Systems (NeurIPS 2021).
  robust features still can provide precise accuracy even in the existence of adversarial perturbation. They have argued that the non-robust features cannot show reliable accuracy in the adversarial setting and could provoke incomprehensible properties.
  Nonetheless, the underlying reason for the existence and pervasiveness of adversarial examples cannot derive common consensus in the research field and still remains unclear [16]. To clarify where the adversarial brittleness truly comes from, we need to figure out how the robust and non-robust features in data manifold subtly manipulate feature representation and fool model prediction, by directly handling them in the feature space. To address it, we propose a way to precisely distill intermediate features into robust and non-robust features by employing Information Bottleneck (IB) [17, 18, 19]. In the sense that semantic information is included in the units of intermediate feature representation [20, 21, 22, 23], we utilize the bottleneck to regulate the information flow in the feature space by explicitly adding noise to the feature units. Then, we estimate how each feature unit contaminated with the noise affects model prediction with assigned information. Based on the prediction sensitivity of the noise intervention, we assort the feature units either robust or brittle, and disentangle the feature representation into robust or non-robust features, respectively.
  Through extensive analysis of the distilled features, we corroborate that the pervasiveness of the adversarial brittleness is derived from the non-robust features, and they have a high correlation with the adversarial prediction. In addition, in order to understand the semantic information of distilled features, we directly visualize them in the feature space and provide their visual interpretation. Consequently, we reveal that both of the robust and non-robust features indeed have semantic information in terms of human-perception by themselves. Based on our observation, we theoretically describe the negative impact of the non-robust features for the model prediction and introduce an approach of amplifying the gradients of non-robust features to break the model prediction.
  In this paper, our contributions can be summarized into three-fold as follows:
  • We propose a novel way to explicitly distill intermediate features into the robust and nonrobust features using Information Bottleneck, and interpret the disentangled features in terms of human-perception by directly visualizing them in the feature space.
  • By analyzing how the distilled features affect the intermediate feature representation under adversarial perturbation, we demonstrate that the non-robust features are highly correlated with the adversarial prediction.
  • We present an attack mechanism manipulating the non-robust features by strengthening their gradients, and validate its effectiveness of breaking model prediction.
sections.heading: 2 Distilling Robust and Non-robust Features in Intermediate Feature Space
sections.text: Problem Setup and Notations. Let X denote clean images and Y denote (one-hot encoded) target labels corresponding to the clean images. Then, adversarial examples Xadv can be created by the following equations: max
  δ E(X,Y )[L(f(X + δ), Y )], where δ denotes an adversarial perturbation,
  and L denotes a pre-defined loss for machine learning tasks. The adversarial examples can be made by Xadv = X + δ. When a given model f is adversarially trained against PGD attack [7], it can be written as follows:
  min w max ‖δ‖∞≤γ
  E(X,Y ) [L (f(X + δ), Y )] , (1)
  where w represents the parameters of f , which are learned to be robust against adversarial attacks. Here, ‖·‖∞ ≤ γ describes L∞ norm, and γ-ball means the perturbation magnitude. In this paper, we adversarially train the model f on γ = 0.03 for the standard adversarial attack. Note that once adversarially trained, the parameters of the model f are no longer covered.1
  As notation of variables that we will use in this paper, Z and Z̄ indicate the intermediate features of the model f such that Z = fl(X) and Z̄ = fl(Xadv), where fl(·) describes l-th layer outputs of the given model. Similarly, fl+(·) represents subsequent network after the l-th layer, thus intermediate features can be propagated to the last output layer, such that Ŷ = fl+(Z) and Ŷadv = fl+(Z̄). The
  1Previous works [14, 15] have demonstrated that the distinction between the robust and non-robust features arises in adversarial settings. In the sense that adversarially trained networks learn robust representation [24], we set the robust classifier as default. Please see the analysis of the standard training in Appendix F.
  model f can be expressed as f = fl+ ◦ fl, satisfying Ŷ = f(X) for the given clean images X . Also, Ŷadv = f(Xadv) is denoted by model propagation of the adversarial examples Xadv. Note that we designate l-th layer as the last convolutional layer, and regard l+ as the rest of the layers in the model.
sections.heading: 2.1 Information Bottleneck for Distilling Informative Features
sections.text: In adversarial settings, we focus on separating robust and non-robust features in the intermediate layer. Recall that robust features are literally robust on the noise (variation) and invariant to the existence of the adversarial perturbation, but non-robust features are not. Our approach aims to distill feature units that affect target prediction under the noise perturbation in the intermediate feature space.
  We follow that the semantic information is inherently included in the feature units of DNNs [20, 22, 25]. From this perspective, we utilize Information Bottleneck (IB) to distill the robust and non-robust features on the given intermediate features Z. Information Bottleneck [17, 18] proposed to encode maximally informative representation for target labels, restraining input information, concurrently. Using the bottleneck, we suggest a way to assess feature importance and quantify information flow for the target prediction. The objective function of IB can be written as follows:
  max Z
  I(Z, Y )− βI(Z,X), (2)
  where I denotes mutual information, and β represents the degree of restraining input information. The first term I(Z, Y ) allows the intermediate features Z to be predictive on the target label Y , and the second term I(Z,X) encourages Z to compress the information of the given images X in the bottleneck. Here, the second term requires a true feature probability p(Z) = ∫ X p(Z | X)p(X)dX to expand it, but it is computationally intractable due to a high dimensional dependency of the dataset probability p(X). Thus, several works [18, 19] modified the IB’s objective function to make it possible to learn DNNs without the true feature probability as follows: minLCE + βLI (see Appendix B). In this formulation, LCE indicates cross-entropy loss, and LI represents information loss computed by KL divergence [26] between a feature likelihood p(Z | X) and an approximate feature probability q(Z). It is radically a closed-form approximation for the true feature probability p(Z).
  Firstly, we deliberately inject noise variation into Z to estimate the prediction sensitivity of each feature unit along the noise intervention. To do so, we newly design an approximate feature probability using noise variation σ, such that qσ(Z) = N (fl(X), σ2). Then, we sample random variables from qσ(Z) and define informative features ZI as follows:
  ZI = fl(X) + σ · , (3) where ZI ∼ qσ(Z). Note that the operator · denotes Hadamard product, and stands for Gaussian noise sampled from N (0, I). Here, the noise variation measures a correlation between intermediate features and model prediction based on the fact that robustness means high correlation on model prediction and non-robustness are opposite [14, 15] in adversarial settings. Since the correlation E(X,Y )[Y ·f(X)] in output layer can be expressed as a variance measure Cov(Y, f(X)), we consider the correlation in intermediate layer as the noise variation. From this perspective, if a feature unit is
  highly predictive despite large noise variation (high correlation), the unit can robustly predict target labels, while a non-robust unit cannot.
  Once the informative features ZI are acquired from the noise variation σ, we propagate ZI to the last output layer and estimate the feature importance of each unit for model prediction. Then, we deal with the information loss LI in order to alleviate feature heterogeneity between Z and ZI . Through aforementioned modification [18, 19], our objective function can be written as follows:
  min σ LX(σ) = −Y log fl+(fl(X) + σ · )︸ ︷︷ ︸
  LCE
  +β DKL[p(Z | X) || qσ(Z)]︸ ︷︷ ︸ LI , (4)
  where the feature likelihood p(Z | X) is set to N (fl(X), σ2z). Here, σz indicates inherent feature variation of the intermediate features Z for each unit. The second term LI makes the informative features ZI resemble the intermediate features Z, while minimizing the cross-entropy LCE . This second term can be written as LI = 12 ∑C k=1[ σ2zk σ2k + log σ2k σ2zk − 1], where k denotes an index of the noise variation σ = [σ1, σ2, · · · , σC ] (the optimizing parameters) and the feature variation σz = [σz1 , σz2 , · · · , σzC ] (the given parameters). Here, only of the variation σ is updated such that σ ← σ − ∂∂σLX(σ). In brief, we summarize overall procedure of our bottleneck concept in Fig. 1. Moreover, we mention that β in Eq. (4) controls the amount of information that flows into the feature representation. Specifically, when β is set to zero, IB loss is equivalent to cross-entropy loss, which means that ZI can accommodate even unimportant features to predict target labels. In contrast, excessively large β only focuses on compressing input information, thus IB may cannot filter out important features to predict target labels. Accordingly, we empirically control β to distill informative features ZI based on the noise variation σ (Please see section 3.4 for analysis of information flow).
sections.heading: 2.2 Separating Informative Features by Tolerance of Feature Variation
sections.text: After optimizing the informative features ZI , we compare the noise variation σ for the informative feature units and dichotomize each unit either robust or non-robust based on their prediction sensitivity. We set the criterion for comparison as T = max(σ2z). Here, T represents the maximum tolerance of the noise variation. It is a reasonable choice to set T as a criterion, because it indicates the maximal variation with respect to the changes of the given image X , in the feature space. In the following procedure, we explicitly disentangle intermediate features Z into the robust Zr and non-robust features Znr.
  Firstly, once the noise variation σ is larger than the maximum tolerance T in specific units, it indicates that their corresponding features are highly predictive on the model prediction, despite the noise intervention. Thus, we define their conjunction as robust features. On the other hand, if the variation of a specific unit is smaller than T , their corresponding features can be represented as non-robust features. This is because the small variation behaves as a strict restriction to retain model prediction of target labels. We assume that once a strong adversarial perturbation comes in, the feature variation of non-robust features becomes to be larger than acceptable tolerance, thereby easily breaking the model classifier and leading to misclassified prediction. In this respect, we sort the noise variation according to their magnitude, and cluster them by assigning robust or non-robust channel indexes to each feature unit. The robust channel index, ir = [ir1 , ir2 , · · · , irC ] can be computed as follows:
  irk = 1(σ 2 k > T ) = { 1 σ2 > T 0 σ2 ≤ T , (5)
  where 1(·) represents the indicator function. The non-robust channel index inr is simply reversed from the robust channel index such that inrk = 1 − irk . Then, we estimate robust features Zr by multiplying the robust channel index to the intermediate features element-wisely such that Zr = ir ·Z. Similarly, non-robust features Znr are presented as Znr = inr · Z. In this way, the intermediate features Z are fully disentangled into the two types of feature representation satisfying Z = Zr+Znr.
  To sum it up, we regard the robust features Zr that have the larger noise variation as invariant features from the adversarial perturbation. On the other hand, non-robust features Znr are considered as easily manipulated features, which harmonize the smaller noise variation. Now, we analyze their impacts to the robustness by expanding the model prediction of ZI to Taylor approximation (see Appendix C.)
  with its convergence of local minima [27, 28] as follows:
  fl+(fl(X) + σ · ) = fl+(fl(X) + σr · ) + [ ∂
  ∂σr fl+(fl(X) + σr · ) ]T σnr︸ ︷︷ ︸
  ∆
  , (6)
  where robust noise variation σr = ir · σ and non-robust noise variation σnr = inr · σ. Since the variation of the robust features does not degrade the model prediction, when σnr is small enough, the erroneous term ∆ in Eq. (6) closes to zero. That is, the model retains having significant robustness against the adversarial perturbation interrupting robust channel index in Z. Conversely, once we force σnr to increase, its output becomes inaccurate for the robust prediction (i.e., first term in Eq. (6)) due to high ∆. Here, we theoretically demonstrate how the brittleness of non-robust features affects the model robustness. We will thoroughly analyze the properties of the two distilled features by empirically showing the robustness of Zr and brittleness of Znr in the following sections.
sections.heading: 3 Analysis of Distilled Features and Visual Interpretation
sections.heading: 3.1 Property of Distilled Feature Units under Adversarial Perturbation
sections.text: After we distill the robust and non-robust features using the bottleneck concept, our next question is How will the target prediction change under the adversarial attacks? In our posit, if the bottleneck successfully disentangles the robust and non-robust channel index (i.e., ir and inr) from the given examples, we should identify the consequential classification accuracy changes under the adversarial perturbation. That is, after applying the robust index to the attacked feature representation, the selected adversarial features with ir denoted by Z̄r (i.e., Z̄r = ir · Z̄) should have invariant accuracy changes for the target labels. Here, ir is robust channel index obtained from the given clean examples X , and Z̄ represents the intermediate features of the adversarial examples, which means Z̄ = fl(Xadv). Contrarily, the selected features satisfying Z̄nr = inr · Z̄ will show inaccurate accuracy due to their brittleness under the existence of adversarial perturbation.
  In Table 1, we analyze evaluation results of the disentangled features under standard attack algorithms [2, 4, 7] in publicly available datasets [32, 33, 34]. As aforementioned, we apply the robust and non-robust channel index optimized from the clean examples to the adversarial features Z̄, and estimate their accuracy (i.e., fl+(Z̄r) and fl+(Z̄nr)). As in the table, Z̄r still shows constant robust accuracy regardless of the adversarial perturbation, even in the high-confidence adversarial attack [4]. On the other hand, we can find that the classification accuracy of Z̄nr steeply degrades as the attacks get stronger, which coincides with the properties of the robust and non-robust features. To further support our experiments, we illustrate the correlation between the disentangled features and true labels, using 2D t-SNE plot [31]. In the case of clean examples as in Fig. 2(a), the robust features Zr exhibit separable clusters on the target labels, while the non-robust features Znr show a partially disorganized tendency. When adversarial perturbation [7] exists, the attacked features Z̄nr represents more collapsed t-SNE visualization as shown in Fig. 2(b). Notably, we can observe that Z̄r still sustain highly clustered results even in the attacked condition.
sections.heading: 3.2 Feature Visualization of Robust and Non-robust Features
sections.text: We have identified the existence of the robust and non-robust features using the bottleneck. Then, we wonder about a way of interpreting the semantic information in the feature space with respect to human-perception. Analyzing semantic representation of DNNs is a wide research area to understand their decision [20, 22, 35]. In adversarial settings, several studies [14, 36] argued that a robust classifier has more meaningful (i.e., perceptually-aligned) loss gradients in the input space. Engstrom et al. [24] further endeavored to interpret robust feature representation using feature visualization [25, 37, 38]. In this manner, we explore whether the disentangled feature representation from the bottleneck indeed has human-perceptible information in the intermediate feature space.
  Feature visualization is an optimization-based method that maximizes specific activation of feature units [38, 39], such that X ′ = argmaxX(a l i(X)), where a l i(·) indicates feature activation of i-th unit in the l-th layer. To understand what conjunction of the robust and non-robust feature units truly interacts with the target labels, we optimize each distilled feature and create their visual explanations. We adopt direct visualization method [25] that has various regularization techniques (e.g., frequency penalization and transformations) to yield better representative visual quality.
  We employ iar and i a nr for the adversarial examples Xadv , which is obtained by optimizing LXadv (σ) instead of Eq. (4). Then, we define Z̄ar and Z̄ a nr as robust and non-robust features of the adversarial examples, satisfying Z̄ar = i a r · Z̄ and Z̄anr = ianr · Z̄. After distilling robust and non-robust features with their corresponding index, we maximize the selected feature unit activation, respectively. The feature visualization results of distilled features are illustrated in Fig. 3.
  As in the figure, we can clearly recognize the semantic information of true labels Y and attacked predictions Ŷadv in the intermediate features (Z and Z̄). Interestingly, what we can observe is: (i) the distilled features have semantic information by themselves and maintain their information, even under the adversarial perturbation, (ii) when the adversarial perturbation exists, the brittleness of non-robust features is intensified and reflected onto Z̄. Thus, the visualization of Z̄ and Z̄anr looks similar, and they manipulate the target prediction to same adversarial prediction. Unlike the previous work [15] that has argued the non-robust features solely have incomprehensible property, the visualization of the distilled features from our bottleneck represent recognizable outputs even for the adversarial examples, and provides a decisive key to interpret the cause of adversarial examples.
sections.heading: 3.3 Adversarial Prediction is Highly Correlated with Non-robust Features
sections.text: We have observed that the non-robust features optimized from the bottleneck are brittle and easily manipulated under the adversarial perturbation, while robust features maintain substantial prediction results for the target labels. Then, if the primary cause of the adversarial examples indeed belongs to non-robust features, it is natural to examine the correlation between the classification outputs of the non-robust features and the adversarial prediction induced by adversarial attacks. Accordingly, we identically apply our IB loss on the adversarial examples Xadv [2, 7, 4], and find their corresponding robust and non-robust channel index using Eq. (5).
  To enlighten the correlation of non-robust features and the adversarial prediction, we evaluate the model prediction of Z̄anr for the attacked labels Ŷadv that can be written as follows: Ŷ a nr = fl+(Z̄ a nr). We set the condition of Ŷadv as successfully attacked labels (i.e., Y 6= f(Xadv)) to definitely show the relationship between the prediction Ŷ anr of non-robust features and the adversarial prediction Ŷadv of adversarial examples. In Table 2, we summarize the accuracy of Ŷ anr for the successfully attacked label Ŷadv in standard attack methods. Generally, we can observe that the non-robust features are highly predictive on Ŷadv in standard low dimensional datasets such as CIFAR-10 and SVHN. Even in a large dataset (i.e., Tiny-ImageNet), the non-robust features are remarkably correlated with the attacked prediction. A brief explanation of the highly correlated example is described in Fig. 4.
sections.heading: 3.4 Bottleneck Controls Information Flow of Robust and Non-robust Features
sections.text: In this analysis, we will investigate how the bottleneck affects the information flow of the robust and non-robust features and clarify their relation. Recall that the bottleneck refines informative features from the given image samples, and β regulates the total amount of the information that flows into Z. We will compare classification accuracy for the robust and non-robust features along β value and analyze the changes of information flow assigned to each disentangled feature.
  In Fig. 5, as β value increases, the accuracy of the robust features is getting higher and decreases after a specific threshold. As theoretically mentioned in 2.1, we can infer that a suitable choice of the β can filter out robust feature units in the intermediate layer. For the excessive β value, we can observe that the bottleneck cannot accurately disentangle adversarial features. For example, the accuracy of the robust and non-robust features are reversed after β = 5.0 in the particular networks of CIFAR-10 and SVHN datasets. In addition, as in Fig. 5(a) and (b), the accuracy of the non-robust features progressively increases. Such results indicate a few robust feature units that are not distilled
  from IB are gradually flowing into the non-robust side and dichotomized as non-robust units, thus producing more higher accuracy. It coincides with the analysis of the number of the assigned robust and non-robust channels in Fig. 5(c). We can observe that the number of robust channels constantly diminishes, whereas that of the non-robust channels increases. It indicates the bottleneck delicately weighs the information flow that should be precisely assigned to the robust or non-robust units.
  From our analysis section, in conclusion, we have demonstrated the existence of the distilled features using the bottleneck: the robust and non-robust features in the intermediate feature representation. In addition, we have revealed that easily manipulated property of non-robust features is the primary cause of adversarial examples through their high correlation with the adversarial prediction. Based on the fact that the non-robust features break the model prediction, we will suggest an effective way of enhancing the adversarial attack, utilizing the gradient of non-robust features in section 4.
sections.heading: 4 Amplifying Brittleness of Non-Robust Features for Attack
sections.text: In this section, we intentionally increase the non-robust noise variation σnr to make model classifier fooled based on Eq. (6). Note that increasing σnr induces high erroneous term ∆, thereby going to deviate from the robust prediction. However, this variation σnr is merely an optimizing parameter that cannot be controlled manually. Thus, in order to secondarily have the effect of enlarging σnr, we alternatively utilize the gradients of the non-robust features directly connected with the model
  prediction. The gradients of non-robust features in adversarial examples can be described as follows:
  Gnr = ∂
  ∂Z̄nr Lbase(f(X + δ), Y ), (7)
  where we define a baseline loss as Lbase(f(X), Y ) = ‖δ‖2 + c · max(max i 6=Y (f(X)i) − f(X)i, 0), instead of cross-entropy loss due to its empirical effectiveness of attack performance [4]. In addition, we use a technique of changes of variables [4] from δ to w for generating an imperceptible yet powerful perturbation, such that δ = 12 (tanh(w) + 1)−X . It serves to smooth out projected gradient descent that clips prematurely to prevent adversarial examples falling into the extreme image domain.
  To compute the gradient practically, we firstly calculate ∂ ∂Z̄ Lbase, and multiply it to ∂∂Z̄nr Z̄ by chain rule. Here, the latter gradient equals to non-robust channel index inr, because the intermediate features of adversarial examples can be re-written as: Z̄ = ir · Z̄r + inr · Z̄nr, and the derivative of Z̄ over Z̄nr equals to inr. Thus, the gradients of the non-robust features Gnr can be simplified as inr · ∂∂Z̄Lbase. Using the gradient, we suggest an attack to non-robust features (NRF) by optimizing the following objective:
  min δ Lbase(f(X + δ), Y )− ∥∥∥∥inr · ∂∂Z̄Lbase ∥∥∥∥
  2
  . (8)
  In Table 3, NRF shows more effective attack performance than the other standard adversarial attacks in [7, 43, 44], since NRF strengthens the gradients of non-robust features that contains the same effect of increasing σnr to disturb accurate model prediction.
  Moreover, we conduct an ablation study on the gradients of robust and non-robust features to probe their influence of prediction changes in Table 4. As expected, maximizing Gnr shows more effective attack performance than minimizing it. It is because maximizing Gnr has an alternative effect of increasing the non-robust noise variation σnr (i.e., large erroneous term ∆ ↑) in Eq. (6). Whereas, manipulating the gradients of robust features Gr shows less attack performance than controlling Gnr, since it cannot directly handle brittle features in the intermediate feature representation. Especially, it seems difficult to break model prediction, while weakening the gradient of robust features, whose noise variation σr have invariance of target prediction even under the adversarial perturbation.
sections.heading: 5 Related Work
sections.text: Various works have been tried to figure out the reason for adversarial vulnerability in the intermediate feature representation. Inkawhich et al. [45] analyzed how the intermediate features are changed by adversarial attacks and measured layer- and class-wise feature distributions. Engstrom et al. [24] pointed out that there is a shortcoming of DNNs and their embedding, that is, the primary features used in DNNs are contrasting with what human uses. Also, they argued that the robust optimization to learn robust features could address this shortcoming by encoding high-level representations of input data. Jacobsen et al. [46] argued that the reason for adversarial vulnerability lies in invariant characteristics of DNNs to task-relevant features. This invariance makes most regions of input space brittle to adversarial attacks so that the classifiers become relying on a few highly predictive features. In addition, recent works [14, 15] have suggested that the existence of the vulnerability is on the non-robust features, which are inherently included in the data and have unrecognizable properties.
  Our work is in line with the concept of the non-robust feature. However, unlike the aforementioned works that directly generated the robust and non-robust datasets to analyze their properties, we reveal that the robust and non-robust features can be completely disentangled in the feature space using Information Bottleneck, and they have semantic information by themselves in fact.
sections.heading: 6 Conclusion and Discussion
sections.text: Conclusion. To understand where the adversarial brittleness comes from, we have investigated information flow in the intermediate feature space, using Information Bottleneck. By estimating the feature importance of each feature unit based on the added noise variation, we introduce a novel method to explicitly distill the robust and non-robust features in the feature representation. Through extensive analysis of the distilled features, we figure out how the feature units interact with target labels, and corroborate that the non-robust features are highly correlated with the adversarial prediction. In addition, we directly visualize the distilled features in the intermediate feature space and reveal that they have recognizable semantic information by themselves. Based on the properties of the distilled features, we suggest a non-robust feature attack (NRF) utilizing the brittleness in the feature space.
  Discussion. The adversarial examples, including our work, can potentially cause negative impacts on various machine learning applications, such as autonomous driving [47] and medical image process [48]. However, by analyzing the nature of robust and non-robust features that can be a primary cause of the adversarial examples, our work contributes important societal impacts in this research field. In this paper, we propose a way of utilizing the gradient of brittle features in the intermediate feature representation (NRF). In future works, we hope to bridge the gap of deploying distilled features into diverse applications such as adversarial detection and defense strategies. Moreover, we would like to note that the last convolutional layer is set to a distilling criterion for Information Bottleneck, since the high-level concepts are included in the higher layer of DNNs. In this sense, it seems a reasonable choice, but how the robust or non-robust features in the lower dimension interact with the much higher dimensional feature units can be another undisclosed future direction to investigate.
  Acknowledgments and Disclosure of Funding
  This work was conducted by Center for Applied Research in Artificial Intelligence (CARAI) grant funded by DAPA and ADD (UD190031RD).
title: Distilling Robust and Non-Robust Features in Adversarial Examples by Information Bottleneck