IB-RAR: Information Bottleneck as Regularizer for Adversarial Robustness
IEEE/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W), vol. 34, pp. 129–135
Abstract
This paper proposes a novel method, IB-RAR, which uses Information Bottleneck (IB) to strengthen adversarial robustness for both adversarial training and non-adversarial-trained methods. We first use the IB theory to build regularizers as learning objectives in the loss function. Then we filter out unnecessary features of intermediate representation according to their mutual information (MI) with labels, as the network trained with IB provides easily distinguishable MI for its features. Experimental results show that IB-RAR can be naturally combined with adversarial training and provides consistently better accuracy on new adversarial examples. The IB-RAR method improves the accuracy by an average of 2.66% against five adversarial attacks for ResNet-18, wide ResNet-28-10, and VGG-16, trained with three adversarial training benchmarks and the CFAR-10, CFAR-100, and Tiny ImageNet datasets. In addition, IB-RAR also provides good robustness for undefended methods, such as training with cross-entropy loss only. Finally, without adversarial training, the VGG-16 network trained using IB-RAR on the CFAR-10 dataset reaches an accuracy of 35.86% against PGD examples, while using all layers reaches 25.61% accuracy.
Authors 3
-
Affiliation as printed
Radboud University,Digital Security Group,Nijmegen,The Netherlands
Digital Security Group, Radboud University, Nijmegen, The Netherlands
-
Affiliation as printed
Leiden University,Leiden Institute of Advanced Computer Science,Leiden,The Netherlands
Leiden Institute of Advanced Computer Science, Leiden University, Leiden, The Netherlands
-
Affiliation as printed
Radboud University,Digital Security Group,Nijmegen,The Netherlands
Digital Security Group, Radboud University, Nijmegen, The Netherlands
Cited by 0 stored of 0
No patents citing this paper on Lens.org (checked 2026-10-11).