mlsanityData to 7 Oct 2026

Distilling Robust and Non-Robust Features in Adversarial Examples by Information Bottleneck

arXiv 2204.02735 ↗First posted 6 Apr 2022cs.LGcited by 30

Not on the map. Why?

Abstract (arXiv)

Adversarial examples, generated by carefully crafted perturbation, have attracted considerable attention in research fields. Recent works have argued that the existence of the robust and non-robust features is a primary cause of the adversarial examples, and investigated their internal interactions in the feature space. In this paper, we propose a way of explicitly distilling feature representation into the robust and non-robust features, using Information Bottleneck. Specifically, we inject noise variation to each feature unit and evaluate the information flow in the feature representation to dichotomize feature units either robust or non-robust, based on the noise variation magnitude. Through comprehensive experiments, we demonstrate that the distilled features are highly correlated with adversarial prediction, and they have human-perceptible semantic information by themselves. Furthermore, we present an attack mechanism intensifying the gradient of non-robust features that is directly related to the model prediction, and validate its effectiveness of breaking model robustness.

Key facts. Cited by 30 papers in the map (data through 7 Oct 2026). Builds on 31 of its 48 references that are in the map. First posted on arXiv 6 Apr 2022.

Builds on

31 of 48 references.

References · 31

  1. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2013Intriguing properties of neural networkscited by 5,114
  5. 2016Wide Residual Networkscited by 3,057
  6. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  7. 2013Visualizing and Understanding Convolutional Networkscited by 2,278
  8. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  9. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  10. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  11. 2016Adversarial Machine Learning at Scalecited by 934
  12. 2016Deep Variational Information Bottleneckcited by 915
19 more
  1. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  2. 2018Robustness May Be at Odds with Accuracycited by 873
  3. 2017Network Dissection: Quantifying Interpretability of Deep Visual Representationscited by 703
  4. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  5. 2014Understanding Deep Image Representations by Inverting Themcited by 399
  6. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
  7. 2015Understanding Neural Networks Through Deep Visualizationcited by 332
  8. 2018Adversarially Robust Generalization Requires More Datacited by 318
  9. 2019On instabilities of deep learning in image reconstruction - Does AI come at a cost?cited by 211
  10. 2019Adversarial Robustness through Local Linearizationcited by 146
  11. 2018Net2Vec: Quantifying and Explaining how Concepts are Encoded by Filters in Deep Neural Networkscited by 128
  12. 2018Are adversarial examples inevitable?cited by 113
  13. 2020Restricting the Flow: Information Bottlenecks for Attributioncited by 110
  14. 2018Excessive Invariance Causes Adversarial Vulnerabilitycited by 66
  15. 2019Understanding Neural Networks via Feature Visualization: A surveycited by 65
  16. 2020Transferable Perturbations of Deep Feature Distributionscited by 51
  17. 2019Are Perceptually-Aligned Gradients a General Property of Robust Classifiers?cited by 42
  18. 2019IoT Network Security from the Perspective of Adversarial Deep Learningcited by 20
  19. 2020Adversarial Machine Learning Attacks and Defense Methods in the Cyber Security Domaincited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 5; 2023: 8; 2024: 12; 2025: 4; 2026: 1.

30 papers.

Sort:

By area:

  1. 2024MoAI: Mixture of All Intelligence for Large Language and Vision Modelscited by 36
  2. 2024Meteor: Mamba-based Traversal of Rationale for Large Language and Vision Modelscited by 30
  3. 2024CoLLaVO: Crayon Large Language and Vision mOdelcited by 26
  4. 2022What Can the Neural Tangent Kernel Tell Us About Adversarial Robustness?cited by 21
  5. 2023Demystifying Causal Features on Adversarial Examples and Causal Inoculation for Robust Network by Adversarial Instrumental Variable Regressioncited by 18
  6. 2024Phantom of Latent for Large Language and Vision Modelscited by 15
  7. 2023A Unified Framework of Graph Information Bottleneck for Robustness and Membership Privacycited by 14
  8. 2024TroL: Traversal of Layers for Large Language and Vision Modelscited by 13
  9. 2024Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Datacited by 12
  10. 2023Mitigating Adversarial Vulnerability through Causal Parameter Estimation by Adversarial Double Machine Learningcited by 11
  11. 2025GenRecal: Generation after Recalibration from Large to Small Vision-Language Modelscited by 9
  12. 2024Robust Feature Learning for Multi-Index Models in High Dimensionscited by 5
18 more
  1. 2022Disentangled Text Representation Learning with Information-Theoretic Perspective for Adversarial Robustnesscited by 4
  2. 2023Exploring Robust Features for Improving Adversarial Robustnesscited by 4
  3. 2022Causal Information Bottleneck Boosts Adversarial Robustness of Deep Neural Networkcited by 3
  4. 2023Robust Proxy: Improving Adversarial Robustness by Robust Proxy Learningcited by 3
  5. 2024Can't Slow me Down: Learning Robust and Hardware-Adaptive Object Detectors against Latency Attacks for Edge Devicescited by 3
  6. 2023IB-RAR: Information Bottleneck as Regularizer for Adversarial Robustnesscited by 2
  7. 2024Theoretical Understanding of Learning from Adversarial Perturbationscited by 2
  8. 2024DifAttack++: Query-Efficient Black-Box Adversarial Attack via Hierarchical Disentangled Feature Space in Cross-Domaincited by 2
  9. 2022Disentangled Generation with Information Bottleneck for Few-Shot Learningcited by 1
  10. 2023DifAttack: Query-Efficient Black-Box Attack via Disentangled Feature Spacecited by 1
  11. 2023Adversarial Attacks to Latent Representations of Distributed Neural Networks in Split Computingcited by 1
  12. 2024Subspace Defense: Discarding Adversarial Perturbations by Learning a Subspace for Clean Signalscited by 1
  13. 2025Weakly Supervised Contrastive Adversarial Training for Learning Robust Features from Semi-supervised Datacited by 1
  14. 2022Meet You Halfway: Explaining Deep Learning Mysteriescited by 0
  15. 2024Golyadkin's Torment: Doppelg"angers and Adversarial Vulnerabilitycited by 0
  16. 2025Robustness Analysis against Adversarial Patch Attacks in Fully Unmanned Storescited by 0
  17. 2025FERD: Fairness-Enhanced Data-Free Robustness Distillationcited by 0
  18. 2026Mid-Harness: Scaling Actions Between Model and Harness for Terminal Agentscited by 0