PaperlayerView exact revision on arXiv

Source-linked AI summary

The Conditional Entropy Bottleneck

Ian Fischer

arXiv:2002.05379v1cs.LGstat.ML

TL;DR

The paper addresses failures of robust generalization by hypothesizing that models retain excessive training-data information. It introduces MNI and CEB, finding empirically that CEB models improve accuracy, adversarial robustness, and OoD detection.

  • Problem

    Machine learning systems remain vulnerable to adversarial examples, weak OoD detection, and memorization despite strong held-out accuracy.

  • Method

    The paper introduces the Minimum Necessary Information criterion and Conditional Entropy Bottleneck objective to reduce unnecessary information about training data.

  • Results

    CEB models empirically improve classification accuracy, adversarial robustness, and OoD detection across evaluated tasks.

  • Takeaways & Limitations

    MNI and CEB provide a promising framework for improving robust generalization with fast amortized inference.

  • Takeaways & Limitations

    For some datasets, the necessary MNI conditions may be impossible to satisfy because representations have a dataset-dependent maximum information value.

Abstract

from arXiv · show

Much of the field of Machine Learning exhibits a prominent set of failure modes, including vulnerability to adversarial examples, poor out-of-distribution (OoD) detection, miscalibration, and willingness to memorize random labelings of datasets. We characterize these as failures of robust generalization, which extends the traditional measure of generalization as accuracy or related metrics on a held-out set. We hypothesize that these failures to robustly generalize are due to the learning systems retaining too much information about the training data. To test this hypothesis, we propose the Minimum Necessary Information (MNI) criterion for evaluating the quality of a model. In order to train models that perform well with respect to the MNI criterion, we present a new objective function, the Conditional Entropy Bottleneck (CEB), which is closely related to the Information Bottleneck (IB). We experimentally test our hypothesis by comparing the performance of CEB models with deterministic models and Variational Information Bottleneck (VIB) models on a variety of different datasets and robustness challenges. We find strong empirical evidence supporting our hypothesis that MNI models improve on these problems of robust generalization.

1. Introduction

The paper frames adversarial vulnerability, poor OoD detection, miscalibration, and memorization as robust-generalization failures caused in part by retaining too much training-data information. It introduces MNI and CEB, then reports improvements in accuracy, adversarial robustness, OoD detection, calibration, and resistance to memorizing information-free data.

  • The paper attributes robust-generalization failures to models retaining too much training-data information and proposes MNI and CEB to address them.
  • MNI models achieve superior classification accuracy to models retaining either more or less than the minimum necessary information.
  • MNI models are substantially more robust to whitebox and transfer adversarial attacks than models retaining excessive training-data information.
  • CEB models detect out-of-distribution examples as well or better than non-MNI models, while providing a useful OoD-detection metric.
  • MNI models are better calibrated than non-MNI models and fail to learn information-free datasets.

2. Robust Generalization

Robust generalization extends held-out accuracy to maintaining performance under unknown adversaries and detecting data that differs substantially from the training distribution. The paper reports that changing the training objective improves all three conditions, without claiming to solve robust generalization.

  • Robust generalization requires classical performance, adversarial performance, and detection of adversarial or substantially shifted data.
  • Existing adversarial-training and provable-robustness approaches typically trade away test accuracy and do not provide a mechanism for distribution-shift detection.
  • VIB and Information Dropout had previously shown progress on adversarial robustness, accuracy, or OoD detection.
  • Changing the training objective produced notable improvement on all three robust-generalization conditions, although the paper does not claim to solve robust generalization.

3. The Minimum Necessary Information

The Minimum Necessary Information criterion seeks representations that retain task-useful information while discarding unnecessary information about the data. Its feasibility is constrained for some datasets, and the link to adversarial robustness is presented as an empirical hypothesis.

  • The criterion combines information, task necessity, and minimality, with minimality selecting the lowest information about (X, Y) among task-solving representations.
  • MNI requires a representation to contain enough information for predicting Y while retaining no more information about X than necessary.Necessity is expressed as I(X; Y) ≤ I(Y; Z), whereas minimality is expressed as I(X; Y) ≥ I(X; Z).
  • For some datasets, no representation can satisfy the MNI conditions exactly because the required information constraints may be infeasible.
  • For deterministic datasets and sufficiently powerful models, the representation can often approach the MNI point.
  • Compression on training data is associated with better generalization to similar test data, while adversarial benefits remain a hypothesis investigated empirically.
  • The MNI criterion does not directly determine OoD detection, which depends on modeling choices and accurate measurement of pairwise information.

4. The Conditional Entropy Bottleneck

The Conditional Entropy Bottleneck optimizes a representation by minimizing conditional information about X given Y while maximizing predictive information about Y. Variational bounds make the objective tractable for amortized inference and avoid a conflicting optimization region identified for IB.

  • CEB minimizes I(X; Z|Y) while maximizing I(Y; Z), directly targeting compression of X conditional on the task.
  • For deterministic datasets, γ = 1 can achieve the MNI with a sufficiently powerful model and is expected to yield consistent models.
  • Variational bounds over the encoder e(z|x), backward encoder b(z|y), and classifier c(y|z) produce a tractable objective for amortized inference.
  • The paper describes additional optimization methods for the CEB objective beyond the variational formulation.

5. Comparison to the Information Bottleneck

CEB reframes the Information Bottleneck objective to target the Minimum Necessary Information point, making compression relative to predictive performance directly measurable. The paper relates CEB to IB and VIB while introducing diagnostics for residual information and variational tightness.

  • Geometry of IB and CEB: CEB rectifies IB’s information plane, avoiding simultaneous minimization and maximization of the central region while making excess compression measurable as I(X; Z|Y) ≥0.For IB, the distance from optimal compression cannot be determined a priori; CEB provides an absolute measure at fixed predictive performance.
  • Comparison of objectives: CEB and IB are equivalent when γ = β −1, providing a direct parameterization for comparing their objectives.The paper introduces a shared parameterization to simplify comparison between the two objectives.
  • Parameterization: For deterministic datasets, ρ = 0 targets the MNI point, while ρ < 0 may undercapture and ρ > 0 may overcapture information.Increasing ρ increases the information captured by the model.
  • Diagnostics: ReX measures exactly how many bits a model is from the MNI point when the current classifier is optimal, unlike the Rate R.Observing R alone does not reveal how tightly the model adheres to MNI.
  • Comparison with VIB: VIB0 may converge to a looser approximation of I(X; Z) = I(Y; Z) = I(X; Y) than CEB, despite reporting Rate R converging to I(X; Y).If ReX converges to 0, the tightness of the backward encoder depends on the tightness of the classifier approximation.

6. Model Variants

The paper develops bidirectional CEB, a consistent classifier, and CatGen variants for shared representations and arbitrary paired prediction tasks. These variants reuse encoder structure, support generation or classification, and use minibatch softmaxes where appropriate.

  • 6.1. Bidirectional CEB: Bidirectional CEB learns a unified representation consistent with both input and output encoders, permitting either output to be generated from either input.It avoids training a joint encoder q(z|x, y).
  • 6.2. Consistent Classifier: The Consistent Classifier reuses the backward encoder as c(y|z) ∝ b(z|y)p(y), requiring parameters only for the two encoders.For uniform labels, p(y) can be omitted; otherwise the empirical label distribution suffices.
  • 6.3. CatGen Decoder: CatGen defines a valid minibatch softmax distribution, allowing the model to sample the training example whose target most closely corresponds to a representation.The construction preserves the variational bound and is called a Categorical Generative Model.
  • 6.3. CatGen Decoder: CatGen applies to arbitrary paired data and balances prediction directions because selecting the correct example among K possibilities has the same difficulty for X and Y.It can replace both c(y|zX) and d(x|zY) in bidirectional CEB.
  • 6.3. CatGen Decoder: CatGen is mathematically equivalent to CPC after an offset of log K, while reusing already parameterized forward and backward encoders in the CEB setting.Its bound is constrained by log K, which can be practical when log K ≥ I(X; Y).

7. Experiments

Experiments compare otherwise matched deterministic, VIB, and CEB models across Fashion MNIST and CIFAR10 robustness challenges. CEB models generally combine strong accuracy with improved adversarial robustness, calibration, OoD detection, and resistance to learning information-free labels.

  • 7.1. (RG1), (RG2), and (RG3): Fashion MNIST: On Fashion MNIST, CEB outperformed VIB at every ρ in accuracy and targeted PGD robustness despite nearly identical maximum rate lower bounds.CEB also outperformed the deterministic baseline except at the least-compressed ρ = 5 model, while lower ρ generally increased robustness.
  • 7.1. (RG1), (RG2), and (RG3): Fashion MNIST: At ρ = 0, CEB maintained high accuracy, reached a 2.3-nat rate lower bound, and showed strong robustness, whereas ρ = −1 traded a large accuracy loss for only a small robustness gain.Both VIB and CEB converged to I(X; Y) = log 10 ≈ 2.3 nats at ρ = 0.
  • 7.1. (RG1), (RG2), and (RG3): Fashion MNIST: Using the rate R was more effective for OoD detection than classifier entropy H, with CEB0 and VIB4 saturating detection performance across four OoD datasets.VIB0 shows that merely having R available is insufficient: models below the MNI point had worse classification and weaker detection signals.
  • 7.1. (RG1), (RG2), and (RG3): Fashion MNIST: MNI-oriented models improved robust-generalization measures: CEB0 and VIB0 stayed slightly overconfident, while ρ = 2 made VIB and CEB nearly as overconfident as deterministic models.Calibration plots track movement from underconfidence to overconfidence during training; the ρ = 0 models remained nearly perfectly calibrated at 20,000 steps.
  • 7.1. (RG1), (RG2), and (RG3): Fashion MNIST: On information-free random-label Fashion MNIST, CEB and VIB models with ρ < 6 never learned, whereas deterministic models always learned.The setup has I(X; Y) = 0 and was trained for up to 100 epochs.
  • 7.2. (RG1) and (RG2): CIFAR10 Experiments: CEB0 reached 97.51% CIFAR10 test accuracy and 93.6% on CIFAR-10.1, a 3.9-point gap, while CEB5 reached 97.06% and 91.9%, respectively.The CEB0 gap was better than all results reported in the cited CIFAR-10.1 paper, while CEB5 showed substantially worse generalization as ρ increased.
  • 7.2. (RG1) and (RG2): CIFAR10 Experiments: CEB0 beat the adversarially trained Madry model on L2 and L∞ attacks at almost all ε values and remained robust to transfer attacks.The transfer attacks used CEB5 and Madry to generate attacks against CEB0, providing black-box tests that do not differentiate through the target model.

8. Conclusion

The paper presents CEB as an MNI-motivated objective and reports substantial improvements in robust generalization, including accuracy, adversarial robustness, and OoD detection.

  • CEB models may substantially improve robust generalization, including higher accuracy, better adversarial robustness, and stronger OoD detection.
  • The conclusion frames CEB as a promising, easy-to-implement framework that permits fast amortized inference while improving robust generalization.

A. Model Details

The experiments use shared Wide ResNet encoder and MLP classifier architectures, with stochastic models differing through latent sampling and objective-specific distributions.

  • All Fashion MNIST models use a 7×2 Wide ResNet encoder with a D = 4 latent representation and two-layer ELU MLP classifier.
  • Stochastic models parameterize a D = 4 fully covariate multivariate Normal distribution, sample latents, and otherwise match Determ during evaluation.
  • VIB uses a learned marginal mixture of 240 D = 4 multivariate Normals, whereas CEB uses a label-conditioned backward encoder and separately trained marginal.
  • CIFAR-10 CEB models use AutoAugment, 800 training epochs, learning-rate reductions at 400 and 600 epochs, and Adam with base rate 10^-3.

A.3. Distributional Families

CEB permits flexible distributional choices and optimization methods, with normal distributions used here for convenience rather than as a fundamental requirement.

  • Any distributional family may be used for the encoder, with reparameterization convenient and score-function gradients available otherwise.
  • The encoder and backward encoder may use the same distributional family or a mixture, making these dataset-dependent practitioner choices.
  • CEB is independent of its optimization method; variational objectives are used for tractability, while other mutual-information estimators may also work.

B.1. Finitness of the Mutual Information

The paper extends CEB to hierarchical, temporal, multiscale, and unsupervised settings, while noting numerical and objective-design limitations.

  • Mutual-information finiteness: With stochastic encoders, CEB and VIB avoid the cited infinite-mutual-information conditions, though some modeling and data choices can still cause numerical instability.
  • Hierarchical CEB: Hierarchical CEB targets Y at every layer, so each Zi maximizes I(Y; Zi), supporting principled consistency across deep representations.
  • Predictive and multiscale CEB: CEBpred learns Zt from past observations to cover predictive information about future observations, with bidirectional and multiscale extensions.
  • Predictive and multiscale CEB: Temporal CEB can use probabilistic RNN or sequence decoders, while CatGen avoids generating long future sequences.
  • Unsupervised CEB: For unsupervised learning, objective hyperparameters may constrain information quantity without clearly selecting the correct task-relevant bits.
  • Unsupervised CEB: Applying CEB to unsupervised data requires choosing a transformation f(X) → X′; the identity transformation yields maximal I(X; X′) and is far from MNI for normal downstream tasks.
  • Unsupervised CEB: Noise functions provide a class of transformations intended to simplify selecting useful information from X for unsupervised CEB.

C.3.1. DENOISING CEB AUTOENCODER

The Denoising CEB Autoencoder corrupts inputs to remove presumed irrelevant information, then learns representations from clean and noisy views. Its bidirectional design supports consistency with uncorrupted inputs, while the method’s idealized noise function can yield a representation containing only task-relevant information.

  • The denoising objective extends earlier denoising autoencoders, which sought representations that reconstruct corrupted inputs by minimizing conditional entropy.The paper also distinguishes a Noising CEB Autoencoder when only the representation matters and the model predicts noisy X′ from X.
  • The model uses two encoders and two decoders so the learned representation remains consistent for corrupted and uncorrupted inputs.A single encoder/decoder pair would either perform poorly on clean inputs or generate only noisy outputs.
  • The noise function must encode assumptions about information structure, which vary by data type and intended downstream task.
  • The method forms noisy inputs X′ = f(X, U) by adding scaled uniform noise and clipping to X’s domain, with λ controlling retained information.λ = 1 makes X′ indistinguishable from uniform noise, while λ →0 preserves more information from X.
  • With an oracle noise function, CEBdenoise can learn a representation isomorphic to classification that encodes exactly I(X; Y) nats.This claim is caveated by model, architecture, and optimizer selection.
Loading 2002.05379v1…