CausalDiff: Causality-Inspired Disentanglement via Diffusion Model for Adversarial Defense

Summary

The paper introduces an adversarial defense method, CausalDiff, which leverages a causal model of robustness combined with a diffusion model to learn label-relevant causative representations. The effectiveness of CausalDiff is specifically demonstrated against unseen attacks, where it surpasses existing adversarial defense baselines on several image classification datasets.

Strengths

- This paper is well-motivated, presenting a novel framework that extracts the disentangled essential features of an image, achieved by first training a diffusion model and then inferring from it. - The pilot study is easy to understand, and the results persuasively demonstrate the effectiveness of the proposed causality-inspired defense framework. - A comprehensive comparison with baselines of adversarial defense methods, especially those based on Diffusion Models, makes the results convincing.

Weaknesses

- Limited discussion about related works. To my knowledgement, neither CausalAdv and DICE limits their modeling of adversarial distribution to a certain type of attack. Therefore, it is necessary to discuss how the proposed method differs from these important baselines in terms of causal modeling. - The writing can be improved. The challenges listed from line 53 to 66 could be clearer by focusing on highlighting the actual problems that are solved by the proposed method, rather than just listing how the method is implemented. For example, challenge (2) could be clarified by explaining that applying a *Causal Information Bottleneck* objective aims to minimize the essential factors to their minimal necessary extent. - The empirical results of the pilot study are convincing. However, the insight into how to extract the desired features (i.e., S, Z) appears unclear, as detailed in Q2-Q3.

Questions

Q1: Could you provide further insight into the source of CausalDiff’s ability to generalize to unseen attacks? For example, what attributes of the *essential factor* for benign images enable its generalizability to unseen attacks, and are there any specific constraints regarding the types of unseen attacks? Q2: Could the author further explain the reason for the opposite optimization direction $(1 - \lambda) I(X;S,Z)$ in Eq. 5? E.g., what is the relationship between the motivation of avoiding "X containing too many unimportant details" (line 196) and the "insensitivity" for $-\lambda I(X;S,Z)$ in Fig. 2? These statements seem to imply the existence of a feature that is neither "essential" (i.e., S) nor "non-essential but important for reconstructing X" (i.e., Z). This kind of feature appears crucial for "sensitivity" but is not fully discussed in the paper. Q3: Any abation study on the parameter $\lambda$ used in Eq.5, which typically plays a crucial role in IB-style objectives? Q4: Other minor typos. - There is a citation format error in line 21, and a method name mistake (with / without) in line 124.

Rating

6

Confidence

4

Soundness

3

Presentation

3

Contribution

3

Limitations

- The defense performance is superior against adversarial attacks with L_p norm constraints. However, the effectiveness of the proposed method against unbounded attacks (e.g., semantic attacks[1]) remains unclear. - Considering the high computational cost and training budget associated with diffusion models tailored to a single image classifier, CausalDiff may lack practicality. Strategies to reduce these costs should be considered. For instance, could a smaller diffusion model be trained to replace the two different diffusion models (unconditional and conditional) through model distillation? [1] Ghiasi, Amin, Ali Shafahi, and Tom Goldstein. "BREAKING CERTIFIED DEFENSES: SEMANTIC ADVERSARIAL EXAMPLES WITH SPOOFED ROBUSTNESS CERTIFICATES." *International Conference on Learning Representations*.

Summary

This work aims to promote the trustworthiness of DNNs through purification. To this end, the authors propose a novel causality view to perform a disentanglement approach using diffusion models. Some experiments are conducted to verify the effectiveness of the proposed method.

Strengths

+ This work takes a good step towards practical adversarial defense. For instance, adversarial attack behaviors are unpredictable, leading to the requirement for robustness against unseen attacks. In this context, the authors highlight the challenge and propose a novel approach to address the challenge. + The experiment designed on the toy dataset is interesting and provides clear points to depict the motivation of this work. Namely, disentanglement is a promising direction to promote the robustness of DNNs. Moreover, this aligns well with Eq. (3), especially the third term on the right. + The experimental results are decent, where the proposed method achieves exciting robustness under various settings. Moreover, the proposed method is evaluated using a SOTA adversarial attack method, i.e., AutoAttack. This makes the results convincing.

Weaknesses

- Adaptive attacks are lacking in this work, which significantly weakens its contribution and convincingness. Specifically, in the context of the considered white-box attack, what if the adversary generates adversarial examples using the following objective function? $\max_{\delta} \ell_{ce}(x+\delta, y) + \log p(x+\delta) + \log p(x+\delta|s^+,z)$ with $s^+ = \arg \min \log p(y|s^+)$ - It is hard to accept the conclusion shown in Figure 2. Specifically, DNNs would exhibit vulnerability when increasing the $\epsilon$-budget. However, Figure 2 shows that the proposed method always makes DNNs robust. It is unclear what would happen if we further improve the budget. The results would be solid evidence for the false robustness if it is not intuitive. - Adversarial training with specific adversarial examples endows DNNs with robustness against these adversarial examples. This is intuitive. However, the current version of this work lacks a detailed and explicit explanation for the intuition or mechanism of why the proposed method can endow DNNs with robustness against various types of adversarial attacks. Relax; this is just a suggestion to make the work more solid. - It is known that diffusion models are sensitive to the inference step related to the inference time. Thus, the proposed method would introduce more cost in time. However, the authors seem to overlook the cost. Minor: The second and third paragraphs of the Introduction lack references. For instance, the authors should provide corresponding works discussing certified defense, adversarial training, purification methods, and the causality and disentangle view. - The authors claim that CausalDiff can be viewed as semantic-level purification. This shows a relation to a previous work [1]. Specifically, performing a (non-semantic) subspace exploration would endow DNNs with robustness to distribution shift [1]. Thus, if we can abstract s* and z* using CausalDiff, we can further perform a distribution exploration to promote the robustness for OOD generalization. [1] Moderately Distributional Exploration for Domain Generalization. Dai et al.

Questions

Please see the weakness.

Rating

6

Confidence

3

Soundness

3

Presentation

3

Contribution

3

Limitations

Yes

Summary

This paper proposed a novel causal diffusion framework based on causal inference to defend against unseen attacks. The causal information bottleneck is interesting to disentangle the target-causative and target-non-causative factors, and then target-causative factors are used for adversarial defense.

Strengths

The originality of this paper is good, since the causal diffusion framework and causal information bottleneck are innovative and effective for adversarial defense. The quality and clarity of this paper are also good, where the logic is clear for understanding. The significance of this paper is obvious, because unseen attacks are necessary to address.

Weaknesses

1. Some technical details need to be explained. For example, what is the actual meaning of the constraint in Eq. (4)? And why are the positions of z_s and s_b defined like in Eq. (2)? 2. Numerically, the authors could consider comparing their method with more baselines. There are some studies on adversarial defense, even without using diffusion models.

Questions

1. Some technical details need to be explained. For example, what is the actual meaning of the constraint in Eq. (4)? And why are the positions of z_s and s_b defined like in Eq. (2)? 2. Numerically, the authors could consider comparing their method with more baselines. There are some studies on adversarial defense, even without using diffusion models.

Rating

8

Confidence

4

Soundness

4

Presentation

3

Contribution

4

Limitations

1. What is the technical drawback of the proposed method? E.g., defense efficiency 2. Does this proposed method work for data other than images?

Summary

The authors propose CausalDiff, a causality-inspired disentanglement approach using diffusion models for adversarial defense, which outperforms state-of-the-art methods on various unseen attacks across multiple datasets.

Strengths

Novel approach combining causal modeling and diffusion models for adversarial defense Strong performance against unseen attacks on multiple datasets Thorough pilot study on toy data to validate the approach Clear theoretical foundation with the proposed Causal Information Bottleneck objective Practical adaptation of diffusion models for conditional generation

Weaknesses

Limited discussion on computational complexity and training time Lack of comparison with other causal approaches for adversarial robustness No analysis of the method's performance on more complex datasets (e.g., ImageNet) Limited exploration of the interpretability of the learned causal factors Absence of ablation studies to isolate the impact of individual components

Questions

Please see the weaknesses section.

Rating

5

Confidence

3

Soundness

3

Presentation

3

Contribution

3

Limitations

The authors adequately addressed the limitations

Official Comment

I appreciate the authors' detailed responses, which address my concerns. Thus, I raise the score to "weak accept".