# Enhancing the “Immunity” of Mixture-of-Experts Networks for Adversarial
Defense

Qiao Han1 yong huang1 xinling Guo1 Yiteng Zhai1 Yu Qin2&Yao Yang1∗
1Zhejiang Lab
2Institute of Software, Chinese Academy of Science
{hanq, yhuang, guoxl, ito<EMAIL_ADDRESS><EMAIL_ADDRESS>
###### Abstract

Recent studies have revealed the vulnerability of Deep Neural Networks (DNNs)
to adversarial examples, which can easily fool DNNs into making incorrect
predictions. To mitigate this deficiency, we propose a novel adversarial
defense method called “Immunity” (Innovative MoE with MUtual infomation &
positioN stabilITY) based on a modified Mixture-of-Experts (MoE) architecture
in this work. The key enhancements to the standard MoE are two-fold: 1)
integrating of Random Switch Gates (RSGs) to obtain diverse network structures
via random permutation of RSG parameters at evaluation time, despite of RSGs
being determined after one-time training; 2) devising innovative Mutual
Information (MI)-based and Position Stability-based loss functions by
capitalizing on Grad-CAM’s explanatory power to increase the diversity and the
causality of expert networks. Notably, our MI-based loss operates directly on
the heatmaps, thereby inducing subtler negative impacts on the classification
performance when compared to other losses of the same type, theoretically.
Extensive evaluation validates the efficacy of the proposed approach in
improving adversarial robustness against a wide range of attacks.

##  1 Introduction

Deep neural networks (DNNs) have demonstrated remarkable capabilities and
ubiquitous applications across various domains, including medical diagnosis
Kleppe et al. (2021), autonomous driving Stocco et al. (2022), security
surveillance Amrutha et al. (2020), etc. However, recent studies have revealed
the vulnerability of DNNs to adversarial attacks Xie et al. (2020).
Adversarial attacks craft imperceptible perturbations into the original input
data and induce DNNs to generate erroneous outputs or predictions Chilamkurthy
et al. (2018). These attacks not only undermine the effectiveness and
reliability of DNNs, but also pose risks to safety-critical scenarios
involving these models, such as medical misdiagnosis, traffic accidents, and
information leakage Papernot et al. (2017). Therefore, enhancing the
adversarial robustness of DNNs, i.e. strengthening these models against
diverse adversarial attacks, is an important yet challenging problem.

To date, a myriad of adversarial defense strategies have emerged to address
this problem, which can be principally classified into 3 main approaches:
robust optimization, data compression and auxiliary means Yuan et al. (2019).
Robust optimization trains the model using adversarial examples or
regularizers to enhance adaptability and generalizability Madry et al. (2017a)
Tramèr et al. (2017). Data compression alleviates harmful data and reduces
perturbations Guo et al. (2018). Auxiliary means incorporate additional
mechanisms to improve model complexity and reliability Margeloiu et al.
(2020). However, extant methods exhibit certain limitations. For instance,
robust optimization risks overfitting or compromising accuracy Kurakin et al.
(2016a), data compression may forfeit useful information or features Zhang et
al. (2019), while auxiliary means can impose computational overhead or have
limited applicability Dimitrov et al. (2020). Moreover, existing methods do
not fully consider how model architecture and behavior influence robustness,
or how different input data components contribute to robustness.

To address the limitations of prior methods, we propose a novel approach
termed “Immunity” (Innovative MoE with MUtual info & positioN stabilITY) that
enhances model defense against adversarial attacks. Immunity enhances model
robustness by employing multiple sub-models termed expert networks to
disentangle distinct features and extract unique concepts or semantics. The
key innovation in our Mixture-of-Experts (MoE) architecture is integrating a
Random Switch Gate, instead of a deterministic gate, to coordinate and
aggregate outputs from individual experts. During inference, it randomly
exchanges weights to improve robustness. To further enhance multi-angle
learning, we devise an innovative Mutual Information (MI) loss and position-
stability loss based on Grad-CAM. These losses directly regularize heatmap of
expert network to increase diversity and causality of learned representations.

The core innovations and contributions of this paper are:

  * •

We propose a novel “Immunity” approach that incorporates Random Switch Gates
into MoE architecture to jointly enhance adversarial robustness and
interpretability, providing new insights on leveraging model ensemble
diversity for defense.

  * •

We devise an innovative MI-based loss operating on Grad-CAM, which simplifies
calculation and induces subtler negative impact on predictions compared to
prevailing MI losses. We also formulate a position-stability regularizer that
encourages learning of causal representations by expert networks.

  * •

Through extensive experiments on public datasets, we demonstrate Immunity
significantly outperforms state-of-the-art defense methods against diverse
adversarial attacks under both standard and adversarial training settings. Our
approach exhibits consistent superiority in defending against various attack
types and magnitudes.

The remainder of this paper is organized as follows: Section 2 reviews related
prior works. Section 3 provides background and motivations. Further, Section 4
elaborates on the principles and details of the proposed method “Immunity”. In
Section 5, we present experimental setup and results in detail. Finally,
Section 6 concludes the paper.

##  2 Related Works

###  2.1 Adversarial Attacks and Defences

Experiments have revealed deep neural networks’ intrinsic vulnerability to
adversarial examples, which can easily lead to misclassifications Goodfellow
et al. (2014). Since the seminal work in 2014, numerous attack techniques have
emerged, including the pioneering Fast Gradient Sign Method (FGSM) that
manipulates gradient directions to generate attacks Goodfellow et al. (2014).
Subsequent methods further leverage Jacobian matrices, decision boundaries,
and generative adversarial networks. Notable attack algorithms include the
Basic Iterative Method(BIM) Kurakin et al. (2016b), Momentum Iterative
Method(MIM) Dong et al. (2017), C&W attack Carlini and Wagner (2018) and
Projected Gradient Descent (PGD) attack Madry et al. (2017b).

In response, defense strategies have been explored from 3 primary perspectives
to enhance model robustness and alleviate vulnerability against adversarial
attacks: Robust Optimization, Data Compression, and Auxiliary Technique. Our
major focus is on robust optimization . For instance, Kannan et al. Kannan et
al. (2018) incorporated adversarial examples into model training, making it
the most ubiquitous and fundamental defense approach.Concurrently, Liu et al.
Liu et al. (2018) introduced random modules and proposed Robust Neural
Networks via Random Self-Ensemble (RSE) to defend against attacks. Then
Hierarchical Random SwitchingWang et al. (2019) was leveraged for Protecting
Neural Networks. Consequently, to further improve the search algorithm
framework, Robnets Guo et al. (2019) and AdvRush Mok et al. (2021) have been
proposed to achieve superior robustness. Regarding the data perspective, Jia
et al. proposed ComDefend using image compression to eliminate perturbations
Jia et al. (2019), while Prakash et al. generated samples via local corruption
Prakash et al. (2018). Auxiliary techniques include adversarial detection
Abusnaina et al. (2021) and auxiliary blocks Yu et al. (2019).

###  2.2 CAM-based Explanations for Deep Learning Interpretability

CAM-based methods provide visual explanations for deep learning models. This
started with CAM Zhou et al. (2016), which required a global pooling layer.
Grad-CAM Selvaraju et al. (2017) then generalized CAM to all neural networks
by using gradient information. As an alternative approach, Score-CAM Wang et
al. (2020b) and SS-CAM Wang et al. (2020a) weighted activation maps based on
forward pass scores. In our proposed approach, we utilize Grad-CAM to
visualize the internal mechanisms of the model, and leverage this to constrain
the learning patterns of individual expert networks.

###  2.3 Mutual Information Aided Mixture of Experts for Independent
Representations

Mutual information (MI) and Mixture of Experts (MoE) frameworks have emerged
as pivotal techniques for learning independent, disentangled representations
across multiple dimensions. Initial explorations into MI date back to Bengio’s
Bengio (2017) proposed architecture The Consciousness Prior, which sought to
leverage MI for representation learning. Subsequently, Brakel and Bengio
formally extracted statistically independent components by minimizing MI
Brakel and Bengio (2017). MI has also been utilized for learning disentangled
representations Sanchez et al. (2020). Recently, Zhou et al. enhanced
adversarial robustness by comparing MI between model outputs and natural
patterns Zhou et al. (2022). However, accurately estimating MI remains
challenging for high dimensional variables. To overcome this limitation,
Belghazi et al. proposed estimating MI based on the Donsker-Varadhan
representation of the Kullback-Leibler divergence Belghazi et al. (2018),
while Hjelm et al. introduced a Jensen-Shannon divergence objective for Deep
InfoMax models Bachman et al. (2019). The Mixture of Experts framework
Masoudnia and Ebrahimpour (2014), since its proposal, has achieved remarkable
success. Recent works have focused on modeling expert relationships, including
Top-k gating Shazeer et al. (2017), heuristic combinations Wang et al. (2018)
and DSelect-k Hazimeh et al. (2021). Our method combines MI and MoE structures
in an organic way to improve the adversarial robustness: the MoE architecture
provides the possibility of multi-angle learning, while MI, as one of the
auxiliary loss functions, further diversifies the learning expression of each
sub-expert network.

Figure 1: The Architecture of The Proposed “Immunity”

##  3 Background and Motivation

Computer vision has been profoundly impacted by adversarial attacks, because
images contain abundant redundant information which can provide attackers with
attack materials to fool models into incorrect predictions. In this paper, we
primarily focus on the issue of adversarial defense in image classification
tasks, and demonstrate how our proposed model and other state-of-the-art
defenses perform against various adversarial attacks. Take the most common
attack method, FGSM and PGD as examples to describe the principle of attack
algorithms:

_Fast Gradient Sign Method_ (FGSM). An efficient attack based on the gradient
of the cost function w.r.t. the neural network input.
$X^{*}=X-\alpha*sign(\nabla_{x}loss(x,y^{label})$.

_Projected Gradient Descent_ (PGD). A more powerful extension of FGSM via
multi-step variant,
$X_{0}=X,X^{t+1}=\prod_{X+S}{(X^{t}-\alpha*sign(\nabla_{x^{t}}loss(x^{t},y^{label})))}$,
where $\prod_{X+S}$ indicates projection to an allowed perturbation set $S$,
which is a ball centered at $X$.

According to the above principle, then we can explain our key motivation why
an MoE-based multi-angle learning approach with a Random Switch Gate can
provide effective defense. This answer is based on two premises: (i) Most
effective adversarial attacks must involve deliberately perturbing the
original input in an anti-gradient direction while random noise is unlikely to
mislead models. (ii) A single image contains a vast amount of redundant
information for classification tasks. Consequently, this redundancy leads to
significant divergence in learned parameters depending solely on model
initialization. Studies demonstrate models with identical architectures
exhibit distinct vulnerable spots when trained from different initializations.
Given adversarial attacks are linked to a special vulnerable direction, and
model vulnerability varies with random initialization, successfully attacking
the MoE architecture requires overcoming the randomization rised by multi-
angle learning to identify a universal weakness. This is inherently more
challenging. Our mutual information and position stability losses further
increase difficulty by promoting expert diversity. Additionally, the
interpretability afforded by the MoE structure plausibly improves robustness,
as interpretability is often positively associated with security.

##  4 Methodology

This section describes the core components of our proposed model for improving
adversarial robustness of neural networks. Our approach relies on a modified
Mixture-of-Experts architecture, along with 2 key constraints: mutual
information and position stability regularization. Each of these techniques is
described in detail. Figure 1 illustrates the overall architecture of our
model.

###  4.1 Enhancing Mixture of Experts Robustness via Novel Regularizations

A standard Mixture of Experts (MoE) learns from a set of expert networks
$f_{i}$ through a gating network $g$, where $i=1,2......N$ and $N$ is the
number of expert networks. The expert networks comprise standard CNNs like
ResNets and GoogLeNets. Although each expert network takes the same input $x$,
we refer to the inputs as $x_{i}$ for notation convenience, where each xi is a
duplicate of $x$. The final output is:

$\begin{split}&\hat{y}=\sum^{N}_{i=1}{g_{i}(x)\hat{y}_{i}}\\\ &where\ \
\hat{y}_{i}=\mathrm{softmax}(f_{i}(x_{i}))\end{split}$ (1)

Thus we obtain the first loss function based on cross-entropy to optimize the
classification accuracy.

$\displaystyle
loss_{CE}=-\sum^{M}_{m=1}{y^{label}_{m}log(\hat{y}_{m})}-\alpha\sum^{N}_{i=1}{\sum^{M}_{m=1}{y^{label}_{m}log(\hat{y}_{im})}}$

(2)

where $m$ indexes categories. This loss trains each expert network in a
supervised manner using the same labels. Further, the gate weights the expert
network’s outputs. Although determined after one-time training, we randomly
switch the gate parameters during inference to obtain diverse architectures.
As expert networks receive sufficient training, introducing the Random Switch
Gate does not impact classification but prevents attackers from targeting
fixed weights. Moreover, the simple structure of RSG also avoids instability
encountered in complex Neural Architecture Search algorithms.

In MoE, each expert learns different higher-level representation. However,
without external constraints, the distinctions between expert representations
are not readily apparent or pronounced. To enhance model robustness, we impose
constraints to achieve: (i) Unique expert learning basis - for example, in
bird classification, experts may focus on different components like wings,
claws and feathers. Once these judgments are combined and supervised by the
gating network, stable outputs can be maintained even if one component is
attacked. (ii) Causal representations - for instance, high-flying birds
correlate with clouds but may not imply causation. Adversarial attacks often
exploit such non-causal spurious correlations between input patterns and model
outputs. By constraining experts to learn more robust causal representations
and thus enhance model security, we aim to remove potentially vulnerable non-
causal links. We consequently design the MoE framework based on these
principles to enhance adversarial robustness.

###  4.2 Interpreting Experts through Grad-CAM

In order to promote diversity and causality of learned representation in
experts, we first leverage Grad-CAM to determine each pixel’s importance for
an expert’s output decision. In our model, Grad-CAM is applied to the last
convolutional layer $A_{i}$ with dimensions exceeding $8*8$, chosen after
experimentation to balance high-level semantics and spatial details. For a
given class label, Grad-CAM averages the gradient of the label output
$y^{label}$ w.r.t. all channels, indicating importance. The heatmap of $A_{i}$
is

$\begin{split}&H^{label}_{i}=ReLU(\sum^{M}_{k=1}{\alpha^{k}_{i}A^{k}_{i}})\\\
&with\ \ \ \alpha^{k}_{i}=\frac{1}{M}\sum_{u,v}\frac{\partial
y^{label}}{\partial A^{k}_{i(u,v)}}\end{split}$ (3)

where $k=1,2......M$ indexes channels and $(u,v)$ represents the denotes
feature coordinates in $A_{i}$. Then we reduce $h_{i}$, the heatmap of
$x_{i}$, by linear interpolation of $H^{label}_{i}$, the activation heatmap of
$A_{i}$. Despite all experts receiving virtually identical inputs $x_{i}$ , we
aim to generate unique heatmaps $h_{i}$ for each individual expert network.

###  4.3 Simplified MI for Expert Diversity

A straightforward approach to improve expert diversity is minimizing the
mutual information between learned high-level representations for each
individual expert networks. However, this has several limitations: (i)
Basically, accurately calculating global MI of learned representations is
challenging; (ii) As high-level features are intermediate representations
containing implicit info about final outputs, constraining their MI could
negatively impact accuracy; (iii) Additionally, minimizing MI between full
representations fundamentally misaligns with our goal of enabling experts to
learn distinct representations from original pixel-level.

Instead, we propose to maximize $I(C,E)$, the MI between two variables: $C$, a
randomly sampled pixel (its coordinate) weighted by output influence; and $E$,
the expert network this pixel originates from.

$\begin{split}I(C,E)=\sum_{E}{\sum_{C}{p(c,e)log\frac{p(c,e)}{p(c)p(e)}}}\end{split}$
(4)

MI is a Shannon entropy-based measure to quantify the dependence of two random
variables, thus the higher $I(C,E)$, the stronger the correlation between $C$
and $E$, indicating more distinct features learned by each expert network.
Note that $p(c,e)=p(c|e)p(e)$ and $p(c)=\sum_{E}{p(c|e)p(e)}$, then we can
obtain

$\begin{split}I(C,E)&=\sum_{E}{\sum_{C}{p(c,e)log\frac{p(c,e)}{p(c)p(e)}}}\\\
&=\sum_{E}{\sum_{C}{p(c|e)p(e)log\frac{p(c|e)}{p(c)}}}\\\
&=\frac{1}{N}\sum_{E}{\sum_{C}{p(c|e)log\frac{p(c|e)}{\sum_{E}{(p(c|e)p(e))}}}}\\\
&=\frac{1}{N}\sum_{i}{\mathbb{E}_{E=i}log\frac{Np(c|E=i)}{\sum_{j}{p(c|E=j)}}}\end{split}$
(5)

We approximate the distribution $p(c|E=i)$ by using heatmaps $h_{i}$ as a
surrogate. According to Equation (5), maximizing $I(C,E)$ is approximately
equivalent to maximizing the mathematical expectation of the distance between
each heatmap $h_{i}$ and their mean.

An intuitive interpretation of the theoretical maximum in Equation (4) can be
provided through the following example. Consider dividing input $x$ into N
uniform subregions,and each subregion is assigned a uniform heatmap ($x$ can
be viewed as consisting of N pixels). Under this formulation, Equation (4) can
be rewritten as:

$\begin{split}I(C,E)=&\frac{1}{N}\sum_{i}{\mathbb{E}_{E=i}log\frac{Np(c|E=i)}{\sum_{j}{p(c|E=j)}}}\\\
=\frac{1}{N}\sum_{i=2}^{N}\sum_{k=1}^{N}&p(c_{k}|E=i)\\\
&log\frac{Np(c_{k}|E=i)}{p(c_{k}|E=1)+\sum_{j\neq 1}{p(c_{k}|E=j)}}\\\
+\frac{1}{N}\sum_{k=1}^{N}&p(c_{k}|E=1)\\\
&log\frac{Np(c_{k}|E=1)}{p(c_{k}|E=1)+\sum_{j\neq
1}{p(c_{k}|E=j)}}\end{split}$ (6)

Assume $l=\operatorname*{argmin}_{k}\sum_{j\neq 1}{p(c_{k}|E=j)}$, we
artificially construct a distribution $p^{*}(c_{k}|E=1)$ satisfying:

$p^{*}(c_{k}|E=1)=\begin{cases}1&if\ k=l\\\ 0&if\ k\neq l\end{cases}$ (7)

Under this formulation, we can derive an upper bound on Equation (6)

$\begin{split}&I(C,E)\leq\frac{1}{N}\sum_{i=2}^{N}({\sum_{k\neq
l}{p(c_{k}|E=i)log\frac{Np(c_{k}|E=i)}{\sum_{j\neq 1}{p(c_{k}|E=j)}}}}\\\
&+p(c_{l}|E=i)log\frac{Np(c_{l}|E=i)}{1+\sum_{j\neq 1}{p(c_{l}|E=j)}})\\\
&+\frac{1}{N}log\frac{N}{1+\sum_{j\neq 1}{p(c_{l}|E=j)}}\\\
&=\frac{1}{N}(\mathbb{E}_{E=1}log\frac{Np^{*}(c|E=1)}{p^{*}(c|E=1)+\sum_{j=2}^{N}{p(c|E=j)}}\\\
&+\sum_{i=2}^{N}{\mathbb{E}_{E=i}log\frac{Np(c|E=i)}{p^{*}(c|E=1)+\sum_{j=2}^{N}{p(c|E=j)}}})\end{split}$
(8)

Equation (8) proves that, when $p(c|E=i)\ \ \forall i\geq 2$ is fixed, (4)
will reach its maximum if and only if $p(c|E=1)=p^{*}(c|E=1)$. This implies
the $1_{st}$ expert focuses solely on the $l_{th}$ subregion. Similarly, each
expert network should learn unique subregions to maximize $I(C,E)$.

Based on the above, we define the second loss function $loss_{MI}$ as

$\begin{split}loss_{MI}=-\sum_{i=1}^{N}{\sum_{a,b}{h_{i(a,b)}log\frac{h_{i(a,b)}}{\sum_{j=1}^{N}{h_{j(a,b)}}}}}\end{split}$
(9)

Where $(a,b)$ denotes the coordinates of $h_{i}$. Obviously, $loss_{MI}$
provides a simplified estimation of the inverse of $I(C,E)$.

###  4.4 Regularizing Experts via Position Stability Index

We incorporate position stability of salient regions as our third loss to
promote expert causality. If a pattern consistently triggers an expert’s
decision of correct result, his position should remain relatively stable
across images.

For each heatmap $h_{i}$ of expert networks, we computed the “centre of mass”
$(X^{C}_{i},Y^{C}_{i})$ as follow

$\begin{split}&X^{C}_{i}=\frac{\sum_{a,b}{ah_{i(a,b)}}}{\sum_{a,b}{h_{i(a,b)}}},\
\ Y^{C}_{i}=\frac{\sum_{a,b}{bh_{i(a,b)}}}{\sum_{a,b}{h_{i(a,b)}}}\end{split}$
(10)

Where $(a,b)$ is the coordinate of $h_{i}$. $(X^{C}_{i},Y^{C}_{i})$ represents
the focus of the $i_{th}$ expert network. Based on the above assumptions, if
the experts learn causal representations, the distance between their “centre
of mass ” should not change a lot. Lastly, we define the third loss to
minimize the variance of these distance across various images in a mini-batch:

$\begin{split}&loss_{PS}=\sum_{i,j}{\sum_{q=1}^{mb}{{(d_{q\\_i,j}^{2}-\frac{1}{mb}\sum_{q=1}^{mb}{d_{q\\_i,j}^{2}})^{2}}}}\\\
&with\ \
d_{q\\_i,j}^{2}=(X^{C}_{q\\_i}-X^{C}_{q\\_j})^{2}+(Y^{C}_{q\\_i}-Y^{C}_{q\\_j})^{2}\end{split}$
(11)

where $mb$ is the number of sample in a mini-batch.

###  4.5 Objective and Training Techniques

The overall loss function for a mini-batch combines the cross-entropy, mutual
information, and position stability losses:

$\begin{split}Loss=&\frac{1}{mb}\\{\sum_{q=1}^{mb}{loss_{CE}}+\frac{\beta}{N}\sum_{q=1}^{mb}{loss_{MI}}\\\
&+\frac{\gamma}{N(N-1)}loss_{PS}\\}\end{split}$ (12)

where $loss_{CE}$, $loss_{MI}$, $loss_{PS}$ are defined in equations (2), (9),
(11), respectively, and $\beta$, $\gamma$ are multi-objective coefficients. We
apply both standard and adversarial training to test their effectiveness
separately. In addition, adversarial training is known to be highly effective
for defense, and the idea is to use adversarial examples during training and
plays a min-max game Kannan et al. (2018). The inner maximization generates
strong adversarial examples that maximize the cross-entropy loss. The outer
minimization then updates model parameters to minimize the loss. While
adversarial training can significantly improve model accuracy by adversarial
samples, it comes at the cost of greatly reduced accuracy on clean examples.

##  5 Experiment

Our experiments evaluate the robustness and defense capabilities of the
proposed Immunity model against various evasion and poisoning attacks. The key
questions are:

  1. 1.

Can Immunity exhibit enhanced resilience across diverse attack types?

  2. 2.

Which modules - mixture-of-experts, mutual information loss, or position
stability loss - most significantly impact Immunity’s performance?

  3. 3.

How can Grad-CAM’s novel visual explanations elucidate Immunity’s robustness?

###  5.1 Experiment Setting

####  5.1.1 Dataset

We conduct classification on the CIFAR-10 and CIFAR-100 dataset, comprising
32x32 pixel images spanning 10 and 100 classes. Training and test sets are
normalized via channel means and standard deviations. We apply standard data
augmentation including random crops and rotations.

####  5.1.2 Adversarial Attacks

We evaluate both standard and adversarial training. Evasion attacks for
robustness quantification include FGSMGoodfellow et al. (2014), BIM Kurakin et
al. (2016b), MIMDong et al. (2017), PGDMadry et al. (2017b) Attacks use an
8/255 perturbation scale and 20 iterations for BIM, MIM and PGD attacks, and
they are inspired from GitHub111https://github.com/Harry24k/adversarial-
attacks-pytorch.

####  5.1.3 Defence Baselines

Defense baselines are P-DARTSChen et al. (2019), RobNetsGuo et al. (2019),
AdvRushMok et al. (2021) \- state-of-the-art methods using regularization.
Models are trained per original specifications with default settings in
perspective GitHub project page.

####  5.1.4 “Immunity”

We train Immunity for 200 epochs (batch size 32) under both standard and
adversarial regimes, using SGD as optimizer with learning rate 0.01 and weight
decay 5e-4. Moreover, we ensemble 5 experts in our experiments, conducted on
an Nvidia Tesla V100S PCIE GPU.

###  5.2 Experiment Analysis

Our experiment employs three prominent deep neural network architectures as
the expert models. Subsequently, we select the most proficient architecture as
an expert to train the Immunity model. Additionally, we add mutual information
and position stability index to calculate the robustness of the models.

Our experiment analysis has four parts. Firstly, we compared the performance
of standard CNNs with their corresponding Immunity models to determine the
most effective expert for training the Immunity model. Secondly, we perform
evaluations to assess the robustness of various models against evasion and
poisoning attacks. Thirdly, we explain the robustness of the Immunity network
architectures through ablation study. Lastly we visualize our expert Grad-CAM
heatmap to explain robustness.

####  5.2.1 Key Expert Selection in “Immunity”

We first evaluate three prominent CNNs - ResNet18, DenseNet121, and GoogLeNet
on CIFAR-10. These models then serve as expert candidates for training the
Immunity model. To fully assess defense capabilities beyond accuracy, we
introduce two metrics - Independence Score (IScore) and Causality Score
(CScore) based on lossMI and lossPS:

IScore. Quantifies expert heatmap differences via mean squared intensity
deviations, relevant parameters in formula 9:

$IScore=\frac{1}{N(N-1)}\sum_{i,j}^{N,N}{\sum_{a,b}{(h_{i(a,b)}-h_{j(a,b)})^{2}}}$

CScore. Measures expert focus variance across images using center of mass
distances, relevant parameters in formula 11:

$CScore=\frac{1}{mb}\sum_{i,j}{\sum_{q=1}^{mb}{{(d_{q\\_i,j}^{2}-\frac{1}{mb}\sum_{q=1}^{mb}{d_{q\\_i,j}^{2}})^{2}}}}$

We simulate experts by training CNNs independently 5 times. Compared to
standalone CNNs, Immunity improves IScore and CScore substantially despite a
minor accuracy drop, indicating enhanced robustness.For attack defense, we
determine the optimal Immunity expert. As shown in Table 1, GoogLeNet achieves
the highest accuracy of 95.01%, surpassing ResNet18 and DenseNet121. Among the
Immunity variants, Immunity-GoogLeNet obtains the best accuracy of 93.46%,
superior to Immunity-ResNet18 and Immunity-DenseNet121. Therefore, we select
GoogLeNet as the ideal expert for the Immunity model.

Model | Accuray | IScore | CScore
---|---|---|---
ResNet18 | 94.14% | 0.344 | 0.026
Immunity-ResNet18 | 91.89% | 0.125 | 0.003
GoogLeNet | 95.01% | 0.352 | 0.022
Immunity-GoogLeNet | 93.46% | 0.117 | 0.001
DenseNet121 | 94.07% | 0.313 | 0.026
Immunity-DenseNet121 | 91.73% | 0.119 | 0.004
Table 1: Evaluation of Candidate Experts for “Immunity”

####  5.2.2 Robustness Study: Adversarial Attack Resilience

We evaluate robustness against prominent FGSM, BIM, MIM, and PGD attacks. The
PGD attack is $l_{\infty}$-bounded with total perturbation scale of 8/255 and
20 step iterations. Then we calculate the accuracy of defence models including
P-DARTS, RobNets, AdvRush and Immunity model under these various attack modes.

We present attack results on CIFAR-10 and CIFAR-100 under standard training
and adversarial training as illustrated in the table 2. The conclusion is
evident: in the absence of attacks during standard training mode, Immunity
exhibits slight lower accuracy compared to part of the baseline models.
However, following adversarial attacks, Immunity demonstrates a notable
improvement, achieving approximately 5% to 10% higher accuracy than other
models . In the adversarial training mode, Immunity significantly outperforms
other state-of-the-art methods weather being attacked or not. It demonstrates
approximately 2% to 5% higher accuracy in a clean test environment and
achieves 2% to 15% approximately higher accuracy under adversarial attacks ,
which is notably superior to other baselines.

Dataset | Training Mode | Model | Clean | FGSM | BIM | MIM | PGD
---|---|---|---|---|---|---|---
CIFAR-10 | Standard Training | GoogLeNet | 95.01% | 47.64% | 45.39% | 44.54% | 38.10%
RobNets | 92.50% | 50.43% | 55.76% | 60.33% | 46.07%
P-DARTS | 94.61% | 53.97% | 55.96% | 54.88% | 37.04%
AdvRush | 97.58% | 60.38% | 51.68% | 56.63% | 41.55%
Immunity | 93.46% | 60.24% | 62.19% | 61.69% | 54.72%
Adversarial Training | GoogLeNet | 89.40% | 57.67% | 56.88% | 57.23% | 50.09%
RobNets | 85.66% | 60.64% | 59.94% | 58.86% | 54.92%
P-DARTS | 83.87% | 63.50% | 61.58% | 41.54% | 39.91%
AdvRush | 86.38% | 62.27% | 58.96% | 60.84% | 56.63%
Immunity | 88.25% | 64.74% | 64.32% | 62.98% | 59.81%
CIFAR-100 | Standard Training | GoogLeNet | 76.10% | 36.26% | 31.89% | 30.48% | 24.80%
RobNets | 71.79% | 46.38% | 40.03% | 40.06% | 33.78%
P-DARTS | 68.47% | 48.55% | 43.11% | 39.96% | 34.33%
AdvRush | 66.53% | 49.72% | 45.15% | 41.29% | 37.15%
Immunity | 74.01% | 51.64% | 44.34% | 42.09% | 40.62%
Adversarial Training | GoogLeNet | 70.93% | 47.05% | 44.03% | 42.47% | 38.58%
RobNets | 67.44% | 50.26% | 46.13% | 44.86% | 41.89%
P-DARTS | 66.14% | 49.17% | 47.71% | 45.32% | 43.11%
AdvRush | 64.43% | 49.39% | 45.15% | 46.31% | 44.45%
Immunity | 68.19% | 54.93% | 48.48% | 47.17% | 45.24%
Table 2: Accuracy of “Immunity” and Baseline Methods Under Attacks with
Standard & Adversarial Training

####  5.2.3 Ablation Study: Evasion Attack Evaluation

To determine the most critical Immunity component, we evaluate Mixture-of-
Experts (MoE) variants on CIFAR-10 under standard training:

  1. 1.

MoE: Vanilla model

  2. 2.

MoE+MI: model with mutual information loss

  3. 3.

MoE+PS: model with position stability loss

| Clean | FGSM | BIM | PGD
---|---|---|---|---
GoogLeNet | 95.01% | 47.64% | 45.39% | 38.10%
MoE | 94.74% | 53.26% | 55.54% | 48.44%
MoE+MI | 93.19% | 58.91% | 60.90% | 52.02%
MoE+PS | 93.58% | 55.42% | 58.99% | 49.87%
Immunity | 93.46% | 60.24% | 62.19% | 54.72%
Table 3: Ablation Study for “Immunity”

As shown in Table 3, under clean training vanilla MoE achieves the highest
accuracy of 94.74%, surpassing MoE+PS and MoE+MI. However, against evasion
attacks, MoE+MI exhibits approximately 2-5% higher accuracy over MoE+PS and
MoE. This suggests mutual information loss significantly impacts Immunity’s
performance, while position stability loss still improves MoE robustness. Both
modules are crucial for Immunity’s overall robustness gains. But the ablation
study highlights mutual information as the most vital component for
adversarial defense.

####  5.2.4 Visualization Study: Immunity Heatmaps

We want to visualize Immunity model to explain why our model is robust, hence
we generate images and their corresponding expert Grad-CAM heatmaps to
highlight the distinctive characteristics of each expert. We put 4 sampled
pictures and their Grad-CAM heatmaps into a 4*6 matrix, the first column is a
32*32*3 raw picture in each row and follows five normalized 32*32*3 Immunity
expert Grad-CAM heatmaps after standard training.

The intensity of the heatmap corresponds to the importance of each part, with
lighter regions indicating higher significance compared to other areas.
Looking at the second row in the figure 2, we can clearly observe that each
expert has some different concentrates on exampled picture. Moving from left
to right, the expert Grad-CAM heatmaps specialize in capturing details related
to the body, ears and hind legs, head, back, tail and front legs of the dog.

##  6 Conclusion and Future Works

Figure 2: Visualization of “Immunity” Expert Heatmaps and Original Input
Images

In summary, we have proposed “Immunity”, a novel regularized Mixture-of-
Experts framework strengthened by mutual information and position stability
techniques to enhance adversarial robustness. Through extensive experiments on
benchmark datasets, we have demonstrated that Immunity significantly
outperforms state-of-the-art defenses against a wide array of evasion and
poisoning attacks under both standard and adversarial training protocols. The
consistent superiority of Immunity highlights the effectiveness of
diversifying and regularizing experts within ensemble architectures to
withstand adversarial manipulations. This work opens exciting avenues for
future research into robust and interpretable multi-gate MoE algorithms that
leverage mutual information principles for broader applications involving
multi-modal, graph, and other complex data. By combining diversity, causality,
and interpretability within ensemble models, this research direction could
help develop more robust defenses beyond current security-robustness trade-
offs, enabling steady progress toward delivering trustworthy and reliable AI
systems.

## References

  * Abusnaina et al. [2021] Ahmed Abusnaina, Yuhang Wu, Sunpreet Arora, Yizhen Wang, Fei Wang, Hao Yang, and David Mohaisen.  Adversarial example detection using latent neighborhood graph.  In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 7687–7696, 2021.
  * Amrutha et al. [2020] CV Amrutha, C Jyotsna, and J Amudha.  Deep learning approach for suspicious activity detection from surveillance video.  In 2020 2nd International Conference on Innovative Mechanisms for Industry Applications (ICIMIA), pages 335–339. IEEE, 2020.
  * Bachman et al. [2019] Philip Bachman, R Devon Hjelm, and William Buchwalter.  Learning representations by maximizing mutual information across views.  Advances in neural information processing systems, 32, 2019.
  * Belghazi et al. [2018] Mohamed Ishmael Belghazi, Aristide Baratin, Sai Rajeshwar, Sherjil Ozair, Yoshua Bengio, Aaron Courville, and Devon Hjelm.  Mutual information neural estimation.  In International conference on machine learning, pages 531–540. PMLR, 2018.
  * Bengio [2017] Yoshua Bengio.  The consciousness prior.  arXiv preprint arXiv:1709.08568, 2017.
  * Brakel and Bengio [2017] Philemon Brakel and Yoshua Bengio.  Learning independent features with adversarial nets for non-linear ica.  arXiv preprint arXiv:1710.05050, 2017.
  * Carlini and Wagner [2018] Nicholas Carlini and David A. Wagner.  Audio adversarial examples: Targeted attacks on speech-to-text.  2018 IEEE Security and Privacy Workshops (SPW), pages 1–7, 2018.
  * Chen et al. [2019] Xin Chen, Lingxi Xie, Jun Wu, and Qi Tian.  Progressive differentiable architecture search: Bridging the depth gap between search and evaluation.  2019 IEEE/CVF International Conference on Computer Vision (ICCV), pages 1294–1303, 2019.
  * Chilamkurthy et al. [2018] Sasank Chilamkurthy, Rohit Ghosh, Swetha Tanamala, Mustafa Biviji, Norbert G Campeau, Vasantha Kumar Venugopal, Vidur Mahajan, Pooja Rao, and Prashant Warier.  Deep learning algorithms for detection of critical findings in head ct scans: a retrospective study.  The Lancet, 392(10162):2388–2396, 2018.
  * Dimitrov et al. [2020] Dimitar I Dimitrov, Gagandeep Singh, Timon Gehr, and Martin Vechev.  Provably robust adversarial examples.  arXiv preprint arXiv:2007.12133, 2020.
  * Dong et al. [2017] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li.  Boosting adversarial attacks with momentum.  2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9185–9193, 2017.
  * Goodfellow et al. [2014] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and harnessing adversarial examples.  CoRR, abs/1412.6572, 2014.
  * Guo et al. [2018] Chuan Guo, Mayank Rana, and Moustapha Cisse.  Lau-rens van der maaten,“countering adversarial images using input transformations,”.  In International Conference on Learning Representations, 2018.
  * Guo et al. [2019] Minghao Guo, Yuzhe Yang, Rui Xu, Ziwei Liu, and Dahua Lin.  When nas meets robustness: In search of robust architectures against adversarial attacks.  arXiv preprint arXiv:1911.10695, 2019.
  * Hazimeh et al. [2021] Hussein Hazimeh, Zhe Zhao, Aakanksha Chowdhery, Maheswaran Sathiamoorthy, Yihua Chen, Rahul Mazumder, Lichan Hong, and Ed Chi.  Dselect-k: Differentiable selection in the mixture of experts with applications to multi-task learning.  Advances in Neural Information Processing Systems, 34:29335–29347, 2021.
  * Jia et al. [2019] Xiaojun Jia, Xingxing Wei, Xiaochun Cao, and Hassan Foroosh.  Comdefend: An efficient image compression model to defend adversarial examples.  In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 6084–6092, 2019.
  * Kannan et al. [2018] Harini Kannan, Alexey Kurakin, and Ian Goodfellow.  Adversarial logit pairing.  arXiv preprint arXiv:1803.06373, 2018.
  * Kleppe et al. [2021] Andreas Kleppe, Ole-Johan Skrede, Sepp De Raedt, Knut Liestøl, David J Kerr, and Håvard E Danielsen.  Designing deep learning studies in cancer diagnostics.  Nature Reviews Cancer, 21(3):199–211, 2021.
  * Kurakin et al. [2016a] Alexey Kurakin, Ian Goodfellow, and Samy Bengio.  Adversarial machine learning at scale.  arXiv preprint arXiv:1611.01236, 2016.
  * Kurakin et al. [2016b] Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio.  Adversarial examples in the physical world.  ArXiv, abs/1607.02533, 2016.
  * Liu et al. [2018] Xuanqing Liu, Minhao Cheng, Huan Zhang, and Cho-Jui Hsieh.  Towards robust neural networks via random self-ensemble.  In Proceedings of the European Conference on Computer Vision (ECCV), pages 369–385, 2018.
  * Madry et al. [2017a] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards deep learning models resistant to adversarial attacks.  arXiv preprint arXiv:1706.06083, 2017.
  * Madry et al. [2017b] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards deep learning models resistant to adversarial attacks.  ArXiv, abs/1706.06083, 2017.
  * Margeloiu et al. [2020] Andrei Margeloiu, Nikola Simidjievski, Mateja Jamnik, and Adrian Weller.  Improving interpretability in medical imaging diagnosis using adversarial training.  arXiv preprint arXiv:2012.01166, 2020.
  * Masoudnia and Ebrahimpour [2014] Saeed Masoudnia and Reza Ebrahimpour.  Mixture of experts: a literature survey.  Artificial Intelligence Review, 42:275–293, 2014.
  * Mok et al. [2021] Ji-Yoon Choi Ji-Hyeok Moon Young-Ilc Mok, Byunggook Na, Hyeokjun Choe, and Sungroh Yoon.  Advrush: Searching for adversarially robust neural architectures.  2021 IEEE/CVF International Conference on Computer Vision (ICCV), pages 12302–12312, 2021.
  * Papernot et al. [2017] Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami.  Practical black-box attacks against machine learning.  In Proceedings of the 2017 ACM on Asia conference on computer and communications security, pages 506–519, 2017.
  * Prakash et al. [2018] Aaditya Prakash, Nick Moran, Solomon Garber, Antonella DiLillo, and James Storer.  Deflecting adversarial attacks with pixel deflection.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 8571–8580, 2018.
  * Sanchez et al. [2020] Eduardo Hugo Sanchez, Mathieu Serrurier, and Mathias Ortner.  Learning disentangled representations via mutual information estimation.  In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XXII 16, pages 205–221. Springer, 2020.
  * Selvaraju et al. [2017] Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra.  Grad-cam: Visual explanations from deep networks via gradient-based localization.  In Proceedings of the IEEE international conference on computer vision, pages 618–626, 2017.
  * Shazeer et al. [2017] Noam Shazeer, Azalia Mirhoseini, Krzysztof Maziarz, Andy Davis, Quoc Le, Geoffrey Hinton, and Jeff Dean.  Outrageously large neural networks: The sparsely-gated mixture-of-experts layer.  arXiv preprint arXiv:1701.06538, 2017.
  * Stocco et al. [2022] Andrea Stocco, Paulo J Nunes, Marcelo D’Amorim, and Paolo Tonella.  Thirdeye: Attention maps for safe autonomous driving systems.  In Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering, pages 1–12, 2022.
  * Tramèr et al. [2017] Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel.  Ensemble adversarial training: Attacks and defenses.  arXiv preprint arXiv:1705.07204, 2017.
  * Wang et al. [2018] Xin Wang, Fisher Yu, Zi-Yi Dou, Trevor Darrell, and Joseph E Gonzalez.  Skipnet: Learning dynamic routing in convolutional networks.  In Proceedings of the European Conference on Computer Vision (ECCV), pages 409–424, 2018.
  * Wang et al. [2019] Xiao Wang, Siyue Wang, Pin-Yu Chen, Yanzhi Wang, Brian Kulis, Xue Lin, and Peter Chin.  Protecting neural networks with hierarchical random switching: Towards better robustness-accuracy trade-off for stochastic defenses.  arXiv preprint arXiv:1908.07116, 2019.
  * Wang et al. [2020a] Haofan Wang, Rakshit Naidu, Joy Michael, and Soumya Snigdha Kundu.  Ss-cam: Smoothed score-cam for sharper visual feature localization.  arXiv preprint arXiv:2006.14255, 2020.
  * Wang et al. [2020b] Haofan Wang, Zifan Wang, Mengnan Du, Fan Yang, Zijian Zhang, Sirui Ding, Piotr Mardziel, and Xia Hu.  Score-cam: Score-weighted visual explanations for convolutional neural networks.  In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops, pages 24–25, 2020.
  * Xie et al. [2020] Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan L Yuille, and Quoc V Le.  Adversarial examples improve image recognition.  In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 819–828, 2020.
  * Yu et al. [2019] Yueyao Yu, Pengfei Yu, and Wenye Li.  Auxblocks: defense adversarial examples via auxiliary blocks.  In 2019 International Joint Conference on Neural Networks (IJCNN), pages 1–8. IEEE, 2019.
  * Yuan et al. [2019] Xiaoyong Yuan, Pan He, Qile Zhu, and Xiaolin Li.  Adversarial examples: Attacks and defenses for deep learning.  IEEE transactions on neural networks and learning systems, 30(9):2805–2824, 2019.
  * Zhang et al. [2019] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan.  Theoretically principled trade-off between robustness and accuracy.  In International conference on machine learning, pages 7472–7482. PMLR, 2019.
  * Zhou et al. [2016] Bolei Zhou, Aditya Khosla, Agata Lapedriza, Aude Oliva, and Antonio Torralba.  Learning deep features for discriminative localization.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2921–2929, 2016.
  * Zhou et al. [2022] Dawei Zhou, Nannan Wang, Xinbo Gao, Bo Han, Xiaoyu Wang, Yibing Zhan, and Tongliang Liu.  Improving adversarial robustness via mutual information estimation.  In International Conference on Machine Learning, pages 27338–27352. PMLR, 2022.