Pith. sign in

REVIEW 1 major objections 6 minor 26 references

Adversarial Robustness of Bottleneck Injected Deep Neural Networks for Task-Oriented Communication

T0 review · 1 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper shows that shallow-bottleneck neural codecs are consistently more vulnerable to adversarial attacks than deep-bottleneck codecs in task-oriented communication, and that the generative decoders such systems rely on add a…

desk verdict Useful empirical benchmark for task-oriented codecs under attack, but the central 'bottleneck depth' claim is confounded by a 10–100x bitrate gap and by different training setups, so the paper needs a reframe rather than a headline. read the letter →

arxiv 2412.10265 v1 pith:WM2PQU4A submitted 2024-12-13 cs.LG cs.DCcs.NIeess.IV

Alireza Furutanpey , Pantelis A. Frangoudis , Patrik Szabo , Schahram Dustdar This is my paper · ORCID
classification cs.LGcs.DCcs.NIeess.IV
keywords adversarialrobustnessinformationbottlenecktask-orientedcommunicationshallowvariationalinjectiondeepgoal-orientedcompressiongenerativemodelsattacks
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether the depth at which an information bottleneck is injected into a neural codec determines how well that codec withstands adversarial attacks, in the setting of task-oriented communication. It establishes empirically that a shallow variational bottleneck (SVBI) is consistently less robust to standard white-box attacks than a deep variational information bottleneck (DVIB), and that the gap grows with task complexity. The paper also shows that IB-trained models are more robust than ordinary log-loss baselines, and that adding a generative decoder to recover salient information creates a separate, exploitable attack surface. A sympathetic reader would care because next-generation communication systems are expected to run shallow encoders under tight latency budgets, and this work suggests that security is shaped by where the bottleneck sits.

What carries the argument

The central object is the placement of the variational information bottleneck along the network's depth. SVBI injects the bottleneck into the first high-level block of a pre-trained backbone, keeping the encoder shallow (roughly 100,000-150,000 parameters) and using head distillation to match shallow features; DVIB places the bottleneck at the penultimate layer and optimizes a rate-distortion objective. The argument that depth matters runs through the information-bottleneck Markov chain $I(X; Y) \geq I(R_1; Y) \geq \dots \geq I(R_n; Y) \geq I(\hat{Y}; Y)$, which the paper uses to claim that longer information paths can discard redundant information more gradually. This depth-versus-task-specificity contrast is the mechanism the experiments are designed to test.

What would settle it

Train SVBI and DVIB models on the same tasks while adjusting their codecs to the same bit per pixel rate, then repeat the same attacks; if the robustness gap largely disappears or reverses, the paper's attribution of robustness to bottleneck depth is not supported.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central discovery is an empirical ordering: across CIFAR-10, SVHN, and ImageNet64, and for FGSM, EAD, C&W, and JSMA-style attacks, models trained with SVBI suffer larger accuracy drops than models trained with DVIB, while both outperform base models trained with plain log-loss. The authors conjecture that the reason is the Markov chain of representations: deeper processing before the bottleneck gives the network more opportunities to filter redundant (adversarially informative) content, and the task-specificity of the deep objective leaves less exploitable ambiguity. A final experiment uses the Tabacof targeted attack on MNIST to show that injecting a variational autoencoder-based codec makes the overall system predict the attack's target label far more often than a baseline model, indicating that the generative component itself widens the attack surface.

Load-bearing premise

The comparison assumes that the chosen bitrates for SVBI and DVIB are comparable operating points, so the measured robustness gap can be attributed to bottleneck depth rather than to the much lower compression rate of DVIB.

Editorial extensions

If this is right

  • Information-bottleneck training provides a meaningful robustness floor over standard log-loss training for task-oriented codecs.
  • Deep bottleneck placement should be preferred over shallow placement when adversarial robustness is a system requirement.
  • The robustness gap between SVBI and DVIB should be expected to widen as tasks become more complex.
  • Systems that use generative decoders to reconstruct salient information should budget for a larger attack surface than the downstream classifier alone.
  • Defenses for task-oriented communication should prioritize attacks that perturb few pixels with high intensity, since IB-based models resist those less well.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the depth explanation holds, then a shallow encoder paired with a deeper post-bottleneck decoder might recover some robustness without increasing sequential encoder depth, a design the paper does not test.
  • The observed bitrate asymmetry (DVIB uses 10-100 times lower bpp) suggests an unseparated confound; a matched-bitrate follow-up could determine whether the robustness benefit comes from bottleneck depth or from retaining less information overall.
  • The Tabacof result implies that even a 'defensive' autoencoder can be turned into an attack amplifier, which may carry over to other generative codecs such as diffusion-based semantic compressors.
  • A natural extension would be to treat robustness against sparse high-intensity perturbations as an explicit objective term alongside rate and distortion.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

1 major / 6 minor

Summary. The paper studies the adversarial robustness of information-bottleneck (IB) based task-oriented communication systems. It compares three model families: standard log-loss baselines, shallow variational bottleneck injection (SVBI), and deep variational information bottleneck (DVIB), across CIFAR-10, SVHN, and ImageNet64, under FGSM, EAD, C&W, and JSMA/JSMAOnePixel attacks. The central empirical claims are that SVBI provides less adversarial robustness than DVIB, that this gap widens with task complexity, and that using generative models for task-oriented communication increases the attack surface, as illustrated by a Tabacof-style attack on MNIST. The paper concludes that IB-based objectives give some resilience against downstream-task attacks but that the generative components introduce new vulnerabilities.

Significance. If the central depth-vs-robustness claim were supported, the result would be directly useful for designing task-oriented communication systems, guiding whether shallow, low-latency encoders are acceptable from a security perspective. The paper has concrete strengths: it uses standard attack implementations from torchattacks, covers multiple datasets and architectures, reports bitrate operating points, and explicitly states the bitrate-selection procedure in Section IV-B. However, the headline comparison between SVBI and DVIB is not a controlled ablation of bottleneck depth because bitrate, training objective, and trainable-layer configuration all differ between the two methods. The paper's contribution therefore rests on an undersupported causal interpretation of an otherwise plausible empirical ordering.

major comments (1)
  1. [§IV-E, Table III] The Tabacof-attack experiment is reported in a way that is difficult to interpret and appears internally inconsistent. The text says that 'the models have near-perfect accuracy on MNIST', yet Table III lists Acc@1 values of 61.6, 76.57, and 33.17 for the base ResNet models. If these are unperturbed accuracies, they contradict the text; if they are post-attack accuracies, the 'hits' column is not a calibrated attack-success metric without a comparison to the natural prediction distribution. It is also unclear whether the attack was evaluated only on the reconstruction path or on the full encoder-decoder-classifier pipeline, which matters because Section III-B claims the vulnerability persists regardless of the downstream task. Please clarify the metric, report attack success relative to the label distribution, and add an appropriate control condition.
minor comments (6)
  1. [§IV-E] There is a typo: 'incrases' should be 'increases'.
  2. [Figure 2] The caption contains a garbled sequence ('64 642 643...') that appears to be a rendering error; please recheck the figure caption.
  3. [Figure 6] The caption says 'FSGSM' instead of 'FGSM'.
  4. [§IV-A] The heading 'Adversarial Attacks and Image Perturbations' duplicates Section III-C and seems to be a leftover; consider renaming it 'Experimental Setup'.
  5. [Table II] The table structure is hard to parse because the 'Model' column entries appear separated from the dataset headers; also consider including the number of runs and error bars in the table.
  6. [§II-A5] The claim that the attack's efficacy is 'irrespective of whether we map the latent to an approximation of the original image or use it for some image recognition downstream task' is strong and would benefit from experimental support or a softened phrasing.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the robustness ordering is measured against external attack benchmarks, not derived from the SVBI definition or from the authors' prior work.

full rationale

The paper's central claim that SVBI provides less adversarial robustness than DVIB is an empirical measurement reported in Table II, obtained by running standard external attacks (FGSM, EAD, C&W, JSMA) from the torchattacks library, not a quantity derived from the method definitions. The bitrate values in Table I are described as experimentally determined operating points that preserve prediction accuracy, which is a design choice rather than a parameter fitted to the robustness outcome. The authors' earlier works are cited to explain the SVBI blueprint encoder and head distillation loss, but the robustness comparisons are new measurements against independent attack benchmarks, so the self-citations are not load-bearing for the robustness conclusion. The depth hypothesis in Section III-A is presented as a conjecture to be tested and is not assumed in the experimental construction. The increased attack surface of generative models is demonstrated by a new Tabacof attack experiment in Table III. The notable bitrate difference between SVBI and DVIB is a potential confound for attributing the robustness gap to bottleneck depth, but that is a validity concern rather than circularity. No circular step satisfies the evidentiary standard of this review.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The central empirical comparison rests on hand-chosen bitrates, the assumption that depth rather than bitrate drives robustness, and the correspondence between attacking the generative decoder and compromising downstream tasks. No new entities are introduced.

free parameters (2)
  • Bottleneck bitrate (bpp) per model and dataset = SVBI: 0.0829 (MNIST), 0.5677 (CIFAR-10), 0.4321 (SVHN), 1.2673 (ImageNet64); DVIB: 0.0161, 0.0308, 0.0086, 0.0115
    Chosen by hand in Section IV-B as the lowest bitrate that preserves prediction performance; differs between SVBI and DVIB and confounds the robustness comparison with compression rate.
  • Adversarial perturbation magnitudes (epsilon and norms) = Not reported
    The paper never states the epsilon for FGSM or the norm bounds for EAD, C&W, and JSMA; all reported robustness numbers depend on these unstated choices.
assumptions (3)
  • domain assumption The information bottleneck objective improves adversarial robustness because perturbations are redundant information that the bottleneck discards.
    Invoked in Section III-A and based on prior work [4], but not proven for shallow SVBI networks.
  • ad hoc to paper Deeper bottleneck placement causes the robustness difference, not the different bitrates or model sizes.
    The paper asserts this in Section III-A and repeats it in Section IV-C, but the experiments do not control for bitrate or total parameter count.
  • domain assumption The Tabacof attack on the generative decoder is a valid measure of the attack surface of the whole task-oriented communication system.
    Section IV-E assumes that disrupting the autoencoder compromises downstream tasks, relying on a statement in the authors' prior work [9] rather than a direct end-to-end measurement.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adversarial Robustness of Bottleneck Injected Deep Neural Networks for Task-Oriented Communication." pith.science (2026). https://pith.science/paper/WM2PQU4A

@misc{pith2026241210265,
  author       = {Pith},
  title        = {Pith review of: Adversarial Robustness of Bottleneck Injected Deep Neural Networks for Task-Oriented Communication},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WM2PQU4A}},
  note         = {Machine review of arXiv:2412.10265}
}
read the original abstract

This paper investigates the adversarial robustness of Deep Neural Networks (DNNs) using Information Bottleneck (IB) objectives for task-oriented communication systems. We empirically demonstrate that while IB-based approaches provide baseline resilience against attacks targeting downstream tasks, the reliance on generative models for task-oriented communication introduces new vulnerabilities. Through extensive experiments on several datasets, we analyze how bottleneck depth and task complexity influence adversarial robustness. Our key findings show that Shallow Variational Bottleneck Injection (SVBI) provides less adversarial robustness compared to Deep Variational Information Bottleneck (DVIB) approaches, with the gap widening for more complex tasks. Additionally, we reveal that IB-based objectives exhibit stronger robustness against attacks focusing on salient pixels with high intensity compared to those perturbing many pixels with lower intensity. Lastly, we demonstrate that task-oriented communication systems that rely on generative models to extract and recover salient information have an increased attack surface. The results highlight important security considerations for next-generation communication systems that leverage neural networks for goal-oriented compression.

Figures

Figures reproduced from arXiv: 2412.10265 by the authors.

Figure 2
Figure 2. Filtering Redundant Information for the ImageNet classification task [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. A simplified overview on a Task-Oriented Communication System. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 4
Figure 4. In pairs, comparing JSMA (left) with JSMAOnePixel variant (right). [PITH_FULL_IMAGE:figures/full_fig_p004_4.png] view at source ↗
Figures from the paper (4 more)
Figure 7
Figure 7. Figure 7: JSMA is more “pixel-efficient” by focusing on the [PITH_FULL_IMAGE:figures/full_fig_p005_7.png]
Figure 5
Figure 5. Figure 5: Average Percentage of pixels perturbed by an adversarial attack. More [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 8
Figure 8. Figure 8: Comparing magnitudes of pixels between JSMA and FGSM. [PITH_FULL_IMAGE:figures/full_fig_p005_8.png]
Figure 9
Figure 9. Figure 9: Base images (bottom) and corresponding perturbation using the [PITH_FULL_IMAGE:figures/full_fig_p006_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

26 extracted references · 22 canonical work pages

  1. [1]

    Threat of adversarial attacks on deep learning in computer vision: A survey,

    N. Akhtar and A. S. Mian, “Threat of adversarial attacks on deep learning in computer vision: A survey,” IEEE Access, vol. 6, pp. 14 410– 14 430, 2018

    work page 2018

  2. [2]

    Beyond transmitting bits: Context, semantics, and task-oriented communications,

    D. G ¨und¨uz et al. , “Beyond transmitting bits: Context, semantics, and task-oriented communications,” IEEE J. Sel. Areas Commun. , vol. 41, no. 1, pp. 5–41, 2023

    work page 2023

  3. [3]

    The information bottleneck method,

    N. Tishby et al. , “The information bottleneck method,” CoRR, vol. physics/0004057, 2000

    arXiv 2000

  4. [4]

    Deep variational information bottleneck,

    A. A. Alemi et al. , “Deep variational information bottleneck,” CoRR, vol. abs/1612.00410, 2016

    arXiv 2016

  5. [5]

    Opening the black box of deep neural networks via information,

    R. Shwartz-Ziv and N. Tishby, “Opening the black box of deep neural networks via information,” CoRR, vol. abs/1703.00810, 2017

    arXiv 2017

  6. [6]

    Task-oriented communication design at scale,

    A. Mostaani et al., “Task-oriented communication design at scale,”IEEE Transactions on Communications , 2024, preprint

    work page 2024

  7. [7]

    Task-oriented multi-user semantic communication with lightweight semantic encoder and fast training for resource-constrained terminal devices,

    J. Peng et al., “Task-oriented multi-user semantic communication with lightweight semantic encoder and fast training for resource-constrained terminal devices,” IEEE Wireless Communications Letters, vol. 13, no. 9, pp. 2427–2431, 2024

    work page 2024

  8. [8]

    Frankensplit: Efficient neural feature compression with shallow variational bottleneck injection for mobile edge comput- ing,

    A. Furutanpey et al., “Frankensplit: Efficient neural feature compression with shallow variational bottleneck injection for mobile edge comput- ing,” IEEE Transactions on Mobile Computing , vol. 23, no. 12, pp. 10 770–10 786, 2024

    work page 2024

Show all 26 references
  1. [9]

    Fool: Addressing the downlink bottleneck in satellite computing with neural feature compression,

    ——, “Fool: Addressing the downlink bottleneck in satellite computing with neural feature compression,” CoRR, vol. abs/2403.16677, 2024

    2024 arXiv

  2. [10]

    Supervised compression for resource-constrained edge computing systems,

    Y . Matsubara et al. , “Supervised compression for resource-constrained edge computing systems,” in Proc. IEEE/CVF Winter Conference on Applications of Computer Vision , 2022

    2022

  3. [11]

    Split computing with scalable feature compression for visual analytics on the edge,

    Z. Yuan et al., “Split computing with scalable feature compression for visual analytics on the edge,” IEEE Transactions on Multimedia, vol. 26, pp. 10 121–10 133, 2024

    2024

  4. [12]

    Condar: Context-aware distributed dynamic object detection on radar data,

    I. Harshbarger et al., “Condar: Context-aware distributed dynamic object detection on radar data,” in Proc. IEEE MILCOM , 2024

    2024

  5. [13]

    Intriguing properties of neural networks,

    C. Szegedy et al. , “Intriguing properties of neural networks,” in Proc. ICLR, 2014

    2014

  6. [14]

    Explaining and harnessing adversarial exam- ples,

    I. J. Goodfellow et al. , “Explaining and harnessing adversarial exam- ples,” in Proc. ICLR, 2015

    2015

  7. [15]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in Proc. IEEE Symposium on Security and Privacy , 2017

    2017

  8. [16]

    EAD: Elastic-net attacks to deep neural networks via adversarial examples,

    P.-Y . Chen et al., “EAD: Elastic-net attacks to deep neural networks via adversarial examples,” in Proc. AAAI, 2018

    2018

  9. [17]

    The limitations of deep learning in adversarial settings,

    N. Papernot et al. , “The limitations of deep learning in adversarial settings,” in Proc. IEEE EuroS&P, 2015

    2015

  10. [18]

    Adversarial images for variational autoencoders,

    P. Tabacof et al. , “Adversarial images for variational autoencoders,” CoRR, vol. abs/1612.00155, 2016

    2016 arXiv

  11. [19]

    Coding theorems for a discrete source with a fidelity criterion,

    C. E. Shannon, “Coding theorems for a discrete source with a fidelity criterion,” in IRE National Convention Record , vol. 4, 1959

    1959

  12. [20]

    End-to-end learning of compressible features,

    S. Singh et al., “End-to-end learning of compressible features,” CoRR, vol. abs/2007.11797, 2020

    2007 arXiv

  13. [21]

    Lossy compression for lossless prediction,

    Y . Dubois et al. , “Lossy compression for lossless prediction,” in Proc. NeurIPS, 2021

    2021

  14. [22]

    Cut, distil and encode (CDE): Split cloud-edge deep inference,

    M. Sbai et al. , “Cut, distil and encode (CDE): Split cloud-edge deep inference,” in Proc. IEEE SECON , 2021

    2021

  15. [23]

    Distilled split deep neural networks for edge- assisted real-time systems,

    Y . Matsubara et al. , “Distilled split deep neural networks for edge- assisted real-time systems,” in Proc. HotEdgeVideo@MobiCom, 2019

    2019

  16. [24]

    Deep learning and the information bottleneck principle,

    N. Tishby and N. Zaslavsky, “Deep learning and the information bottleneck principle,” in Proc. 2015 IEEE Information Theory Workshop (ITW), 2015

    2015

  17. [25]

    Torchattacks: A pytorch repository for adversarial attacks,

    H. Kim, “Torchattacks: A pytorch repository for adversarial attacks,” arXiv preprint arXiv:2010.01950 , 2020

    2010 arXiv

  18. [26]

    Adversarial.js,

    K. Song, “Adversarial.js,” https://kennysong.github.io/adversarial.js/, ac- cessed: 2024-07-29

    2024

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.