# What it Thinks is Important is Important:
Robustness Transfers through Input Gradients

Alvin Chan1, Yi Tay1, Yew-Soon Ong1,2
1Nanyang Technological University, 2 AI3, A∗STAR, Singapore Corresponding
author<EMAIL_ADDRESS>
###### Abstract

Adversarial perturbations are imperceptible changes to input pixels that can
change the prediction of deep learning models. Learned weights of models
robust to such perturbations are previously found to be transferable across
different tasks but this applies only if the model architecture for the source
and target tasks is the same. Input gradients characterize how small changes
at each input pixel affect the model output. Using only natural images, we
show here that training a student model’s input gradients to match those of a
robust teacher model can gain robustness close to a strong baseline that is
robustly trained from scratch. Through experiments in MNIST, CIFAR-10,
CIFAR-100 and Tiny-ImageNet, we show that our proposed method, input gradient
adversarial matching (IGAM) 111Codes and models are released at:
https://github.com/alvinchangw/IGAM_CVPR2020, can transfer robustness across
different tasks and even across different model architectures. This
demonstrates that directly targeting the semantics of input gradients is a
feasible way towards adversarial robustness.

##  1 Introduction

Deep learning models have shown remarkable performances in a wide range of
computer vision tasks [15, 28, 17] but can be easily fooled by adversarial
examples [27]. These examples are crafted by imperceptible perturbations and
can manipulate a model’s prediction during test time. Due to its potential
security risk in deployment of deep neural networks, adversarial examples have
received much research attention with many new attacks [2, 19, 4] and defenses
[24, 20, 16, 9, 33, 1] proposed recently.

While there is still a wide gap between accuracy on clean and adversarial
samples, the strongest defenses rely mostly on adversarial training (AT) [8,
18, 25]. Adversarial training’s main idea, simple yet effective, involves
training the model with adversarial samples generated in each training loop.
However, crafting strong adversarial training samples is computationally
expensive as it entails iterative gradient steps with respect to the loss
function [13, 31].

To circumvent the cost of AT, a recent line of work explores transferring
adversarial robustness from robust models to new tasks [11, 26]. To transfer
to a target task, current such techniques involve finetuning new layers on top
of robust feature extractors that were pre-trained on other domains (source
task). While this approach is effective in transferring robustness across
different tasks, it assumes that the source task and target task models have
similar architecture as pre-trained weights are the medium of transfer.

Here, we propose a robustness transfer method that is both task- and
architecture-agnostic with input gradient as the medium of transfer. Our
approach, input gradient adversarial matching (IGAM), is inspired by
observations [29, 6] that robust AT-trained models display visibly salient
input gradients while their non-robust standard trained models have noisy
input gradients (Figure 1). The value of input gradient at each pixel defines
how a small change there can affect the model’s output and can be loosely
thought as to how important each pixel is for prediction. Here, we show that
learning to emulate how robust models view ‘importance’ on images through
input gradients can result in robust models even without adversarial training
examples.

The core idea behind our approach is to train a student model with an
adversarial objective to fool a discriminator into perceiving the student’s
input gradients as those from a robust teacher model. To transfer across
different tasks, the teacher model’s logit layer is first briefly finetuned on
the target task’s data, like in [26]. Subsequently, the teacher model’s
weights are frozen while a student model is adversarially trained with a
separate discriminator network in a min-max game so that the input gradients
from the student and teacher models are semantically similar, i.e.,
indistinguishable for the discriminator model [7].

Through experiments in MNIST, CIFAR-10, CIFAR-100 and Tiny-ImageNet, we show
that input gradients are a feasible medium to transfer robustness,
outperforming finetuning on transferred weights. Surprisingly, student models
even outperform their teacher models in both clean accuracy and adversarial
robustness. In some cases, the student model’s adversarial robustness is close
to that of a strong baseline that is adversarially trained from scratch.
Though our method does not beat the state of the art robustness, it shows that
addressing the semantics of input gradients is a new promising way towards
robustness.

In summary, the key contributions of this paper are as follows:

  * •

For the first time, we show that robustness can transfer across different
model architectures.

  * •

We achieve this by training the student model’s input gradients to
semantically match those of a robust teacher model through our proposed
method.

  * •

Through extensive experiments, we show that input gradients are a more
effective and versatile medium to transfer robustness than pre-trained
weights.

##  2 Background

We review the concept of adversarial robustness for image classification and
its relationship with input gradients.

##### Adversarial Robustness

We express an image classifier as
$f(\operatorname{\mathbf{x}};\theta):\operatorname{\mathbf{x}}\mapsto\mathbb{R}^{k}$
that maps an input image $\operatorname{\mathbf{x}}$ to output probabilities
for $k$ classes in set $C$, where classifier’s parameters is defined as
$\theta$. Denoting training dataset as $D$, empirical risk minimization is the
standard way to train a classifier $f$, through
$\min_{\theta}\mathbb{E}_{(\operatorname{\mathbf{x}},\mathbf{y})\sim
D}L(\operatorname{\mathbf{x}},\mathbf{y})$, where
$\mathbf{y}\in\mathbb{R}^{k}$ is the one-hot label for the image and
$L(\operatorname{\mathbf{x}},\mathbf{y})$ is the standard cross-entropy loss:

$L(\operatorname{\mathbf{x}},\mathbf{y})=\mathbb{E}_{(\operatorname{\mathbf{x}},\mathbf{y})\sim
D}\left[-\mathbf{y}^{\top}\log f(\operatorname{\mathbf{x}})\right]$ (1)

With this training method, deep learning models typically show good
performance on clean test samples but fail in the classification of
adversarial test samples. With an adversarial perturbation of magnitude
$\varepsilon$ at input $\operatorname{\mathbf{x}}$, a model is considered
robust against this attack if

$\operatorname*{argmax}_{i\in
C}f_{i}(\operatorname{\mathbf{x}};\theta)=\operatorname*{argmax}_{i\in
C}f_{i}(\operatorname{\mathbf{x}}+\delta;\theta)$ (2)

where $\forall\delta\in
B_{p}(\varepsilon)={\delta:\|\delta\|_{p}\leq\varepsilon}$. With small
$\varepsilon$, adversarial perturbation with $p=\infty$ is often imperceptible
and is the focus in this paper.

##### Input Gradients of Robust Models

Input gradients characterize how an infinitesimally small change to the input
affects the output of the model. Given a pair of input and label
$(\operatorname{\mathbf{x}},\mathbf{y})$, its corresponding input gradient
$\nabla_{\operatorname{\mathbf{x}}}\mathcal{L(\operatorname{\mathbf{x}},\mathbf{y})}$
can be computed through gradient backpropagation in a neural network to its
input layer. For classification tasks, the input gradient can be loosely
interpreted as a pixel map of what the model thinks is important for its class
prediction.

It was observed [29] that robust models that are adversarially trained display
an interesting phenomenon: they produce salient input gradients that loosely
resemble input images while less robust standard models display noisier input
gradients (Figure 1). [6] shows in linear models that distance from samples to
decision boundary increases as the alignment between the input gradient and
input image grows but this weakens for non-linear neural networks. While these
previous studies show that robustly trained models result in salient input
gradients, our paper studies input gradients as a medium to transfer
robustness across different models.

Figure 1: Input gradients of (middle) a non-robust model and (right) robust
model on CIFAR-10 images. The non-robust model undergoes standard SGD training
with natural images while the robust model is trained with 7-step PGD
adversarial examples.

##  3 Related Work

We review prior art on defense against adversarial examples and highlight
those that are most similar to our work.

##### Adversarial Training

With the aim of gaining robustness against adversarial examples, the core idea
of adversarial training (AT) is to train models with adversarial training
examples. Formally, AT minimizes the loss function:

$L(\operatorname{\mathbf{x}},\mathbf{y})=\mathbb{E}_{(\operatorname{\mathbf{x}},\mathbf{y})\sim
D}\left[\max_{\delta\in
B(\varepsilon)}L(\operatorname{\mathbf{x}}+\delta,\mathbf{y})\right]$ (3)

where $\max_{\delta\in
B(\varepsilon)}L(\operatorname{\mathbf{x}}+\delta,\mathbf{y})$ is computed via
gradient-based optimization methods. One of the strongest defenses employ
projected gradient descent (PGD) which carries out the following gradient step
iteratively:

$\delta\leftarrow\mathrm{Proj}\left[\delta-\eta~{}\mathrm{sign}\left(\nabla_{\delta}L(\operatorname{\mathbf{x}}+\delta,\mathbf{y})\right)\right]$
(4)

where
$\mathrm{Proj}(\operatorname{\mathbf{x}})=\operatorname*{argmin}_{\epsilon\in
B(\varepsilon)}\|\operatorname{\mathbf{x}}-\epsilon\|$.

AT has seen many adaptations since its introduction. A recent work [32] seeks
to generate more effective adversarial training examples through maximizing
feature matching distance between those examples and clean samples. To
smoothen the loss landscape so that model prediction is not drastically
affected by small perturbations, [21] proposed minimizing the difference
between the linearly estimated and real loss value of adversarial examples.
Another work, TRADES [33], reduces the difference between the prediction of
natural and adversarial examples through a regularization term to smoothen the
model’s decision boundary.

##### Non-Adversarial Training Defense

Closely linked to our method, there is a line of work that regularizes the
input gradients to boost robustness. Those prior art [23, 12] focus on using
double backpropagation [5] to minimize the input gradients’ Frobenius norm.
Those approaches aim to constrain the effect that changes at individual pixels
have on the classifier’s output but not the overall semantics of the input
gradients like our method. [3] show that models can be more robust when
regularized to produce input gradients that resemble input images.

Several recent methods fall under the category of provable defenses that seeks
to bound minimum adversarial perturbation for a subset of neural networks [10,
22, 30]. These defenses typically first find a theoretical lower bound for the
adversarial perturbation and optimize this bound during training to boost
adversarial robustness.

##### Robustness Transfer

There is a line of work that shows robustness can transfer from one model to
another. [11] shows that robustness from adversarial training can be improved
if the models are pre-trained from tasks from other domains. Another work
shows that adversarially trained learn robust feature extractors that can be
directly transferred to a new task by finetuning a new logit layer on top of
these extractors [26]. Circumventing adversarial training, these transferred
models can still retain a high degree of robustness across tasks. Unlike our
method, these two work require that the source and target models both have the
same model architecture since pre-trained weights are directly transferred.

##  4 Input Gradient Adversarial Matching

Our proposed training method consists of two phases: 1) finetuning robust
teacher model on target task and 2) adversarial regularization of input
gradients during the student models’ training.

###  4.1 Finetuning Teacher Classifier

The first stage involves finetuning the weights of the teacher model
$f_{\text{t}}$ on the target task. Parameterizing the model weights as $\psi$,
the finetuning stage minimizes the cross-entropy loss over the target task
training data
$(\operatorname{\mathbf{x}},\mathbf{y})\sim\mathcal{D}_{\text{target}}$:

$L_{\psi,\text{xent}}(\operatorname{\mathbf{x}},\mathbf{y},\psi)=\mathbb{E}_{(\operatorname{\mathbf{x}},\mathbf{y})}\left[-\mathbf{y}^{\top}\log
f_{\text{t}}(\operatorname{\mathbf{x}})\right]$ (5)

where $\operatorname{\mathbf{x}}\in\mathbb{R}^{hwc}$ for $h\times w$-size
images with $c$ channels, $\mathbf{y}\in\mathbb{R}^{k}$ is one-hot label
vector of $k$ classes.

To preserve the robust learned representations in the teacher model [26], we
freeze all the weights and replace the final logits layer to finetune.
Denoting the frozen weights as $\psi^{\dagger}$ and the new logits layer as
$\psi_{\text{logit}}$, the teacher model finetuning objective is

$\psi_{\text{logit}}^{*}=\operatorname*{argmin}_{\psi_{\text{logit}}}L_{\text{xent}}(\mathbf{z}(\operatorname{\mathbf{x}},\psi^{\dagger}),\mathbf{y},\psi_{\text{logit}})$
(6)

where $\mathbf{z}(\operatorname{\mathbf{x}},\psi^{\dagger})$ represents the
hidden features before the logit layer. After finetuning the logits layer on
the target task, all the teacher model’s parameters ($\psi$) are fixed,
including $\psi_{\text{logit}}$.

###  4.2 Input Gradient Matching

The aim of the input gradient matching is to train the student model to
generate input gradients that semantically resemble those from the teacher
model. The input gradient characterizes how the loss value is affected by
small changes to each input pixel.

We express the classification cross entropy loss of the student model
$f_{\text{s}}$ on the target task dataset $\mathcal{D}_{\text{target}}$ as:

$L_{\theta,\text{xent}}(\operatorname{\mathbf{x}},\mathbf{y},\theta)=\mathbb{E}_{(\operatorname{\mathbf{x}},\mathbf{y})}\left[-\mathbf{y}^{\top}\log
f_{\text{s}}(\operatorname{\mathbf{x}})\right]$ (7)

Through gradient backpropagation, the input gradient of the student model
$f_{\text{s}}$ is

$\operatorname{J_{\text{s}}}(\operatorname{\mathbf{x}})\coloneqq\nabla_{\operatorname{\mathbf{x}}}L_{\theta,\text{xent}}=\left[\frac{\partial
L_{\theta,\text{xent}}}{\partial{\operatorname{\mathbf{x}}_{1}}}~{}~{}~{}\cdots~{}~{}~{}\frac{\partial
L_{\theta,\text{xent}}}{\partial{\operatorname{\mathbf{x}}_{d}}}\right]$ (8)

where $d=hwc$.

Correspondingly, the input gradient of the teacher model $f_{\text{t}}$ is

$\operatorname{J_{\text{t}}}(\operatorname{\mathbf{x}})\coloneqq\nabla_{\operatorname{\mathbf{x}}}L_{\psi,\text{xent}}=\left[\frac{\partial
L_{\psi,\text{xent}}}{\partial{\operatorname{\mathbf{x}}_{1}}}~{}~{}~{}\cdots~{}~{}~{}\frac{\partial
L_{\psi,\text{xent}}}{\partial{\operatorname{\mathbf{x}}_{d}}}\right]$ (9)

####  4.2.1 Adversarial Regularization

To achieve the objective of training the student model’s input gradient
$\operatorname{J_{\text{s}}}$ to resemble those from the teacher model
$\operatorname{J_{\text{t}}}$, we draw inspiration from GANs, a framework
comprising a generator and discriminator model. In our case, we train the
$f_{\text{s}}$ to make it hard for the discriminator $f_{\text{disc}}$ to
distinguish between $\operatorname{J_{\text{t}}}$ and
$\operatorname{J_{\text{s}}}$. The discriminator output value
$f_{\text{disc}}(\operatorname{J})$ represents the probability that
$\operatorname{J}$ came from the teacher model $f_{\text{t}}$ rather than
$f_{\text{s}}$. To train $f_{\text{s}}$ to produce
$\operatorname{J_{\text{s}}}$ that $f_{\text{disc}}$ perceive as
$\operatorname{J_{\text{t}}}$, we employ the following adversarial loss:

$\displaystyle L_{\text{adv}}$
$\displaystyle=\mathbb{E}_{\operatorname{J_{\text{t}}}}[\log
f_{\text{disc}}(\operatorname{J_{\text{t}}})]+\mathbb{E}_{\operatorname{J_{\text{s}}}}[\log(1-f_{\text{disc}}(\operatorname{J_{\text{s}}}))]$
(10)

Combining this regularization loss with the classification loss function
$L_{\text{xent}}$ in Equation (7), we can optimize through stochastic gradient
descent (SGD) to approximate the optimal parameters for $f_{\text{s}}$ as
follows,

$\theta^{*}=\operatorname*{argmin}_{\theta}(L_{\theta,\text{xent}}+\lambda_{\text{adv}}L_{\text{adv}})$
(11)

where $\lambda_{\text{adv}}$ control how much input gradient adversarial
regularization term dominates the training.

In contrast, the discriminator ($f_{\text{disc}}$) learns to correctly
distinguish the input gradients by maximizing the adversarial loss term.
Parameterizing $f_{\text{disc}}$ with $\phi$, the discriminator is also
trained with SGD as such

$\phi^{*}=\operatorname*{argmax}_{\phi}L_{\text{adv}}$ (12)

####  4.2.2 Reconstruction Regularization

Apart from the adversarial loss term, we also employ a term to penalize the
$l_{2}$ difference between the $\operatorname{J_{\text{s}}}$ and
$\operatorname{J_{\text{t}}}$ generated from the same input image.

$\displaystyle
L_{\text{diff}}=\|\operatorname{J_{\text{s}}}-\operatorname{J_{\text{t}}}\|^{2}_{2}$
(13)

The $L_{\text{diff}}$ term is analogous to the additional reconstruction loss
in a VAE-GAN setup [14] where it has shown to improve performance. For each
given input image ($\operatorname{\mathbf{x}}$) in IGAM, there is a
corresponding target input gradient $\operatorname{J_{\text{t}}}$ for the
student model’s $\operatorname{J_{\text{s}}}$ to match, allowing us to exploit
this instance matching loss ($L_{\text{diff}}$). Adding this term with
Equation 11, the final training objective of the student model is

$\theta^{*}=\operatorname*{argmin}_{\theta}(L_{\theta,\text{xent}}+\lambda_{\text{adv}}L_{\text{adv}}+\lambda_{\text{diff}}L_{\text{diff}})$
(14)

where $\lambda_{\text{diff}}$ determines the weight of the $l_{2}$ penalty
term in the training.

Figure 2 shows a summary of IGAM training phase while Algorithm 1 details the
corresponding pseudo-codes.

Figure 2: Training phase of input gradient adversarial matching (IGAM).

Input: Target task training data $\mathcal{D}_{\text{train}}$, Learning rates
for teacher model $f_{\text{t}}$, student model $f_{\text{s}}$ and
discriminator $f_{\text{disc}}$: ($\alpha,\beta,\gamma$)

for  _each finetuning iteration_ do

Sample $(\operatorname{\mathbf{x}},\mathbf{y})\sim\mathcal{D}_{\text{train}}$

$L_{\psi,\text{xent}}\leftarrow-\mathbf{y}^{\top}\log
f_{\text{t}}(\operatorname{\mathbf{x}})$ $\triangleright$ Classification loss

$\psi_{\text{logit}}\leftarrow\psi_{\text{logit}}-\alpha~{}\nabla_{\psi_{\text{logit}}}L_{\psi,\text{xent}}$
$\triangleright$ Update teacher $f_{\text{t}}$ to minimize
$L_{\psi,\text{xent}}$

for  _each training iteration_ do

Sample $(\operatorname{\mathbf{x}},\mathbf{y})\sim\mathcal{D}_{\text{train}}$

$L_{\psi,\text{xent}}\leftarrow-\mathbf{y}^{\top}\log
f_{\text{t}}(\operatorname{\mathbf{x}})$ $\triangleright$ Classification loss
for teacher

$\operatorname{J_{\text{t}}}\leftarrow\nabla_{\operatorname{\mathbf{x}}}L_{\psi,\text{xent}}$
$\triangleright$ Compute teacher input gradient

$L_{\theta,\text{xent}}\leftarrow-\mathbf{y}^{\top}\log
f_{\text{s}}(\operatorname{\mathbf{x}})$ $\triangleright$ Classification loss
for student

$\operatorname{J_{\text{s}}}\leftarrow\nabla_{\operatorname{\mathbf{x}}}L_{\theta,\text{xent}}$
$\triangleright$ Compute student input gradient

$L_{\text{adv}}\leftarrow\log
f_{\text{disc}}(\operatorname{J_{\text{t}}})+\log(1-f_{\text{disc}}(\operatorname{J_{\text{s}}}))$
$\triangleright$ Adversarial loss

$L_{\text{diff}}\leftarrow\|\operatorname{J_{\text{s}}}-\operatorname{J_{\text{t}}}\|^{2}_{2}$
$\triangleright$ $l_{2}$ penalty loss

$\theta\leftarrow\theta-\beta~{}\nabla_{\theta}(L_{\theta,\text{xent}}+\lambda_{\text{adv}}L_{\text{adv}}+\lambda_{\text{diff}}L_{\text{diff}})$
$\triangleright$ Update the student $f_{\text{s}}$ to minimize
$L_{\theta,\text{xent}}$, $L_{\text{adv}}$ and $L_{\text{diff}}$

$\phi\leftarrow\phi+\gamma~{}\nabla_{\phi}L_{adv}$ $\triangleright$ Update
discriminator $f_{\text{disc}}$ to maximize $L_{\text{adv}}$

Algorithm 1 Input gradient adversarial matching

###  4.3 Transfer With Different Input Dimensions

In the earlier sections, we assume that the input dimensions of the teacher
and student models are the same. Recall that before finetuning, the teacher
model $f_{\text{t}}$ was originally trained on source task samples
$(\operatorname{\mathbf{x}}_{\text{src}},\mathbf{y}_{\text{src}})\sim\mathcal{D}_{\text{src}},\operatorname{\mathbf{x}}_{\text{src}}\in\mathbb{R}^{d_{\text{src}}}$
where each $\operatorname{\mathbf{x}}_{\text{src}}$ is a $h_{\text{src}}\times
w_{\text{src}}$-size image with $c_{\text{src}}$ channels. In practice, the
image dimensions may differ from those from the task target, i.e.,
$d_{\text{src}}\neq d_{\text{tar}}$. To allow the gradient backpropagation of
the losses through the input gradients, we use affine functions to adapt the
target task images to match the dimension of the teacher model’s input layer:

$\displaystyle\operatorname{\mathbf{x}}_{\text{tar}}^{\prime}=\mathbf{A}\cdot\operatorname{\mathbf{x}}_{\text{tar}}+\mathbf{b}$
(15)

where
$\operatorname{\mathbf{x}}_{\text{tar}}^{\prime},\mathbf{b}\in\mathbb{R}^{d_{\text{src}}},\operatorname{\mathbf{x}}_{\text{tar}}\in\mathbb{R}^{d_{\text{tar}}}$
and $\mathbf{A}\in\mathbb{R}^{d_{\text{src}}\times d_{\text{tar}}}$.

Subsequently, cross-entropy loss for the teacher model can be computed:

$L_{\psi,\text{xent}}(\operatorname{\mathbf{x}}_{\text{tar}},\mathbf{y}_{\text{tar}},\psi)=\mathbb{E}_{(\operatorname{\mathbf{x}}_{\text{tar}},\mathbf{y}_{\text{tar}})}\left[-\mathbf{y}_{\text{tar}}^{\top}\log
f_{\text{t}}(\operatorname{\mathbf{x}}_{\text{tar}}^{\prime})\right]$ (16)

Since affine functions are continuously differentiable, we can backprop to get
the input gradient:

$\operatorname{J_{\text{t}}}(\operatorname{\mathbf{x}}_{\text{tar}})=\nabla_{\operatorname{\mathbf{x}}_{\text{tar}}}L_{\psi,\text{xent}}$
(17)

We use a range of such transformations in our experiments to cater for the
difference of input dimensions from various source-target dataset pairs.

####  4.3.1 Input Resizing

Image resizing is one such transformation where the resized image can be
expressed as the output of an affine function, i.e.,
$\operatorname{\mathbf{x}}_{\text{tar}}^{\prime}=\mathbf{A}\cdot\operatorname{\mathbf{x}}_{\text{tar}}$.
In the case where the teacher model’s input dimension is smaller than the
student model, i.e., $d_{\text{tar}}>d_{\text{src}}$, we can use average
pooling to downsize the image. A $2\times 2$ average pooling is equivalent to
resizing with bilinear interpolation when $d_{\text{tar}}$ is a multiple of
$d_{\text{src}}$. Figure 3(a) shows how we use input resizing to generate the
input gradient from the teacher model. For cases of
$d_{\text{tar}}<d_{\text{src}}$, we use image resizing with bilinear
interpolation to upscale the input dimension before feeding into the teacher
model. For the source-target pair of MNIST-CIFAR, we can similarly reduce the
number of channels by averaging the RGB values of the CIFAR images before
feeding to the teacher model (trained on MNIST).

####  4.3.2 Input Cropping

Cropping is another way to downsize the image to fit a smaller teacher model’s
input dimension, i.e., $d_{\text{tar}}>d_{\text{src}}$. The cropped image is
output of
$\operatorname{\mathbf{x}}_{\text{tar}}^{\prime}=\mathbf{A}\cdot\operatorname{\mathbf{x}}_{\text{tar}}$
where $\mathbf{A}$ is a row-truncated identity matrix. For input cropping, the
initial $\operatorname{J_{\text{t}}}$ would have zero values at the region
where the image was cropped out since those pixel values are multiplied by
zero. To prevent the discriminator from exploiting this property to
distinguish $\operatorname{J_{\text{t}}}$ from $\operatorname{J_{\text{s}}}$,
we feed into the discriminator $\operatorname{J_{\text{t}}}$ and
$\operatorname{J_{\text{s}}}$ that are cropped to size $d_{\text{src}}$.
Figure 3(b) shows how we use cropping to generate the cropped input gradient
from the teacher model.

####  4.3.3 Input Padding

In contrast to cropping, padding can be used for cases where
$d_{\text{tar}}<d_{\text{src}}$. With the same form of affine function
$\operatorname{\mathbf{x}}_{\text{tar}}^{\prime}=\mathbf{A}\cdot\operatorname{\mathbf{x}}_{\text{tar}}$,
$\mathbf{A}$ is a identity matrix preppended and appended with zero-valued
rows. Figure 3(c) shows how we generate the input gradient from the teacher
model with input padding.

(a) Input resizing

(b) Input cropping

(c) Input padding

Figure 3: Transformations to fit images to teacher model’s input dimensions.

##  5 Experiments

We conducted experiments with IGAM on source-target data pairs comprising of
MNIST, CIFAR-10, CIFAR-100 and Tiny-ImageNet. These datasets allow us to
validate the effectiveness of IGAM in transferring across tasks with different
image dimensions. Unless otherwise stated, adversarial robustness is evaluated
based on $l_{\infty}$ adversarial examples with $\varepsilon=\frac{8}{255})$.
IGAM’s hyperparameters such as $\lambda_{\text{adv}},\lambda_{\text{diff}}$
and $f_{disc}$ for each experiment are included in the supplementary material.

###  5.1 CIFAR-10 Target Task

In our experiments with CIFAR-10 as the target task, we study two types of
robustness transfer. The upwards transfer involves employing IGAM to transfer
robustness from a smaller model trained on the simpler MNIST dataset to a
larger CIFAR-10 classifier. Conversely, the downwards transfer experiments
involve transferring robustness from a 200-class Tiny-ImageNet model to a
CIFAR-10 classifier.

####  5.1.1 Upwards Transfer

##### Setup

CIFAR-10 is a 10-class colored image dataset comprising of 50k training and
10k test images, each of size $32\times 32\times 3$. For the CIFAR-10 student
model, we use a Wide-Resnet 32-10 model with similar hyperparameters to [18]
and train it for 200 epochs on natural training images with IGAM. The MNIST
dataset consists of 60k training and 10k test binary-colored images, each of
size $28\times 28\times 1$. For the robust teacher model trained on MNIST, we
also follow the same adversarial training setting and 2-CNN layered
architecture as [18] 222Robust MNIST pre-trained model downloaded from
https://github.com/MadryLab/MNIST_challenge. The teacher model is finetuned on
natural CIFAR-10 images for 10 epochs before using it to train the student
model with IGAM. Since the input dimensions of CIFAR-10 and MNIST are
different, we average pool pixel values across the color channels of CIFAR-10
images to get dimension $32\times 32\times 1$ and subsequently center crop
them into $28\times 28\times 1$ input images for the MNIST teacher model. With
this same input transformation, we also finetune the final logit layer of a
robust MNIST model on CIFAR-10 images similar to [26] for 100 epochs, to
compare as a baseline (FT-MNIST). We also train a strong robust classifier,
with 7-step PGD adversarial training like in [18], with the same architecture
as the IGAM student model to compare.

##### Results

In the face of adversarial examples, the IGAM-trained student model
outperforms the standard and finetuned baselines by large margins (Table 1).
Despite the difference between the dataset domains and model architectures,
IGAM can transfer robustness from the teacher to the student model to almost
match that from a strong adversarially trained (AT) model. The IGAM student
model has higher clean test accuracy than the robust PGD7-trained baseline
which we believe is a result of using natural (not adversarially perturbed)
images as training data in IGAM.

We note that though finetuning was previously showed to have positive results
in transferring robustness across relatively similar domains like between
CIFAR10 and CIFAR100 [25], it fails to transfer successfully here. This is
likely due to the bigger difference between the MNIST and CIFAR-10 dataset, as
well as the requirement of a more sophisticated model architecture for the
more challenging CIFAR-10 dataset.

Table 1: Accuracy (%) on clean and adversarial CIFAR-10 test samples with upwards transfer. Model | Clean | FGSM | PGD5 | PGD10 | PGD20
---|---|---|---|---|---
Standard | 95.0 | 13.4 | 0 | 0 | 0
FT-MNIST | 33.4 | 1.51 | 0.44 | 0.15 | 0.12
IGAM-MNIST | 93.6 | 67.8 | 63.6 | 56.9 | 43.5
PGD7-trained | 87.3 | 56.2 | 55.5 | 47.3 | 45.9

####  5.1.2 Downwards Transfer

##### Setup

Tiny-ImageNet is a 200-class image dataset where each class contains 500
training and 50 test images. Each Tiny-ImageNet image has dimension of
$64\times 64\times 3$. For the robust teacher model trained on Tiny-ImageNet,
we use a similar Wide-Resnet 32-10 model since it is compatible with a larger
input dimension due to its global average pooling operation of the feature
maps before fully connected layers. We robustly train this teacher model on
Tiny-ImageNet, following the same adversarial training hyperparameters in [18]
where robust models are trained with $l_{\infty}$ adversarial examples
generated by 7-step PGD. Before using it to train the student model with IGAM,
the teacher model is finetuned on natural CIFAR-10 images for 6 epochs. Since
the input dimensions of CIFAR-10 and Tiny-ImageNet are different, we resize
the $32\times 32\times 3$ CIFAR-10 images with bilinear interpolation to get
dimension $64\times 64\times 3$ for finetuning the teacher model. For the IGAM
student model, we use the same Wide-Resnet 32-10 model and hyperparameters as
in § 5.1.1. We also finetune the final logit layer of a robust Tiny-ImageNet
model on upsized CIFAR-10 images similar to [26] for 100 epochs, to compare as
a baseline (FT-TinyImagenet). We also investigate two more types of input
transformation for IGAM here. The first is a trained $3\times 3$ transpose
convolutional filter, with stride 2, to upscale the CIFAR-10 images to size
$64\times 64\times 3$. This single transpose convolutional layer is trained
together with the teacher model while finetuning on natural CIFAR-10 images.
The second type of input transformation is padding, as detailed in § 4.3.3, of
which we explore two variants: center-padding and random-padding.

##### Results

With input padding or input resizing, the IGAM-trained student model
outperforms the standard and finetuned baselines in adversarial robustness
(Table 2). From our experiments, using padding or resizing is more effective
for downwards transfer of robustness, with slightly better results for
resizing. With the downwards transfer, the student model can match the strong
PGD7-trained baseline even more closely than in the upwards transfer case
(Table 1). This is expected since the teacher model was robustly trained in a
more challenging Tiny-ImageNet task and would likely learn even more robust
representations than if it were trained on the simpler datasets like MNIST.
Compared to upwards transfer, the finetuning baseline transfers robustness and
clean accuracy performance to a larger extent but is still outperformed by
IGAM.

Table 2: Accuracy (%) on clean and adversarial CIFAR-10 test samples with downwards transfer. Model | Clean | FGSM | PGD5 | PGD10 | PGD20 | PGD50 | PGD100
---|---|---|---|---|---|---|---
Standard | 95.0 | 13.4 | 0 | 0 | 0 | 0 | 0
FT-TinyImagenet | 77.2 | 37.7 | 33.9 | 28.0 | 24.9 | 23.0 | 22.5
IGAM-TransposeConv | 93.2 | 65.0 | 58.8 | 44.5 | 32.4 | 22.4 | 18.7
IGAM-RandomPad | 88.3 | 35.8 | 43.9 | 40.1 | 38.6 | 37.8 | 37.6
IGAM-Pad | 87.9 | 51.6 | 52.2 | 46.6 | 44.0 | 43.0 | 42.5
IGAM-Upsize | 88.7 | 54.0 | 52.5 | 47.6 | 45.1 | 43.5 | 43.0
PGD7-trained | 87.25 | 56.22 | 55.5 | 47.3 | 45.9 | 45.4 | 45.3

####  5.1.3 Input Gradients

When comparing the input gradients of the various baseline and IGAM models
(Figure 4), we can observe that there is a diverse degree of saliency. The
IGAM models’ input gradients appear less noisy than a standard trained model
as what we aim to achieve with our proposed method. Interestingly, the IGAM-
MNIST model’s input gradients have a degree of saliency despite the sparse
input gradients from its FT-MNIST teacher model. For IGAM models with a Tiny-
ImageNet teacher, the more robust variants like IGAM-Upsize and IGAM-Pad
display less noisy input gradients than the less robust IGAM-RandomPad and
IGAM-TransposeConv. More input gradient samples are displayed in Figure 6 of
the supplementary material.

Figure 4: Input gradients of different models.

###  5.2 CIFAR-100 Target Task

We further study IGAM performance in upwards transfer of robustness with
CIFAR-100 as the target task, MNIST and CIFAR-10 as the source task.

##### Setup

CIFAR-100 is a 100-class colored image dataset comprising of 50k training and
10k test images. Similar to CIFAR-10, each image has a dimension of $32\times
32\times 3$. For the CIFAR-100 student model, we use a Wide-Resnet 32-10 model
with similar hyperparameters as § 5.1.1 except for the final logit layer,
which has 100 instead of 10 class outputs. We train the student model for 200
epochs on natural CIFAR-100 training images with IGAM. The robust MNIST
teacher model used is similar to the one in § 5.1.1. For the robust CIFAR-10
teacher model, we also follow the same adversarial training setting and
architecture as [18] 333Robust CIFAR-10 pre-trained model downloaded from
https://github.com/MadryLab/cifar10_challenge. During IGAM training with MNIST
as the source task, the input transformation same as in § 5.1.1 is used to
resize CIFAR-100 images into $28\times 28\times 1$ inputs for the teacher
model. No input transformation is used when the source task is CIFAR-10 since
its images have the same dimensions as CIFAR-100’s. The final logit layers of
MNIST and CIFAR-10 teacher models are finetuned for 10 and 6 epochs,
respectively, on natural CIFAR-100 images before been used to transfer
robustness in IGAM. We also finetune the final logit layer of a robust
CIFAR-10 model on CIFAR-100 for 100 epochs, to compare as a baseline (FT-
CIFAR10). We also train a strong robust classifier, with 7-step PGD
adversarial training like in [18], with the same architecture as the IGAM
student model to compare.

##### Results

Similar to our findings in § 5.1, IGAM-trained models outperform standard and
finetuned baselines in adversarial robustness (Table 3). Expectedly, using
CIFAR-10 as the source task yields higher transferred robustness than using
MNIST for IGAM. Since CIFAR-10 is closer to CIFAR-100 and more challenging
than MNIST, the CIFAR-10 teacher model likely has more robust and relevant
representations that are reflected as more robust input gradients.

We note that though CIFAR-10 and CIFAR-100 are the most similar datasets in
our experiments, the finetuned baseline has lower clean accuracy and
adversarial robustness compared to IGAM models. Finetuned models’ weights are
frozen up until the final logit layer to retain learned robust
representations. While weight freezing maintains a degree of robustness to
outperform standard training, it may restrict the model from learning new
representations relevant to the target task, explaining its lower clean
accuracy. We believe this restriction also explains its lower robustness
compared to IGAM since IGAM models are free to learn representations important
for the target task.

Table 3: Accuracy (%) on clean and adversarial CIFAR-100 test samples. Model | Clean | FGSM | PGD5 | PGD10 | PGD20
---|---|---|---|---|---
Standard | 78.7 | 7.95 | 0.13 | 0.03 | 0
FT-CIFAR10 | 49.3 | 17.2 | 15.3 | 11.7 | 10.5
IGAM-MNIST | 73.16 | 41.41 | 33.09 | 23.35 | 17.67
IGAM-CIFAR10 | 62.39 | 34.31 | 29.59 | 24.05 | 21.74
PGD7-trained | 60.4 | 29.1 | 29.3 | 24.3 | 23.5

##### Roles of Loss Terms

Improvements from the two terms are additive to each other, as reflected in
Table 4 and 5. From Figure 7 in the supplementary material, we observe that
both the $L_{\text{adv}}$ and $L_{\text{diff}}$ smoothen the decision
boundaries and lower cross-entropy values in the loss landscape compared to
the standard trained baseline.

Table 4: IGAM-CIFAR10 accuracy (%) with varying $\lambda_{\text{diff}}$. $\lambda_{\text{diff}}$ | 0 | 2.5 | 5 | 10
---|---|---|---|---
PGD20 | 16.0 | 16.3 | 21.7 | 21.7
Clean | 58.9 | 61.8 | 62.9 | 62.4
Table 5: IGAM-CIFAR10 accuracy (%) with varying $\lambda_{\text{adv}}$. $\lambda_{\text{adv}}$ | 0 | 0.5 | 1 | 2
---|---|---|---|---
PGD20 | 3.9 | 4.34 | 7.37 | 21.7
Clean | 78.4 | 77.4 | 74.3 | 62.4

##### Compute Time

Since finetuning is conducted once, we amortize its time taken over each IGAM
epoch to arrive at 347s, which is lower than the 815s taken for a 7-step PGD
epoch. Even though IGAM involves an additional discriminator update step on
top of standard training, the parameter size of the discriminator is much
smaller than the classifier model.

###  5.3 Tiny-ImageNet Target Task

We study if robustness can transfer through the input gradients when the
target task has significantly larger input dimensions than the source task,
with Tiny-ImageNet as the target task and CIFAR-10/100 as the source task.

##### Setup

For the robust CIFAR-10/100 teacher model, we follow the same adversarial
training setting and Wide-Resnet 32-10 architecture as [18]. We use a similar
Wide-Resnet 32-10 model for the Tiny-ImageNet student model due to its
compatible with larger input dimension due to its global average pooling
layer. The robust CIFAR-10/100 teacher models are finetuned for 5 epochs on
natural Tiny-ImageNet images before being used for IGAM. Since the input
dimensions of Tiny-ImageNet and CIFAR-10/100 are different, we study two types
of input transformation to reshape the image dimension from $64\times 64\times
3$ to $32\times 32\times 3$ for finetuning the teacher model. The first is
image resizing with bilinear interpolation (§ 4.3.1), which is equivalent to a
$2\times 2$ average pooling layer with stride 2. The second transformation is
center-cropping as detailed in § 4.3.2. The models’ adversarial robustness is
evaluated based on 5-step PGD attacks on test Tiny-ImageNet samples.

##### Results

Similar to previous target-source task pairs, IGAM can transfer robustness
even to much more challenging dataset, to a degree to outperform the standard
trained and finetuned baselines (Figure 5). There is no visible difference in
robustness transferred when using image resizing or center-cropping as the
input transformation.

Figure 5: Accuracy (%) on clean and adversarial Tiny-ImageNet test samples.

##  6 Theoretical Discussion

To understand how robustness transfer across input gradients of the student
and teacher models, we first look at the link between robustness and saliency
of input gradients in a single network. The link is formalized in Theorem 2 of
[6] which states that a network’s linearized robustness ($\rho$) around an
input $\operatorname{\mathbf{x}}$ is upper bounded by alignment term $\alpha$:

$\rho(\operatorname{\mathbf{x}})\leq\alpha(\operatorname{\mathbf{x}})+\frac{C}{\|g\|}$
(18)

where $g$ is the Jacobian of the difference between the top two logits,
$\alpha(\operatorname{\mathbf{x}})=\frac{|\langle\operatorname{\mathbf{x}},g\rangle|}{\|g\|}$
and $C$ is a positive constant. An important notion here is that a model with
high linearized robustness ($\rho$) retains its original prediction in face of
large perturbation but may still perform poorly on clean test data with
incorrect original outputs, such as finetuned teachers.

Different finetuned teacher models (FT-MINST and FT-TinyImagnet) display
visually different input gradients which we speculate to be a result of being
‘locked’ into their dataset-specific robust features. Different from natural
images which have smooth pixel value distributions, MNIST pixels take extreme
binary values. From the robustness-alignment link, one can expect the input
gradient to also take extreme values, explaining the sparse $J$ of FT-MINST.

With Theorem 6.1 below, IGAM’s $L_{\text{adv}}$ term encourages the teacher
and student models’ input gradients and, consequently, their input alignment
terms ($\alpha$) to match well.

######  Theorem 6.1.

The global minimum of $L_{\text{adv}}$ is achieved when
$\operatorname{J_{\text{s}}}=\operatorname{J_{\text{t}}}$.

Its proof is in the supplementary material (§ B). As a result, the high
linearized robustness upper bound of teacher model is transferred to the
student model. Though input gradients are approximations of $g$ and the upper
bound is not tight, we observe that such transfer is feasible in our
experiments. On top of this transferred robustness bound, all of the student
model’s weights are free to learn features relevant to the target task in
boosting its clean accuracy, hence the improved performance over its teacher
models.

##  7 Conclusions

We showed that input gradients are an effective medium to transfer adversarial
robustness across different tasks and even across different model
architectures. To train a student model’s input gradients to semantically
match those of a robust teacher model, we proposed input gradient adversarial
matching (IGAM) to optimize for the input gradients’ source to be
indistinguishable for a discriminator network. Through extensive experiments
on image classification, IGAM models outperform standard trained models and
models finetuned on pre-trained robust feature extractors. This demonstrates
that input gradients are a more versatile and effective medium of robustness
transfer. We hope that this will encourage new defenses that also target the
semantics of input gradients to achieve adversarial robustness.

#### Acknowledgments

This paper is supported in part by the National Research Foundation, Singapore
under its AI Singapore Programme (AISG Award No: AISG-RP-2018-004), and the
Data Science and Artificial Intelligence Research Center at Nanyang
Technological University. Any opinions, findings and conclusions or
recommendations expressed in this material are those of the authors and do not
reflect the views of National Research Foundation, Singapore.

## References

  * [1] Maksym Andriushchenko and Matthias Hein.  Provably robust boosted decision stumps and trees against adversarial attacks.  arXiv preprint arXiv:1906.03526, 2019.
  * [2] Nicholas Carlini and David Wagner.  Towards evaluating the robustness of neural networks.  In 2017 IEEE Symposium on Security and Privacy (SP), pages 39–57. IEEE, 2017.
  * [3] Alvin Chan, Yi Tay, Yew Soon Ong, and Jie Fu.  Jacobian adversarially regularized networks for robustness.  arXiv preprint arXiv:1912.10185, 2019.
  * [4] Francesco Croce and Matthias Hein.  Minimally distorted adversarial examples with a fast adaptive boundary attack.  arXiv preprint arXiv:1907.02044, 2019.
  * [5] Harris Drucker and Yann Le Cun.  Double backpropagation increasing generalization performance.  In IJCNN-91-Seattle International Joint Conference on Neural Networks, volume 2, pages 145–150. IEEE, 1991.
  * [6] Christian Etmann, Sebastian Lunz, Peter Maass, and Carola-Bibiane Schönlieb.  On the connection between adversarial robustness and saliency map interpretability.  arXiv preprint arXiv:1905.04172, 2019.
  * [7] Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio.  Generative adversarial nets.  In Advances in neural information processing systems, pages 2672–2680, 2014.
  * [8] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and harnessing adversarial examples.  arXiv preprint arXiv:1412.6572, 2014.
  * [9] Sven Gowal, Krishnamurthy Dvijotham, Robert Stanforth, Rudy Bunel, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli.  On the effectiveness of interval bound propagation for training verifiably robust models.  arXiv preprint arXiv:1810.12715, 2018.
  * [10] Matthias Hein and Maksym Andriushchenko.  Formal guarantees on the robustness of a classifier against adversarial manipulation.  In Advances in Neural Information Processing Systems, pages 2266–2276, 2017.
  * [11] Dan Hendrycks, Kimin Lee, and Mantas Mazeika.  Using pre-training can improve model robustness and uncertainty.  arXiv preprint arXiv:1901.09960, 2019.
  * [12] Daniel Jakubovitz and Raja Giryes.  Improving dnn robustness to adversarial attacks using jacobian regularization.  In Proceedings of the European Conference on Computer Vision (ECCV), pages 514–529, 2018.
  * [13] Harini Kannan, Alexey Kurakin, and Ian Goodfellow.  Adversarial logit pairing.  arXiv preprint arXiv:1803.06373, 2018.
  * [14] Anders Boesen Lindbo Larsen, Søren Kaae Sønderby, Hugo Larochelle, and Ole Winther.  Autoencoding beyond pixels using a learned similarity metric.  arXiv preprint arXiv:1512.09300, 2015.
  * [15] Yann LeCun, Yoshua Bengio, and Geoffrey Hinton.  Deep learning.  nature, 521(7553):436, 2015.
  * [16] Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu.  Defense against adversarial attacks using high-level representation guided denoiser.  In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 1778–1787, 2018.
  * [17] Chieh Hubert Lin, Chia-Che Chang, Yu-Sheng Chen, Da-Cheng Juan, Wei Wei, and Hwann-Tzong Chen.  Coco-gan: Generation by parts via conditional coordinating.  arXiv preprint arXiv:1904.00284, 2019.
  * [18] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards deep learning models resistant to adversarial attacks.  arXiv preprint arXiv:1706.06083, 2017.
  * [19] Nicolas Papernot, Fartash Faghri, Nicholas Carlini, Ian Goodfellow, Reuben Feinman, Alexey Kurakin, Cihang Xie, Yash Sharma, Tom Brown, Aurko Roy, Alexander Matyasko, Vahid Behzadan, Karen Hambardzumyan, Zhishuai Zhang, Yi-Lin Juang, Zhi Li, Ryan Sheatsley, Abhibhav Garg, Jonathan Uesato, Willi Gierke, Yinpeng Dong, David Berthelot, Paul Hendricks, Jonas Rauber, and Rujun Long.  Technical report on the cleverhans v2.1.0 adversarial examples library.  arXiv preprint arXiv:1610.00768, 2018.
  * [20] Aaditya Prakash, Nick Moran, Solomon Garber, Antonella DiLillo, and James Storer.  Deflecting adversarial attacks with pixel deflection.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 8571–8580, 2018.
  * [21] Chongli Qin, James Martens, Sven Gowal, Dilip Krishnan, Alhussein Fawzi, Soham De, Robert Stanforth, Pushmeet Kohli, et al.  Adversarial robustness through local linearization.  arXiv preprint arXiv:1907.02610, 2019.
  * [22] Aditi Raghunathan, Jacob Steinhardt, and Percy S Liang.  Semidefinite relaxations for certifying robustness to adversarial examples.  In Advances in Neural Information Processing Systems, pages 10877–10887, 2018.
  * [23] Andrew Slavin Ross and Finale Doshi-Velez.  Improving the adversarial robustness and interpretability of deep neural networks by regularizing their input gradients.  In Thirty-second AAAI conference on artificial intelligence, 2018\.
  * [24] Lukas Schott, Jonas Rauber, Matthias Bethge, and Wieland Brendel.  Towards the first adversarially robust neural network model on mnist.  arXiv preprint arXiv:1805.09190, 2018.
  * [25] Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein.  Adversarial training for free!  arXiv preprint arXiv:1904.12843, 2019.
  * [26] Ali Shafahi, Parsa Saadatpanah, Chen Zhu, Amin Ghiasi, Christoph Studer, David W. Jacobs, and Tom Goldstein.  Adversarially robust transfer learning.  CoRR, abs/1905.08232, 2019.
  * [27] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus.  Intriguing properties of neural networks.  arXiv preprint arXiv:1312.6199, 2013.
  * [28] Hugo Touvron, Andrea Vedaldi, Matthijs Douze, and Hervé Jégou.  Fixing the train-test resolution discrepancy.  arXiv preprint arXiv:1906.06423, 2019.
  * [29] Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry.  Robustness may be at odds with accuracy.  arXiv preprint arXiv:1805.12152, 2018.
  * [30] Eric Wong, Frank Schmidt, Jan Hendrik Metzen, and J Zico Kolter.  Scaling provable adversarial defenses.  In Advances in Neural Information Processing Systems, pages 8400–8409, 2018.
  * [31] Cihang Xie, Yuxin Wu, Laurens van der Maaten, Alan L Yuille, and Kaiming He.  Feature denoising for improving adversarial robustness.  In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 501–509, 2019.
  * [32] Haichao Zhang and Jianyu Wang.  Defense against adversarial attacks using feature scattering-based adversarial training.  arXiv preprint arXiv:1907.10764, 2019.
  * [33] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P Xing, Laurent El Ghaoui, and Michael I Jordan.  Theoretically principled trade-off between robustness and accuracy.  arXiv preprint arXiv:1901.08573, 2019.

Figure 6: Input gradients of different models. Figure 7: Decision boundaries
and loss landscapes of (a) standard trained, (b) IGAM-CIFAR10
($\lambda_{\text{adv}}=2,\lambda_{\text{diff}}=0$), (c) IGAM-CIFAR10
($\lambda_{\text{adv}}=0,\lambda_{\text{diff}}=10$) and (d) IGAM-CIFAR10
($\lambda_{\text{adv}}=2,\lambda_{\text{diff}}=10$) along the adversarial
perturbation and a random direction. Correct class: #53.

##  Appendix A IGAM Hyperparameters

The IGAM hyperparameters are fined through grid search through the same range
of hyperparameter values within each transfer task. We report the values of
the IGAM models whose results are reported in this paper for reproducibility.

###  A.1 CIFAR-10 Target Task

##### IGAM-MNIST

$\lambda_{\text{adv}}=1$, $\lambda_{\text{diff}}=100$, $f_{disc}$ : 5 CNN
layers (16-32-64-128-256 output channels) and updated once for every 10
classifier update steps

##### IGAM-TranposeConv

$\lambda_{\text{adv}}=1$, $\lambda_{\text{diff}}=10$, $f_{disc}$ : 4 CNN
layers (8-16-32-64 output channels) and updated once for every 5 classifier
update steps

##### IGAM-RandomPad

$\lambda_{\text{adv}}=1$, $\lambda_{\text{diff}}=10$, $f_{disc}$ : 4 CNN
layers (8-16-32-64 output channels) and updated once for every 5 classifier
update steps

##### IGAM-Pad

$\lambda_{\text{adv}}=2$, $\lambda_{\text{diff}}=20$, $f_{disc}$ : 4 CNN
layers (8-16-32-64 output channels) and updated once for every 5 classifier
update steps

##### IGAM-Upsize

$\lambda_{\text{adv}}=5$, $\lambda_{\text{diff}}=10$, $f_{disc}$ : 4 CNN
layers (8-16-32-64 output channels) and updated once for every 5 classifier
update steps

###  A.2 CIFAR-100 Target Task

##### IGAM-MNIST

$\lambda_{\text{adv}}=0.1$, $\lambda_{\text{diff}}=200$, $f_{disc}$ : 5 CNN
layers (16-32-64-128-256 output channels) and updated once for every 5
classifier update steps

##### IGAM-CIFAR10

$\lambda_{\text{adv}}=2$, $\lambda_{\text{diff}}=10$, $f_{disc}$ : 5 CNN
layers (16-32-64-128-256 output channels) and updated once for every 10
classifier update steps

###  A.3 Tiny-ImageNet Target Task

##### IGAM-CIFAR10-Resize

$\lambda_{\text{adv}}=0.1$, $\lambda_{\text{diff}}=200$, $f_{disc}$ : 4 CNN
layers (8-16-32-64 output channels) and updated once for every 5 classifier
update steps

##### IGAM-CIFAR10-Crop

$\lambda_{\text{adv}}=2$, $\lambda_{\text{diff}}=50$, $f_{disc}$ : 4 CNN
layers (8-16-32-64 output channels) and updated once for every 5 classifier
update steps

##### IGAM-CIFAR100-Resize

$\lambda_{\text{adv}}=0.1$, $\lambda_{\text{diff}}=200$, $f_{disc}$ : 4 CNN
layers (8-16-32-64 output channels) and updated once for every 5 classifier
update steps

##### IGAM-CIFAR100-Crop

$\lambda_{\text{adv}}=0.5$, $\lambda_{\text{diff}}=200$, $f_{disc}$ : 4 CNN
layers (8-16-32-64 output channels) and updated once for every 5 classifier
update steps

##  Appendix B Proof

######  Theorem B.1.

The global minimum of $L_{\text{adv}}$ is achieved when
$\operatorname{J_{\text{s}}}=\operatorname{J_{\text{t}}}$.

###### Proof.

From [7], the optimal discriminator is

$f_{\text{disc}}^{*}(\operatorname{J})=\frac{p_{\text{teacher}}(\operatorname{J})}{p_{\text{teacher}}(\operatorname{J})+p_{\text{student}}(\operatorname{J})}$
(19)

We can include the optimal discriminator into Equation (10) to get

$\displaystyle L_{\text{adv}}$ $\displaystyle=\mathbb{E}_{\operatorname{J}\sim
p_{\text{teacher}}}[\log
f_{\text{disc}}^{*}(\operatorname{J})]+\mathbb{E}_{\operatorname{J}\sim
p_{\text{student}}}[\log(1-f_{\text{disc}}^{*}(\operatorname{J}))]$ (20)
$\displaystyle=\mathbb{E}_{\operatorname{J}\sim
p_{\text{teacher}}}\left[\log\frac{p_{\text{teacher}}(\operatorname{J})}{p_{\text{teacher}}(\operatorname{J})+p_{\text{student}}(\operatorname{J})}\right]$
$\displaystyle\phantom{=}\,\phantom{=}\,+\mathbb{E}_{\operatorname{J}\sim
p_{\text{student}}}\left[\log\frac{p_{\text{student}}(\operatorname{J})}{p_{\text{teacher}}(\operatorname{J})+p_{\text{student}}(\operatorname{J})}\right]$
$\displaystyle=KL\left(p_{\text{teacher}}\;\middle\|\;\frac{p_{\text{teacher}}+p_{\text{student}}}{2}\right)$
$\displaystyle\phantom{=}\,\phantom{=}\,+KL\left(p_{\text{student}}\;\middle\|\;\frac{p_{\text{teacher}}+p_{\text{student}}}{2}\right)-\log
4$ $\displaystyle=2\cdot JS(p_{\text{teacher}}||p_{\text{student}})-\log 4$

where $KL$ and $JS$ are the Kullback-Leibler and Jensen-Shannon divergence
respectively. Since the Jensen-Shannon divergence is always non-negative,
$L_{\text{adv}}(G)$ reaches its global minimum value of $-\log 4$ when
$JS(p_{\text{teacher}}||p_{\text{student}})=0$. When
$\operatorname{J_{\text{s}}}=\operatorname{J_{\text{t}}}$, we get
$p_{\text{teacher}}=p_{\text{student}}$ and consequently
$JS(p_{\text{teacher}}||p_{\text{student}})=0$, thus completing the proof.

∎


# Properties of relativistic star in $5$-D Einstein-Gauss-Bonnet gravity

Soumik Bhattacharya  Department of Physics, Cooch Behar Panchanan Barma
University, Cooch Behar 736101, India.
Email<EMAIL_ADDRESS>Suntharalingam Thirukkanesh  Department
of Mathematics, Eastern University, Chenkalady, Sri Lanka.
Email<EMAIL_ADDRESS>Ranjan Sharma111Corresponding author Department
of Physics, Cooch Behar Panchanan Barma University, Cooch Behar 736101, India.
Email<EMAIL_ADDRESS>
###### Abstract

In recent years, there has been a growing interest in stellar modelling in the
framework of Einstein-Gauss-Bonnet gravity. In this paper, for a relativistic
star in static equilibrium, we invoke the $5$ dimensional Einstein-Gauss-
Bonnet gravity and solve the system by assuming a matter distribution that
admits a linear equation of state (EOS). We fix the model parameters by
matching the interior solution to the exterior Boulware-Deser metric, which
facilitates physical analysis of the resultant configuration. We analyze the
star’s gross physical properties, which brings to attention the role of the
Gauss-Bonnet coupling parameter $\alpha$ in fine-tuning the values of the
matter variables.

###### keywords:

Einstein-Gauss-Bonnet gravity; Relativistic star; Stellar configuration.

Received (Day Month Year)Revised (Day Month Year)

PACS Nos.:

##  1 Introduction

The General Theory of Relativity (GTR) developed by Einstein relating
spacetime curvature with matter is believed to be the correct theory of
gravity till date. Despite the enormous success of Einstein’s gravity (GR) in
predicting several observational tests of gravity, including the most recent
direct detection of gravitational waves from the merger of binary black holes
and neutron stars by advanced LIGO and Advanced Virgo detectors to the direct
imaging of black holes at the centres of Milky Way and $M87$ galaxies, a
correct theory of gravity applicable at all scales has remained elusive till
date. Among other issues such as the quantization of gravity, the theory comes
short in explaining many observational phenomena, e.g., the late time
accelerated expansion of the universe. In pursuit of alternative theories, GR
is being modified in many ways, including modifications invoked by considering
higher-order curvature terms in the Lagrangian. In the past, Kaluza and Klein
[1, 2] investigated the higher dimensional effects on electromagnetism (EM) by
conjoining EM to gravity. A natural extension of GTR is the Lovelock gravity
[3], which incorporates higher order curvature corrections to the field
equations in a general higher dimensional spacetime. One obtains an effective
theory of gravity for a quadratic form of the Lagrangian in Lovelock gravity,
namely, the Einstein-Gauss-Bonnet (EGB) gravity.

The Einstein-Gauss-Bonnet (EGB) gravity has got widespread attention primarily
in cosmological models (see e.g., Ref. Tan63,Chatter90,Gallo04,Ghosh08 and
references therein). By modifying the Einstein- Hilbert action with the
inclusion of a $4$D-Gauss-Bonnet term, Boulware and Deser [8] showed that
black hole solutions might exist in $n\geq 5$ dimensions. In the recent past,
in addition to its cosmological applications, there has been a growing
interest in studying its astrophysical implications. It should be stressed
that even though we live in a $4$-dimensional universe, such probes,
particularly in the context of astrophysical systems, stem out of theoretical
curiosity to understand the effects of higher order curvature corrections in a
general $n\geq 4$ dimensions.

Our investigation is motivated by some recent developments in this field.
Within the framework of $5$-D EGB gravity, Maharaj et al [9] developed an
interior solution by assuming a barotropic perfect fluid distribution. Dadhich
et al [10] established that the gravitational field inside a constant density
fluid sphere has a universal character for the spacetime dimensions $n\geq 4$,
which is not only valid for the Einstein-Hilbert action but also true for the
more general Lovelock action. Recently, Tangphati et al [16] have developed a
new class of solutions for a static spherically symmetric perfect fluid
distribution composed of quark matter in EGB gravity. In a comparative study
between EGB gravity and GTR [12], it has been claimed that some features of a
stellar body such as energy conditions and causality behaviour might remain
unaltered in EGB gravity. Effects of the EGB coupling term on stellar
properties have been analyzed by developing various stellar models in the
presence of the scalar field, anisotropy, bulk viscosity, shear, charge, and
heat-flux [13, 14, 15, 16]. Bhar et al [24] developed a model of a static
compact charged anisotropic fluid sphere possessing a linear relationship
between the radial pressure and the energy density within the framework of
Einstein-Maxwell-Gauss-Bonnet (EMGB) gravity. It has been shown that the mass
and radius of a compact star for a given central density increase as the
Coulomb repulsive force increases with the incorporation of electric charge
[17]. It is noteworthy that Gauss-Bonnet gravity has also been studied in
$n\rightarrow 4$ dimension. Some of the investigations include the
incorporation of scalar fields such as dilations [18, 19, 20], and rescaling
of the coupling parameter [21]. The GB parameter has also been regularized in
$4$ dimensions to generate a non-trivial gravitational theory [22]. It is,
therefore, worthwhile to analyze the implications of EGB gravity on the
geometry and physical behaviour of localized objects.

In our work, we study a star-like configuration by generating a new class of
exact solutions within the framework of $5-$D EGB gravity. The stellar object
is assumed to be filled with anisotropic matter that admits a linear equation
of state (EOS). In the high-density regime, theoretical studies affirm that
the radial and the tangential pressures need not be equal [23]. For the
assumed matter distribution, we make the EGB field equations tractable by
introducing a particular coordinate transformation and closing the system in
terms of a single generating function. We solve the system by specifying the
generating function $Z(x)$. We show that the solution is well-behaved, stable
and the energy conditions are satisfied. We fix the model parameters of the
solution by matching the interior solution to the exterior Boulware-Deser
metric [8], which facilitates its physical analysis. Numerical analysis of the
developed model helps us understand the effects of EGB gravity on the geometry
and gross physical features of the resultant object.

The paper is organized as follows: In section 2, the mathematical framework of
EGB gravity is laid down. In section 3, we introduce a particular
transformation to make the relevant field equations integrable. We solve the
field equations for a linear EOS and express the physical quantities in
analytic forms in section 4. In section 5, the interior solution is matched to
the exterior Boulware-Deser solution. In section 6, we compare EGB and GR by
analyzing the effects of the EGB coupling coefficient on the physical
quantities. Some concluding remarks are made in section 7.

##  2 EGB gravity: Basic framework

In five dimensions, by incorporating the Gauss-Bonnet term, the Einstein-
Hilbert action can be written as

$S=\int\sqrt{-g}\left[\frac{1}{2}(R-2\Lambda+\alpha
L_{GB})\right]d^{5}x+S_{matter},$ (1)

where $\alpha$ is the Gauss-Bonnet coupling term originating from string
theory. The corresponding equation of motion for the above action turns out to
be a second-order quasi-linear equation. The strength of the action $L_{GB}$
can be understood for the Gauss-Bonnet term in dimensions $n\geq 5$.

For the assumed action, the EGB field equations222in this formalism, we use
geometric units with the coupling constant $\kappa$ set to unity are obtained
as [9]:

$G_{ab}+\alpha H_{ab}=T_{ab},$ (2)

where $G_{ab}$ is the Einstein tensor. Note that we have considered the metric
signature as (- + + + +). The Lanczos tensor has the form

$H_{ab}=2(RR_{ab}-2R_{ac}R^{c}_{b}-2R^{cd}R_{acbd}+R^{cde}_{a}R_{bcde})-\frac{1}{2}g_{ab}L_{GB},$
(3)

where the Lovelock term is given by

$L_{GB}=R^{2}+R_{abcd}R^{abcd}-4R_{cd}R^{cd}.$ (4)

##  3 Field equations

We couch the line element for the interior of a static anisotropic
distribution of matter in $5$-dimensions (in coordinates
$x^{i}=t,r,\theta,\phi,\psi$) in the standard form as

$ds^{2}=-e^{2\nu(r)}dt^{2}+e^{2\lambda(r)}dr^{2}+r^{2}(d\theta^{2}+\sin^{2}{\theta}d\phi^{2}+\sin^{2}{\theta}\sin^{2}{\phi}d\psi^{2}),$
(5)

where $\nu(r)$ and $\lambda(r)$ are the unknown gravitational potentials. The
comoving fluid velocity is given by $u^{i}=e^{-\nu}\delta_{0}^{i}$ and the
unit space-like vector along the radial direction has the form
$\theta^{i}=e^{-\lambda}\delta_{1}^{i}$.

The energy-momentum tensor of the anisotropic fluid is assumed to be of the
form

$T_{ab}=(\rho+p_{t})u_{a}u_{b}+p_{t}g_{ab}+(p_{r}-p_{t})\theta_{a}\theta_{b},$
(6)

where $\rho$ , $p_{r}$ and $p_{t}$ represent the matter density, radial and
transverse pressure of the fluid, respectively.

Subsequently, the field equations (2) are obtained as 333Here $(^{\prime})$
denotes the differentiation with respect to the radial coordinate r

$\displaystyle\rho$ $\displaystyle=$
$\displaystyle\frac{3}{e^{4\lambda}r^{3}}\left(4\alpha\lambda^{\prime}+re^{2\lambda}-re^{4\lambda}-r^{2}e^{2\lambda}\lambda^{\prime}-4\alpha
e^{2\lambda}\lambda^{\prime}\right),$ (7) $\displaystyle p_{r}$
$\displaystyle=$
$\displaystyle\frac{3}{e^{4\lambda}r^{3}}\left[-re^{4\lambda}+(r^{2}\nu^{\prime}+r+4\alpha\nu^{\prime})e^{2\lambda}-4\alpha\nu^{\prime}\right],$
(8) $\displaystyle p_{t}$ $\displaystyle=$
$\displaystyle\frac{1}{e^{4\lambda}r^{2}}\left(-e^{4\lambda}-4\alpha\nu^{\prime\prime}+12\alpha\nu^{\prime}\lambda^{\prime}-4\alpha(\nu^{\prime})^{2}\right)$
(9) $\displaystyle+$
$\displaystyle\frac{1}{e^{2\lambda}r^{2}}\left(1-r^{2}\nu^{\prime}\lambda^{\prime}+2r\nu^{\prime}-2r\lambda^{\prime}+r^{2}(\nu^{\prime})^{2}\right)$
$\displaystyle+$
$\displaystyle\frac{1}{e^{2\lambda}r^{2}}\left(r^{2}\nu^{\prime\prime}-4\alpha\nu^{\prime}\lambda^{\prime}+4\alpha(\nu^{\prime})^{2}+4\alpha\nu^{\prime\prime}\right).$

To make the set of equations (7)-(9) tractable, we make the following
transformation

$x=r^{2},~{}~{}Z(x)=e^{-2\lambda(r)}~{}\mbox{and}~{}y^{2}(x)=e^{2\nu(r)}.$
(10)

A similar transformation may be found in Ref. Dur83 and Hans06. Consequently,
the system of equations (7)-(9) takes the form:

$\displaystyle\rho$ $\displaystyle=$ $\displaystyle
3\dot{Z}+\frac{3(Z-1)(1-4\alpha\dot{Z})}{x},$ (11) $\displaystyle p_{r}$
$\displaystyle=$
$\displaystyle\frac{3(Z-1)}{x}+\frac{\dot{y}}{y}\left[6Z-\frac{24\alpha(Z-1)Z}{x}\right],$
(12) $\displaystyle p_{t}$ $\displaystyle=$ $\displaystyle
2\left[3Z+x\dot{Z}-4\alpha\left(\frac{Z}{x}(Z-1)+(3Z-1)\dot{Z}\right)\right]\frac{\dot{y}}{y}$
(13) $\displaystyle+$ $\displaystyle
4Z\left[x-4\alpha(Z-1)\right]\frac{\ddot{y}}{y}+\frac{Z-1}{x}+2\dot{Z},$

where a dot (.) denotes differentiation with respect to the variable $x$.

At this stage, we need to provide an equation of state (EOS) to close the
system. Accordingly, we assume that the matter distribution satisfies the
following linear barotropic EOS

$p_{r}=k\rho-B,$ (14)

where $k$ and $B$ are constants. It is to be noted that the MIT bag model EOS
for ultra-compact stars composed of strange matter has a linear form. Zdunik
[31] has shown that a strange matter EOS can be approximated to a linearized
form that exhibits a particular scaling behaviour of the system. Earlier,
Sharma and Maharaj [32] had assumed a linear EOS to develop a relativistic
stellar model. All these provide us with enough motivation to choose a linear
EOS to construct our model. Another advantage of choice (14) is that it
ensures that the radial pressure vanishes when the density reaches its surface
value $\rho_{s}=B/k$.

Substituting (11) and (12) into (14), we obtain

$\frac{\dot{y}}{y}=\frac{3\left[k\dot{Z}x+(Z-1)[k(1-4\alpha\dot{Z})-1]\right]-Bx}{3[2xZ-8\alpha(Z-1)Z]}.$
(15)

Integration of equation (15) yields

$y=d\exp\left[\int f(x)dx\right],$ (16)

where $\displaystyle
f(x)=\frac{3\left[k\dot{Z}x+(Z-1)[k(1-4\alpha\dot{Z})-1]\right]-Bx}{3[2xZ-8\alpha(Z-1)Z]},$
and $d$ is a constant of integration. Subsequently, we express the system of
equations (11)-(13) in the following form:

$\displaystyle\rho$ $\displaystyle=$ $\displaystyle
3\dot{Z}+\frac{3(Z-1)(1-4\alpha\dot{Z})}{x},$ (17) $\displaystyle p_{r}$
$\displaystyle=$ $\displaystyle k\rho-B,$ (18) $\displaystyle p_{t}$
$\displaystyle=$
$\displaystyle\frac{Z-1}{x}+2\dot{Z}+2\left[3Z+x\dot{Z}-4\alpha\left(\frac{Z}{x}(Z-1)+(3Z-1)\dot{Z}\right)\right]f(x)+$
(19) $\displaystyle
4Z\left[x-4\alpha(Z-1)\right]\left[\dot{f}(x)+(f(x))^{2}\right]$

It is remarkable that the matter variables $\rho,p_{r}$ and $p_{t}$ are
expressed in terms of the gravitational potential $Z$ only. We must choose $Z$
in such a manner that (i) equation (16) becomes integrable and (ii) it
provides a physically acceptable model.

##  4 Choosing $Z$

Utilizing the additional degrees of freedom, we assume the gravitational
potential $Z$ in the form

$Z=\frac{(1+2ax)}{(1+ax)},$ (20)

where $a$ is a real constant. The objective of the specific choice is to
ensure that the system becomes integrable, and to the best of our knowledge,
this particular choice has not been used earlier to develop a stellar model in
EGB gravity. With this assumption, the physical quantities take the following
forms:

$\displaystyle e^{2\nu}$ $\displaystyle=$ $\displaystyle
d^{2}(1+2ax)^{l}(1+ax)^{-k}[1+ax-4a\alpha]^{h}\exp{\left[-\frac{B(1+ax)}{6a}\right]},$
(21) $\displaystyle e^{2\lambda}$ $\displaystyle=$
$\displaystyle\frac{(1+ax)}{(1+2ax)},$ (22) $\displaystyle\rho$
$\displaystyle=$
$\displaystyle\frac{3a(2+3ax+a^{2}x^{2}-4a\alpha)}{(1+ax)^{3}},$ (23)
$\displaystyle p_{r}$ $\displaystyle=$
$\displaystyle\frac{3ak(2+3ax+a^{2}x^{2}-4a\alpha)}{(1+ax)^{3}}-B,$ (24)
$\displaystyle p_{t}$ $\displaystyle=$
$\displaystyle\frac{a(3+ax)}{(1+ax)^{2}}+\frac{2}{(1+ax)^{3}}\left[3+a(13x-12\alpha)\right.$
(25)
$\displaystyle\left.+2a^{3}x^{2}(3x-4\alpha)+16a^{2}x(x-2\alpha)\right]f(x)+$
$\displaystyle\left[\frac{4(1+2ax)[x+ax(x-4\alpha)]}{(1+ax)^{2}}\right]\left[\dot{f(x)}+f(x)^{2}\right],$

where

$\displaystyle l$ $\displaystyle=$
$\displaystyle\frac{B+6a[1+k(16a\alpha-3)]}{12a(8a\alpha-1)},$ $\displaystyle
h$ $\displaystyle=$
$\displaystyle\frac{4a\alpha[3(1-k)+4B\alpha)}{3(1-8a\alpha)},$ $\displaystyle
f(x)$ $\displaystyle=$
$\displaystyle-\left[B+a^{3}x^{2}(3-3k+Bx)+a(3-6k+3Bx^{2})+3a^{2}((2-3k)x+Bx+4k\alpha)\right]/$
$\displaystyle 6(1+ax)(1+2ax)[1+a(x-4\alpha)].$

##  5 Exterior spacetime and matching conditions

The exterior spacetime corresponding to the $5$-dimensional static
distribution is assumed to be described by the Boulware-Deser [8] metric

$ds^{2}=-F(r)dt^{2}+[F(r)]^{-1}dr^{2}+r^{2}(d\theta^{2}+\sin^{2}{\theta}d\phi^{2}+\sin^{2}{\theta}\sin^{2}{\phi}d\psi^{2}),$
(26)

with

$F(r)=\eta+\frac{r^{2}}{4\alpha}\left(1-\sqrt{1+\frac{8\alpha
M}{r^{4}}}\right),$ (27)

where $M$ is the gravitational mass and $\eta$ is an arbitrary constant. Note
that, with $\eta=0,~{}\pm 1,$ the line element (26) corresponds to a
cosmological brane world solution [33, 34, 35] in EGB gravity. Moreover, with
$\eta=1$, the solution asymptotically corresponds to the Schwarzschild
solution with a positive gravitational mass or Schwarzschild-de Sitter
solution with a negative gravitational mass [36].

To fix the values of the model parameters, we first match the gravitational
potentials of the interior metric with the exterior metric at the boundary
$r=R$. Matching of $g_{rr}$ determines $a$ in the form

$a=\frac{(1-\eta)-A}{R^{2}[A+(\eta-2)]},$ (28)

where

$A=\frac{R^{2}}{4\alpha}[1-\sqrt{1+\frac{8\alpha M}{R^{4}}}].$ (29)

Utilizing the requirement that radial pressure must vanish at the boundary, we
obtain $B$ as

$B=\frac{3ak(2+3aR^{2}+a^{2}R^{4}-4a\alpha)}{(1+aR^{2})^{3}}.$ (30)

Matching of $g_{tt}$ across the boundary yields

$d=\pm\left[\frac{F(R)(1+aR^{2})^{k}}{(1+2aR^{2})^{l}(1+aR^{2}-4a\alpha)^{h}}\right]^{1/2}\exp{\left[-\frac{B(1+aR^{2})}{12a}\right]},$
(31)

where

$F(r=R)=\eta+A.$ (32)

It is interesting to note that equations (28) and (31) determine the constants
$a$ and $d$ in terms of the radius of the star $R$ and gravitational mass $M$.
To get an estimate of the values of the model parameters, for a given mass and
radius, values of different physical quantities are given in Table 5 where
following Bhar and Govender [24], we set $\eta=1.5$ and $k=0.35$ in our
calculation.

Values of physical parameters for different $\alpha$ ($R=10$, $k=0.35$,
$M=2$).  $\alpha$ $a$ $\rho_{c}$ $B$ $0.01$ $0.00923077$ $0.0553744$
$0.0076603$ $0.1$ $0.0092308$ $0.0552825$ $0.00765578$ $1.0$ $0.00923106$
$0.0543638$ $0.00761057$ $5.0$ $0.00923224$ $0.0502794$ $0.00740962$ $10.0$
$0.0092337$ $0.0451709$ $0.00715838$ $15.0$ $0.00923516$ $0.0400591$
$0.0069071$ $20.0$ $0.0092366$ $0.034944$ $0.00665578$ $25.0$ $0.00923802$
$0.0298258$ $0.0064044$

###  5.1 Choice of $\alpha$

In equation (23), by setting $x=0$, we obtain the central density

$\rho_{c}=3a(2-4a\alpha).$ (33)

Now, the central density will remain positive if either of the following two
conditions is satisfied:
i) $a>0$ & $(2-4a\alpha)>0$, or ii) $a<0$ & $(2-4a\alpha)<0$.
Condition (i) implies $\alpha<\frac{1}{2a}$ and condition (ii) implies
$\alpha>\frac{1}{2a}$.

Therefore, in our model, the signature of $\alpha$ depends on the choice of
the curvature parameter $a$ appearing in the metric ansatz (20). For numerical
analysis, we consider only positive values of $a$. While a negative value of
the coupling parameter is permissible (see e.g., Ref. [25]), it is, in
general, restricted to positive coupling only as can be seen in references
[26, 27, 28]. A positive $\alpha$ is consistent with its physical meaning as
the inverse string tension having a dimension of $[$Length$]^{2}$ in string
theory [16].

##  6 Physical features

For a fixed set of model parameters, we now utilize the solution to analyze
the physical features of the stellar configuration. Some salient features of
the resultant configuration are discussed below:

  1. 1.

We plot the matter variables in Fig. (2), (2) and (4). The plots show that the
matter density $\rho$, the radial pressure $P_{r}$ and the tangential pressure
$P_{t}$ are all positive and decrease from their peak values at the centre
towards the surface as expected for a physically acceptable model.
Interestingly, for a given mass and radius, the density and radial pressure
consistently decrease for higher Gauss-Bonnet coupling ($\alpha$) values. The
tangential pressure towards the centre also exhibits similar behaviour.

Figure 1: Matter density $\rho$ plotted against the radial distance $r$. (We
have assumed $R=10,~{}M=2,~{}\eta=1.5,~{}k=0.35$)

Figure 2: Radial pressure $P_{r}$ plotted against the radial distance $r$ by
taking the same values of the parameters mentioned in Fig. 2.

  2. 2.

The radial variation of anisotropy ($\displaystyle\Delta=P_{t}-P_{r}$) is
shown in Fig. 4. We note that both $P_{t}$ and $P_{r}$ are equal at the
centre, as expected. For $\alpha\neq 0$, $\Delta$ reaches a maximum value and
then decreases.

Figure 3: Tangential pressure $P_{t}$ plotted against the radial distance $r$
by taking the same values of the parameters mentioned in Fig. 2.

Figure 4: Anisotropy $P_{t}-P_{r}$ plotted against the radial distance $r$ by
taking the model parameters as: $M=2$, $R=10$, $k=0.35$, $(i)$ $\eta=1.7$ for
$\alpha=10$, $(ii)$ $\eta=1.43$ for $\alpha=15$, $(iii)$ $\eta=1.22$ for
$\alpha=20$, $(iv)$ $\eta=1.4$ for $\alpha=25$

  3. 3.

Fulfillment of energy conditions: A realistic star should fulfill the
following energy conditions:

     * •

Null Energy Condition (NEC): $\rho\geq 0$.

     * •

Weak Energy Condition (WEC) : $\rho-P_{r}\geq 0,~{}\rho-P_{t}\geq 0$.

     * •

Strong Energy Condition (SEC): $\rho-P_{r}-2P_{t}\geq 0$.

Fig. (6)-(8) clearly show fulfillment of these conditions in this model.

Figure 5: $\rho-P_{r}-2P_{t}$ plotted against the radial distance $r$ by
taking the same values of the parameters mentioned in Fig. 2.

Figure 6: $\rho-P_{r}$ plotted against the radial distance $r$ by taking the
same values of the parameters mentioned in Fig. 2.

  4. 4.

In this model, since we have assumed a linear relationship between the density
and radial pressure given in equation (14), the square of the radial sound
velocity ($v_{sr}^{2}$) is simply a constant $k$ in the presence or absence of
the coupling term. However, the square of transverse sound velocity
($v_{st}^{2}$) shows a variation that falls off with the radial distance $r$
and $\alpha$ as shown in Fig. 8.

Figure 7: $\rho-P_{t}$ plotted against the radial distance $r$ by taking the
same values of the parameters mentioned in Fig. 2.

Figure 8: Transverse sound velocity $v_{st}^{2}$ plotted against the radial
distance $r$ by taking the same values of the parameters mentioned in Fig. 2.

  5. 5.

An important measure of a stellar object is the adiabatic index which is
defined as

$\Gamma=\frac{\rho+P_{r}}{P_{r}}\frac{dP_{r}}{d\rho},$ (34)

For a stable stellar configuration, $\Gamma$ should be greater than $4/3$
everywhere within the stellar interior [38]. This condition is shown to be
satisfied in this model in Fig. 9. A marginal increment in the values of
$\Gamma$ is noted for higher values of $\alpha$.

Figure 9: Adiabatic index $\Gamma$ plotted against radial distance $r$ by
taking the same values of the parameters mentioned in Fig. 2.

  6. 6.

To examine stability of the configuration, we have applied the ‘cracking’
condition of [39]. In Fig. 10, we note that the difference between the radial
sound speed ($v_{sr}^{2}$) and the tangential sound speed ($v_{st}^{2}$)
becomes zero at a certain radial distance which shifts outwards with the
increase of $\alpha$ without violating the overturning (cracking) condition
$0<\left|v_{st}^{2}-v_{sr}^{2}\right|~{}<1$.

Figure 10: Fulfillment of Harrera’s cracking condition.

##  7 Conclusion

We have generated a new solution describing a relativistic stellar
configuration in Einstein-Gauss-Bonnet gravity which is regular, well-behaved
and physically reasonable. The solution facilitates an analysis of the Gauss-
Bonnet coupling term on the gross physical properties of the star. In
particular, we have analyzed the role of the coupling term $\alpha$ on the
physical quantities of the star. In this context, we would like to point out
the following:

  * •

The energy density and radial pressure decrease with the increase of the EGB
coupling parameter $\alpha$. This feature is more pronounced at the central
region.

  * •

While the tangential pressure decreases with the increase of the EGB coupling
parameter $\alpha$ at the central region, an inverse relationship is observed
towards the surface.

  * •

Energy conditions are satisfied for a wide range of values of $\alpha$. The
stability of the configuration remains unaltered for a wide range of values of
$\alpha$.

Our results points towards the fact the the Gauss-Bonnet gravity might play an
important role in fine-tuning stellar observables. Further progress in this
direction will be reported elsewhere.

## Acknowledgments

RS gratefully acknowledge support from the Inter-University Centre for
Astronomy and Astrophysics (IUCAA), Pune, India, under its Visiting Research
Associateship Programme. We express our gratitude to the anonymous referee for
his comments and suggestions.

## Data availability

The manuscript has no associated data.

## References

  * [1] T. Kaluza, Sitz. Preuss. Acad. Wiss. F1, 966 (1921).
  * [2] O. Klein, A. Phys. 37, 895 (1926).
  * [3] D. Lovelock, J. Math. Phys. 12, 498 (1971); 13, 874 (1972).
  * [4] F. Tangherlini, NCim 27, 636 (1963).
  * [5] S. Chatterjee, B. Bhui and A. Banerjee, J. Math. Phys. 31, 2208 (1991).
  * [6] E. Gallo, Gen. Relativ. Gravit. 36, 1463 (2004).
  * [7] S. G. Ghosh and D. Kothawala, Gen. Relativ. Gravit. 40, 9 (2008).
  * [8] D. G. Boulware and S. Deser, Phys. Rev. Lett. 55, 2656 (1985).
  * [9] S. D. Maharaj, B. Chilambwe and S. Hansraj, Phys. Rev. D 91, 084049 (2015).
  * [10] N. Dadhich, A. Molina and A. Khugaev, Phys. Rev. D 81, 104026 (2010)
  * [11] T. Tangphati, A. Pradhan, A. Erryhymy and A. Banerjee,, Annals of Phys. 430, 168498 (2021)
  * [12] P. Bhar, M. Govender and R. Sharma, Eur. Phys. J. C 77, 109 (2017).
  * [13] S. Hansraj and N. Qwabe, Mod. Phys. Lett. A 32, 1750204 (2017).
  * [14] B. P. Brassel and S. D. Maharaj, Eur. Phys. J. C  80, 971 (2020).
  * [15] M. K. Jasim, S. K. Maurya, K. N. Singh and R. Nag, Entrp. 23, 23, 1015 (2021).
  * [16] T. Tangphati, A. Pradhan, A. Erryhymy and A. Banerjee, Phys. Lett. B 819, 136423 (2021).
  * [17] J. M. Z. Pretel, A. Pradhan and A. Banerjee, Eur. Phys. J. C 82, 180 (2022)
  * [18] T. Torii, H. Yajima and K. I. Maeda, Phys. Rev. D 55, 739 (1997).
  * [19] S. Nojiri, S. D. Odintsov and M. Sasaki, Phys. Rev. D 71, 123509 (2005).
  * [20] C. M. Chen, D. V. Gal’tsov, N. Ohta and D. G. Orlov, Phys. Rev. D 81, 024002 (2010).
  * [21] S. Hansraj, A. Banerjee, L. Moodly and M. K. Jasim, Class. Quant. Grav. 38, 035002 (2020).
  * [22] J. X. Feng, B. M. Gu, and F. W. Shu, Phy. Rev. D 103, 064002 (2021).
  * [23] L. Herrera and N. O. Santos, Phy. Rep. 286, 53 (1997).
  * [24] P. Bhar and M. Govender, Astrophys. Space Sci. 364, 186 (2019).
  * [25] S. Dey and B. C. Paul, https://doi.org/10.48550/arxiv.2201.08391 (2022).
  * [26] D. J. Gross and J. H. Solan, Nucl. Phys. B 291, 41 (1987).
  * [27] M. C. Bento and O. Bertolami, Phys. Lett. B 368, 198 (1996).
  * [28] H. Maeda, Phys. Rev. D 73, 10 (2006).
  * [29] M. C. Durgapal and R. Banerjee, Phys. Rev. D 27, 328 (1983).
  * [30] S. Hansraj and S. D. Maharaj, Int. J. Mod. Phys. D 15, 1311 (2006).
  * [31] J. L. Zdunik, Astron. & Astrophys. 359, 311 (2000).
  * [32] R. Sharma and S. D. Maharaj, Mon. Not. R. Astron. Soc. 375, 1265 (2007).
  * [33] P. Kraus, J. High Ener. Phys. 1999, 011 (1999).
  * [34] D. Ida, J. High Ener. Phys. 0009, 014 (2000).
  * [35] S. C. Davis, Phys. Rev. D 67, 024030 (2003).
  * [36] L. Abbott and S. Deser, Nucl. Phys. B 195, 76 (1982).
  * [37] J. Bonifacio, K. Hinterbichler and L. A. Johnson, Phys. Rev. D  102, 024029 (2020).
  * [38] H. Heintzmann and W. Hillebrandt, Astron. Astrophys. 38, 51 (1975).
  * [39] L. Harrera, Phys. Lett. A 165, 206 (1992).