Defensive Distillation

The process involves a two-stage training paradigm. An initial teacher model is trained on hard labels with high temperature softmax to produce class probability vectors rich in inter-class similarity information. A second student model, architecturally identical, is then trained on these soft labels rather than ground-truth hard labels.

• Teacher Model: Trained with temperature T > 1 to soften probability distributions
• Student Model: Learns the full decision surface topology, not just decision boundaries
• Temperature Parameter: Controls the smoothness of the transferred knowledge

Defensive distillation reduces the sensitivity of the model's loss surface in the vicinity of training points. The soft label training forces the student model to output probabilities that change extremely slowly when inputs are perturbed, effectively flattening the loss landscape.

• Adversarial gradient magnitudes become near-zero
• Attackers cannot reliably compute the direction of steepest ascent
• The Jacobian of the model becomes numerically unstable for gradient-based attacks

The distillation temperature T is the critical hyperparameter. During teacher training, the softmax function becomes softmax(z/T), where higher T values produce softer, more uniform probability distributions that encode relative class similarities.

• T=1: Standard softmax, minimal knowledge transfer
• T > 20: Near-uniform distribution, maximal smoothing
• At inference, the student uses T=1 for standard classification confidence

Defensive distillation provides strong resistance against white-box gradient-based attacks like the Fast Gradient Sign Method (FGSM) and Jacobian-based Saliency Map Attack (JSMA). However, it is vulnerable to black-box transfer attacks and adaptive attacks that account for the distillation defense.

• FGSM Success Rate: Reduced from 90%+ to below 5% on MNIST
• C&W Attack: Carlini & Wagner demonstrated adaptive attacks can bypass distillation
• Defense-in-Depth: Should be combined with adversarial training for comprehensive robustness

The primary cost is training two identical models sequentially. The teacher and student share the same architecture, doubling the training time compared to standard training. However, inference cost is identical to the base model since only the student is deployed.

• Training Cost: 2x standard training time
• Inference Cost: No additional overhead
• Memory Footprint: No increase at deployment

Defensive distillation is not a provable defense. Nicholas Carlini and David Wagner demonstrated that constructing a modified loss function that accounts for the temperature scaling can successfully generate adversarial examples against distilled models.

• Adaptive Attackers: Can reverse-engineer the distillation temperature
• Transfer Attacks: Adversarial examples crafted on an undefended surrogate model often transfer
• Certified Robustness: Distillation provides no formal mathematical guarantees

The quantified resilience of a model against intentionally crafted inputs designed to cause misclassification. Defensive distillation directly improves robustness by smoothing the model's decision surface, making it harder for attackers to find adversarial directions.

• Key metric: Robust accuracy under perturbation budget ε
• Relationship: Distillation is a robustness training technique
• Trade-off: Often reduces clean-data accuracy by 1-3%

An inference-time attack where an adversary modifies an input sample with imperceptible perturbations to force misclassification. Defensive distillation was specifically designed to counter evasion attacks by reducing the amplitude of adversarial gradients.

• FGSM: Fast Gradient Sign Method, a common evasion technique
• PGD: Projected Gradient Descent, a stronger iterative variant
• Defense mechanism: Distillation flattens loss landscape near training points

A phenomenon where a defense inadvertently hides gradient information rather than truly improving robustness. Early defensive distillation implementations were criticized for causing gradient masking, which gave a false sense of security against white-box attacks.

• Detection: Test with black-box transfer attacks
• Fix: Combine distillation with adversarial training
• Lesson: Obfuscated gradients ≠ genuine robustness

A formal, mathematical guarantee that a model's prediction remains constant for any input perturbation within a defined Lp-norm bound. Unlike empirical defenses like distillation, certified methods provide provable guarantees.

• Randomized smoothing: A leading certification technique
• Comparison: Distillation offers empirical, not certified, defense
• Hybrid approach: Use distillation as a base, then apply smoothing

An attack where an adversary systematically queries a target model to reconstruct its functionality or steal learned parameters. The soft labels used in defensive distillation can inadvertently leak more information per query than hard labels.

• Risk: Softmax probabilities reveal decision boundary details
• Mitigation: Apply differential privacy to output probabilities
• Trade-off: Higher temperature distillation increases extraction vulnerability

A decentralized training process that incorporates adversarial examples into local client training to improve global model robustness. When combined with defensive distillation across federated nodes, it creates a defense-in-depth architecture.

• Local step: Each client generates adversarial examples on-device
• Global benefit: Aggregated model inherits multi-source robustness
• Privacy: Adversarial samples never leave the local node