Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 6: Weak Accept
review_content: This paper presents a method for adaptive adversarial example detection. The authors propose to construct the adversarial subspace detector based on Asymmetrical Adversarial Training (AAT). The proposed model is composed of both classifier and adversarial detector, where the classifier makes the classification prediction and the adversarial detector evaluate if the input sample is natural of adversarial. The goal of the objective function is to minimize the adversarial detector error given large enough perturbation budget.

The authors provide extensive experimental results showing the promising performance of the model in detecting various types of adversarial attack. I have several concerns regarding the model and experiments:

1) Since D^{'^{f}}_k \subset D^f_k, would the model minimize w.r.t. both the loss of L(h(x, \theta), 0) and L(h(x, \theta), 1)? Would this cause unstable training?

2) Maybe I missed it, but it seems that the objective function in Eq. (5) is based on the adversarial detector. How could the classification performance of classifier f be guaranteed in training?

3) What does the cross mark mean in Fig. 2(b) and 4(b)?
review_title: Official Blind Review #3

final_score: rating: 6: Weak Accept
review_content: Review: The paper addresses the adversarial example detection problem. The framework proposed in the paper divides the input space into subspaces based on a classifier’s output and trains detectors on these subspaces to classify a natural sample (classified as that class) from an adversarial one fooling the network. The goal is to use a robust optimization approach to enable detection methods to withstand adaptive/dynamic attacks. Hence, an asymmetrical adversarial training (AAT) regime is employed which presents solving a min-max problem. AAT supports the detectors to learn class conditional distributions, motivating generative detection/classification approaches. There are three different attacking scenarios and evaluation shows that the combined attack turns out to be most effective (as it fools both the classifier and detectors) against integrated detection. The paper also demonstrates empirical improvements over state of the art detection techniques with higher L2 distortion of perturbed samples.

Pros:
- With the vulnerabilities associated with neural networks, the motivation behind building defense mechanisms against adversarial attacks has been well-justified.
- Most of the evaluation metrics look appropriate and well-defined.
- It was interesting to observe the perturbed samples produced by attacking generative classifier. While they exhibited visible features of the target class, these perturbations had to be different on a sematic level to be distinguished from the natural samples. 


Cons:
- While the idea to partition into subspaces and learn a different detection for each of them is novel, it involves training multiple detectors one by one that can be computationally expensive. The loss function for different attacking scenarios uses the outputs from all the detectors, which can also be expensive, especially when there are a lot of classes.
- To deal with extremely unbalanced data sets when training the detector, the solutions used in the paper resamples to balanced the positive and negative class data. This would mean throwing off most of the data, I would see how it affects the training. 

review_title: Official Blind Review #2

final_score: rating: 6: Weak Accept
review_content: Summary:
This paper studies the adversarial detection problem within the robust optimization framework. They propose an adversarial detection and a generative modeling technique called asymmetrical adversarial training (AAT). With one detector for each class discriminating natural data from adversarially perturbed data, AAT can learn class-conditional distributions, which further result in generative detection/classification methods with competitive performance. Experimental results are provided on MNIST, CIFAR10 and Restricted ImageNet, compared with CW method as baseline.

The paper is well written with detailed experimental results. I'd suggest accepting the paper.

To my understanding, the objective function of AAT is similar to GAN's, while there is a detector for each class discriminating natural data from adversarially perturbed data instead of generated data. They incorporate the attack into the training objective with three attacking scenarios: classifier attack, detectors attack, and combined attack. They also introduce integrated classification of the classifier and detectors with the reject option. Further, they demonstrate ATT promotes the learning of class-conditional distributions and leads to generative classifiers. They claim in addition to more robust classification, ATT also gives rise to improved interpretability, which I'm not convinced of with given experimental results.
review_title: Official Blind Review #1

Meta-review: This work addresses the problem of detecting an adversarial attack. This is a challenging problem as the detection mechanism itself is also vulnerable to attack. The paper proposes asymmetrical adversarial training as a robust solution. This approach partitions the feature space according to the output of the robust classifier and trains an adversarial example detector per partition. The paper demonstrates improvements over state-of-the-art detection techniques. 

All three reviewers recommend acceptance of this work. Some positive points include the paper being well-written with strong experimental evidence. One potential difficulty with the proposed approach is the additional computational cost associated with a per class adversarial attack detector. The authors have responded to this concern by claiming that the straightforward version of their approach is K times slower (10 in the case of 10 classes), but their integrated version is 2x slower as they only run the detector associated with the example-specific class prediction. We encourage the authors to include a discussion on computational cost in the final version. In addition, there was a community comment about black-box testing which will be of relevance to many in the community. The authors have already provided additional experiments to address this question as well as code to reproduce the new experiment. 

Overall, the paper addresses an important problem with a two-step solution of training a robust model and detecting potentially perturbed samples per class. This is a novel solution with comprehensive experiments and therefore recommend acceptance. 

Decision: Accept (Poster)