Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: The paper proposes a geometric and analytic modeling perspective for robust training. They first propose a formalization of robustness in learning theoretic term, then give a geometrical description of the phenomenon for simple classifiers. Experiments are conducted on synthetic and real-world data to verify their idea. 
strength_and_weaknesses: Strength:
The paper tries to provide a general framework for robust learning and the goal is plausible. 

Weaknesses: 
The writing is weak and as a result I can only barely judge the other aspects of the paper.  
Aside from the obvious LaTex compiling error, the paper spends quite a few pages to include new definitions, which are only explained in later sections. When reading the paper following each section, the reader may get confused about why this definition is included -- very oftenly the definition just appear without any motivating sentences. For example, there is no explanation for why SVC is needed before Definition 2.4 and why complex-value classifier is needed before Definition 3.1. 
The writing also fails to clearly identify Assumptions that should be made for this analytical framework, e.g., "If we find some sample x that does not perplex h but is not correctly labeled by h, then we assume that H is agnostic to the pattern f x." appears in a paragraph, but I think this should be an assumption that needs to get highlighted. 
Also in terms of clarity, when the paper mentions "integral representation is more adequate for analysis when there is a continuum of features to choose from, e.g. ANN" -- the paper does not define what 'feature' is in ANN so one can only guess what the meaning is. 
There are clarity issues in the main results section (Section 4) as well. Theorem should be self-explanatory as much as possible, whereas in Theorem 4.1, it is unclear what does f mean and there is no short proof provided (if one dives deeper, it points to Appendix C.7 then Proposition C.2 which seems to be from another paper.). 

clarity,_quality,_novelty_and_reproducibility: I have expressed my concerns on clarity and quality in the above section. 
summary_of_the_review: I would vote for reject since the writing does not meet the bar. Even though the paper may contain interesting ideas, it probably should go through another review round after a major revision.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: In this paper, the authors introduced a general framework for training robust models. The idea of using calculus of variations and differential equations to tackle the robust training of neural network models is novel and interesting. Some theoretical analysis is given.
strength_and_weaknesses: Strength: The idea of using calculus of variations and differential equations to tackle the robust training of neural network models is novel and interesting. The theoretical results seem solid.

Weaknesses: 1. This paper is not well written since there are many typos. For example, see "Section ??" on Page 8, "Lemma ??" on Page 13, and "Definition ??" on Page 15.
2. Many theoretical results are about SVC. More theoretical results on more complicated models should be included.
clarity,_quality,_novelty_and_reproducibility: Clarity: This paper is not very well written. 
Quality: This paper is technically sound.
Novelty: The novelty of this paper is high.
summary_of_the_review: In summary, this is a solid paper with novel ideas. The idea of using calculus of variations and differential equations to tackle the robust training of neural network models is novel and interesting. However, This paper is not very well written. Also, more theoretical results on more complicated models should be included.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: This paper provides an analytical framework to understand adversarial example problems in a more formal way. Several hypothesis classes are discussed, especially $L^2$ (square-integrable functions) and $A^2$ (Bergman space, a subspace of holomorphic square-integrable functions). For their framework, the authors extended the space of classifiers so that it contains complex-valued functions as classifiers. Their main statement (Theorem 4.2) states that a learning rule minimizing Dirichlet energy would induce a robust classifier. A practical discussion on how to implement the main idea and an experimental exploration are provided.

strength_and_weaknesses: [[Strengths]]
1. The paper provides precious theoretical insights into robust classification.
2. About implementing the authors’ learning rule (Theorem 4.2), the paper proposes a practical method based on a well-understood PDE problem. This reduction to the PDE problem would open up a new research direction.

[[Weaknesses]]
1. The paper has a few LaTeX issues. First, there are some missing references, e.g., ‘section ??’ in Section 5, ‘lemma ??’ in Appendix C.4, and ‘definition ??’ in Appendix C.8. Since those missing references appear in the main body (or even in the proof), the authors should fix these missing references. Also, please fix the Appendix sectioning so that the material starts from Appendix A. (Currently, Appendix A is just an empty section with the title ‘Appendix’)
2. About the experimental details, the authors mentioned that “The interested reader can find the details of the experiment in the supplementary materials.”, but the supplementary materials only contain iPython notebooks that the reader should run. This is submitted as an academic paper, and general readers (even those who are interested in experimental details) only read the written materials. Therefore, this raises a reproducibility issue. (the descriptions in the paper are not enough to reproduce the result.) I suggest the authors 1. write an additional section (in the Appendix) about experimental details (e.g., network structure, hyperparameters, etc.) and 2. put your code on a code repository and add the link to the repository in the camera-ready version. (Because this is a blind review, you should not add the repository link during the review process.)

clarity,_quality,_novelty_and_reproducibility: The authors’ contributions look novel, and the writing is straightforward and understandable. There might be a few reproducibility issues.

summary_of_the_review: I consider the paper novel and valuable work. This paper contains novel insights into training robust classifiers. Especially the concept of complex-valued function as a classifier can provide further insights as it simultaneously encodes two geometric objects (the data manifold and the decision boundary). Though I could not check the whole proof, the suggested learning rule looks novel and interesting. The author also demonstrated that the proposed idea is also implementable and can be reduced to solving a PDE problem.
Regarding some negative factors, the paper contains some LaTeX problems, including missing references, and lacks details about the experimental setup, raising a reproducibility issue. However, I believe these are amendable issues, and I’m willing to raise the score after they are fixed.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This work provides a formal definition for robustness based on learning theoretical terms. Specifically, holomorphicity enables complexity analysis tool to investigate the phenomenon of adversarial examples. In addition, the analysis provides a geometrical interpretation for these phenomena.
strength_and_weaknesses: Strength:

It is novel to study the phenomenon of adversarial examples from the aspect of differentiable hypothesis, a new aspect as far as what I know.

Weakness and Questions:

1. The settings are a bit restricted: all theorems are based on binary classification. In addition, many theorems are based on support vector classifier (SVC), which is a linear model and much simpler from the ones used in practice.

2. Numerical results are not very strong: a simple MLP model on a single and simple dataset. The attack to evaluate the adversarial accuracy should be stronger than one-step black-box attack (Figure 3). Probably, more experiments are needed.

3. Presentation needs improvement (See the next section)
clarity,_quality,_novelty_and_reproducibility: Novelty: As far as what I know, it looks a good perspective to study adversarial examples.

Reproducibility: This work does not have too many experiments, the code is provided.

Clarify and Quality: I think the presentation of this work needs improvement.
  * There are some latex compilation errors such as "Section ??" in the manuscript.
  * It is better to provide the pseudo-code of the framework in the beginning of Section 5. This will make the readers better aware of the algorithms proposed.
  * Some necessary contexts are needed for some theorems. For example, in Theorem 4.1, the authors should clearly state how $f$ is obtained.
  * Notation is a bit complicated and hard to follow. For example, it is difficult to figure out what is "L with stroke" in Theorem 2.5. What do calligraphic letters $\mathcal{S}$ and $\mathcal{C}$ represent after definition 3.1. Probably, a notation table is necessary in the appendix.

summary_of_the_review: In general, I think this paper is not ready for publication because of the concerns above.

As I am not familiar with differentiable hypothesis, I welcome the authors clear my concerns and make me better understand the technical contribution of this paper during the discussion.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: The paper proposes a geometric and analytic modeling perspective for robust training. The idea is novel. But all the reviewers find the paper is not ready for publish. For example, there are many latex errors, many definitions and experimental details are missing. The paper should be carefully revised before publish.
Decision: Reject