Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper provides another viewpoint of investigating the robustness of DNNs. The motivation is that when a model is training, the decision boundary w.r.t. the model is dynamically changing over epoch time, so that the distance of training data points and the decision boundary varies. When the distance gets closer, that data point becomes vulnerable. Due to this motivation, the paper defines some functions such as “curve of the closest boundary point” and “speed of the decision boundary”, that are helpful to visualize the phenomenon of the dynamics of decision boundaries, and to alert which data point may not be safe. Moreover, this paper proposes a robust training algorithm, called Dynamics-Aware Robust Training (DyART), to encourage the decision boundary leaving away from vulnerable training data points. By combining the close-form for the gradient of smooth cost function of the margin, and the soft decision boundary, into the loss function, DyART can be trained efficiently, and can take both clean and robust accuracies into account.
strength_and_weaknesses: Strength:
1. The motivation is interesting and heuristic, pointing out the remaining shortcomings of adversarial training.
2. The idea is simple and clear, for mitigating the concerning robustness issue.
3. The presented experimental result outperforms previous works (2021 or ealier) in similar area.

Weaknesses:
1. Almost every individual idea is too intuitive, so that none of them is groundbreaking or novel.
2. A few experimental results shown. Maybe try some large-scale multiclass dataset like ImageNet.
3. Some sentential expression is not very clear: at the end of 2nd/3rd paragraph of Section 2, the conclusions are likely the same.
clarity,_quality,_novelty_and_reproducibility: Clarity: Good.

Quality: Good.

Novelty: Ordinary.

Reproducibility: No comment.
summary_of_the_review: Overall, I think that this is a good paper. It starts from the nature of dynamics of decision boundary, pointing out some shortcomings of existing robust model. Then, it proposes a training algorithm, called DyART, to mitigate such issue. With some experimental results, DyART is verified to be an effective robust model.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: This work presents a new robust training approach by pushing the nearby soft boundaries away for points that are closer to the boundaries. The motivation of the paper is an observation that some points are not pushed away from the boundary in the existing PGD training; therefore, it is straightforward to design an algorithm that is aware of the decision boundary. The authors test their method on CIFAR-10 and Tiny-ImageNet to show the effectiveness of the work.

strength_and_weaknesses: ### Strength

**Presentation.** The presentation of the paper is very clear and easy to follow. Thank you for the writing. 

**Motivation.** This paper is well-motivated. The problem of pushing decision boundaries away from points that are hard to produce robust predictions has existed for a long time. The proposed solution is very intuitive and the key message is easy to grasp (thanks to the clear writing). 

**Theoretical Contributions.** Theorems characterizing the boundary speed and soft boundaries are important contributions. These are very interesting results and measurements, potentially can be used by future researchers for similar topics. 

### Weakness
My biggest concern of this work is the empirical evaluation of the paper. I also have some minor concerns regarding the novelty of the work (I will elaborate this in the next review box). 

Firstly, my biggest concern on the empirical results is simply that the baseline robust accuracy on CIFAR-10 (i.e. AT) is too low for a new method proposed in 2022. Although the improvement of the robust accuracy compared against the baseline numbers still show the new method is effective, they are still outside the ballpark of the state-of-the-art numbers. For example, on the benchmark page (https://robustbench.github.io/), the top-15 entries on CIFAR-10(linf, 8/255) have robust accuracy higher than 60% while all methods reported in this paper are below 50%. Even though I don’t think a paper has to outperform the state-of-the-art results to get accepted (and personally I am very enjoying reading and studying the solution proposed in this paper), empirical results at least within the ballpark will make the experiments stronger. I think the same problem happens to the Tiny-ImageNet results. 

Secondly, there are a few hyper-parameters in the proposed method. It would be nice to have some sensitivity experiments to tell how the results are affected by these parameters and what are the recommended numbers for any follow-up work to use. 

clarity,_quality,_novelty_and_reproducibility: 
### Clarity 
I have no problem regarding the clarity of the paper. It is well-written. 


### Quality
The theoretical parts are sound; however, the empirical part can be improved to be stronger. 


### Novelty
Firstly, I think the observation of the sign of boundary speed and the weighting function $h$ to balance large and small margins are novel contributions. However, the idea to  design an algorithm that pushes boundaries away is in fact pretty common. As a result, the paper may have not given enough credits to the existing work and form a detailed discussion. For example, the robust loss in TRADES is in fact a way to push boundaries away and the KL-divergence between clean and adversarial logits is roughly a way to penalize more on points that are closer to the boundary. I think this can be an explanation why TRADES results are so close to the new method in Table 1. Can the authors also provide the boundary speed comparison between TRADES and DyART? I wonder how much better DyART improves on pushing nearby boundaries away compared to TRADES. Moreover, this work [1] directly pushes the nearby hard boundaries away. Although the focus of [1] is certifiable robustness instead of the empirical one, it should at least be discussed in the paper. 


[1] Croce, Francesco et al. “Provable Robustness of ReLU networks via Maximization of Linear Regions.” AISTATS (2019).



### Responsibility 
A statement on where to find ways to reproduce the experiment can better improve the reproducibility of the work. 

summary_of_the_review: 

In summary, I am currently on the fence. I like the theoretical part of the paper but the empirical part is not that convincing to me. I will vote for a weak accept for now but may be happy to raise if my concerns are resolved.
review_title: null

final_score: rating: 10: strong accept, should be highlighted at the conference
review_content: summary_of_the_paper: This paper proposes DyART: a new regularization method that encourages that the decision boundaries of a neural network move away from the data points with the smallest marginss during training. This regularizer is motivated by the observation that during adversarial training, the distance to the decision boundary does not grow uniformly for all data points, and instead decreases for a large portion of the training set. To alleviate this issue, the authors derive a closed-form expression for the margin velocity around a given data point that can be tractably regularized during training. In two datasets (CIFAR10 and TinyImageNet), DyART outperdorms can achieve stronger robustnesss than SOTA methods based on adversarial training, despite being based on a conceptually very different approach.
strength_and_weaknesses: # Strengths
1. **A fresh and effective idea**: There are thousands of papers on adversarial robustness, all of them trying to improve the robustness of neural networks in different ways. However, among the empirical defenses, only adversarial training and its variants have managed to stand the test of time. This paper tries to tackle the same problem, using a very different approach (regularizing the exact distance to the boundary), which seems to be very effective. 
2. **Brilliant derivations**: The derived mathematical expressions on the movement of the decision boundary are absolutely brilliant and very noteworthy. Above all, the main value of this paper does not lie on their idea to obtain robustness, but the fact that the authors could manage to execute it by cleverly and elegantly deriving tractable expressions to track the movement of the decision boundary. The main theorems of the paper do not require advanced math to be proved, and are very intuitive. This is a very strong point.
3. **Very competitive robustness numbers and a correct evaluation**: The reported results are competitive with other methods and the authors seem to have followed the right protocols to evaluate the robustness of their models.
4. **Clean writing**: The paper is very well-written and it is easy to read. The storyline flows nicely, and the theoretical bits, including the proofs, are easy to follow.

# Weaknesses

1. **Lack of ablations on new method**: I find the paper would be stronger if, besides reporting best performances on two datasets, it also described how different hyperparameters affect the performance and dynamics of their proposed method. How do $\alpha, \lambda, r_{0}$ affect performance? And the burn-in period? Knowing the effect of these parameters and the sensitivity of the method to their exact values is fundamental for its wide adoption. It would also be nice to provide runtime numbers of DyART and compare them to the competing methods.
2. **(Minor) Missing relevant citations**: In general, I find the paper is missing citations to a few relevant works that also have studied the dynamics of the margins of adversarial training or been inspired by them to improve the performance of robust models:
   - R. Rade, S. Moosavi-Dezfooli. Reducing excessive to achieve a better accuracy vs. robustness tradeoff. ICLR 2022   
   - G. Ortiz-Jimenez, A. Modas, S. Moosavi-Dezfooli, P. Frossard. Hold me tight! Influence of discriminative features on deep network boundaries. NeurIPS 2020.
   - F. Tramèr, J. B., Nicholas Carlini, N. Papernot, J. Jacobsen. Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations. ICML 2020

3. **(Minor) Figure 3 and Figure 5 could be improved**. Although informative, I find the design of this two plots a bit suboptimal. In Fig. 3, instead of showing just a snapshot of the margin-speed distributions, it would be more interesting, in my opinion to show how this distribution evolves with training. One option to do that is to show the statistic described in the caption through time (i.e., what is the proportion of points with negative speed below a given margin at step t). The problem with Fig. 5, on the other hand, is that the graph is a bit confusing. What is the meaning of the bar heights, and why is it the same for AT and DyART?

clarity,_quality,_novelty_and_reproducibility: - **Clarity**: The paper is very clearly written. The proofs of the main theorems are also easy to follow.
- **Quality**: The paper has a high technical quality. The mathematical derivations are elegant, and the robustness evaluation follows the right protocols established by prior art.
- **Novelty**: As far as I know, the ideas and results in this paper are novel. A few citations could be included to a few papers that discuss similar topics.
- **Reproducibility**: The main results of this work are probably reproducible. Howevere, a few extra ablation studies would simplify the adoption of DyART as a robustness method.
summary_of_the_review: Overall, I believe this paper clearly deserves to be accepted to ICLR. It brings forward a novel idea based on interesting insights and provides useful mathematical derivations for the community. The empirical results also seem to indicate that DyART could be a strong contender for the SOTA in adversarial robustness.

If the ablation studies mention in the **weaknesses** section of my review were included in the paper, I would be open to increase my score even further.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper aims to improve the adversarial robustness of deep models.      
I. The authors observe that during traditional adversarial training, margins to the decision boundary for some examples are enlarged while margins to the decision boundary for other examples even become smaller.     
II. Based on this phenomenon, the paper proposes dynamic-aware robust training,  giving high priority to examples suffering from smaller margins.   
III. Experiments on CIFAR-10 and Tiny-ImageNet show some improvements over baselines.   
strength_and_weaknesses: Strength:     
(1) The paper give sound theoretical analysis.
(2) The insight of giving high priority to examples with smaller margins is interesting.    

Weakness:      
(1) This paper identified the phenomenon that during adversarial training, the decision boundary moves away from some vulnerable points but simultaneously moves closer to others, decreasing their margins. However, it is well-known that adversarial training suffers from the overfitting issue, i.e., adversarial examples in training can be well classified in the late training stage. So, does the identified phenomenon only exists in the early adversarial training stage?   
(2) Experimental setting is not consistent with previous work, e.g., TRADES uses wideresnet34-10 and achieves 53.08% while wideresnet28-10 is adopted and only reports 49.3% in this paper.     
(3) Comparisons with state-of-the-art methods are missed, like AWP[1], and LBGAT[2].       
(4)  Experiments on CIFAR-100 should be included to verify consistent improvements of the proposed method.       

[1] Adversarial Weight Perturbation Helps Robust Generalization. NeurIPS 2020.     
[2] Learnable Boundary Guided Adversarial Training. ICCV 2021.


clarity,_quality,_novelty_and_reproducibility: Code is not provided.
summary_of_the_review: This paper aims to improve model adversarial robustness with a dynamic-aware robust training strategy. However, the inconsistent experimental setting and lack of comparisons with state-of-the-art methods make it unconvinced.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper first proposes a continuous-time framework for quantifying the speed of decision boundary changes and empirically shows conflicting dynamics in adversarial training: the decision boundary moves closer to some examples even if the model just learns these examples. This paper proposes a novel adversarial training method, DyART, aiming to increase margins to alleviate the conflicting dynamics. By evaluating DyART on CIFAR10 and Tiny-Imagenet datasets, this paper shows that the proposed method performs better.
strength_and_weaknesses: Strength:

+ This paper shows that there are conflicting dynamics in adversarial training. It is interesting to know that the decision boundary of some examples becomes even worse after training.
+ This paper proposes a novel adversarial training method, DyART, which has a novel loss to alleviate the conflicting dynamics.
+ By evaluating on CIFAR10 and Tiny ImageNet, the proposed method outperforms other methods.
+ The paper is well-written and easy to follow.

Weakness & Questions:

- In Section 4.1, this paper studies how boundary changes by evaluating CIFAR10 models. The decision boundary speed is evaluated by training an additional iteration on pretrained models. For this experiment, I am not quite clear about some settings: 

1. Why do you use a pretrained model to calculate the dynamics? Why don’t train a model from scratch and observe the dynamics?
2. The dynamics are only calculated for one batch and one iteration, which makes it more like a case study or qualitative analysis. Why don’t you collect the dynamic across the whole training process and analyze the speed at different epochs? Maybe this conflict only happens at the beginning of the training and will be stable later.
3. I don’t get the reason behind replacing BN with GN, which may indicate that the proposed method to evaluate the decision boundary speed is not general enough.
 
- In Section 6.1, I notice that a validation set is used to mitigate the robust overfitting. How often do you calculate the validation accuracy, and do you apply the same thing on other baseline methods to mitigate robust overfitting? 

- Although the proposed method outperforms selected baseline methods, there are other state-of-the-art (SOTA) methods reported to have better performance than selected baseline methods in https://robustbench.github.io/. What is the advantage of the proposed method compared to other more recent SOTA adversarial training methods?
clarity,_quality,_novelty_and_reproducibility: The writing of this paper is good and easy to follow, but some places may need further clarification. The study on decision boundary dynamics is novel and interesting. However, for the adversarial training part, there is a lack of comparison or discussion on some recent adversarial training papers.
summary_of_the_review: I thoroughly enjoy reading this paper, but I think that there needs more clarification. One concern is comparisons to some recent related works on adversarial training are missing.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: Inspired by the observation that the robustness of a deep neural network in the classification task can be characterized by its margins, i.e., the decision boundary's distances to natural data points and the fact that it is still unclear whether the existing robust training methods effectively increase the margin for each vulnerable point during training, the authors studied a continuous-time framework for quantifying the relative speed of the decision boundary with respect to each individual point. 
Based on further visualizing the moving speed of the decision boundary under Adversarial Training, a moving-behavior is revealed in that the decision boundary moves away from some vulnerable points but simultaneously moves closer to others, decreasing their margins.
To alleviate these conflicting dynamics of the decision boundary, the authors proposed Dynamics-aware Robust Training (DyART) with preliminary results conducted on Cifar-10 and Tiny-ImageNet.
The authors claimed that the proposed method is orthogonal to the exosting works; robustness can boosted without using additional training data.

Basically, all reviewers agree that this paper is well-motivated with somewhat intuitive/simple ideas, all the concerns have been properly addressed, and all reviewers give positive comments and higher scores.

Since the reviewers reach a consistent consensus in appreciating the contributions of this paper, the AC makes a decision of ``accept''. 



justification_for_why_not_higher_score: Although this paper presents a simple but interesting idea in adversarial robustness, the adversarial accuracy is not significantly higher than those of SOTAs.
justification_for_why_not_lower_score: This paper contributes to study the dynamics of decision bounrady to realize adversarial robustness.
Basically, all reviewers agree that this paper is well-motivated with somewhat intuitive/simple ideas, all the concerns have been properly addressed, and all reviewers give positive comments and higher scores.
Decision: Accept: poster