Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: - The authors propose a new approach for the adversarial training of deep neural networks using their $A^2$ automated attacker. By using an efficient and stronger attack algorithm, the adversarial perturbations can result in more robust models trained using adversarial training. Their inner attack algorithm is inspired by AutoML and can select the attack parameters that generate the worst-case perturbations. The authors’ attack incurs a small increase in runtime compared to PGD.
strengths_and_weaknesses: Strengths

- A new attack type that can be used to improve the robustness of models defended using adversarial training. The attack increases runtime by 5-7%, a rather acceptable trade-off.
- The results and experiments show a consistent improvement over previous work in both attacking models and using $A^2$ for adversarial training.
- Included analyses and explanations of certain results (e.g., natural vs. adversarial accuracy trade-off).

Weaknesses

- Most results only indicate small improvements of less than 2 percentage points.
- It is unclear whether results from tables 2, 3, and 4 are also run and averaged 5 times.
- Various minor typos and grammar issues: is developed -> was developed, PDG -> PGD, such linearization attack -> attacks tend, becompatible -> be compatible, etc. I would recommend the authors perform a thorough proofreading check.
- No investigation of whether different datasets, classes, or samples actually require a significant amount of fine-tuning to find optimal attack parameters.

questions: - Are the results from tables 2, 3, and 4 also run 5 times and averaged as well? Can we be certain that the $A^2$ approach shows a consistent improvement over normal adversarial training (and were not cherry-picked results)?
- Did the authors investigate the efficacy of their $A^2$ adversarial training approach against transferable black box attacks?
- I’m curious how frequently each attacker parameter is selected. Is there a combination of attack types or step sizes which are clearly selected a vast majority of the time? If so, does $A^2$ provide a considerable improvement over just using this combination of attack parameters? Or are there classes or datasets that are more vulnerable to certain attack combinations?

limitations: - The main limitations of this work can be addressed with the following suggestions:
	- I would suggest the authors log the distribution of selected attack parameters for each dataset and class.
	- The authors should ensure that the the results presented in tables 2-5 are reproducible. Though, it is understandable these experiments were run only once, given the expensive runtime of adversarial training.
	- Emphasizing or explaining the significance of the relatively small performance improvements afforded by $A^2$
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper proposes a novel attack method that efficiently generates strong adversarial perturbations. Specifically, based on the idea of AutoML, the authors design an automated attacker $A^2$ that finds the best perturbation for each iteration. The main idea is to use an attention mechanism to score possible attacks in the attacker space, then sample the attack to perform based on the assigned scores. The authors challenge the problem of training attention mechanism via reparameterization trick. By training both the model parameter and the automated attacker, the authors propose an improved adversarial training method using $A^2$.

From a set of experiments, the paper answers three questions about $A^2$: the power of the attack method, its effect in adversarial training, and the robustness of $A^2$ training. The experimental results demonstrate that $A^2$ can increase the attack power and improve the adversarial training performance without too much overhead.

strengths_and_weaknesses: Originality: To the best of my knowledge, the paper contains novel ideas.

Quality: 

[[Strength]]
1. The construction looks sound, and the reparametrization trick seems reasonable to handle similar situations in model training.
2. The authors used various adversarial training methods, datasets, and attack methods for the adversarial training experiments, showing the proposed method's effectiveness.

[[Weakness]]
1. The authors can improve the experiment on the attack effectiveness by more comparisons to other attacks (other than PGD) such as CW and AutoAttack.

Clarity: The paper writing is clear, and there is no issue with the clarity of the paper.

Significance: 

[[Strength]]
1. The result on the attack effectiveness shows that we can save the number of iterations by adapting $A^2$ in adversarial example generation.
2. The experiments contain a practical overhead analysis for people adapting $A^2$ in practice. Considering the additional power of the attack, I believe the overhead is reasonably small.

questions: 1. This paper specifically uses $\nabla_{\mathbf{x}^{(k-1)}} l(f_\theta(\mathbf{x}^{(k-1)}, y)$ to produce a query. Is it a necessary choice, or is your design flexible enough to take other values as input? To provide more context, I’m considering a gradient-free version of $A^2$ and expect the same design to work with a different attacker space and a different type of query.
limitations: The authors discussed limitations and potential negative societal impact in the paper appropriately.
review_title: null

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: This paper presents a more efficient way for adversarial training – deciding attack algorithm parameter based on the idea of AutoML. In this framework, attack steps are split into step-wise cells, and the proposed method aims to predict the best parameter for each cell using attention mechanism. By fixing the parameters of each cell, the proposed framework degenrates into existing adversarial training method. The proposed method has been evaluated on three commonly used datasets: SVHN, CIFAR-10, CIFAR-100. Comprehensive experimental results demonstrate the effectiveness of the proposed method.
strengths_and_weaknesses: # Strengths

1. Traditional defense methods leverages multi-step PGD for creating adversarial examples to adversarially train a model. Such method is promising but poses very significant computational overhead. I've also gone through the pain of slow adversarial training. Hence, the motivation to create adversarial examples more effectively for training is valid and clear.

2. The proposed method is novel – introducing ideas of automl into the manual parameter tuning of attack algorithms for better results. Meanwhile, the method is clearly described and is not difficult to understand.

3. The proposed method is effective and clearly improves robust accuracy. Nowdays it's very hard to improve adversarial robustness on these standard benchmarks. Compared to the recent related works, the robustness improvement introduced by this method (such as Table 2) is already non-trivial.

4. The proposed method is compatible with other state-of-the-art defense methods like AT, TRADES, and AWP.

# Weaknesses

1. [important] Is the resulting adversarial perturbation clipped into the perturbation bound epsilon? The perturbation bound epsilont is reuiqred by Algorithm 1, but not explicitly used. Please clarify this and make it less confusing.

2. [minor suggestion.] It would be better to investigate wether the proposed method is still effective on larger scale datasets like ImageNet.
questions: My questions are listed in the weaknesses above. Generally this is a good paper and I did not find many questions.
limitations: By searching the keyword "limitation" I found no result in the submission, but I consider this a minor issue.
This paper focuses on defense side, and hence negative impact is not of concern.
review_title: null

Meta-review: metareview: Based on the idea of AutoML, this paper proposes an attack method that efficiently generates strong adversarial perturbations. The main idea is to use an attention mechanism to score possible attacks in the attacker space, then sample the attack to perform based on the assigned scores. The experimental results show that the proposed method can increase the attack power and improve the adversarial training performance without too much overhead. The reviewers suggest the authors to release code to help others reproduce the results.
confidence: Certain
Decision: Accept