Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: The paper proposes Discrete Adversarial Training (DAT) strategy for vision tasks that avoids continuous-Lp based perturbations and encourages adversarial examples generated through image discretization using VQGAN. Authors derive the motivation for using image discretization from the observation of improved generalization via discrete adversarial training in NLP tasks. Adversarial examples generated using this discretization process are used for training different architectures for different downstream tasks. Unlike traditional adversarial training (AT), DAT shown to improve network generalization across different tasks, different distribution shifts and also improve adversarial robustness. Major improvements are noticed in image classification task and minimal or comparable performance seen on object detection and semantic segmentation tasks.
strengths_and_weaknesses:  Strengths:
1)	Well written paper. Easy to understand.
2)	Motivation is explained clearly.
3)	Major strength lies in the extensive experimental evaluation.
4)	Shown improvements of network generalization across different ImageNet distribution shift datasets and higher adversarial robustness on both ResNet50 and ViT.
5)	Conducted ablation studies to understand the effect of different components.

Weakness:
Different assumptions are made to ease the computation of gradients, backpropagation through VQGAN to generate adversarial examples. No theoretical details are shown to support the assumptions and approximations are made through heuristics.

questions: In line 148, it is mentioned that “We delete the constraint term since there is no need to bound the per-pixel values of \delta”. Would you elaborate on why this constraint is not needed?

In line 157, authors mention “as proposed in previous work, a straight-through gradient estimator can be used by copying the gradients from v_q to v”. Which previous work is referred here? Would you provide justification how the gradients can be estimated and copied from v_q to v? 

Similarly a straight-through gradient estimator was used between Q(x) and x. How does this hold in practice (not in ideal setting) ?

In line 179, it is mentioned that  “x + \delta is discretized by VQGAN again and acts as the adversarial input”. Do authors cross check that these adversarial inputs generated by VQGAN still mislead the classifier F?

limitations: Authors have not discussed about their limitations. I find no potential negative impact from this work. The method requires heavily parameterized VQGAN to train different networks. This imposes heavy computation time and budget during the training process.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper proposes discrete adversarial training to boost the performance on representation learning. Extensive results on image classification, object detection and self-supervised learning validate the effectiveness.
strengths_and_weaknesses: ## Strengths:

The presentation is clear and extensive experimental results are convincing.

## Weaknesses:

1. My biggest concern is why discrete representation helps?

2. DrVit is very similar except for inner optimization and quantization training. DrVit is training VQVAE from scratch. Will that become unfair comparison? For example, you are using different data for training or pretraining. Could you provide the results if the proposed method is also trained from scratch using the same dataset, loss and architecture? Or DrVit is also using VQGAN

3. In Table 1, why the winner between DrVit and AugReg-Vit keeps changing on different metrics?


questions: See above.
limitations: n/a
review_title: null

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: The paper proposes a discrete adversarial training strategy to alleviate the robustness-generalization trade-off in vision tasks.  Motivated from the adversarial training used in NLP models, the authors claim that a discrete representation of the image space will aid in more robust models without much drop in generalization. The method utilizes a VQGAN model to generate discrete adversarial samples for adversarial training. The authors show that the adversarial training strategy enhances the performances of various vision tasks such as classification, object detection and self-supervised learning. 
strengths_and_weaknesses: + Originality -  The idea to use discrete adversarial samples to enhance the performance of vision tasks seems novel/interesting. 

+ Clarity -  The paper is well written and can be easily understood. 

- Clarity -  I felt some of the experimental details are missing. For example, the implementation details of the adversarial  robustness experiments  - FGSM and Damagenet. There are some typos which needs to be proofread.

- Quality - The paper lacks theoretical intuition and the experimental section needs more stronger baselines for robustness tasks.  For example the intuition that the straight-through gradient computation and backpropagation canjust be skipped seems very odd to me. At least some empirical evidence (comparison of the adversarial examples that are actually computed by backpropagation) should be reported. 

- Significance - It is difficult to analyze the superiority of the method in adversarial robustness since the robustness experiments is missing baselines from RobustBench. However, number for much smaller epsilons than the ones usually evaluated in robustBench indicate that the method strongly underperforms in this respect. 
- Without error bars, it is unclear how significant the results are.


After the rebuttal and extentive discussion, I see that the proposed approach might have potential w.r.t. model generalization. My orignial argument w.r.t. adversarial robustness holds, but I am willing to increase my score based on the presented results. 
questions: - Please report robust accuracy values for epsilon = 4/255 on ImageNet and L_inf for AutoAttack.

- I understand that error bars on ImageNet are not possible - but for CIFAR, that would be easier - and allow for a comparison to more SotA methods on RobustBench. For CIFAR, the epsilon for the comparison should be 8/255 for L_inf on AutoAttack.




limitations: The authors already mention the limitations of the proposed method – the computational cost and lack of theoretical intuition. Although there are some empirical intuitions provided in the paper (fig 2), the missing error bars in all experiments make the empirical findings less convincing.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper studies the problem of adversarial training for vision tasks by borrowing ideas from NLP.  A new method called "DAT" (Discrete Adversarial Training) is proposed.  DAT uses a VQA-GAN encoder to convert images into discrete tokens, by learning a vocabulary of words (aka image codebook).  Adversarial perturbations are applied on these tokens.  Performance is reported on:
1. 6 versions of Imagenet for evaluating robustness (Imagenet-A/C/V2/R/ Stylized/Sketch)
2. against adversarial attacks (FGSM, DamageNet)
3. COCO-C for object detection
strengths_and_weaknesses: ## Strengths
1. The motivation of the paper comes from an informed perspective of both vision and NLP literature on AT, and I like the fact that the phenomenon from NLP of AT improving both robustness and clean accuracy is used as a goal for AT in vision.  This exchange of ideas often leads to improvements across various application domains of machine learning.  
2. Performance is evaluated extensively and reported 
    - 3 benchmarks (classification, detection, self-supervised image classification) 
    - multiple architectures
3. The paper is well written, especially the methods section.  I have a few questions about the method though (see below)

## Weaknesses
1. One major weakness is that previous work on adversarial training has been used for improving domain generalization (see my question1).  However, experiments have not been performed in this paper on DG benchmarks.
2. The methods section has some assumptions (see Q 3 and 4) -- these assumptions are not clearly justified (either theoretically or intuitively).  More study along these assumptions is needed.  
3. The effect of discrete perturbations is not discussed.  In pixel-wise AT, the perturbation leads to noisy images.  But that need not be true for DAT -- a comparison should be included, perhaps in terms of photorealism comparison between "real" images and perturbed images.  
questions: ## Questions 
Adversarial training has also been used in image classification literature for domain generalization:  see (GUD: Volpi et al NeurIPS 2018 https://arxiv.org/abs/1805.12018, MADA: Qiao et al. CVPR 2019 https://arxiv.org/abs/2003.13216, ME-ADA: Zhao et al. NeurIPS 2020 https://arxiv.org/abs/2010.08001). This leads me to two questions:
1. How does DAT perform on domain generalization benchmarks such as Digits, PACS, OfficeHome etc.?
2. On the imagenet benchmarks presented in this paper, how does DAT compare with GUD, MADA? (if some of the baselines that you have used have been shown to be better than GUD, MADA -- please let me know which paper).

3. Line 148: `We delete the constraint term since there is no need to bound the per-pixel values of $\delta$` -- what are the effects on the performance if the perturbation is bounded? is it better / worse in general? Is is better for some eval datasets but worse for others?
4. Line 166: `Since xˆ ≃ x established for an ideal discretizer Q` -- this connects to my question-3:  does the magnitude of the perturbation affect this assumption? Will a large perturbation make this assumption false?
5. Line 184: `Previous work has pointed out that the underlying distributions of adversarial examples are different from clean images.` -- which paper? please cite.

## Suggestions (about References, Structure, Grammar, etc.)
1. References:  you may also add references to "vision-like" AT that have been explored in NLP.  You have mentioned one of them (FreeLB). Another one is:
    - https://arxiv.org/abs/2006.06195 (NeurIPS 2020) -- here "VILLA" perturbs encoded features (of images and/or text) encoded by pretrained V&L model.  In that sense, it is similar to perturbing the VQGAN encoding of images (DAT) is similar to VILLA, but DAT perturbs in the symbolic codebook space.
2. References:  other forms of adversarial training (beyond pixel-wise perturbations) have been explored for vision tasks:
    - https://arxiv.org/abs/2012.01806 (AAAI 2021) -- "AGAT" is an adversarial training pipeline which starts with a given knowledge of symbolic attributes of images, and then perturbs images along those attributes.  A comparison should be made between DAT and AGAT: in my view DAT indirectly uses the symbolic knowledge from VQGAN encoder, whereas AGAT assumes that such symbols/attributes will be given.
3. Typo: Fig 4 caption:  last word should be "attackers".
4. Fig 3 caption: please mention in words what $\alpha$ is (step size/magnitude of adversarial update).
5. Fig 2: please label the x-axis
6. Line 201: `Using robustness`:  please rephrase this to `using "robustness" library` since robustness is a standard ML term, so people might get confused.
limitations: Limitations are not discussed clearly.  Please add a section in/after conclusion to discuss them.  Especially about the assumptions in the method.
review_title: null

Meta-review: metareview: This paper proposes a discrete adversarial training scheme for improving the robustness of vision models. Reviewers find the paper is well written, the proposed idea seems to be novel/interesting, and the approach leads to improved empirical performance. This work may also inspire new approaches for improving both robustness as well as generalization together. Therefore, I recommend accepting the paper, while also encourage the authors to address the remaining issues pointed out by the reviewers.

confidence: Certain
Decision: Accept