Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper proposes a defense method based on Modeling Adversarial Noise. The authors introduce an additional transition network to capture the transition matrix from adversarial predictions to vanilla predictions. The final output is the rectified prediction using this transition matrix. The proposed method is novel to me and is empirically validated by the authors under several adaptive attacks.

main_review: Strengths
1.	Overall speaking the paper is well written and the method is clearly presented.
2.	The proposed approach seems novel to me. The method is empirically validated by using several attack methods that not only attack the classifier but also the transition network as well.

Weaknesses
1.	I am not fully convinced by the motivation. I would like to see supports on the claim that data pre-processing based methods suffer from high dimensionality problem and addressing the dimensionality problem in modeling adversarial noise is good for robustness. In addition, supposed that modeling perturbations in low-dimensional space is beneficial, it is still not clear that the proposed low-dimensional transition matrix actually models the adversarial noise. It would be helpful if the authors can address these concerns.
2.	It seems like the proposed transition network works as a kind of post-processing. Instead of parameterizing $p(y|x)$ using a neural network $f(x)$, the proposed method parameterizes $p(y|x)$ using $g_{\omega}(x, h_{\theta}(x))$. Following this lens, why cannot we take $g_{\omega}(x, h_{\theta}(x))$ as a whole and expect a single function $f(x)$ to learn and perform as the same? Please kindly elaborate if I am mistaken.
3.	In experiments, the comparison with SOTAs may not be fair. Does the method improve robustness merely because it uses a more complicated neural network architecture with more capacity (as it introduces an additional network $g_{\omega}$ )? It would be great if the authors can align the number of network parameters used by each method in the comparison.

Other questions: How does the proposed method perform combined with TRADES[1]? 

[1] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML, 2019.

summary_of_the_review: Given the points listed, I give the current rating here. It would be helpful if the questions listed can be addressed.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper proposes to learn a transition relationship between adversarial labels and natural labels for achieving adversarial defense. Especially, the authors introduced an instance-dependent transition matrix, which can be seamlessly embedded with the target model, to relate the adversarial labels and natural labels. Experiments on CIFAR and tiny-ImageNet demonstrate the proposed defense framework can outperform normal adversarial training.
main_review: Strengths:
1. The defense strategy that embedding an instance-dependent transition matrix into the target model is novel.
2. The experiments show that the performance of the proposed framework is better than normal adversarial training (AT).

Weakness:
1. The authors claim that the proposed framework can be viewed as adversarial training and the transition matrix can be embedded into the target model. Thus, the authors should conduct experiments by embedding the transition matrix into current adversarial training strategies, e.g., [a,b]. Such experiments are necessary to demonstrate the effectiveness of the proposed method, and should not be viewed as the future work.
[a] Zhang, Hongyang, et al. "Theoretically principled trade-off between robustness and accuracy." International Conference on Machine Learning. PMLR, 2019.
[b] Zheng, Yaowei, Richong Zhang, and Yongyi Mao. "Regularizing neural networks via adversarial model perturbation." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2021.

2. Experiments in Table 1 and 2 should also be conducted with other network structures besides ResNet18.

3. The trained model with MAN will lose the performance on the clean samples without perturbations. Especially, the distance is obvious for tiny-ImageNet as shown in Table5. This lead me to doubt the effectiveness of MAN.

4. The size of transition matrix will increase a lot with the increase of class number. Thus, this method would cause greater cost for the dataset with larger class number, e.g., ImageNet.

5. Why the training epoch is different for MAN and the baseline (150 vs 100)?

summary_of_the_review: Although the proposed method is novel by embedding a transition matrix to the target model, there are several concerns: 
1) the experiments with more kinds of AT baselines, 

2) the decrease of performance on clean samples, 

3) the applicability of the proposed method for the dataset with large class number, 

4) the comparison fairness.

Thus, I think this paper is not enough for publication until these concerns are solved.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper proposes an adversarial defense method MAN by learning an instance-dependent transition matrix exploiting the transition relationship of adversarial labels and natural labels.  MAN generates the transition matrix by training a parameterized deep neural network which takes the mixture data (adversarial and natural data) as input and outputs the instance-dependent transition matrix. During inference, we can infer the natural labels with the adversarial labels and the transition matrix.  The authors evaluate MAN under three adaptive attacks scenarios and show the improved adversarial accuracy with the proposed method. 
main_review: Strengths: 
1. In the experiments part, the authors clearly evaluate the robustness of the models under three adaptive attack scenarios and the empirical results are technically convincing.

Weaknesses: 
1. The idea of using the transition matrix seems to come from the widely used methodology in noisy label learning. The authors should discuss those literatures in the related work and compare the difference between the proposed method and those methods. Otherwise, the novelty of the paper can not be well justified.   
2. In Section 3.2, the use of mathematical symbols is a bit confusing, and there are situations where symbols are not defined. For example, the sentence $Y'$  denotes the variable for the natural label, and $Y$ denotes the variable for the natural labels” is confusing. The symbols such as $\widetilde{x_i}$, $\widetilde{y_i}$ are not defined. The authors should well organize this part. 
3. For the robustness evaluation, In Table 1, the comparison with only AT is not enough. The transition matrix can be a general module combined with more adversarial training methods such as Trades, MART or ect. to conduct more experiments to benchmark the robustness improvement with different adversarial training methods. 
4. For  the experiments in Defense transferability, can the authors provide more results against adaptive attacks? Can the transferability exist under the stronger adaptive attacks?
5. For the effectiveness of the transition matrix, I am concerned with the generalization of the learned transition matrix. From the results in Table 1, we can observe that the improvement of the adversarial accuracy is diverse under different attacks, the improvement under AA is just 0.3 and under TI-DIM is 1.76 which is smaller than 2.46 under PGD40 (the test attack is the same with training attack). 



summary_of_the_review: 
Overall, from my point of view, I think the novelty of the methodology and experiments evaluation of the paper in current form is not enough. I suggest rejection.
review_title: null

Meta-review: This paper aims to model adversarial noise by learning the transition relationship between adversarial labels and natural labels. In particular, an instance-dependent transition matrix to relate adversarial labels and natural labels. Reviewers agreed that the paper is well motivated and well written, and the proposed method is novel. Meanwhile, reviewers raised some concerns about experiments and paper presentation. During discussion, the authors provided a lot of additional results that partially addressed the reviewers' concerns. However, the reviewers still think the experimental part of this paper should be further strengthened before acceptance. 

Thus, I recommend to reject this paper. I encourage the authors to take the review feedback into account and submit a future version to another venue.
Decision: Reject