Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 5: Marginally below the acceptance threshold
review_content: summary: This paper investigates the relationship between calibration and adversarial robustness, showing that calibration error is larger among less robust images. Based on this, a training procedure is proposed where the labels of the images are smoothed based on the robustness level, to produce a better calibrated model. 

The proposed method is evaluated on CIFAR-10/CIFAR-100, and their corrupted counterparts, comparing with other calibration and label smoothing approaches, as well as ensemble methods.
main_review: This paper studies an interesting idea: how the less robust images are also responsible for higher calibration error. The idea of ranking the images based on their robustness and exploit the less-robust images to improve calibration is worth investigating. 
However there are many issues with the paper in its current version, as listed next:

1. Until the last page of the paper, it was not clear if the robustness levels are pre-computed or update during training. This should be made clear earlier. Considering the "on-the-fly" computation, how does it change over the epochs? Do the images migrate from one level to another? Does the perturbation norm associated with each level change over the epochs? And by how much?
2. How does the proposed methods AdaLS/AR-AdaLS affect the accuracy? In particular, for the comparison with the other approaches in Table 2, it would be useful to compare the accuracy as well, or clearly indicate that there's no significant change in accuracy, if that's the case.
3. Although the authors indicate in the checklist that they present error bars in the plots, none of the plots or tables in the main paper have error bars or standard deviations, even though it is claimed in the paper that results come from 5 independent runs (also, multiple runs with distinct data splits would be more informative than relying on random initialization).
4. Due to the lack of error bars/deviation measurements, it is hard to interpret the significance of the results. For example, in Table 2, Mixup or the ensemble methods have similar or better calibration for CIFAR-100. AR-AdaLS is better only for CIFAR-10 and by a margin of 0.2, which is hard to assess if it is significant.
5. The units used for ECE are inconsistent throughout the paper. In Figures 1 and 2, ECE values are decimals (range from 0 to 1), while in Tables 2, 3, 5 and Figure 4 it is measured in percentages (from 0 to 100).
6. For OOD experiments: CIFAR-10 and CIFAR-100 are derived from the same original dataset and have similar classes. It would be more meaningful to compare with more distinct datasets such as SVHN, LSUN or STL-10.
7. For Figure 3, it could be improved by showing the entropy in-distribution as well. The current figure shows that AR-AdaLS increases entropy OOD, but it's not clear how it affects the in-distribution entropy. 
8. Another useful OOD analysis would be to have the ROC plot (or measure AUCROC) for the detection of images in/out of distribution.
9. Notation is a bit confusing or unclear: it is never described if $\tilde{p}_r$ is a vector or a function, or if it is distinct for each example.The $z$ in the superscript is never defined in the text. In the Algorithm, the epoch index should be updated for $t+1$ in the appropriate places in the for loop.

Overall, the paper investigates an interesting idea, but, from the results presented, did not convince me that the proposed method is better than the competing baselines.
limitations_and_societal_impact: The paper does not discuss limitations or potential negative societal impact of their work. This could be improved by identifying the underlying assumptions (e.g. measuring robustness with CW attack) of the model and where they fall short. Or identifying cases of failure and what is their impact.
review_title: null

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: The authors first expose a link between robustness and expected calibration error (ECE), the less robust a data point is, the larger the ECE. They then propose to exploit this link by introducing an adaptive label smoothing method that improves the expected calibration error of less robust data points. They benchmark their new method showing better calibration metrics on standard datasets, as well on corrupted datasets and out-of-distribution data. 
main_review: The authors show that their adaptive label smoothing improves upon standard label smoothing. They also show how the adaptive label smoothing can further be improved by splitting the data into several adversarial robustness bins. However, I have several concerns/questions.


1. Mixup and other baselines. From Tab. 2 we see that Mixup outperforms the proposed method on CIFAR-100, whereas on CIFAR-10 Mixup is competitive to the proposed method.
However, in the rest of the paper, the authors do not show results with Mixup. Also, additional baselines are missing in the evaluation on corrupted datasets and out-of-distribution data, which prevents the reader from entirely assessing the proposed method.  
In my opinion, such benchmarks, and ideally both with mixup and with competitive methods to mixup, are necessary to indeed convey the message that the proposed method works well relative to existing methods.

2. While the authors use CIFAR-100 and ImageNet in Fig. 1 to show the correlation between confidence and adversarial robustness, most of the results that follow focus solely on CIFAR-10. Could the authors show the results on CIFAR-100 and ImageNet (e.g. in Fig.2)? In my opinion, such results are necessary to indeed conclude that the performance gains hold across datasets.

3. As the x-axis in Fig.1 is not a hyperparameter or one value that you can change to obtain the y-value, I assume you run multiple experiments to get the curves. Could you also report the standard deviation of the curves, or if that is problematic, maybe a scatter plot?


4. As a minor comment, I think the authors should be more precise when referring to "classifier confidence", and should *not* be mixed with "uncertainty estimation". While I think it is common to mix the two, uncertainty estimation goes beyond the former, as it requires statistical tools to estimate the epistemic and aleatoric uncertainty of the model (for example, population of models). From line 121, I think the authors should use "classifier confidence" where needed (e.g. caption in Fig. 1).


5. Regarding the writing, while I did not include it in my evaluation, I think the authors could improve it in terms of simplifying the sentences, as (in my opinion) some sentences are ambiguous and overloaded, making the manuscript harder to read. For example the sentences in lines 3, 29 can be simplified, and some terms such as "unrobust data", "attackable data" could be made more precise as these depend on the classifier and not solely the data points (e.g. data points whose perturbations fool the classifier into wrong predictions).



--- Minor ---

In figure 1, consider mentioning what variance is referring to.

line 133: as -> with the

line 139: data -> datapoints

inconsistent spacing between lines 157 and 158

--- Recommendation --- 

I encourage the authors to benchmark their method against existing methods on corrupted and out-of-distribution datasets. I would be happy to raise my score if the authors could demonstrate that their method is on par with other baselines on those benchmarks. 

--- Post-discussion update --- 

The authors addressed most of my concerns, thus I increase my score.
limitations_and_societal_impact: The limitations are not addressed.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: 1) This paper points out a novel finding: Examples that can be adversarially attacked may also be calibrated worse.
2) The author utilize the above finding to design the AR-AdaLS to enhance calibration. 
main_review: Generally speaking, I am satisfied with the topic and the method proposed in this work. In these two years, adversarial robustness has been found to be related to many other concurrent fields: Outlier Detection[1], Domain Adaption[2], Data Augmentation[3] etc. According to my knowledge, this is the first work that points out the relationship between adversarial robustness and calibration. Therefore, I think this can complement the current study about the concept of the general robustness. The proposed method is reasonable and consistent with the finding. The experimental setup aligns with common choices in other works. In particular, I consider this work as a good extension for [4]. However, I still have a few concerns:
1) Although I do think the observation that "Examples that can be adversarially attacked may also be calibrated worse" is reasonable, I find that in this paper the authors did not provide sufficient information to properly explain this phenomena. Section 3 are basically composed of empirical findings and lack of analyses. I hope the authors can offer more insights in the rebuttal phase and perhaps provide evidences from other works, or maybe explain the phenomena based on the framework of [4].
2) In Table 3, the author combine the proposed AR-AdaLS with ensemble based method. Can AR-AdaLS be combined with the data augmentation based methods like MixUp as in Table 1?
3) Although the writing is rather clear and straightforward, there are many typos or mistakes. For instance, the appendix is submitted with the main content. Many section titles are not properly capitalized. Of course, these minor issues do not influence my general impressions on this paper. But I suggest the author to be more careful with these mistakes in the future.








[1] ENHANCING THE RELIABILITY OF OUT-OF-DISTRIBUTION IMAGE DETECTION IN NEURAL NETWORKS

[2] Adversarial Examples Improve Image Recognition

[3] Adversarial Mutual Information for Text Generation

[4] When does label smoothing help?
limitations_and_societal_impact: None
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: This paper studies the connection between adversarial robustness (measured as the distance to the decision boundary using some adversarial attack) and model calibration (i.e how well the predicted probability indicates how much we can truth the model predictions). 

1. The authors show that there is a significant correlation between adversarial robustness and model calibration. That is, inputs that have smaller distance to the decision boundary are more likely to have poorly calibrated predictions. 
2. Based on this insight, the authors propose an algorithm called AR-AdaLS to learn how much to smooth the labels of the training data based on their adversarial robustness. They also discuss how this technique can be extended to an ensemble model. 
3. The authors thoroughly compare their results against many previous calibration techniques and show that AR-AdaLS results in improved performance (for the single-model based methods). The results are superior also under distribution shift. They show results on CIFAR-10, CIFAR-100 and Imagenet datasets. For results under distribution shift, they show results on CIFAR-10-C, CIFAR-100-C and Imagenet-C datasets.
main_review: The paper studies the important problem of model calibration and provides a novel viewpoint based on the idea of using adversarial robustness (measured using distance to the decision boundary). The authors clearly discuss how the work differs from the previous related works and in which cases the performance of their proposed method is better. 

The submission is technically sound. The claims are well supported through extensive experiments on well studied datasets such as CIFAR-10, CIFAR-100 and Imagenet. The results under distribution shift are also extensively compared on CIFAR-10-C, CIFAR-100-C and Imagenet-C datasets. 

The paper is well written and easy to understand. 

I believe the results showing link between the two seemingly different research areas of adversarial robustness and model calibration will be interesting for the research community. 
The authors perform a very thorough comparison of their method against many single-model based methods and ensemble-based or data-augmentation based methods and find that their approach results in superior performance over single-model based methods. They show results on CIFAR-10, CIFAR-100 and Imagenet datasets.

For results under distribution shifts, they show results on CIFAR-10-C, CIFAR-100-C and Imagenet-C datasets and they are significantly better than the previous methods. The authors also show results on CIFAR-100 when the model is trained on CIFAR-10 and the number of low entropy predictions on OOD data is reduced. 
limitations_and_societal_impact: I see no foreseeable potential negative societal impacts of their work.
review_title: null

Meta-review: All reviewers agreed the method proposed in this submission is insightful and novel. The authors' rebuttal has successfully addressed the reviewers' concerns. However, the reviewers are also less satisfied by the fact that the proposed method seems to be, at best, on par with other baselines (e.g. Mixup). The robustness-based label smoothing is not consistently better and there are no theoretical arguments to favor their approach. This is a borderline paper but I recommend acceptance. Despite limited performance gain compared to baseline methods, I believe the technical contributions are sufficient.

Decision: Accept (Poster)