Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: This paper proposes integrated gradient regularizer (IGR) for attribution protection. Incorporating IGR is to combine a standard (adversarial) loss function with a similarity function measuring the difference between the natural and perturbed attributions. The authors propose to use the cosine similarity of the integrated gradients (IG) as the similarity function, and they theoretically show that it is an appropriate differentiable replacement for Kendall’s rank correlation, which is a metric quantifying the differences between attributions. The authors also show the downsides of previous attribution protection methods based on $l_p$-norm, along with the shortcomings of standard adversarial training for attribution protection and cosine similarity for adversarial protection. Experiments show that IGR can both contribute to attribution protection and adversarial protection, surpassing previous baselines.
strengths_and_weaknesses: Strengths:

The proposed IGR is simple and effective, strengthening both adversarial and attribution robustness. The advantages are shown both theoretically and empirically. The presentation is generally clear.

Weaknesses (and suggestions):

- The title is too narrow. I suggest not to mention the specific metric “Kendall’s Rank Correlation”.
- The detail of choosing $\lambda$ is missing. What value is set for it and how does it affect the results?
- In section 4, I suggest the authors first point out the implications of (a) the angle between the attribution vectors and (b) their magnitudes, and state the importance of minimizing (a) as well as maximizing (b). When explaining the drawbacks, I suggest the authors focus on the characteristics of the methods for minimizing (a) and maximizing (b).
questions: In the caption of Figure 2, the authors say that “Solid ball represents the untrained attribution surface $g$ and the dashed ball is the trained surface $g^*$.” What do “trained” and “untrained” mean?
limitations: I suggest the authors describe the concept of attribution protection in more detail in the preliminaries, and emphasize its significance, for the concept seems to be not very popular in the ML community.
I suggest the authors make a box plot of +IGR and baseline models to show the variance on multiple samples.
review_title: null

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: ### Summary

The authors study an important problem in the space of feature attribution robustness. Based on the cited works in the paper, feature attribution methods are vulnerable to adversarial attacks, such that is possible to obtain remarkably  different attribution by adding an adversarial noise to the input without changing the output label of the model (in the case of classification). This begs the question if it is possible to protect the model against such attribution attacks.  The paper highlights some of the weaknesses in existing attribution robustness (attribution defense) methods such as l_p distance regularizers and Pearson correlation. The authors make a key observation about the Kendall's rank correlation metric which is a commonly used metric for evaluation feature attribution robustness and propose a differentiable alternative based on cosine similarities which can be embedded during training.

The main contributions of the are as follows.
- Theoretically showing the relationship between Kendall's rank correlation between natural and perturbed attribution and their cosine similarity (under certain assumptions).
- Providing a geometric perspective to explain connection between adversarial robustness and attribution robustness
- Proposing a novel Integrated Gradients Regularizer method which (i) Improves attribution robustness and (ii) increases activation consistency for natural and perturbed examples.

Overall it is a good paper and I recommend the paper for an accept. 



strengths_and_weaknesses: ### Strengths and Weaknesses


Strengths:
- [ ] Providing a theoretical justification for using cosine similarity and exploiting its relationship with kendall rank correlation metric which seems to not have been done in the prior work in https://arxiv.org/pdf/2010.07393.pdf .
- [ ] Theoretical proof in the Appendix around instability of pearson correlation for small variance. 
- [ ] The geometrical perspective with associated figure and explanation is convincing and intuitively explains the claims.

Weakness:
- [ ] One major concern I have with the paper is that while theoretically it is shown the Pearson correlation is unstable and the IGR (Integrated Gradient Regularization) method seems to give best performance, it would also be helpful to compare the it's correlation with Kendall rank correlation. i.e. a figure similar to Figure 2(a) but for the pearson correlation term used in prior work.
- [ ] Suggested though not important for review decision: Some discussion around how the KL divergence term in TRADES might be interacting with IGR to give large gains.

nit:
- [ ] Line 103: Typo paris -> pairs
- [ ] Suggest to cite the following in Related Works
	- [ ] https://arxiv.org/pdf/2206.03178.pdf
	- [ ] https://www.aaai.org/AAAI22Papers/AAAI-3836.HuaiM.pdf
	- [ ]



questions: ### Questions

- [ ] I have not been able to read the prior work in full detail. Can you please clarify if both the prior work https://arxiv.org/pdf/2010.07393.pdf  and the current work seem to involve an outer minimization and an inner maximization to obtain the adversarial perturbed example ? Is this prior work differentiable ?
- [ ] Can you include AdvAAT loss function in Table 1 and highlight the difference between AT and AdvAAT. I think I understand the difference based on going through prior work but would be good to confirm.

limitations: N/A
review_title: null

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: This paper theoretically demonstrates that Kendall’s rank correlation of two vectors is correlated to their cosine similarity. Then the authors propose an integrated gradients regularizer (IGR) to regularize the adversarial training methods and make them more robust.
strengths_and_weaknesses: Strengths:
1. The authors demonstrate the relationship of two correlation metrics Kendall’s rank correlation and cosine similarity theoretically and intuitively. 
2. This paper is well-written and well-organized.
3. The integrated gradient regularizer helps adversarial training achieve more improvements.
4. The integrated gradients regularizer can make the model more robust.

Weaknesses:
1. Some experimental settings should be described more clearly, such as the top-k metric.
2. No limitations are claimed in the paper.

questions: Could the cosine similarity between integrated gradients be used to select harder adversarial examples during training?
limitations: No limitation is submitted.
review_title: null

Meta-review: metareview: Reviewers all find this paper presenting both good theoretical findings and empirical results for an important problem (feature attribution robustness). The approaches authors used in connecting the relationship between Kendall’s rank correlation and cosine similarity, as well as the geometric perspectives, are well received. The presentations are well written, with minor places for quick improvements. 

Reviewers have raised various weakness points but we agreed most of them are minor, do not affect the contribution of this paper, and/or can be fixed without much effort.

Overall we recommend acceptance and would like to encourage the authors to further improve this paper presentation following reviewers’ suggestions in the next version.
confidence: Less certain
Decision: Accept