Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 7: Good paper, accept
review_content: summary: This paper proposes a novel regularization for adversarial robustness based on an information bottleneck criterion. The method is well-motivated and supported theoretically and empirically.
main_review: Strengths:
- The proposed regularization is well-motivated (Fig. 1, Lines 127-135).
- It is theoretically shown to upper bound the variance in the network output (Theorem 1 with continuity and bounded assumptions) and the expected absolute difference of the output (Theorem 2 with Gaussian input assumption). Theorem 2 is a more direct bound for the adversarial robustness.
- The experiments support the effectiveness of the idea in increasing the robustness of ResNet and WideResNet models on CIFAR-10 (Table 2) and CIFAR-100 (Table 1 right) when combined with other robustness methods as measured by various attacks such as AutoAttack. In particular, the improvements achieved combined with TRADES are significant (Table 1-right, CIFAR-100 ~0.5% against AA, Table 2-right, CIFAR-10 ~0.8% against AA). The improvements are shown to be statistically significant.

Minor:
- In Table 3 and Appendix E, the accuracy against PGD is low. Is this ablation study done without adversarial training? It would be better to see an ablation study on the best performing methods. Also, lambda_y is only set to 0.05 in Table 6 and a wider range needs to be studied.
limitations_and_societal_impact: Limitations and societal impact have been discussed in the appendix.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: To enhance the adversarial robustness of deep models, this paper proposes to use HSIC bottleneck as a regularizer. Unlike previous work trained with adversarial samples, the proposed learning objective drops redundant information from the input to the latent representations. Theoretical analysis that HSIC regularizer can reduce the output variance is provided.
main_review: This paper is valuable in the following aspects:
1.	The idea that improving robustness without adversarial samples is interesting. Although HSIC bottleneck is used in previous work, it is novel to use HSIC as a regular term for adversarial robustness.
2.	The theoretical analysis ensures the soundness that HSIC can reduce the influence of an adversarial attack.
3.	The effectiveness is well studied with ablations, and the experiment details are clear.
4.	The limitations and potential negative impacts are clearly discussed.

I only find some minor issues:
1.	It will be more readable if the abstract provides more information on the proposed method and theoretical conclusions.
2.	It is said that SWHB fails on ResNet-18 due to the way how SWHB updates parameters. However, Ma et al. have conducted experiments on ResNet and shows comparable performance with backprop. Could you please provide more explanation?
3.	Error bars in figure 5 are unclear. It might be better to show the standard deviations with a table.

limitations_and_societal_impact: Yes
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: The authors propose to use an information bottleneck regularization -- with Hilbert-Schmidt information rather than mutual information -- to improve the adversarial robustness of the trained neural networks. The authors furthermore show that the minimizing HSIC between the input and the latent representation limits the variance the network output can achieve.
main_review: The main idea of the paper is very nice, especially in the light of the fact that for deterministic networks the classical IB objective is infinite (cf. [2] in the paper). The HSIC functionals appear not to be suffering from this limitation. However, I have noticed several small to medium issues that need to be addressed:

-) First of all, it is not exactly clear why the HSIC(Y;Z) term is required. Essentially, the classical or adversarial loss in (5) should suffice to ensure that Z contains sufficient information about Y, while HSIC(Y;Z) goes in the same direction. Moreover, in the classical IB setting, the term I(Y;Z) is usually replaced (not complemented) by the classical cross entropy loss. I have the strong feeling that it should be possible to remove this term altogether by appropriately adjusting the hyperparameters lambda_x. This is also supported by Table 3: In case HSIC(Y;Z) is missing during training, both HSIC terms turn out to be zero, indicating that the regularization on HSIC(X;Z) was too strong. This is further supported by Table 5, in which lambda_y=0 and for small lamda_x still good natural accuracy is achieved. Thus, HSIC(Y;Z) is not necessary, but a careful setting of lambda_x is required.

-) Theorem 1 is extremely strong and interesting; however, I agree with previous reviewers that it is not very useful for making the intended point. In fact, for a purely Gaussian setting, I expect that similar statements can be made about I(X;Z): If Z contains only little information about X (in the sense of a conditional variance, which appears to be the case for Gaussian settings and/our HSIC measured with distance-based kernels), then also the network output can only vary little with X. Theorem 2 goes in the same direction, essentially replacing variance with the first absolute moment under a specific perturbation model. Both theorems are interesting, but they do not explicitly point at adversarial robustness, other than just pointing at general invariance to input variations.

-) This brings me to a recent publication that may actually help relieving the previous issue. The conditional entropy bottleneck by Fischer replaces the I(X;Z) part in the IB functional by I(X;Z|Y). This term should indeed become zero, and setting this term to zero does not harm classification performance. If the same Theorems 1 and 2 could be formulated for HSIC(X;Z|Y) (appropriately defined), then this reduction in variation with the input would actually help make strong claims regarding generalization and adversarial robustness.

-) Some of the papers in the references are still referred to via their arXiv version, despite being already published. I suggest to update the reference list.

Aside from that, I noticed some minor issues that can be addressed quite easily. I list them here for completeness, they do not influence the review score though:
- [1] did not study learning dynamics, but [1] used the IB functional as a training objective. [2] did not suggest the IB functional for training, but analyzed it. [1] has a focus on supervised learning, not on auto-encoders. A reference to Fischer's conditional entropy bottleneck may be added.
- in line 92, while y in {0,1}^k is correct, this is not standard notation; y is usually one-hot encoded.
- after line 110, w.r.t. which distribution are the expectations taken?
- in lines 138-140, the computational complexity also depends on d_Z; this should be acknowledged.
- in line 171, why must the sets be closed? Is it not sufficient that they are bounded?
- in Table 1, the caption claims that training times are shown, but I think they are missing.
- line 244-245 contains a typo: "with and hyperparameters"
- line 273 lists Shwartz et al, but I guess it should be Shwartz-Ziv and Tishby.
- in Table 1 [ii] it is not surprising that missing the cross entropy loss yields low accuracy. Even if Z contains much information about Y, this information may not be easy to access for the remaining part of the network. This was discussed also in [2].


edit: I acknowledge the authors' responses and change my score. Thank you!
limitations_and_societal_impact: Yes, the authors have partly addressed the societal impact by claiming that being too confident in adversarial robustness may be problematic. This being a method paper, I accept this statement as sufficient.
review_title: null

Meta-review: Adversarial robustness is an important problem of neural network models. This paper proposed a new regularization based on Hilbert-Schmidt Independence Criterion (HSIC) to improve adversarial robustness. The regularization consists two HSIC terms: one aims to reduce the nonlinear dependence between input and features, while the other enhances the dependence between features and outputs. Such a regularization is shown to enhance adversarial robustness in both natural training and adversarial training. The reviewers unanimously accept this paper after discussions. There are several minor points raised by reviewers that the authors promise to revise accordingly. In the preparation of final version, the authors are expected to incorporate these points suggested by the reviewers.
Decision: Accept (Poster)