Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: As the title suggests, this work studies bags of tricks for FGSM AT.

strength_and_weaknesses: Strength 1: This work performs a comprehensive analysis on FGSM AT

Strength 2: Competitive performance.

Weakness1: The main concern is that this work mainly relies on empirical results on showing effectiveness. For example, it is fully unclear why masking a subset of the input pixels can stabilize FGSM-AT. Why does it help prevent catastrophic overfitting? Why does catastrophic overfitting happen to ViT not CNN? Why does larger stride help? To my understanding, the core issue in FGSM AT its how to prevent catastrophic overfitting, a recent work [1] shows random noise augmentation is sufficient for preventing catastrophic overfitting and the reason of its success is analyzed in another work [2]. Can Non-robust feature perspective in [2] be used to explain to the success of the proposed techniques in this work? Or do the authors have their own new perspective? From my understanding, to provide explanations for why the techniques can be more important than the tricks themselves, especially in the adversarial ML community. Otherwise, the takeaway from this work can be limited. 

Weakness2: The technical contributions might also be limited.


[1] Fast Adversarial Training with Noise Augmentation: A Unified Perspective on RandStart and GradAlign, https://arxiv.org/pdf/2202.05488.pdf

[2] Understanding Catastrophic Overfitting in Fast Adversarial Training From a Non-robust Feature Perspective, https://openreview.net/forum?id=UO8UP_xDMwD
clarity,_quality,_novelty_and_reproducibility: The work is clearly written with good quality but the novelty is limited in the sense of lacking a good explanation. I believe that this work can be reproducible. 
summary_of_the_review: Overall, I believe this work has some strong empirical findings but lacks a good explanation of why they help prevent catastrophic overfitting. The limited technical contribution might also be a concern. I decide to submit this late review considering it only has three reviews, however, the authors do not need to address my concerns considering that my review is late. 

Even though my score is 5 (marginally below the acceptance threshold), I am totally okay if this paper is accepted.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: In this work, the authors study the phenomenon of catastrophic failure during Fast Gradient Sign Method (FGSM) adversarial training, and identify a collection of techniques that help stabilize the training process. In particular, the paper proposes three main ingredients: (1) modifying data wherein a random/fixed subset of input pixels are masked to zero, (2) the use of larger strides for convolutions and smooth activation functions, and (3) regularization of weights or gradients. 
strength_and_weaknesses: Strengths:
1) The paper is well-written, and motivates each aspect considered in a clear manner. 
2) The three primary modifications identified are seen to be fairly effective in stabilizing FGSM-based adversarial training, while not requiring any large additions in the computational footprint needed for training.
3) Moreover, the methods themselves, such as masking out a fraction of the input pixels, or using larger stride for convolutions and smooth activation functions are fairly simple, and thus will likely be quite of high utility in practice.
4) The paper also presents a fairly thorough ablative study to better understand the relative contribution of these different techniques. In particular, the results obtained on the WideResNet-34-10 indicate that the findings are not overly specific to one network-type alone, and yield robust networks in sharp contrast to that of Fast-FGSM-AT.
5) In addition, the results presented over larger perturbation radii also help establish the validity and generality of the techniques proposed to mitigate catastrophic failure during FGSM training, and are seen to be effective even at 16/255 for L-infinity based adversaries. 



Weaknesses:
1) The paper slightly lacks from the viewpoint of technical novelty, but the empirical findings presented are still useful for the community at large. For example, the notion of using a fixed mask to help stabilize training seems to suggest that reducing the dimensionality of the input is effective, and this might correlate well with the “effective” strength of an L-infinity based adversary in being able to perturb fewer pixels, though the epsilon-budget stays fixed.  
2) Moreover, the paper could have been significantly improved by including discussions on the L2 threat model with FGSM-AT, to yield a better understanding of the techniques, and the extent of their generality.
3) Given that the main theme of the paper is about improving the stability of single-step FGSM training, a more comprehensive experiment set would be expected over a large statistical sample - the average over three random seeds alone is perhaps a bit lacking. Given that the models can be trained extremely quickly, the paper could perhaps have shown results over 10 random seeds, given that even FGSM-AT behaves quite differently at times with different initializations. This certainly is not required for all the different values presented in all the tables, but could have been included for final comparisons.
4) The ablation with WideResNet-34-10 is a fairly pertinent section of the paper, since it presents an important leap in stability over Fast-AT. For example, were these models too trained for 110 epochs similar to that of results present for the ResNet models, alongside other factors such as learning rate? Other observations from Table-6, such as that of the stride being set to 2 appearing to be the single-most effective factor could have been discussed in more detail, and is fairly important to assess the relative importance amongst other proposed ingredient changes.
5) Furthermore, since robust overfitting is observed at a much larger scale in these settings, validation-based early stopping might help present potential improvements as well, and would better set apart the improvements achieved over Fast-AT which uses early stopping necessarily. Similarly, more detailed comparisons could have been made with respect to GradAlign in Figure-8 with larger perturbation radii for the L-infinity threat model. Overall, the contributions of the paper can perhaps be strengthened significantly by including a more detailed and broadened discussion of the ablations section, with other matter potentially moved to the appendix.
6) Could the authors also comment on the low clean accuracy achieved by several models that utilize the smooth activation function, such as those presented in Table-3,6? Since the tradeoff between robustness and accuracy is well known, focusing on robust accuracy in a vacuum may not be entirely indicative of the phenomenon at hand. For example, is it believed that these networks overfit to a far smaller extent, and have consequent impacts on the level of robustness proportionately achieved?

clarity,_quality,_novelty_and_reproducibility: The paper is well written, and presents its key ideas in a lucid manner. While the technical contributions are indeed limited, the empirical set of experiments presented do serve as a useful guide for modifications in training (such as setting stride=2 instead of 1 etc.).
summary_of_the_review: Though the technical contributions are limited, the paper presents a fairly simple set of modifications to Fast-FGSM-AT with minimal computational overhead. The overarching guidelines, such as using a larger stride for convolutions etc are useful in practice, and is a good contribution overall. As mentioned in the weaknesses, results over a larger number of seeds could be presented to better establish the generality and validity of results, alongside a more detailed discussion for pertinent sections such as the results obtained on WideResNet, larger perturbation radii etc. I would be willing to raise my score further if these issues could be addressed.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper systematically studies different tricks for FGSM adversarial training (FGSM-AT) on CIFAR-10/100. They found that there are three simple tricks that overcome the catastrophic overfitting in FGSM-AT: Data Initialization, Network Structure, and Optimization.
strength_and_weaknesses: I think this work is a valuable contribution to the research on FGSM adversarial training, but I have a few concerns regarding of the current version.

1. I think there is a slight discrepancy between the title and the core idea of the paper. Throughout the whole paper, the first glance of three tricks is to overcome catastrophic overfitting in FGSM-AT. Their improvement in performance is not very noticeable. Moreover, I think if the title is ``bags of tricks``, the studies of hyperparameter and other perspectives are also considered. Maybe the title like ``three things everyone should know ...`` is better. 

2. In Figure 2, the authors show the results by using a masking trick. When mask ration is equal to 30%, why does the training experience catastrophic overfilling after the first learning rate drops? My concern for the Mask-Fixed scheme is whether the result is related to random initialization. For instance, we just achieved a good random mask that is beneficial to FGSM-AT. So I think it's better to run the experiments multiple times and report the mean and variance score. Masking techniques are similar to random erasing [1] and cutout [2]. How well does it work using this classic data regularization technique?

3. In section 3.2, they studied the impact of the network structure. Some related work is missing. In [3], the authors "modernize" a standard ResNet toward the design of a vision transformer, which shows promising robustness behaviors. And the work in [4] uses the NAS technique with different modules to improve the model's robustness.

4. The stride of CNN is actually related to the spatial downsampling. Recently, DiffStride [5] is a pooling layer with learnable strides. I suggest the authors try this adaptive module. Moreover, I think this modification of strides is linked to the frequency model in [6], which also modified the first layer in CNN. Moreover, I am interested in the impact of the large kernel used in recent CNN [3, 7].

5. I think it's better to report the training time in all experiments, especially for the tables.

6. In Table 5, what will the results be when we combine multiple tricks? For example, we consider: Mask-fixed+Str2 (+Weightnorm), and Mask+Smooth+WeightNorm. A similar question is also for Table 6. What will the results be when considering Smooth+Str2, mask+smooth, and Smooth+Str2+WeightNorm?

7. In Table 7 and Figure 8, it's better to show the results of a combination of different tricks.

8. A recent FGSM-AT [8] is missing.

9. FGSM-AT is an effective adversarial training that can train deep model on large-scale dataset, like ImageNet. So it's better to evaluate the mentioned tricks on a large dataset, like Tiny-ImageNet or ImageNet. 

[1] Random Erasing Data Augmentation. AAAI 2020.

[2] Improved Regularization of Convolutional Neural Networks with Cutout. Arxiv 2017.

[3] A ConvNet for the 2020s, CVPR 2022.

[4] Anti-Bandit Neural Architecture Search for Model Defense. ECCV 2020.

[5] DiffStride: Learning strides in convolutional neural networks. ICLR 2022. 

[6] High-frequency component helps explain the generalization of convolutional neural networks. CVPR 2020.

[7] Scaling up your kernels to 31x31: Revisiting large kernel design in cnns. CVPR 2022.

[8] Revisiting and advancing fast adversarial training through the lens of bi-level optimization. ICML 2022.
clarity,_quality,_novelty_and_reproducibility: The evaluation is not sufficient, but the results are interesting. 
summary_of_the_review: This paper systematically studies different tricks for FGSM-AT, but its main target is to overcome the catastrophic overfitting. If the authors consider doing a topic on ''bags of tricks," I think the authors should give more takeaways and put forward a standard baseline setting for future work. I have many concerns about the current version. For more details, please refer to the [Strength And Weaknesses].
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper comprehensively study how to mitigate or get rid of catastrophic overfitting from perspectives: data initialisation, network architecture and optimisation, and thus provides a bag of tricks for how to improve and stabilise fast adversarial training.
Specifically, the authors find that randomly masking out some input features, using smooth activation functions, increase the convolutional strides and regularising the weights on the first convolutional layer can help.
strength_and_weaknesses: Strength:

1. Some observations, such as random masking and increased convolutional strides, are interesting and could be useful for practitioners. 
2. Many experiments and ablation study are conducted to support the authors' claims.

Weakness:

1. My major concern is the novelty, the contribution is actually incremental. This is a pure empirical work, and the authors provide almost no explanation or intuitions about why these tricks work. This makes me doubt if these technique can be applied to more complicated tasks, such as ImageNet.

2. Although the tricks proposed can get rid of catastrophic overfitting, but the final results are not very competitive. For example, on the robustBench, "Efficient Robust Training via Backward Smoothing" can achieve 51.12% and 26.94% robust accuracy under AA on CIFAR10 and CIFAR100, respectively.

3. In order to achieve the best results, the authors should apply combinations of several tricks on WideResNet-34-10 as well, since the result of a single trick on WideResNet-34-10 is still worse than when we apply several to PreActResNet-18.

4. As mentioned in the beginning of Section 3, the authors do not use the label smoothing. What is the reason behind this? As fas as I know, adaptive label like the one in self adaptive training (https://proceedings.neurips.cc/paper/2020/file/e0ab531ec312161511493b002f9be2ee-Paper.pdf) can indeed improve the performance with little overhead.

Minor:

1. Variance should be reported for Table 2.

2. More values of $\alpha$ should be included in Figure 5(b).




clarity,_quality,_novelty_and_reproducibility: Clarity and quality: This paper is generally well-written and easy to follow. 

Novelty: this is the major concern of this paper. The author does not provide any analyses, explanations or intuition to convince me the "bag of tricks" is generally applicable.

Reproducibility: As a pure empirical work, the authors should release the code and the checkpoint model for reproduction.

summary_of_the_review: This paper empirically study the tricks to improve fast adversarial training.
Although it can provide some useful tricks for practitioner, the paper still does not reach the bar of publishing because of the concerns above.

I suggest the authors provide more analyses, explanations and intuitions, as well as the open-source code to make the findings of this paper more convincing.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: This paper considers a problem in adversarial training using FGSM: the robust accuracy abruptly drops to zero within a single training step. The paper investigates a collection of tricks that mitigate this catastrophic overfitting issue. 

Although the paper considers an interesting and important practical problem, reviewers have concerns about the novelty of the paper is limited. In addition, there are some concerns about the final results not being very competitive. 
 
justification_for_why_not_higher_score: Although the paper considers an interesting and important practical problem, reviewers have concerns about the novelty of the paper is limited. In addition, there are some concerns about the final results not being very competitive.
Decision: Reject