Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: This paper evaluated the robustness of the general deep equilibrium model (DEQ) in the traditional white-box attack-defense setting. The authors first pointed out the challenges of training robust DEQs. Then they developed a method to estimate the intermediate gradients of DEQs and integrate them into the adversarial attack pipelines. 
strengths_and_weaknesses: Strength:
1. General DEQs' robustness is not well studied in the literature and this paper provides the first study in this area.
2. The intermediate gradient estimation methods proposed are interesting, especially the first one inspired by the adjoint process in neural ODE models. I am wondering if such methods can be applied to attacks on the regular deep neural networks.

Weakness:
1. I found the intro to DEQs a little bit hard to follow. I spent a lot of time on the formulation of the problem. I think if the authors want to present this work in the adversarial robustness community, a friendlier intro in Section 2 may be useful. 
2. The time complexity of "simultaneous adjoint in the forward pass" proposed in 4.1 seems high, especially with a Jacobian inverse (even with low-rank approximation). Some complexity analysis and running time report may be useful.
questions: 1. In Table 3, I noticed that for many models AutoAttack's performance is worse than PGD10, which surprised me. I was wondering if this is something special for DEQs. More explanation on this is welcome.
limitations: The authors adequately addressed the limitations and potential negative social impact of their work.
review_title: null

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: This paper investigates the adversarial robustness of DEQs. In order to apply the standard attack algorithms (e.g. PGD attacks), the authors propose to estimate the gradient of intermediate states with two different approaches. The authors also propose techniques to improve the robustness of DEQs.
strengths_and_weaknesses: ## Strengths

* The paper proposes and investigates an interesting topic - the empirical robustness of DEQs. The authors identify the key problem of empirical adv attacks on general DEQs and propose methods for both attacks and defenses.

* As far as I can tell, the proposed approach is correct and intuitively makes sense. The authors propose two techniques to approximate the gradient of intermediate states, based on which they can perform the adversarial attack and adv training algorithms. These proposed approaches are clear and correct.

## Weaknesses

* The attack on vanilla-trained DEQs are missing in the evaluation, which is a key part of the story. To me, the logic of the paper would be 1) authors propose an adv attack against DEQs; 2) authors utilize the attack to do PGD adversarial training. Although the authors show that the adv-trained models indeed have a good performance against the proposed attacks, they do not show that the proposed attack indeed works against vanilla models. Therefore, we cannot arrive at conclusions like "adv-trained DEQs have better robustness than standard models" without seeing the results on the vanilla-trained DEQs.

* Some terms are not clearly defined and confusing to readers. For example, no specific names are given to the two approaches on intermediate gradient estimation proposed in Sec. 4.1 and 4.2. I hypothesize that the terms "exact-trained" and "unrolling-trained" will sometimes refer to the two approaches respectively, but they are also used to refer to the two previous works for training DEQs.
questions: * How do you apply the two different intermediate gradient estimation techniques in Section 4.1&4.2 to your experiments? How do they relate with the previous two training approaches "exact" and "unrolling"?

* What is the performance of your proposed attack against vanilla-trained DEQs? Which attack will have the better performance, regardless of how the model is trained (e.g. exact/unrolling)?
limitations: I do not see the discussion of the limitation in the paper. As far as I can tell, I think the efficiency of adv-DEQs would be a concern compared with standard DL models. In addition, I doubt whether the approach can be applied to larger-scale tasks such as ImageNet.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper studies the robustness issue in deep equilibrium models.
Specifically, the paper points out the misalignment between forward and backward tracks of DEQ due to the black-box solver.
To address this issue, the paper proposes two gradient estimation methods:
an adjoint process and unrolling the intermediate states.
Those two proposed methods allow accurate robustness measurement and effective adversarial training.
strengths_and_weaknesses: Strength:
The observation of misalignment between forward and backward passes in DEQs is a significant contribution to the adversarial robustness research.
The proposed two gradient estimation methods are helpful for accurately evaluating the robustness of DEQs.

Weakness:
Adversarially trained DEQ models do not show significant advantages compared with conventional deep neural networks, as shown in Table 3. Their performances are comparable.


questions: Could the author elaborate on the advantages of using adversarially trained DEQs models over the traditional deep convolutional networks?
limitations: The limitations of this proposed method are discussed in the conclusion.
The stability of adversarial training is indeed one concern of DEQ models.
Meanwhile, I think showing the advantages of using robust DEQs over deep CNNs is also not very clear at this point.
review_title: null

Meta-review: metareview: This paper studies the empirical robustness of the general deep equilibrium model (DEQ) in the traditional white-box attack-defense setting.  As the topic is under-explored in the literature, the authors first pointed out the challenges of training robust DEQs. Then, they developed a method to estimate the intermediate gradients of DEQs and integrate them into the adversarial attack pipelines. The authors did a good job to address the reviewers' concerns in the author-reviewer discussion phase, and at the end, all reviewers unanimously support the acceptance. Although AC sees some limitations, e.g., limited advantages of using robust DEQs over deep CNNs, scalability to large-scale datasets and training instability, AC thinks the merits of this paper outweigh them: this paper can be a useful guideline when researchers pursue the under-explored problem in the future. Hence, AC recommends acceptance.
confidence: Certain
Decision: Accept