Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: The authors propose a new data augmentation technique, called AdversarialAugment, to increase robustness of image classification models.
The proposed method optimizes the parameters of image-to-image models to generate adversarially corrupted images, where they also show sufficient conditions for the consistency in the simple setting.
They empirically show that AdversarialAugment improves common corruption robustness on CIFAR-10-C as well as worst-case performance against lp-norm bounded perturbations on CIFAR-10 and ImageNet. 
main_review: - Strength:
    - Connecting common image corruption robustness and adversarial robustness is a good direction. 
    - While models trained with AdversarialAugment is not specifically designed to defend against lp-norm bounded adversarial perturbations, their classifiers show some resilience. This is an important improvement over DeepAugment+AugMix, because these previous approaches didn't show robustness against adversarial perturbations. Previously, adversarially-trained networks were shown to be robust to some corruption types, but they fail at corruption types like Fog. Future work might be able to fix this gap by leveraging AdversarialAugment.

- Weaknesses:
    - The current formulation seems to be much more computationally demanding than their counterparts such as AugMix, DeepAugment etc. It would be more fair to discuss the limitation on this aspect and/or compare the baselines controlled for similar computational resources.    
summary_of_the_review: This paper contributes to the body of work that tries to tackle both types of robustness problems (common corruption and adversarial corruption) under a unifying view, which is an important step. While their method seems to be computationally demanding, it demonstrates good empirical performance along with theoretical justification.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper makes use of image-to-image translation networks to generate adversarial data augmentation for input images. When combined with existing approaches, it achieves state-of-the-art robustness against unseen corruptions and worst-case perturbations.
main_review: *Strength*

In contrast to attacking the classifier, this approach makes a novel use of image-to-image translations network to generate corrupted samples for the classifier. This general proposed approach is amenable to learning a wide-set of image transformations, thus creating a potential for a big impact on the current state of the art in the field. 

*Weakness*

I think that the proposed approach is significantly more computationally expensive than baselines (except DeepAugment) This is because the optimization process is solved over image-to-image translation networks. Unlike classification networks, these models largely operate on full-resolution images throughout the network, thus have much higher latency. Additionally the optimization process is solved individually for each sample. Can authors provide a comparison of the computation cost with baselines?

What is the impact of architecture-specific priors? There is a common trend, where U-Net and VQ-VAE models consistently perform worse than their counterparts (table 1, 2). In particular, clean accuracy itself degrades significantly when using them as a source of adversarial dataset augmentation. Is it because of their inability to reconstruct the input image in absence of perturbation or hard to achieve high fidelity in presence of perturbations. Can authors shed some light on this phenomenon?

Moving beyond image corruptions: Due to use of image-to-image translation network, current approach is mostly limited to image corruptions. For example, it is very hard for an image-to-image translation network to model affine transformations. Modelling such non-local transformations is an active area of research [1]. I encourage authors to discuss this limitation. 

Another missing analysis in the paper is towards understanding how the proposed augmentations generalize to unseen corruptions at test time. I agree that the image-to-image translation network is expressive enough to model most image corruptions techniques, when specifically optimized for them (figure 3). However, we operate in an untargeted setting, i.e., not aware of the test-time corruption mechanism. In this untargeted setting, does the translation network using corruptions similar to the existing set of corruptions (such as blurring, weather changes)? This can be potentially measured with a classifier trained to recognize presence of specific corruptions in an image. 

On a minor note, range of SSIM values in fig. 3 appears above 1 (which is not feasible since SSIM is bounded between [-1, 1]. Is it just a plotting issue with errorbars?


1. ​​Richardson, Eitan, and Yair Weiss. "The surprising effectiveness of linear unsupervised image-to-image translation." 2020 25th International Conference on Pattern Recognition (ICPR). IEEE, 2021.



summary_of_the_review: This paper provides a general framework to defend against unseen image corruptions and adversarial perturbation. The general nature of the framework makes it feasible to use it with a wide range of corruptions.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper provides a data augmentation method that augments samples by perturbing parameters of a generative model. The perturbations are found by an adversarial loss, and are constrained based on a perceptual similarity distance to guard from the outliers.
In addition to thorough empirical evaluations, this paper provides formalization of their method and a closely related one (deep augment), adding theoretical insights , and provide interesting convergence properties and PAC-Bayesian analysis.

main_review: strengths:
===========
- empirical evaluations are thorough and detailed.

- formalisation and theoretical analysis are provided, connecting the proposed method with previous work

- combining defense against perturbation with adversarial training, providing a data augmentation method that can provide resilience against both at the same time, without sacrificing generalisation.

weaknesses:
===========
- Main results (Table1,2) suggest that none of the single Ada methods can consistently outperform DeepAugment or AugMix, in any of the corruptions, clean accuracy, or adversarial attacks. In fact, none of the 4 proposed variants (EDSR,CAE,UNET, VQVAE) can by their own outperform DeepAugment or AugMix, on any of the corruptions, generalisation, or adversarial robustness (compare any of the Ada methods, with nominal row in AugMix and DeepAugment). This is a very important drawback, which is  hard to justify, that only by combinations with other techniques, the proposed method becomes effective. 

- Although one of the aspects of this work is building adversarial robustness into models, no thorough comparisons against SOTA adversarial training methods (such as [1,2,3]) are provided. Table4 in appendix F only shows perturbation and clean performance, and not adversarial robust accuracy. This is the second drawback of the current paper, that does not provide the full comparison to the two edge of the related work. Ideally, we would like a method that can improve both, or at least perform on-par, or with a reasonable trade-off. 

- The proposed approach seems to be significantly more computationally demanding than its counterparts AugMix and DeepAugment. I would like to see a comparison in terms of computational requirements.


Additional questions
====================

- In Appx E, what is the value of max threshold t? and how is it calculated?

- In the sample guarding mechanism, how many of the augmented samples are guarded? are there any statistics? and also on the linear interpolation, some statistics on what values of lambda have been used would be insightful, to demonstrate that actually the augmented samples have been largely influential, and not ignored by the guard or interpolation.

- Do all methods (Ada, DeepAugment, AugMix) use the same training strategy (lr schedule, resizing on ImageNet, etc)?

- In Appx C, it is mentioned that for ImageNet and CIFAR10 standard data augmentation has been used. Is this the basic setting? E.g, all methods used and evaluated in this paper, use the "standard" augmentations, in addition to the mentioned augmentations (e.g, DeemAugment, AugMix, Ada)?

- In Alg1, it seems there is no randomness choosing between training on real samples and augmented samples. Were models always trained on augmented samples (e.g, no original training was used)?

- In Appx A: One of the benefits of Ada was mentioned to be its generality to other tasks and data modalities such as Audio and text. Though there is no provided result that can support this claim. I recommend to rephrase or strengthen the claim by additional results.

- In section 4, discussions, where did 10^-5 ||\delta|| come from? 


- are there any evaluation metrics on the generative models used? How good do they perform in the task they have been trained on?


- Adversarial Mixing [4] is an augmentation method that similar to Ada uses a generative model, as well as an adversarial loss, to create augmented samples. In this regard, it is the closes method to Ada. I expect to see how it compares to Ada, at least on some of the experiments.

refs:
=====
[1] Zhang, Hongyang, et al. "Theoretically principled trade-off between robustness and accuracy." International Conference on Machine Learning. PMLR, 2019.

[2] Gowal, Sven, et al. "Uncovering the limits of adversarial training against norm-bounded adversarial examples." arXiv preprint arXiv:2010.03593 (2020).

[3] Kireev, Klim, Maksym Andriushchenko, and Nicolas Flammarion. "On the effectiveness of adversarial training against common corruptions." arXiv preprint arXiv:2103.02325 (2021).

[4] Gowal, Sven, et al. "Achieving robustness in the wild via adversarial mixing with disentangled representations." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2020.

summary_of_the_review: The proposed method builds on recent related work, and its design is justified. Provides insightful empirical and theopretical results, and unifying some related work.
However:
- Empirical results does not support the claims (considering single methods applied)
- Is not compared to adversarial training methods on adversarial robustness AND perturbation robustness.
- Some relevant approaches have been missed in comparisons, as discussed above.


## after rebuttal:
During the rebuttal, the authors responded to all my concerns, and strengthened their empirical evaluations with additional results. Also the claims of the paper are now aligned with the reported results, and the limitations of the proposed approach is clarified and sufficiently discussed.
I find this paper a good reference for research on adversarial and perturbation robustness method that benchmarks a wide range of methods from both areas, with a method that although has its limitation, a strong baseline for the future work in this direction. I therefore increase my score.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The main contribution of the paper is the proposed AdversarialAugment (AdA) method. AdA generates augmented versions of an input by passing the input through an corruption network (such as a pretrained image-to-image model) while adding a worst-case perturbation to the _weights_ of this pretrained network. The paper thus aims at using worst-case perturbations for increasing average case out-of-distribution generalization such as common corruption robustness. Tuning the weight perturbation radius of the corruption network is done based on controlling the SSIM of the augmented to the clean input.

The paper provides theoretical considerations that state assumptions under which AdA is well-behaved (converges) and how it is related to prior work such as DeepAugment.

The paper presents an extensive evaluation on common corruption benchmarks (CIFAR10-C and ImageNet-C), domain shift (ImageNet-R), resampled test sets (CIFAR-10.1 and ImageNet-v2), and worst-case robustness against $\ell_p$ perturbations.

main_review: Strength:
* the proposed Adversarial Augment (AdA) is a novel contribution that comes with the benefit of being a general purpose approach. That is: in contrast to other augmentation operations, it could be applied on any type of data if there exist a suitable pretrained corruption network for the type of data
 * Strong empirical results, establishing a new state-of-the-art for CIFAR-10-C when combined with other augmentations. Moreover, strong results are also shown for ImageNet-C
* paper is well written and experiments are well structured and presented (Table 1 and Table 2)

Weaknesses:
 * Related work on sharpness-aware minimization (SAM; Foret et al. "Sharpness-aware Minimization for Efficiently Improving Generalization", ICLR 2021) and adversarial weight perturbation (AWP, Wu et al., "Adversarial Weight Perturbation Helps Robust Generalization", NeurIPS 2020) should be discussed. The main difference seems to be that the proposed method utilizes an auxiliary image-to-image model while SAM and AWP generate adversarial weight perturbations directly in parameter space of the classifier. Since the setting of SAM/AWP is more generic (no requirement of pretrained vorruption network), it would be important to clearly show an advantage of AdA over these works.
 * Assumption 1 (Corruption coverage), which is the basis for the theoretical considerations, is not plausible. The authors show in Figure 3 that the first part of the assumption ("$\beta$ has support as least as broad as $\alpha$") is approximately fulfilled. However, the second part ("any corruption function sampled from $\beta$ leaves the ground-truth label unchanged") seems highly unlikely: because of the first part of the assumption, the same property would have to hold for $\alpha$. Prior work has established that images corresponding to different classes can have small $\ell_p$ distance. The support of corruptions such as Gaussian noise-severity 5 on an image thus very likely covers parts of the input space that belong to other classes (even though sampling such Gaussian noise is highly unlikely).
* since the general method is not restricted to image classifiers or even image-based tasks, including results on other types of data would strengthen the paper.
* discussing the computational and memory overhead more transparently would be desirable. As I see it, the additional inner maximization should increase runtime by a factor of M (M=10 on CIFAR10). Moreover, the additional corruption network needs to fit in memory, increasing the required memory. This should be part of a discussion of pros and cons of the methods. 
* AdA is by design a deterministic procedure that should generate the same augmented version of the input for a given model when applied repeatedly. A desirable property of data augmentation is diversity, that is: the same input is augmented differently in every application of the augmentation operator. Could the authors comment on why AdA is defined as a deterministic procedure? (I acknowledge that due to randomness in optimization and changing model parameters, the input augmentation during training is not static but still, diversity is more an accidental byproduct and not an intrinsic property of AdA).

Additional comments:
 * in the current form, all layers of the corruption network are perturbed. Would it make sense to perturb only a subset of the layers - for instance the first layers that presumable focus more on appearance than semantics?
 * shouldn't $\eta_c$ in line 8 of Algorithm 1 depend on the layer index i - because it needs to depend on the {2, \phi} norm ?  Also, shouldn't Algorithm 1 use the {2, \phi} norm?
* Having error bars in Figure 3 that go beyond 1 does not make sense since SSIM cannot be larger than 1. This indicates that a different way of plotting the empirical distribution of SSIM scores would be better suited for the data.

summary_of_the_review: The main strengths of the paper are its strong empirical results and that the proposed AdA is a generic approach that could be extended to other types of data. However, the strong empirical results come at the cost of highly increased computation at train time and it remains unclear if appropriately tuned SAM couldn't provide similar benefits. Moreover, the general purpose nature of the approach is not demonstrated because experiments are restricted to image classification. Finally, the theoretical considerations are based on an impractical assumption.
In summary, I consider the paper in its current form below the acceptance threshold (albeit marginally so). Showing the potential of AdA on other types of data _and_ comparing to SAM/AWP could bring it above the threshold.

### Update after rebuttal ###
The authors have convincingly addressed my concerns regarding a comparison to SAM/AWP, discussing the computational and memory overhead more transparently, and several further minor points. I am raising my score to 6: marginally accept.
However, I would still like to emphasize that the "Theoretical Considerations" in their current form are grounded on unrealistic assumptions and disconnected from the rest of the paper. The authors describe in the discussion how the theoretical considerations could be revised to be grounded on more realistic assumptions. It is difficult to judge the correctness of this line of thought based on a discussion in the review forum, without a proper revision of the paper. I highly encourage the authors to update the "Theoretical Considerations" of the main paper.
In summary, I lean towards acceptance because the paper is strong on the empirical side and provides a compelling approach - but this is in spite of (not because of) the theoretical considerations.
review_title: null

Meta-review: The paper proposes an adversarial data augmentation technique searching for adversarial weight perturbations of a corruption network (e.g. a pretrained image-to-image model). The goal is to achieve common corruption robustness as well as a non-trivial level of adversarial robustness. The authors claim state-of-the-art-performance on CIFAR10-C.

Most reviewers had initial concerns which the authors could clarify in most cases. Finally, all reviewers argue for acceptance.

Strengths:
- no pre-defined corruption model necessary
- extensive experiments on CIFAR10 and ImageNet with SOTA results
- all reviewers agree that this paper would be valuable as a future reference

Weaknesses:
- the theoretical part is in my point of view rather misleading and should be completely rewritten as the authors lack here rigor concerning the setting they are working in (as also Reviewer 31sh criticizes). In particular the corruptions are not just a covariate shift (p(y|x) is invariant, only p(x) changes) as the corruptions mix the conditional distributions of different points. Thus under the given assumptions (which should be summarized at one point rather than being scattered over the text) the Bayes optimal classifer is invariant but not the Bayes optimal predictive probability distribution (which is clearly important for assessing uncertainty of the prediction). 
However, when training with the cross-entropy loss we are estimating the predictive probability distribution and thus the given statement
about convergence of the risks makes no sense for me and the optimal parameters of the classifier need not be equal even if their classifications agree everywhere. Thus the required changes to fix this theoretical part go significantly beyond what the authors suggest in their rebuttal. 
- the improvements over AugMix+DeepAugment (7.83 mCE vs 7.99 mCE) are negligible and most likely not statistically significant
While AdA has significantly higher adversarial robustness than AugMix+DeepAugment, it remains unclear if using AugMix+DeepAugment together with adversarial training for l_2 as done in
 [3] Kireev, Klim, Maksym Andriushchenko, and Nicolas Flammarion. "On the effectiveness of adversarial training against common corruptions." arXiv preprint arXiv:2103.02325 (2021).
could have led to a similar result 

The paper provides an interesting approach to achieve robustness against common corruptions and all reviewers recommend acceptance. The theoretical part as written currently is misleading as discussed above - the authors have to make it completely rigorous (including proofs, formal statements/defininitions etc) or get rid of it.

Minor weak points:
- According to the leaderboard of RobustBench the SOTA for CIFAR10-C is  by now taken by the NeurIPS 2021 paper
Diffenderfer et al,  A Winning Hand: Compressing Deep Networks Can Improve Out-Of-Distribution Robustness
which achieves 96.56% standard accuracy and 92.78% mCE. This is 1.64% and 0.61% better than in the present paper and needs
to be discussed as prior work.
- for the adversarial robustness evaluation regarding "AutoAttack & MultiTargeted" you refer to Gowal et al (2020) but the robustness
evaluation has to be properly discussed in this paper
Decision: Accept (Poster)