Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper proposes a regularization method for improving the generalization in maximum likelihood learning. The main idea is to reduce confidence (or increase entropy) on inputs generated by large adversarial perturbation. The authors conduct extensive experiments to demonstrate the effectiveness of their method. They also analyze the effectiveness of their method by showing it can unlearn noisy features in a toy setting.
strengths_and_weaknesses: This paper is overall well-organized and clearly written. As the main contribution of this paper is to propose a new regularization method, the novelty might be minor since the proposed method resembles the existing methods in adversarial data augmentation [1,2,3], albeit the difference that this paper proposes to "unlearn" examples under large adversarial perturbation instead of "learn" examples under small adversarial perturbation. 

My biggest concern in this paper is that the experiment results may not be sufficient to demonstrate the effectiveness of the proposed method. Since the authors aim to improve generalization in a very general sense instead of robustness against perturbation or domain shift, experiments on large datasets such as ImageNet would be necessary. I am not quite certain about the effectiveness of the proposed method in such a more realistic setting as the improvements on full datasets such as CIFAR-10 and CIFAR-100 are already marginal. The authors also emphasize that the proposed method is most effective in low-data regimes. In this regard, I believe it would be necessary to showcase the proposed method in a semi-supervised setting with unlabeled data available. 

[1] Virtual adversarial training: a regularization method for supervised and semi-supervised learning. Miyato et al., 2018.

[2] Generalizing to unseen domains via adversarial data augmentation. Volpi et al., 2018.

[3] Maximum-entropy adversarial data augmentation for improved generalization and robustness. Zhao et al., 2020.
questions: The authors compare their method with baselines including those from adversarial training such as FGSM, and those from domain adaptation such as ADA and ME-ADA. But as far as I am concerned, none of these methods is specifically designed for standard in-domain generalization. FGSM is for improving adversarial robustness while ADA and ME-ADA are for domain generalization. Why didn't the authors compare their method to VAT [1], which also proposes to perform data augmentation with adversarial perturbation, and aims for generalization in standard supervised and semi-supervised settings?

[1] Virtual adversarial training: a regularization method for supervised and semi-supervised learning. Miyato et al., 2018.
limitations: The limitations have been properly discussed in Section 6.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper proposes a new regularization technique for deep neural networks by reducing confidence on self-generated examples that lie along directions adversarially chosen to increase training loss. The proposed regularizer can be easily integrated into training pipelines and added to existing techniques to gain 1-3% improvement in test accuracy.
strengths_and_weaknesses: Strength:

This paper identifies a new inductive bias to reduce the confidence on out-of-distribution inputs and turns this bias into a new regularizer for training. Using adversarial direction to guide the training process is an interesting idea. The empirical evidence demonstrates the effectiveness of the proposed method, and the theoretical analysis also presents some theoretical guarantees on generalization gap. Some interesting insights are also provided with experimental validations.

Weaknesses:

1. The approach of generating out-of-distribution examples from large stepsize adversarial examples needs to be justified. Why is it a proper way to generate such examples? How is it compared with other generation methods, e.g., random samples in other classes?

2. It would be better to point out that the objective is not to improve adversarial robustness although adversarial examples are employed for training. This could help avoid confusion. Although the proposed method does not try to robustfy the model, it is unclear if the proposed method improves the test accuracy at the cost of the adversarial robustness. Corresponding experiments could be designed to address this concern.

3. The connection of the proposed method to some other ideas such as data augmentation and contrastive learning could be also discussed and compared if relevant.

4. Running time comparison could be added to see how much cost paid for the performance gains.

5. It would be also interesting to see how the proposed regularizer is compared with the existing ones with respect to generalization performance.

questions: 1. Justify the way to generate out-of-distirbution examples.
2. Check how vulnerable the trained model is to adversarial attacks.
3. Discuss the difference from contrastive learning with data augmentation.
4. Running time comparison.
5. Comparison with existing regularizers.
limitations: Yes.
review_title: null

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: The paper proposes RCAD, a simple regularization scheme for predictive models that aims to increase the predictive entropy for OOD points. OOD points are generated adversarially using FGSM with a large step size. The authors demonstrate that the method reliably improves the test accuracy on a set of image classification tasks, as well as tabular regression tasks. The improvement is more significant when less data is available. To understand why the method works, the authors study it on a toy linear classification task.
strengths_and_weaknesses: Strengths:
- The method is clearly introduced, and carefully compared to prior work.
- Statistically significant improvement in test accuracy (up to 3 percentage points) across the benchmarks (image classification and regression on UCI data) when RCAD is employed, compared to multiple strong baselines.
- Ablations to understand the impact of the adversarial step size and model architecture.
- Theoretical analysis for the linear case that motivates the method.

Weaknesses:
- The idea to use adversarial optimization to find OOD points is of limited novelty (see \[a\]). To the best of my knowledge, however, it has not been previously studied theoretically, or evaluated on such a broad set of benchmarks.
- The analysis on the linear case is sometimes hard to follow. Consider moving more detail into the appendix, to give the narrative more breathing space.

References:
- \[a\]: Besnier, V., Bursuc, A., Picard, D., & Briot, A. (2021). Triggering Failures: Out-Of-Distribution detection by learning from local adversarial attacks in Semantic Segmentation. In Proceedings of the IEEE/CVF International Conference on Computer Vision (pp. 15701-15710).

questions: - Does the "sweet spot" for the $\alpha$ value that we see in Figure 4b change significantly with the dataset? Would be useful to understand how tricky it is to get this parameter "right" for a novel task.
- Have authors considered the relation of the method to max margin classifiers like the SVM? I wonder if the two approaches recover similar decision boundaries. A comparison on the toy dataset would be interesting.
limitations: Authors discuss the impact of the additional regularization term on training time, as well as the assumptions made by the analysis. I consider the potential negative societal impact of this work to be limited.
review_title: null

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: This paper proposes to increase the test accuracy by maximizing the entropy of out-of-distribution examples that are adversarially generated, which is named reducing confidence along adversarial directions (RCAD). Empirical results support the claim that RCAD can improve test accuracy. In addition,  the authors theoretically analyze the effectiveness of RCAD on a linear case. 

strengths_and_weaknesses: Strengths
+ This paper is well written and organized. I can easily follow.
+ The proposed method is easy but effective in improving test accuracy. The proposed method is an interesting case that leverages adversarial attacks for good. 
+ Experiments are comprehensive and sound. The results validate that RCAD can be compatible with various methods and indeed enhance the test accuracy. 
+ The theoretical results explain why RCAD help test accuracy to some extent (although I have not carefully checked the correctness of theoretical results) — RCAD can regularize the model to unlearn the spurious features. 
questions: + Could I know the influence of the hyperparameter $\lambda$, since it seems that an important hyperparameter in RCAD?

limitations: The authors have pointed out the limitation of their proposed method. I have no idea about how to accelerate RCAD so far.
review_title: null

Meta-review: metareview: All reviewers have expressed a clear opinion in favour of acceptance, one improving their score after the rebuttal and discussion. I’m happy to recomment acceptance.
confidence: Certain
Decision: Accept