Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: This work study the adversarial robustness of convolutional neural networks (CNNs) based on the popular hypothesis about the frequency bias phenomenon in CNNs. By introducing a Shapley value, they quantify the impacts of every frequency component at an instance-level. They also propose a Shapley-value guided method for adversarial training.
strengths_and_weaknesses: Strengths:
1. Using the Shapley value to analysis frequency components in each instance is an interesting idea. Their experiments also demonstrate that this metric is meaningful to improve the adversarial robustness of CNNs.
2. Their observations in Section 4 lead to instructive and constructive arguments on adversarial robustness. For example, their explanations about standard trained models (4.2) and adversarial trained models (4.3) are inspiring.

Weaknesses:
1. The experiment in Table 1 only use a small ResNet-18 model. Experiments on larger models, e.g., WideResNet-32, can be more convincing than this one.
2. In Figure 7, only class 3 shows large negative values on high-frequency components, while others only show small negative values or all positive values. Is there any intuitive or theoretical explanation for this?

questions: Please address questions in Weaknesses.
limitations: No potential negative societal impact observed.
review_title: null

final_score: rating: 4: Borderline reject: Technically solid paper where reasons to reject, e.g., limited evaluation, outweigh reasons to accept, e.g., good evaluation. Please use sparingly.
review_content: summary: This paper presents a method for using Shapley values to estimate the importance of different frequency components of input images for the predictions of a CNN. In addition they propose a new method to train more robust classifiers by reducing the effect of frequency components that usually reduce the classification chance of target class.
strengths_and_weaknesses: Strengths:
- Relatively original combination of feature importance tools such as Shapley values and the analysis of adversarial examples in the frequency domain.
- Some interesting analysis, such as the average Shapley values of different frequencies in Figure 3, and analysis of accuracy in different classes in section 4.5.
- Related work and background explained quite clearly.

Weaknesses:

Most claims not sufficiently backed by evidence:
- Most claims are based on one experiment with one network and with margins that do not look significant to me. Some examples:
Line 186-188: It seems like this should be the case based on definitions alone but experimental data does not support it very well, with very small difference between PFC and NFC.  This to me suggests there may be issues with the methodology. 
- Fig 4. also forms the basis for one of the main claims of the paper claiming that positive parts of HFC and negative parts of LFC are most easily attacked which I don't think is displayed in the figure at all.
- Analysis of Figure 7 not well supported by data. While there may be some trend towards "classes that rely on HFC would have relatively low accuracy and robustness under AT", it is not clear if this is the case and I would like to see a more quantitave measure or a simpler graph focused on this.
- Experimental results of Table 1 are not very convincing. Authors get a slightly more robust model than the baseline they have chosen at the cost of clean accuracy. Similar results could probably be achieved by changing some parameters of the baseline method. In addition performance is far below published state-of-the-art on RobustBench, even for methods using same ResNet-18 backbone.

Clarity:
- Overall the papers was very hard to follow. It has many typos and weird word choices especially in sections describing main findings of the paper which made it hard to understand what these findings are claimed to be. Examples:
- Line 56-57: “we find that ST models merely exploit HFC but are more vulnerable on HFC under adversarial attacks”, what does this sentence mean? The phrase “merely exploits” is used many times in the paper such as the title of section 4.2 but it is unclear to me what the authors mean by this.
- Line 169-171: “Thus we assume that the tension between accuracy and robustness possibly accounts for the overlooking of AT on HFC, especially positive ingredients.” What? Extremely confusing sentence.
- Line 181: We future split → we further split
- Line 208: “NFC take up a fairly certain ratio“, what does certain mean in this context?
- Figure 1 is hard to understand.
- Figure 7 should have same x-axis for all subfigures

Contributions:
I don't think the papers contributions are very significant. As explained above robust training results don't seem too useful, and while the paper claims to extend previous work based on dataset level statistics of different features into instance based analysis, I only found the dataset level analysis discussed in the paper useful. The main takeaway that I think is adequately supported by this paper is that $l_{\infty}$-norm adversarial attacks target high frequency features but this was already known from previous work.
questions: Would like clarification on the confusing sentences disucssed in weaknesses, as well as any arguments for why claims I had issue with are indeed well supported by data.
limitations: Only one sentence discussing limitations and no discussion regarding potential negative social impact. Would like to see at least some effort made to discuss potential impact, or at least acknowledge the fact that due to the nature of the work there may not be any that are easily predictable.

In addition I had some issues with the Checklist which was filled incorrectly. Specifically, authors state they have included code and data but this is not the case. In additions authors claim to have reported compute times hardware used which is also false. They also included a theoretical result but marked the corresponding sections in the checklist as N/A.


### Edit:
Thank you for the detailed response. I think the updated submission is noticeable stronger, and has largely addressed my concerns regarding soundness of the results, however I still have some concerns regarding the contributions and clarity of this submission. In response I have updated my review as follows:

Soundness: 2->3, Presentation 1->2, Rating 3->4.
In addition I have updated my confidence from 4->3 as my remaining concerns are more subjective and I feel less confident about them.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: In this paper, the authors mainly focus on the problem of explaining the relationship of CNN's robustness and frequency bias by proposing a new method utilizing the Shapley-value as the major tool. They assign the Shapley value to the frequency domain components and futher examine its relationship with HFC and LFC. The main contributions are:
1. Propose a new method to explain the robustness--frequency bias relationship;
2. Conduct instance-level, class-level and dataset-level test on the frequency-component explanation experiment, reveal the relationship between HFC/LFC and PFC/NFC;
3. Propose a data augmentation method based on the explanation to improve the model robustness.

strengths_and_weaknesses: The main strengths are:
1. The problem is of broad interest and the angle is somehow novel, since the are few previous works focusing on instance-level explanation for CNN frequency bias;
2. The overall method is reasonable. Assigning Shapley value to the frequency domain components is also novel;
3. According to the results reported in the paper, the augmentation method also succeed in improving the model robustness.

The main weaknesses are:
1. The motivation of using Shapley value is not clear. In fact, analyzing the importance of each indivisual frequency components has been discussed before[1, 2]. The most intuitive explanation method would be simply replace the target frequency component with zero or mean value, and the results reported in the papers also align with each other. This also lead to another problem that this paper lacks baseline method to compare with, considering this is not a novel task;
2. Some explanation does not sound reasonable. For example, in section 4.5 the authors try to explain class-wise fairness with the Shapley values. However, the authors state that class 0 is both robust HFC-negative because the label of which is "transportation". This obviously make the previous robustness-HFC explanation less strong;
3. Lack of more experimental results. The authors argue that the HFC/LFC dependency is inconsistent across instances within the same dataset by giving the Shapley heatmap of a shark and a gold fish. It would be great if the authors could show more results, and also avergae results across the class/dataset to better illustrate, considering the "shark" image is kind of blurred and even hard to tell by humans;
4. Minor issues. For Figure 3, please double check the x-axis. For line 168, there is a typo with "LHC". For line 248, did you mean four classes? For Figure4, what do you mean by model output?


[1] Visualizing and Understanding Convolutional Networks, Zeiler et al;

[2] Towards Frequency-Based Explanation for Robust CNN, Wang er al.

questions: Please refer to the previous section.
limitations: The authors conclude the only limitation as limited to CNNs. This does not look like a reasonable limitation, since the main topic is discussing the frequency bias of CNN. CNN is more likely to suffer from such biases becuase of its locality. Moreover, the limitations that I can think of are:
1. Lack of motivatiuon of using such a framework;
2. Lack of theoretical analysis on robustness-PFC/HFC.
review_title: null

final_score: rating: 8: Strong Accept: Technically strong paper, with novel ideas, excellent impact on at least one area, or high-to-excellent impact on multiple areas, with excellent evaluation, resources, and reproducibility, and no unaddressed ethical considerations.
review_content: summary: This work provides an interesting perspective to the robustness of CNNs in frequency domain with the help of Shapley value via a theoretically stable quantification of the contribution of frequency components. 

Specifically, the authors bring a new hypothesis about the trade-off between accuracy and robustness on adversarial training and an in-depth analysis of attack bias.

The authors also investigate the fairness problem in adversarial training and propose to boost robustness by proactively augmenting inputs with negative frequency components of their class. Experimental results verify the effectiveness of their method.
strengths_and_weaknesses: Pros:
+ This work performs a novel fine-grained analysis of the contribution of every frequency component in an instance-level with Shapley value, while previous works only do the coarse division of frequency spectrum at dataset-level. 
+ Based on the quantization of Shapley value, the authors propose novel and interesting explanations about the existence of adversarial examples and the success and limitations of adversarial training on CNNs. 
+ This work also delves into the class-wise robustness and proposes novel explanations, which may shed light on mitigating the fairness problem on adversarial training. Their proposed data augmentation defense strategy gets evaluated under strong attack baselines that verify its effectiveness. 

Cons:
- Lack of comparison with baselines which imporve robustness by filtering out HFC.
- Lack of time complexity analysis. 
questions: Questions:

1. [Major concern] On line 34, the authors talk about a series of works improve robustness by filtering out HFC, while these baselines are missing in their experiment section.

2. [Minor concern] On line 261-265, the authors claim that though calculating Shapley value requires large sampling steps, their strategy only depends on a small ratio of data. It may be better to provide a detailed time complexity of this overhead. 

limitations: Yes, the authors addressed the limitations.
review_title: null

Meta-review: metareview: All reviewers find the paper's approach on using Shapley values to measure the impact of frequency spectrum on the adversarial robustness of CNNs novel and the results interesting. Initially there were concerns about limited evaluation of the proposed approach and presentation. Author's response provided additional results and better presentation of the paper. This has largely alleviated reviewer's main concerns and most of them are positive about the work. One reviewer still rates the paper negatively and are not fully convinced about the effectiveness of the proposed approach. I think overall the response seems positive to me and I suggest acceptance. I encourage authors to update the paper incorporating the reviewers suggestions and adding more experimental results that came up during the discussion.
confidence: Less certain
Decision: Accept