Venue: ICLR 2018 conference

Reviews:

final_score: rating: 6: Marginally above acceptance threshold
review_content: This paper analyses adversarial training and its effect on universal adversarial examples as well as standard (basic iteration) adversarial examples. It also analyses how adversarial training affects detection.

The robustness results in the paper are interesting and seem to indicate that interesting things are happening with adversarial training despite adversarial training not fixing the adversarial examples problem. The paper shows that adversarial training increases the destruction rate of adversarial examples so that it still has some value though it would be good to see if other adversarial resistance techniques show the same effect. It's also unclear from which epoch the adversarial examples were generated from in figure 5. Further the transformations in figure 5 are limited to artificially controlled situations, it would be much more interesting to see how the destruction rate changes under real-world test scenarios.

The results on the detector are not that surprising since previous work has shown that detectors can learn to classify adversarial examples and the additional finding that they can detect adversarial examples for an adversarially trained model doesn't seem surprising. There is also no analysis of what happens for adversarial examples for the detector.

Also, it's not clear from section 3.1 what inputs are used to generate the adversarial examples. Are they a random sample across the whole dataset?

Finally, the paper spends significant time on describing MaxMin and MinMax and the graphical visualizations but the paper fails to show these graphical profiles for real models.
review_title: Work would benefit from real world tests

final_score: rating: 3: Clear rejection
review_content: Summary:

This paper empirically studies adversarial perturbations dx and what the effects are of adversarial training (AT) with respect to shared (dx fools for many x) and singular (only for a single x) perturbations. Experiments use a (previously published) iterative fast-gradient-sign-method and use a Resnet on CIFAR.

The authors conclude that in this experimental setting:
- AT seems to defend models against shared dx's.
- This is visible on universal perturbations, which become less effective as more AT is applied.
- AT decreases the effectiveness of adversarial perturbations, e.g. AT decreases the number of adversarial perturbations that fool both an input x and x with e.g. a contrast change.
- Singular perturbations are easily detected by a detector model, as such perturbations don't change much when applying AT.

Pro:
- Paper addresses an important problem: qualitative / quantitative understanding of the behavior of adversarial perturbations is still lacking.
- The visualizations of universal perturbations as they change during AT are nice.
- The basic observation wrt the behavior of AT is clearly communicated.

Con:
- The experiments performed are interesting directions, although unfocused and rather limited in scope. For instance, does the same phenomenon happen for different datasets? Different models?
- What happens when we use adversarial attacks different from FGSM? Do we get similar results?
- The papers lacks a more in-depth theoretical analysis. Is there a principled reason AT+FGSM defends against universal perturbations?

Overall:
- As is, it seems to me the paper lacks a significant central message (due to limited and unfocused experiments) or significant new theoretical insight into the effect of AT. A number of questions addressed are interesting starting points towards a deeper understanding of *how* the observations can be explained and more rigorous empirical investigations.

Detailed:
-

review_title: An interesting area of research, but paper lacks focus, does not give new theoretical insight and provides limited experiments.

final_score: rating: 6: Marginally above acceptance threshold
review_content: This paper investigates the effect of adversarial training. Based on experiments using CIFAR10, the authors show that adversarial training is effective in protecting against "shared" adversarial perturbation, in particular against universal perturbation. In contrast, it is less effective to protect against singular perturbations. Then they show that singular perturbation are less robust to image transformation, meaning after image transformation those perturbations are no longer effective. Finally, they show that singular perturbations can be easily detected.

I like the message conveyed in this paper. However, as the statements are mostly backed by experiments, then I think it makes sense to ask how statistically significant the present results are. Moreover, is CIFAR 10 experiments conclusive enough. 
review_title: I like the message conveyed in this paper. However, as the statements are mostly backed by experiments, then I think it makes sense to ask how statistically significant the present results are. Moreover, is CIFAR 10 experiments conclusive enought. 

Meta-review: This paper studies to what extent adversarial training affects the properties of adversarial examples in object classification.

Reviewers found the work going in the right direction, but agreed that it needs further evidence/focus in order to constitute a significant contribution to the ICLR community. In particular, the AC encourages authors to relate their work to the growing body of (mostly concurrent) work on robust optimization and adversarial learning. For the above reasons, the AC recommends rejection at this time. 
Decision: Reject