Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 4: Ok but not good enough - rejection
review_content: In this work, the authors propose to use orthogonal multi-path(OMP) block to improve the adversarial robustness of deep neural networks. They introduce three types of OMP, OMP-a/b/c, based on where the OMP block is located in the neural network. Experimental results demonstrate the effectiveness of their OMP approach. The idea is interesting and the paper is easy to follow. 

However, I have some concerns below:

1.	I feel the contribution of this work is not sufficient as the orthogonal feature learning has been explored in natural training.
2.	In addition, the baselines are also not enough for the convincing. From the perspective of network structure, this work needs to compare with related work of network structure in adversarial robustness studies, such as Feature Denoising [1]. From the perspective of model ensembling or diverse feature learning (since OMP is an ensemble strategy), this work needs to compare with works on model ensembling or diverse feature learning [2]
3.	The comparison is rather limited. The experiments are only conducted on one dataset, CIFAR-10, and the attacks for evaluation are limited.

[1] Feature Denoising for Improving Adversarial Robustness. CVPR 2019.
[2] Improving Adversarial Robustness via Promoting Ensemble Diversity. ICML 2019.

review_title: Official Blind Review #4

final_score: rating: 5: Marginally below acceptance threshold
review_content: This paper proposes to learn multiple near-orthogonal paths (OMP) in the CNN which could provide better adversarial training performance by using one random path selected from the OMP block, improving the diversity of the adversarial training examples generated. Results show some improvements over regular adversarial training. Interestingly, the improvements are very significant on the VGG networks, while not quite significant for the ResNet variants tested.

This paper claimed that it creates orthogonal paths, but it's realistically near-orthogonal since they only added a soft constraint on the OMP regularization term, similar algorithms have been proposed in the past:

[Bansal et al. 2018] Can we gain more from orthogonality regularizations in training deep cnns?

There have also been quite a few work on learning real orthogonal paths based on Riemannian manifold optimization. Some of these are of similar speed as conventional SGD and Adam. A review paper can be found at:

[Huang et al. 2020] Normalization Techniques in Training DNNs: Methodology, Analysis and Application.

Some of those papers should be cited.

In terms of performance, I feel this work should be compared against other regularization-based adversarial defense methods. A couple examples of that are:

Qin et al. Adversarial Robustness through Local Linearization. NeuRIPS 2019
Mao et al. Metric Learning for Adversarial Robustness. NeuRIPS 2019.

Comparisons against those algorithms would further verify the performance of the proposed approach.

Besides, there should be some discussions on potentially why the improvements on VGG networks are very significant and not so much on ResNet.

There is also some recent evidence on the effect of early stopping on adversarial defenses (e.g. Rice et al. Overfitting in adversarially robust deep learning. ICML 2020). It would be nice if the authors could state when did they stop the training of the respective models.

In terms of ablation, it would be nice to see different inference schemes. e.g. whether using a subset of the paths in the OMP block would be beneficial against adversarial examples or not.

I look forward to seeing the authors rebuttal and comments from other reviewers.
review_title: A different adversarial training approach

final_score: rating: 5: Marginally below acceptance threshold
review_content: The paper proposes an adversarial example defense method based on ensembling the final linear layer of a classifier, where the components of the ensemble are jointly trained with each other and with the backbone of the model to minimize cross-entropy and to be approximately orthogonal with each other. Orthogonality here is measured by flattening the layers weight matrices and computing their inner products. Training examples are either original classification examples or adversarial examples computed by the PGD attack, used in a generative adversarial traning approach.

The authors experiment on standard image classification dataset and compute robustness to both white box and black box attacks, obtaining some improvements over plain GAT. The authors also experiment with ensembling other layers of the model but obtain worse results.

The proposed method is interesting, however it increases the model size, hence it should be compared to a non-robust or GAT model for the same parameter budget. Also, in the description of the inference procedure it was not very clear how the ensemble predictions are combined. Overall, this appears to be an incremental improvement.
review_title: Review

final_score: rating: 5: Marginally below acceptance threshold
review_content: This paper addresses the problem of adversarial defence, by proposing to build multiple parallel orthogonal layers to replace a regular neural network layer. The layers in the OMP block are trained to be diverse and orthogonal to each other. Experiments on both white-box and black-box attacks, with or without adversarial training, have been carried out to show the efficacy of the proposed method, on the CIFAR 10 dataset.

\- I think for OMP-a and OMP-b, it is no longer considered as white-box attack when we change the direction of the parameters of one layer to another orthogonal direction, as the authors described below Fig 4.

\- Only Cifar 10 is used to verified the proposed method. Since Cifar 10 is a simpler dataset with low resolutions, it might be helpful to involve other datasets in the evaluation part.

\- There are some other defenses based on diversity ensemble, which are not discussed in the paper. For example, "Improving Adversarial Robustness via Promoting Ensemble Diversity".

\- From Table 2, does it mean the proposed method is not effective to improve the robustness for black-box attack compared with vanilla adversarial training?

After reading the response, my concerns are not fully resolved. For example, based on "For OMP-a and OMP-b, ... The robustness of single network is terrible. ... adversarial examples created from one of these networks can be successfully reclassified by other networks", I am feeling the OMP-a and OMP-b are less effective based on a real white-box attack. Also some other concerns are not fully addressed. Thus I am keeping my rating unchanged.
review_title: Experiments are somewhat limited

Meta-review: I thank the authors and reviewers for the lively discussions. Although reviewers mentioned the work has potentials to improve adversarial robustness, they agreed that the current draft needs a bit more work specially to strengthen its experimental results and comparisons with related works. 


Decision: Reject