Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This submission aims to reduce the prevalence of samples for which a neural network might predict the wrong answer, not just for the sample but also its nearby points in the input space. Authors call this metric robust inaccuracy.

Next, after reducing the robust inaccuracy metric, they take advantage of their models to improve conventional robustness, by taking advantage of their more reliable robustness metric to abstain from samples for which model prediction is not robust (perhaps better to call this consistent, since it can refer to both correct and incorrect predictions). 
main_review: I found it difficult to understand this paper. The goal is not well motivated, the proposed terminology is confusing, and I'm not sure what the takeaway is from the results.

First of all, the abstract mentions numbers without sufficient context. It is not even stated which benchmark this sentence refers to: "natural accuracy from 97.8% to 97.6%". After going through the paper, one can infer that they were referring to CIFAR-10, but even then the model name and training settings are not mentioned (either on table 3 or section 7.3). I see that one could follow the reference or the appendix, but basic information such as this one should be included in the main text. 

Similarly, the phrase "robust inaccuracy" is not defined until page 3, even though it is mentioned in the abstract and the introduction. I would suggest authors to define robust inaccuracy, even if informally, earlier in the paper. My personal guess is that a phrase like "mistake consistency" or "prediction consistency" would be less confusing than the phrase "robust inaccuracy". 

I would also suggest the authors try to connect the "robust inaccuracy" aspect of their work with previous work. The related work section mainly touches on the "abstain option" and the "robustness vs accuracy tradeoff". Regarding the "robust inaccuracy", I'm not sure if this concept as been studied with that name before. But relevant work includes prediction consistency of models in semi-supervised learning and adversarial robustness of models trained on random labels. It is surprising (and relevant to this paper) that models trained on random labels have similar behavior w.r.t. adversarial attacks as models trained on regular data. Thus the adversarial robustness on a sample may not depend too much on whether the sample itself is classified correctly or incorrectly by the model.

My biggest concern about this submission is that I do not see the motivation of studying the "robustness of inaccuracy" on samples that are already classified incorrectly. The adversarial direction is defined as the direction that increases the loss, so it's not surprising that the predictions are still incorrect after the adversarial direction is added to the sample. An interesting study could look at the dynamics of going from one incorrect prediction to another one, but that is not explored in this submission. 


summary_of_the_review: I found that the goal of the paper is not well motivated and the presentation should be improved before it can be accepted.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: The paper addresses the issue of trained models being inaccurate but robust for some samples. To address this issue a flexible fine-tuning mechanism is proposed. A robustness-based ensembling method is introduced as well. 
main_review: The abstract assumes the reader is aware that the paper will deal with adversarial DL, it would be better to "set the stage" a bit.
Without giving the setting of robustness to adversarial examples, the abstract is not clear to me, as it is using a lot of terms and concepts that will only become clear during the paper, such as: "robust inaccuracy", "$\epsilon_\infty$ robustness" and "certified robustness".

Table 1 seems to be a justification why the approach presented in the paper is needed. However not much details are given on how to interpret the results shown and how the values were generated.

The datasets are only explained & cited in section 7, however the abbreviations are used already in the introduction. Either cite them correctly and declare the abbreviations at first occurrence or do not mention them explicitly in the introduction.

Instead of mixing experiments (on synthetic data) and partial method descriptions with the introduction, i would favor a more detailed explanation of the introduced concepts and presented experiments. In the introduction i would suggest to focus on the gap in previous works, while keeping the experimental investigations for the respective chapter and providing more details there.

In the related work section there are several claims and properties of the proposed approach mentioned, that are not yet explained or proven, i would be better to at least point the reader to where that will be done.

The important concepts of "natural accuracy", "robust accuracy" and "robust inaccuracy" are only explained in section 3 but used to a large extend prior to that section. At least reference the explanation coming at a later stage or consider rearranging the order by which concepts are introduced. First introduce the concept than use it to explain the novelty or justification of the proposed approach.

Minor point, but similar issue: indicator function introduced in section 4, but already used in section 3.

The compositional architecture seems like ensembling with weighting based on selector S. It would be helpful to relate to that.

Illustration in figure 2 seems rather cluttered, difficult to grasp the gain by the proposed method.

## Questions to the authors
Have you compared fine-tuning existing models with training them from scratch with the proposed loss?
Why would the method be restricted to fine-tuning?
summary_of_the_review: In summary a few things are a bit unclear, e.g. to me why the method would be restricted to fine-tuning. Can certainly be improved by re-structuring, some suggestions given above. In the current state for me a bit hard to grasp the contribution.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: To tackle the two limitations of the current robust training algorithms: 1). robust inaccuracy 2). the sacrifice of natural accuracy, this paper proposed a new training method that aims to maximize robust accuracy and minimize robust inaccuracy. Moreover, a robustness-based abstain mechanism is adopted to further boost overall robustness without sacrificing accuracy. Experiments show the effectiveness of the algorithm in terms of fewer robust and inaccurate samples and better robustness, with only marginally reduced natural accuracy.
main_review: 1. It's interesting to improve robust training methods by avoiding robust inaccuracy, but the proposed method is a little bit straightforward. 
2. I think more discussion and analysis should be provided to explain the reason behind the effectiveness of the proposed method, empirically or theoretically. To be clear, I'm not requesting the authors to provide theoretical justification, and just suggest providing more insights and analysis.
3. The Figure2, 3, 4 can be improved, and I was confused about what did the curves represent at first.
summary_of_the_review: From my perspective, the proposed approach is straightforward and not fully explained. Thus I tend to reject this work. But I am open with my score, according to the authors' responses and other reviewers' comments.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: This well presented work is motivated by the relevant issue that improving model robustness while maintaining high accuracy can result in robust inaccuracy, i.e. a non-negligible amount of samples get classified incorrectly, but the category remains consistent for their perturbations. Supporting this observation empirically, this work proposes an approach to address this issue.

There are two main technical contributions. The first complements the standard robustness objectives from the literature with a regularisation term penalising robust inaccuracy. The paper provides specific implementations of this term under two setups: empirical (adversarial) and certified robustness. The second contribution is an abstain model: a learned indicator function that decides which samples are to be processed by the robust (but less accurate) classifier, and which ones should default to the non-robust (but accurate) baseline. As a result, this two-stage approach achieves high robustness without compromising the classification accuracy.
The experiments on standard benchmarks further confirm, that the robust model consistently decreases the fraction of robust inaccurate samples (albeit at the expense to robust accuracy).
main_review: Pros:
- The accuracy-robustness trade-off is a highly relevant issue. The emphasis of this work to improve robustness without sacrificing the accuracy is compelling. 
- Very nice and accessible presentation: the goal of the work is well motivated, the technical steps are explained in sufficient depth.
- The implementation of the robust inaccuracy penalty spans both adversarial and certified training.
- The experiments are of appropriate scope, contain sufficient detail for reproducibility, and substantiate the claims about the proposed approach well.
- Although most of the presented technical aspects featured in previous work, their composition seems carefully designed and sufficiently novel.

Cons:
- Although the problem formulation seems novel (Eq. 4), its implementation under both adversarial and certified scenarios of training are closely based on prior work. Similarly for compositional models (Eq. 16). This is appropriately cited, hence does not present a serious issue, but does somewhat limit the novelty.

A more general concern is that the experimental results often do not yet provide as much insight as they potentially could. The showed improvements on one metric often come at a cost of degrading the other. The analysis focuses almost exclusively on the improvement, and I wish the existing trade-off deserved more discussion and analysis in the main text. For example:
- From Fig. 2, the improvement of robust inaccuracy comes at the expense (in part significant) of robust accuracy. Since robust inaccuracy affects only a fraction of samples (cf. Tab. 1), such cost may outweigh the benefits of the proposed regularisation.  
- In Tab. 2, $\mathcal{L}_{\text{CRA}}$ may also decrease the robust sample selection w.r.t. the baseline for Cohen et al. Why may this be the case and why is it not the case of Sehwag et al.?

Minor:
* Although this work relates to adversarial robustness, one could relate the issue of robust inaccuracy to model calibration: the model trained with a robust objective may end up overconfident on misclassified examples. The proposed regularisation, in a way, addresses the issue of miscalibration from the perspective of robustness. Nevertheless, I wonder if and how the proposed approach affects the quality of model calibration.
* While I follow the illustrative goal of Fig. 1,  I wonder why is it reasonable to compare the standard model with 2 (!)  decision boundaries to other models with only one. 
* Fig. 2 could be made more illustrative (e.g. by reducing the scale of the y-axis);
* Sec. 7.1, certified robustness: It’s at least necessary to summarise the results in the main text, if there is no space to show the results in full. 
* The alternative formulation ($\mathcal{L}_{\text{DGA}}$ loss) does not seem to be beneficial. I’d suggest that it is discussed in the appendix, while the allocated space is to address more important concerns.
* Conclusion is too short. It’d be worthwhile to point out existing limitations, and to offer a perspective on how future works may leverage the obtained results.

summary_of_the_review: This work raises and addresses an interesting artefact of robust training, which was disregarded in previous work. The proposed approach seems technically sound, with a few novel elements. Although the analysis could be stonger, it nevertheless provides sufficient evidence for improved accuracy-robustness trade-off over state-of-the-art methods.
review_title: null

Meta-review: This paper presents the problem of robust inaccuracy (model predictions being robust to perturbations but inaccurate on datapoints), and present methods to maximize robustness while avoiding robust inaccuracy. Furthermore, they develop an abstention mechanism based on robustness to prevent prediction on points where the model is not robust. Results show improvement in adversarial robustness to standard attacks with only small reduction in natural accuracy. 

Reviewers were mixed on the clarity and importance of this submission. A major concern raised was on the importance of robust inaccuracy, motivation for avoiding it, and novelty of the proposed method. Other abstention mechanisms are available and one does not solely need to rely on robustness. Additionally, results are often presented on a pareto front and the method does not strictly dominate prior approaches. Authors addressed many of the clarity concerns in their updated revision, and reviewers commented on the high quality of analysis performed in the experiments. But several reviewers still found the draft and description of the robust inaccuracy problem insufficiently motivated and the methodology not well explained. Given lingering concerns over clarity and motivation (in spite of a revision that exceeds the page limit), I cannot recommend this paper for acceptance.
Decision: Reject