Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: Authors investigate the problem of network robustness in the presence of parameter variations. To that end, authors propose an adversarial parameter perturbation based robust training method. Proposed training approach iteratively performs adversarial attacks on the parameter space during training to regularize the model by penalizing parameter vulnerability. Experiments are performed on F-MNIST, ECG data and a speech command detection dataset, with both conventional CNNs and recurrent SNNs, where weight-space perturbations during training showed generalization to weight perturbations at inference time.
main_review: The paper is clear to understand in most parts. Experiments are well presented, including successful demonstrations of better flattening of the weight-loss landscape with respect to the competitive methods. My main concern relates to the ambiguity on explicitly putting the novelty of this paper as the proposed problem is recently addressed by similar studies. In fact, adversarial parameter perturbations for regularization is an approach that was demonstrated in the context of model generalization with similar results (see below). The novelty of this paper however, in my opinion, comes from the fact that the authors applied this idea for the first time to recurrent spiking neural networks (SNNs).

Given the current narrative, title, and manuscript organization, the methodological contribution of this work is not directly put to the domain of compact SNN architectures and utility in the context of neuromorphic hardware, however sort of generally implied. As CNN experiments are also demonstrated to show that the proposed idea extends to conventional networks, one obvious concern would be on the scalability of this approach on the parameter space to larger networks as training would get costly to estimate Eq (2). So far the conventional CNN that the authors used only has 500k trainable parameters, and is not even demonstrated to operate on RGB images such as CIFAR-10. Did the authors investigate this with respect to the competitive methods?

From various aspects the work has similarities to the adversarial model perturbation (AMP) framework that was recently proposed [Zheng et al., Regularizing Neural Networks via Adversarial Model Perturbation, CVPR 2021]. A very similar goal was reached to obtain robust parameters to variations, including convergence to flatter local minima regions for empirical risk minimization. While I agree on the choice of all the other competitive methods that the authors compared their approach with in the paper, one needs to compare/discuss AMP with the proposed method (which uses a novel TRADES-like loss objective).

It is ambiguous what does the following statement mean on page 5: “We further adapted AWP [Wu et al, 2020] so that the input data is never attacked.” Does this mean that there were no adversarial input robustness evaluations, or that AWP [Wu et al, 2020] was implemented by the authors in a way that did not harness adversarially crafted input examples during training with adversarial weight perturbation? If it is the latter, than the AWP approach may possibly be under-performing as well. Did the authors investigate that?

One recent concept that the authors should also discuss the similarities in their paper: In principle the idea is similar to training quantized neural networks with adversarial bit errors [Stutz et al., “Random and Adversarial Bit Error Robustness: Energy-Efficient and Secure DNN Accelerators”, arXiv preprint arXiv:2104.08323 (2021)], hence perturbing the weights during training for generalization to random weight perturbations at test time. Present study approaches this problem from the perspective of a network which operates with floating-point weights.

Authors use the abbreviation LSNN in the figures and tables, however this was never described in the paper. Instead the text used the abbreviation SRNNs. It is later discovered by the reader that LSNN abbreviation corresponds to the one by [Bellec et al. 2018], when one dives into the supplementary materials.

summary_of_the_review: The paper has solid contributions by presenting an adversarial parameter perturbation based model regularization scheme that is successfully applied to recurrent SNNs. However there are important methodological comparisons/discussions missing with respect to similar methods that were recently proposed. My major concerns are listed in the above reviews, which concludes that I find this work currently to be below borderline.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: This paper introduces a special loss formulation and training algorithm leveraging projected gradient ascent to build robustness to parameter noise into training for neural networks (both spiking and convolutional neural networks are tested).  The authors show that the proposed method flattens the loss landscape for small parameter perturbations with a tradeoff of increased overall cross entropy (task) loss.  It is shown that this alternative loss, when utilized during training, provides stronger resiliency to adversarially injected parameter noise than competing methods such as dropout or adversarial weight perturbation.  Tests relating to device mismatch due to manufacturing process deficiencies are also performed and the authors show their training method would be useful for building networks that don't require per-device tuning in such cases (neuromorphic/analog computing).
main_review: This paper presents a novel application of a loss formulation (task loss and robustness loss) and projected gradient descent training to build resilience to parameter noise into neural networks.  The paper is presented well and provides sufficient evidence on the performance of the method.  While the grammar and layout is generally good, Figure caption text size does need to be increased in some cases (e.g. Fig 1 and 2 legends).  It appears details are present to reproduce results from a casual glance at supplementary code in conjunction with details provided in the paper.   Repeated and averaged results in several figures strengthens confidence of reported figures.cce

I am unsure of the implications of assuming the Jacobian of the parameters w.r.t. the attack parameters is diagonal but I believe this would limit the device applications to those where noise is uncorrelated between parameters.  Correlated noise may also have a small effect on final network performance even when trained under a diagonal Jacobian assumption. 

L_{cce} is referred to twice in the paper but is undefined -- is this the same as L_{nat} task loss?


summary_of_the_review: Techniques in this paper appear to be novel modifications to neural network training that combine projected gradient ascent with a loss specifically designed to promote robustness to small perturbations in network weights (or any similarly learned parameter).  The authors provide evidence to the strengths of this technique when compared with other mitigation measures for noise in the parameter space (either adversarial or as a byproduct of physical properties).  This research provides an interesting path toward making imperfect analog computing devices practical for large scale use and deployment.  Though I am not an expert in the specifics of this adversarial and noise related network training methods, the paper layout and methodology appear sound.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: In this paper, the authors proposed an adversarial training method that minimizes the robustness loss so that the network parameter can be trained to be robust to the parameter perturbation. 
The motivation of the work comes from the parameter mismatch that exists when using analog devices for computation. 
The robustness loss calculates the difference between the network output before the weight perturbation and after the weight perturbation, and the direction of perturbation is decided in adversarial manner with Projected Gradient Ascent (PGA). 
Experimental results with several benchmarks showed that minimizing such loss resulted in flattened weight-loss landscape, and the proposed method outperformed existing methods in terms of the robustness to parameter mismatch.
main_review: First of all, this paper is well-written and easy to follow. 
The authors provided clear explanations on the prior works, and the proposed method is clearly described.
The proposed method that uses the robustness loss seems like a simple idea, but the experimental results showed clear improvement compared to existing methods with several different benchmarks.

However, the datasets used for experiments seem too small in terms of the network size and the number of parameters, so it is doubtful that the proposed method can be a scalable solution.
Since there seems no reason for the proposed method to be limited to the spiking neural networks, it would be better if the authors can showed the improvement from the proposed method with larger-scale datasets commonly used for non-spiking neural networks.

summary_of_the_review: This paper proposed a simple yet effective solution for parameter mismatch with gradient-based adversarial training method.
However, since I am not familiar with the prior works on the parameter mismatch, I am not very confident about my assessment.
review_title: null

Meta-review: The authors propose an adversarial training method to increase network robustness to parameter variations. The proposed approach performs adversarial attacks on network parameters during training. They demonstrate that their method flattens the loss landscape of the network. Experiments were performed on F-MNIST, ECG data, and speech command detection datasets using a conventional CNN and a recurrent spiking neural networks (SNNs).

The manuscript is well-written and the method is interesting.

One reviewer was somewhat concerned about the novelty of the work, but acknowledged that the application to recurrent SNNs was new.
The main initial criticism was the question of scalability of the method, as it was tested only on networks with a relatively small number of parameters.

In the revision, the authors addressed these issues. Their method was compared to related approaches, and experiments on CIFAR-10 with a ResNet32 were performed.
The reviewers acknowledged these larger-size experiments, but were not fully convinced as much larger models are typically used today.

Nevertheless, the reviewers acknowledged the improvements and ratings were increased, so all are voting for acceptance.
Decision: Accept (Poster)