Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: The authors propose a new method for measuring confidence and increasing the robustness of neural networks. The core of the method is replacing the last linear layer and softmax with learnable per-class Gaussians (centroids).   
To address convergence problems, the paper proposes simplified Gaussians and adding negative log-likelihood with a margin to a loss.
The method is backed by proof that classification with centroids is at least as expressive as linear layer classification.
strength_and_weaknesses: Strengths
* The paper is well-written, the explanation is clear and the flow is good.
* The proposed method appears naturally, backed up by a sound theoretical background.
* Though it's closely related to another method, the one proposed in the paper feels simpler, requiring fewer resources and being more robust at the same time.

Weakness
My main concern is that experiments feel shallow
* First of all, the authors refer to DUQ and make comparisons mostly with it. But DUQ by itself focuses on out-of-distribution detection, not robustness, so I would expect out-of-distribution experiments. If the robustness is expected to be the strongest point for the method, then I would expect some baseline from this area, e.g. adversarial training or improved Lipschitz constant with methods like spectral normalization.
* The authors mention restricting of Lipschitz constant and it's a part of a proof condition, but it's not addressed in the implementation and experiments. What's more concerning, local Lipschitz constant restriction with spectral normalization is part of the DUQ method, but I feel that it wasn't used in the paper this way. The provided repository doesn't contain the code for it, so I have some concerns about the validity of the provided results.
* I'm not sure what conclusion should we make from confidence in table 1. Mean confidence is not a very meaningful metric, as with postprocessing like temperature scaling you can get almost arbitrary values for it. The calibration plot would be much more meaningful in this case. Particularly, one can argue that having mean confidence 0.87 with 0.99 accuracy is strongly under-confident.
* While the statement in theorem 1 seems valid, there are a few issues in derivation, I believe it could use some polishing. E.g., missed opening bracket in eq.1. The sign for b seems wrong as well there, should be '-' in the third line of the appendix.  It's stated that the second term eq.1 could be made zero, but in fact, it is only shown to be constant.
clarity,_quality,_novelty_and_reproducibility: The paper is clear and focused; the statements in the paper are correct. 
summary_of_the_review: While I have concerns about the experimental part, the paper is coherent and original overall.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper focuses on uncertainty quantification and robustness. The authors find that existing work in uncertainty quantification mostly revolves around the confidence reflected in the input feature space. The authors focus on the learned representation of the network and analyze the confidence in the penultimate layer space. The proposed new confidence measure is centroid-based and hence no longer suffers from the artificial confidence inflation of out-of-distribution samples. 

strength_and_weaknesses: Strengths:

1. The authors formally prove that independent of optimization-procedural effects, a set of centroids always exists such that softmax classifiers are the nearest centroid classifiers.
2. The authors proposed a new confidence measure that is centroid-based and hence no longer suffers from the artificial confidence inflation of out-of-distribution samples. 
3. The proposed centroidal confidence measure provides a robustness certificate against attacks.


Weaknesses:

1. What is the motivation of Section 3? What is the connection between uncertainty and robustness?
2. Lack of important related work of uncertainty quantification, such as [1, 2].
3. It is better to add more baselines to demonstrate the effectiveness of the proposed method.
4. Since the paper focuses on uncertainty quantification, it may necessary to show some experiments result about out-of-distribution detection.


[1] Malinin, Andrey, and Mark Gales. "Predictive uncertainty estimation via prior networks." Advances in neural information processing systems 31 (2018).

[2] Malinin, Andrey, and Mark Gales. "Reverse kl-divergence training of prior networks: Improved uncertainty and adversarial robustness." Advances in Neural Information Processing Systems 32 (2019).

clarity,_quality,_novelty_and_reproducibility: This paper is well-presented and organized. The proposed idea is novel. The authors provide the code for experiment result reproduction.

summary_of_the_review: See Strength And Weaknesses:

------------ after rebuttal ------------

The authors' response addressed some of my concerns. But I still suggest adding more baselines and out-of-distribution detection experiments in the future version to demonstrate the effectiveness of the proposed method. Therefore, I will keep my score.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This work proposes modeling the predictive confidence of the DNN model using RBF-style output layers (Definition 1). This choice is justified by a theoretical argument on the connection between softmax classifier and the  neares centroid classifier, for which a robustness guanrantee can be derived (Section 3). The paper then conducted vision experiments based on standard benchmark and architecture (ResNet-18/50 on MNIST/CIFAR/ImageNet), ans shows accuracy improvement over DUQ, and adversarial robustness improvement over softmax classifier. 
strength_and_weaknesses: Strength:

* A interesting work that improves the single-model uncertainty methods based on RBF-style classifier (i.e., DUQ).
* Author investigated (both theoretically and empirically) the implication of adversarial robustness of the distance-based approach.

Weakness:

* Performance is lacking on large-scale benchmarks. There are several single-model methods developed and tested on, e.g., ImageNet with ResNet50 (e.g., see MIMO or SNGP on Uncertainty Baselines: https://github.com/google/uncertainty-baselines/tree/main/baselines/imagenet), which are generally competitive or outperform standard softmax classifier in Table 1. This may somehow discount the emprirical utility of Gauss classifier, as it still incurs a hard uncertainty v.s. utility tradeoff. This somehow leads me to question the utility of centroid-based classifier in more difficult tasks (CIFAR-100 and ImageNet).

* Missing evaluation metric for uncertainty performance: In Table 1, please consider evaluate model uncertainty using a standard evaluation metric such as ECE.

* Missing treatment of Lipschitz constant control / related literature review. As authors commented, Lipschitz constant is important for guanrantee model's uncertainty and robustness performance. However, there are a stream work in the single-model uncertainty literature (e.g., [SNGP](https://arxiv.org/abs/2205.00403), [DUE](https://arxiv.org/abs/2102.11409), [DDU](http://www.gatsby.ucl.ac.uk/~balaji/udl2021/accepted-papers/UDL2021-paper-022.pdf) etc) that tackles this by combining spectral normalization with distance-based classifier, which generally outperforms DUE and works well for high-dimensional benchmarks. Please consider include them into related work, and optionally absorbing some of these baseline techniques into methodology or include these previous work as baselines.

clarity,_quality,_novelty_and_reproducibility: The paper is well written and easy to follow.
summary_of_the_review: This is an interesting work that theoretically establishes the connection between softmax classifier and centroid classifier, empirically proposed an improved formulation of RBF-style last-layer classifier than outperforms its similar predecessors (i.e., DUQ), and brings the consideration of adversarial robustness into the picture. 

However, the work is slightly disconnected from the current uncertainty literature in that it does not sufficiently review or compare with its contemporary methods (e.g., SNGP, DUE) that handles Lipschitz control and uses distance-based classifier, and empirically its accuracy performance is not on par with the other uncertainty methods, and its uncertainty performance is not rigorously evaluated with standard performance metrics (e.g., ECE). Adding literature review and additional baseline comparison should address these issues to some extent.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: The paper investigates uncertainty quantification in NNs by treating them as a softmax classifiers. The paper establishes a formal relationship between softmax and Voronoi region driven classification. The relationship between the two is obtained through multivariate Gaussian distribution. This relationship is then exploited to suggest Gaussian confidence scores, which can be seen as a measure of 
uncertainty quantification and also robustness.

While there was appreciation of the proposed measure but the reviews express substantive concerns mostly related to relationship with past work. The rebuttal tried to address some of them but the current draft does not seem to be ready for a selective conference like ICLR
justification_for_why_not_higher_score: There are several concerns with the paper, see reviews.
Decision: Reject