Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: This paper explores the trade-off between (1) average-case robustness to translation and rotations and (2) adversarial robustness. The paper shows through extensive experiments and a theoretical example that the trade-off occurs, and they show that curriculum learning can lead to a reasonable trade-off that achieves some degree of both types of robustness.
main_review: Overall, the paper is clear and well-written, and has mostly solid supporting experimental evidence. Thus, the quality and clarity of the work is high. On the other hand, the originality and significance is more limited, but I feel that it is still interesting. Thus, I would recommend a weak accept for this paper.

This paper explores the question of whether or not robustness to random translations and rotations (“spatial robustness”) can be achieved while also achieving adversarial robustness, and the authors show in a specific theoretical construction that the answer is “no” -- that is, there exists a distribution on which a classifier of high adversarial robustness necessarily has relatively low spatial robustness. They then show experimental evidence that when optimizing purely for adversarial robustness (via standard PGD-adversarial training), spatial robustness decreases, and vice versa. In particular, they measure metrics that are reasonable, such that all models start at the same value for that metric and performance degradation occurs only after the adversarial epsilon (or the amount of rotation/translation) is increased. The results are presented in a fairly clear and logical manner, and the experiments are relatively comprehensive, covering multiple datasets and a few different models and architectures.

The authors also show that a simple curriculum-learning approach can lead to relatively high adversarial robustness and spatial robustness; I am not too sure of the significance of this, as I do not know if optimizing for this combination of robustness (as opposed to, say, adversarial robustness and common corruption robustness) is particularly useful for any specific downstream task. However, understanding how different types of robustness in general can be mixed with each other is valuable, so I do think it is still interesting.

I do have some more minor questions/clarifications/suggestions for the authors to improve their work.

1) Can you also include evaluation results for adversarial spatial robustness? For example, it might be interesting to know how well the curriculum-learned models perform when faced with adversarial rotations/translations -- does it still work well?
2) Around L105-113: What is an example of a truly invariant model, vs. a model that is invariant for most inputs but not all x?
3) L236 - when you measure adversarial robustness using PGD, are you still using the same number of PGD-attack steps as during train-time? Usually, it is better to use a greater number of attack steps (e.g. 100 steps instead of 10 steps for CIFAR) when evaluating test-time adversarial robustness, as sometimes PGD attacks are still relatively weak without more attack-steps.
4) L244 - in general, are there significant differences between StdCNNs/GCNN’s, or different architectures? From my inspection of Figure 1, the overall trends seem similar.
5) Table 1 - Have you also tried PGD (Aug 0) -> PGD (Aug 180), or Aug 180 -> PGD (Aug 180)? Those both seem like more natural ways to try to achieve both types of robustness, as opposed to completely ignoring one type of robustness during the second phase of training.
6) Figure 6 - it seems that the curriculum learning helps a little bit, but not too much, relative to something simpler like PGD (Aug 180). Could this relatively minor difference just be a result of the learning rate schedule, for example? That is, is it possible that the curriculum learning step is not actually necessary?



------------
Update: The authors responded to my questions and also performed new experiments, which had results that still support their original conclusions (and also, the new experiments seem to get even better numbers than the original experiments in the paper).

Thus, I still believe that the paper should be accepted, and I would encourage the authors to add some of the updated experimental results into their paper for completeness.


limitations_and_societal_impact: The authors have addressed the societal impact of their work.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: This paper studies the properties of spatial and adversarial $\epsilon$-bounded robustness of convolutional neural networks. Throughout the paper, the authors focus on __random__ spatial transformations, as opposed to __targeted__ (adversarial) rotations/translations. Their key hypothesis is that spatial robustness and adversarial $\epsilon$-bounded robustness are inimical to each other, and increasing one must be at the cost of decreasing the other.

They derive theoretical results for a specific distribution, and derive upper and lower bounds for the spatial robustness of an adversarially trained network on this distribution. They also show that high accuracy on the original data does not imply high spatial robustness.

Through a set of elaborately designed experiments, they provide empirical evidence for their main hypothesis. Finally, they propose a curriculum-learning based approach to find a pareto-optimal solution that achieves the optimal trade-off between the two types of robustness.
main_review: **High-level comments :**

The paper is nicely structured, and the experiments are thorough. Overall, it provides compelling evidence for the hypothesis that there is a trade-off between the two notions of robustness. The theoretical results provide support for the main hypothesis, although I have not checked the proof of Theorem 2 in detail.

**Questions :**

1. Do you think a similar trade-off holds for the worst-case spatial robustness? That is, choosing a custom rotation/translation for each image and neural network, using an approach like in [1].

2. It would be nice if you could do one experiment with more than 10 iterations of PGD on CIFAR-10. Unless PGD converges, it is sometimes difficult to draw definitive conclusions from the results.

3. I am slightly confused about the role of $m$ in the theoretical analysis. If all the coordinates (other than $x_0$ are identical), then how does shifting by different amounts correspond to a greater or lesser degree of transformation? For example, couldn’t one just re-number the coordinates without changing anything (modulo the choice of code word)?

**Minor remarks :**

1. Line 63 - “First, we show that spatial robustness on the above distribution is non-trivial...”. This is confusing because at first glance it seems like “the model has spatial robustness to some non-trivial extent”, which is actually the opposite. I would re-word it as “First, we show that achieving a high degree of spatial robustness on the above distribution is non-trivial…”.

2. In Proposition 1, could you qualify the meaning of $j$ in both mentions of $r_j$? For instance, “...$(r_j(X), Y)$ for any $j$ also has accuracy at least 97%.”

3. Could you add a row in Table 1 for a standard model trained without PGD or augmentation?

**References :**

1. Xiao, Chaowei, et al. "Spatially transformed adversarial examples." 6th International Conference on Learning Representations, ICLR 2018. 2018.
limitations_and_societal_impact: I do not see any possible negative societal impact arising from this paper.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: The work presents a comprehensive discussion on the trade-off between spatial robustness (robust against spatial transformations like rotation, translation, etc) and adversarial robustness (robust against adversarial attacks) in neural network models, by proving the phenomenon theoretically and justifying it empirically. The experiment results show that the model trained with better spatial robustness via equivariant models and larger training augmentation has worse adversarial robustness, and vice versa. To improve both robustness, the authors designed a curriculum learning-based approach where the difficulty of spatial augmentation and adversarial strength is gradually increased during training.
main_review: - Originality: The work discussed a very interesting phenomenon, which looks counterintuitive at first sight but is actually justifiable. The related works are cited in the introduction section. There is no related work section. I am not familiar with this field, so I cannot comment on if related work is adequately cited.

- Quality: The work is technically sound. The claims are well supported by theoretical analysis and empirical results. 

- Clarity: The work is clearly written, and the theoretical analysis and empirical results are well organized. The table and figures are easy to follow. The theoretical results are a little difficult to understand, especially for people like me who are not familiar with the cyclic codewords setting. It would be better to add some figure to show the setup of the theoretical analysis. 

- Significance: The results for justifying the trade-off between two types of robustness are clear and significant. The results for the performance of the proposed curriculum learning algorithm (Table 1) are not that clear to me. It seems the proposed method achieves better spatial accuracy than PGD, but worse adversarial accuracy than Aug 180 -> PGD.  So I am not sure if you can claim that the proposed method improves both types of robustness (Abstract).  Moreover, as justified in the first part of the paper, there is always a trade off between the two types, so even with the proposed curriculum learning method, it should not achieve the improvement for both.


Update: Thank the authors for answering to my questions. I keep my rating. I would suggest the authors incorporate the new results into the final version. 
limitations_and_societal_impact: Yes, the authors addressed the limitations and societal impact.
review_title: null

final_score: rating: 5: Marginally below the acceptance threshold
review_content: summary: The authors study the trade-off between spatial (translation and rotation) robustness and adversarial robustness. They show theoretical proofs and empirical evidence that two properties may be at odds with each other. A curriculum lraining based method is proposed to mitigate the problem.
main_review: [Theoretical results]

The theoretical results are interesting but not substantial. The authors study the bayes optimal classifier in a simple setting and show that spatial robustness is non-trivial to achieve and high adversarial accuracy leads to low spatial accuracy. However, the low spatial accuracy is mostly due to the decrease in the standard accuracy. To see this, since the authors consider the average-case spatial robustness which depends on the accuracy of both translated and original data, the accuracy on the original data play a larger role when the number of possible translations is smaller, i.e. $m$ is larger, which is exactly when Theorem 2 supports the claim. This also can be seen in the proof (line 566) where the authors bound the accuracy of the translated data to be 1. In general, the setting with $m=1$ might be more practical and hence interesting as it considers all the possible translations.

[Experiments]

The authors train stdCNNs and GCNNs with different levels of data augmentation to achieve different levels of spatial / adversarial robustness. The results seem to support the claim on the trade off between two robustness but only in a sense of correlation rather than causality. For example, the observation that the larger translation robustness and worse adversarial robustness can be both attributed to the stronger data augmentation [1, 2]. A more convincing proof needs more carefully controlled factors, for example, the authors may consider models with inherently different levels of spatial robustness like fully connected networks and ViTs [3].

Sometimes slightly improving the spatial robustness improves the adversarial robustness, e.g. Fig. 7 (f, h, p), which seems to be at odd with the claim.

Minor - Figure 7 caption: "(m-p) Aug - RT" --> "(m-p) Aug - RT GCNN".

[Originality]
The proposed curriculum lraining based method is novel and interesting. There is an ongoing discussion on the trade-off between spatial and adversarial robustness and it might be interesting to discuss the relationship to these works [4, 5].

[1] Chen, Lin, et al. "More data can expand the generalization gap between adversarially robust and standard models." International Conference on Machine Learning. PMLR, 2020.

[2] Rebuffi, Sylvestre-Alvise, et al. "Fixing data augmentation to improve adversarial robustness." arXiv preprint arXiv:2103.01946 (2021).

[3] Shao, Rulin, et al. "On the adversarial robustness of visual transformers." arXiv preprint arXiv:2103.15670 (2021).Shao, Rulin, et al. "On the adversarial robustness of visual transformers." arXiv preprint arXiv:2103.15670 (2021).

[4] Ge, Songwei, et al. "Shift Invariance Can Reduce Adversarial Robustness." arXiv preprint arXiv:2103.02695 (2021).

[5] Kamath, Sandesh, Amit Deshpande, and K. V. Subrahmanyam. "Invariance vs Robustness of Neural Networks." (2019).

limitations_and_societal_impact: The authors discuss the societal impact. I didn't see any section / paragraph of the discussion on the limitations of the work.
review_title: null

Meta-review: This work studies tradeoffs between robustness to translations (spatial robustness) and robustness to worst case lp-perturbations (adversarial robustness). First the authors mathematically construct distributions for which tradeoffs between these two forms of robustness provably exist. Then the authors present a series of empirical studies showing that the tradeoff occurs in practice, and methods towards achieving pareto optimality. Reviewers were overall supportive of acceptance, noting that the empirical experiments presented were particularly interesting and well executed. There was a long discussion during the rebuttal period regarding Theorem 2. For the distribution in question, a tradeoff between spatial and adversarial robustness follows as a direct consequence from a tradeoff between adversarial robustness and standard accuracy (which has been shown already theoretically for some distributions in prior work). Reviewers agreed that the original text did not make it clear that this weaker bound followed from the standard accuracy - robustness tradeoff, or how Theorem 2 strengthened upon this weaker bound. However, even with this issue reviewers agreed that the experimental results were arguably interesting enough to warrant publication. After follow up discussions between the AC and the authors, the authors have agreed to rework this section to make the weaker bound explicit (and better discussion on how it follow from  the standard accuracy / adv robustness tradeoff) while highlighting how their construction strengthens this result. With these changes in mind, the paper seems ready for publication.
Decision: Accept (Poster)