Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 4: Ok but not good enough - rejection
review_content: summary: This paper presents a method to detect adversarial examples by disentangling the representation. This is done by training autoencoders over both correct and incorrect class/semantic features. The authors claim that the proposed method outperformed other SOTA methods for adversarial detection and even works against adaptive adversarial attacks.

main_review: The core motivation of the paper is to distinguish robust features versus non-robust features using the DRR network. The assumption here is that the DRR could successfully disentangle the semantic features versus the class features. However, the establishment of such an assumption is still under question. There is no definition of the metric to measure disentanglment, we could show through statistical metrics such as Mutual information Gap (MIG), SAP score < Chen et al. 2019 Isolating Sources of Disentanglement in VAEs>. 
- Especially in part 3 of the paper, there are many hand-wavy explanations, e.g. line 148. The idea of encoder/decoder structure is quoted vaguely, but it is used as a base logic. In a word, this cannot convince me that DRR is able to disentangle the features. In representation learning, disentanglement is still a very challenging problem as is pointed out by seminal work such as <Locatello et al. 2018> whereas there is no evidence showing that the proposed method could generate any type of compact representation.  (In a compact representation, a given factor is associated with only one or a few code dimensions. <Ridgeway et al. 2018 Learning Deep Disentangled Embeddings
With the F-Statistic Loss> From the resulting images in the experiment section and in the appendix, I just could not tell whether the semantic features are different from the class features. 
limitations_and_societal_impact: The other question is related to the size of the dataset in experiment, we are using very small datasets i.e. MNIST and CIFAR 10 to train a GAN basically, and I am not sure whether the conclusion would generalize to large-scale datasets such as ImageNet which is 20x larger. 

Last thing is about the adaptive attack which the authors added, why are the results on Cifar and MNIST different in terms of epsilon value? The description of Fig 6 is quite confusing, making me think PGD is a stronger attack than the adaptive attack, which shouldn’t be the case.
review_title: null

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: The paper propose a new defense mechanism against adversarial attacks based on an autoencoder architecture. The proposed architecture uses self-supervised learning to disentangle the semantic and class features, which enables the autoencoder to discriminate the clean and adversarial examples at test time. The approach was shown to outperforms other autoencoder approach in the experiments, when the attacker as access to only the victim model or both the victim model and autoencoder.
main_review: **Originality**:
- The proposed approach builds on previous autoencoder approach to detect adversarial examples, however the author propose a new architecture and leverage self-supervised learning. 
0The related work seems to be adequately cited and the contributions is put into the context of the previous autoencoder approach.

**Quality**:
- The experiments clearly show that the proposed approach outperforms the other autoencoder approach. In particular, table 3 clearly shows that DRR has a significantly higher AUC on 3 datasets (CIFAR, MNIST, Fashion) and against different attackers. However, the experiments don't report any confidence interval, it would be nice to have error bars for the experiments. 
- The objective is also composed of many different losses and introduces many new hyperparameters, the role and importance of each losses is not clear, it would be nice to have some ablation studies that shows to which extent each loss terms and how the new hyperparameters affects the performance of the proposed solution. In particular, I don't understand the definition of $L_2$ the first term is a constant and $\hat x_i$ is not defined. In eq. 4 how important is the hinge loss and the value of $d$. I would like to see an ablation study with $\lambda_{\text{GAN}} = 0$, $\lambda_2 = 0$, $\lambda_3 = 0$ or $\lambda_4 = 0$, to see the influence of each loss on the performance of  DRR.

**Clarity**:
- The paper is overall well written and quite clear. However there is a problem with the labels of the axis and the legend of fig. 6. 
- In Figure 3, you show examples of adversarial example reconstructed that's quite interesting. I'm also very curious about what the reconstruction $x'_{i,j}$ looks like during training, and believe it would be interesting to also plot it, to show if indeed the network is able to disentangle the features.
- You mention L210-211 that the hyperparameters are tuned using a binary search, it's not clear to me what you mean by that ? 

**Significance**:
-  The proposed approach clearly outperforms other similar approach, however the approach introduces many losses and new hyperparameters without a lot of justification on why such loss are important. I believe this could prevent people from using this new method out-of the box, some ablation study could really help the paper have more impact.
limitations_and_societal_impact: Yes
review_title: null

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: The paper proposes a novel adversarial example detection strategy based on disentangled latent representations. The main idea is that latents are separated into class features and semantic features. Detection then uses the fact that adversarial samples preserve semantics while at the same time changing class according to some victim model. Training is being performed through a sophisticated combination of losses accounting for begin examples and counterexamples. Experimental results on detecting various kinds of attacks on popular datasets show clear improvements over previous methods. The paper also presents an evaluation of an adaptive attack.
main_review: - Originality: The paper presents a novel combination of common ideas to learn disentangled representations for adversarial sample detection. While previous works in this area have investigated traditional (non-disentangling) autoencoders. Related work seems to be sufficiently citied and discussed.

- Quality: The submission appears technically sound and well organized. The method and individual losses appear well motivated and the experimental evaluation is solid. 

- Clarity: 
The paper is generally clearly written. The presence of a few missing connecting words and typos, these generally do not harm the reading flow. However, I found the methodological section a bit harder to follow at first. One suggestion might be to include an example similar to Figure 2 but using images from CIFAR-10 or MNIST instead of x_i or x_j. I also had the impression that the text in the adaptive evaluation was a hastily written and could need a bit of rework to increase clarity. 

- Significance: The experimental setup is sound and the presented results are noticeably better compared to competing approaches. I especially found the AUROC curves impressive. The approach is also reasonably resistant to the adaptive attack presented in the paper.

- Questions:
1) I would be curious to get further insights into the disentanglement quality. Would it be possible to add further results to the paper that visualize disentanglement quality?
2) It is apparent from Figure 3 (b) that DRR does not reconstruct the benign sample well while 1-2 other methods do a reasonable job at this task. Granted that faithful reconstruction is not the main task, I wonder whether the authors could comment on this tradeoff between reconstruction quality of benign (!) samples and detectability of adversarial examples a bit more. At the same time, I understand that  the constructed loss is aimed at reducing the generalization capability of the autoencoder to more easily detect adversarial samples.
limitations_and_societal_impact: The paper includes an adaptive attack in which white-box access to the presented defense mechanism is granted. It would have been great if the paper would also discuss additional limitations of the proposed method (see questions above).
review_title: null

final_score: rating: 5: Marginally below the acceptance threshold
review_content: summary: This paper proposes to detect adversary using learned disentangled auto-encoder. The model can disentangle the class feature and the semantic feature. Class features are easily changed by adversary, while the semantic features cannot. Existing Auto-Encoder cannot disentangle those two types of features, and also has strong generalization ability---high performance on both the adversary and the benign examples, making it hard to detect. Using the proposed disentangled AE, benign example can be reconstructed faithfully while adversary examples cannot. Thanks to the tailored AE, the paper state-of-the-art adversarial detection performance on MNIST, Fashion-MNIST, and CIFAR-10 in most cases.
main_review: Pros:
1. The paper is well motivated by the fact that AE generalize well even under adversary attacks, and propose a novel design to the AE, which disentangles the class features and semantic features, to allow detection of adversary.

2. The paper evaluated on three datasets, MNIST, Fashion-MNIST, and CIAFR-10, over 5 different adversarial attacks. The gain is significant.

3. It is nice to see the method is evaluated under adaptive attacks. The adaptive attacker attacks the detection metric in an end-to-end manner, which is a standard adaptive attack. However, it may be weak due to attacking an auto-encoding task that is high dimension, making the attack less effective, because gradient from multitask (one task for each pixel reconstruction) may cancel out [1].

4. Overall, the paper is clear written.

Cons:
1. Adaptive attack maybe weak. As I mentioned before, auto-encoding task is not a task that is easy to attack due to its high output dimensionality. Thus the author should consider a stronger adaptive attack that attack one component in the model that is less high dimension. For example, instead of attack End2Eend, we can attack the individual component of the defense model, if we have that knowledge.  What if the adaptive attacker attacks(optimizes, corrects) the V model that encode the class feature so that it is the same as the natural label? In this way, the detector should not longer working because class feature is the same as the benign.

[1] Mao et al. Multitask Learning Strengthens Adversarial Robustness. ECCV 2020.


limitations_and_societal_impact:  The authors adequately addressed the limitations and potential negative societal impact of their work
review_title: null

Meta-review: The manuscript introduces a defense against adversarial examples that relies on disentangling representations (here, disentanglement is not meant in the more common sense of feature disentanglement). On the methodology front, a number of concerns were raised about the ability of the approach to scale to larger datasets (where different classes are more likely to be difficult to disentangle). I also note that all experiments are performed on vision datasets. The current evaluation also fails to provide insights into the different hyperparameters introduced. An ablation study was suggested by the authors but not done in the current manuscript. Finally, the adaptive attack was not tailored to the proposed approach but rather simply evaluates an end-to-end attack. This is a good start but the authors did not provide a convincing argument for why it is sufficient in response to a comment raised in the reviews. In particular, given that the approach would involve a threshold should it be deployed in practice, I encourage the authors to provide evidence that a threshold offering sufficient accuracy on normal inputs while detecting adversarial inputs can be found - even in the presence of an adaptive adversary. 
Decision: Reject