Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: The paper shows a causal perspective to the adversarial robustness problem. It creates a graph over content and style variable sets. It identifies the spurious correlation between style and label as the main reason for adversarial examples, and then proposes a method to remove it from the trained model. Experiments on three datasets show that the proposed method is better than two baselines. 
main_review: The paper has a lot of strengths:
* While the relationship between causality and adversarial robustness is often stated, this is the first paper I've seen that formally characterizes it. I like the simple separation of content and style variables that allows this characterization. 
* The paper derives a method based on the graph criterion. I am not sure about all the assumptions used here (e.g., independent gaussians), but at least on the benchmarks reported, the method performs well.
* The authors provide an interpretation of past methods within their framework, which I thought was a nice unifying insight. 

Overall, the strength of this paper is in the formulation of adversarial examples as a causal problem. This provides a different view and motivates better methods for modeling the style-based spurious correlations. My feedback for the authors is:
* Section 3.1: While the theoretical justification makes sense, can you provide a (toy) empirical example to show how the learnt spurious correlation leads to adversarial examples, and not P(x|s)? I get the intuition, but the claim is vague. If you can provide one toy example supporting the claim, it will be stronger.
* Section 3.2: 
 --I do not see how Eqn 5 is derived. Are you using something similar to the triangle inequality for the divergences? In that case, will it be an upper bound. Also I do not think KL divergence supports triangle inequality. So this approximation step seems arbitrary--can you justify it?
 --Does it mean that g and h are the same models? Is there any justification for this choice, besides convenience?
* Section 4.2: Can you provide examples of the kind of adversarial examples that ADA method is robust to, which prior work is not? That will be provide more intuition on what exactly is ADA method capturing. Right now, we see that the accuracy increases but not sure why.


summary_of_the_review: Great paper connecting causality and adversarial robustness
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The work presents a causal perspective of adversarial attacks on image-based machine learning models by studying a causal graph of the adversarial data creation process and highlighting how such a process makes the learned models vulnerable. It argues that the main reason for adversarial vulnerability is the reliance of models on spurious correlations between labels and style. Accordingly, it proposes a method to learn models for which the conditional distribution of label given style and image does not vary much when attacked. Empirically, the method is shown to be more robust than two baselines on three datasets.
main_review: The work provides a plausible causal representation of the adversarial attack process and derives a useful explanation for vulnerability. The robust approach derived from their explanation is quite reasonable and is novel to my knowledge. It shows improvement on MNIST, CIFAR-10, and CIFAR-100 datasets. However, the confidence intervals are omitted which makes the results less convincing. 
The choice of comparing against only two baselines, Madry and TRADES, can be better motivated, especially since many alternative methods exists. Consider comparing against the top performing method from RobustBench (https://robustbench.github.io/).
Scope of the analysis is not well defined. The types of adversarial attacks, types of classifiers, and types of data are not specified, and implicitly assumed to be image-based neural networks. 
The description of the causal graph makes it hard to understand that two processes are being represented - the natural data distribution and its relation to the distribution of images constructed from adversarial attack for a given classifier(s). The robust learning method based on adversarial alignment is not explained well and involves choices that are unjustified. Statements on relationship of the proposed method to Madry et al. 2017 and Zhang et al. 2019 are imprecise.
 
 
# Related work

Admittedly the literature on this problem area is vast, however, the following two related works will be important to discuss.
A causal graph motivated adversarial learning approach is proposed in Heinze-Deml and Meinshausen 2021 (Conditional variance penalties and domain shift robustness. Machine Learning https://link.springer.com/article/10.1007/s10994-020-05924-1). The graph has core (content) and style nodes although it is different from the one proposed in this work.
The relationship between causal and adversarial approaches to robust learning was discussed in Bühlmann 2020 (Invariance, Causality and Robustness. Statistical Science https://arxiv.org/abs/1812.08233). The discussion is for a different causal graph where X causes Y and different type of adversarial perturbations that are unbounded, however, the work is related as it also gives a causal interpretation to robust learning.
Although non-causal in motivation, other robust learning work has also identified spurious correlation between labels and style features as reason for lack of generalizability. For example, see Sagawa et al. 2020 (Distributionally Robust Neural Networks for Group Shifts. ICLR https://arxiv.org/abs/1911.08731). Consider discussing this line of work into out-of-distribution generalization.
 
 
# Questions that I would like the authors to respond to:
 
What is the scope of domains for the proposed causal graph in Figure 1? Is it applicable to image or any high-dimensional data problems? Please specify the problems for which this causal graph is suitable. The graph makes unstated assumptions like Y is an effect not a cause of C (i.e. anti-causal learning) which should be motivated in context of some problem domains.

Why should the adversarial distribution be a result of an intervention on some causal graph, where the graph is shared with the one generating the natural distribution? This assumption does not seem necessary as the defintion of adversarial perturbation E_adv in Eq (2) does not rely on the causal graph. Please clarify if this is not a limiting assumption.

What are type of adversarial attacks are in scope? This should be specified beforehand. The argument about origin of adversarial vulnerability relies on the assumption that conditional distribution of style P(s | X) does not vary much with adversarial attacks. However, some attacks change the image drastically such as ones that add image patches. 
 
 
# Questions below are minor and do not seriously affect my review:

Can you test your hypothesis that spurious correlation between labels and style features is the reason for adversarial vulnesrabitliy such as by studying known attacks? This will provide more evidence to the analysis of the assumed causal graph.

The relation between the two causal models \mathcal{M} and \mathcal{M}_adv is not clear. Mention the specific hard or soft intervention that results in the latter one like do(E\sim E_adv).

On the specific way of constructing adversarial distribution in Eq (2), the X and E are added instead of any other general function. Please state if this is a necessary assumption.

Can you comment on the order of the standard deviations for numbers in Table 1, 2, 3? Ideally, these should be included in Appendix even if small.
 
 
# Suggestions for improving the writing:

The statement claiming that objective in Eq. (7) is same as in Madry et al. 2017 for \lambda and \gamma equal to 0 is incorrect. The objective in Madry et al. solves a min-max problem maximising loss over perturbations of natural data points. Similarly, TRADES Zhang et al. 2019 also has a term containing maximum loss over perturbations.

The term nuisance factors is used in Sections 1,2 without defining it until later using the style features. Consider briefly mentioning an example of nuisance factors early on.

The term integrated representation s(X) in Eq (6) is not clear. Please give an example of such a function.

I did not understand how Footnote 3 is an explanation for ignoring dependence between C and S. Even if the relation is not causal, it can be modelled as correlation exists based on the causal graph.
 
Relationship with the work of Ilyas et al. 2019 on the origin of adversarial vulnerability can be moved to the main text from Appendix F as it is important to highlight what additional insights does a causal perspective provides. 

Consider mentioning the omitted explanation for change in P(Y | \tilde{X}, s) since the path from S to Y given \tilde{X} is open due to conditioning on a child of the collider X.

Sum notation in Eq (3) should clarify that \mathbb{S} is discrete.
 
The remark from Gopnik et al. 2004 in the Introduction can be made more precise to the specific experimental conditions of that work instead of a claim for all of human cognition.
summary_of_the_review: The paper undertakes an original approach to studying the important problem of adversarial vulnerability. However, the description of the method, its design choices, and evaluation requires improvement. That said, the results are quite encouraging and authors should provide more evidence for their hypothesis on reasons for adversarial vulnerability and test their method against stronger baselines.

---
After the response

Most of my concerns have been adequately addressed. The description of the method needs further clarification. I would encourage authors to clarify the choices made in Appendix A. Given that the approach to adversarial robustness is novel, empirically useful, and potentially will inspire further work, I have substantially improved the score and leaning towards a recommendation to Accept.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: This paper presents a causal perspective on addressing adversarially vulnerability. It first constructs a causal graph, which then inspires the design of the distribution alignment method for reducing the gap between adversarial and natural data. Extensive experiments on CIFAR10, CIFAR100, and MNIST demonstrate the robustness of the proposed method against various attack methods.
main_review: Strengths:
* This paper provides a new perspective on analyzing adversarial robustness and it is novel for me.
* This paper is well organized and easy to follow.
* The distribution alignment method inspired by theory shows good robustness

Weakness:
* I noticed the Natural accuracy on CIFAR-10 and CIFAR-100 can sometimes be worse than TRADES and Madry. Given the trade-off between natural and adversarial accuracy is adjustable, it would be good to adjust the trade-off to see if the proposed method can simultaneously surpass TRADES in terms of both natural accuracy and robustness.
* How to select the hyper-parameters $\lambda$, $\beta$ and $\gamma$. Are they sensitive? Are they consistent among different datasets?

Detail comments:
* First paragraph of Page 9, "we report robust accuracy of WRN-34-10 trained with CIFAR10 dataset on Auto-Attack, Madry: 49.58%, ADA-M: 51.56%, TRATDES: 52.46%" TRATDES --> TRADES
* Some "Mardry" should be "Madry"
summary_of_the_review: I enjoy reading the analysis of the paper. This new perspective is novel to me and I would tend to accept this paper. If the author can address my concerns on the experiments. I would be more convinced.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: This paper proposes a causal graph to model the generation process of adversarial attacks. Based on the proposed causal graph, the authors identify the origin of adversarial vulnerability as the spurious correlation between style variable and class label. Under the adversarial distribution, such spurious correlation can be maliciously used to mislead a victim model. In this light, the authors propose a method to align the adversarial distribution and the natural distribution to prevent a model from learning spurious correlation. The proposed method is empirically validated on prevailing datasets under several attacks.
main_review: Strengths
1.	Overall the paper is well written and easy to follow.
2.	The proposed causal graph well models the generation process of adversarial attacks and sheds new light on how to understand and defend against attacks from a causal perspective.
3.	The proposed approach is novel and well-motivated. 
4. The authors empirically validate the proposed method using several attacks on prevailing datasets.

Weaknesses
1.	In experiments, the current version only compares with SOTAs using attacks with 20 iterations. It would be helpful if attacks with more iterations are employed as the performance of some defense techniques is shown to drop significantly when the number of attack iterations increases.
2.	Some technical details may need to be clarified. See my questions below.

Questions
 1. In the first term of Eq 4, the authors aim to minimize the divergence between $P(Y|X)$ and $P_{\theta}(Y|\widetilde{X})$. As  $P_{\theta}(Y|\widetilde{X})$ cannot be formulated analytically, the authors introduce $Q_{\theta}$ as an anchor and minimize $KL(P_{\theta}(Y|\widetilde{X})||Q_{\theta}(Y|\widetilde{X}))$ and $KL(P(Y|X)||Q_{\theta}(Y|X))$ instead. However, from my perspective this objective only optimize the anchor instead of pushing $P_{\theta}(Y|\widetilde{X})$ towards $P(Y|X)$, if I am not mistaken.

2. How to connect $g$ and $h$ by sharing the same representation?  It seems that $g$ is a linear function while $h$ is supposed to be parameterized by a neural network.

3. In Eq 8, why $\hat{s}(X)$ can approximate $s(X)$? It seems that there is no supervision signal to ensure this point.

4. If $\hat{s}(X)$ is the integrated representation of both $s$ and $x$, as mentioned in the paper, are $\hat{c}(X)$ and $\hat{s}(X)$ supposed to be independent when $x$ is given?

It would be helpful if these questions can be addressed.

summary_of_the_review: Given the strengths listed, I tend to accept this paper. I suggest the authors concern the questions listed to be addressed.
review_title: null

Meta-review: The paper shows a causal perspective to the adversarial robustness problem. Based on a causal graph of the adversarial data creation process, which describes the perceived data as a function of content and style variables, the authors identified that the spurious correlation between style and label is the main reason for adversarial examples. Based on this observation, they propose a method to learn models for which the conditional distribution of label given style and image does not vary much when attacked. Experiments on MNIST, CIFAR-10, and CIFAR-100 datasets show that the proposed method is better than two baselines, Madry and TRADES.

Overall, the paper contains interesting ideas and tackles an important problem. Due to some concerns regarding the clarity and motivation of the paper, we strongly recommend the authors take the reviewers' comments to heart and incorporate their thoughts in preparing the camera-ready version of their manuscript.
Decision: Accept (Poster)