Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper investigates the robustness of stochastic neural networks against adversarial attacks. To that end, it derives a sufficient condition on the robustness in terms of the decision margin, the gradient norms, and the angle between the decision boundary and the perturbation vector. The sufficient condition holds for linear and L-smooth classifiers and the paper provides some intuition as to why the conditions should generalize to arbitrary networks. The condition confirms various empirical approaches trying to improve robustness: more samples increase the attack performance, reducing the gradient variance and expected value increase the network’s robustness, and the number of samples used for inference is largely irrelevant.
strengths_and_weaknesses: The paper provides a novel theoretical perspective on the robustness of stochastic neural networks. It derives a sufficient condition on the robustness in terms of the decision margin, the gradient norms, and the angles between the perturbation vector and the decision boundary. As a consequence, the paper can analyze the influence of the different terms, which have been empirically used to increase robustness in prior work, on the robustness of neural networks. Thus, the paper presents a unified view of the robustness of stochastic neural networks, which can be useful for future research in this area.

Some typos:

- Line 97: the input *is* stochastic
- Line 269: theaccuracy -> the accuracy
- Line 271: many -> Many
- Caption of Table 1: correspondinggradient -> corresponding gradient
questions: What are the implications for randomized smoothing methods aimed at increasing the certified robustness of neural networks?
limitations: The paper addresses the potential negative societal impact.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper drives a sufficient condition for the robustness of stochastic neural networks (SNNs). The theorems show that SNNs can classify adversarial examples correctly if the angle between adversarial perturbations and gradient of the inference estimate of SNNs satisfies specific properties. These theoretical results imply several strategies for attack and defense for SNNs.
strengths_and_weaknesses: Strength:
+ This paper gives a theoretical condition to show when SNNs can classify adversarial examples correctly. 
+ Most parts of theorems and proofs are well-written and clear for understanding.
+ Empirical results are aligned with the theoretical results.

Weakness:

- Missing information in theorem 4.1: $c \neq y$ is used in proof but not in Theorem 4.1.  Supplementary material defines $\alpha$ in line 29, but Theorem 4.1 does not describe it.

- I think the theorems discussed in the paper are a bit too general and do not go deeper inside the design of SNNs from a probabilistic perspective:  The estimate used for attack and the estimate used for inference could be arbitrary two models with different decision boundaries.
It would be interesting to discuss more on how some properties (like the number of realizations) of SNNs influence the adversarial classification.

- A type of related work is not well discussed: Random smoothing is a popular certified defense method and could be also treated as a type of SNN. (Random variables only change the input and do not influence the weight). It would be good to mention and discuss how random smoothing fits into the proposed theory. 

questions: 1. How is random smoothing related to the implications on SNN?
limitations: Yes
review_title: null

final_score: rating: 3: Reject: For instance, a paper with technical flaws, weak evaluation, inadequate reproducibility and incompletely addressed ethical considerations.
review_content: summary: The authors study the adversarial attacks for stochastic classifiers. The attacker has the disadvantage of not knowing the exact direction of the attack since the hypothesis is a random variable and it would change randomly every time that it is queried. It has been observed that increasing the sample size would decrease the attack success rate, which goes against intuition on its face.

A sufficient condition for the robustness of the stochastic classifier against the calculated attack is proposed. Based on this condition, we can identify the factors that lead to an increased robustness of stochastic classifiers: 
1- Larger expected prediction margins 
2- A smaller expected norm of the gradient estimates 
3- Higher angles between the attack direction and the direction to the closest decision boundary during inference.

The observed angles depend inverse proportionally on the norm of the expected gradient and proportionally on the variance of the gradient estimates. This variance can be reduced by increasing the sample size. The authors proposal explains the previously reported empirical findings for SNNs from a geometrical perspective, that the robustness of SNNs is higher than the robustness of their deterministic counterparts even for strong attacks that are based on several samples, why regularization of the gradient variance, norm of the mean gradient, and angle improves the adversarial robustness, and why increasing the sample size during attack is important to exploit its potential.
strengths_and_weaknesses: - Originality:
The paper tries to bring insight on the phenomenon from the perspective of stochastic classifiers. The proposal is positioned as an explanation for the already observed aspects of the phenomenon is SNNs. From the three proposed conditions of robustness, large margin and the mean gradient norm are already studied in the literature. The angle is unique to the stochastic setting, and is the main result of the paper.

- Quality:
The authors have made the claims rigorous. The theorems and the results are intuitive enough. I have not read the supplementary material and the proofs. Nevertheless, the proposal lacks an analysis of the convergence of the classifiers in derivatives. The observations could be trivially explained if we assume that the derivatives of the trained SNNs have not converged in probability, or that the convergence is pointwise.

- Clarity:
The intuition behind the proposal is clear.

- Significance:
This is the my main concern with the paper. The main object of study in the paper is only definable for stochastic models. Consequently, it cannot be a good foundation for more general settings. It would be of help if the authors describe the proposal from the perspective of convergence in learning theory.
questions: What is the difference between a robust stochastic model and an stochastic model that have not converged in its derivatives?
limitations: The authors make a good effort to describe the limitations. However, they have not included the learning theory aspects of the phenomenon. The proposal is also positioned as an explanation for observations, where as it is more likely that the observations are not causally related to the phenomenon.
review_title: null

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: The authors perform a systematic study on the robustness of stochastic neural networks (SNNs). They make several theorectical corollaries: 1) In order to increase the probability of a successful attack against a SNN, the attacker need to increase the amount of samples to estimate the gradient. 2) The defender need to increase gradient variance and decrease the norm of the mean gradient, in order to improve the robustness of a SNN. 3) The robustness of a stochastic classifier does not depend on the amount of samples taken during inference.
The authors also conuduct extensive experiments on Fashion-MNIST and CAIFAR-10 datasets to emperically verify the correctness of these corollaries.
strengths_and_weaknesses: Strengths: The paper is written with good clarity and easy to follow. It also provide valuable theoretical insights on the robustness analysis of stochastic neural networks. The theoretical corollaries are well supported in the experiments.

Weaknesses: The datasets used in the experiments are relatively small. 
questions: The paper "Certified Adversarial Robustness via Randomized Smoothing" uses randomized smoothing to provide a robustness certificate for a neural network. A neural network with randomized smoothing can be seen as a type a stochastic neural network. How can Theorem 4.1 and Theorem 4.2 be used to certify robustness for a neural network with randomized smoothing? And how is it related to the robustness certificate in the paper "Certified Adversarial Robustness via Randomized Smoothing"?
limitations: They discuss the limitations and potential negative societal impact of their work in section 4 & 6.
review_title: null

Meta-review: metareview: All reviewers agree this paper studies an important problem and presents a principled analysis for robustness of SNNs. Empirical results, though limited, seems to be complementing the analysis well.  One reviewer rated the paper negatively. I find their concerns to be well addressed in the rebuttal phase. Overall this a borderline paper. I am suggesting acceptance and ecourage authors to update the draft to address all the reviewers comments.
confidence: Less certain
Decision: Accept