Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The authors aim to reduce the gap between clean accuracy without adversarial training and with adversarial training. To improve the robustness-accuracy trade-off, the authors introduce Helper-based Adversarial Training. The main idea is to use adversarial examples $\mathbf{x}_{\text{adv}} = \mathbf{x} + 2 \mathbf{r}$, where $\mathbf{r}$ is standard PGD adversarial perturbation, as helper adversarial examples. The model is trained to classify these helper adversarial examples as the adversarial label predicted by the model trained without adversarial training. In the experiments, the authors show that HAT improves clean accuracy and robust accuracy on CIFAR-10 and CIFAR-100 datasets when compared with TRADES defense.
main_review: ### Strengths:
- Extremely simple method, which can be useful for practitioners.
- A slight improvement over baseline defences on CIFAR-10 and CIFAR-100 datasets.

### Weaknesses:
- The method is based on intuition and the authors didn't provide any theoretical justifications for the proposed defence. Based on my intuition, I believe the method is fundamentally flawed as its assumptions are incorrect. For example, it is incorrect to assume that all adversarial examples with perturbations $2 \epsilon$ should be labelled with its adversarial label.
- The authors should compare the robustness of their method for moderate size perturbations as well, e.g. $\epsilon = 12/255$ and $\epsilon = 16/255$ on CIFAR-10 and CIFAR-100. It is quite likely that their method will be less robust for moderate size perturbations.
- The overall procedure is ad-hoc and requires training and storing the model trained without any regularization first. The model is then finetuned with the proposed training procedure.
- Some references are missing and the comparison is outdated. The method should also be compared with [1], [2] and [3] defenses, which improve upon Trades defense.
- The experimental comparison can be improved. The authors evaluated the models with AutoAttack. The authors can also compare their method against GAMA [4] attack. The authors should also include the gradient masking checks in the experimental results or at least discuss gradient masking.

[1] Amirreza Shaeiri, Rozhin Nobahari, and Mohammad Hossein Rohban. Towards deep learning models resistant to large perturbations. arXiv preprint arXiv:2003.13370, 2020.

[2] Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankanhalli. Attacks which do not kill training make adversarial learning stronger. In International Conference on Machine Learning, pp. 11278–11287. PMLR, 2020.
[3] Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. Advances in Neural Information Processing Systems (NeurIPS), 2020.

[4] Gaurang Sriramanan, Sravanti Addepalli, Arya Baburaj, and R Venkatesh Babu. Guided Adversarial Attack for Evaluating and Enhancing Adversarial Defenses. In Advances in Neural Information Processing Systems (NeurIPS), 2020.

### Update after the author's response
The authors addressed all my concerns. In particular, the authors:
- Added adversarial robustness results with $\epsilon = 12$.
- Added adversarial robustness results with other attacks.

Overall, based on the new results for the larger perturbations and the author's comments to other reviewers, I am discarding my doubts about the paper's approach, that it is somewhat ad-hoc. I believe the empirical contributions of this work are significant and novel. Therefore, I recommend accepting the revised paper.
summary_of_the_review: The authors proposed a simple technique to improve clean accuracy. However, the method is based on intuition, which in my opinion, is flawed: not all large perturbations should be labelled with its adversarial label. The authors should provide a theoretical justification for their intuition. Besides that, the experimental comparison is outdated with few recent defenses missing, which improve upon TRADES defense.

### Update after the author's response
I sincerely thank the authors for addressing the majority of my comments and concerns. The experimental results are undeniable and clearly demonstrate the advantages of the proposed technique. Based on the new results for the medium perturbation $\epsilon = 12$ and additional experiments with other attacks, I tend to overlook my doubts about the paper's approach.

I recommend accepting the revised version of the manuscript.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper highlights the presence of excessive invariance in the prediction of robust models along the initial adversarial directions. Initial adversarial directions refers to the directions in which adversarial images generated using a standard trained model are present. Based on this hypothesis the authors propose a training method where the excessive invariance is minimized using the cross entropy loss between the prediction(made using the standard trained model) of larger epsilon adversarial image and the prediction of the adversarial image, in addition to the TRADES loss formulation. This additional loss term indeed improves the accuracy-robustness trade-off by giving a significant boost in clean accuracy along with a slight boost in adversarial robustness as compared to the existing methods. Overall the paper is well written and easy to follow.
main_review: Strengths:
* The paper is well written and easy to understand. The motivation behind the design choices is clear. All the related works are properly addressed and the baselines are also strong.
* The paper achieves a significant boost as compared to existing methods on strong attacks like Auto-Attack. The approach shows consistent gains across multiple datasets.

Weaknesses:

* I think the results shown in Figure-4 are quite expected as initially when the perturbations are generated from a standard trained model, they will be non-smooth similar to random noise. Thus the final model will have high invariance to the directions of these random noise as compared to the perturbations which are smooth in nature and have features. These smoother perturbations would be generated by the adversarially trained models and thus the model would be easily fooled as we go in the direction of these perturbations. This is addressed by the Final Margin of figure 4-c. Although the proposed approach reduces the invariance in the directions of the initial perturbations which are similar to random noise, (as shown in table 1, 5 and stated in section 3), I think ideally the model should focus on reducing the invariance in the direction of smooth perturbations which have semantic features. Could the authors clarify a bit on this. I dont think it would matter much if the model will reduce the invariance in the directions of initial perturbations(similar to random noise) since they won't change the semantics of the image to some other class image. While the smooth perturbations which have some semantics and are generated using an adversarial model have the potential to change the semantics of an image and thus change the true class of the image as well as shown in [1] and thus it is desired to reduce invariance in these directions.

Some minor concerns:

* Could the authors clarify how they plotted the class boundaries in figure 3? I think this is plotted by examining the predictions of all the points possible in the 3D space?
* In table 5 it is shown that the models are trained so that they have the same robustness. I think this is not a good idea for an ideal comparision. Could the authors show the same table with the median margin in R-init , R-5 and R-15 where the models do not have any constraint on having the same robust accuracy. If possible could the authors share the results of table-1 for R-5 and R-15 also.
* I think the training budget for the results reported in Table 6 is only 50 epochs. If possible could the authors share the results of HAT for all three datasets for 200 epochs training budget? This will help in better understanding the proposed approach. I think the activation used without additional data is ReLU. If this is true could the authors also share the CIFAR10 200 epochs without additional data results for SiLU activation. In case the authors have used SiLU can they share the results with RelU.
* If possible could the authors share the PRN18 and WRN-28-10 for CIFAR10 and CIFAR100(if possible) results as shown in table 4 using the ReLU activation? This would help in understanding the influence of SiLU activation.
* An ablation study on using different perturbation bounds for getting the helper label in Algorithm-1 can also help a lot in better understanding the proposed approach.

[1] Tramèr, F., Behrmann, J., Carlini, N., Papernot, N., & Jacobsen, J. (2020). Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations. ArXiv, abs/2002.04599.
summary_of_the_review: Overall I think the paper is well written. It shows a significant boost as compared to existing art and has some minor issues at present.
If the concerns are properly addressed I am willing to increase my score.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: **Few sentences summary**: the paper proposes a new training loss for adversarial training in the Lp-norm setting. Based on the observation that adversarial training increases the classification margin in a disproportionate manner compared to the nominal training setting, the authors introduce additional samples called "helpers" to reduce the classification margin. The helper samples, which are samples translated further away in the worst adversarial direction, can change labels compared to the adversarial samples. Helper samples get assigned labels from a standardly trained model, thus acting as a constraint coming from this standardly trained network.

Regarding the **results** and **contributions**:
* Novel method using helpers to define a new training loss for adversarial training.
* On par or better results in robust accuracy compared to the SOTA training loss TRADES on CIFAR-10/100, SVHN, TinyImageNet and a subset of ImageNet.
* Much improved results in clean accuracy compared to TRADES, thus reducing the gap between clean and robust accuracy which is primordial for the application of Lp norm models to practical uses.
* Clear analytical tools based on the margin analysis to investigate the proposed method and how/why it works.
main_review: **Strengths**:
* Clean, original and novel idea leading to good experimental results. Very well written paper with a clear story, with clear arguments and experiments to support the story.
* Very extensive experiments in the main paper and in the appendix. It gives a lot of intuitions about the problem and Lp-norm robustness in general.
* The proposed analytic tools are useful beyond the analysis of the proposed algorithm. Big plus for the toy problem giving interesting intuitions, the margin analysis in Figure 4 and the per epsilon analysis in Figure 6.
* The code is attached in the supplementary materials and anyway, the experimental details and code are very well described in the paper. Hence, the paper seems reproducible.

**Weaknesses/Suggestions/Questions**:
1) In the bullet points in page 2 and other parts of the paper, please specify when the accuracy is the "clean" or "robust" accuracy. Otherwise, there is an ambiguity.
2) It would be great to see how the proposed method performs compared to TRADES on larger models such as WRN-70-16. Maybe by fine-tuning an already pre-trained model to avoid expensive computations.
3) In Figure 6, maybe specify that the variable $\epsilon$ on the x-axis is used for the test-time robust accuracy and not the training procedure.
4) In Figure 13 in the appendix, why do the curves TRADES and HAT ($\gamma=0$) do not match while they are the same method? Is the difference due to the variance in the results?
5) (Very optional but curious to check) I would be curious to see the performance of an alternative helper: $x' = x + r + r'$ where $r'$ is the adversarial perturbation computed at $x + r$. In this way, helper samples could possibly look more "natural" rather than when using $x + 2r$, thus possibly improving the final results. It would require twice as more computations but would be interesting to check.
summary_of_the_review: Paper enjoyable to read with extensive experiments supporting a clear and novel idea leading to improved results. The authors also propose great analytical tools to investigate their hypothesis. Hence, I vouch for acceptance.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper proposes a helper-based adversarial training (HAT) method to alleviate the trade-off between robustness and accuracy. Empirical evaluations are done on several datasets, and under AutoAttack and common corruptions.
main_review: Strengths:
- The writting is easy to follow, while the illustration of the idea of HAT is clear and reasonable.
- I especially admire the empirical evaluations in this paper, which involve large-scale experiments using DDPM generated data and 80M TI extra data. The improvements are significant, and the sanity check for, e.g., gradient masking is also presented.

Weaknesses:
- The modifications introduced in HAT are simple (which is good), but they depend on an assumption that ``the model should not be robust beyond the threat model``. Namely, under an 8/255 $\ell_{\infty}$-norm threat model, an adversarial example with 16/255 perturbation is encouraged by HAT to fool the model, while the label of the adversarial example may not change. For me, this assumption is quite ad-hoc, and introducing another standard model $f\_{\theta\_{\textrm{std}}}$ seems not an elegant solution.

In conclusion, I think the pros and cons of this paper are quite clear. Strong empirical evaluations and promising improvements, but the method itself is somewhat ad-hoc and not very principled. So I would like to recommend an acceptance, but the method could be further polished.

summary_of_the_review: Strong empirical evaluations and promising improvements, but the method itself is somewhat ad-hoc and not very principled.
review_title: null

Meta-review: The authors propose a simple addition to adversarial training methods that improves model performance without significantly changing the complexity of training.  The initial reviews raised some questions about whether experiments were sufficiently extensive, but these issues were resolved during the rebuttal and discussion period, resulting in a strong consensus that the paper should be published.
Decision: Accept (Poster)