Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 5: Marginally below the acceptance threshold
review_content: summary: The paper proposes a two phase non-iterative approach for efficient training of robust models. 

The first phase is a distillation phase which trains a neural network while enforcing the gradients of the loss w.r.t. to the input image of the student network to be indistinguishable to that same gradient for the teacher network with the goal of enforcing the saliency maps of the teacher and student networks to be “similar”. In addition to the binary cross-entropy GAN-type loss, the paper also explicitly promotes the two saliency maps to be similar by adding an $\ell_2$ regularization on their differences. 

The second phase, which is called model refinement, is a curriculum learning based adversarial training fine-tuning step. At every step of this phase, the attacker is limited to only perturbing the top X% of pixels from the teachers saliency. As training progresses, the attacker is more limited (i.e., X gets smaller). 
main_review: The problem considered is an important problem and a well motivated problem: How can we efficiently train a robust network which maintains high natural accuracy? The authors have done a good job in phrasing and motivating the problem. The empirical results reported look good. However, I do have some intuition/theoretical questions. 

One of the main premises of the paper is that it achieves robustness very fast (efficiently) since it is a non-iterative method/compared to iterate methods. However, given that during the first phase, the best performing models of this methods utilize iteratively trained robust networks trained on the same dataset (from Tables 3, and 4), it seems like that this method should either contain a phase 0: adversarially train a robust network, or, the claims should be a bit toned down to efficiently improving robustness of robust networks. And for the later case, the method would have a better / fairer comparison if compared to other methods which are based on either pertaining and transfer learning. 

The first phase of this approach seems pretty complicated and while it has motivation, it leaves me with many questions:
1- Why do we need both L_diff and L_robust for the alignment loss? From the paper (line 163), the global minimum of L_robust is achieved when the saliency maps match, which implies that L_diff is indeed what is needed. I do wonder that, from a theoretical point of view, what does L_robust do? 

2- point 1 even pushed further, why do we need phase 1 completely? Doesn’t using the teacher model (specially for cases where the teacher is trained on the same dataset as the student), result in minimum loss for the first phase? If we drop the first phase, then the second phase is similar to a LwF penalty added to robust training. 

3- what is the value of loss for each of the terms after phase1 as completed? What would the value of loss be if we simply plug the Madry WRN32-10 robust net for CIFAR-10?

For the second phase, the curriculum learning is designed to make the attacker weaker, which intuitively *may* result in lower robustness (but at the same time may be beneficial for natural accuracy), do the authors have an intuition why gradually making the attacker weaker during training, can result in an improvement in robustness? 
Also, what is the intuition behind still using the teachers saliency? The saliency consistency regularizations for phase 2 resembles the learning without forgetting loss --  It seems like that you refine the net but still maintain the saliency map of the robust net from phase 1 (or phase 0)?

From results in Table1, it seems that for the curriculum based methods, the strongest attacks are ether AA & CW. I wonder, how the CIFAR-100 models (Table2) would do with these attacks? Also, comparing PGD-5, to PGD-10, and then PGD-10 to PGD-20, it seems like the methods robustness may not have yet plateaued under the PGD attack, I do wonder what is the robustness if we increase the number of iterations further? 

Other:
Small typo: In line 124, tern -> term. 
Figure 6 contradicts some recent papers which claim that the saliency maps of robust nets are more aligned with human perception. When going to phase 2 (B) from phase (A), if we are improving robustness, it seems like we are making the saliency map more noisy, any intuition on this?

limitations_and_societal_impact: NA
review_title: null

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: This paper proposes a non-iterative method to improve adversarial robustness. Compared to mainstream AT baselines, the proposed method avoids iterative gradient calculations, so as to be time-saving. By involving attribution maps and perturbing the allowed set of pixels, the proposed method can achieve better performance. After sufficient experiments, the proposed method beats all baselines.
main_review: Pros:

Compared to traditional multi-step AT, this paper has a novel solution Teacher-guided Saliency-based Robust Training and clear explanation. 

The paper conducted extensive experiments to validate the effectiveness of the proposed method, including different datasets, attack methods, and baselines.

This paper has startling performance, especially on natural accuracy in the case of improvement on adversarial accuracy.

Cons:
My most concern is about the organized and written style. 
-The title ”Adversarial Robustness without Adversarial Training: A Teacher-Guided Curriculum Learning Approach” does not fit the insights. 
The method that “Teacher-guided Saliency-based Robust Training” is also a solution of training. By the way, although Adversarial Training is the mainstream to achieve robustness, there are still other ways such as Obfuscated Gradients, “Adversarial Robustness without Adversarial Training” need rethinking.

-The main effect mentioned in the abstract is time-saving, however, there is a Teacher model, and regardless of the training time of the teacher model is unfair. Suggest this paper can reorganize its contribution.

-For adversarial-robust models trained by baselines, it is feasible to use any attack method to test its performance, while too much NA is in the experimental tables, bad for comparison. 


limitations_and_societal_impact: The authors adequately addressed the limitations and potential negative social impact of their work.
review_title: null

final_score: rating: 5: Marginally below the acceptance threshold
review_content: summary: The paper proposes an AT based defense method, which only focuses on the salient image regions to perturb and attack. Saliency is computed from a pertained teacher model; and is gradually reduced during the training (hence the name curriculum learning). A two phase approach is proposed: phase-1 computes the saliency map; and phase-2 generates adversaries by altering the salient pixels only (by gradually reducing the salient pixels from 90% upto 50%). Experiments are given on CIFAR-10/100 and TinyImageNet.

main_review: Can authors validate their assumption that perturbing the salient/foreground image pixels results in quick strong adversaries, by considering a pertained segmentation network, and restricting the perturbations to salient regions, and providing a comparison with perturbing all pixels (vs salient pixels)? 

An underlying assumption is that the model trained using the loss in phase 1 (Eq 13) generates saliency map which can localise the object. I was expecting some visualisations of that. Fig4&Fig7 have a few samples, but they’re too few. Can authors show some more examples in the supplementary? Also, can they quantify (e.g., Jaccard Index) on how good are the generated saliency maps; for a dataset with ground truth segmentation masks?

A major claim of the paper is its compute efficiency. I did not see any comparison with existing AT based defense methods for comparison in terms of compute time; number of iterations required. The proposed method has an additional step (phase-1 of the method), which isn’t the case for most sota AT based defences. A fair comparison is required to substantiate the efficiency claims made in the paper.

limitations_and_societal_impact: Conclusion section of the paper briefly mentions pros and cons of the research.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: The paper proposes a non-iterative adversarial defense. The method trains networks to have similar saliency maps as a teacher model. The authors show empirically that their method outperforms baseline defenses while requiring less training time.
main_review: **Originality**
The method proposed in this paper is similar to other non-iterative adversarial training methods as mentioned by the authors in section 3. The exact methodology differs from prior work, which allows the authors to achieve better results that outperform baselines.

**Quality**
The method is not motivated theoretically, so its effectiveness must be demonstrated through experiments. The experiments are particularly important, since the paper claims to present a state-of-the-art defense. There are some potential issues with the experiments, although they may be resolvable:
1) TRADES has a lower accuracy under AutoAttack in Table 1 compared to what is reported in the AutoAttack paper. Is there a reason for this?
2) How does the proposed method compare to the state-of-the-art defenses on CIFAR-10 (particularly defenses incorporating unlabeled data) reported in the AutoAttack paper (in Table 2 of that paper)? In particular, is the proposed method the state-of-the-art defense on CIFAR-10 for 8/255 $\ell_\infty$ perturbation sizes?
3) The training time and memory consumption of the proposed method vs. baselines do not appear to be quantified anywhere. This is very important to include since computational efficiency is one of the main advantages of this approach.
4) CIFAR and TinyImagenet are good choices for evaluating adversarial defenses. However, training a robust model on ImageNet would be ideal. 
5) Are both the discriminator-based and L2 saliency losses necessary to achieve robustness? In other words, how does the method perform when $\beta=0$ or $\gamma=0$?

Resolving these issues would *significantly* improve the quality of this paper.


**Clarity**
The paper is generally well organized and the writing is clear. Concepts are introduced with the appropriate context and experiments are clearly described.


**Significance**
If the issues with experimental results are resolved, this paper could represent a major contribution to the research community since it can achieve state-of-the-art performance with an order of magnitude lower computational cost than current methods.
limitations_and_societal_impact: The authors adequately describe the impact and limitations of the work in the broader impacts section.
review_title: null

Meta-review: this works achieves adversarial robustness without adversarial training adding a "refinement" phase to a network trained with an alignment loss. The idea of the refinement is to force the model to be robust to perturbations outside of the detected item and is done using curriculum learning using a threshold on saliencies as a mask. Avoiding iterative training allows to significantly lower the computational cost for Sota robustness. 
I think the discussion with reviewer Wty9 highlights well the situation: yet the paper can be considered as an empirical better way to force a NN to focus on the actually important part of an image, empirical evidence is convincing and an ablation study is performed. I'd love a discussion about the existence or not of a difference wrt the robustness obtained with iterative methods.  
Also, adding results on imageNet would improve the paper and mentioning the low variance in the legends of the tables rather than in text would be good.

Decision: Accept (Poster)