Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 3: Weak Reject
review_content: This paper studied the effectiveness of Conditional Entropy Bottleneck (CEB) on improving model robustness. Three tasks are considered to demonstrate its effectiveness; generalization performance over clean test images, adversarially perturbed images, and images corrupted by various synthetic noises. The experiment results demonstrated that CEB improves the model robustness on all considered tasks over the deterministic baseline and adversarially-trained classifiers. 

The proposed idea is simple, easy to implement, and generally applicable to various classification networks. I especially enjoyed the nice experiment results; indeed, it has been widely observed that many existing approaches on adversarial training sacrifice the classification performance to improve the robustness over adversarial examples [1]. The proposed approach sidesteps such a problem since it does not require adversarial retraining. It is surprising to see that the proposed method is still able to achieve stronger robustness than the models based on adversarial training.

One of my major concerns is that it has a large overlap with Fischer (2018) in terms of methodology, experiment settings, and empirical observations, which limits the general contribution of the paper. Fischer (2018) first proposed CEB objective and showed its effectiveness in various tasks, including the adversarial defense. Although this paper extends the results on adversarial defense to CIFAR 10 dataset and includes additional ablative experiments and experiments on other types of input noises, it ends up confirming very similar observations/conclusions in Fischer (2018). Although Fischer (2018) is an unpublished work, I think that it is fair to consider that as a prior work since it is properly cited in the paper.   

My other concern is that the experiment misses comparisons against other adversarial defense approaches, which makes it difficult to understand the degree of robustness this model can achieve. The current comparisons are mostly focused on deterministic and VIB baselines, which are useful to understand the core argument of the paper, but insufficient to understand how useful CEB could be in the purpose of adversarial defense. Especially, I believe that some recent approaches that do not require adversarial training, such as [A2], are worth comparisons.  

Below are some minor comments/questions on the paper.
1. Section 3.2: For this experiment, BN is removed from the classification network; it would be still beneficial to see the baseline performance with BN (deterministic model) to better compare the classification performance on clean test data.
2. Section 3.3: The performance on both baseline and the proposed model on clean data is far lower than the SOTA models. Some clarification would be helpful.
3. It would be great to see further clarifications of improvement in CEB over VIB; currently, it is very simply justified that it is because CEB optimizes tighter variational bound on Eq.(3) than VIB. But it would also be great to see justifications from various angles (e.g. in the context of adversarial defense).  

review_title: Official Blind Review #1

final_score: rating: 3: Weak Reject
review_content: The paper modifies existing classifier architectures and training objective, in order to minimize "conditional entropy bottleneck" (CEB) objective, in attempts to force the representation to maximize the information bottleneck objective. Consequently, the paper claims that this CEB model improves general test accuracy and robustness against adversarial attacks and common corruptions, compared to the softmax + cross entropy counterpart. This claim is supported by experimental results on CIFAR-10 and ImageNet-C datasets.

In overall, the manuscript is easy-to-follow with a clear motivation. I found the experimental results are also promising, at least for the improved test accuracy and corruption robustness. Regarding the results about adversarial robustness, however, it was really confusing for me to understand and validate the reported values. I would like to increase my score if the following questions could be addressed:

- It is not clear whether adversarial training is used or not in CEB models for the adversarial robustness results. If the results were achieved "without" adversarial training, these would be somewhat surprising for me. At the same time, however, I would want to see more thorough evaluation than the current, e.g. PGD with more n, random restart, gradient-free attacks, or black-box attacks.
- I wonder if the paper could provide a motivation on why the AutoAug policy is adopted when training robust model. Personally, this is one of the reasons that makes me hard to understand the values presented in the paper.
- Figure 3, right: Does this plot indicates that "28x10 Det" is much more robust than "28x10 Madry"? If so, it feels so awkward for me, and I hope this results could be further justified in advance.
- Figure 3: It is extremely difficult to understand the plots as the whole lines are interleaved on a single grid. I suggests to split the plots based on the main claims the paper want to demonstrate.
- How was the issue of potential over-fitting on rho handled, e.g. using a validation set?
- In general, I slightly feel a lack of justification on why the CEB model improves robustness. In Page 5: "... Every small model we have trained with Batch Normalization enabled has had substantially worse robustness, ..." - I think this line could be a critical point, and need further investigations in a manner of justifying the overall claim.
review_title: Official Blind Review #3

final_score: rating: 6: Weak Accept
review_content: TITLE
CEB Improves Model Robustness

REVIEW SUMMARY
As a thorough empirical evaluation of a new method for training deep neural networks, this paper is a useful contribution.

PAPER SUMMARY
The paper presents an empirical study of the robustness of neural network classifiers trained using a conditional entropy bottleneck regularization.

CLARITY
The paper is well written and easy to follow. Results are presented in a way that gives the reader a good overview, but figure quality / legibility could be improved.

ORIGINALITY
The CEB method is an original (but minor) modification of a well known method. 

SIGNIFICANCE
The primary contribution of the paper is a thorough experimental evaluation of the particular regularization method presented in the paper. While this is certainly useful, it would have been even better with more comparison with other regularization methods. The paper clearly demonstrates the benefits of CEB, which is of interest in itself.

FURTHER COMMENTS
Consider making a more clear distinction between generalization and robustness.
"are are" Double word.
"all machine-learned systems...highly vunerable" Too strong statement.
"VIB" Abbreviation not defined in the text.
Figure 1, 2 and 3 are a bit hard to read (especially the dotted lines)


review_title: Official Blind Review #2

Meta-review: This paper proposes CEB, Conditional Entropy Bottleneck, as a way to improves the robustness of a model against adversarial attacks and noisy data. The model is tested empirically using several experiments and various datasets.

We appreciate the authors for submitting the paper to ICLR and providing detailed responses to the reviewers' comments and concerns. After the initial reviews and rebuttal, we had extensive discussions to judge whether the contributions are clear and sufficient for publication. In particular, we discussed the overlap with a previous (arXiv) paper and decided that the overlap should not be considered because it is not published at a conference or journal. Plus the paper makes additional contributions.

However, reviewers in the end did not think the paper showed sufficient explanation and proof of why and how this model works, and whether this approach improves upon other state-of-the-art adversarial defense approaches.

Again, thank you for submitting to ICLR, and I hope to see an improved version in a future publication.
Decision: Reject