Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 8: Top 50% of accepted NeurIPS papers, clear accept
review_content: summary: Reweighting adversarial data has been recently shown to be effective, with larger weights assigned for data closer to the boundaries. Previous work used the LPS to measure the closeness, but the authors suggested that the LPS might not be reliable since they are discrete and path-dependent. To this end, this paper proposed three types of probabilistic margin, which could overcome the drawbacks of the LPS. The probabilistic margins were used to measure the importance of adversarial data, which induced convincing results in experiments.
main_review: Instance-reweighted adversarial training assigns unequal importance for adversarial examples, where data close to decision boundaries are vulnerable to be attacked and should be given with large weights. However, the authors stated that the existing methods measuring the closeness (i.e., LPS) are unreliable and experimentally verified their consequence is non-negligible. In my opinion, it might partially explain why GAIRAT cannot work well regarding advanced attack methods such as CW. 

This paper proposed the probabilistic margin, which is the multi-class margin measured by the model outputs. The margin is a natural measurement of the closeness in SVM, and it is computed in an embedding space with normalization for the sake of the same scale. The modification is well-motivated and partly overcomes the drawbacks in GAIRAT. 

Based on the probabilistic margin, this paper proposed a general framework for instance reweighing learning. MAIL could boost the performance of previous methods (e.g., MART) and can adopt different kinds of probabilistic margins in weighting. 

The authors conducted extensive experiments on various datasets and with different probabilistic margins. MAIL not only outperformed the GAIRAT by a large margin for many attacks (e.g., AA) but also achieved comparable results against many state-of-the-art methods (e.g., MART). 
limitations_and_societal_impact: 1.	The drawbacks of LPS stem from the use of the PGD method, but it seems that the proposed LM-PGD can alleviate some of these drawbacks. Therefore, I think LM-PGD would help calculate the LPS, and it would be great if the authors could clarify, i.e., why is the PM better than the LM-PGD?
2.	Computing the margin in the probabilistic space of the model outputs may look convincing. However, I am curious about the results without normalization, i.e., if the proposal only adopted the embedding features (without softmax as normalization) for weight assignment, how much will the model's performance degrade?
3.	Another little question, I think the authors could describe why the constraint of the sum is required in Eq. 3.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: DNNs are susceptible to adversarial attacks, and AT is an efficacious method in combating this challenging issue. In general, AT creates adversarial examples on the fly, and the DNN is trained to overcome their impacts. 

The paper mainly focuses on the drawbacks of the reweighted AT training. First, the authors state empirically that the LPSs used in previous works are discrete and path-dependent, unreliable for weight estimation. They then propose a novel metric (PM) that overcomes the drawbacks in LPSs and devise three specifications that capture different geometric properties of the data. Next, a weighting strategy uses PMs to develop a new kind of reweighted AT method called margin-aware instance reweighting learning (MAIL).

main_review: ### Originality:
Although the reweighted AT training has been explored in recent studies, the paper claims the drawbacks of their PGD-based metrics in weight assignment. Accordingly, the authors propose three types of PMs, which can be viewed as the multi-class margin in the probabilistic space of model output. There are some novelties as they address the drawbacks in previous works, and the experimental results look pretty convincing to me. 

### Quality:
The paper is motivated by the drawbacks of previous works, and the detailed realizations look technically sound. The experiments are shown on a host of datasets, which are well executed, reproducible, and competitive against state-of-the-arts. 

### Clarity:
The paper is well structured and clearly written. They provide the realization details and the adopted hyper-parameters in a clear way.

### Significance:
They concentrate on the weighted AT training, which is a promising methodology that attracts increasing attention recently. The paper discusses the drawbacks of the PGD-based metrics used in previous works, which would make the training procedure unstable and inaccurate. Further, the proposed solution is relatively new and seems like an acceptable improvement over the previous works. 

limitations_and_societal_impact: The proposed AT method maybe not general to all attacking methods. The main reason is that there is only one attack method used for training. I would be happy to see training the network using other attack methods.

It seems that the GAIRAT, an advanced AT with weighting, does not perform well for the AA attacks in Table 1 and 2. I am curious to know the reason for its inferior results.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: This paper focuses on reweighting adversarial data in adversarial training problems. Actually, how to determine the sensible weights for each adversarial example matters for the adversarial robustness of the trained model. In this way, this paper proposes a new measurement called probabilistic margin, and employs it into multiple baseline methods. The achieved results seem promising. 
main_review: By arguing that the current measurement of "closeness to boundary" is discrete and path-dependent, this paper borrows the tool in margin theory called probabilistic margin (PM) as a more accurate proxy. Then the PM is utilized in multiple baseline methods and achieves better performance. 

However, the utilization of PM seems sort of plain to me. Using PM seems a natural option for various proxies of measurement of "closeness to boundary". More theoretical insights are needed. 

Authors should make further investigations of the formulation of weight assignment. Why do we choose sigmoid in Eq8? 

Instructions of empirical choice of PM_adv, PM_nat, PM_diff are still not clear. What can we draw from the analysis?

-----------------------------------------------------

Thanks for the kind response. After the rebuttal, my concerns are well-addressed. Thus I am happy to raise my score.



limitations_and_societal_impact: Yes
review_title: null

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: This paper propose  three types of probabilistic margin (PM) to improve the model robustness. The proposed method can measure the aforementioned closeness and reweight adversarial data. 
And some experiments were conducted to validate the effectiveness of the proposed method.  
main_review:  This paper have following problems:

1.  the paper lacks comparative experiments with the state-of-the-art methods [1]
 
2.  The robustness improvement is very small. The proposed MAIL-AT achieves lower AA attack accuracy compared with AT [26] in table 2 (44.10% VS 44.90%) .
and MAIL-TRADES only achieves a little higher AA attack accuracy compared with TRADES in Table 3 ( 53.90% VS 53.40%).

3.  The certain baseline of FAT seem to deviate from values reported in prior works [2].

4. The novelty of work is limited. This paper seem to  use multi-class margin in margin theory [20] to conduct adversarial training. 

Therefore, I think this work is not qualified enough for NIPS.

[1] Adversarial Weight Perturbation Helps Robust Generalization, (NeurIPS 2020)
[2] Bag of Tricks for Adversarial Training, Pang et al, (ICLR 2021)

limitations_and_societal_impact: Yes
review_title: null

Meta-review: The paper studied the reweighting strategy in adversarial training and got 8776 scores. Before rebuttal, only one reviewer had some concerns on the experiments, while the authors provided a successful rebuttal with additional experiments and addressed the reviewer's concerns. Thus, I recommend accepting the paper. 
Decision: Accept (Poster)