Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 7: Good paper, accept
review_content: summary: This paper provides a new perspective to explain different adversarial attacks and adversarial defenses in a "unified" way. Specifically, the authors exploit the multi-order interactions between inputs to analyze the robustness of DNNs. Based on the multi-order interaction, this paper further investigates the representation of high-order interactions and low-order interactions and draws some interesting conclusions. Based on the observed results, this paper gives a theoretical explanation of the commonality between adversarial attacks and defenses.

main_review: $\textbf{Cons}:$

(1) My biggest concern of this paper is that I can not agree with your statement about "a unified view to explain different adversarial attacks and defenses".  I am very satisfied with the perspective of the utilized "multi-order interaction" to conduct adversarial attacks and defenses. However, in this paper, the discussion only happened in the gradient-based adversarial attacking method ($i.e.$, PGD and momentum attack) and adversarial training defense.  I think that these attacking/defending strategies can not represent all of the adversarial area works ($e.g.$, optimization-based attacking method and other defending methods). And thus, causing the following concern: is this proposed theory can be extended to other related works? I have reservations about that.

(2)In Line 261, the author claimed that adversarial perturbations towards adversarially trained DNNs penalized both complex features of global collaborations and simple features of local collaborations. However, there is no evidence to say that global collaborations mean complex features and local collaborations mean simple features, at least not provided or clarified (I see the statement in Line 288 but I can not easily agree). And according to Figure 4, it can be clearly witnessed that some x-order interactions, including low-order interactions, are increased ($i.e.$, not penalized).

(3) The writing of this paper should be carefully gone through. In some paragraphs, what makes me confused is that the attacker is stated as DNN. But in my opinion, the attacker who performs attacks ($i.e.$, attack low-order interactions or high-order interactions) should be an adversarial example, not a DNN.

#post-rebuttal

I am satisfied with the author's explanation, so I am willing to raise my score and give a acceptance
limitations_and_societal_impact: Almost addressed the limitations and potential negative societal impact. See my concern (2).
review_title: null

final_score: rating: 4: Ok but not good enough - rejection
review_content: summary: The Shapley interaction index is leveraged to analyze the adversarial robustness, with an ambitious goal of unifying different explanations for adversarial attacks and defenses.
main_review: Originality:

a. The Shapley (interaction) index is a well-known mathematical quantity in the field of game theory and has been explored in the ML community, particularly to understand DNN [1].

b. A similar decomposition of the Sharpley interaction index has also been provided in [58], which may undermine the technical novelty of the current work.

c. The discovery that higher-order interactions are affected by the adv attack the most is interesting.

Quality:

a. From Figure 3, it seems to the reviewer that the behaviors of standard and adv trained CNNs are quite similar under the $I^{(m)}$ measure. Does this mean that the adv training is not that effective? If so, this goes against empirical evidence that adv training is helpful?

b. Have the authors tried to experiment with the training methods with certified robustness? The reviewer wonders whether a similar figure (like figure 3) can be produced.


Clarity:

a. Overall, the reviewer is comfortable reading the first two sections and begins to find the remaining sections difficult to comprehend. For example, why can the trend of $\hat{v}(S)$ be reflected by $v(S)$? 

b. What are the motivations of the two equations in Eq. (4)?

c. How do the authors implement the masking? Setting to zero or mid-gray or Gaussian noise? Will different choices affect the results?






limitations_and_societal_impact: The authors may improve the writing by narrowing down the scope.
review_title: null

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: The authors discover and partially prove that adversarial perturbations mainly affect high-order interactions, rather than low-order interactions. 

The authors find that there is a clear difference between standard DNNs and adversarially trained DNNs. Adversarial training significantly increases the robustness of high-order interactions.

The research provides a unified understanding for the success of several existing adversarial defense methods,
main_review: There is one related paper which also performs a game theoretic analysis for adversarial attacks and defenses [*1]. The authors should make a comparison with the paper. 

The authors define the disentanglement metric to identify whether interactions of this order are discriminative for the classification of a specific category, or represent common knowledge shared by different categories. Based on the disentanglement metric, the authors discover that compared with standard DNNs, adversarially trained DNNs usually encode more discriminative low-order interactions. Discriminative low-order interactions make high order interactions of adversarially trained DNNs robust to attacks.

Some studies explained adversarial examples as high-frequency features and high-rank features. It is glad to see that the problem can be viewed from a different aspect. The high order interactions can better explain the essential property of attacking-sensitive representations, i.e. the complex and large-scale visual concepts.

[*1] A Game Theoretic Analysis of Additive Adversarial Attacks and Defenses, NeurIPS 2020
limitations_and_societal_impact: The authors do not mention this.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: This work provides a unified understanding for adversarial perturbations and robustness based on the multi-order interaction between input variables.  The experimental results and theoretical analyses validate that adversarial perturbations are highly correlated to the high-order interactions. Adversarial training significantly improves the disentanglement of low-order interactions, thus enhancing the robustness of sensitive high-order interactions.  The proposed multi-order perspective of adversarial robustness can explain the reasons for some methods  improving adversarial robustness.
main_review: This paper is well written and organized. The understanding for adversarial robustness seems to be well motivated and brings much conceptual improvement. The research studies the relationship between the adversarial attacks and robustness, and multi-order interactions. 
On one hand, the research discovers high-order interactions are frequently affected by adversarial attacks and explains this phenomenon theoretically. On the other hand, the authors show that adversarially-trained DNNs make the low-order interactions more discriminative compared to naturally-trained DNNs. Comprehensive experiments are conducted and support the claims in this paper. Besides, this paper provides the unified understanding for the success of some existing adversarial training method from this novel perspective. 

There is a minor question --- I wonder if the strength of adversarial attacks (e.g., the iteration numbers of PGD) is related to the perturbations on high-order interations. That is to say, could we use the pertubetions on high-order interactions to measure the strength of adversarial attacks?
limitations_and_societal_impact: This paper contributes to understanding adversarial robutness. Therefore,  no potential negative societal impacts incur.
review_title: null

Meta-review: This paper focuses on a new perspective to explain different adversarial attacks and adversarial defenses in a unified way. The philosophy behind sounds interesting to me, namely, exploit the multi-order interactions between inputs to analyze the robustness of DNNs. This philosophy leads to the representation of high-order interactions and low-order interactions and some interesting conclusions that I have never seen.

The clarity and novelty are marginally above the bar of NeurIPS. However, there are three key issues proposed by Reviewer T63V that should be merged in your next version. First, the authors reuse the techniques to prove the decomposition of the network output in this paper, which bring limited technical novelty to the community. Please try to explain more and revise that part. Second, due to pretty much the same formulation, the proofs of linearity, nullity, commutativity, and symmetry follow straightforwardly. Third, the equivalence between the multi-order interaction and mutual information seems straightforward as well. By the way, please revise your updated version more clear and accessible, because the reviewer still fails to understand how to compute the proposed measure with seemingly combinatorial complexity.

While all reviewers had some concerns on the significance, the authors did a particularly good job in their rebuttal. Thus, most of us have agreed to accept this paper for publication. Please include the additional explanation and experimental results (especially for Reviewer T63V) in the next version. 
Decision: Accept (Poster)