Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The authors pose and attempt to answer a new question if the perceptual gradients of the model imply the robustness of the model to adversarial attacks. To answer that, they proposed a new method that trains the model to have input gradients that align with ground-truth input gradients. They introduced several methods to obtain ground truth gradients. In the experiments, they showed that using perceptual input gradients as a constraint alone is sufficient to achieve robustness comparable to adversarial training.
strength_and_weaknesses: ### Strengths

- Poses and attempts to answer the question: do perceptual gradients imply adversarial robustness?
- Novel model training called Perceptually Aligned Gradients that attains adversarial robustness without running an expensive adversarial attack, such as PGD-10, in the inner loop of the model training.

### Weaknesses

- The objective for optimizing alignment requires computing cosine similarity between all classes, which scales poorly for problems with many classes. The authors didn’t present results for problems with more than 10 classes.
- The lack of a theoretical analysis of the proposed method. It is not clear why the proposed objective will guide the training toward a more robust model.
- The comparison was made only with vanilla Madry adversarial training. The authors should include a comparison with more recent adversarial training methods, e.g. TRADES, FAT, Early Stopping PGD, etc.

### Questions

- How does the proposed method compare to Lipschitz regularization methods which require a small input gradient? Which approach is more suitable for robust training?
- Could the authors include experimental comparison with denoising methods using diffusion models? Why the presented approach is more suitable for robust training?
clarity,_quality,_novelty_and_reproducibility: The paper is easy to read and follow. In general, the paper is original and timely as it tackles an important problem. The proposed approach has some interesting properties compared to adversarial training, such as good performance in the low-data regime and a lower complexity of training compared to adversarial training. However, some of the authors’ claims are unsupported. For example, the authors claim that the proposed method provides robustness on par with adversarial training. However, the comparison does not include more recent methods which address some of the issues of adversarial training.
summary_of_the_review: The authors attempt to answer the question if perceptual gradients imply adversarial robustness. They proposed a novel training method that directly optimized the perceptual gradients. Using the proposed method, they showed that perceptual gradients indeed imply robustness.  The idea is novel and interesting. However, some of the claims might not be well supported and the authors should expand both theoretical and empirical analysis of the proposed approach.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper aims to create image classification models which produce gradients which are “perceptually aligned” (in the sense of Tsipras et al.). The authors then essentially try to understand whether this alignment can imply robustness (i.e. the opposite of the claim first made in Tsipras et al.). The main difficulty is to produce a model with PAG (perceptually aligned gradients) without inheriting robust characteristics as a byproduct from the adversarial training (AT) process.

The authors propose a technique to induce PAG by adding a regularization term to the usual cross entropy loss of an image classification model. This term essentially forces the gradient of the model to point in the direction of the “ground truth” PAG via cosine similarity. 

There are two ways in which these ground truth PAGs are obtained:
1. Heuristic: The model is forced to point its gradients towards a general representative (r_t) of the target class (gradient = r_t - x). The representative can be chosen three ways: pick an arbitrary image from the class (OI), choose class mean (CM) or take the nearest neighbor image to x (NN).
2. Score based: A pretrained diffusion model is used to obtain an estimation for “ground-truth” classifier input-gradients by a simple subtraction of conditional and unconditional outputs of the network .

PAG is evaluated qualitatively via images of one class morphing to another class (See Fig 4). Experiments are performed on a toy 2d dataset, CIFAR-10 and STL with a ResNet model and a ViT. Results show strong robustness results (at least against L2 attacks) for all models/datasets.
strength_and_weaknesses: Strengths:
1. Creating models with PAG which are not a byproduct of robustifying a model has to my knowledge not been done and is a significant contribution of the paper.
2. The main idea of the paper is extremely simple and the presentation is straightforward. The paper on the whole is well written and clear.
3. Experiments in the paper support the authors claim that PAG can imply robustness (see concerns below).
4. Results in the L2 attack case are very strong. The authors observe robustness better than AT in some cases without the additional overhead of robust training.

Weaknesses:
1. My main concern about the results in the paper center around the lack of quantification of PAGs. There is a huge difference in robustness against L2 and L-infinity attacks (shown in Table 1). It seems there is little robustness induced (especially in the heuristic L-infinity VIT case) in some settings even when there are PAGs (as shown in Fig 4). Therefore, it seems that even though PAG is present at least superficially, no corresponding robustness is observed. This goes against what the paper is trying to prove (that PAGs imply robustness). I’m not sure if this only shows up in one case (heuristic L-infinity VIT case) but there is some explanation needed.
2. Related to the above point, since there is no quantitative measure of PAG, it is hard to understand whether there is a dose-response relationship between PAG and robustness. If there were a dose-response relationship, it could potentially explain my concern above (Pt 1) by saying that - the PAG for the heuristic L-infinity VIT case is weak so robustness is not very high. The authors already use cosine similarity in the loss which could potentially serve as a quantitative metric for the PAGs.
3. I feel the paper is lacking analysis to definitively “prove” that PAGs imply robustness. For example, we have seen improving PAG improves robustness, but what happens if we purposely try to decrease PAG? (flip the sign on the regularization term). What happens if train a model using AT and add a regularization term to decrease PAG? (i.e. essentially increase robustness and decrease PAG simultaneously). Without additional analysis, I think the paper falls short in showing where and how the effect being claimed exists.
clarity,_quality,_novelty_and_reproducibility: The paper is extremely clear and easy to understand. The main idea being conveyed is simple and problem under study is novel.
summary_of_the_review: Overall, I think the paper makes a solid attempt at understanding a curious property of image classification models. I think the approach introduced by the authors is very interesting. However, there is a lack of analysis discussing the limitations of the technique being proposed which keeps me from recommending publication.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: In this paper, the authors throw out a question about the usefulness of Perceptually Aligned Gradients (PAG) and give a positive answer by numerical evaluation.
strength_and_weaknesses: strength:
+ it is interesting to see several attempt to design several approaches for the ground truth gradients for alignment. 

weakness:
- PAG provides additional supervised information and I do not think people have too much doubt about this. Meanwhile this could be explained directly rather than numerical experiments. 
- In numerical experiments, the proposed methods do not show clear advantages over AT, expect for ViT model.  One question is about the performance of ViT, which seems quite weak, but in general ViT is believed to be more robust than CNN. 
- The lack of ImageNet makes the conclusion less convincing. Besides, additional structures should be considered. In my opinions, to support the conclusion, typical NN structures (skip or not, dense or not, wide, different depth) and AT schemes should be included. 
clarity,_quality,_novelty_and_reproducibility: The writing is not very clear. The novelty is good but maybe it is because verifying the usefulness of PAG is not so attractive. 
summary_of_the_review: The problem this paper cares about is not very interesting. Even for this question, the answer could come from not only numerical experiments. Besides, the experiments are not sufficient. Overall, I tend to give negative score on this paper.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper studies the effect of encouraging the semantic space of a deep model to be perceptually aligned on the adversarial robustness of the model.
This paper is based on earlier observations that robustly trained models have interpretable feature space.
This work encourages the gradients the model to be perceptually aligned through four different approaches.
Experimental results show that the obtained model, without training on adversarial examples, exhibits non-trivial robustness characteristics that could match the adversarially trained one.
strength_and_weaknesses: Strengths:

- The problem that this paper is analyzing is both important and interesting.

- The study of the complementary path, from perceptually aligned gradients to adversarial robustness, is somewhat novel.

- Approaches considered in this paper for encouraging the gradients to be perceptually aligned are intuitive.

- Experimental results supports the claim of this work.

- The paper is well-written and easy to follow.

Weaknesses:

Despite that there are several aspects of this work that I like and appreciate, there are several concerns that need to be addressed.

1 - The main weakness of this work is the manual inspection of perceptually aligned gradients. Is there a way, based on the experimental results of this work, to quantify how aligned are the gradients of a given model? Conducting manual inspection might be misleading as it highly depends on the initialization.

2- Since all proposed approaches in this work do not include adversarial examples in their training routine, it is necessary to have a runtime comparisons between each proposed method and conducting adversarial training (it would also be fair to include other variants of adversarial training such as Free AT [A] and Fast AT [B]).

3- The experimental results is missing a large-scale real-world dataset such as ImageNet. 

4- Analyzing the effect of encouraging the feature space to be semantically interpretable on adversarial robustness has been explored before in [C] through deploying metric learning. It would be nice to include describe the main differences between both this work and previous approaches.

5- While the proposed SBG matches the adversarial robustness of adversarially trained models, how would the performance be of we combine both approaches. For example, how would AT+SBG perform? The authors might want to explore more powerful variants of adversarial training such as AWP [D].

I generally admire the efforts in this work. I am also happy to increase my score based on the discussion with authors.

[A]: Adversarial Training for Free!, NeurIPS 2019

[B]: Fast is Better than Free: Revisiting Adversarial Training, ICLR 2020

[C]: Rethinking Clustering for Robustness, BMVC 2021

[D]: Adversarial Weight Perturbation Helps Robust Generalization, NeurIPS 2020
clarity,_quality,_novelty_and_reproducibility: I am generally happy with the quality and novelty of this work. There are few concerns mentioned in the weaknesses part that I hope to be addressed during the discussion period.
summary_of_the_review: This work has several merits that I appreciate. However, the main concerns regarding this work are:
(1) A systematic approach in quantifying the ''perceptuality'' of gradients of a given model.
(2) Large scale experiments to demonstrate the effectiveness of the proposed approach.
(3) Discussion on how related this work is with earlier works in the literature analyzing the complementary path (from semantics to robustness).
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: While previous work has established that adversarial robust models lead to perceptually-aligned gradients, this paper tries the answer if the reverse condition also holds that if a model has perceptually-aligned gradients, is it robust to adversarial examples? The answer given by this paper is yes. The crux of the approach is a new training scheme which explicitly optimizes for the alignment between current input gradients and perceptually-aligned gradients. The authors proposed several approaximations to achieve this gradient alignment. The proposed method is evaluated on CIFAR-10 and STL.
strength_and_weaknesses: Strengths:
1. This paper asks an interesting question: is perceptually-aligned gradients also a sufficient condition for adversarial robustness. While previous work has shown that it is necessary, none has looked into if the reverse also holds true. Trying to answer this question would help the community understand the importance of former (perceptually-aligned gradients) to the latter (adversarial robustness).
2. The method proposed in section 3 is novel and can be a principled approach for future work as to how to induce percetually-aligned gradients during training.
3. The experiments are solid and the conclusion drawn from the experiments that perceptually-aligned gradients do imply adversarial robustness is interesting. It could benefit future work in this direction to rethink the importance of perceptually-aligned gradients.


Weaknesses:
1. It would be nice to report the training time of the proposed approach compared to adversarial training. It seems that it would require less backward pass compared to full PGD with many steps as used in AT. Thus it would be nice to have a formal comparison of the statistics of time spent.
2. I don’t quite follow the part about score-based gradients. So are you using the gradients computed from equation 7 as the new target g? It seems that you need two diffusion models, one being class-conditional and one being unconditional to estimate the two parts in the right hand side of equation 7.   
I feel the first two paragraphs of section 4.2 can be moved into background or related work. It seems hard to follow which is exactly your contribution. I would elaborate more on how you obtain the gradients in equation 7. 

clarity,_quality,_novelty_and_reproducibility: Clarity: This paper is written clearly. 
Quality: The quality is good
Novelty: The problem and the approach are both novel.
Reproducibility: The authors have provided the code in the appendix.

summary_of_the_review: The paper is clearly written. I like the question this paper is trying to answer. The proposed approach can be a principled way to directly induce perceptually-aligned gradients. For now i am leaning towards accept.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: Motivated by the observation that some earlier works have identified Perceptually Aligned Gradients (PAG) as a byproduct of robust training, but none have considered it as a standalone phenomenon nor studied its own implications, the authors studied if the perceptual gradients of the model imply the robustness of the model to adversarial attacks. 
They proposed to directly promote PAG in training classifiers and examine whether models with such gradients are more robust to adversarial attacks. They showed that using perceptual input gradients as a constraint alone is sufficient to achieve robustness comparable to adversarial training.
Overall, the authors have properly responded to reviewers' comments (although some reviewers did not actively participate in the rebuttal process).

Main weaknesses of this paper include:
(1)Even PAG is combined with AT, the robust accuracy is significantly lower than SOTA (https://robustbench.github.io/#div_cifar10_L2_heading).
(2)The proposed method did not show a promising Clean accuracy – robustness tradeoff.

Based on the above concerns, this paper is recommended to be rejected.

justification_for_why_not_higher_score: Main weaknesses of this paper include:
(1)Even PAG is combined with AT, the robust accuracy is significantly lower than SOTA (https://robustbench.github.io/#div_cifar10_L2_heading).
(2)The proposed method did not show a promising Clean accuracy – robustness tradeoff.
Decision: Reject