Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper proposes a scalable ensemble training with random gated block to enhance the model adversarial robustness.
main_review: 1. The random gated block enable the efficient/scalable model ensemble but the introduced randomness may greatly decrease the model capacity. It would be great if ImageNet dataset can be tested to prove algorithm can fit highly complex data distribution.
2. The random gated method looks very similar to applying dropout not only during the model training phase but also the model inference phase. It would be good to clearly address the key difference between random gating and dropout. It would be expected that some similar theoretical discussions like the following paper can be included in the draft.
(1) Gal, Yarin, and Zoubin Ghahramani. "Dropout as a bayesian approximation: Representing model uncertainty in deep learning." In international conference on machine learning, pp. 1050-1059. PMLR, 2016.

summary_of_the_review: The model capacity can be a big concern and the technical depth is somehow limited.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper proposed a new way to generate an ensemble of networks against adversarial attacks. Different from other methods, which train different sub-models, the proposed method repeats convolution layers multiple times and controls them with random gates.  The experiment demonstrates that it outperforms other ensemble training with a smaller computational overhead. 
main_review: Pros:
1.The paper is well written and easy to read.
2.The idea is interesting and clearly explained.
3.Experimental setup is comprehensive and appropriate ablation studies have been performed.

Cons:
1.Adversarial training (AT) seems a better option. As shown in Figure 5&6, the AT can easily beat EIO as perturbation strength increase from 0.01 under the White-box setting. Considering the AT only takes less than half the training time of EIO (Figure 7), it makes EIO less attractive. It seems that EIO can be easily combined with AT together. I would suggest that the author conducts the experiment to check the performance of the combination of EIO and AT.


2.Lack of interpretation of results. Since the DVERGE and EIO share the same vulnerability diversification training, why EIO can outperform DVERGE significantly? Is it because EIO can impede more adversarial transferability among sub-models within the ensemble? In Figure 6, why do you only take one sub-model in the ensemble to evaluate the performance of GAL and DEVRGE? Is that the reason why GAL and DEVRGE completely fail to defend against White-box attacks?

3.The major contribution of the paper is to construct ensemble by repeating the original layer by n times. However, the increase of this key parameter n (from 2 to 3) will lead to performance degradation (Figure 3), which does not match the intuition of the paper.  Given enough training time, will the model trained with n=3 beat the model trained with n=2? 

Minor:
1.	Table 1 is not clear, what does the number mean before and after the slash, is that accuracy against White-box/Black-box attacks?
2.	There are typos in legend of Figure 4 (Baseline.5 and DVERGE.8).

summary_of_the_review: Overall, I think this paper is marginally below the acceptance threshold.  I like the idea of the ensemble with random gates in deep neural networks. Although this method can beat other ensemble methods, it is less attractive than basic adversarial training since the latter takes less training time and is flexible to be tuned with different perturbation strengths. If my concerns are addressed, I would like to raise the score.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper uses ensemble learning to improve the adversarial robustness. The authors introduce the concept of ``Ensemble-in-One",  in which a simple but effective method called random gated network (RGN) is ultilized to enlarge the ensemble size in a very effective manner.
main_review: Strengths:
1. The idea of using random gated network (RGN) to make the ensemble scalable is very interesting.
2. Strong empirical results when compared with SOTAs.

Weakness:
1. Instead of just presenting the numerical results, the authors could try to provide some theoretical analysis on the proposed methods. A good example could be the ICLR 2018 paper: Ensemble Adversarial Training: Attacks and Defenses 
2. The concept of the random gated network is similar to the work of stochastic path network (``Deep Networks with Stochastic Depth"). 
3. The authors discussed two ways to deploy the final model in the testing phase. Why not consider the case where we just aggregrating the results, possibly by average  pooling, from different paths at each layer ?
summary_of_the_review: The idea is quite interesting and the results are good. However, the current version lacks the theoretical analysis and other key empirical comparisons as mentioned above.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper proposes a robust training and defending method RGN by applying control gates with binary status. During the training, the proposed method generates adversarial examples in a clean-label attack manner and mitigates the adversarial perturbation through training on another path. During the inference, RGN finds a subnetwork to defend against adversarial attacks.
main_review: 1. It seems to me that this training is complicated and computationally expensive. The defender needs to consider (1) different data pairs (N^2) (2) all possible paths (although the authors choose p paths in each data batch, the training epoch should be much larger to cover possible paths) (3) generating different clean-label adversarial perturbations. 

2. Some parts of the training process are quite confusing:  (1) My understanding of this training process is that it forces some paths to remember certain perturbation patterns. But how can the method guarantee that (a) the memorizations will not be rewritten by other perturbations?  (b) adversarial inputs will go into the corresponding paths in the inference stage? And what is the benefit of using such a method compared with forcing the neural network to remember all perturbations? (2) The objective here is to generate a perturbation that relies on the path and certain training data. In fact, Equation 2 and its variants can be used to generate clean-label attacks. However, its application here is not for defending such an attack. I don't understand why the authors choose to use equation 2 instead of using the conventional non-targeted adversarial attack. Also, if one considers $l$ to be the output layer, then basically, the adversarial generation in RGN reduces to a targeted attack. Of course, using the targeted attack in robust training is not plausible.

3. The inference phase of RGN searches a subnetwork to defend against attacks. This raises a question. Does the robustness come from its complicated training process, or does it come from the distillation? In fact, many works have explored the lottery ticket hypothesis in the standard training and robust training regimes, e.g., [1].

[1] Towards Practical Lottery Ticket Hypothesis for Adversarial Training
summary_of_the_review: Although applying control gates is an interesting idea, I have some concerns about the RGN method. I have listed my major concerns in the main review.
review_title: null

Meta-review: The paper proposes a stochastic network, named Ensebmle-in-One (EIO), to increase adversarial robustness. EIO replaces the layers in a given architecture by so called random gated blocks (RGBs) in which a random gate switches between multiple copies of the original layers. By sampling from the random gates different subnetworks can be sampled which can be arranged to form an ensemble. During training non-robust feature distillation (as proposed in previous work) between models is applied. For inference in the experiments a single subnetwork is sampled, and the robustness of that subnetwork is compared against several ensemble methods and adversarial training.  

One reviewer was worried about model capacity and recommended to perform experiments on image net to demonstrate scalability to large datasets. In turn, authors added experiments on CIFAR-100 during rebuttal period. Another critique was that the model does not show a significant advantage over vanilla adversarial training (AT), which can easily tuned with different perturbation strengths and only takes half of the training time. While other ensemble techniques, like DVERGE, can be combined with AT to improve their robustness, combing EIO with AT does not lead to improvements as shown by experiments performed during the rebuttal period. Two reviewers stated that adding a theoretical analysis will improve the paper. Another suggestion for improving the paper was to add a comparison to stochastic path networks, which is related work, and to investigate model performance when results from several sub-networks are aggregated. 

Overall, the paper can not be accepted in its current state, but I would recommend the authors to continue the direction of work and to incorporate reviewers suggestions in a future version of the manuscript.
Decision: Reject