Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 7: Good paper, accept
review_content: summary: This paper bridge the performance between single-step adversarial training and multiple-step adversarial training. The author proposed a Nuclear Norm regularizer in adversarial training (NuAT) which enhancing optimization to use joint batch-statistics of adversarial samples. Moreover, the author also utilizes the weight averaging method to boost the current performance. This work shows outstanding robust performance with significantly low computational cost.
main_review: This paper shows outstanding performance with single-step adversarial training. The experiment was thorough and easy to understand the paper. I think this paper has large significance in fast adversarial training research area.

However, I have few questions to be clarify about NuAT.
- I am curious about the nuclear norm itself. Does matching singular values is effective or matching clean and adversarial examples is effective? What if using KL divergence [TRADES] term instead of Nuclear norm? Does KL divergence does not show any benefits compare to the Nuclear norm?
- Does FGSM (Free is better than fast) + WA also work? How does performance change?
- Why does the Nuclear norm make a more diverse attack than the Frobenius norm? Any explanation?
- Why does the Nuclear norm able to make smoothed loss surface while the Frobenius norm can't?
- Does NuAT also work in ImageNet1K? How does performance shows in ImageNet 1K, not ImageNet100? Since fast adversarial learning is especially essential in the large-scale dataset, I think the results of ImageNet1K will make NuAT a more solid contribution in this research area.
- What is the difference between Nu-AT and NuAT using only CE+NN attack in supplementary table 4?
- What will be the performance when using NuAT using only NN attack?

Minor typo

Line 159: reference 29→27
limitations_and_societal_impact: Authors did not clearly describe the limitation nor societal impact in the main manuscript in section 5,6,7.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: The paper addresses the performance gap between single-step and multi-step adversarial training by introducing a Nuclear Norm regularizer to improve the adversarial robustness of models in single-step adversarial training. It shows that this regularizer encourages function smoothing near clean samples by incorporating joint batch-statistics of adversarial samples, which leads to increased robustness. The authors also use exponential weight-averaging and a 2-step variant of the proposed defense to further improve the performance. Experiments on MNIST, CIFAR-10 and ImageNet-100 demonstrate that the proposed method outperforms single-step adversarial training methods and is competitive with multi-step methods in terms of robustness (while being more computationally efficient).
main_review: - The paper is well-written and the proposed approach is described clearly. 


- Experiments are thorough and demonstrate that the method outperforms most single-step adversarial training approaches and is competitive with multi-step methods in terms of robustness, while being more computationally efficient than multi-step methods.   


- The authors verify how the proposed regularizer encourages local smoothness of the loss surface and more diversity in the generated attacks.  


- As common in adversarial training methods, the proposed approach leads to a drop in clean accuracy. I am wondering if the proposed method can be combined with methods such as AdvProp [B] which alleviate the clean accuracy drop in adversarial training. 
Specifically, whether using separate batch norms for clean and adversarial examples is possible in the proposed framework and whether it can lead to improvements in clean accuracy.  


- Comparison with AWP and GAT-WA is missing in Table 2. The authors mention that "though we expect AWP training to be highly effective, we do not present the method here due to the complexity of finding hyperparameters and the immense computational cost incurred for each training run, particularly in the case of ImageNet-100" (L 306 - 308). But it would be good to have these results in the final version for completeness. 
There are also other adversarial training defenses such as [A] that are not mentioned in the paper.  


- The authors claim that "the proposed method NuAT performs significantly better than existing single-step training methods" (L 272 - 273). However, based on the results in Table 1 and 2, the relative gain compared with GAT(-WA) is not significant. There are also no comparisons with GAT-WA in Table 2. 


[A] Confidence-Calibrated Adversarial Training: Generalizing to Unseen Attacks; Stutz et al.; ICML 2020


[B] Adversarial examples improve image recognition; Xie et al.; CVPR 2020


---------------------------------------------------------------------------------------------------------------------------------------------------------------


Update after the rebuttal: I read the rebuttal and other reviews. The reviewers have addressed most of my concerns. I believe the paper meets the acceptance criteria for the conference. I vote for acceptance. 


----------------------------------------------------------------------------------------------------------------------------------------------------------------
limitations_and_societal_impact: Yes
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: This paper proposes a new adversarial training method using the Nuclear regularizer with weight averaging to bridge the gap of the trained robustness accuracy between single-step and multi-step adversarial training. Comprehensive experimental results show that the proposed method can successfully eliminate the problem of gradient masking for single-step adversarial training methods while can still achieve high robustness performance as multi-step ones.
main_review: Strength:
- The proposed method is novel and the investigated problem is challenging. Using nuclear regularization seems to be an interesting solution. Insights behind the proposed methods are well explained.
- The authors have compared the proposed methods with most SOTA adversarial training methods and strong white-box and black-box attacks. I love the comprehensive and informative evaluations presented in both submission draft and supplementary.

Weakness:
- The proposed method is very simple and straightforward.
- There is no theoretical guarantee that the proposed method can always eliminate the problem of gradient masking.

Comments:
- Can the proposed 1-step and 2-step NuAT always prevent gradient masking? I understand providing a theoretical guarantee might be difficult, but multiple times of training tests would be sufficient. For instance, how many times the gradient masking will happen if we train with the proposed methods (1-step and 2-step NuAT independently) using over 10 different random initial weights compared to RFSGM-AT for long training epochs (e.g., 100 epochs)?
- The training process is usually full of randomness. It would be better to do the training multiple times (at least 3 times) and show the mean and variance in the main table (e.g., Table 1a). That would make the results more convincing.
- It would be helpful to provide the detailed numbers of training time and epoch time to get a better understanding of the computational complexity of the proposed methods.

--- Post Rebuttal ---
Thank the authors for the detailed response and additional results. Most of my concerns are addressed. I will raise my score and vote for acceptance.
limitations_and_societal_impact: No limitations and potential negative societal impact.
review_title: null

Meta-review: The paper introduces a Nuclear-Norm Adversarial Training (NuAT) by imposing a rank minimization constraint on the oscillation of function values across a training minibatch. All reviewers thought the paper is above the accept threshold. I suggest authors to take reviewers' suggestions in revising the final version of their paper.
Decision: Accept (Poster)