Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: This paper includes several theoretical analyses about introducing additional artificial data in adversarial training: its benefits and the relationship between the generator performance and training performance. The analysis starts from their main theorem that decomposes the access risk into two parts: label cost (from mislabeling the artificial data) and generator cost (from the poor performance of the generative model).

Then, the authors use this decomposition to investigate their two research questions further. The answer to the first question is that, assuming an ideal generator (with no generator cost), the excess risk after introducing artificial data is smaller than the excess risk of vanilla adversarial training.  This result shows the benefits of introducing artificial data in adversarial training. Also, the author decomposed the generator cost further to bias and variance terms and showed that the bias term is upper bounded by the dissimilarity between the data distribution and the distribution of generated data. Because the variance term converges to 0 as the number of generated samples grows, the result shows that we can reduce the generator cost by having a better-quality generative model. This paper's last contribution is the strategy of weighting the usual training samples and the introduced artificial samples.

strengths_and_weaknesses: Originality: To the best of my knowledge, the paper contains novel ideas.

Quality: 

[[Strength]]
1. Assuming the correctness of lemmas, the proof of Theorem 1 seems correct.

[[Weakness]]
1. The proofs for Proposition 2 and Proposition 3 are missing. I don’t think they are trivial statements, but the proofs are neither in the main part nor the Appendix.

Clarity: There are a few typos and grammatical errors. See Questions for more details.

Significance:

[[Strength]]
1. This paper is dense with theoretical discussions on adversarial training. Considering the lack of theoretical understanding of adversarial training in adversarial machine learning research, I believe that this paper provides valuable insights into the field.
questions: 1. Where are the missing proofs for Proposition 2 and Proposition 3? If they do not need proof, please explain. I consider those proofs missing quite seriously, so if the proofs are in the paper but I missed them somehow, please let me know so that I can adjust the rating.
2. I recommend the authors proofread the writings once again. Some typos and grammatical errors that I spotted are as follows.

  - Line 83: “$\theta_\epsilon = \min R(\theta, \epsilon)$” -> “$\theta_\epsilon = \arg\min_\theta R(\theta, \epsilon)$” ($\min R(\theta, \epsilon)$ is the value of minimum risk, but $\theta_\epsilon$ must be the model parameter minimizing the risk.)

  - Line 175: “The simulations results in” -> “The simulations result in” (Grammar)

  - Line 480: “Figure B.1” -> “Figure B.2” (It looks like that Figure B.1 is the result for Section B.2)

  - Line 516: “Lemma 1” -> “Theorem 1 (According to the structure of this section, the proof for Theorem 1 comes last.)

  - Equation after Line 547: “$\mathcal P_a \otimes \mathcal P_\epsilon$” -> “$\mathcal P_a \otimes \mathcal P_y$” (I don’t think that $\mathcal P_\epsilon$ is defined in the article.)

3. I don’t understand why the authors separated Section 5 from subsection 4.4, whereas it can be just a continuation of subsection 4.4. Also, it would be better to separate subsection 4.1 and the other parts, because subsection 4.1 looks to be the main insight and the other parts are analysis/design from the main insight.
4. In my opinion, you use the notation "$\cdot\otimes\mathcal P_y$" multiple times, consuming too much space in the paper. Defining a shorter notation for "$\cdot\otimes\mathcal P_y$" and changing all the occurrences would save some space.

limitations: This paper does not have a part assigned to address the limitations and potential negative societal impact. I understand the hardship of putting many results in the page limit, but it must be possible to condense the contents further to ensure space for this. (I don’t know whether moving some contents to the Appendix at this stage is allowed, but I recommend it if it is allowed.)
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper investigated the phenomena when using simulated data to improve adversarial robustness and provided the theoretical analysis. Specifically, the author decomposed the adversarial risk used in adversarial training to explain why and how unlabeled data can help and how its quality affects the resulting robustness. 
strengths_and_weaknesses: Strengths:
The authors clearly shape the research questions and provide the theorem and experiments to verify their points of view. The theoretical analysis for to answer the interesting questions that artificially data helps robustness is the main contribution of this paper. This paper is also generally well-written, delivering the main message clearly. 

Weaknesses:
The proofs for the proposed theorems/lemmas/propositions are all in the appendix, I would suggest including more details, especially the motivation and reasons when giving the theorem. 

It is intuitive to ask if there have some scenarios that the theorems cannot explain; the authors use too many assumptions in giving the derivations, however, if the assumptions should be reasonable not for convenience. The discussion on counterexamples where the theorems might not hold would shed light on the paper.

Secondly, in my opinion, most of the equations are hard to understand and follow, this might be due to the loss of the explanation before giving the statement. 

Third, the experiments seem to lose some baselines for comparison, it would be great if compare with more others.

Last, the paper requires careful proofreading, e.g., "minimiax" in line 185, “… is the current model” in line 183, etc.

questions: 1. Why perform Taylor expansion for Eq. 4?
2. When doing simulation, how do authors make sure they are aligned with your assumptions? For example, the datasets used are in sub-Gaussian distribution.
3. When do the assumptions A1 and A2 hold?
4. In what situation, the assumption would not hold. In this case, how would the robustness performance be affected?

limitations: Please refer to my review.
review_title: null

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: This paper provides statistical insights to explain why the artificially generated data improve adversarial training. In particular, it studies how the attack strength and the quality of the unlabeled data affect adversarial robustness in the adversarial training framework of Carmon et al. (2019); Gowal et al. (2021). The results show that with a high-quality unlabeled data generator, adversarial training can benefit greatly from this framework under large attack strength, while a poor generator can still help to some extent. It then proposes an algorithm that performs online adjustment to the weight between the labeled real data and the generated data, aiming to optimize the adversarial risk. Numerical studies are conducted to verify the theories and show the effectiveness of the proposed algorithm. 
strengths_and_weaknesses: I think this paper has the following strengths: 

1. The theoretical analysis is novel and the results seem sound, though I don't check the proof of the theories carefully. It is important to understand why and how using unlabeled data can benefit adversarial training. It is also important to understand how the quality of the unlabeled data generator affects the adversarial robustness. 

2. It proposes an algorithm that dynamically adapts the weight during the training of neural networks and shows its promising performance empirically. 

3. It is well-written and the ideas are clearly presented. The related works are properly discussed. 

However, this paper has the following weaknesses: 

1. There are some mismatches between the theory and the actual experiments. For example, it only considers $p=2$ in the theorems while in the experiments, it sets $p=\infty$. Do the theoretical results still hold for $p=\infty$? 

2. It only considers binary classification for the theoretical analysis. Could the results generalize to multi-class classification? 

3. It puts simulations and most real experiments in Appendix. I think it should at least summarize the results and findings in the main body of the paper.  


questions: 1. Do the theoretical results still hold for $p=\infty$? 

2.  Could the theoretical results generalize to multi-class classification? 
limitations: The limitations and potential negative societal impact of the paper are properly addressed.
review_title: null

final_score: rating: 8: Strong Accept: Technically strong paper, with novel ideas, excellent impact on at least one area, or high-to-excellent impact on multiple areas, with excellent evaluation, resources, and reproducibility, and no unaddressed ethical considerations.
review_content: summary: In this paper, the authors provide a statistical insight to explain the reason that using unlabeled generated data can improve model's robustness. The experiments verify that the theories in this paper are correct and can enhance the model's robustness.
strengths_and_weaknesses: Strengths:

1. The writing is good. This paper is very easy to follow.

2. This paper gives detailed theoretical analysis of the reason that using unlabeled data can improve model's robustness. 

3. The experimental results strongly verify the analysis is correct.

Weaknesses:

1. As the quality of unlabeled data matters, how to choose a proper generator for adversarial training is vital. However, the theory in this paper cannot directly guide people to train or choose such a generator. On the other hand, it seems like judging a poor generator is much easier. Could the authors attempt to solve this challenge?

questions: 1. In Figure 2, the authors suppose that $n_2 \to \infty$. Later, the authors analyze the case where $n_2$ is finite. I think there may exist a gap. Could the authors add more details for different ratio of $\frac{n_1}{n_2}$, and analyze the remainder term $o$?

2. What does ``unbiased'' mean in Line 127? I guess the authors judge a generator based on the gap between real data distribution and a data distribution generated by a generator. So, an ideal generator means it can generate a real data distribution. But, how do we define a good one and a poor one without any threshold?
limitations: I do not see any limitations.
review_title: null

Meta-review: metareview: The recommendation is based on the reviewers' comments, the area chair's personal evaluation, and the post-rebuttal discussion. 

This paper studies how synthetic data can be useful for improving adversarial robustness. All reviewers find the results convincing and valuable. The authors' rebuttal has successfully addressed the reviewers' concerns. Given the unilateral agreement, I am recommending acceptance
confidence: Certain
Decision: Accept