Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 6: Marginally above acceptance threshold
review_content: This paper surveys various adversarial defense methods on their performance when the perturbation distortion epsilon is increased. The author argues that robustness for a specific epsilon may not be enough and suggests robustness curves as an alternative. I think in general this paper provides some interesting empirical studies. My detailed comments are as follows.
1. The overfitting of specific epsilon value is expected but interesting to see and I think this is one of the main reasons why a robustness curve is necessary. However, in this adversarial robustness community, the status quo is that researchers compare with each other on some specific datasets with some specific epsilon, for example, 0.3 for MNIST, 8/255 for CIFAR. I think one reason for choosing these values is that studying robustness under perturbation with larger distortion is kind of unnecessary because then the noise added is no longer imperceptible, which is at odds with adversarial examples' definition. I think the authors may need to provide more discussion on why studying robustness with epsilon>0.6 for MNIST is necessary, since we may misclassify those images as human. 
2. The authors suggest a robustness curve as an evaluation metric. However, I haven't seen any works on improving the robustness for all epsilon values globally. One possibility is that there is a trade-off between small epsilon performance and large epsilon performance, similar to the trade-off between robustness and accuracy (epsilon=0 performance). My suggestion is that the authors may define an "area under the curve" value just like in ROC curves for better comparison.
3. (Minor) Please refrain from only using color to distinguish curves in figures as it may not be friendly to readers with color blindness. 
review_title: This paper provides some interesting insights.

final_score: rating: 5: Marginally below acceptance threshold
review_content: Summary:
The authors advocate for the use of Robustness curves, plotting the adversarial accuracy as a function of the size of the neighbourhood region of allowed perturbation. The problem that they identify is that if you only evaluate adversarial accuracy at some numbers of threshold, you might conclude that some models (and the method that was used to train them) are more robust than others while it would be incorrect at other thresholds.

General comment:
The paper clearly describes the problem it deals with and reads easily. On the other hand, I am not entirely convinced by the importance of the problem. If you have a particular specification that you care about  ("Robustness against l_inf attack for eps=0.1"), you can just verify that. On the other hand, if your goal is "I want my network to be robust", then it's not properly defined, so of course it's hard to evaluate. Robustness curves will help there but there is still the problem that you might want to be robust to L_infinity, L_1, L_2, brightness difference, Wasserstein difference, changes of small patches... and then the robustness curves will not help you (unless of course you compute one for each difference). At the same time, they are quite a bit more costly to compute that simple point measures. While I agree that you are going to get more information if you compute a full robustness curve than if you sample it at a bunch of points, I'm not convinced that it is worth the effort.

One thing that I would recommend the authors is to make clearer the distinction between robustness curves as they described them (based on finding the closest adversarial example) vs. plotting on a robustness curve the pointwise measures and interpolating through them. This would be a much cheaper solution (and is essentially what reporting experimental results for a few chosen eps achieves). For example, the results the authors give in their Table 1. based on point wise measures wessentially achieves what the authors want to show: no defense strictly dominate the others.

Specific Comments:
- The toy dataset example presented in Figure 1. is great and provides a great explanation of the problem that the authors identify. The constructive proof in Appendix A. is also quite interesting and really drives the point that the authors want to make.

- The authors argue that robustness curves allow to compare "global robustness properties and their dependence on a given classifier, distribution and distance function". In practice, does it really give insights global robustness property? If I look at the L_infinity robustness curves, it does not tell me much about the robustness to L_2 perturbations.

- I don't understand how the robustness curves are generated for the L-infinity case? If PGD is used to find adversarial examples, it's not likely to be the "closest" adversarial examples that is going to be found, in all likelihood it's going to be one that matches the epsilon given as input to the PGD attack (due to the projection)? There is nothing that is even encouraging the sample to be close to the input beyond the constraints used for projection.
Even for the L2 distance, there is still the usual problem that, although the CW attack encourages to find the closest sample, there is no guarantee that it will, and the effectiveness it will have at doing so might depend from model to model. As a result, it's hard to decouple the robustness curve from the attack that it used internally.

Minor Notes & Typos:
- To improve the look of the paper, it should be possible to include manual linebreaks in the title so that it's not broken in every line. 
- The authors talk in the introduction about "recently proposed robustness curves" and cite a paper from 2020 for them, but it seems like those curves were already in use before that. "On the effectiveness of interval bound propagation for training verifiably robust models", Gowal et al. had some in 2018.; "Provable Defenses against Adversarial Examples via the Convex Outer Adversarial Polytope" had some (transposed) in 2017.
- At the end of the introduction, the author say: "It is our belief that the continued use of single perturbation thresholds in the adversarial robustness literature is due to a lack of awareness of the shortcomings of these measures".  This seems overtly harsh. You could make the same point about training algorithms and say that authors only reporting on only a few datasets due it just out of lack of awareness of the fact that the relative performance of different algorithms will vary depending on the dataset. Given that computing robustness curves needs computing the closest adversary to a point, this is much more expensive so maybe computational cost might be the differentiating factor rather than "lack of awareness"?
review_title: Clear paper but importance of the problem not obvious.

final_score: rating: 5: Marginally below acceptance threshold
review_content: This paper presents a theoretical scenario where point-wise measure of adversarial robustness falls short in comparing model robustness, then conduct experiments to show that robustness curve is a more meaningful evaluation metric from a global perspective.


Pros:


+ The motivation is well explained. I mainly agree with the authors on the argument that point-wise measurement of robustness may be insufficient in explaining model robustness. Computing and visualizing robustness curves seems to be more meaningful and rigorous from a security perspective. 

+ Relating the choice of the perturbation strength to the underlying property of the data distribution is useful. The inter-class distances demonstrated in Table could potentially be used as a reference on determining the right scale of perturbation strength.


Cons:


- The robustness results presented in Table 1 seems far below the state-of-the-art robustness. For instance, in the last row (\epsilon=8/255), the robust test error of AT is 0.92, which is much higher than the reported statistics in (Madry et al., 2018). The author uses a very small 4-layer convolutional neural network for CIFAR-10 experiments, whereas the state-of-the-art robustness results are achieved using a much larger network, such as a ResNet architecture or a WideResNet architecture (refer to [1] for the current best robustness results on CIFAR-10). Thus, I recommend authors to rerun these experiments using a larger network.

- Similar architecture is used for the robustness curves in Figures 3 and 4. This suboptimal choice of network architecture makes the argument 'it contains multiple intersections in the robustness curve' unconvincing. 


Other Questions or Comments:

1. Most of the existing defenses against adversarial examples are typically trained using a specifically-chosen perturbation strength. If adopting robustness curves (or global robustness) as the evaluation criteria instead of point-wise robustness, how will this affect the existing adversarial training procedure?

2. What does the distance statistics presented in Table 2 suggest for the typical choice of perturbation strength used in existing literature? 

3. The global robustness considered in this paper is robustness for varying perturbation strength. Is there a way to define the perturbation strength for different input locations based on your computed inter-class statistics?

4. The bibliography style of the reference is not standard. Check if you are using the correct file.


[1] Reliable Evaluation of Adversarial Robustness with an Ensemble of Diverse Parameter-free Attacks, Francesco Croce and Matthias Hein, ICML 2020

review_title: Marginally below acceptance threshold

final_score: rating: 6: Marginally above acceptance threshold
review_content: Summary:
The paper showed that point-wise measures fail to capture important properties that are essential to compare the robustness of different classifiers. The authors introduced the recently proposed robustness curves to provide a global perspective including the scale as a way to distinguish small and large perturbations. 

Pros:
(1) How to compare the robustness is a very important question for current machine learning models. The author introduced a better criterion for this important question. 
(2) The paper is well written and easy to read.  The experiments and its discussion are strong proofs to support that the robustness curve should be the better criterion.
(3) The authors released code to reproduce all the experiments for the current popular frameworks. It will be very helpful for the researchers to the advantages of this curve over point-wise measures. 

Cons:
Overall, this paper is impressive. 
The only concern the reviewer has is the contribution compared to the previous work who proposed the robustness curve (C. Gopfert et al. 2020).  it seems this paper's contribution is highly based on  the proposal of robustness curve, and providing more explanations and discussions. (But this will not affect the importance of this paper)





review_title: A good criterion for evaluating robustness of classifiers 

Meta-review: The authors study "robustness curves" which are plots of the robust error versus the radius used in the corresponding l_p-ball threat model.

Pro: I completely agree with the authors that the current evaluation purely based on evaluation for a single radius is insufficient
and one should report the complete curve. 

Con: The authors are overclaiming that they have come up with robustness curves. Very early papers e.g. even in the adversarial
training paper of Madry there are plots of robust accuracy versus chosen threshold. Moreover, I agree with one of the reviewers that using PGD for the purpose of a robustness curve is inaccurate and in particular inefficient as several attacks for different radii have to be done. There have been several attacks developed which aim to find the adversarial sample with minimum norm and thus compute the robustness curve in one run.

The additional insights e.g. intersection of robustness curves are partially to be expected and I don't find them sufficient to move the paper over the bar for ICLR.  As these insights are additionally  only shown for relatively small models which seem far away from the state of the art, it is unclear if they generalize. However, I encourage to follow some of the reviewer's suggestions to improve the paper.
Decision: Reject