Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper focuses on federated adversarial training, especially learning in a resource-constrained setting. To be specific, the high demand for memory capacity and computational power makes federated adversarial training infeasible in the resource-constrained setting. To overcome this issue, this paper proposes Federated Adversarial Decoupled Learning (FADE), which allows a more flexible model partition on devices to fit the resource budgets. Correspondingly, the authors provide the theoretical guarantee for the convergence of the proposed algorithm and conduct experiments to empirically verify the effectiveness of FADE.
strength_and_weaknesses: Strength:
1. The focused problem is very practical and significant to push federated adversarial training towards a more real-world scenario.
2. The proposed FADE shows empirical effectiveness in the experiments on FMNIST and CIFAR-10 datasets.
3. The corresponding theoretical analysis on the convergence of the proposed FADE is provided and seems to be correct.

Weaknesses:
1. The technical novelty of the proposed method is limited compared to DGL. Without a clear technical motivation to improve DGL, the proposed FADE seems to be heuristical. The presentation could further highlight the technical difficulty and how FADE address that.
2. The experiment part of the current version is weak. The performance gain of the proposed method is not significant and still suffers from severe accuracy-robustness tradeoff. Some quantitative experiments which can reflect the degree of resource-constrained edge devices seem to be missing, which can directly reflect the performance limitation of either previous or the proposed methods. Since the title is called "large-scale", some large-scale datasets can be involved to make the empirical results more convincing. It also lacks the appropriate ablation study to understand the proposed algorithmic component better. It needs further evidence or clear presentation to show the relationship of the effectiveness with the improved algorithm.
3. The current theoretical analysis indeed provides the convergence guarantee of the algorithm. Could the author provide more discussion about the relationship between the theoretical results with the resource-constrained setting?


clarity,_quality,_novelty_and_reproducibility: Clarity: This paper is well organized, and most clarifications are clear and well-supported. However, the current improvement seems to be not significant, and more experiments on other challenging datasets or real-world datasets are also encouraged to be conducted, which can make the claims more convincing.

Quality: The presentation of the current version is of high quality with sufficient theoretical analysis. However, the relationship of the current theoretical analysis with algorithm 1 is not very clear.

Novelty: The novelty of the proposed decoupled learning has limited novelty compared with the original DGL. the method part could be further improved by highlighting its unique points for this problem that is different from related strategies.

Reproducibility: This paper has provided detailed information about the experimental settings. It could be better if the author could open-source its code later. 

summary_of_the_review: Overall, I think this paper proposed a promising method for federated adversarial training under resource-constrained edge devices, with corresponding theoretical analysis. However, the presentation part and the experimental parts can be further improved.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper proposes an adversarial training framework for resource-constrained federated learning. The proposed framework decouples the entire model into small modules to fit into the edge device memory. Adversarial training is only performed on a single module in each communication round.
strength_and_weaknesses: Strengths:
1. The paper aims to address the challenges of adversarial training in resource-constrained federated learning, which is an important and timely problem.
2. FADE offers theoretical evidence for the convergence and adversarial robustness of the proposed framework.
3. The experimental results show that FADE reduces the computational cost while maintaining model robustness.

Weaknesses:
1. The proposed federated decoupled learning is unclear. It seems the paper only addresses the update locking using the auxiliary output model.  Forward passing is still required in federated decoupled learning. For example, in the second row of Figure 2, the model training still needs the outputs from the previous layers. 
2. The min-max optimization problem (Eq. 11) requires to update $\delta_{m-1}$ to maximize the loss function. However, without accessing the first few layers, how do we update $\delta_{m-1}$?
3. The paper investigates two recent federated learning algorithms FedNOVA and FedBN. It would be nice to consider FedAVG as another baseline.
4. The paper considers 2-module and 3-module FADE. Can we split the model into more modules for extremely low-end devices? 

Minor: Page 3. Decouled Greedy Learning -> Decouple Greedy Learning

clarity,_quality,_novelty_and_reproducibility: The paper presents a novel idea of combing decoupled learning with adversarial training. The details of the proposed framework need further clarification.
summary_of_the_review: The proposed framework is quite novel. The experimental results look promising. The paper presents theoretical proof for convergence and adversarial robustness. However, the details of the proposed framework need further clarification.

Thank you for the authors' responses. While the responses have addressed most of my concerns, I still have a concern about the use of forward passing in the first training round, which may impact the efficiency of the proposed method. I also agree with other reviewers that the paper's novelty may be somewhat limited as it simply applies decoupled learning in federated adversarial learning.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper studies how to perform federated adversarial training (FAT) on resource-constrained edge devices. The authors propose Federated Adversarial Decoupled Learning (FADE) to decouple the entire model into small modules for feasible FAT. They also offer a theoretical guarantee for convergence and adversarial robustness, based on which, a technique to alleviate objective inconsistency and achieve better accuracy-robustness balance is proposed.
strength_and_weaknesses: This paper focuses on federated adversarial training (FAT) on resource-constrained edge devices, which is an important and less researched topic. The authors incorporate Decoupled Learning (DL) into FAT naturally, analyze and solve the resulting problems theoretically and technologically. Specially, they propose FADE, offer a theoretical guarantee for convergence and adversarial robustness and provide a technique to alleviate objective inconsistency and achieve better accuracy-robustness balance. However, I still have some concerns and suggestions:
1.	In section 3.1, the meaning of Eq. 9 conflicts with the above description of it and the meaning of Figure 2. The authors said that the proposed method can ensure flexible model partitions, that is to say, different clients have different model partitions, as shown in Figure 2. However, what Eq. 9 means is only for the case that different clients have the same model partition. In fact, from my perspective, throughout the paper, the analyses and experiments are constructed on the assumption that different clients have the same model partition. Only the experiment “FADE (Mixing)” assumes that different clients have different model partitions, yet the detail of implementation is unclear. For the case that different clients have different model partitions, I wonder how to aggregate model parameters when the data across clients are heterogenous.
2.	When talking about Decoupled Greedy Learning (DGL), the authors can give some explanations and examples of locally supervised loss. As a reader, why and how to use locally supervised loss is unclear.
3.	In related work, the authors should give some introduction of FedDynAT and FedRBN, both of which are compared in the experiments.
4.	There are some typos. In the third paragraph of section 2, “Decouled Greedy Learning (DGL)” should be “Decoupled Greedy Learning (DGL)”. In line 8 and 9 of Algorithm 1, $\Theta^{(t+1)}_{m_k^t,k}$ should be $\Theta^{(t+1)}_{m_k^t}$ to be consistent with the notations in section “Decoupled Greedy Learning (DGL)”.

clarity,_quality,_novelty_and_reproducibility: Quality: The quality of this paper is good. The authors propose to exploit Decoupled Learning in Federated Adversarial Learning and provide the corresponding trade-off technique and theoretical guarantee.
Clarity: The clarity of this paper needs to be improved. In section 3.1, the meaning of Eq. 9 conflicts with the above description of it and the meaning of Figure 2. The authors said that the proposed method can ensure flexible model partitions, that is to say, different clients have different model partitions, as shown in Figure 2. However, what Eq. 9 means is only for the case that different clients have the same model partition. Additionally, there are some typos and unclear writings (See in “Strength And Weaknesses”).
Originality: The originality of this paper is limited. The authors incorporate Decoupled Learning into Federated Adversarial Learning and propose a weight decay strategy. However, analyses for the case that different clients have different module partitions are lacking.

summary_of_the_review: This paper focuses on federated adversarial training (FAT) on resource-constrained edge devices. The authors propose to exploit Decoupled Learning in Federated Adversarial Learning and provide the corresponding trade-off technique and theoretical guarantee. However, analyses for the case that different clients have different module partitions are lacking and the clarity needs to be improved (See in “Strength And Weaknesses”). 

==I read the authors' rebuttal and comments from other PCs, I updated my scorings for its merits and shortcominings.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: The paper proposes a framework named Federated Adversarial Decoupled Learning (FADE) to enable adversarial training on resource-constrained edge devices.  The authors provide the theoretical guarantee for the convergence of the proposed algorithm and conduct experiments to empirically verify the effectiveness of FADE w.r.t. to adversarial robustness.

Despite the fact that the reviewers raised their scores, they remained concerned about several issues. As a result, they maintained a "borderline" recommendation overall. Issues that remained were:
(a) The technical novelty of the proposed method is limited as it simply applies decoupled learning in the federated adversarial learning setting.
(b)  Experiments could be further improved, along the line indicated in the reviews. 
(c) Forward passing is still required in the first training round, which impacts the efficiency of the proposed method.
(d) Presentation overall could be improved, along the suggestions provided in the last review
justification_for_why_not_higher_score: See above
justification_for_why_not_lower_score: NA
Decision: Reject