Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The vulnerability of DNNs to adversarial examples is related to local non-smoothness and the steepness of loss landscapes. To solve the above problem, the main contribution of this paper is that they explore the existence of collaborative examples by simply adapting the PGD method by gradient descent rather than gradient ascent in the original PGD. They propose squeeze training (ST) by considering utilizing collaborative examples and adversarial examples jointly during training to regularize non-smooth regions of the whole loss landscape. Empirically, their method can outperform some SOTA methods under various attacks and datasets.
strength_and_weaknesses: Strength:

1. Using collaborative samples in adversarial training is novel and effective, and it can be used as a plugin for some data augmentation-based adversarial training methods.

2. The proposed ST method is simple and effective, and the theoretical analysis is reasonable and correct.

3. They conduct comprehensive experiments to evaluate the performance of the proposed ST.


Weaknesses:

1. P4, Sec. 3.2, Paragraph 3: Line 1 ‘using the method introduced in Section 3.1. Eq. (5)’ should be Eq. (4).

2. One question is the ratio and sample size of adversarial examples and collaborative examples in ST. Is the total sample size for ST twice the sample size of regular adversarial training or is the sample size the same and adversarial examples and collaborative examples each account for 50%?

3. P8, Sec. 5.1, Table 2: In the comparison between ST and TRADES, the scaling factor values are inconsistent. Can you explain why not adopt the same values of scaling factor, since ST and TRADES are based on similar ideas?

4. The idea of ST in this paper is based on TRADES, and the generation of collaborative examples is based on the reverse operation of PGD. The idea is novel, but the innovation is slightly weak.

clarity,_quality,_novelty_and_reproducibility: Pls see the above comments.
summary_of_the_review: Pls see the above comments.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: The authors study adversarially robust learning where the goal is to train a model that predicts correctly, even under small, worst-case perturbations of its inputs. The authors focus on “collaborative examples”: inputs close to natural ones that have been perturbed to induce very low loss. These examples are then incorporated into an adversarial training method which the authors find to slightly improve over existing ones. Essentially, the idea is: instead of minimizing the difference in prediction between the original example and its adversarial counterpart (e.g., TRADES), minimize the difference in prediction between any pair of points within the L-p ball around the original example.
strength_and_weaknesses: Strenghts:

- The idea of minimizing the maximum prediction difference across arbitrary pairs of points within the Lp ball is interesting and, to the best of my knowledge, novel.
- The experimental results do show a consistent improvement in the robustness and accuracy of the resulting model, even against strong attacks such as Auto-Attack.

Weaknesses:

- I did not find the discussion around “collaborative examples” particularly insightful. The existence of such examples is more or less implied by the existence of adversarial examples in the first place (if increasing the loss with small perturbations is easy, one would expect that decreasing the loss would be easy as well).
- The motivation of the proposed method is not entirely clear. If the goal is to reduce the worst-case error, why does the best-case error have an effect? Is there a fundamental reason or does it happen to help make the loss smoother in practice?
- Relatedly, the proposed method cannot be directly compared with existing approaches since (as the authors note in Appendix C) their method includes additional examples computed from the inner optimization loop. Comparing with other methods that use more inner steps is not a direct comparison. Instead, it would be useful to compare to variants of these methods that, say, compute two adversarial examples in the inner loop and train on the worst one or on both.
clarity,_quality,_novelty_and_reproducibility: Clarity: The paper is easy to understand.

Quality: The experimental results are compelling but some additional analysis/justification of the results would be beneficial.

Novelty: The core idea is novel to the best of my knowledge.

Reproducibility: The paper explain the high level ideas needed to reproduce their work but do not provide code at this point.
summary_of_the_review: The main idea proposed is interesting and does provide non-trivial improvements on a number of datasets. However, the justification and analysis of the method could be significantly improved. 

---
Given the additional experimental results provided by the authors, I believe that the analysis is sufficient to support the claims of the paper. I thus increase my score.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The authors propose a simple modification to existing adversarial training methods - rather than merely using adversarial examples that are meant to maximize classification loss, they propose to use collaborative examples which minimize the training loss. The training formulation minimizes a distance such as the symmetric KL divergence between the adversarial and collaborative examples to impose a stricter smoothness constraint when compared to existing methods. The method shows consistent gains over existing methods on CIFAR-10, CIFAR-100 and SVHN, and scales to WideResNet models as well. 
strength_and_weaknesses: 
Strengths - 
- This work builds upon existing methods to propose a simple and intuitive change that shows consistent performance gains. 
- The observation that merely using collaborative examples can improve adversarial robustness is interesting. 
- The observation that TRADES training indeed results in the generation of collaborative examples in some cases is surprising and interesting. 
- The paper is well written and clear. 

Weaknesses - 
- The performance gains are marginal - hence it is important to perform more ablation experiments to ensure that the gains are indeed due to the use of collaborative examples. (some suggestions mentioned below)
- Attack generation part of Algorithm-1 can be discussed in more detail. Specifically, how does this attack ensure max and min loss, rather than two examples which are far from each other? 

Questions for rebuttal - 
- It is possible that collaborative example based training causes gradient masking and hence shows improved robustness. Could the authors share AutoAttack accuracy of the best epoch of each case in Fig.4? 
- Could the authors also compare with TRADES defense where CE loss is used in the inner maximization step, as discussed in [1]?
- It is not clear how well the inner maximization can generate collaborative and adversarial examples given a common generation step. Could the authors compare the loss of the resulting examples with the loss obtained when CE loss is maximized or minimized independently?
- It would be interesting to see what happens when adversarial examples are first generated by maximizing CE loss, and in a next step, collaborative examples are generated to maximize the KL divergence w.r.t. the adversarial examples. 

[1] Gowal et al., Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples

clarity,_quality,_novelty_and_reproducibility: The paper is clear, well-written and has sufficient novelty. Hyperparameters used have been discussed. The authors are encouraged to share the code as well.
summary_of_the_review: The work presents a simple and intuitive change to existing adversarial training algorithms and shows improvements over existing methods. Some more ablations would ascertain the importance of collaborative examples further. Hence I recommend a borderline accept for now. 

--- Post Rebuttal update ---

I thank the authors for the rebuttal and I would like to maintain my score.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: In this paper, the authors tackle adversarial training. They pay more attention to the valley region of the loss landscape of DNNs. This is where collaborative examples exists. Collaborative examples fall within a bounded region of a benign example while having very small loss values. The authors first show that such examples can be directly used to improve the adversarial robustness of DNNs. Next they show that such examples in conjunction with adversarial examples (where they are both treated equally) can give an even higher boost to the robustness of DNNs. This is known as squeeze training as it "squeezes possible prediction gaps and jointly regularizes the two sorts of non-smooth and steep regions in the loss landscape". The authors compare their proposed method against multiple state of the art adversarial training methods. They also show how the choice of the regularization function impacts the robustness. Furthermore, they show that proposed method can also be extended to other adversarial training methods like RST.
strength_and_weaknesses: Strengths
1. The paper is well written. The main idea of the paper is presented in an effective manner. This is followed by initial results with just collaborative examples, then squeeze training and others.
2. The idea of using collaborative examples is an interesting one. The authors show that such examples alongside adversarial examples, not only improves robustness but also shows less degradation on the clean dataset. The results seem to hold across a large variety of datasets as well. 
3. Another strength of the proposed method is its extendability to other adversarial training methods. The authors show that this can be done easily and that it still yields better results.

Weakness
1. While I like the idea of collaborative examples presented in this paper, the paper can still benefit from an explanation regarding why such examples would be useful in adversarial training. From the perspective of the model these examples are "easy". So, in principle the model should not learn many useful information from such examples. However, we see that when used in conjunction with adversarial examples and the regularization function the results are impressive.
2. In this work, the authors use the whole dataset when doing collaborative training. This should incur increased cost. I wonder if the whole dataset is necessary or not. Some analysis on this regard will also help shed further light to the nature of the collaborative examples.
3. Extending on the previous point, I would have liked to see a further analysis on the cost of doing squeeze training. I noticed some analysis in the appendix. However, I would have liked to seen a more in depth analysis regarding cost vs gain.
4. Similarly I would have liked to see more details about the experiments. I might have missed it but I did not see a lot of discussion about the split. In particular I want to know how the adversarial examples for the test cases were sampled.
5. The authors can also consider adding imagenet dataset in their experiments.

clarity,_quality,_novelty_and_reproducibility: As mentioned above the paper is easy to follow. The paper on its own is not very novel as the others are inspired by multiple other works. However, combining those ideas in adversarial training is novel indeed. Finally, I think the authors need to provide more details to make the results reproducible.
summary_of_the_review: In this empirical paper, the proposed squeeze method shows impressive performance across multiple datasets. However, as mentioned above some further analysis could elevate this paper further.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: The paper suggest that during adversarial training one should not penalize just the "worst case adversarial example" (lowest confidence in correct class) but the difference of worst and best case (highest confidence in correct class in the ball around the target example). While this doubles the computational effort during training (two attacks have to be done simultaneously), the authors show that this consistently improves over other adversarial training approaches (in particular TRADES which is closest to the suggested approach).

Strength:
- interesting, novel and simple modification of TRADES which is effective
- experimental gains are small but seem to be consistent. The new results which take into account the extra work of the suggested method still show an advantage (Table 6)

Weakness:
- there is little motivation for the method, the theoretical connection to the local Lipschitz constant could be improved (in one answer in the rebuttal it looks like that the local Lipschitz constant gets better but it is not directly measured)
- the experimental gains are small and for some runs (Table 3/4) no standard deviation is reported

The authors could clarify all doubts and questions of the reviewers, in particular regarding a fair comparison to existing approaches due to their two times increased computational effort. All reviewers recommend acceptance of the paper.

For the final version I suggest to:
- include the experiments with fair comparison regarding computational cost in the main paper
- report local Lipschitz constants for different AT alternatives
- check effect on other threat models like $l_2$
justification_for_why_not_higher_score: The motivation of the method e.g. regarding improving local Lipschitz constants could be improved. While the method seems to lead to consistent improvements, the gains in performance are small.
justification_for_why_not_lower_score: The experiments look solid (strong attacks like AutoAttack are used for evaluation), the improvements are consistent over three datasets. The method is simple and efficient and seems even outperform existing methods when one considers the doubled computational effort.
Decision: Accept: poster