Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper proposes kernel average pooling operation to improve model robustness.
strength_and_weaknesses: Strength
- The proposed operation is simple and economic.

Weaknesses
- The paper is not well-presented and well-written. 
   -  In the introduction section, it jumps direction into "our central premise in this work" to talk about ensemble without any hints or smooth transition.
   - Especially, the section about kernel average pool is not clear and solid. Equation (3) does not make sense to me because $w_i.x$ for all $i$. It is hard to interpret this operation. The authors should give more context about the shape of $x$, $z$ and so on. In Algorithm 1, it seems that KAP is average pooling over the depth. So it is not novel to me. Additionally, after applying average pooling over the depth, the output tensor gets smaller, how you can get back the shape W,H,D as in the last line of Algorithm 1.
- There are some vague arguments to me, for example "individual kernels within a network are robust". How can we justify if a kernel is robust?
- How to interpret and understand Equation (9) because I cannot see any random factor in KAP.
- The experiments are humble without comparing to other SOTA baselines. 
clarity,_quality,_novelty_and_reproducibility: - The KAP operation seems not novel. It is unclear how it contributes to improve model robustness.
- The technicality of KAP is not clear and it lacks strong discussions about KAP in improving robustness.
- It lacks the comparison to other baselines. 
summary_of_the_review: This paper considers KAP operation to improve model robustness. It says that KAP focuses on learning feature ensembles that form local “committees” similar to those used in Boosting and Random Forests. However, I cannot see how KAP realizes feature ensembles. It seems to me that KAP is average pooling over the depth.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper tackles an important problem of the adversarial robustness of neural networks. Specifically, the authors of the paper propose a novel "kernel average pooling" layer that can be readily applied to most of the existing network architectures. Inspired by the recent success of neural network ensembles, the kernel average pooling layer applies a mean filter along the kernel dimension of the layer activation tensor. The authors of the paper also insights into why such a pooling layer can combat the problem of adversarial robustness, and conduct a series of experiments to demonstrate the effectiveness of the proposed method. 
strength_and_weaknesses: Strength:
- The paper is well-written and easy to follow. 
- The proposed method is technically sound and well motivated. 
- The experiments are carefully conducted. 
- The method seems to provide reasonable improvement in terms of adversarial robustness. 

Weaknesses: 
- Overall, I find this to be an interesting approach. The main complaint I have regarding this approach is that the robustness comes at the cost of significantly lower clean data accuracy, and at the same time, the improvement of adversarial robustness is not consistent, as seen from the fact that regular ResNet18 model with activation noise can sometimes outperform the proposed method in terms of adversarial robustness. 
- While there are some insights offered on why the proposed method can help adversarial robustness in section 3.4, most of the explanation is quite descriptive and lacks concrete details in my opinion. It might be good to go in-depth on this and offer some additional insights mathematically. 
- Maybe it makes sense to also benchmark the proposed method against some other cheap ensembling methods, such as [1]? 
- Other than adversarial robustness, does the proposed method offer other benefits? Does it help combat robustness against natural noise, model calibration, etc., since these are common benefits observed from a regular neural network ensemble? It might be interesting to investigate further other potential benefits as well.

[1] Wen, Yeming, Dustin Tran, and Jimmy Ba. "Batchensemble: an alternative approach to efficient ensemble and lifelong learning." arXiv preprint arXiv:2002.06715 (2020).
clarity,_quality,_novelty_and_reproducibility: the paper is well written. The method is carefully described and sufficient information is provided to reproduce results. 
summary_of_the_review: All in all, despite the interesting approach and observation of the proposed method, there are several limitations regarding the proposed approach. As such, I think the paper is marginally above the acceptance threshold.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: The authors propose an algorithm to improve the adversarial robustness of neural networks based on kernel averaging and noise. They show that their method is competitive with adversarial training in some cases. However, the algorithm description is not clear enough and there are also not sufficient investigations on why the method works. 

strength_and_weaknesses: Strengths: 
- The authors combine averaging kernels with additive noise to improve the robustness of neural networks against adversarial attacks; some of these ingredients are known to help improve robustness.  

- The method is competitive with state-of-art methods based on adversarial training on some datasets, without the use of adversarial training. 

Weaknesses: 
- Although there are some good empirical results, it is hard to understand and verify why the method works. Is it due to the use of noise for regularization in the network, or the use of averaging of kernels, or both? There is no ablation studies on these factors that might contribute to the robustness of the model, making the current study difficult to understand and reproduce. 

- The authors described 2D kernel averaging in Appendix A1. Yet unlike the spatial dimensions, there is no topological structure relating the different kernel dimensions. Why choose 2d instead of 3d or 1d? 

- While noise is known to improve robustness in previous work, it is not clear why kernel averaging helps improve robustness. The authors should consider further empirical/theoretical analysis to illustrate why it works, such as looking at its smoothing properties or effects on Lipschitz constants of the network. 

clarity,_quality,_novelty_and_reproducibility: - This paper has problems with clarity. The description of the algorithm is difficult to understand. The notations in Algorithm 1 such as Vec, Vec^-1, Pad, AvePool are not properly defined. 
- Noise is used in the proposed algorithm (experiments in Section 4) but the authors have not been properly described how they are used in the algorithm in Section 3
- The clearest explanation of kernel average pooling is in Appendix A1; the descriptions in Section 3.2 and Algorithm 1 are not helpful compared to Figure A1. The authors should consider revising that section by including the figure. 

summary_of_the_review: The authors present a method for improving the robustness of neural networks based on kernel averaging and additive noise. Although there are some encouraging empirical results, it is difficult to understand why the method works. The authors should improve the presentation of the method, especially description of the algorithm, to improve the readability of the paper. The authors should also consider including ablation studies to help the readers understand what makes the method work.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper proposes an architectural component called kernel average pooling which averages kernels (channels) of the input to the kernel average pooling layer.  They show that when using multiple KAP layers combined with random noise added to the input of each KAP layer, the adversarial robustness of the final model increases.
strength_and_weaknesses: Strengths:
- writing is clear and easy to understand
- diagrams help with understanding KAP
- experiments on a variety of datasets

Weaknesses:
- questionable robustness- Since this work proposes a randomized defense (without proposing or testing any adaptive attack against this defense) it is unclear whether KAP really provides robustness or not.
- lack of ablation- the work immediately jumps into using multiple KAP layers with noise added before every layer.  What happens if you only add noise to the input?  Would using KAP improve on certified robustness via randomized smoothing in this case?  What about changing the number of KAP layers vs regular convolutional layers?
- For CIFAR-10, I think the robust accuracy numbers for AT are a little low, probably due to suboptimal hyperparameters.  Could the authors use the training setup from Gowal et al. 2020?  I think that the choice in learning rate scheduler seems to change robustness numbers of AT by a lot.
Gowal, Sven, et al. "Uncovering the limits of adversarial training against norm-bounded adversarial examples." arXiv preprint arXiv:2010.03593 (2020).
- Since TRADES is also commonly used, it would also be good to use TRADES as a baseline too (using the training setup from Gowal et al 2020)
- It would also be interesting to provide results on L2 robustness as well; after all the motivation of KAP was based on randomized smoothing which is a defense against L2 attacks.
clarity,_quality,_novelty_and_reproducibility: I think overall the writing is clear and the proposed technique, KAP, is novel.  I do have some concerns about the rigor of the experiments though (see weaknesses), especially since many randomized empirical defenses have been proposed in the past, but these have also been broken by stronger attacks (ie. Sitawarin et al. 2022).

Sitawarin, Chawin, Zachary J. Golan-Strieb, and David Wagner. "Demystifying the adversarial robustness of random transformation defenses." International Conference on Machine Learning. PMLR, 2022.
summary_of_the_review: Overall, I think that the authors should try using adaptive attacks against KAP and perform more ablations to better understand the impact of the noise in KAP and the impact of KAP layers on robustness.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: This paper looks at improving adversarial robustness, motivated by ensemble-like strategies. In particular, the authors propose kernel average pooling, a layer for neural networks takes the average filter from the kernel dimension of intermediate features. The authors claim this produces functionality similar to an ensemble of kernels. They then validate their approach empirically against adversarial attacks on several image datasets.

There are two major complaints cited by reviewers that I particularly agree with.

+ Inconsistent empirical results, with even the regular model outperforming in adversarial robustness.
+ There's not much description behind why the strategy might work, either theoretically or with empirical intuition (e.g., toy examples). The paper makes several claims in general that aren't really backed up.

All reviewers leaned toward reject, and I agree with their opinion.
justification_for_why_not_higher_score: I listed 2 reasons above in my review:

+ Inconsistent empirical results, with even the regular model outperforming in adversarial robustness.
+ There's not much description behind why the strategy might work, either theoretically or with empirical intuition (e.g., toy examples). The paper makes several claims in general that aren't really backed up.
Decision: Reject