Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper introduces a new empirical defense against adversarial examples. The new defense is competitive to SOTA adversarial training based defenses, but does not use adversarial training. Specifically, the paper proposes adding an additional loss to the standard classification loss which “smoothens” the feature maps of a specific layer in the model. At test time, random noise is added to each input, then the input is smoothened out (in an attempt to remove the adversary), by minimizing the Smoothening loss introduced earlier with respect to the input. The introduced defense is rigorously evaluated using SOTA attacks and shows competitive robust accuracies to adversarially-trained models on CIFAR-10 and CIFAR-100.

main_review: ### Strengths:
- The introduced defense is sound and novel
- The defense does not depend on adversarial training, so it is quite fast to train in practice compared to adversarial training.
- The defense is evaluated using standard white-box and blackbox attacks and compares to SOTA robustness benchmarks.

### Weaknesses:
- The new defense requires smoothening the input at test time, which requires multiple (200 - 400) forward-backward runs through the network, which might be impractical in some scenarios.
- The writing quality can be improved and it is hard to follow some sections on the paper.
- The submission does not include code. 

### Detailed questions/suggestions:	
- As I understand, at test time, the defense smoothens the input by adding noise and doing 200-400 iterations through the network to minimize the smoothing loss. Does this have to be sequential? Or could these be done in parallel (batches)? This matters for assessing the practicality of the defenses. That being said, it would also be helpful to add an inference time table to make this clearer for the reader.
- The paper mentions: “What is the consequence if we make the image smoother further, i.e., to decrease L_{F^l} ? The natural effect will be the increase of cross-entropy loss L_{ce} , but the drop in classification accuracy should be small since L_{F^l} and L_{ce} are comfortable with each other.” in an attempt to justify or motivate the introduced loss? But I didn’t really get what this means. What does it mean that two losses are “comfortable with each other”? I think this is too hand-wavy and I encourage the authors to fix this.
- I am curious how the defense scales to ImageNet.
- I am not sure what Fig 4 and 5 are adding to the paper. What should the reader be looking at in these figures? I think adding takeaways of these figs in text or caption should be helpful.

### Small changes:
In Alg 1, “s” should be “l”.


summary_of_the_review: Overall I think the introduced defense is novel and sound. The new defense is faster at training time than adversarial training, but slower at inference time. It achieves slightly better accuracies than SOTA and is properly evaluated to the best of my knowledge on white-box and black-box attacks. I will give a score of “marginally above the acceptance threshold” since the paper quality can be improved, and since I have several questions which I think require clarification from the authors (see above).
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper proposes a defense against adversarial attacks that does not involve using attacks in the defense process. The defense consists of two parts: first, a feature smoothing loss is added to the main objective function during training. Then, when defending against attacks, noise is added to the input followed by additional perturbations to the input designed to decrease the feature smoothing loss. The proposed method achieves favorable accuracies relative to baseline defenses.
main_review: Strengths
1. The paper develops an effective and simple adversarial defense that requires only adding a simple regularization term during training, and additional processing of inputs during testing.
2. The proposed defense appears to outperform baseline defenses on strong attacks. The accuracies achieved by the defense appear competitive.

Weaknesses
1. The proposed defense is novel, but some ideas are similar to ones previously proposed in the literature. In particular, the idea of feature smoothing is related to prior work as noted in section 2. Moreover, the idea of adding noise to inputs as a defense has been explored in the literature on randomized smoothing.
2. The proposed defense is not theoretically motivated. This is not strictly necessary given the strong empirical results; however, it would be helpful to provide further intuition on why the interaction between feature smoothing during training and during active defense may enhance adversarial robustness.
3. It is not clear to what extent the noise (step 1 of active defense) by itself enhances robustness vs. the feature smoothing step of the active defense. The authors demonstrate that standard training by itself with active defense is ineffective, indicating the importance of the feature smoothing loss during training. It would be helpful to conduct a similar ablation experiment to evaluate the importance of the noise vs. feature smoothing steps in the active defense.
4. It is possible that the high performance of the proposed method is due to obfuscated gradients since for the attacker, optimizing inputs through the active defense may be more difficult. Adding additional experiments to demonstrate that obfuscated gradients do not occur would strengthen the paper (the authors may want to consider the experiments in Athalye et al., 2018).
5. The authors do not state whether the proposed method is state-of-the-art. To the best of their knowledge, do the authors achieve state-of-the-art robust accuracy on CIFAR-10 at $\epsilon=8/255$?
6. What is the role of the L1/absolute value penalty in eqn 3? Would the method still be effective with an L2/square penalty?

Minor comments
1. Some typos: "AutoAttak" in section 3, " It needs to emphasize here " -> " It needs to be emphasized here" in section 5


summary_of_the_review: The proposed method appears to achieve state-of-the-art performance. However, fully demonstrating this will require addressing the possibility of obfuscated gradients. Moreover, understanding the role of noise in the active defense via an ablation experiment will be important to see which aspects of the method actually improve robustness. If the authors can address these points, the paper would be significantly improved.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper aims to provide an approach to train a robust model, where the model is trained without adversarial examples. To this end, the authors introduce an inference-time defense strategy. However, this idea is not novel. Moreover, the inference-time defense strategy may give false robustness.
main_review: The motivation of its current version is unclear. The performance gain of robustness is not convincing. 

- The feature smoothing method is proposed for training robust model, but it also is used in the test phase. The motivation for applying this strategy in the test phase is unclear. Intuitively, removing the inference-time smoothing operation (the backpropagation process) will degrade the accuracy of the proposed method.
- The proposed method is actually ‘attack’ the generation process of adversarial examples, so this strategy may give false robustness. This kind of approach is not novel [1].
- Besides adaptive attack, the criterion suggested by [2] is also necessary to verify the robustness.

[1] Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attacks. arXiv
[2] Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. ICML2018

summary_of_the_review: The motivation of its current version is unclear. The performance gain of robustness is not convincing.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: The paper proposes a new defense strategy involving both randomization and smoothing.  To my knowledge, no other paper has proposed precisely the same defense.
main_review: The most significant concern I have is that the “adaptive attack” is not, in my view, a sufficient try at breaking the proposed method.  The authors should perform an adaptive PGD attack where each gradient is computed as follows: Draw multiple samples of random noise, add each of them individually to your current adversarial example iterate, run Algorithm 1 for each of the noised examples, plug the resulting images into the model to obtain a cross-entropy (also try CW) loss value, and finally backprop through the entire Algorithm 1 to compute a gradient with respect to the adversarial example iterate.
 
Imagenet experiments would be greatly appreciated as ImageNet data is far higher dimensional, more realistic, and typically has very different properties than low-dimensional data.

There are several issues with the writing of Algorithm 1:  What is lower case ell?  Also, s is only computed and never used or output.

Just a note about formatting.  The authors should be careful about the difference between \citep and \citet natbib commands.  Additionally, there are numerous grammatical errors and misspellings which should be corrected before publication.
summary_of_the_review: The "adaptive attack" is not sufficient and needs improvement.  I am highly skeptical that this defense will stand up to scrutiny, and I don't think the current experiments demonstrate that it will.
review_title: null

Meta-review: This paper suggests a novel defense against adversarial perturbations where during training a loss term is added which enforces similar feature representations.
At test time: i) noise is added, ii) the feature loss is minimized

The authors report excellent results against AutoAttack but the problem is that AutoAttack expects a static, non-randomized defense. Both is not the case for the defense proposed in the present paper. Therefore,  the evaluation with AutoAttack could significantly overestimate the actual robustness and the evaluation of the paper is therefore not valid. Thus adaptive attacks are needed, which are tailored to the defense mechanism, see e.g. Carlini et al, On Evaluating Adversarial Robustness, https://arxiv.org/abs/1902.0670. 

As two reviewers noticed, the suggested "adaptive attack" in the paper is not properly attacking the whole defense mechanism by unrolling the test time optimization and using additionally EOT. Thus it is unclear at the moment if the method is really robust. Moreover, the inference time is significantly increased so that it is questionable if this approach is practically relevant. Therefore this paper is not ready for publication yet.
Decision: Reject